From 1fc81ddb04d3ff5ceb7690be4f5666dcafca87df Mon Sep 17 00:00:00 2001
From: praboth charith - GBS - CLI <probothcharith@gmail.com>
Date: Wed, 28 Oct 2026 10:16:07 +0530
Subject: [PATCH] style: format documentation and test files according to
 prettier rules

---
 docs/API.md                   |  4 +--
 docs/PERFORMANCE_PROFILING.md | 43 +++++++++++++++----------
 docs/PUBLISH_REHEARSAL.md     | 22 +++++++------
 docs/RELEASE_PROPOSAL_M5.md   | 38 +++++++++++-----------
 docs/ROADMAP.md               | 60 +++++++++++++++++------------------
 docs/SECURITY_AUDIT.md        | 24 +++++++++-----
 docs/SUPPORTED_MATRIX.md      | 43 ++++++++++++++++---------
 examples/basic-usage/main.tsx |  6 ++--
 examples/index.html           |  6 ++--
 tests/browser/widget.spec.ts  |  1 -
 10 files changed, 140 insertions(+), 107 deletions(-)

diff --git a/docs/API.md b/docs/API.md
index 81866a3..af2cd2c 100644
--- a/docs/API.md
+++ b/docs/API.md
@@ -28,8 +28,8 @@ All exports are named from `accessibility-plugin-react`. JavaScript consumers re
 | DictionaryController                 | Optional `className?: string`, `label?: string`, `description?: string`, `provider?: DictionaryProvider                                                                                                                                                                                                                                                                                                                                | null`, `defaultOpen?: boolean`, `initialTerm?: string`. Accessible dictionary lookup dialog with zero network requests by default, local glossaries, and sanitization. See docs/DICTIONARY.md. |
 | VoiceNavigationController            | Optional `className?: string`, `label?: string`, `description?: string`. Opt-in research prototype controller enabling browser-native speech commands with inactivity watchdog and keyboard fallback buttons. See docs/VOICE_NAVIGATION.md.                                                                                                                                                                                            |
 | TranslationController                | Optional `className?: string`, `label?: string`, `description?: string`, `provider?: TranslationAdapter`, `defaultTargetLanguage?: string`. Host-content translation adapter prototype with explicit consent, privacy boundaries, sensitive element exclusion, and DOM restoration. See docs/TRANSLATION.md.                                                                                                                           |
-| SmartContrastController              | Optional `className?: string`, `label?: string`, `description?: string`, `options?: SmartContrastOptions`. Measured smart contrast research prototype with relative luminance, alpha compositing, live statistics, and non-destructive restoration. See docs/SMART_CONTRAST.md.                                                                                                                                                       |
-| DiagnosticsHarness                   | Optional `config?: DiagnosticsConfig`, `visible?: boolean`, `className?: string`. Development-only integration diagnostics harness inspecting containing-block traps, CSP, host CSS, and accessibility landmarks. See docs/DIAGNOSTICS.md.                                                                                                                                                                                               |
+| SmartContrastController              | Optional `className?: string`, `label?: string`, `description?: string`, `options?: SmartContrastOptions`. Measured smart contrast research prototype with relative luminance, alpha compositing, live statistics, and non-destructive restoration. See docs/SMART_CONTRAST.md.                                                                                                                                                        |
+| DiagnosticsHarness                   | Optional `config?: DiagnosticsConfig`, `visible?: boolean`, `className?: string`. Development-only integration diagnostics harness inspecting containing-block traps, CSP, host CSS, and accessibility landmarks. See docs/DIAGNOSTICS.md.                                                                                                                                                                                             |
 | All other controllers in FEATURES.md | Pick/omit in JSX. For custom labels or behavior, compose a control with useAccessibility or the modular control primitives.                                                                                                                                                                                                                                                                                                            |
 
 Use one button/list pair per provider and one provider per document. UI IDs use React `useId`; do not target the old fixed `arap-panel` ID. Plugin children can include ordinary app content, but mounting the widget as a sibling makes intent clearer. Persistence configuration is fixed at mount; use `<AccessibilityPlugin key={newKey} persistenceKey={newKey}>` when switching storage identity.
diff --git a/docs/PERFORMANCE_PROFILING.md b/docs/PERFORMANCE_PROFILING.md
index 6de9e63..ce82ec7 100644
--- a/docs/PERFORMANCE_PROFILING.md
+++ b/docs/PERFORMANCE_PROFILING.md
@@ -9,28 +9,31 @@ This document records empirical performance profiling, bundle size analysis, lis
 ## 1. Bundle and chunk size analysis
 
 ### Library Distribution Assets (`dist/`)
+
 Built with `tsup` targeting ES2020:
 
-| Asset | Description | Raw Size | Gzip Size | Brotli Size |
-| :--- | :--- | :--- | :--- | :--- |
-| `dist/index.mjs` | ESM bundle (all components, controllers, engines, offline dictionary) | 603.27 KB | 111.48 KB | 86.04 KB |
-| `dist/index.js` | CommonJS bundle | 636.96 KB | 114.52 KB | 87.33 KB |
-| `dist/style.css` | Scoped CSS stylesheet | 71.31 KB | 11.31 KB | 9.57 KB |
-| `dist/index.d.mts` | TypeScript ESM declarations | 83.58 KB | 22.07 KB | 18.48 KB |
-| `dist/index.d.ts` | TypeScript CommonJS declarations | 83.58 KB | 22.07 KB | 18.48 KB |
+| Asset              | Description                                                           | Raw Size  | Gzip Size | Brotli Size |
+| :----------------- | :-------------------------------------------------------------------- | :-------- | :-------- | :---------- |
+| `dist/index.mjs`   | ESM bundle (all components, controllers, engines, offline dictionary) | 603.27 KB | 111.48 KB | 86.04 KB    |
+| `dist/index.js`    | CommonJS bundle                                                       | 636.96 KB | 114.52 KB | 87.33 KB    |
+| `dist/style.css`   | Scoped CSS stylesheet                                                 | 71.31 KB  | 11.31 KB  | 9.57 KB     |
+| `dist/index.d.mts` | TypeScript ESM declarations                                           | 83.58 KB  | 22.07 KB  | 18.48 KB    |
+| `dist/index.d.ts`  | TypeScript CommonJS declarations                                      | 83.58 KB  | 22.07 KB  | 18.48 KB    |
 
 ### Module Composition & Offline Guarantees
+
 - **Offline Glossary & Dictionaries**: Contains built-in glossaries (English, Sinhala, Tamil) allowing instantaneous client-side definitions without external API latency, rate limits, or network tracking.
 - **Zero Runtime Dependencies**: The package relies exclusively on React and React DOM as peer dependencies. Zero external icon fonts, CSS frameworks, or animation libraries are bundled.
 
 ### Real Consumer Application Production Builds
+
 Measured in clean consumer testbeds with minification and tree-shaking:
 
-| Consumer Application | Framework / Bundler | Packed Archive Asset | Production Gzip Size |
-| :--- | :--- | :--- | :--- |
-| **React 18 Consumer** | React 18.3.1 + Vite 7 (Rollup) | Application bundle (React + React DOM + Plugin) | **127.36 KB** gzipped |
-| **Next.js 16 App Router** | Next.js 16.2.10 (Webpack 5) | Page Route Chunks (`app/page.js`, `app/route-test/page.js`) | **1.85 KB** gzipped |
-| **Next.js 16 App Router** | Next.js 16.2.10 (Webpack 5) | Shared Vendor Chunks | **59.37 KB – 79.42 KB** gzipped |
+| Consumer Application      | Framework / Bundler            | Packed Archive Asset                                        | Production Gzip Size            |
+| :------------------------ | :----------------------------- | :---------------------------------------------------------- | :------------------------------ |
+| **React 18 Consumer**     | React 18.3.1 + Vite 7 (Rollup) | Application bundle (React + React DOM + Plugin)             | **127.36 KB** gzipped           |
+| **Next.js 16 App Router** | Next.js 16.2.10 (Webpack 5)    | Page Route Chunks (`app/page.js`, `app/route-test/page.js`) | **1.85 KB** gzipped             |
+| **Next.js 16 App Router** | Next.js 16.2.10 (Webpack 5)    | Shared Vendor Chunks                                        | **59.37 KB – 79.42 KB** gzipped |
 
 ---
 
@@ -39,6 +42,7 @@ Measured in clean consumer testbeds with minification and tree-shaking:
 When the accessibility widget is mounted in a host application with the panel closed (the standard idle state), its runtime footprint is strictly constrained:
 
 ### Event Listener Footprint (Closed State)
+
 - **Window Listeners**:
   - `pagehide`: 1 handler attached to synchronously flush any debounced state to storage prior to navigation.
   - `resize`: 1 throttled listener for viewport boundary clamping during repositioning.
@@ -51,7 +55,9 @@ When the accessibility widget is mounted in a host application with the panel cl
   - `0` persistent audio/microphone streams.
 
 ### Feature-Specific Listener Isolation
+
 Listeners for features with dynamic tracking are registered **only while that specific feature is active**:
+
 - **Reading Guide / Reading Mask**: Pointer tracking listeners (`pointermove`, `touchmove`, `scroll`) are attached only when either guide or mask is toggled ON, and are removed immediately upon toggle OFF or reset.
 - **Accessible Tooltips**: Global hover/focus listeners are active only when tooltips are enabled.
 - **Speech & Voice**: Recognition and synthesis listeners attach only during active listening or playback sessions, and disconnect immediately on stop, timeout, visibility change, or unmount.
@@ -64,13 +70,14 @@ To verify that display preferences do not induce perceptible UI lag (jank) or bl
 
 ### Benchmark Results (Automated Vitest / JSDOM Suite)
 
-| Operation | Scope | Target Budget | Measured Duration | Status |
-| :--- | :--- | :--- | :--- | :--- |
-| **Multi-Feature Apply** | 1,000 DOM elements (Text Scale, Line Height, Font Family, Contrast Mode, Hide Images) | < 3,000 ms (JSDOM non-JIT) | **~1,770 ms** | **PASS** |
-| **Full Reset Teardown** | 1,000 DOM elements (Complete style restoration across all nodes) | < 1,500 ms (JSDOM non-JIT) | **~420 ms** | **PASS** |
-| **Real Browser Main Thread** | Chrome 120+ / WebKit (Playwright runtime execution) | < 100 ms | **< 45 ms** | **PASS** |
+| Operation                    | Scope                                                                                 | Target Budget              | Measured Duration | Status   |
+| :--------------------------- | :------------------------------------------------------------------------------------ | :------------------------- | :---------------- | :------- |
+| **Multi-Feature Apply**      | 1,000 DOM elements (Text Scale, Line Height, Font Family, Contrast Mode, Hide Images) | < 3,000 ms (JSDOM non-JIT) | **~1,770 ms**     | **PASS** |
+| **Full Reset Teardown**      | 1,000 DOM elements (Complete style restoration across all nodes)                      | < 1,500 ms (JSDOM non-JIT) | **~420 ms**       | **PASS** |
+| **Real Browser Main Thread** | Chrome 120+ / WebKit (Playwright runtime execution)                                   | < 100 ms                   | **< 45 ms**       | **PASS** |
 
 ### Style Application Efficiency
+
 - Features modify inline styles using direct property assignment or scoped CSS class toggling rather than DOM tree rebuilds.
 - Protected elements (such as `<code>`, `<pre>`, form buttons, meaningful images, and CAPTCHAs) are identified via cached selector filters, avoiding redundant style computation.
 
@@ -79,12 +86,14 @@ To verify that display preferences do not induce perceptible UI lag (jank) or bl
 ## 4. 100 Mount/Unmount and toggle leak stress-testing
 
 ### Mount/Unmount Cycle Verification
+
 - Executed **100 consecutive mount and unmount cycles** of `<AccessibilityPlugin>`:
   - Verified `0` orphaned `.arap-root` or `.arap-panel` DOM nodes remaining in `document.body`.
   - Verified `0` residual `<style id="arap-*">` tags in `document.head`.
   - Verified `0` detached DOM nodes retained in memory.
 
 ### 100 Consecutive Toggle Cycles
+
 - Executed **100 rapid consecutive toggles** across text scale, letter spacing, line height, and image hiding:
   - Asserted that element inline styles return precisely to authored baseline values without compounding drift or rounding errors.
   - Asserted zero residual CSS properties after triggering `Reset All`.
diff --git a/docs/PUBLISH_REHEARSAL.md b/docs/PUBLISH_REHEARSAL.md
index a0d2d9c..980227e 100644
--- a/docs/PUBLISH_REHEARSAL.md
+++ b/docs/PUBLISH_REHEARSAL.md
@@ -10,17 +10,18 @@ This document records the exact archive inspection, tarball packaging rehearsal,
 
 The package archive was built, packed, and inspected via `scripts/check-package.mjs`:
 
-| Inspection Item | Requirement | Measured Result | Status |
-| :--- | :--- | :--- | :--- |
-| **Tarball Location** | Local disposable archive | `.consumers/package.tgz` | **PASS** |
-| **Total Files** | Required bundle, types, CSS, legal, and docs | **61 files** | **PASS** |
-| **Archive Size** | Uncompressed package content | **1,186,512 bytes** (~1.18 MB) | **PASS** |
-| **Client Directives** | Leading `"use client";` on entrypoints | Present in `dist/index.mjs` and `dist/index.js` | **PASS** |
-| **CSS Injection** | Self-contained automatic injection | `styleInject` with `.arap-root` present in bundles | **PASS** |
-| **CSS Isolation** | Zero global element resets | No un-scoped resets on `html`, `body`, `:root`, or `*` | **PASS** |
-| **Legal Files** | Permissive license and attribution | `LICENSE` and `NOTICE` verified in tarball | **PASS** |
+| Inspection Item       | Requirement                                  | Measured Result                                        | Status   |
+| :-------------------- | :------------------------------------------- | :----------------------------------------------------- | :------- |
+| **Tarball Location**  | Local disposable archive                     | `.consumers/package.tgz`                               | **PASS** |
+| **Total Files**       | Required bundle, types, CSS, legal, and docs | **61 files**                                           | **PASS** |
+| **Archive Size**      | Uncompressed package content                 | **1,186,512 bytes** (~1.18 MB)                         | **PASS** |
+| **Client Directives** | Leading `"use client";` on entrypoints       | Present in `dist/index.mjs` and `dist/index.js`        | **PASS** |
+| **CSS Injection**     | Self-contained automatic injection           | `styleInject` with `.arap-root` present in bundles     | **PASS** |
+| **CSS Isolation**     | Zero global element resets                   | No un-scoped resets on `html`, `body`, `:root`, or `*` | **PASS** |
+| **Legal Files**       | Permissive license and attribution           | `LICENSE` and `NOTICE` verified in tarball             | **PASS** |
 
 ### Packed Files Breakdown
+
 - `dist/index.mjs` (ESM build)
 - `dist/index.js` (CommonJS build)
 - `dist/index.d.mts` (ESM TypeScript declarations)
@@ -37,6 +38,7 @@ The package archive was built, packed, and inspected via `scripts/check-package.
 The exact archive (`.consumers/package.tgz`) was installed in isolated consumer testbeds across supported framework versions:
 
 ### React 18 Consumer (`.consumers/react18`)
+
 - **Environment**: React 18.3.1, React DOM 18.3.1, Vite 7.3.7.
 - **Verification**:
   - NodeNext ESM import and SSR hydration: **PASS**
@@ -44,6 +46,7 @@ The exact archive (`.consumers/package.tgz`) was installed in isolated consumer
   - Production Vite rollup build: **PASS** (`dist/assets/index-RXyyFYxY.js` 487.73 KB raw / 130.42 KB gzip).
 
 ### React 19 Consumer (`.consumers/react19`)
+
 - **Environment**: React 19.2.0, React DOM 19.2.0, Tailwind CSS 3.4.19, Vite 7.3.7.
 - **Verification**:
   - NodeNext ESM import and SSR hydration: **PASS**
@@ -52,6 +55,7 @@ The exact archive (`.consumers/package.tgz`) was installed in isolated consumer
   - Tailwind CSS co-existence: Scoped `.arap-*` classes operate without interference from host Tailwind utilities.
 
 ### Next.js 16 Consumer (`.consumers/next`)
+
 - **Environment**: Next.js 16.2.10 (Webpack), React 19.2.0.
 - **Verification**:
   - Server Component layouts: **PASS**
diff --git a/docs/RELEASE_PROPOSAL_M5.md b/docs/RELEASE_PROPOSAL_M5.md
index 08dd7e7..3ee020c 100644
--- a/docs/RELEASE_PROPOSAL_M5.md
+++ b/docs/RELEASE_PROPOSAL_M5.md
@@ -3,7 +3,7 @@
 **Date:** 2026-10-28  
 **Scope:** Milestone 5 — Launch readiness and package hardening (Issues #66, #67, #68, #69, #70, #71)  
 **Parent Trackers:** [Issue #27](https://github.com/prabothcharith/accessibility-plugin-react/issues/27), [Issue #15](https://github.com/prabothcharith/accessibility-plugin-react/issues/15), [Issue #21](https://github.com/prabothcharith/accessibility-plugin-react/issues/21)  
-**Current Registry State:** `accessibility-plugin-react@2.28.0` on npm under tag `latest`  
+**Current Registry State:** `accessibility-plugin-react@2.28.0` on npm under tag `latest`
 
 ---
 
@@ -12,6 +12,7 @@
 Milestone 5 focused on comprehensive package hardening, multi-browser and device matrix verification, runtime profiling, security and dependency auditing, documentation synchronization, and clean consumer publish rehearsals.
 
 All six Milestone 5 sub-issues have completed all functional, programmatic, and integration requirements:
+
 - **A11Y-501 (Issue #66):** Full supported-browser, device, and assistive-technology matrix (`docs/SUPPORTED_MATRIX.md`).
 - **A11Y-502 (Issue #67):** Performance, bundle, listener, and leak profiling (`docs/PERFORMANCE_PROFILING.md`).
 - **A11Y-503 (Issue #68):** Documentation website, API reference, and interactive examples (`CONTRIBUTING.md`, `docs/API.md`, `docs/FEATURES.md`, examples).
@@ -25,13 +26,13 @@ This document reviews the complete verification evidence, evaluates semantic ver
 
 ## 2. Milestone 5 Verification Evidence
 
-| Issue | Area | Verification Artifacts | Status | Results & Key Metrics |
-|---|---|---|---|---|
-| **#66 (A11Y-501)** | Supported Matrix & AT | `docs/SUPPORTED_MATRIX.md`<br>`tests/browser/widget.spec.ts` | **PASS** | • Verified Chromium, Firefox, WebKit, Mobile WebKit, Android emulation.<br>• 400% zoom reflow at 320px CSS viewport width verified without clipping.<br>• Forced-colors protection (`forced-colors: active`) verified.<br>• $\ge 44\text{px} \times 44\text{px}$ touch targets verified across all controls.<br>• Zero universal WCAG claims; automated tests establish semantics, human testing mandatory. |
-| **#67 (A11Y-502)** | Performance & Leaks | `docs/PERFORMANCE_PROFILING.md`<br>`tests/performanceProfiling.test.tsx` | **PASS** | • Distribution bundle: ESM `index.mjs` 603 KB raw / 111 KB gzip; CSS 71 KB raw / 11 KB gzip.<br>• React 18 consumer application bundle: 130 KB gzip.<br>• Closed idle runtime: 0 unthrottled pointer listeners, 0 RAF loops, 0 timers.<br>• 1,000-node DOM scaling: multi-feature application & reset under heavy parallel CPU.<br>• 100 mount/unmount & toggle cycles: 0 leaked DOM nodes, 0 leaked styles, 0 memory drift. |
-| **#68 (A11Y-503)** | Documentation & Examples | `CONTRIBUTING.md`<br>`docs/API.md`<br>`docs/FEATURES.md`<br>`examples/*` | **PASS** | • Added `CONTRIBUTING.md` with PR guidelines, coding conventions, and a11y bounds.<br>• Synchronized `docs/API.md` with complete components table and exported types.<br>• Synchronized `docs/FEATURES.md` with Smart Contrast prototype documentation.<br>• Updated `examples/basic-usage` and `examples/next-app` with all prebuilt controllers. |
-| **#69 (A11Y-504)** | Security & Licenses | `NOTICE`<br>`docs/SECURITY_AUDIT.md`<br>`tests/securityAudit.test.ts` | **PASS** | • 0 runtime dependencies (`dependencies: {}`); 0 `npm audit` vulnerabilities.<br>• Added `NOTICE` attributing ISC license, historical origins, and assets.<br>• Strict CSP compliance: 0 dynamic `eval`, 0 `Function()`, 0 inline script injections.<br>• Strict privacy: 0 network telemetry, 0 analytics, 0 audio/transcript transmission.<br>• Sensitive data protection: automatic credential/password exclusion (`isSensitiveElement`). |
-| **#70 (A11Y-505)** | Publish Rehearsal | `docs/PUBLISH_REHEARSAL.md`<br>`scripts/check-package.mjs` | **PASS** | • Exact tarball `.consumers/package.tgz`: 61 files, 1.18 MB unpacked; includes `NOTICE`.<br>• Clean consumer installations passed in React 18.3.1, React 19.2.0, and Next.js 16.0.0.<br>• Zero SSR hydration mismatches; clean production builds generated across all consumers. |
+| Issue              | Area                     | Verification Artifacts                                                   | Status   | Results & Key Metrics                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| ------------------ | ------------------------ | ------------------------------------------------------------------------ | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **#66 (A11Y-501)** | Supported Matrix & AT    | `docs/SUPPORTED_MATRIX.md`<br>`tests/browser/widget.spec.ts`             | **PASS** | • Verified Chromium, Firefox, WebKit, Mobile WebKit, Android emulation.<br>• 400% zoom reflow at 320px CSS viewport width verified without clipping.<br>• Forced-colors protection (`forced-colors: active`) verified.<br>• $\ge 44\text{px} \times 44\text{px}$ touch targets verified across all controls.<br>• Zero universal WCAG claims; automated tests establish semantics, human testing mandatory.                                  |
+| **#67 (A11Y-502)** | Performance & Leaks      | `docs/PERFORMANCE_PROFILING.md`<br>`tests/performanceProfiling.test.tsx` | **PASS** | • Distribution bundle: ESM `index.mjs` 603 KB raw / 111 KB gzip; CSS 71 KB raw / 11 KB gzip.<br>• React 18 consumer application bundle: 130 KB gzip.<br>• Closed idle runtime: 0 unthrottled pointer listeners, 0 RAF loops, 0 timers.<br>• 1,000-node DOM scaling: multi-feature application & reset under heavy parallel CPU.<br>• 100 mount/unmount & toggle cycles: 0 leaked DOM nodes, 0 leaked styles, 0 memory drift.                 |
+| **#68 (A11Y-503)** | Documentation & Examples | `CONTRIBUTING.md`<br>`docs/API.md`<br>`docs/FEATURES.md`<br>`examples/*` | **PASS** | • Added `CONTRIBUTING.md` with PR guidelines, coding conventions, and a11y bounds.<br>• Synchronized `docs/API.md` with complete components table and exported types.<br>• Synchronized `docs/FEATURES.md` with Smart Contrast prototype documentation.<br>• Updated `examples/basic-usage` and `examples/next-app` with all prebuilt controllers.                                                                                           |
+| **#69 (A11Y-504)** | Security & Licenses      | `NOTICE`<br>`docs/SECURITY_AUDIT.md`<br>`tests/securityAudit.test.ts`    | **PASS** | • 0 runtime dependencies (`dependencies: {}`); 0 `npm audit` vulnerabilities.<br>• Added `NOTICE` attributing ISC license, historical origins, and assets.<br>• Strict CSP compliance: 0 dynamic `eval`, 0 `Function()`, 0 inline script injections.<br>• Strict privacy: 0 network telemetry, 0 analytics, 0 audio/transcript transmission.<br>• Sensitive data protection: automatic credential/password exclusion (`isSensitiveElement`). |
+| **#70 (A11Y-505)** | Publish Rehearsal        | `docs/PUBLISH_REHEARSAL.md`<br>`scripts/check-package.mjs`               | **PASS** | • Exact tarball `.consumers/package.tgz`: 61 files, 1.18 MB unpacked; includes `NOTICE`.<br>• Clean consumer installations passed in React 18.3.1, React 19.2.0, and Next.js 16.0.0.<br>• Zero SSR hydration mismatches; clean production builds generated across all consumers.                                                                                                                                                             |
 
 ---
 
@@ -53,12 +54,12 @@ This document reviews the complete verification evidence, evaluates semantic ver
 We present two valid options for the owner's authorization:
 
 - **Option A (Recommended): Version `2.29.0` (Minor Release)**
-  - *Rationale:* SemVer convention often treats milestone completion and legal attribution additions (`NOTICE` in tarball files) as a minor increment signifying a hardened, launch-ready milestone milestone release. It clearly demarcates the pre-hardening releases (2.28.0 and earlier) from the fully profiled, audited, and matrix-verified release.
-  - *Publish target:* npm tag `latest`.
+  - _Rationale:_ SemVer convention often treats milestone completion and legal attribution additions (`NOTICE` in tarball files) as a minor increment signifying a hardened, launch-ready milestone milestone release. It clearly demarcates the pre-hardening releases (2.28.0 and earlier) from the fully profiled, audited, and matrix-verified release.
+  - _Publish target:_ npm tag `latest`.
 
 - **Option B: Version `2.28.1` (Patch Release)**
-  - *Rationale:* If the owner strictly interprets SemVer to require new public runtime API functions for a minor bump. Because M5 primarily added packaging metadata (`NOTICE`), documentation, and automated test suites without introducing new end-user React components or hooks beyond those already present in 2.28.0, `2.28.1` accurately reflects a hardening patch.
-  - *Publish target:* npm tag `latest`.
+  - _Rationale:_ If the owner strictly interprets SemVer to require new public runtime API functions for a minor bump. Because M5 primarily added packaging metadata (`NOTICE`), documentation, and automated test suites without introducing new end-user React components or hooks beyond those already present in 2.28.0, `2.28.1` accurately reflects a hardening patch.
+  - _Publish target:_ npm tag `latest`.
 
 ---
 
@@ -71,14 +72,14 @@ Issue #15 was created early in the repository lifecycle to track the initial sta
 1. **Issue #4 (Licensing conflict):** Closed. Owner confirmed ISC for all code; `LICENSE` and `NOTICE` are verified.
 2. **Issue #5 (Package identity):** Closed. Owner selected `accessibility-plugin-react`; published under `latest`.
 3. **Issue #6 (Screen-reader accessibility acceptance):**
-   - *Status:* Programmatic accessibility semantics verified via automated axe-core audits and Playwright tests in `tests/browser/widget.spec.ts`.
-   - *Documentation:* `docs/DEVELOPMENT.md` and `docs/SUPPORTED_MATRIX.md` document detailed manual VoiceOver, NVDA, and TalkBack protocols.
-   - *Policy:* Automated tests do not certify WCAG compliance; continuous human assistive technology testing remains an active operational discipline.
+   - _Status:_ Programmatic accessibility semantics verified via automated axe-core audits and Playwright tests in `tests/browser/widget.spec.ts`.
+   - _Documentation:_ `docs/DEVELOPMENT.md` and `docs/SUPPORTED_MATRIX.md` document detailed manual VoiceOver, NVDA, and TalkBack protocols.
+   - _Policy:_ Automated tests do not certify WCAG compliance; continuous human assistive technology testing remains an active operational discipline.
 4. **Issue #7 (Physical devices, actual zoom, visual accessibility):**
-   - *Status:* Verified in automated browser matrix (Mobile WebKit emulation, 320px reflow, 400% zoom reflow, forced-colors mode).
-   - *Documentation:* Manual physical device touch testing protocol documented in `docs/DEVELOPMENT.md`.
+   - _Status:_ Verified in automated browser matrix (Mobile WebKit emulation, 320px reflow, 400% zoom reflow, forced-colors mode).
+   - _Documentation:_ Manual physical device touch testing protocol documented in `docs/DEVELOPMENT.md`.
 5. **Issue #8 (Representative host-application acceptance):**
-   - *Status:* Verified via packed clean consumer test suite (`npm run test:consumers`) in React 18 (Vite), React 19 (Tailwind), and Next.js 16 (Webpack/App Router/SSR).
+   - _Status:_ Verified via packed clean consumer test suite (`npm run test:consumers`) in React 18 (Vite), React 19 (Tailwind), and Next.js 16 (Webpack/App Router/SSR).
 6. **Issue #9 (Documentation update):** Closed. All documentation synchronized.
 7. **Issue #10 (Final release candidate validation):** Fulfilled by Issue #70 (A11Y-505) and `docs/PUBLISH_REHEARSAL.md`.
 8. **Issue #11 (Publish approved package):** Automated via GitHub Actions npm OIDC trusted publishing in `.github/workflows/publish.yml`.
@@ -97,4 +98,3 @@ The repository owner authorized release on 2026-10-28:
 - [x] **2. Default Branch Merge:** Authorized merge of release branch into `development` and synchronization into `main`.
 - [x] **3. Publication Authorization:** Automated GitHub Actions npm trusted publishing (`publish.yml`) via OIDC and GitHub Packages (`publish-github-package.yml`) triggered upon merge to `main`.
 - [x] **4. Git Release Tag:** Create matching `v2.28.1` Git tag and release upon verified npm registry upload.
-
diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md
index b0f9406..a7b171c 100644
--- a/docs/ROADMAP.md
+++ b/docs/ROADMAP.md
@@ -2,36 +2,36 @@
 
 No deadlines or percentage-complete estimates. Status is based on current evidence in PROJECT_STATUS.md.
 
-| Phase                           | Priority | Objective / tasks                                                                                            | Dependencies                           | Acceptance / deliverables                                                               | Risk / status                                                                            |
-| ------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------ | -------------------------------------- | --------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- |
-| Investigation                   | P0       | Compare vanilla/main/development/new-development, PR #1, history; baseline all checks                        | Git/registry access                    | Evidence-backed baseline and parity matrix                                              | Completed locally                                                                        |
-| Core stabilization              | P0       | Provider effects, filter composition, independent storage, reset cancellation, no invisible hit area         | Baseline                               | Close/reopen, reset race, restore, dynamic content and cleanup regressions              | Implemented; local automated verification                                                |
-| Features and extension          | P1       | All fifteen controllers, missing original variants, safe custom apply contract                               | Core                                   | Per-feature bounds/states and custom restore/reset/unmount tests; public examples       | Implemented; host-specific effect limits documented                                      |
-| Accessibility/UI                | P1       | Non-modal semantics, names/focus, safe-area responsive CSS, motion preferences                               | Core                                   | Keyboard/browser/axe checks plus human SR, actual zoom and device review                | Automated checks implemented; human review remains                                       |
-| Packaging/frameworks            | P1       | Client boundary, ESM/CJS/types/CSS, React 18/19, Next App/Pages, built examples                              | Core + build                           | Clean tarball installs, production builds and runtime tests                             | Local and hosted consumer verification passed; complete Firefox coverage passed on Linux |
-| CI/release validation           | P1       | Execute hosted matrix; fix Firefox launch environment; record results                                        | Push/PR workflow and compatible runner | Passing Node22/24 jobs and full browser matrix on exact release commit                  | Completed: hosted Node22/24 and full Chromium/Firefox/WebKit/mobile matrix passed        |
-| Clean light base design         | P1       | Apply owner-selected light concept, icons, tokens and responsive rows                                        | Stabilized core                        | Browser/axe/target-size checks, actual runtime screenshots and documented overrides     | Merged through PR #16; local and hosted checks passed                                    |
-| Movement and quick actions      | P1       | Persist drag/corner placement, non-drag controls and fixed reset/footer                                      | Clean light foundation                 | Drag/cancel/reload/resize and pinned-action browser regressions                         | Merged through PR #17; local and full hosted checks passed                               |
-| Ownership/release               | P1       | Continue confirmed npm identity; resolve license; choose version; approve merge/tag/publish                  | Owner decision + all gates             | Traceable authorized release with clean registry install                                | 2.0.0/latest published; automated release pipeline active for 2.1.0–2.22.0               |
-| Modular control primitives      | P1       | Accessible primitives (Toggle, Choice, Stepper, Card, Preview), search counts, empty/error UI states         | Clean light core                       | WCAG 2.2 touch target, radiogroup/switch keyboard semantics, live announcements         | Completed; released in v2.3.0                                                            |
-| Typography enhancements         | P1       | TextScale (stepwise), LineHeight presets, script-aware LetterSpacing and WordSpacing, ParagraphSpacing       | Core text engine                       | Arabic cursive protection, Sinhala/Tamil script bounds, reflow safety                   | Completed; released in v2.4.0–v2.9.0                                                     |
-| Reading aids & Media hiding     | P1       | ReadingGuide, ReadingMask, BigCursor fine-pointer detection, HideDecorativeImages, HideVideos                | Portal layout                          | Safe-area fit, pointer-transparency, alt text preservation, performance                 | Completed; released in v2.10.0–v2.14.0                                                   |
-| Navigation, Presets & I18n      | P1       | PageNavigator, Tooltips (WCAG 1.4.13), Profiles, Custom Presets JSON transfer, ReadingMode, Shortcuts        | Core store & i18n                      | Heading tree, focus restoration, zero tracking, Sinhala/Tamil localizations             | Completed; released in v2.15.0–v2.19.0                                                   |
-| Native Speech TTS (Issue 57)    | P1       | User-initiated Web Speech read-aloud with sentence chunking, pitch/rate, voice selector, floating bar        | Web Speech API                         | Zero network calls, sensitive field exclusions, no auto-play                            | Completed; released in v2.20.0                                                           |
-| Saturation/Grayscale (58)       | P1       | Opt-in saturation levels, monochrome grayscale, image/chart advisory warnings, forced-colors bypass          | Filter pipeline                        | Non-destructive reset, high-contrast OS detection, accessible advisories                | Completed; released in v2.21.0                                                           |
-| Menu Customization (Issue 60)   | P1       | Per-site feature menu reordering, grouping, custom labels, safe diagnostics, and stable rerenders            | AccessibilityList / FeatureMenu        | Non-crashing error handling, preserved canonical IDs, memoized focus stability          | Completed; released in v2.23.0                                                           |
-| Diagnostics & Harness (61)      | P1       | Dev-only integration diagnostics, containing-block traps, CSP, host CSS, DOM landmarks and test harness      | Diagnostics engine & harness           | Zero compliance claims, strict privacy guarantees, actionable fixes                     | Completed; released in v2.24.0                                                           |
-| Smart Contrast Prototype (63)   | P1       | Measured smart contrast for eligible elements with compositing, caching, unsupported reporting, full restore | Smart contrast engine & controller     | Non-destructive restoration, no layout thrashing, Porter-Duff compositing, zero claims  | Completed; released in v2.26.0                                                           |
-| Voice Navigation Prototype (64) | P1       | Client-side voice navigation for headings and scrolling with timeout, tab cleanup, zero recording storage    | Web Speech Recognition & controller    | Inactivity timeout, document.hidden protection, zero audio storage, keyboard fallbacks  | Completed; released in v2.27.0                                                           |
-| Host Translation Adapter (65)   | P1       | Decoupled translation provider interface, consent modal, sensitive field exclusion, DOM restoration          | Translation engine & controller        | Explicit consent, privacy threat model, zero default requests, textContent sanitization | Completed; released in v2.28.0                                                           |
-| Compatibility Matrix (Issue 66) | P1       | Full supported-browser, device, zoom reflow, forced-colors, safe-area and touch-target matrix                | Test suite & documentation             | 320px 400% reflow, forced-colors bypass, 44px targets, zero overclaims                  | Completed; documented in docs/SUPPORTED_MATRIX.md                                        |
-| Performance Profiling (Issue 67)| P1       | Measure bundle gzip, closed runtime, 1,000-node DOM jank, 100 mount/unmount and toggle cycles         | Performance test suite & doc           | Actual gzip/brotli metrics, <45ms main thread, 0 leaks, 0 compounding                   | Completed; documented in docs/PERFORMANCE_PROFILING.md                                   |
-| Documentation & Demos (Issue 68)| P1       | Synchronize README, API, FEATURES, CONTRIBUTING, and runnable Vite/Next consumer examples              | Documentation and examples             | Complete API & features sync, CONTRIBUTING guide, full runnable package demos           | Completed; documented in CONTRIBUTING.md, docs/API.md, docs/FEATURES.md                  |
-| Security & Audit (Issue 69)     | P1       | Audit dependencies, licenses, NOTICE, CSP, unsafe eval/HTML, privacy model, and vulnerabilities        | Security & audit test suite            | 0 dependencies, 0 audit advisories, strict CSP compliance, sensitive data protection    | Completed; documented in NOTICE, docs/SECURITY_AUDIT.md                                  |
-| Publish Rehearsal (Issue 70)    | P1       | Pack dry-run archive inspection, clean React 18/19 and Next.js 16 consumer builds and SSR verification   | Consumer validation scripts            | Tarball inspection passed, clean React 18/19/Next installs and production builds passed  | Completed; documented in docs/PUBLISH_REHEARSAL.md                                       |
-| Release Proposal (Issue 71)     | P1       | Review evidence, recommend patch/minor, prepare dated changelog, reconcile #15, and await owner approval | Release proposal & versioning analysis | Comprehensive evidence review, SemVer recommendation, legacy tracker reconciliation     | Completed; documented in docs/RELEASE_PROPOSAL_M5.md                                     |
-| Host effects hardening          | P2       | Optional explicit effect scopes, CSP renderer, Shadow DOM strategy, fixed-descendant filter alternatives     | API design and real use cases          | Documented contract with package/browser tests                                          | Planned; avoid universal-host compatibility claims                                       |
-| Multi-instance/cross-tab        | P2       | Decide if needed; deterministic arbitration/synchronization                                                  | Usage evidence                         | Isolated lifetime, persistence and interaction tests                                    | Deferred; one provider/document enforced                                                 |
+| Phase                            | Priority | Objective / tasks                                                                                            | Dependencies                           | Acceptance / deliverables                                                               | Risk / status                                                                            |
+| -------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------ | -------------------------------------- | --------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- |
+| Investigation                    | P0       | Compare vanilla/main/development/new-development, PR #1, history; baseline all checks                        | Git/registry access                    | Evidence-backed baseline and parity matrix                                              | Completed locally                                                                        |
+| Core stabilization               | P0       | Provider effects, filter composition, independent storage, reset cancellation, no invisible hit area         | Baseline                               | Close/reopen, reset race, restore, dynamic content and cleanup regressions              | Implemented; local automated verification                                                |
+| Features and extension           | P1       | All fifteen controllers, missing original variants, safe custom apply contract                               | Core                                   | Per-feature bounds/states and custom restore/reset/unmount tests; public examples       | Implemented; host-specific effect limits documented                                      |
+| Accessibility/UI                 | P1       | Non-modal semantics, names/focus, safe-area responsive CSS, motion preferences                               | Core                                   | Keyboard/browser/axe checks plus human SR, actual zoom and device review                | Automated checks implemented; human review remains                                       |
+| Packaging/frameworks             | P1       | Client boundary, ESM/CJS/types/CSS, React 18/19, Next App/Pages, built examples                              | Core + build                           | Clean tarball installs, production builds and runtime tests                             | Local and hosted consumer verification passed; complete Firefox coverage passed on Linux |
+| CI/release validation            | P1       | Execute hosted matrix; fix Firefox launch environment; record results                                        | Push/PR workflow and compatible runner | Passing Node22/24 jobs and full browser matrix on exact release commit                  | Completed: hosted Node22/24 and full Chromium/Firefox/WebKit/mobile matrix passed        |
+| Clean light base design          | P1       | Apply owner-selected light concept, icons, tokens and responsive rows                                        | Stabilized core                        | Browser/axe/target-size checks, actual runtime screenshots and documented overrides     | Merged through PR #16; local and hosted checks passed                                    |
+| Movement and quick actions       | P1       | Persist drag/corner placement, non-drag controls and fixed reset/footer                                      | Clean light foundation                 | Drag/cancel/reload/resize and pinned-action browser regressions                         | Merged through PR #17; local and full hosted checks passed                               |
+| Ownership/release                | P1       | Continue confirmed npm identity; resolve license; choose version; approve merge/tag/publish                  | Owner decision + all gates             | Traceable authorized release with clean registry install                                | 2.0.0/latest published; automated release pipeline active for 2.1.0–2.22.0               |
+| Modular control primitives       | P1       | Accessible primitives (Toggle, Choice, Stepper, Card, Preview), search counts, empty/error UI states         | Clean light core                       | WCAG 2.2 touch target, radiogroup/switch keyboard semantics, live announcements         | Completed; released in v2.3.0                                                            |
+| Typography enhancements          | P1       | TextScale (stepwise), LineHeight presets, script-aware LetterSpacing and WordSpacing, ParagraphSpacing       | Core text engine                       | Arabic cursive protection, Sinhala/Tamil script bounds, reflow safety                   | Completed; released in v2.4.0–v2.9.0                                                     |
+| Reading aids & Media hiding      | P1       | ReadingGuide, ReadingMask, BigCursor fine-pointer detection, HideDecorativeImages, HideVideos                | Portal layout                          | Safe-area fit, pointer-transparency, alt text preservation, performance                 | Completed; released in v2.10.0–v2.14.0                                                   |
+| Navigation, Presets & I18n       | P1       | PageNavigator, Tooltips (WCAG 1.4.13), Profiles, Custom Presets JSON transfer, ReadingMode, Shortcuts        | Core store & i18n                      | Heading tree, focus restoration, zero tracking, Sinhala/Tamil localizations             | Completed; released in v2.15.0–v2.19.0                                                   |
+| Native Speech TTS (Issue 57)     | P1       | User-initiated Web Speech read-aloud with sentence chunking, pitch/rate, voice selector, floating bar        | Web Speech API                         | Zero network calls, sensitive field exclusions, no auto-play                            | Completed; released in v2.20.0                                                           |
+| Saturation/Grayscale (58)        | P1       | Opt-in saturation levels, monochrome grayscale, image/chart advisory warnings, forced-colors bypass          | Filter pipeline                        | Non-destructive reset, high-contrast OS detection, accessible advisories                | Completed; released in v2.21.0                                                           |
+| Menu Customization (Issue 60)    | P1       | Per-site feature menu reordering, grouping, custom labels, safe diagnostics, and stable rerenders            | AccessibilityList / FeatureMenu        | Non-crashing error handling, preserved canonical IDs, memoized focus stability          | Completed; released in v2.23.0                                                           |
+| Diagnostics & Harness (61)       | P1       | Dev-only integration diagnostics, containing-block traps, CSP, host CSS, DOM landmarks and test harness      | Diagnostics engine & harness           | Zero compliance claims, strict privacy guarantees, actionable fixes                     | Completed; released in v2.24.0                                                           |
+| Smart Contrast Prototype (63)    | P1       | Measured smart contrast for eligible elements with compositing, caching, unsupported reporting, full restore | Smart contrast engine & controller     | Non-destructive restoration, no layout thrashing, Porter-Duff compositing, zero claims  | Completed; released in v2.26.0                                                           |
+| Voice Navigation Prototype (64)  | P1       | Client-side voice navigation for headings and scrolling with timeout, tab cleanup, zero recording storage    | Web Speech Recognition & controller    | Inactivity timeout, document.hidden protection, zero audio storage, keyboard fallbacks  | Completed; released in v2.27.0                                                           |
+| Host Translation Adapter (65)    | P1       | Decoupled translation provider interface, consent modal, sensitive field exclusion, DOM restoration          | Translation engine & controller        | Explicit consent, privacy threat model, zero default requests, textContent sanitization | Completed; released in v2.28.0                                                           |
+| Compatibility Matrix (Issue 66)  | P1       | Full supported-browser, device, zoom reflow, forced-colors, safe-area and touch-target matrix                | Test suite & documentation             | 320px 400% reflow, forced-colors bypass, 44px targets, zero overclaims                  | Completed; documented in docs/SUPPORTED_MATRIX.md                                        |
+| Performance Profiling (Issue 67) | P1       | Measure bundle gzip, closed runtime, 1,000-node DOM jank, 100 mount/unmount and toggle cycles                | Performance test suite & doc           | Actual gzip/brotli metrics, <45ms main thread, 0 leaks, 0 compounding                   | Completed; documented in docs/PERFORMANCE_PROFILING.md                                   |
+| Documentation & Demos (Issue 68) | P1       | Synchronize README, API, FEATURES, CONTRIBUTING, and runnable Vite/Next consumer examples                    | Documentation and examples             | Complete API & features sync, CONTRIBUTING guide, full runnable package demos           | Completed; documented in CONTRIBUTING.md, docs/API.md, docs/FEATURES.md                  |
+| Security & Audit (Issue 69)      | P1       | Audit dependencies, licenses, NOTICE, CSP, unsafe eval/HTML, privacy model, and vulnerabilities              | Security & audit test suite            | 0 dependencies, 0 audit advisories, strict CSP compliance, sensitive data protection    | Completed; documented in NOTICE, docs/SECURITY_AUDIT.md                                  |
+| Publish Rehearsal (Issue 70)     | P1       | Pack dry-run archive inspection, clean React 18/19 and Next.js 16 consumer builds and SSR verification       | Consumer validation scripts            | Tarball inspection passed, clean React 18/19/Next installs and production builds passed | Completed; documented in docs/PUBLISH_REHEARSAL.md                                       |
+| Release Proposal (Issue 71)      | P1       | Review evidence, recommend patch/minor, prepare dated changelog, reconcile #15, and await owner approval     | Release proposal & versioning analysis | Comprehensive evidence review, SemVer recommendation, legacy tracker reconciliation     | Completed; documented in docs/RELEASE_PROPOSAL_M5.md                                     |
+| Host effects hardening           | P2       | Optional explicit effect scopes, CSP renderer, Shadow DOM strategy, fixed-descendant filter alternatives     | API design and real use cases          | Documented contract with package/browser tests                                          | Planned; avoid universal-host compatibility claims                                       |
+| Multi-instance/cross-tab         | P2       | Decide if needed; deterministic arbitration/synchronization                                                  | Usage evidence                         | Isolated lifetime, persistence and interaction tests                                    | Deferred; one provider/document enforced                                                 |
 
 Release gates are not satisfied by checking in tests or CI configuration. Execute them on the final candidate. A local Chromium/WebKit pass is not a Firefox pass, and an axe pass is not screen-reader or WCAG certification.
 
diff --git a/docs/SECURITY_AUDIT.md b/docs/SECURITY_AUDIT.md
index a054041..bc9abdb 100644
--- a/docs/SECURITY_AUDIT.md
+++ b/docs/SECURITY_AUDIT.md
@@ -6,14 +6,14 @@ This document provides a comprehensive security review, dependency audit, Conten
 
 ## 1. Executive summary and audit results
 
-| Audit Area | Standard / Requirement | Current Verification Result | Status |
-| :--- | :--- | :--- | :--- |
-| **Dependencies** | 0 runtime dependencies; peerDependencies only | Clean `package.json`; 0 runtime dependencies. Only peer dependencies: React (`^18.3.1 \|\| ^19.0.0`) and React DOM. | **PASS** |
-| **Vulnerabilities** | `npm audit` 0 findings across direct and transitive tooling | `npm audit` returns 0 vulnerabilities across all installed packages. | **PASS** |
-| **Script Injection** | No dynamic code execution (`eval`, `new Function`) | Automated AST scan verifies 0 instances of `eval` or `Function` constructors across all `src/` modules. | **PASS** |
-| **Network Requests** | No unauthorized telemetry, tracking, or background calls | 0 `fetch()`, 0 `XMLHttpRequest`, 0 `navigator.sendBeacon`, 0 `WebSocket` calls. | **PASS** |
-| **Data Residency** | All state stored locally; zero external exfiltration | Preferences persist strictly in `localStorage` under `react-accessibility-plugin:state`. Zero cloud sync. | **PASS** |
-| **Licensing** | Permissive ISC license; clean IP attribution | Dedicated `LICENSE` and `NOTICE` files committed; zero GPL/copyleft or proprietary binary assets. | **PASS** |
+| Audit Area           | Standard / Requirement                                      | Current Verification Result                                                                                         | Status   |
+| :------------------- | :---------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------ | :------- |
+| **Dependencies**     | 0 runtime dependencies; peerDependencies only               | Clean `package.json`; 0 runtime dependencies. Only peer dependencies: React (`^18.3.1 \|\| ^19.0.0`) and React DOM. | **PASS** |
+| **Vulnerabilities**  | `npm audit` 0 findings across direct and transitive tooling | `npm audit` returns 0 vulnerabilities across all installed packages.                                                | **PASS** |
+| **Script Injection** | No dynamic code execution (`eval`, `new Function`)          | Automated AST scan verifies 0 instances of `eval` or `Function` constructors across all `src/` modules.             | **PASS** |
+| **Network Requests** | No unauthorized telemetry, tracking, or background calls    | 0 `fetch()`, 0 `XMLHttpRequest`, 0 `navigator.sendBeacon`, 0 `WebSocket` calls.                                     | **PASS** |
+| **Data Residency**   | All state stored locally; zero external exfiltration        | Preferences persist strictly in `localStorage` under `react-accessibility-plugin:state`. Zero cloud sync.           | **PASS** |
+| **Licensing**        | Permissive ISC license; clean IP attribution                | Dedicated `LICENSE` and `NOTICE` files committed; zero GPL/copyleft or proprietary binary assets.                   | **PASS** |
 
 ---
 
@@ -22,10 +22,12 @@ This document provides a comprehensive security review, dependency audit, Conten
 The library is designed to function cleanly under strict corporate and enterprise Content Security Policies:
 
 ### Script Execution (`script-src`)
+
 - **No Unsafe Eval**: The library never invokes `eval()` or constructs functions from strings. It is 100% compatible with CSPs that omit `'unsafe-eval'`.
 - **Pre-Compiled Distributions**: Ships standard pre-bundled ESM and CommonJS artifacts; no runtime transpilation or script loaders are used.
 
 ### Style Sheets & Styling (`style-src`)
+
 - **Scoped Plain CSS**: The library injects its stylesheet (`.arap-*`) scoped to its own container and uses CSS custom properties (`--arap-*`) on `.arap-root` and `.arap-panel`.
 - **Standalone Stylesheet Option**: Applications with CSPs that disallow inline styles (`'unsafe-inline'`) can load the standalone pre-compiled stylesheet directly:
   ```css
@@ -34,11 +36,13 @@ The library is designed to function cleanly under strict corporate and enterpris
   See [docs/CSP.md](CSP.md) for detailed nonce and hash configuration guidance.
 
 ### URL Protocol Sanitization (`isSafeUrl`)
+
 - When displaying links in reading mode or page navigation, all URLs undergo strict protocol verification (`isSafeUrl()`):
   - Permitted protocols: `http:`, `https:`, relative paths (`/`, `./`, `../`), in-page hashes (`#`), and safe `data:image/` URLs.
   - Prohibited schemes: `javascript:`, `vbscript:`, and unknown protocols are immediately rejected to prevent cross-site scripting (XSS) vectors.
 
 ### DOM Updates & XSS Safeguards
+
 - **TextContent Assignment**: The host translation adapter assigns translated content exclusively through `Text.textContent`, never `innerHTML`, completely eliminating script injection vectors.
 - **Reading Mode HTML Sanitization**: Strips executable elements (`<script>`, `<iframe>`, `<object>`, `<embed>`) and inline event handlers (`onload`, `onclick`, `onerror`).
 
@@ -47,11 +51,14 @@ The library is designed to function cleanly under strict corporate and enterpris
 ## 3. Privacy threat model and data residency
 
 ### Zero Telemetry & Tracking
+
 - The library does not contain analytics beacons, tracking pixels, cookie setters, or telemetry endpoints.
 - No network requests are made during normal widget lifecycle or feature toggling.
 
 ### Sensitive Element Detection (`isSensitiveElement`)
+
 Features that inspect or transform DOM elements (such as host translation, read aloud, and smart contrast) automatically exclude sensitive and private nodes:
+
 - **Credentials & Passwords**: `input[type="password"]`, `input[type="hidden"]`.
 - **Financial Data**: `[autocomplete*="password"]`, `[autocomplete*="cc-"]`, `[autocomplete*="credit-card"]`.
 - **Code & Technical Content**: `<code>`, `<pre>`, `<kbd>`, `<samp>`, `<script>`, `<style>`.
@@ -59,6 +66,7 @@ Features that inspect or transform DOM elements (such as host translation, read
 - **Cross-Origin Boundaries**: `<iframe>` elements are strictly skipped to prevent Same-Origin Policy (SOP) bypass.
 
 ### Client-Side Speech & Microphone Privacy
+
 - **Web Speech API**: Text-to-speech synthesis and voice navigation utilize native browser platform engines (`window.speechSynthesis`, `window.SpeechRecognition`).
 - **Zero Audio Retention**: No microphone recordings or voice audio streams are ever stored in `localStorage`, `sessionStorage`, or transmitted to remote servers.
 - **Inactivity Watchdog**: Voice listening terminates automatically after 30 seconds of inactivity or when the tab becomes hidden (`document.hidden`).
diff --git a/docs/SUPPORTED_MATRIX.md b/docs/SUPPORTED_MATRIX.md
index 6618130..850ae29 100644
--- a/docs/SUPPORTED_MATRIX.md
+++ b/docs/SUPPORTED_MATRIX.md
@@ -10,13 +10,13 @@ This document details the compatibility matrix, verification methods, responsive
 
 All browser environments are tested using real browser engines in clean, packed-consumer production builds (React 18, React 19 with Tailwind CSS, Next.js App Router, and Vite).
 
-| Platform / Engine | Tested Versions | Automated Status | Known Behaviors & Safeguards |
-| :--- | :--- | :--- | :--- |
-| **Chromium** (Chrome, Edge, Brave, Opera) | Chromium 120+ (Playwright 1.64.0 / Chromium 156) | **Verified (CI & Local)** | Full support for all filter pipelines, CSS variables, `forced-colors`, pointer capture, and Web Speech API. |
-| **Gecko / Firefox** (Firefox Desktop) | Firefox 120+ (Playwright Linux CI & Desktop) | **Verified (CI)** | Full CSS filter, zoom, and font replacement support. Web Speech synthesis in headless Linux CI requires graceful degradation due to absence of system audio sinks. |
-| **WebKit** (Safari Desktop) | WebKit 17+ (Playwright WebKit 27.2) | **Verified (CI & Local)** | WebKit requires programmatic focus transfer targets (such as `<main id="host">`) to have `tabIndex={-1}` when navigating via landmark skip links. Non-standard subpixel fractional geometry is handled with tolerance assertions. |
-| **Mobile WebKit** (iOS Safari) | iOS 16+, iPhone 13/14 emulation | **Verified (CI & Local)** | Full touch target compliance ($\ge 44\text{px} \times 44\text{px}$). Respects `env(safe-area-inset-*)`. Pointer drag events use pointer capture and prevent unwanted page scrolling during widget repositioning. |
-| **Chromium for Android** | Chrome Mobile emulation (Pixel 5/7) | **Verified (Local)** | Full touch target compliance ($\ge 44\text{px} \times 44\text{px}$). Safe area support. |
+| Platform / Engine                         | Tested Versions                                  | Automated Status          | Known Behaviors & Safeguards                                                                                                                                                                                                      |
+| :---------------------------------------- | :----------------------------------------------- | :------------------------ | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Chromium** (Chrome, Edge, Brave, Opera) | Chromium 120+ (Playwright 1.64.0 / Chromium 156) | **Verified (CI & Local)** | Full support for all filter pipelines, CSS variables, `forced-colors`, pointer capture, and Web Speech API.                                                                                                                       |
+| **Gecko / Firefox** (Firefox Desktop)     | Firefox 120+ (Playwright Linux CI & Desktop)     | **Verified (CI)**         | Full CSS filter, zoom, and font replacement support. Web Speech synthesis in headless Linux CI requires graceful degradation due to absence of system audio sinks.                                                                |
+| **WebKit** (Safari Desktop)               | WebKit 17+ (Playwright WebKit 27.2)              | **Verified (CI & Local)** | WebKit requires programmatic focus transfer targets (such as `<main id="host">`) to have `tabIndex={-1}` when navigating via landmark skip links. Non-standard subpixel fractional geometry is handled with tolerance assertions. |
+| **Mobile WebKit** (iOS Safari)            | iOS 16+, iPhone 13/14 emulation                  | **Verified (CI & Local)** | Full touch target compliance ($\ge 44\text{px} \times 44\text{px}$). Respects `env(safe-area-inset-*)`. Pointer drag events use pointer capture and prevent unwanted page scrolling during widget repositioning.                  |
+| **Chromium for Android**                  | Chrome Mobile emulation (Pixel 5/7)              | **Verified (Local)**      | Full touch target compliance ($\ge 44\text{px} \times 44\text{px}$). Safe area support.                                                                                                                                           |
 
 ---
 
@@ -24,13 +24,13 @@ All browser environments are tested using real browser engines in clean, packed-
 
 The package ships pre-bundled ESM, CommonJS, TypeScript declarations (`.d.ts`), and scoped CSS without requiring external styling dependencies or build-time transforms.
 
-| Framework / Runtime | Versions Tested | Verification Scope | Status |
-| :--- | :--- | :--- | :--- |
-| **React 18** | 18.3.1 | Clean packed npm tarball, Vite CSR, Vitest unit suite | **Verified** |
-| **React 19** | 19.0.0, 19.2.0 | Clean packed npm tarball, Vite CSR, Tailwind CSS 3/4 integration | **Verified** |
-| **Next.js (App Router)** | 14.x, 15.x, 16.x (`next@16.2.10`) | Production webpack build, Server Component imports, SSR hydration, client boundary | **Verified** |
-| **Next.js (Pages Router)** | 14.x, 15.x, 16.x | Production SSR and client-side navigation | **Verified** |
-| **Node.js** | >= 22.13.0 (Node 22 LTS, Node 24) | `npm ci`, `npm pack`, build scripts, consumer installations | **Verified** |
+| Framework / Runtime        | Versions Tested                   | Verification Scope                                                                 | Status       |
+| :------------------------- | :-------------------------------- | :--------------------------------------------------------------------------------- | :----------- |
+| **React 18**               | 18.3.1                            | Clean packed npm tarball, Vite CSR, Vitest unit suite                              | **Verified** |
+| **React 19**               | 19.0.0, 19.2.0                    | Clean packed npm tarball, Vite CSR, Tailwind CSS 3/4 integration                   | **Verified** |
+| **Next.js (App Router)**   | 14.x, 15.x, 16.x (`next@16.2.10`) | Production webpack build, Server Component imports, SSR hydration, client boundary | **Verified** |
+| **Next.js (Pages Router)** | 14.x, 15.x, 16.x                  | Production SSR and client-side navigation                                          | **Verified** |
+| **Node.js**                | >= 22.13.0 (Node 22 LTS, Node 24) | `npm ci`, `npm pack`, build scripts, consumer installations                        | **Verified** |
 
 ---
 
@@ -39,14 +39,17 @@ The package ships pre-bundled ESM, CommonJS, TypeScript declarations (`.d.ts`),
 The plugin is designed to withstand aggressive browser zoom and extreme viewport reflow without layout breakage, clipping, or loss of functionality.
 
 ### 400% Zoom Reflow (WCAG 1.4.10)
+
 - **Standard Baseline**: A desktop viewport of 1280px zoomed to 400% scales CSS layout down to a **320px viewport width**.
 - **Panel Reflow**: The accessibility panel constrains its maximum width to `100vw` (clamped to `min(360px, calc(100vw - 32px))`), preventing horizontal viewport scrollbars on the host page (`el.scrollWidth <= el.clientWidth + 1`).
 - **Internal Scrolling**: The control tools list (`.arap-tools-list`) scrolls independently with smooth vertical overflow, keeping header titles, close buttons, and footer reset actions fixed and immediately reachable.
 
 ### 200% Text Zoom / Font Scaling
+
 - Font scale controls step smoothly between 100% and 200% using scalable `rem` / proportional calculations without truncating button text or causing overlapping elements.
 
 ### Safe Areas (`env(safe-area-inset-*)`)
+
 - The floating launcher button and open panel respect device notches, home indicator bars, and display cutouts by padding bounds with:
   ```css
   top: max(16px, env(safe-area-inset-top));
@@ -60,19 +63,24 @@ The plugin is designed to withstand aggressive browser zoom and extreme viewport
 ## 4. High contrast and system color schemes
 
 ### Forced Colors / Windows High Contrast Mode (`forced-colors: active`)
+
 - **Filter Suppression**: When `forced-colors: active` is detected, the core filter composition engine (`composeFilter()`) automatically returns an empty string `""`. This guarantees that CSS filters (`invert()`, `contrast()`, `saturate()`, `grayscale()`) **never distort or override the user's high-contrast operating system colors**.
 - **System Palette Keywords**: Controls, borders, and focus rings utilize system color tokens such as `CanvasText`, `LinkText`, `ButtonBorder`, and `Highlight` to integrate seamlessly with OS color choices.
 - **Explicit Borders**: Interactive elements feature solid CSS borders so that controls remain distinctly outlined even when background colors are overridden by the user agent.
 
 ### Dark, Light, and System Themes
+
 - Built-in Clean Light theme uses CSS variables scoped under `.arap-root` and `.arap-panel`.
 - Adapts smoothly when embedded in dark-themed host applications without bleeding host styles into the widget or widget styles into the host application.
 
 ### Reduced Motion (`prefers-reduced-motion: reduce`)
+
 - All panel transitions, accordion expansions, and reading guide smooth scrolling are disabled or instantaneous when the user requests reduced motion:
   ```css
   @media (prefers-reduced-motion: reduce) {
-    *, *::before, *::after {
+    *,
+    *::before,
+    *::after {
       animation-duration: 0.01ms !important;
       animation-iteration-count: 1 !important;
       transition-duration: 0.01ms !important;
@@ -86,10 +94,12 @@ The plugin is designed to withstand aggressive browser zoom and extreme viewport
 ## 5. Touch and pointer target specifications
 
 ### Minimum Target Size (WCAG 2.5.5 / WCAG 2.5.8)
+
 - Every interactive button within the launcher, panel, control cards, stepper controls, choice selectors, and quick-action footers satisfies a minimum clickable/tappable bounding box of **$44\text{px} \times 44\text{px}$**.
 - Continuous Playwright browser tests assert that all visible buttons maintain `box.width >= 44` and `box.height >= 44` under both desktop and mobile viewports.
 
 ### Pointer and Drag Interactions
+
 - **Pointer Capture**: Widget repositioning uses pointer events (`onPointerDown`, `setPointerCapture`, `onPointerUp`) rather than HTML5 drag-and-drop, guaranteeing smooth movement across touchscreens, trackpads, and mice.
 - **Cancellation**: Pressing the `Escape` key during an active drag operation immediately cancels the drag and restores the widget to its prior persisted coordinates.
 - **Boundary Clamping**: The widget cannot be dragged off-screen or hidden behind browser chrome or taskbars.
@@ -100,13 +110,16 @@ The plugin is designed to withstand aggressive browser zoom and extreme viewport
 ## 6. Assistive technology and semantic structure
 
 ### Screen Reader Support
+
 The widget's controls are tested with standard screen reading technologies:
+
 - **NVDA** (Windows) with Chrome / Firefox / Edge
 - **JAWS** (Windows) with Chrome / Edge
 - **VoiceOver** (macOS & iOS) with Safari
 - **TalkBack** (Android) with Chrome
 
 ### Semantic DOM & ARIA Landmarks
+
 - **Launcher**: Native `<button type="button">` with descriptive `aria-label="Accessibility"` and `aria-expanded="true|false"`.
 - **Panel Container**: Non-modal `<section>` or `<div>` with `role="region"` and `aria-label="Accessibility settings"`. Does not trap focus or block interaction with the underlying page.
 - **Controls**:
diff --git a/examples/basic-usage/main.tsx b/examples/basic-usage/main.tsx
index 2674d2a..586ee47 100644
--- a/examples/basic-usage/main.tsx
+++ b/examples/basic-usage/main.tsx
@@ -131,9 +131,9 @@ function App() {
               and color filters to see them applied in real-time.
             </p>
             <p>
-              This example demonstrates all prebuilt feature controllers
-              working together with persistent settings, theme adaptation, and
-              dynamic view transitions.
+              This example demonstrates all prebuilt feature controllers working
+              together with persistent settings, theme adaptation, and dynamic
+              view transitions.
             </p>
             <h2>Testing Links & Form Controls</h2>
             <p>
diff --git a/examples/index.html b/examples/index.html
index dcf15bb..ba31b0c 100644
--- a/examples/index.html
+++ b/examples/index.html
@@ -68,9 +68,9 @@ <h2>
         </h2>
         <p>
           Demonstrates all prebuilt feature controllers (typography, contrast,
-          speech read-aloud, dictionary, translation, smart contrast, voice navigation,
-          presets, and reading aids), light and dark themes, non-modal focus management,
-          and dynamic tab/route transitions.
+          speech read-aloud, dictionary, translation, smart contrast, voice
+          navigation, presets, and reading aids), light and dark themes,
+          non-modal focus management, and dynamic tab/route transitions.
         </p>
       </div>
 
diff --git a/tests/browser/widget.spec.ts b/tests/browser/widget.spec.ts
index c156c6b..0892dbb 100644
--- a/tests/browser/widget.spec.ts
+++ b/tests/browser/widget.spec.ts
@@ -1808,4 +1808,3 @@ test("A11Y-501: full supported matrix verification - zoom reflow, forced-colors,
   await expect(trigger).toBeFocused();
   await page.emulateMedia({ forcedColors: "none" });
 });
-