From 11bfffaacda1db7767e062216b203f0497636645 Mon Sep 17 00:00:00 2001
From: Jeremi Joslin <jeremi@joslin.fr>
Date: Sat, 18 Jul 2026 08:52:15 +0700
Subject: [PATCH] chore(release): prepare Registry Stack v0.11.0 beta-13

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
---
 CONTRIBUTING.md                               |   2 +-
 Cargo.lock                                    |  52 +++---
 Cargo.toml                                    |  48 +++---
 SECURITY.md                                   |  10 +-
 crates/registry-relay/CHANGELOG.md            |  10 ++
 crates/registry-relay/docs/release-notes.md   |   9 +
 .../openapi/registry-relay.openapi.json       |   2 +-
 crates/registryctl/CHANGELOG.md               |  11 ++
 crates/registryctl/README.md                  |  10 +-
 .../bounded-http/registry-stack.yaml          |   4 +-
 crates/registryctl/install.sh                 |   4 +-
 .../dhis2-tracker/registry-stack.yaml         |   4 +-
 .../registry-stack.yaml                       |   4 +-
 .../opencrvs/registry-stack.yaml              |   4 +-
 .../snapshot-exact/registry-stack.yaml        |   4 +-
 crates/registryctl/tests/project_authoring.rs |   2 +-
 .../scripts/check-registryctl-tutorials.sh    |   4 +-
 .../site/scripts/release-notes-drift.test.mjs |  33 ++++
 docs/site/src/content/docs/changelog.mdx      |  28 ++-
 .../docs/operate/upgrade-and-rollback.mdx     |  11 +-
 .../content/docs/reference/api-stability.mdx  |   2 +-
 .../content/docs/reference/registryctl.mdx    |  20 ++-
 .../docs/security/report-a-vulnerability.mdx  |   2 +-
 .../content/docs/security/support-window.mdx  |   2 +-
 .../src/content/docs/spec/rs-pr-notary.mdx    |   8 +-
 .../tutorials/author-registry-project.mdx     |   2 +-
 .../deploy-standalone-with-own-data.mdx       |   6 +-
 ...blish-spreadsheet-secured-registry-api.mdx |  12 +-
 .../tutorials/verify-claim-registry-api.mdx   |  14 +-
 .../docs/tutorials/verify-opencrvs-claims.mdx |   2 +-
 docs/site/src/data/contracts.yaml             |  25 +--
 docs/site/src/data/docsets.yaml               |  38 +++-
 docs/site/src/data/generated/contracts.json   |  18 +-
 docs/site/src/data/generated/docsets.json     |  48 +++++-
 docs/site/src/data/generated/projects.json    |  18 +-
 docs/site/src/data/generated/standards.json   | 100 +++++------
 docs/site/src/data/projects.yaml              |  18 +-
 docs/site/src/data/repo-docs.yaml             |  82 ++++-----
 docs/site/src/data/standards.yaml             | 106 ++++++------
 products/manifest/CHANGELOG.md                |   4 +
 products/manifest/docs/release-notes.md       |   4 +
 products/manifest/fuzz/Cargo.lock             |   6 +-
 products/notary/CHANGELOG.md                  |  10 ++
 products/notary/docs/release-notes.md         |  18 +-
 products/notary/fuzz/Cargo.lock               |  22 +--
 .../openapi/registry-notary.openapi.json      |   4 +-
 products/platform/CHANGELOG.md                |   2 +
 products/platform/fuzz/Cargo.lock             |  18 +-
 release/READINESS.md                          |   8 +-
 release/VERIFY.md                             |   2 +-
 .../exercises/upgrade-v0.10.0-to-v0.11.0.md   | 163 ++++++++++++++++++
 release/manifests/registry-stack-beta-13.yaml |  31 ++++
 release/notes/v0.11.0.md                      | 131 ++++++++++++++
 release/scripts/test_registry_release.py      |   2 +-
 54 files changed, 874 insertions(+), 330 deletions(-)
 create mode 100644 release/exercises/upgrade-v0.10.0-to-v0.11.0.md
 create mode 100644 release/manifests/registry-stack-beta-13.yaml
 create mode 100644 release/notes/v0.11.0.md

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 969b17fca..baba9d731 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -141,7 +141,7 @@ These checks require Python 3.11 or later.
 ```bash
 python3 -m unittest release/scripts/test_registry_release.py
 python3 -m unittest release/scripts/test_openid_conformance_runner.py
-release/scripts/registry-release validate release/manifests/registry-stack-beta-12.yaml
+release/scripts/registry-release validate release/manifests/registry-stack-beta-13.yaml
 release/scripts/registry-release audit release/manifests/import-map-2026-06-24.yaml
 REGISTRY_RELEASE_SOURCE_MODE=monorepo release/scripts/check-release-source-model.sh
 python3 -m unittest release/scripts/test_check_release_source_model.py
diff --git a/Cargo.lock b/Cargo.lock
index efba328d5..b1aa11de4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -5192,7 +5192,7 @@ checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
 [[package]]
 name = "registry-config-report"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "jsonschema 0.46.6",
  "serde",
@@ -5201,7 +5201,7 @@ dependencies = [
 
 [[package]]
 name = "registry-language-server"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -5214,7 +5214,7 @@ dependencies = [
 
 [[package]]
 name = "registry-manifest-cli"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "registry-manifest-core",
  "serde",
@@ -5225,7 +5225,7 @@ dependencies = [
 
 [[package]]
 name = "registry-manifest-core"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "oxiri",
  "oxjsonld",
@@ -5240,7 +5240,7 @@ dependencies = [
 
 [[package]]
 name = "registry-notary"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "axum",
  "axum-test",
@@ -5276,7 +5276,7 @@ dependencies = [
 
 [[package]]
 name = "registry-notary-client"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "async-trait",
  "axum",
@@ -5303,7 +5303,7 @@ dependencies = [
 
 [[package]]
 name = "registry-notary-core"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "base64",
  "humantime-serde",
@@ -5330,7 +5330,7 @@ dependencies = [
 
 [[package]]
 name = "registry-notary-server"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "async-trait",
  "aws-lc-rs",
@@ -5388,7 +5388,7 @@ dependencies = [
 
 [[package]]
 name = "registry-notary-worker-harness"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "libc",
  "serde",
@@ -5400,7 +5400,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-audit"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "async-trait",
  "hmac 0.13.0",
@@ -5421,7 +5421,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-authcommon"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "proptest",
  "serde",
@@ -5435,7 +5435,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-cache"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "async-trait",
  "sha2 0.11.0",
@@ -5446,7 +5446,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-canonical-json"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "ryu-js",
  "serde",
@@ -5456,7 +5456,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-config"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "base64",
  "registry-platform-crypto",
@@ -5471,7 +5471,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-crypto"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "async-trait",
  "aws-lc-rs",
@@ -5494,7 +5494,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-httpsec"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "axum",
  "http",
@@ -5509,7 +5509,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-httputil"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "axum",
  "base64",
@@ -5536,7 +5536,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-oid4vci"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "base64",
  "registry-platform-crypto",
@@ -5551,7 +5551,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-oidc"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "axum",
  "base64",
@@ -5567,7 +5567,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-ops"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "fs2",
  "jsonschema 0.46.6",
@@ -5584,14 +5584,14 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-pdp"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "registry-platform-replay"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "async-trait",
  "getrandom 0.4.3",
@@ -5603,7 +5603,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-sdjwt"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "async-trait",
  "base64",
@@ -5620,7 +5620,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-testing"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "async-trait",
  "axum",
@@ -5646,7 +5646,7 @@ dependencies = [
 
 [[package]]
 name = "registry-relay"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "arc-swap",
  "assert-json-diff",
@@ -5727,7 +5727,7 @@ dependencies = [
 
 [[package]]
 name = "registryctl"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "anyhow",
  "base64",
diff --git a/Cargo.toml b/Cargo.toml
index 896dcbfef..0a95998a9 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -40,7 +40,7 @@ exclude = [
 resolver = "2"
 
 [workspace.package]
-version = "0.10.0"
+version = "0.11.0"
 edition = "2021"
 rust-version = "1.95"
 license = "Apache-2.0"
@@ -51,29 +51,29 @@ repository = "https://github.com/registrystack/registry-stack"
 unsafe_code = "forbid"
 
 [workspace.dependencies]
-registry-config-report = { path = "crates/registry-config-report", version = "0.10.0" }
-registry-language-server = { path = "crates/registry-language-server", version = "0.10.0" }
-registry-manifest-core = { path = "crates/registry-manifest-core", version = "0.10.0" }
-registry-notary-client = { path = "crates/registry-notary-client", version = "0.10.0" }
-registry-notary-core = { path = "crates/registry-notary-core", version = "0.10.0" }
-registry-relay = { path = "crates/registry-relay", version = "0.10.0" }
-registry-notary-server = { path = "crates/registry-notary-server", version = "0.10.0", default-features = false }
-registry-notary-worker-harness = { path = "crates/registry-notary-worker-harness", version = "0.10.0" }
-registry-platform-audit = { path = "crates/registry-platform-audit", version = "0.10.0" }
-registry-platform-authcommon = { path = "crates/registry-platform-authcommon", version = "0.10.0" }
-registry-platform-cache = { path = "crates/registry-platform-cache", version = "0.10.0" }
-registry-platform-canonical-json = { path = "crates/registry-platform-canonical-json", version = "0.10.0" }
-registry-platform-config = { path = "crates/registry-platform-config", version = "0.10.0" }
-registry-platform-crypto = { path = "crates/registry-platform-crypto", version = "0.10.0" }
-registry-platform-httpsec = { path = "crates/registry-platform-httpsec", version = "0.10.0" }
-registry-platform-httputil = { path = "crates/registry-platform-httputil", version = "0.10.0" }
-registry-platform-oid4vci = { path = "crates/registry-platform-oid4vci", version = "0.10.0" }
-registry-platform-oidc = { path = "crates/registry-platform-oidc", version = "0.10.0" }
-registry-platform-ops = { path = "crates/registry-platform-ops", version = "0.10.0" }
-registry-platform-pdp = { path = "crates/registry-platform-pdp", version = "0.10.0" }
-registry-platform-replay = { path = "crates/registry-platform-replay", version = "0.10.0" }
-registry-platform-sdjwt = { path = "crates/registry-platform-sdjwt", version = "0.10.0" }
-registry-platform-testing = { path = "crates/registry-platform-testing", version = "0.10.0" }
+registry-config-report = { path = "crates/registry-config-report", version = "0.11.0" }
+registry-language-server = { path = "crates/registry-language-server", version = "0.11.0" }
+registry-manifest-core = { path = "crates/registry-manifest-core", version = "0.11.0" }
+registry-notary-client = { path = "crates/registry-notary-client", version = "0.11.0" }
+registry-notary-core = { path = "crates/registry-notary-core", version = "0.11.0" }
+registry-relay = { path = "crates/registry-relay", version = "0.11.0" }
+registry-notary-server = { path = "crates/registry-notary-server", version = "0.11.0", default-features = false }
+registry-notary-worker-harness = { path = "crates/registry-notary-worker-harness", version = "0.11.0" }
+registry-platform-audit = { path = "crates/registry-platform-audit", version = "0.11.0" }
+registry-platform-authcommon = { path = "crates/registry-platform-authcommon", version = "0.11.0" }
+registry-platform-cache = { path = "crates/registry-platform-cache", version = "0.11.0" }
+registry-platform-canonical-json = { path = "crates/registry-platform-canonical-json", version = "0.11.0" }
+registry-platform-config = { path = "crates/registry-platform-config", version = "0.11.0" }
+registry-platform-crypto = { path = "crates/registry-platform-crypto", version = "0.11.0" }
+registry-platform-httpsec = { path = "crates/registry-platform-httpsec", version = "0.11.0" }
+registry-platform-httputil = { path = "crates/registry-platform-httputil", version = "0.11.0" }
+registry-platform-oid4vci = { path = "crates/registry-platform-oid4vci", version = "0.11.0" }
+registry-platform-oidc = { path = "crates/registry-platform-oidc", version = "0.11.0" }
+registry-platform-ops = { path = "crates/registry-platform-ops", version = "0.11.0" }
+registry-platform-pdp = { path = "crates/registry-platform-pdp", version = "0.11.0" }
+registry-platform-replay = { path = "crates/registry-platform-replay", version = "0.11.0" }
+registry-platform-sdjwt = { path = "crates/registry-platform-sdjwt", version = "0.11.0" }
+registry-platform-testing = { path = "crates/registry-platform-testing", version = "0.11.0" }
 
 crosswalk-core = { git = "https://github.com/PublicSchema/crosswalk", rev = "1d44ec735fdc8a7c719264b339574371e8330337", version = "0.2.0" }
 crosswalk-functions = { git = "https://github.com/PublicSchema/crosswalk", rev = "1d44ec735fdc8a7c719264b339574371e8330337", version = "0.2.0" }
diff --git a/SECURITY.md b/SECURITY.md
index f52a22289..0bf45e2ef 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -44,14 +44,14 @@ include cosign signatures without SLSA provenance.
 
 For each signed release asset, download three files from the GitHub Release:
 
-- The asset, for example `registryctl-v0.10.0-linux-amd64`
-- The matching signature, for example `registryctl-v0.10.0-linux-amd64.sig`
-- The matching certificate, for example `registryctl-v0.10.0-linux-amd64.pem`
+- The asset, for example `registryctl-v0.11.0-linux-amd64`
+- The matching signature, for example `registryctl-v0.11.0-linux-amd64.sig`
+- The matching certificate, for example `registryctl-v0.11.0-linux-amd64.pem`
 
 Then verify the asset:
 
 ```bash
-asset=registryctl-v0.10.0-linux-amd64
+asset=registryctl-v0.11.0-linux-amd64
 
 cosign verify-blob \
   --certificate "${asset}.pem" \
@@ -69,7 +69,7 @@ For releases with SLSA provenance, download the provenance asset and verify the
 artifact against the release tag:
 
 ```bash
-tag=v0.10.0
+tag=v0.11.0
 asset=registryctl-${tag}-linux-amd64
 provenance=registry-stack-${tag}-release-provenance.intoto.jsonl
 
diff --git a/crates/registry-relay/CHANGELOG.md b/crates/registry-relay/CHANGELOG.md
index d94f64afe..51e39a7d8 100644
--- a/crates/registry-relay/CHANGELOG.md
+++ b/crates/registry-relay/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+## 0.11.0 - 2026-07-18
+
 - Relay now publishes a reproducible, product-owned Draft 2020-12 schema for
   the complete runtime configuration. `registry-relay schema --format json`
   prints the committed artifact byte for byte, and local CI checks schema drift,
@@ -18,6 +20,14 @@
   `audit.chain.inconsistent` after detecting a retained-chain verification
   failure or a write-time foreign append. Transient audit I/O failures retain
   their existing request-level policy and do not poison readiness.
+- Script authoring diagnostics now reject unknown `source` and Crosswalk host
+  calls, unsupported arities, and invalid entrypoints before execution. The
+  bounded diagnostic identifies the first authored call, its source location,
+  and the closest valid signatures without retaining authored argument values.
+- Requests that present both `Authorization` and `x-api-key` are rejected
+  before either credential is parsed or validated with the candidate-neutral
+  `auth.multiple_credentials` code. Relay does not fall back to one credential
+  or reveal whether either candidate was valid.
 
 ## 0.10.0 - 2026-07-17
 
diff --git a/crates/registry-relay/docs/release-notes.md b/crates/registry-relay/docs/release-notes.md
index 904182093..5ac088e5a 100644
--- a/crates/registry-relay/docs/release-notes.md
+++ b/crates/registry-relay/docs/release-notes.md
@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+## 0.11.0
+
 - BREAKING: Configuration `${VAR}` expansion now rejects environment variables
   that are unset or empty. `${VAR:-fallback}` uses its fallback for either
   state, `${VAR:-}` explicitly expands to empty, and `${VAR:?message}` reports
@@ -10,6 +12,13 @@
   `audit.chain.inconsistent` code after retained-audit-chain verification or
   write-time fork detection. Transient audit I/O failures do not change
   readiness.
+- Relay reports bounded authoring diagnostics for unknown or incorrectly
+  called Script host functions, including the first call location and closest
+  valid signatures. Diagnostic output does not include authored argument
+  values.
+- Sending both `Authorization` and `x-api-key` now fails before credential
+  parsing with `auth.multiple_credentials`. The response and audit outcome do
+  not disclose whether either candidate credential was valid.
 
 ## 0.10.0
 
diff --git a/crates/registry-relay/openapi/registry-relay.openapi.json b/crates/registry-relay/openapi/registry-relay.openapi.json
index e7177feba..79bffe16b 100644
--- a/crates/registry-relay/openapi/registry-relay.openapi.json
+++ b/crates/registry-relay/openapi/registry-relay.openapi.json
@@ -2903,7 +2903,7 @@
     },
     "summary": "Read-only data gateway exposing entity records, catalog metadata, and SHACL/DCAT-AP shapes for governed datasets.",
     "title": "Registry Relay API",
-    "version": "0.10.0"
+    "version": "0.11.0"
   },
   "openapi": "3.1.0",
   "paths": {
diff --git a/crates/registryctl/CHANGELOG.md b/crates/registryctl/CHANGELOG.md
index fc6dc5801..db8ef4d52 100644
--- a/crates/registryctl/CHANGELOG.md
+++ b/crates/registryctl/CHANGELOG.md
@@ -6,6 +6,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ## [Unreleased]
 
+## [0.11.0] - 2026-07-18
+
 ### Added
 
 - `registryctl check` now returns a bounded typed authoring diagnostic
@@ -28,6 +30,15 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
   developer previews for VS Code and Zed launch the same server alongside their existing YAML
   language servers. They are not marketplace extensions or release artifacts; generated editor
   schema setup remains the stable beta path for YAML validation, completion, hover, and formatting.
+- `registryctl add notary` extends the generated local benefits project with
+  an editable, registry-backed Notary evaluation tutorial and a private
+  compiler-pinned Relay consultation. This local journey evaluates claim
+  results only; it does not issue a credential or prove wallet or OID4VCI
+  interoperability.
+- `registryctl init --from` continues to expose exactly five public starters:
+  HTTP, DHIS2 Tracker, OpenCRVS DCI, FHIR R4, and exact snapshot. A committed
+  catalog now drives documentation and tests for additional maintained and
+  conformance workspaces without turning them into public starters.
 
 ### Changed
 
diff --git a/crates/registryctl/README.md b/crates/registryctl/README.md
index decbc55f1..ea6bdfc0e 100644
--- a/crates/registryctl/README.md
+++ b/crates/registryctl/README.md
@@ -5,7 +5,7 @@
 Install a pinned release without cloning this repo:
 
 ```sh
-curl -fsSL https://raw.githubusercontent.com/registrystack/registry-stack/refs/tags/v0.10.0/crates/registryctl/install.sh | bash
+curl -fsSL https://raw.githubusercontent.com/registrystack/registry-stack/refs/tags/v0.11.0/crates/registryctl/install.sh | bash
 ```
 
 The quick installer verifies downloaded release assets against `SHA256SUMS`
@@ -97,7 +97,7 @@ workers need a platform-specific process limit. The Notary default remains
 128 MiB. The maximum 1 GiB value supports emulated local runtimes and is a
 per-worker data/address-space ceiling, not reserved memory.
 
-The installer defaults to `v0.10.0`. To install a different pinned release, set
+The installer defaults to `v0.11.0`. To install a different pinned release, set
 `REGISTRYCTL_VERSION`:
 
 ```sh
@@ -108,10 +108,10 @@ Fetch the installer from the same pinned tag selected by
 `REGISTRYCTL_VERSION`. An older installer does not know the asset contract of a
 newer release.
 
-Prebuilt binaries are published for the `v0.10.0` stack release on Linux x86_64,
+Prebuilt binaries are published for the `v0.11.0` stack release on Linux x86_64,
 Linux arm64, and macOS arm64. On other platforms, install from source with
-`cargo install --git https://github.com/registrystack/registry-stack --tag v0.10.0 registryctl --locked`.
-Intel macOS has no prebuilt binary for `v0.10.0`, so the installer stops after
+`cargo install --git https://github.com/registrystack/registry-stack --tag v0.11.0 registryctl --locked`.
+Intel macOS has no prebuilt binary for `v0.11.0`, so the installer stops after
 printing that Cargo command. It does not run the source build automatically.
 
 ## Release image lock (`v0.9.0` and later)
diff --git a/crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml b/crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml
index 635ac2062..dae5cb20d 100644
--- a/crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml
+++ b/crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml
@@ -1,8 +1,8 @@
 version: 1
 starter:
   id: http
-  release: 0.10.0
-  content_digest: sha256:7abce076294e39cad168500a513f36e65d44e811a55a1906057c0e1ff9ff3876
+  release: 0.11.0
+  content_digest: sha256:c349257d84d442318969452fd79c82d92a9fa43798758291dc7dba30dbf02ec7
 
 registry:
   id: fictional-citizen-registry
diff --git a/crates/registryctl/install.sh b/crates/registryctl/install.sh
index 5440b254c..63dc625a4 100755
--- a/crates/registryctl/install.sh
+++ b/crates/registryctl/install.sh
@@ -2,7 +2,7 @@
 set -euo pipefail
 
 repo="registrystack/registry-stack"
-default_version="v0.10.0"
+default_version="v0.11.0"
 version="${REGISTRYCTL_VERSION:-$default_version}"
 install_dir="${REGISTRYCTL_INSTALL_DIR:-$HOME/.local/bin}"
 verify_url="https://github.com/${repo}/blob/main/release/VERIFY.md"
@@ -19,7 +19,7 @@ unsigned. Follow the canonical release verification guide:
   $verify_url
 
 Environment:
-  REGISTRYCTL_VERSION      Pinned release tag to install. Defaults to v0.10.0.
+  REGISTRYCTL_VERSION      Pinned release tag to install. Defaults to v0.11.0.
   REGISTRYCTL_INSTALL_DIR  Install directory. Defaults to ~/.local/bin.
 EOF
 }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/registry-stack.yaml
index 7a953f658..ea71708a2 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/registry-stack.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/registry-stack.yaml
@@ -1,8 +1,8 @@
 version: 1
 starter:
   id: dhis2-tracker
-  release: 0.10.0
-  content_digest: sha256:aca86cfe088a7c51dddbfc24e0b1c680bf1a191964e55200c41bef8d8df06b88
+  release: 0.11.0
+  content_digest: sha256:49a811e0d70e4a0b3d75cb293bd6fb000b83e31b495d0f4dcdc1ed772f92d99d
 registry: { id: fictional-health-registry }
 integrations:
   health-record: { file: integrations/health-record/integration.yaml }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml
index a4fee06e5..071c06e8a 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml
@@ -1,8 +1,8 @@
 version: 1
 starter:
   id: fhir-r4
-  release: 0.10.0
-  content_digest: sha256:feb805241e5fce368c2762f6d84724180e5a22eda7af7b57405ce5496b3eadd2
+  release: 0.11.0
+  content_digest: sha256:2708d485e48785d045c25e895179e651019d48baf23d98e4383c87188ba753f6
 registry: { id: fictional-fhir-registry }
 integrations:
   coverage: { file: integrations/coverage/integration.yaml }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/registry-stack.yaml
index ece52cb9d..b15d899f4 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/registry-stack.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/registry-stack.yaml
@@ -1,8 +1,8 @@
 version: 1
 starter:
   id: opencrvs-dci
-  release: 0.10.0
-  content_digest: sha256:144583392ad58aacce61ac0092ab5d8431963d08ded605096cec3b205280273f
+  release: 0.11.0
+  content_digest: sha256:4d1be45915d5130540771bfd067344ef8b377988d441b736da4b6f4fcd062e36
 registry: { id: fictional-civil-registry }
 integrations:
   birth-record: { file: integrations/birth-record/integration.yaml }
diff --git a/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml
index a33ea037e..ecb21f272 100644
--- a/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml
+++ b/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml
@@ -1,8 +1,8 @@
 version: 1
 starter:
   id: snapshot
-  release: 0.10.0
-  content_digest: sha256:0aa94f9c6a3b6d97befab6175ab03664af463ab4faad2c2fcce8e12db214816c
+  release: 0.11.0
+  content_digest: sha256:de0b3bfc64823e5f8bbf10554427ec838602a700a03409a080ad70bde03d3fe5
 registry: { id: fictional-population-registry }
 integrations:
   person-snapshot: { file: integrations/person-snapshot/integration.yaml }
diff --git a/crates/registryctl/tests/project_authoring.rs b/crates/registryctl/tests/project_authoring.rs
index 05f9dfa60..6470af0ec 100644
--- a/crates/registryctl/tests/project_authoring.rs
+++ b/crates/registryctl/tests/project_authoring.rs
@@ -4307,7 +4307,7 @@ fn check_and_build_produce_deterministic_product_inputs() {
     assert_eq!(first_closure, directory_closure(&output));
     assert_eq!(
         closure_digest(&first_closure),
-        "b2b6a70bc5e15f330f81d069af55024ea8473c637ed33d4a9d364a6e0f091fc6",
+        "d15890b0c4e693d7ef1f2a03f5ca1c0451fcab6dcb0241a2464dacf935d69e7f",
         "project inputs must match the cross-machine golden digest"
     );
 }
diff --git a/docs/site/scripts/check-registryctl-tutorials.sh b/docs/site/scripts/check-registryctl-tutorials.sh
index ec24acc6f..d6ba03ef1 100644
--- a/docs/site/scripts/check-registryctl-tutorials.sh
+++ b/docs/site/scripts/check-registryctl-tutorials.sh
@@ -301,7 +301,7 @@ run_relay_tutorial() {
 		'["Install registryctl","Create the sample project","Start the local stack","Run the smoke check","Load local demo keys","Make one denied request","Make one allowed request","Read one protected record","Read one protected record","Read restricted identity fields","Read restricted identity fields","Inspect the generated contract","Inspect the generated contract","Run an aggregate","Change the disclosure rule","Change the disclosure rule","Change the disclosure rule","Change the disclosure rule","Change the disclosure rule","Stop the stack"]'
 	node "$HELPER" extract-shell "$RELAY_TUTORIAL" "$blocks"
 
-	expected_install=$'curl -fsSL https://raw.githubusercontent.com/registrystack/registry-stack/refs/tags/v0.10.0/crates/registryctl/install.sh | REGISTRYCTL_VERSION=v0.10.0 bash\nregistryctl --version'
+	expected_install=$'curl -fsSL https://raw.githubusercontent.com/registrystack/registry-stack/refs/tags/v0.11.0/crates/registryctl/install.sh | REGISTRYCTL_VERSION=v0.11.0 bash\nregistryctl --version'
 	if [[ "$(cat "$blocks/01.sh")" != "$expected_install" ]]; then
 		printf 'release-only install block changed; update the explicit source-under-test boundary\n' >&2
 		exit 1
@@ -316,7 +316,7 @@ run_relay_tutorial() {
 	cd "$tutorial_root"
 	printf '\nrelease installer skipped: this gate uses the checked-out registryctl; GH#198 verifies release assets\n'
 	run_block 'Relay 1: source registryctl version' "$version_block" success
-	assert_contains "$LAST_OUTPUT" 'registryctl 0.10.0'
+	assert_contains "$LAST_OUTPUT" 'registryctl 0.11.0'
 	run_block 'Relay 2: Create the sample project' "$blocks/02.sh" success
 	CURRENT_SECRET_FILE="$PWD/secrets/local.env"
 	run_block 'Relay 3: Start the local stack' "$blocks/03.sh" success
diff --git a/docs/site/scripts/release-notes-drift.test.mjs b/docs/site/scripts/release-notes-drift.test.mjs
index 0a1fb957e..816abc20c 100644
--- a/docs/site/scripts/release-notes-drift.test.mjs
+++ b/docs/site/scripts/release-notes-drift.test.mjs
@@ -6,6 +6,7 @@ import { readdirSync, readFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { test } from 'node:test';
+import { parse } from 'yaml';
 
 const here = dirname(fileURLToPath(import.meta.url));
 const repoRoot = resolve(here, '../../..');
@@ -64,6 +65,17 @@ function latestStackReleaseVersion() {
   return newestVersion(versions, 'release/notes');
 }
 
+function latestStackManifest() {
+  const version = latestStackReleaseVersion();
+  const manifests = readdirSync(resolve(repoRoot, 'release/manifests'))
+    .filter((name) => /^registry-stack-.+[.]yaml$/.test(name))
+    .map((name) => parse(readRepoFile(`release/manifests/${name}`)))
+    .filter((manifest) => manifest?.stack?.version === version);
+
+  assert.equal(manifests.length, 1, `expected one release manifest for ${version}`);
+  return manifests[0];
+}
+
 test('product release notes track newest released changelog headings', () => {
   for (const product of productReleaseNotes) {
     const newestChangelog = newestVersion(
@@ -95,3 +107,24 @@ test('registryctl changelog tracks the latest stack release', () => {
     'registryctl changelog must carry a section for the latest stack release',
   );
 });
+
+test('a hosted-held release does not claim completed current Solmara smoke evidence', () => {
+  const manifest = latestStackManifest();
+  const hostedHeld = manifest.warnings?.some(
+    (warning) => warning.code === 'hosted-publication-held',
+  );
+  if (!hostedHeld) {
+    return;
+  }
+
+  const publicEvidenceData = [
+    readRepoFile('docs/site/src/data/contracts.yaml'),
+    readRepoFile('docs/site/src/data/standards.yaml'),
+  ].join('\n');
+
+  assert.doesNotMatch(publicEvidenceData, /Solmara Lab checks the (?:current )?hosted/);
+  assert.match(
+    publicEvidenceData,
+    /hosted evidence remains pending until the lab is[\s\S]*repinned to published v[0-9]+[.][0-9]+[.][0-9]+ digests/,
+  );
+});
diff --git a/docs/site/src/content/docs/changelog.mdx b/docs/site/src/content/docs/changelog.mdx
index f111ca292..c696302dd 100644
--- a/docs/site/src/content/docs/changelog.mdx
+++ b/docs/site/src/content/docs/changelog.mdx
@@ -5,7 +5,7 @@ status: current
 owner: registry-docs
 source_repos:
   - registry-docs
-last_reviewed: "2026-07-16"
+last_reviewed: "2026-07-18"
 doc_type: reference
 locale: en
 standards_referenced: []
@@ -16,6 +16,32 @@ documents.
 Per-product release notes live in each product repository; the entries below link to the
 relevant product pages on this site rather than duplicating release notes.
 
+## 2026-07-18
+
+Documentation updates for the v0.11.0 beta-13 release:
+
+- Advanced current source citations, install commands, verification examples,
+  contracts, projects, and standards links to Registry Stack `v0.11.0`.
+- Added the `v0.11.0` archived docset while retaining the v0.10.0 and earlier
+  archives. The public release inventory remains eight artifacts. The optional
+  language server, VS Code preview, and Zed preview remain source-installed
+  developer tools, not release or marketplace artifacts.
+- Published the registry-backed local Notary tutorial and the maintained
+  authoring-workspace catalog. Registryctl continues to expose exactly five
+  public starters. The local tutorial proves evaluation only, not credential,
+  wallet, presentation, or OID4VCI interoperability.
+- Documented the credential-issuance migration: only fresh, non-delegated,
+  registry-backed evaluations with exact Relay provenance are credential
+  capable. Source-free and delegated results remain evaluation and rendering
+  surfaces, and old evaluations require re-evaluation before issuance. No
+  database migration is required solely for this narrowing.
+- Added migration coverage for ambiguous primary credentials, strict empty
+  environment expansion, Relay Script host-call diagnostics, and offline audit
+  quarantine recovery.
+
+This beta does not claim stable 1.0 completion, full OID4VCI interoperability,
+hosted promotion, audit completion, or an external pilot result.
+
 ## 2026-07-16
 
 Documentation updates for the v0.10.0 beta-12 release:
diff --git a/docs/site/src/content/docs/operate/upgrade-and-rollback.mdx b/docs/site/src/content/docs/operate/upgrade-and-rollback.mdx
index 9a0386b69..3bfb79678 100644
--- a/docs/site/src/content/docs/operate/upgrade-and-rollback.mdx
+++ b/docs/site/src/content/docs/operate/upgrade-and-rollback.mdx
@@ -33,7 +33,7 @@ anti-rollback state before starting its binary. The
 
 ## Prerequisites
 
-- Your deployment pins a version tag (`v0.10.0`) or an image digest, never `latest`.
+- Your deployment pins a version tag (`v0.11.0`) or an image digest, never `latest`.
 - You know where your deployment keeps its persistent state. At minimum: the audit log
   directory of each product, the anti-rollback state file if `config_trust` is enabled
   (`antirollback_state_path`), each PostgreSQL database backing Relay consultation or Registry
@@ -43,7 +43,7 @@ anti-rollback state before starting its binary. The
   before changing the running containers. Store each release's config and anti-rollback
   state as a separate restore set; do not overwrite an older set with a newer file.
 - You can run the release-verification steps in
-  [SECURITY.md](https://github.com/registrystack/registry-stack/blob/v0.10.0/SECURITY.md)
+  [SECURITY.md](https://github.com/registrystack/registry-stack/blob/v0.11.0/SECURITY.md)
   (cosign, and slsa-verifier for releases with provenance).
 
 ## Upgrade
@@ -124,6 +124,13 @@ anti-rollback state before starting its binary. The
    anti-rollback monotonicity were not exercised by that run. Current Registry Notary releases
    keep replay and nonce correctness state in PostgreSQL.
 
+   The current
+   [v0.10.0 -> v0.11.0 -> v0.10.0 release-gate procedure](https://github.com/registrystack/registry-stack/blob/v0.11.0/release/exercises/upgrade-v0.10.0-to-v0.11.0.md)
+   adds old-evaluation rejection and re-evaluation before issuance,
+   candidate-neutral multiple-credential rejection, and retained audit-chain
+   recovery. It is a prepared procedure and does not claim a successful run
+   until finalized-source and published-asset evidence are attached.
+
 8. Keep the previous release's artifacts, config, exact anti-rollback state, database backups,
    role records, and key-lifecycle restore sets until the new release has run through your soak
    period. Only then remove them under your retention policy.
diff --git a/docs/site/src/content/docs/reference/api-stability.mdx b/docs/site/src/content/docs/reference/api-stability.mdx
index 537479f62..d4d3f8cab 100644
--- a/docs/site/src/content/docs/reference/api-stability.mdx
+++ b/docs/site/src/content/docs/reference/api-stability.mdx
@@ -61,7 +61,7 @@ The enforcement column names the repository CI checks so the mechanism is audita
 | Registry Manifest schema and rendered artifacts | `registry-manifest/v1` and the rendered artifact schema versions, governed by [RS-DM-MANIFEST](../../spec/rs-dm-manifest/) | `validate_manifest` accepts only `registry-manifest/v1`; REQ-DM-MANIFEST-013 requires strict unknown-key rejection at parse time |
 | Source-adaptation integration surfaces | Registry Relay's compiled `http`, `script`, and `snapshot` consultation plans, including the Rhai `consult(ctx)` host API and versioned protocol helpers | Registry Stack project-authoring schemas and fixtures; Relay source-plan compiler and consultation contract tests |
 | Command-line interfaces | Documented commands and flags of `registryctl`, `registry-relay`, `registry-notary`, and `registry-manifest`, and their machine-readable output modes (`--format json`, `openapi`, `schema`) | CLI reference pages; `registryctl` version test |
-| Release artifacts and verification interface | Released binary and image names (`ghcr.io/registrystack/registry-relay`, `ghcr.io/registrystack/registry-notary`), signature and provenance layout per `release/VERIFY.md` | Release workflow; signed assets verified as documented in [SECURITY.md](https://github.com/registrystack/registry-stack/blob/v0.10.0/SECURITY.md) |
+| Release artifacts and verification interface | Released binary and image names (`ghcr.io/registrystack/registry-relay`, `ghcr.io/registrystack/registry-notary`), signature and provenance layout per `release/VERIFY.md` | Release workflow; signed assets verified as documented in [SECURITY.md](https://github.com/registrystack/registry-stack/blob/v0.11.0/SECURITY.md) |
 
 {/* TODO[review]: Prometheus metric names are not in this table. Operators build dashboards
      on them and both products have renamed metrics pre-1.0. Decide the tier: covered like an
diff --git a/docs/site/src/content/docs/reference/registryctl.mdx b/docs/site/src/content/docs/reference/registryctl.mdx
index 2a74954a2..ab40fcbf6 100644
--- a/docs/site/src/content/docs/reference/registryctl.mdx
+++ b/docs/site/src/content/docs/reference/registryctl.mdx
@@ -254,7 +254,7 @@ verification. Trust-anchor creation and key changes use the existing `anchor` su
 ## Project setup
 
 The legacy `init relay` command creates a local spreadsheet project.
-In registryctl `v0.10.0`, this generation command requires the strict
+In registryctl `v0.11.0`, this generation command requires the strict
 `registryctl-vX.Y.Z-image-lock.json` from the same release beside the running
 binary. Set `REGISTRYCTL_IMAGE_LOCK` only when an operator has verified the same
 file at a separate explicit path. Registryctl does not search the current
@@ -279,19 +279,21 @@ Notary-only, and combined deployments. Registry Notary does not have a direct-so
 generator. Registry-backed Notary claims consume compiler-pinned Relay consultations, while a
 Notary-only project contains source-free or self-attested evaluation-only claims.
 
-### Next-release local Notary add-on
+### Local Notary add-on
 
-The `release/1.0` source line adds `registryctl add notary`. This command is not in the published
-`v0.10.0` CLI. From a generated `benefits` spreadsheet project, it creates an editable authored
-project under `notary/project/`, adds a private consultation Relay and local Notary services, and
-generates local-only evaluator and workload credentials. It refuses an existing Notary directory
-or a second invocation instead of overwriting authored work.
+Registryctl `v0.11.0` adds `registryctl add notary`. From a generated `benefits` spreadsheet
+project, it creates an editable authored project under `notary/project/`, adds a private
+consultation Relay and local Notary services, and generates local-only evaluator and workload
+credentials. It refuses an existing Notary directory or a second invocation instead of
+overwriting authored work.
 
 `registryctl start` and `registryctl restart` validate and rebuild this add-on from the authored
 project before starting it. Registryctl validates the fixed local runtime overrides with the
 production product models and publishes one complete generated bundle, so services do not observe
 a partially updated contract. The command is a tutorial convenience for the generated benefits
 workbook, not a custom-registry import command.
+The tutorial path evaluates a registry-backed claim only. It does not issue a
+credential or prove wallet, credential-presentation, or OID4VCI interoperability.
 
 ## Lifecycle
 
@@ -347,6 +349,6 @@ Related environment variables are listed in the [environment variable reference]
 
 ## Source
 
-The released command tree comes from the registryctl source at `v0.10.0`.
+The released command tree comes from the registryctl source at `v0.11.0`.
 For its canonical definitions, read the
-[registryctl command tree in `src/main.rs`](https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registryctl/src/main.rs).
+[registryctl command tree in `src/main.rs`](https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registryctl/src/main.rs).
diff --git a/docs/site/src/content/docs/security/report-a-vulnerability.mdx b/docs/site/src/content/docs/security/report-a-vulnerability.mdx
index 0cdbce4bf..0806e6412 100644
--- a/docs/site/src/content/docs/security/report-a-vulnerability.mdx
+++ b/docs/site/src/content/docs/security/report-a-vulnerability.mdx
@@ -62,7 +62,7 @@ For each signed release asset, download the asset, its `.sig` signature, and its
 certificate from the GitHub Release, then verify:
 
 ```bash
-asset=registryctl-v0.10.0-linux-amd64   # replace with the asset you downloaded
+asset=registryctl-v0.11.0-linux-amd64   # replace with the asset you downloaded
 
 cosign verify-blob \
   --certificate "${asset}.pem" \
diff --git a/docs/site/src/content/docs/security/support-window.mdx b/docs/site/src/content/docs/security/support-window.mdx
index d59d773a6..b6cf1bc2d 100644
--- a/docs/site/src/content/docs/security/support-window.mdx
+++ b/docs/site/src/content/docs/security/support-window.mdx
@@ -49,7 +49,7 @@ always in a newer release.
 
 - A security fix ships as a release with signed artifacts and provenance, verifiable as
   documented in
-  [SECURITY.md](https://github.com/registrystack/registry-stack/blob/v0.10.0/SECURITY.md).
+  [SECURITY.md](https://github.com/registrystack/registry-stack/blob/v0.11.0/SECURITY.md).
 - Release notes identify security-relevant changes. When a fix required tightening covered
   surface, the notes say so explicitly, per the security exception in the
   [deprecation policy](../../reference/deprecation-policy/).
diff --git a/docs/site/src/content/docs/spec/rs-pr-notary.mdx b/docs/site/src/content/docs/spec/rs-pr-notary.mdx
index e4d52dc8f..940e3996c 100644
--- a/docs/site/src/content/docs/spec/rs-pr-notary.mdx
+++ b/docs/site/src/content/docs/spec/rs-pr-notary.mdx
@@ -303,12 +303,12 @@ This specification is `verified`: every requirement describes shipped behavior a
 - The [standards register](../../reference/standards/) records the adoption mode for SD-JWT VC, OID4VCI, CCCEV, and the other standards listed in `standards_referenced`, including the profiled-subset claims this document refers to.
 - [RS-ARC-G](../rs-arc-g/) Section 3 and Section 5 hold the architectural invariants (REQ-ARC-G-004/007/008/009) that this document refines.
 - Delegated self-attestation access modes, Relay consultation capabilities, stored metadata, and denial reasons are implemented in Registry Notary Core and Server.
-- Delegated relationship configuration validation is implemented in [`config.rs`](https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-notary-core/src/config.rs).
+- Delegated relationship configuration validation is implemented in [`config.rs`](https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-core/src/config.rs).
 - Request context derivation, stored-evaluation revalidation, OID4VCI delegated-token rejection, explicit target binding, and proof-gated Relay consultations are implemented in Registry Notary Server.
 - Private evaluation provenance capture and the shared direct/OID4VCI issuance verifier (REQ-PR-NOTARY-037) are implemented in Registry Notary Server's evaluation and render runtime modules.
-- OIDC principal derivation from the configured principal claim, without client id, authorized party, or audience fallback (REQ-PR-NOTARY-034), is implemented in [`standalone.rs`](https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-notary-server/src/standalone.rs)'s `principal_from_oidc` function and its `oidc_principal_requires_configured_principal_claim` test.
-- The issuer-bound self-attestation transaction-token gate (REQ-PR-NOTARY-035) is implemented in [`api.rs`](https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-notary-server/src/api.rs)'s `self_attestation_requires_authorization_details` function.
-- The issuer-bound OID4VCI transaction-detail gate (REQ-PR-NOTARY-036) is implemented in [`api.rs`](https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-notary-server/src/api.rs)'s `oid4vci_requires_authorization_details` and `require_oid4vci_issuance_authorization_details` functions.
+- OIDC principal derivation from the configured principal claim, without client id, authorized party, or audience fallback (REQ-PR-NOTARY-034), is implemented in [`standalone.rs`](https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/standalone.rs)'s `principal_from_oidc` function and its `oidc_principal_requires_configured_principal_claim` test.
+- The issuer-bound self-attestation transaction-token gate (REQ-PR-NOTARY-035) is implemented in [`api.rs`](https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/api.rs)'s `self_attestation_requires_authorization_details` function.
+- The issuer-bound OID4VCI transaction-detail gate (REQ-PR-NOTARY-036) is implemented in [`api.rs`](https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/api.rs)'s `oid4vci_requires_authorization_details` and `require_oid4vci_issuance_authorization_details` functions.
 
 ## Next
 
diff --git a/docs/site/src/content/docs/tutorials/author-registry-project.mdx b/docs/site/src/content/docs/tutorials/author-registry-project.mdx
index 3f945017a..28e9f5e86 100644
--- a/docs/site/src/content/docs/tutorials/author-registry-project.mdx
+++ b/docs/site/src/content/docs/tutorials/author-registry-project.mdx
@@ -58,7 +58,7 @@ The human-readable result confirms the project, starter provenance, and next com
 ```text
 Initialized Registry Stack project "fictional-citizen-registry".
   Directory: registry-project
-  Starter: http (Registry Stack 0.10.0)
+  Starter: http (Registry Stack 0.11.0)
   Starter content: matches bundled digest
   Editor support: VS Code and Zed (registry-project/.registry-stack-editor/manifest.json)
 
diff --git a/docs/site/src/content/docs/tutorials/deploy-standalone-with-own-data.mdx b/docs/site/src/content/docs/tutorials/deploy-standalone-with-own-data.mdx
index 2280c7c0a..09e384251 100644
--- a/docs/site/src/content/docs/tutorials/deploy-standalone-with-own-data.mdx
+++ b/docs/site/src/content/docs/tutorials/deploy-standalone-with-own-data.mdx
@@ -44,7 +44,7 @@ credentials, or production records in commands or source control.
 Pull a release tag or verified digest rather than `latest`:
 
 ```sh
-docker pull ghcr.io/registrystack/registry-relay:v0.10.0
+docker pull ghcr.io/registrystack/registry-relay:v0.11.0
 ```
 
 Review the release verification evidence before promoting an image into an institutional
@@ -89,7 +89,7 @@ Generate an API key and store only its fingerprint in the environment named by t
 
 ```sh
 docker run --rm \
-  ghcr.io/registrystack/registry-relay:v0.10.0 \
+  ghcr.io/registrystack/registry-relay:v0.11.0 \
   generate-api-key --id program-system
 ```
 
@@ -111,7 +111,7 @@ docker run --rm \
   -v "$(pwd)/data:/var/lib/registry-relay/data:ro" \
   -v "$(pwd)/cache:/var/lib/registry-relay/cache" \
   --env-file <verified-private-env-file> \
-  ghcr.io/registrystack/registry-relay:v0.10.0 \
+  ghcr.io/registrystack/registry-relay:v0.11.0 \
   --config /etc/registry-relay/config.yaml
 ```
 
diff --git a/docs/site/src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx b/docs/site/src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx
index 5de8a0261..ff2e6094e 100644
--- a/docs/site/src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx
+++ b/docs/site/src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx
@@ -25,14 +25,14 @@ identity reads, and inspect the contract Registry Stack generated.
   outcome="A protected local API over a benefits workbook, with operational and restricted identity reads separated, one canonical birth date retained, and an edited disclosure rule enforced."
   time="About 15 minutes after Docker is installed"
   level="Local single-node"
-  prerequisites={['registryctl 0.10.0', 'A Docker Compose provider', 'curl']}
+  prerequisites={['registryctl 0.11.0', 'A Docker Compose provider', 'curl']}
 />
 
 This tutorial uses synthetic data and local demo credentials.
 Do not use the generated local keys in production.
 
 :::note[Current first-run route]
-The v0.10.0 source beta and this local tutorial can be used while hosted credential publication is
+The v0.11.0 source beta and this local tutorial can be used while hosted credential publication is
 held by [GH#330](https://github.com/registrystack/registry-stack/issues/330) and the incomplete
 [GH#198](https://github.com/registrystack/registry-stack/issues/198) fresh-reader run.
 :::
@@ -42,7 +42,7 @@ held by [GH#330](https://github.com/registrystack/registry-stack/issues/330) and
 Install `registryctl` without cloning the repository:
 
 The quick installer verifies downloaded release assets against the release's
-`SHA256SUMS`. The pinned `v0.10.0` installer installs the binary and matching
+`SHA256SUMS`. The pinned `v0.11.0` installer installs the binary and matching
 release image lock beside each other. It
 does not authenticate the installer script or release. Before running it,
 review the available signature and provenance evidence in the
@@ -50,7 +50,7 @@ canonical [`release/VERIFY.md`](https://github.com/registrystack/registry-stack/
 guide. Evidence availability varies by release, and `v0.8.0` is unsigned.
 
 ```sh
-curl -fsSL https://raw.githubusercontent.com/registrystack/registry-stack/refs/tags/v0.10.0/crates/registryctl/install.sh | REGISTRYCTL_VERSION=v0.10.0 bash
+curl -fsSL https://raw.githubusercontent.com/registrystack/registry-stack/refs/tags/v0.11.0/crates/registryctl/install.sh | REGISTRYCTL_VERSION=v0.11.0 bash
 registryctl --version
 ```
 
@@ -61,7 +61,7 @@ Prebuilt `registryctl` assets exist for Linux x86_64, Linux arm64, and macOS arm
 On Intel macOS, the installer stops after printing the pinned `cargo install` command.
 It does not run the source build automatically.
 After installing a Rust toolchain, run the command printed by the installer. For
-`v0.10.0`, also checksum-verify the matching release image lock and
+`v0.11.0`, also checksum-verify the matching release image lock and
 place it beside the Cargo-installed binary, as described in the troubleshooting table.
 
 ## Create the sample project
@@ -483,7 +483,7 @@ Relay refused to start when the floor dropped under 2 on personal data.
 | `registryctl` is not found | The install directory is not on `PATH`. | Add the directory printed by the installer, usually `~/.local/bin`, to `PATH`. |
 | The installer reports an unsupported platform | No binary is published for that OS or CPU. | Run the pinned `cargo install` command printed by the installer. For `v0.9.0` or later, also checksum-verify the matching `registryctl-vX.Y.Z-image-lock.json` release asset and place it beside the installed binary. |
 | `registryctl start` cannot find Docker | Docker or another Compose provider is not installed or running. | Start Docker Desktop, OrbStack, Colima, Podman, or your supported provider, then run `registryctl start` again. |
-| Docker reports no `linux/arm64` manifest for a Registry Stack image | The v0.10.0 Relay and Notary images are published for `linux/amd64` only. | Start with `DOCKER_DEFAULT_PLATFORM=linux/amd64 registryctl start`. |
+| Docker reports no `linux/arm64` manifest for a Registry Stack image | The v0.11.0 Relay and Notary images are published for `linux/amd64` only. | Start with `DOCKER_DEFAULT_PLATFORM=linux/amd64 registryctl start`. |
 | `registryctl start` fails and the container log shows `failed to parse config YAML ... unknown field` | The locally cached container image does not match the digest-pinned image in the generated `compose.yaml`. | Run `docker compose pull` in the project directory (on Apple silicon, prefix it with `DOCKER_DEFAULT_PLATFORM=linux/amd64`), then `registryctl start` again. |
 | `registryctl start` times out and the container log shows `missing field \`commitment\`` | registryctl v0.8.4 pins a service image older than its own generated config format ([GH#278](https://github.com/registrystack/registry-stack/issues/278)). | Pin the project's `compose.yaml` to the published v0.8.4 release digests: `ghcr.io/registrystack/registry-relay@sha256:93e194500a3500ba3f6331d5a0a9a3069127c48a709beccb083a5fcbdbc3ec61` and, when present, `ghcr.io/registrystack/registry-notary@sha256:0cf05184885d7ed17dd9889e20f3797eb2a9ad07517f4ac7c05c03b774a00b8f`. Then run `docker compose pull`; reapply the pins after a generation command rewrites `compose.yaml`. |
 | `registryctl init` reports that its image lock is missing or invalid | The binary was moved or built without the strict image lock from the same release, or the file failed its release, source, platform, or digest checks. | Rerun the installer from the same pinned target tag so it checksum-verifies and installs both files. For an operator-managed or source-test location, set `REGISTRYCTL_IMAGE_LOCK` to the checksum-verified lock from that exact release. Do not substitute a lock from another version or a mutable image tag. |
diff --git a/docs/site/src/content/docs/tutorials/verify-claim-registry-api.mdx b/docs/site/src/content/docs/tutorials/verify-claim-registry-api.mdx
index df71bdccf..6dffdaf40 100644
--- a/docs/site/src/content/docs/tutorials/verify-claim-registry-api.mdx
+++ b/docs/site/src/content/docs/tutorials/verify-claim-registry-api.mdx
@@ -1,7 +1,7 @@
 ---
 title: Evaluate a registry-backed claim locally
 description: Add Registry Notary to the protected spreadsheet project, match a person by name and date of birth, return one boolean claim, and edit its rule.
-status: draft
+status: current
 owner: registry-docs
 source_repos:
   - registry-stack
@@ -31,7 +31,7 @@ claim.
   outcome="A live registry-backed boolean claim, matched without a national identifier, with a meaningful policy edit exercised end to end."
   time="About 10 minutes after completing the first tutorial"
   level="Local single-node"
-  prerequisites={['The my-first-api project from the first tutorial', 'Matching Registry Stack 1.0+ registryctl, release images, and image lock', 'A Docker Compose provider', 'curl']}
+  prerequisites={['The my-first-api project from the first tutorial', 'Matching Registry Stack v0.11.0 registryctl, release images, and image lock', 'A Docker Compose provider', 'curl']}
 />
 
 This tutorial uses synthetic data and local demo credentials. Do not use the generated keys or
@@ -39,9 +39,11 @@ database settings in production.
 
 :::note[Release status]
 This tutorial requires `registryctl`, immutable Relay and Notary images, and the image lock from
-the same Registry Stack 1.0 or later release. It is not runnable with the published `v0.10.0`
-CLI or with an ad hoc source-built CLI alone. The source-image rebinding used by the repository's
-tutorial gate is an internal CI method, not a supported installation route.
+the same Registry Stack `v0.11.0` release. Do not combine a source-built CLI with images or an
+image lock from another release.
+
+This is an evaluation-only local tutorial. It does not issue a credential or
+prove wallet, credential-presentation, or OID4VCI interoperability.
 :::
 
 ## Add Notary to the project
@@ -388,7 +390,7 @@ answer.
 
 | Symptom | Cause | Resolution |
 | --- | --- | --- |
-| `registryctl add notary` is unknown | The CLI predates Registry Stack 1.0 or does not match the installed release image lock. | Install `registryctl`, the immutable Relay and Notary images, and the image lock from the same Registry Stack 1.0 or later release. Do not substitute an ad hoc source build or a lock from another release. |
+| `registryctl add notary` is unknown | The CLI predates Registry Stack v0.11.0 or does not match the installed release image lock. | Install `registryctl`, the immutable Relay and Notary images, and the image lock from the same Registry Stack v0.11.0 release. Do not substitute an ad hoc source build or a lock from another release. |
 | `registryctl add notary` says the project already has a Notary add-on | The command has already completed for this project. | Continue with `registryctl start`; do not run the add command twice. |
 | Notary returns `401` | The evaluator key was not loaded or is from another generated project. | Source `secrets/local.env` again in the current shell. |
 | Notary returns `403` | The key lacks the evidence scope or the purpose does not match the authored service. | Use `TUTORIAL_EVALUATOR_RAW` and the tutorial purpose shown above. |
diff --git a/docs/site/src/content/docs/tutorials/verify-opencrvs-claims.mdx b/docs/site/src/content/docs/tutorials/verify-opencrvs-claims.mdx
index c7e5be1fe..6fb937527 100644
--- a/docs/site/src/content/docs/tutorials/verify-opencrvs-claims.mdx
+++ b/docs/site/src/content/docs/tutorials/verify-opencrvs-claims.mdx
@@ -57,7 +57,7 @@ The result confirms the initialized project and next command:
 ```text
 Initialized Registry Stack project "fictional-civil-registry".
   Directory: opencrvs-project
-  Starter: opencrvs-dci (Registry Stack 0.10.0)
+  Starter: opencrvs-dci (Registry Stack 0.11.0)
   Starter content: matches bundled digest
   Editor support: VS Code and Zed (opencrvs-project/.registry-stack-editor/manifest.json)
 
diff --git a/docs/site/src/data/contracts.yaml b/docs/site/src/data/contracts.yaml
index e48240cec..6208fc797 100644
--- a/docs/site/src/data/contracts.yaml
+++ b/docs/site/src/data/contracts.yaml
@@ -5,7 +5,7 @@
   surface: Shared Rust crate APIs for auth helpers, OIDC verification, audit envelopes and sinks, HTTP security middleware, outbound HTTP policy, Ed25519 JWK and DID helpers, SD-JWT VC issuance, and testing fixtures.
   source_of_truth:
     label: Registry Platform crates
-    url: https://github.com/registrystack/registry-stack/tree/v0.10.0/crates
+    url: https://github.com/registrystack/registry-stack/tree/v0.11.0/crates
   consumer_note: Relay, Notary, and future registry services should consume these primitives instead of reimplementing security or operational behavior locally.
 - id: registry-relay.openapi
   name: Registry Relay OpenAPI
@@ -14,7 +14,7 @@
   surface: "Protected Registry Data API, metadata API, evidence offering discovery, aggregates, health and readiness, plus optional standards adapters (OGC API Features, OGC API Records, OGC API EDR, SP DCI)."
   source_of_truth:
     label: Registry Relay abstract OpenAPI contract
-    url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/openapi/registry-relay.openapi.json
+    url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/openapi/registry-relay.openapi.json
   consumer_note: Hand-authored from `docs/api.md` and the runtime route table. Uses templated paths and capability tags. For instance-specific shape of `{dataset_id}` and `{entity}`, fetch `GET /openapi.json` from a configured gateway. Runtime deployments gate that route by default unless `openapi_requires_auth` is disabled for demos or controlled tooling.
 - id: registry-notary.openapi
   name: Registry Notary OpenAPI
@@ -23,7 +23,7 @@
   surface: Claim discovery, claim evaluation, batch evaluation, federated delegated evaluation, rendering, JWKS, service metadata, and credential issuance.
   source_of_truth:
     label: Registry Notary OpenAPI generator
-    url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-notary-server/src/openapi.rs
+    url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/openapi.rs
   consumer_note: Generate with `cargo run -p registry-notary -- openapi`. Both direct and OID4VCI credential routes require a fresh non-delegated stored evaluation with exact claim pins and normalized unique Relay execution records for every selected root's registry-backed dependency closure.
 - id: registry-notary.oid4vci
   name: Registry Notary OID4VCI surface
@@ -32,14 +32,15 @@
   surface: OID4VCI offer start and callback (`/oid4vci/offer/start`, `/oid4vci/offer/callback`), credential offer (`GET /oid4vci/credential-offer`), nonce (`POST /oid4vci/nonce`), token (`POST /oid4vci/token`), credential request (`POST /oid4vci/credential`), VCT credential and metadata routes (`/credentials/{vct_path}`, `/.well-known/vct/{vct_path}`), and issuer metadata (`GET /.well-known/openid-credential-issuer`). Primitives sourced from the `registry-platform-oid4vci` crate.
   source_of_truth:
     label: Registry Notary OID4VCI routes
-    url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-notary-server/src/api.rs
+    url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/api.rs
   consumer_note: >-
     OID4VCI flow advertising `dc+sd-jwt` credential format. Credential
     configurations accept non-delegated registry-backed claims only and issuance verifies the
-    exact dependency-closure Relay execution provenance before signing. Solmara Lab checks
-    the hosted issuer metadata, credential offer, nonce, authorization redirect,
-    and unauthenticated denial paths through `just hosted-smoke`. Full OID4VCI
-    Draft 13 `vc+sd-jwt` wallet conformance is not asserted at this version.
+    exact dependency-closure Relay execution provenance before signing. Solmara Lab carries
+    a `just hosted-smoke` harness for issuer metadata, credential offer, nonce,
+    authorization redirect, and unauthenticated denial paths. Beta-13 hosted evidence remains
+    pending until the lab is repinned to published v0.11.0 digests and that harness passes.
+    Full OID4VCI Draft 13 `vc+sd-jwt` wallet conformance is not asserted at this version.
 - id: registry-notary.federated-evaluation
   name: Registry Notary Federated Evaluation MVP
   owner: registry-notary
@@ -47,7 +48,7 @@
   surface: Static-peer delegated evaluation over `POST /federation/v1/evaluations`, compact JWS request and response JWTs, peer policy checks, pairwise subject handles, replay protection, and federation audit fields.
   source_of_truth:
     label: Registry Notary federation module
-    url: https://github.com/registrystack/registry-stack/tree/v0.10.0/crates/registry-notary-server/src/federation
+    url: https://github.com/registrystack/registry-stack/tree/v0.11.0/crates/registry-notary-server/src/federation
   consumer_note: This is delegated evaluation only. Open federation, trust-chain discovery, shared replay storage, audit checkpoint exchange, and federated credential issuance are outside the MVP.
 - id: registry-manifest.metadata-yaml
   name: Metadata Manifest
@@ -56,7 +57,7 @@
   surface: Portable `metadata.yaml` documents, compiled metadata model, public services, forms, policies, requirements, evidence type lists, evidence offering metadata, public federation metadata, and evaluation profile metadata.
   source_of_truth:
     label: Registry Manifest core
-    url: https://github.com/registrystack/registry-stack/tree/v0.10.0/crates/registry-manifest-core
+    url: https://github.com/registrystack/registry-stack/tree/v0.11.0/crates/registry-manifest-core
   consumer_note: Runtime source paths, scopes, table names, backend URLs, peer allowlists, replay storage, and federation secrets belong in runtime service config, not manifests.
 - id: registry-manifest.cpsv-ap-service-catalogue
   name: CPSV-AP Service Catalogue Render Contract
@@ -65,7 +66,7 @@
   surface: CPSV-AP JSON-LD service catalogue, CCCEV requirements, grouped evidence type lists, local form-definition links, DCAT data services, and form JSON Schemas.
   source_of_truth:
     label: Registry Manifest CPSV-AP fixture
-    url: https://github.com/registrystack/registry-stack/tree/v0.10.0/products/manifest/fixtures/cpsv-ap
+    url: https://github.com/registrystack/registry-stack/tree/v0.11.0/products/manifest/fixtures/cpsv-ap
   consumer_note: Each CCCEV evidence type list is one grouped option; multiple lists on a requirement are alternatives.
 - id: registry-manifest.static-publication
   name: Static Metadata Publication Bundle
@@ -74,5 +75,5 @@
   surface: Static index, catalog JSON, evidence offerings, policies, DCAT, CPSV-AP, BRegDCAT-AP, SHACL, OGC Records item collection, entity JSON Schemas, form JSON Schemas, and embedded SKOS-shaped codelist nodes.
   source_of_truth:
     label: Registry Manifest CLI
-    url: https://github.com/registrystack/registry-stack/tree/v0.10.0/crates/registry-manifest-cli
+    url: https://github.com/registrystack/registry-stack/tree/v0.11.0/crates/registry-manifest-cli
   consumer_note: The bundle can be hosted as static files without running Registry Relay.
diff --git a/docs/site/src/data/docsets.yaml b/docs/site/src/data/docsets.yaml
index 55b133188..cc6de34e6 100644
--- a/docs/site/src/data/docsets.yaml
+++ b/docs/site/src/data/docsets.yaml
@@ -9,17 +9,47 @@ docsets:
     description: Current RegistryStack monorepo documentation build.
     products:
       registry-stack:
-        version: v0.10.0
+        version: v0.11.0
         ref: HEAD
       registry-relay:
-        version: v0.10.0
+        version: v0.11.0
         ref: HEAD
       registry-notary:
-        version: v0.10.0
+        version: v0.11.0
         ref: HEAD
       registry-manifest:
-        version: v0.10.0
+        version: v0.11.0
         ref: HEAD
+  - id: v0.11.0
+    label: v0.11.0
+    path: /v/0.11.0/
+    status: archived
+    source: registry-stack-v0.11.0
+    repo_docs_source: monorepo
+    published_at: 2026-07-18
+    description: RegistryStack v0.11.0 beta-13 documentation set.
+    products:
+      registry-stack:
+        version: v0.11.0
+        ref: cb795ea3a09ba81df59c56520d1a4ad039c0fa79
+      registry-platform:
+        version: v0.11.0
+        ref: cb795ea3a09ba81df59c56520d1a4ad039c0fa79
+      registry-manifest:
+        version: v0.11.0
+        ref: cb795ea3a09ba81df59c56520d1a4ad039c0fa79
+      registry-notary:
+        version: v0.11.0
+        ref: cb795ea3a09ba81df59c56520d1a4ad039c0fa79
+      registry-relay:
+        version: v0.11.0
+        ref: cb795ea3a09ba81df59c56520d1a4ad039c0fa79
+      registry-registryctl:
+        version: v0.11.0
+        ref: cb795ea3a09ba81df59c56520d1a4ad039c0fa79
+      crosswalk:
+        version: crosswalk-core-v0.2.0
+        ref: 1d44ec735fdc8a7c719264b339574371e8330337
   - id: v0.10.0
     label: v0.10.0
     path: /v/0.10.0/
diff --git a/docs/site/src/data/generated/contracts.json b/docs/site/src/data/generated/contracts.json
index f0a1f4b4f..02981ce41 100644
--- a/docs/site/src/data/generated/contracts.json
+++ b/docs/site/src/data/generated/contracts.json
@@ -7,7 +7,7 @@
     "surface": "Shared Rust crate APIs for auth helpers, OIDC verification, audit envelopes and sinks, HTTP security middleware, outbound HTTP policy, Ed25519 JWK and DID helpers, SD-JWT VC issuance, and testing fixtures.",
     "source_of_truth": {
       "label": "Registry Platform crates",
-      "url": "https://github.com/registrystack/registry-stack/tree/v0.10.0/crates"
+      "url": "https://github.com/registrystack/registry-stack/tree/v0.11.0/crates"
     },
     "consumer_note": "Relay, Notary, and future registry services should consume these primitives instead of reimplementing security or operational behavior locally."
   },
@@ -19,7 +19,7 @@
     "surface": "Protected Registry Data API, metadata API, evidence offering discovery, aggregates, health and readiness, plus optional standards adapters (OGC API Features, OGC API Records, OGC API EDR, SP DCI).",
     "source_of_truth": {
       "label": "Registry Relay abstract OpenAPI contract",
-      "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/openapi/registry-relay.openapi.json"
+      "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/openapi/registry-relay.openapi.json"
     },
     "consumer_note": "Hand-authored from `docs/api.md` and the runtime route table. Uses templated paths and capability tags. For instance-specific shape of `{dataset_id}` and `{entity}`, fetch `GET /openapi.json` from a configured gateway. Runtime deployments gate that route by default unless `openapi_requires_auth` is disabled for demos or controlled tooling."
   },
@@ -31,7 +31,7 @@
     "surface": "Claim discovery, claim evaluation, batch evaluation, federated delegated evaluation, rendering, JWKS, service metadata, and credential issuance.",
     "source_of_truth": {
       "label": "Registry Notary OpenAPI generator",
-      "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-notary-server/src/openapi.rs"
+      "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/openapi.rs"
     },
     "consumer_note": "Generate with `cargo run -p registry-notary -- openapi`. Both direct and OID4VCI credential routes require a fresh non-delegated stored evaluation with exact claim pins and normalized unique Relay execution records for every selected root's registry-backed dependency closure."
   },
@@ -43,9 +43,9 @@
     "surface": "OID4VCI offer start and callback (`/oid4vci/offer/start`, `/oid4vci/offer/callback`), credential offer (`GET /oid4vci/credential-offer`), nonce (`POST /oid4vci/nonce`), token (`POST /oid4vci/token`), credential request (`POST /oid4vci/credential`), VCT credential and metadata routes (`/credentials/{vct_path}`, `/.well-known/vct/{vct_path}`), and issuer metadata (`GET /.well-known/openid-credential-issuer`). Primitives sourced from the `registry-platform-oid4vci` crate.",
     "source_of_truth": {
       "label": "Registry Notary OID4VCI routes",
-      "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-notary-server/src/api.rs"
+      "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/api.rs"
     },
-    "consumer_note": "OID4VCI flow advertising `dc+sd-jwt` credential format. Credential configurations accept non-delegated registry-backed claims only and issuance verifies the exact dependency-closure Relay execution provenance before signing. Solmara Lab checks the hosted issuer metadata, credential offer, nonce, authorization redirect, and unauthenticated denial paths through `just hosted-smoke`. Full OID4VCI Draft 13 `vc+sd-jwt` wallet conformance is not asserted at this version."
+    "consumer_note": "OID4VCI flow advertising `dc+sd-jwt` credential format. Credential configurations accept non-delegated registry-backed claims only and issuance verifies the exact dependency-closure Relay execution provenance before signing. Solmara Lab carries a `just hosted-smoke` harness for issuer metadata, credential offer, nonce, authorization redirect, and unauthenticated denial paths. Beta-13 hosted evidence remains pending until the lab is repinned to published v0.11.0 digests and that harness passes. Full OID4VCI Draft 13 `vc+sd-jwt` wallet conformance is not asserted at this version."
   },
   {
     "id": "registry-notary.federated-evaluation",
@@ -55,7 +55,7 @@
     "surface": "Static-peer delegated evaluation over `POST /federation/v1/evaluations`, compact JWS request and response JWTs, peer policy checks, pairwise subject handles, replay protection, and federation audit fields.",
     "source_of_truth": {
       "label": "Registry Notary federation module",
-      "url": "https://github.com/registrystack/registry-stack/tree/v0.10.0/crates/registry-notary-server/src/federation"
+      "url": "https://github.com/registrystack/registry-stack/tree/v0.11.0/crates/registry-notary-server/src/federation"
     },
     "consumer_note": "This is delegated evaluation only. Open federation, trust-chain discovery, shared replay storage, audit checkpoint exchange, and federated credential issuance are outside the MVP."
   },
@@ -67,7 +67,7 @@
     "surface": "Portable `metadata.yaml` documents, compiled metadata model, public services, forms, policies, requirements, evidence type lists, evidence offering metadata, public federation metadata, and evaluation profile metadata.",
     "source_of_truth": {
       "label": "Registry Manifest core",
-      "url": "https://github.com/registrystack/registry-stack/tree/v0.10.0/crates/registry-manifest-core"
+      "url": "https://github.com/registrystack/registry-stack/tree/v0.11.0/crates/registry-manifest-core"
     },
     "consumer_note": "Runtime source paths, scopes, table names, backend URLs, peer allowlists, replay storage, and federation secrets belong in runtime service config, not manifests."
   },
@@ -79,7 +79,7 @@
     "surface": "CPSV-AP JSON-LD service catalogue, CCCEV requirements, grouped evidence type lists, local form-definition links, DCAT data services, and form JSON Schemas.",
     "source_of_truth": {
       "label": "Registry Manifest CPSV-AP fixture",
-      "url": "https://github.com/registrystack/registry-stack/tree/v0.10.0/products/manifest/fixtures/cpsv-ap"
+      "url": "https://github.com/registrystack/registry-stack/tree/v0.11.0/products/manifest/fixtures/cpsv-ap"
     },
     "consumer_note": "Each CCCEV evidence type list is one grouped option; multiple lists on a requirement are alternatives."
   },
@@ -91,7 +91,7 @@
     "surface": "Static index, catalog JSON, evidence offerings, policies, DCAT, CPSV-AP, BRegDCAT-AP, SHACL, OGC Records item collection, entity JSON Schemas, form JSON Schemas, and embedded SKOS-shaped codelist nodes.",
     "source_of_truth": {
       "label": "Registry Manifest CLI",
-      "url": "https://github.com/registrystack/registry-stack/tree/v0.10.0/crates/registry-manifest-cli"
+      "url": "https://github.com/registrystack/registry-stack/tree/v0.11.0/crates/registry-manifest-cli"
     },
     "consumer_note": "The bundle can be hosted as static files without running Registry Relay."
   }
diff --git a/docs/site/src/data/generated/docsets.json b/docs/site/src/data/generated/docsets.json
index a173c5520..abfb4138e 100644
--- a/docs/site/src/data/generated/docsets.json
+++ b/docs/site/src/data/generated/docsets.json
@@ -11,23 +11,63 @@
       "description": "Current RegistryStack monorepo documentation build.",
       "products": {
         "registry-stack": {
-          "version": "v0.10.0",
+          "version": "v0.11.0",
           "ref": "HEAD"
         },
         "registry-relay": {
-          "version": "v0.10.0",
+          "version": "v0.11.0",
           "ref": "HEAD"
         },
         "registry-notary": {
-          "version": "v0.10.0",
+          "version": "v0.11.0",
           "ref": "HEAD"
         },
         "registry-manifest": {
-          "version": "v0.10.0",
+          "version": "v0.11.0",
           "ref": "HEAD"
         }
       }
     },
+    {
+      "id": "v0.11.0",
+      "label": "v0.11.0",
+      "path": "/v/0.11.0/",
+      "status": "archived",
+      "source": "registry-stack-v0.11.0",
+      "repo_docs_source": "monorepo",
+      "published_at": "2026-07-18",
+      "description": "RegistryStack v0.11.0 beta-13 documentation set.",
+      "products": {
+        "registry-stack": {
+          "version": "v0.11.0",
+          "ref": "cb795ea3a09ba81df59c56520d1a4ad039c0fa79"
+        },
+        "registry-platform": {
+          "version": "v0.11.0",
+          "ref": "cb795ea3a09ba81df59c56520d1a4ad039c0fa79"
+        },
+        "registry-manifest": {
+          "version": "v0.11.0",
+          "ref": "cb795ea3a09ba81df59c56520d1a4ad039c0fa79"
+        },
+        "registry-notary": {
+          "version": "v0.11.0",
+          "ref": "cb795ea3a09ba81df59c56520d1a4ad039c0fa79"
+        },
+        "registry-relay": {
+          "version": "v0.11.0",
+          "ref": "cb795ea3a09ba81df59c56520d1a4ad039c0fa79"
+        },
+        "registry-registryctl": {
+          "version": "v0.11.0",
+          "ref": "cb795ea3a09ba81df59c56520d1a4ad039c0fa79"
+        },
+        "crosswalk": {
+          "version": "crosswalk-core-v0.2.0",
+          "ref": "1d44ec735fdc8a7c719264b339574371e8330337"
+        }
+      }
+    },
     {
       "id": "v0.10.0",
       "label": "v0.10.0",
diff --git a/docs/site/src/data/generated/projects.json b/docs/site/src/data/generated/projects.json
index f5bedcc31..78baa4492 100644
--- a/docs/site/src/data/generated/projects.json
+++ b/docs/site/src/data/generated/projects.json
@@ -19,11 +19,11 @@
     "source_docs": [
       {
         "label": "README",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/products/platform/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/platform/README.md"
       },
       {
         "label": "Registry Platform crates",
-        "url": "https://github.com/registrystack/registry-stack/tree/v0.10.0/crates"
+        "url": "https://github.com/registrystack/registry-stack/tree/v0.11.0/crates"
       }
     ],
     "rename_status": "New shared workspace; not part of the 2026-05-23 rename wave."
@@ -48,11 +48,11 @@
     "source_docs": [
       {
         "label": "README",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/products/manifest/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md"
       },
       {
         "label": "Local examples",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/products/manifest/examples/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/examples/README.md"
       }
     ],
     "rename_status": "Already using the target repo name locally."
@@ -81,15 +81,15 @@
     "source_docs": [
       {
         "label": "README",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md"
       },
       {
         "label": "Local API docs",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/docs/api.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/docs/api.md"
       },
       {
         "label": "Local metadata docs",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/docs/metadata.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/docs/metadata.md"
       }
     ],
     "rename_status": "Local checkout renamed to `registry-relay`; old worktrees under `registry_relay-*` remain for historical evidence."
@@ -121,11 +121,11 @@
     "source_docs": [
       {
         "label": "README",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/products/notary/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/notary/README.md"
       },
       {
         "label": "OpenAPI source",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-notary-server/src/openapi.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/openapi.rs"
       }
     ],
     "rename_status": "Already using the target repo name locally."
diff --git a/docs/site/src/data/generated/standards.json b/docs/site/src/data/generated/standards.json
index db8e1e9b9..585bea56e 100644
--- a/docs/site/src/data/generated/standards.json
+++ b/docs/site/src/data/generated/standards.json
@@ -20,15 +20,15 @@
     "evidence_docs": [
       {
         "label": "Registry Relay README",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md"
       },
       {
         "label": "Registry Manifest README",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/products/manifest/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md"
       },
       {
         "label": "Registry Relay DCAT catalog tests",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/tests/catalog_entity.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/catalog_entity.rs"
       }
     ],
     "last_checked": "2026-06-13",
@@ -54,15 +54,15 @@
     "evidence_docs": [
       {
         "label": "Registry Relay README",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md"
       },
       {
         "label": "Registry Manifest README",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/products/manifest/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md"
       },
       {
         "label": "Registry Relay BRegDCAT-AP route tests",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/tests/catalog_entity.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/catalog_entity.rs"
       }
     ],
     "last_checked": "2026-06-13",
@@ -88,7 +88,7 @@
     "evidence_docs": [
       {
         "label": "Registry Manifest CPSV-AP fixture",
-        "url": "https://github.com/registrystack/registry-stack/tree/v0.10.0/products/manifest/fixtures/cpsv-ap"
+        "url": "https://github.com/registrystack/registry-stack/tree/v0.11.0/products/manifest/fixtures/cpsv-ap"
       }
     ],
     "last_checked": "2026-05-25",
@@ -114,15 +114,15 @@
     "evidence_docs": [
       {
         "label": "Registry Relay README",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md"
       },
       {
         "label": "Registry Manifest README",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/products/manifest/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md"
       },
       {
         "label": "Registry Relay OGC records API tests",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/tests/ogc_records_api.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/ogc_records_api.rs"
       }
     ],
     "last_checked": "2026-06-13",
@@ -147,11 +147,11 @@
     "evidence_docs": [
       {
         "label": "Registry Relay README",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md"
       },
       {
         "label": "Registry Relay OGC Features API tests",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/tests/ogc_api.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/ogc_api.rs"
       }
     ],
     "last_checked": "2026-06-20",
@@ -176,7 +176,7 @@
     "evidence_docs": [
       {
         "label": "Registry Relay OGC EDR API tests",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/tests/ogc_edr_api.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/ogc_edr_api.rs"
       }
     ],
     "last_checked": "2026-06-20",
@@ -202,19 +202,19 @@
     "evidence_docs": [
       {
         "label": "Registry Relay README",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md"
       },
       {
         "label": "Registry Notary README",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/products/notary/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/notary/README.md"
       },
       {
         "label": "Registry Relay generated OpenAPI document (pinned)",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/openapi/registry-relay.openapi.json"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/openapi/registry-relay.openapi.json"
       },
       {
         "label": "Registry Notary generated OpenAPI document (pinned)",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/products/notary/openapi/registry-notary.openapi.json"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/notary/openapi/registry-notary.openapi.json"
       }
     ],
     "last_checked": "2026-06-13",
@@ -240,15 +240,15 @@
     "evidence_docs": [
       {
         "label": "Registry Relay README",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md"
       },
       {
         "label": "Registry Manifest README",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/products/manifest/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md"
       },
       {
         "label": "Registry Relay SHACL document structure tests",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/tests/catalog_entity.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/catalog_entity.rs"
       }
     ],
     "last_checked": "2026-06-13",
@@ -274,11 +274,11 @@
     "evidence_docs": [
       {
         "label": "Registry Manifest codelist renderer",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-manifest-core/src/lib.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-manifest-core/src/lib.rs"
       },
       {
         "label": "Registry Manifest codelist tests",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-manifest-core/tests/metadata_core.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-manifest-core/tests/metadata_core.rs"
       }
     ],
     "last_checked": "2026-06-20",
@@ -304,15 +304,15 @@
     "evidence_docs": [
       {
         "label": "Registry Relay README",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md"
       },
       {
         "label": "Registry Manifest README",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/products/manifest/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md"
       },
       {
         "label": "Registry Manifest form schema fixture (Draft 2020-12)",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/products/manifest/fixtures/cpsv-ap/health-linked-child-support.form.schema.json"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/fixtures/cpsv-ap/health-linked-child-support.form.schema.json"
       }
     ],
     "last_checked": "2026-06-13",
@@ -341,15 +341,15 @@
     "evidence_docs": [
       {
         "label": "Registry Relay JSON-LD renderers",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/src/metadata/shacl.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/src/metadata/shacl.rs"
       },
       {
         "label": "Registry Notary CCCEV renderer",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-notary-server/src/runtime.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/runtime.rs"
       },
       {
         "label": "Registry Manifest CPSV-AP JSON-LD fixture",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/products/manifest/fixtures/cpsv-ap/health-linked-child-support.cpsv-ap.jsonld"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/fixtures/cpsv-ap/health-linked-child-support.cpsv-ap.jsonld"
       }
     ],
     "last_checked": "2026-06-13",
@@ -376,15 +376,15 @@
     "evidence_docs": [
       {
         "label": "Registry Notary SD-JWT VC conformance profile",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/products/notary/docs/sd-jwt-vc-conformance-profile.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/notary/docs/sd-jwt-vc-conformance-profile.md"
       },
       {
         "label": "Registry Notary format constants",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-notary-core/src/model.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-core/src/model.rs"
       },
       {
         "label": "Registry Platform SD-JWT crate",
-        "url": "https://github.com/registrystack/registry-stack/tree/v0.10.0/crates/registry-platform-sdjwt"
+        "url": "https://github.com/registrystack/registry-stack/tree/v0.11.0/crates/registry-platform-sdjwt"
       }
     ],
     "last_checked": "2026-06-13",
@@ -409,7 +409,7 @@
     "evidence_docs": [
       {
         "label": "Registry Notary README",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/products/notary/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/notary/README.md"
       }
     ],
     "last_checked": "2026-05-23",
@@ -438,15 +438,15 @@
     "evidence_docs": [
       {
         "label": "Registry Manifest grouped evidence fixture",
-        "url": "https://github.com/registrystack/registry-stack/tree/v0.10.0/products/manifest/fixtures/cpsv-ap"
+        "url": "https://github.com/registrystack/registry-stack/tree/v0.11.0/products/manifest/fixtures/cpsv-ap"
       },
       {
         "label": "Registry Notary CCCEV renderer",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-notary-server/src/runtime.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/runtime.rs"
       },
       {
         "label": "Registry Notary media type constants",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-notary-core/src/model.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-core/src/model.rs"
       }
     ],
     "last_checked": "2026-05-25",
@@ -474,23 +474,23 @@
     "evidence_docs": [
       {
         "label": "Registry Relay README",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md"
       },
       {
         "label": "Registry Manifest README",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/products/manifest/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md"
       },
       {
         "label": "Registry Relay catalog tests (ODRL offer assertions)",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/tests/catalog_entity.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/catalog_entity.rs"
       },
       {
         "label": "Registry Platform PDP ODRL enforcement profile constants",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-platform-pdp/src/lib.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-platform-pdp/src/lib.rs"
       },
       {
         "label": "Registry Relay governed evidence PDP path",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/src/api/governed.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/src/api/governed.rs"
       }
     ],
     "last_checked": "2026-07-09",
@@ -515,11 +515,11 @@
     "evidence_docs": [
       {
         "label": "Registry Relay client integration guide",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/docs/client-integration.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/docs/client-integration.md"
       },
       {
         "label": "Registry Relay aggregates tests (schema-validated SDMX-JSON output)",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/tests/aggregates_entity.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/aggregates_entity.rs"
       }
     ],
     "last_checked": "2026-06-13",
@@ -544,7 +544,7 @@
     "evidence_docs": [
       {
         "label": "Registry Notary claim model",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-notary-core/src/model.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-core/src/model.rs"
       }
     ],
     "last_checked": "2026-05-23",
@@ -598,7 +598,7 @@
     "evidence_docs": [
       {
         "label": "Registry Relay README",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md"
       }
     ],
     "last_checked": "2026-05-23",
@@ -650,7 +650,7 @@
     "evidence_docs": [
       {
         "label": "Registry Relay README",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/README.md"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md"
       },
       {
         "label": "Registry Stack OpenCRVS project-authoring fixture",
@@ -684,11 +684,11 @@
     "evidence_docs": [
       {
         "label": "Registry Notary OID4VCI routes",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-notary-server/src/api.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/api.rs"
       },
       {
         "label": "Registry Platform OID4VCI crate",
-        "url": "https://github.com/registrystack/registry-stack/tree/v0.10.0/crates/registry-platform-oid4vci"
+        "url": "https://github.com/registrystack/registry-stack/tree/v0.11.0/crates/registry-platform-oid4vci"
       },
       {
         "label": "Historical Registry Lab citizen OID4VCI smoke script",
@@ -700,7 +700,7 @@
       }
     ],
     "last_checked": "2026-06-13",
-    "notes": "Registry Notary exposes the OID4VCI credential offer, nonce, credential, and issuer-metadata routes as a profiled subset of OID4VCI Draft 13. The historical v0.9.0 Registry Lab issuer metadata advertised `format: dc+sd-jwt` for the citizen credential configuration. Registry Platform owns the underlying primitives in the `registry-platform-oid4vci` crate. The historical Registry Lab exercised the flow through the `just citizen-oid4vci-*` recipes at v0.9.0. Solmara Lab checks the current hosted issuer metadata, credential offer, nonce, authorization redirect, and unauthenticated denial paths through `just hosted-smoke`. Full OID4VCI issuer conformance is not asserted: the server advertises itself as `openid4vci.support: not_full_issuer`, and the surfaces emit the protocol shape validated by the checked smoke paths."
+    "notes": "Registry Notary exposes the OID4VCI credential offer, nonce, credential, and issuer-metadata routes as a profiled subset of OID4VCI Draft 13. The historical v0.9.0 Registry Lab issuer metadata advertised `format: dc+sd-jwt` for the citizen credential configuration. Registry Platform owns the underlying primitives in the `registry-platform-oid4vci` crate. The historical Registry Lab exercised the flow through the `just citizen-oid4vci-*` recipes at v0.9.0. Solmara Lab carries a `just hosted-smoke` harness for issuer metadata, credential offer, nonce, authorization redirect, and unauthenticated denial paths. Beta-13 hosted evidence remains pending until the lab is repinned to published v0.11.0 digests and that harness passes. Full OID4VCI issuer conformance is not asserted: the server advertises itself as `openid4vci.support: not_full_issuer`, and the surfaces emit the protocol shape validated by the checked smoke paths."
   },
   {
     "id": "w3c-did",
@@ -723,11 +723,11 @@
     "evidence_docs": [
       {
         "label": "Registry Notary did:jwk handling",
-        "url": "https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-notary-server/src/api.rs"
+        "url": "https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/api.rs"
       },
       {
         "label": "Registry Platform crypto crate",
-        "url": "https://github.com/registrystack/registry-stack/tree/v0.10.0/crates/registry-platform-crypto"
+        "url": "https://github.com/registrystack/registry-stack/tree/v0.11.0/crates/registry-platform-crypto"
       }
     ],
     "last_checked": "2026-06-13",
diff --git a/docs/site/src/data/projects.yaml b/docs/site/src/data/projects.yaml
index 48b0039a9..97c057fb7 100644
--- a/docs/site/src/data/projects.yaml
+++ b/docs/site/src/data/projects.yaml
@@ -14,9 +14,9 @@
     - Product-level authorization policy, tenant isolation, audit retention, secret provisioning, or deployment configuration.
   source_docs:
     - label: README
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/products/platform/README.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/platform/README.md
     - label: Registry Platform crates
-      url: https://github.com/registrystack/registry-stack/tree/v0.10.0/crates
+      url: https://github.com/registrystack/registry-stack/tree/v0.11.0/crates
   rename_status: New shared workspace; not part of the 2026-05-23 rename wave.
 - id: registry-manifest
   name: Registry Manifest
@@ -34,9 +34,9 @@
     - Production source configuration.
   source_docs:
     - label: README
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/products/manifest/README.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md
     - label: Local examples
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/products/manifest/examples/README.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/examples/README.md
   rename_status: Already using the target repo name locally.
 - id: registry-relay
   name: Registry Relay
@@ -58,11 +58,11 @@
     - Storage table ids or arbitrary SQL in public APIs.
   source_docs:
     - label: README
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/README.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md
     - label: Local API docs
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/docs/api.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/docs/api.md
     - label: Local metadata docs
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/docs/metadata.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/docs/metadata.md
   rename_status: Local checkout renamed to `registry-relay`; old worktrees under `registry_relay-*` remain for historical evidence.
 - id: registry-notary
   name: Registry Notary
@@ -87,9 +87,9 @@
     - Credential issuance from source-free or self-attested evidence.
   source_docs:
     - label: README
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/products/notary/README.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/notary/README.md
     - label: OpenAPI source
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-notary-server/src/openapi.rs
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/openapi.rs
   rename_status: Already using the target repo name locally.
 - id: solmara-lab
   name: Solmara Lab
diff --git a/docs/site/src/data/repo-docs.yaml b/docs/site/src/data/repo-docs.yaml
index 0d73021da..da07016c2 100644
--- a/docs/site/src/data/repo-docs.yaml
+++ b/docs/site/src/data/repo-docs.yaml
@@ -8,7 +8,7 @@ repos:
   registry-relay:
     remote: https://github.com/registrystack/registry-stack
     ref: HEAD
-    version: v0.10.0
+    version: v0.11.0
     local: ../..
     openapi: crates/registry-relay/openapi/registry-relay.openapi.json
     archive_remote: https://github.com/jeremi/registry-relay
@@ -23,7 +23,7 @@ repos:
         last_reviewed: unreviewed
         standards_referenced: [openapi, ogc-api-records, ogc-api-features, ogc-api-edr, odrl, sp-dci]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0]
             standards_referenced: [openapi, ogc-api-records, ogc-api-features, ogc-api-edr, odrl, sp-dci]
             last_reviewed: unreviewed
           - docsets: [v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
@@ -39,7 +39,7 @@ repos:
         last_reviewed: unreviewed
         standards_referenced: [openapi, sdmx, w3c-did]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0]
             standards_referenced: [openapi, sdmx, w3c-did]
             last_reviewed: unreviewed
           - docsets: [v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
@@ -54,7 +54,7 @@ repos:
         last_reviewed: unreviewed
         standards_referenced: [openapi, ogc-api-features, ogc-api-edr, odrl, sp-dci, w3c-did]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0]
             standards_referenced: [openapi, ogc-api-features, ogc-api-edr, odrl, sp-dci, w3c-did]
             last_reviewed: unreviewed
           - docsets: [v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
@@ -68,7 +68,7 @@ repos:
         last_reviewed: unreviewed
         standards_referenced: [dcat, bregdcat-ap, ogc-api-records, ogc-api-features, ogc-api-edr, openapi, shacl, json-schema, sdmx, sp-dci, w3c-did]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0]
             standards_referenced: [dcat, bregdcat-ap, ogc-api-records, ogc-api-features, ogc-api-edr, openapi, shacl, json-schema, sdmx, sp-dci, w3c-did]
             last_reviewed: unreviewed
           - docsets: [v0.8.4, v0.8.3, v0.8.2, v0.8.1]
@@ -84,7 +84,7 @@ repos:
         standards_referenced: [dcat, bregdcat-ap, cpsv-ap, ogc-api-records, ogc-api-features, shacl, json-schema, json-ld, odrl, sp-dci, w3c-did]
         exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
             standards_referenced: [dcat, bregdcat-ap, cpsv-ap, ogc-api-records, ogc-api-features, shacl, json-schema, json-ld, odrl, sp-dci, w3c-did]
             last_reviewed: unreviewed
       - src: crates/registry-relay/docs/ops.md
@@ -95,7 +95,7 @@ repos:
         last_reviewed: unreviewed
         standards_referenced: [dcat, bregdcat-ap, ogc-api-edr, sp-dci, w3c-did]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0]
             standards_referenced: [dcat, bregdcat-ap, ogc-api-edr, sp-dci, w3c-did]
             last_reviewed: unreviewed
           - docsets: [v0.8.4, v0.8.3, v0.8.2, v0.8.1]
@@ -110,7 +110,7 @@ repos:
         last_reviewed: unreviewed
         standards_referenced: [json-ld, w3c-did]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0]
             standards_referenced: [json-ld, w3c-did]
             last_reviewed: unreviewed
           - docsets: [v0.8.4, v0.8.3, v0.8.2, v0.8.1]
@@ -126,7 +126,7 @@ repos:
         standards_referenced: []
         exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
             standards_referenced: []
             last_reviewed: unreviewed
       - src: crates/registry-relay/docs/standards-adapter-operator-guide.md
@@ -137,7 +137,7 @@ repos:
         last_reviewed: unreviewed
         standards_referenced: [ogc-api-records, ogc-api-features, ogc-api-edr, sp-dci]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0]
             standards_referenced: [ogc-api-records, ogc-api-features, ogc-api-edr, sp-dci]
             last_reviewed: unreviewed
           - docsets: [v0.8.4, v0.8.3, v0.8.2, v0.8.1]
@@ -153,7 +153,7 @@ repos:
         standards_referenced: []
         exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
             standards_referenced: []
             last_reviewed: unreviewed
       - src: crates/registry-relay/STANDARDS_ASSUMPTIONS.md
@@ -165,7 +165,7 @@ repos:
         standards_referenced: [dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, json-schema, odrl, sp-dci, w3c-did]
         exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
             standards_referenced: [dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, json-schema, odrl, sp-dci, w3c-did]
             last_reviewed: unreviewed
       - src: crates/registry-relay/docs/relay-scenario-catalog.md
@@ -177,7 +177,7 @@ repos:
         standards_referenced: [dcat, ogc-api-records, ogc-api-features, openapi, shacl, sp-dci]
         exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
             standards_referenced: [dcat, ogc-api-records, ogc-api-features, openapi, shacl, sp-dci]
             last_reviewed: unreviewed
       - src: crates/registry-relay/docs/release-notes.md
@@ -188,7 +188,7 @@ repos:
         last_reviewed: unreviewed
         standards_referenced: [dcat, ogc-api-edr, openapi, shacl, json-ld, sdmx, sp-dci, w3c-did]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0]
             standards_referenced: [dcat, ogc-api-edr, openapi, shacl, json-ld, sdmx, sp-dci, w3c-did]
             last_reviewed: unreviewed
           - docsets: [v0.8.4, v0.8.3, v0.8.2, v0.8.1]
@@ -198,7 +198,7 @@ repos:
   registry-notary:
     remote: https://github.com/registrystack/registry-stack
     ref: HEAD
-    version: v0.10.0
+    version: v0.11.0
     local: ../..
     openapi: products/notary/openapi/registry-notary.openapi.json
     archive_remote: https://github.com/jeremi/registry-notary
@@ -216,7 +216,7 @@ repos:
           - docsets: [beta-2026-06-12]
             standards_referenced: [sd-jwt-vc, oid4vci]
             last_reviewed: unreviewed
-          - docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3]
             standards_referenced: [sd-jwt-vc, oid4vci, fhir-r4]
             last_reviewed: unreviewed
         description: Integrator and operator documentation for Registry Notary.
@@ -232,7 +232,7 @@ repos:
           - docsets: [beta-4, beta-3, beta-2026-06-12]
             standards_referenced: [sd-jwt-vc, oid4vci, w3c-did]
             last_reviewed: unreviewed
-          - docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5]
             standards_referenced: [sd-jwt-vc, oid4vci, w3c-did, fhir-r4]
             last_reviewed: unreviewed
       - src: products/notary/docs/client-sdk-guide.md
@@ -247,7 +247,7 @@ repos:
           - docsets: [beta-2026-06-12]
             standards_referenced: [sd-jwt-vc, oid4vci]
             last_reviewed: unreviewed
-          - docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3]
             standards_referenced: [sd-jwt-vc, oid4vci, w3c-did]
             last_reviewed: unreviewed
       - src: products/notary/docs/identity-and-record-matching.md
@@ -259,7 +259,7 @@ repos:
         last_reviewed: unreviewed
         standards_referenced: [sd-jwt-vc, verifiable-credentials]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
             standards_referenced: [sd-jwt-vc, verifiable-credentials]
             last_reviewed: unreviewed
       - src: products/notary/docs/source-claim-modeling-guide.md
@@ -274,7 +274,7 @@ repos:
           - docsets: [beta-4, beta-3, beta-2026-06-12]
             standards_referenced: [sd-jwt-vc]
             last_reviewed: unreviewed
-          - docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5]
             standards_referenced: [sd-jwt-vc, fhir-r4]
             last_reviewed: unreviewed
       - src: products/notary/docs/operator-config-reference.md
@@ -286,7 +286,7 @@ repos:
         last_reviewed: unreviewed
         standards_referenced: [openapi, sd-jwt-vc, sp-dci, oid4vci, w3c-did, fhir-r4]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0]
             standards_referenced: [openapi, sd-jwt-vc, sp-dci, oid4vci, w3c-did, fhir-r4]
             last_reviewed: unreviewed
           - docsets: [v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3]
@@ -303,7 +303,7 @@ repos:
         last_reviewed: unreviewed
         standards_referenced: []
         docset_overrides:
-          - docsets: [v0.10.0]
+          - docsets: [v0.11.0, v0.10.0]
             standards_referenced: []
             last_reviewed: unreviewed
         exclude_docsets: [v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
@@ -316,7 +316,7 @@ repos:
         last_reviewed: unreviewed
         standards_referenced: [sd-jwt-vc, w3c-did]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
             standards_referenced: [sd-jwt-vc, w3c-did]
             last_reviewed: unreviewed
       - src: products/notary/docs/credential-issuance-migration.md
@@ -326,6 +326,10 @@ repos:
         doc_type: how-to
         last_reviewed: "2026-07-17"
         standards_referenced: [sd-jwt-vc, oid4vci, w3c-did]
+        docset_overrides:
+          - docsets: [v0.11.0]
+            standards_referenced: [sd-jwt-vc, oid4vci, w3c-did]
+            last_reviewed: "2026-07-17"
         exclude_docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
       - src: products/notary/docs/signing-key-provider.md
         archive_src: docs/signing-key-provider.md
@@ -336,7 +340,7 @@ repos:
         last_reviewed: unreviewed
         standards_referenced: [sd-jwt-vc, w3c-did]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
             standards_referenced: [sd-jwt-vc, w3c-did]
             last_reviewed: unreviewed
       - src: products/notary/docs/sd-jwt-vc-conformance-profile.md
@@ -348,7 +352,7 @@ repos:
         last_reviewed: unreviewed
         standards_referenced: [json-ld, sd-jwt-vc, verifiable-credentials, oid4vci, w3c-did]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
             standards_referenced: [json-ld, sd-jwt-vc, verifiable-credentials, oid4vci, w3c-did]
             last_reviewed: unreviewed
       - src: products/notary/docs/notary-capability-matrix.md
@@ -360,7 +364,7 @@ repos:
         standards_referenced: [sd-jwt-vc, w3c-did]
         exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
             standards_referenced: [sd-jwt-vc, w3c-did]
             last_reviewed: unreviewed
       - src: products/notary/docs/notary-scenario-patterns.md
@@ -372,7 +376,7 @@ repos:
         standards_referenced: [sd-jwt-vc, w3c-did]
         exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
             standards_referenced: [sd-jwt-vc, w3c-did]
             last_reviewed: unreviewed
       - src: products/notary/docs/federated-evaluation-operator-guide.md
@@ -384,7 +388,7 @@ repos:
         standards_referenced: [w3c-did]
         exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
             standards_referenced: [w3c-did]
             last_reviewed: unreviewed
       - src: products/notary/docs/self-attestation-operator-guide.md
@@ -396,7 +400,7 @@ repos:
         standards_referenced: [sd-jwt-vc, oid4vci, w3c-did]
         exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
             standards_referenced: [sd-jwt-vc, oid4vci, w3c-did]
             last_reviewed: unreviewed
       - src: products/notary/docs/deployment-hardening-runbook.md
@@ -408,7 +412,7 @@ repos:
         standards_referenced: [sd-jwt-vc, oid4vci]
         exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
             standards_referenced: [sd-jwt-vc, oid4vci]
             last_reviewed: unreviewed
       - src: products/notary/docs/api-reference.md
@@ -420,7 +424,7 @@ repos:
         standards_referenced: [openapi, sd-jwt-vc, cccev, oid4vci, fhir-r4]
         exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
             standards_referenced: [openapi, sd-jwt-vc, cccev, oid4vci, fhir-r4]
             last_reviewed: unreviewed
       - src: products/notary/docs/oid4vci-wallet-interop.md
@@ -432,7 +436,7 @@ repos:
         standards_referenced: [sd-jwt-vc, oid4vci, w3c-did]
         exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
             standards_referenced: [sd-jwt-vc, oid4vci, w3c-did]
             last_reviewed: unreviewed
       - src: products/notary/docs/release-notes.md
@@ -444,13 +448,13 @@ repos:
         standards_referenced: [openapi, sd-jwt-vc, oid4vci, fhir-r4]
         exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
             standards_referenced: [openapi, sd-jwt-vc, oid4vci, fhir-r4]
             last_reviewed: unreviewed
   registry-manifest:
     remote: https://github.com/registrystack/registry-stack
     ref: HEAD
-    version: v0.10.0
+    version: v0.11.0
     local: ../..
     archive_remote: https://github.com/jeremi/registry-manifest
     docs:
@@ -463,7 +467,7 @@ repos:
         last_reviewed: unreviewed
         standards_referenced: [dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, skos, json-schema, json-ld, odrl, sp-dci, w3c-did, prov-o, govstack-digital-registries]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3]
             standards_referenced: [dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, skos, json-schema, json-ld, odrl, sp-dci, w3c-did, prov-o, govstack-digital-registries]
             last_reviewed: unreviewed
           - docsets: [beta-2026-06-12]
@@ -482,7 +486,7 @@ repos:
           - docsets: [beta-2026-06-12]
             standards_referenced: [dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, json-schema, json-ld, odrl]
             last_reviewed: unreviewed
-          - docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3]
             standards_referenced: [dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, skos, json-schema, json-ld, odrl]
             last_reviewed: unreviewed
       - src: products/manifest/docs/profile-fixtures.md
@@ -494,7 +498,7 @@ repos:
         last_reviewed: unreviewed
         standards_referenced: [sp-dci]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
             standards_referenced: [sp-dci]
             last_reviewed: unreviewed
       - src: products/manifest/docs/reference.md
@@ -509,7 +513,7 @@ repos:
           - docsets: [beta-2026-06-12]
             standards_referenced: [dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, json-schema, json-ld, cccev, odrl, w3c-did]
             last_reviewed: unreviewed
-          - docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3]
             standards_referenced: [dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, skos, json-schema, json-ld, cccev, odrl, w3c-did]
             last_reviewed: unreviewed
       - src: products/manifest/docs/itb-semic-validation.md
@@ -521,6 +525,6 @@ repos:
         standards_referenced: [dcat, bregdcat-ap, shacl, skos, json-schema, json-ld]
         exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12]
         docset_overrides:
-          - docsets: [v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
+          - docsets: [v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
             standards_referenced: [dcat, bregdcat-ap, shacl, skos, json-schema, json-ld]
             last_reviewed: unreviewed
diff --git a/docs/site/src/data/standards.yaml b/docs/site/src/data/standards.yaml
index 29fa448ba..c3765482f 100644
--- a/docs/site/src/data/standards.yaml
+++ b/docs/site/src/data/standards.yaml
@@ -15,11 +15,11 @@
     - access service metadata
   evidence_docs:
     - label: Registry Relay README
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/README.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md
     - label: Registry Manifest README
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/products/manifest/README.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md
     - label: Registry Relay DCAT catalog tests
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/tests/catalog_entity.rs
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/catalog_entity.rs
   last_checked: 2026-06-13
   notes: Relay and Manifest emit DCAT-shaped metadata; the emitted catalog structure is asserted by Relay's catalog tests. Profile conformance claims still require profile-specific validation evidence (no DCAT validator output is pinned).
 - id: bregdcat-ap
@@ -38,11 +38,11 @@
     - embedded SHACL entity shapes
   evidence_docs:
     - label: Registry Relay README
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/README.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md
     - label: Registry Manifest README
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/products/manifest/README.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md
     - label: Registry Relay BRegDCAT-AP route tests
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/tests/catalog_entity.rs
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/catalog_entity.rs
   last_checked: 2026-06-13
   notes: Manifest and Relay emit BRegDCAT-shaped registry and data-service metadata; the `/metadata/dcat/bregdcat-ap` route output is asserted by Relay's catalog tests. CPSV-AP is now the service-discovery layer; BRegDCAT-AP remains the registry and data-service discovery layer. Later BRegDCAT-AP releases require a separate renderer review.
 - id: cpsv-ap
@@ -61,7 +61,7 @@
     - competent authority and requirement links
   evidence_docs:
     - label: Registry Manifest CPSV-AP fixture
-      url: https://github.com/registrystack/registry-stack/tree/v0.10.0/products/manifest/fixtures/cpsv-ap
+      url: https://github.com/registrystack/registry-stack/tree/v0.11.0/products/manifest/fixtures/cpsv-ap
   last_checked: 2026-05-25
   notes: Registry Manifest emits CPSV-AP service catalogues. Registry Relay does not expose a current CPSV-AP runtime route.
 - id: ogc-api-records
@@ -80,11 +80,11 @@
     - OGC records item bodies
   evidence_docs:
     - label: Registry Relay README
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/README.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md
     - label: Registry Manifest README
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/products/manifest/README.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md
     - label: Registry Relay OGC records API tests
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/tests/ogc_records_api.rs
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/ogc_records_api.rs
   last_checked: 2026-06-13
   notes: Relay exposes records routes behind the ogcapi-records feature (route output asserted by the OGC records API tests), and Manifest renders and publishes static OGC Records item collections.
 - id: ogc-api-features
@@ -102,9 +102,9 @@
     - dataset-scoped feature items
   evidence_docs:
     - label: Registry Relay README
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/README.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md
     - label: Registry Relay OGC Features API tests
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/tests/ogc_api.rs
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/ogc_api.rs
   last_checked: 2026-06-20
   notes: Relay exposes OGC API Features routes behind the ogcapi-features feature. The claim is scoped to the profiled route output tested in Registry Relay, not full OGC conformance.
 - id: ogc-api-edr
@@ -122,7 +122,7 @@
     - EDR collection discovery
   evidence_docs:
     - label: Registry Relay OGC EDR API tests
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/tests/ogc_edr_api.rs
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/ogc_edr_api.rs
   last_checked: 2026-06-20
   notes: Relay exposes OGC API EDR area routes behind the ogcapi-edr feature for configured spatial aggregates. The claim is scoped to the tested adapter surface, not full OGC conformance.
 - id: openapi
@@ -141,13 +141,13 @@
     - native OpenAPI publication
   evidence_docs:
     - label: Registry Relay README
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/README.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md
     - label: Registry Notary README
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/products/notary/README.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/notary/README.md
     - label: Registry Relay generated OpenAPI document (pinned)
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/openapi/registry-relay.openapi.json
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/openapi/registry-relay.openapi.json
     - label: Registry Notary generated OpenAPI document (pinned)
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/products/notary/openapi/registry-notary.openapi.json
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/notary/openapi/registry-notary.openapi.json
   last_checked: 2026-06-13
   notes: Relay and Notary generate OpenAPI; the pinned generated documents are cited directly. These docs publish the same pinned artifacts as native API reference pages.
 - id: shacl
@@ -166,11 +166,11 @@
     - entity node shapes
   evidence_docs:
     - label: Registry Relay README
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/README.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md
     - label: Registry Manifest README
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/products/manifest/README.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md
     - label: Registry Relay SHACL document structure tests
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/tests/catalog_entity.rs
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/catalog_entity.rs
   last_checked: 2026-06-13
   notes: Relay emits SHACL/JSON-LD documents whose structure is asserted by its catalog tests, and Manifest renders SHACL. No SHACL validator run against the emitted shapes is pinned.
 - id: skos
@@ -189,9 +189,9 @@
     - BRegDCAT/DCAT dataset codelist references
   evidence_docs:
     - label: Registry Manifest codelist renderer
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-manifest-core/src/lib.rs
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-manifest-core/src/lib.rs
     - label: Registry Manifest codelist tests
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-manifest-core/tests/metadata_core.rs
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-manifest-core/tests/metadata_core.rs
   last_checked: 2026-06-20
   notes: Registry Manifest emits flat SKOS-shaped `skos:ConceptScheme` and `skos:Concept` nodes for manifest codelists inside SHACL and BRegDCAT/DCAT-shaped outputs. It does not yet publish a standalone SKOS artifact or claim full SKOS conformance.
 - id: json-schema
@@ -210,11 +210,11 @@
     - static discovery bundle
   evidence_docs:
     - label: Registry Relay README
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/README.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md
     - label: Registry Manifest README
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/products/manifest/README.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md
     - label: Registry Manifest form schema fixture (Draft 2020-12)
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/products/manifest/fixtures/cpsv-ap/health-linked-child-support.form.schema.json
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/fixtures/cpsv-ap/health-linked-child-support.form.schema.json
   last_checked: 2026-06-13
   notes: Manifest renders entity JSON Schemas (the pinned fixture declares Draft 2020-12) and Relay exposes entity schema endpoints.
 - id: json-ld
@@ -236,11 +236,11 @@
     - CCCEV render output
   evidence_docs:
     - label: Registry Relay JSON-LD renderers
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/src/metadata/shacl.rs
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/src/metadata/shacl.rs
     - label: Registry Notary CCCEV renderer
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-notary-server/src/runtime.rs
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/runtime.rs
     - label: Registry Manifest CPSV-AP JSON-LD fixture
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/products/manifest/fixtures/cpsv-ap/health-linked-child-support.cpsv-ap.jsonld
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/fixtures/cpsv-ap/health-linked-child-support.cpsv-ap.jsonld
   last_checked: 2026-06-13
   notes: The projects emit JSON-LD artifacts and contexts; a pinned JSON-LD fixture is cited as a concrete emitted artifact. No broad RDF dataset conformance claim is made here.
 - id: sd-jwt-vc
@@ -260,11 +260,11 @@
     - shared SD-JWT VC issuance and holder-proof helpers
   evidence_docs:
     - label: Registry Notary SD-JWT VC conformance profile
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/products/notary/docs/sd-jwt-vc-conformance-profile.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/notary/docs/sd-jwt-vc-conformance-profile.md
     - label: Registry Notary format constants
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-notary-core/src/model.rs
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-core/src/model.rs
     - label: Registry Platform SD-JWT crate
-      url: https://github.com/registrystack/registry-stack/tree/v0.10.0/crates/registry-platform-sdjwt
+      url: https://github.com/registrystack/registry-stack/tree/v0.11.0/crates/registry-platform-sdjwt
   last_checked: 2026-06-13
   notes: >-
     Registry Platform owns reusable SD-JWT VC issuance and holder-proof helpers.
@@ -288,7 +288,7 @@
     - SD-JWT VC credential issuance
   evidence_docs:
     - label: Registry Notary README
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/products/notary/README.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/notary/README.md
   last_checked: 2026-05-23
   notes: Registry Notary issues SD-JWT VC. Relay no longer emits or hosts VC artifacts.
 - id: cccev
@@ -310,11 +310,11 @@
     - evidence node JSON-LD
   evidence_docs:
     - label: Registry Manifest grouped evidence fixture
-      url: https://github.com/registrystack/registry-stack/tree/v0.10.0/products/manifest/fixtures/cpsv-ap
+      url: https://github.com/registrystack/registry-stack/tree/v0.11.0/products/manifest/fixtures/cpsv-ap
     - label: Registry Notary CCCEV renderer
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-notary-server/src/runtime.rs
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/runtime.rs
     - label: Registry Notary media type constants
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-notary-core/src/model.rs
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-core/src/model.rs
   last_checked: 2026-05-25
   notes: Manifest emits CCCEV requirement and evidence type list metadata. Notary renders CCCEV-shaped claim results. Profile conformance is not claimed.
 - id: odrl
@@ -335,15 +335,15 @@
     - governed evidence PDP constraint terms
   evidence_docs:
     - label: Registry Relay README
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/README.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md
     - label: Registry Manifest README
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/products/manifest/README.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/products/manifest/README.md
     - label: Registry Relay catalog tests (ODRL offer assertions)
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/tests/catalog_entity.rs
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/catalog_entity.rs
     - label: Registry Platform PDP ODRL enforcement profile constants
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-platform-pdp/src/lib.rs
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-platform-pdp/src/lib.rs
     - label: Registry Relay governed evidence PDP path
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/src/api/governed.rs
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/src/api/governed.rs
   last_checked: 2026-07-09
   notes: Relay catalog JSON-LD can include dataset-scoped ODRL Offers, and Manifest renders ODRL policy metadata. That publication surface is descriptive and is not itself an access grant. The shared governed Evidence Gateway profile vocabulary includes `odrl:purpose` and `odrl:spatial`, but Relay's governed runtime path currently enforces `odrl:purpose` only; `odrl:spatial` and other unsupported ODRL terms are denied fail-closed rather than treated as enforced.
 - id: sdmx
@@ -361,9 +361,9 @@
     - content negotiation delivery
   evidence_docs:
     - label: Registry Relay client integration guide
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/docs/client-integration.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/docs/client-integration.md
     - label: Registry Relay aggregates tests (schema-validated SDMX-JSON output)
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/tests/aggregates_entity.rs
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/tests/aggregates_entity.rs
   last_checked: 2026-06-13
   notes: >-
     Relay serves configured aggregates as SDMX-JSON 2.1 data messages via
@@ -389,7 +389,7 @@
     - provenance-shaped claim fields
   evidence_docs:
     - label: Registry Notary claim model
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-notary-core/src/model.rs
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-core/src/model.rs
   last_checked: 2026-05-23
   notes: The code uses provenance concepts, but current evidence does not show a PROV-O vocabulary emission surface. Keep this as design influence until PROV-O terms are emitted or mapped.
 - id: fhir-r4
@@ -427,7 +427,7 @@
     - capability boundary
   evidence_docs:
     - label: Registry Relay README
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/README.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md
   last_checked: 2026-05-23
   notes: Relay explores a protected consultation gateway model rather than the current single uniform CRUD platform.
 - id: universal-dpi-safeguards
@@ -470,7 +470,7 @@
     - authored Relay source integration
   evidence_docs:
     - label: Registry Relay README
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-relay/README.md
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-relay/README.md
     - label: Registry Stack OpenCRVS project-authoring fixture
       url: https://github.com/registrystack/registry-stack/tree/2dfcf2dd/crates/registryctl/tests/fixtures/project-authoring/opencrvs
   last_checked: 2026-05-23
@@ -495,9 +495,9 @@
     - wallet-facing citizen self-attestation flow
   evidence_docs:
     - label: Registry Notary OID4VCI routes
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-notary-server/src/api.rs
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/api.rs
     - label: Registry Platform OID4VCI crate
-      url: https://github.com/registrystack/registry-stack/tree/v0.10.0/crates/registry-platform-oid4vci
+      url: https://github.com/registrystack/registry-stack/tree/v0.11.0/crates/registry-platform-oid4vci
     - label: Historical Registry Lab citizen OID4VCI smoke script
       url: https://github.com/registrystack/registry-stack/blob/v0.9.0/lab/scripts/smoke-citizen-oid4vci.sh
     - label: Solmara Lab hosted OID4VCI smoke
@@ -511,9 +511,11 @@
     Platform owns the underlying primitives
     in the `registry-platform-oid4vci` crate. The historical Registry Lab
     exercised the flow through the `just citizen-oid4vci-*` recipes at v0.9.0.
-    Solmara Lab checks the current hosted issuer metadata, credential offer,
-    nonce, authorization redirect, and unauthenticated denial paths through
-    `just hosted-smoke`. Full OID4VCI issuer conformance is not asserted: the
+    Solmara Lab carries a `just hosted-smoke` harness for issuer metadata,
+    credential offer, nonce, authorization redirect, and unauthenticated
+    denial paths. Beta-13 hosted evidence remains pending until the lab is
+    repinned to published v0.11.0 digests and that harness passes. Full OID4VCI
+    issuer conformance is not asserted: the
     server advertises itself as
     `openid4vci.support: not_full_issuer`, and the surfaces emit the protocol
     shape validated by the checked smoke paths.
@@ -534,8 +536,8 @@
     - shared DID validation and Ed25519 JWK helpers
   evidence_docs:
     - label: Registry Notary did:jwk handling
-      url: https://github.com/registrystack/registry-stack/blob/v0.10.0/crates/registry-notary-server/src/api.rs
+      url: https://github.com/registrystack/registry-stack/blob/v0.11.0/crates/registry-notary-server/src/api.rs
     - label: Registry Platform crypto crate
-      url: https://github.com/registrystack/registry-stack/tree/v0.10.0/crates/registry-platform-crypto
+      url: https://github.com/registrystack/registry-stack/tree/v0.11.0/crates/registry-platform-crypto
   last_checked: 2026-06-13
   notes: Notary parses did:jwk values for credential subjects, and Platform owns shared DID and Ed25519 JWK helpers. Relay no longer hosts a did:web document. No DID resolver, DID URL dereferencing, or DID Core conformance class is implemented, so the claim stays at emits. The site does not claim conformance to the wider DID method registry beyond did:jwk.
diff --git a/products/manifest/CHANGELOG.md b/products/manifest/CHANGELOG.md
index e8215f594..390b9cc2a 100644
--- a/products/manifest/CHANGELOG.md
+++ b/products/manifest/CHANGELOG.md
@@ -7,6 +7,10 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+## [0.11.0] - 2026-07-18
+
+- No user-visible Registry Manifest changes.
+
 ## [0.10.0] - 2026-07-17
 
 ### Changed
diff --git a/products/manifest/docs/release-notes.md b/products/manifest/docs/release-notes.md
index 48df6348b..c8d392d6a 100644
--- a/products/manifest/docs/release-notes.md
+++ b/products/manifest/docs/release-notes.md
@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+## 0.11.0
+
+- Registry Manifest has no user-visible changes in this release.
+
 ## 0.10.0
 
 - BREAKING: source-manifest and policy digests now use Registry Stack's shared
diff --git a/products/manifest/fuzz/Cargo.lock b/products/manifest/fuzz/Cargo.lock
index 2311e825e..a448bd7b9 100644
--- a/products/manifest/fuzz/Cargo.lock
+++ b/products/manifest/fuzz/Cargo.lock
@@ -188,7 +188,7 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
 [[package]]
 name = "registry-manifest-cli"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "registry-manifest-core",
  "serde",
@@ -199,7 +199,7 @@ dependencies = [
 
 [[package]]
 name = "registry-manifest-core"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "oxiri",
  "registry-platform-canonical-json",
@@ -223,7 +223,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-canonical-json"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "ryu-js",
  "serde",
diff --git a/products/notary/CHANGELOG.md b/products/notary/CHANGELOG.md
index ee83b42f0..fb01b0944 100644
--- a/products/notary/CHANGELOG.md
+++ b/products/notary/CHANGELOG.md
@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.11.0] - 2026-07-18
+
 ### Added
 
 - Added `registry-notary audit quarantine` as an offline recovery path for an
@@ -54,6 +56,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   renderer. Subject-access `allowed_formats` now follows the same evaluation
   boundary and no longer needs to repeat the credential profile's output
   format.
+- Requests that present more than one primary credential channel now fail
+  before candidate parsing or validation with `auth.multiple_credentials`.
+  The public response and restricted audit record remain candidate-neutral and
+  do not reveal which credential, if any, was valid.
+- The registryctl local Notary tutorial now exercises a live registry-backed
+  claim through an exact compiler-pinned Relay consultation. It is an
+  evaluation-only tutorial and does not claim credential issuance, wallet
+  interoperability, or OID4VCI interoperability.
 
 ## [0.10.0] - 2026-07-17
 
diff --git a/products/notary/docs/release-notes.md b/products/notary/docs/release-notes.md
index 0189f01fd..01a716cb4 100644
--- a/products/notary/docs/release-notes.md
+++ b/products/notary/docs/release-notes.md
@@ -2,12 +2,15 @@
 
 ## Unreleased
 
+## 0.11.0
+
 - BREAKING: Direct and OID4VCI credential issuance now require a fresh,
   non-delegated stored evaluation with an exact compiler pin for every claim in
   each selected root's registry-backed dependency closure and one normalized
   record per unique Relay execution. Source-free and delegated claims are
   evaluation-only and cannot be configured for credential issuance. Existing
-  evaluations remain readable and renderable but must be re-evaluated before issuance. See the
+  evaluations remain readable and renderable but must be re-evaluated before
+  issuance. See the
   [credential issuance trust-boundary migration](credential-issuance-migration.md).
 - BREAKING: Configuration `${VAR}` expansion now rejects environment variables
   that are unset or empty. `${VAR:-fallback}` uses its fallback for either
@@ -20,6 +23,19 @@
   the corrupt files and open a tamper-evident break segment. The single-writer
   lock prevents online recovery, and signed-bundle acceptance audit failures
   still prevent bundle persistence and serving.
+- Presenting multiple primary credential channels now returns the generic
+  `auth.multiple_credentials` failure before any candidate is parsed or
+  validated. The result does not reveal whether either candidate was valid.
+- Omitted claim `formats` now defaults to canonical claim-result JSON. Explicit
+  empty, unknown, CCCEV-only, and SD-JWT evaluation-format lists fail
+  configuration validation; SD-JWT remains a credential issuance format.
+- Registry-backed Relay consultations may bind bounded string, boolean, and
+  integer inputs from `request.target.attributes.<stable-name>`. These values
+  remain caller-supplied request context and cannot satisfy authenticated
+  target-identifier requirements for delegated subject access.
+- The local registryctl Notary tutorial evaluates one registry-backed claim
+  through an exact Relay compiler pin. It does not exercise issuance, a
+  wallet, credential presentation, or OID4VCI interoperability.
 
 ## 0.10.0
 
diff --git a/products/notary/fuzz/Cargo.lock b/products/notary/fuzz/Cargo.lock
index e90714c10..1b3a7b02d 100644
--- a/products/notary/fuzz/Cargo.lock
+++ b/products/notary/fuzz/Cargo.lock
@@ -1483,7 +1483,7 @@ dependencies = [
 
 [[package]]
 name = "registry-notary-core"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "base64",
  "humantime-serde",
@@ -1516,7 +1516,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-authcommon"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "serde",
  "sha2 0.11.0",
@@ -1527,7 +1527,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-cache"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "async-trait",
  "sha2 0.11.0",
@@ -1537,7 +1537,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-canonical-json"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "ryu-js",
  "serde",
@@ -1547,7 +1547,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-config"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "base64",
  "registry-platform-crypto",
@@ -1561,7 +1561,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-crypto"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "async-trait",
  "aws-lc-rs",
@@ -1582,7 +1582,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-httputil"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "base64",
  "bytes",
@@ -1605,7 +1605,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-oid4vci"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "base64",
  "registry-platform-crypto",
@@ -1618,7 +1618,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-ops"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "fs2",
  "registry-platform-config",
@@ -1633,7 +1633,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-replay"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "async-trait",
  "getrandom 0.4.3",
@@ -1644,7 +1644,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-sdjwt"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "base64",
  "getrandom 0.4.3",
diff --git a/products/notary/openapi/registry-notary.openapi.json b/products/notary/openapi/registry-notary.openapi.json
index 0b559d618..083a894a8 100644
--- a/products/notary/openapi/registry-notary.openapi.json
+++ b/products/notary/openapi/registry-notary.openapi.json
@@ -1845,7 +1845,7 @@
     },
     "summary": "Standalone evidence evaluation, rendering, and credential issuance service.",
     "title": "Registry Notary API",
-    "version": "0.10.0"
+    "version": "0.11.0"
   },
   "openapi": "3.1.0",
   "paths": {
@@ -3388,7 +3388,7 @@
                 "example": {
                   "info": {
                     "title": "Registry Notary API",
-                    "version": "0.10.0"
+                    "version": "0.11.0"
                   },
                   "openapi": "3.1.0",
                   "paths": {
diff --git a/products/platform/CHANGELOG.md b/products/platform/CHANGELOG.md
index 6e223fd7f..735fae6cf 100644
--- a/products/platform/CHANGELOG.md
+++ b/products/platform/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 ## Unreleased
 
+## v0.11.0 - 2026-07-18
+
 - BREAKING: shared configuration `${VAR}` expansion now rejects environment
   variables that are unset or empty. `${VAR:-fallback}` uses its fallback for
   either state, `${VAR:-}` explicitly expands to empty, and `${VAR:?message}`
diff --git a/products/platform/fuzz/Cargo.lock b/products/platform/fuzz/Cargo.lock
index 22a3607e6..d47e8475b 100644
--- a/products/platform/fuzz/Cargo.lock
+++ b/products/platform/fuzz/Cargo.lock
@@ -1433,7 +1433,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-authcommon"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "serde",
  "sha2 0.11.0",
@@ -1444,7 +1444,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-cache"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "async-trait",
  "sha2 0.11.0",
@@ -1454,7 +1454,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-canonical-json"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "ryu-js",
  "serde",
@@ -1464,7 +1464,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-crypto"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "async-trait",
  "aws-lc-rs",
@@ -1504,7 +1504,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-httputil"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "base64",
  "bytes",
@@ -1527,7 +1527,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-oid4vci"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "base64",
  "registry-platform-crypto",
@@ -1540,7 +1540,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-oidc"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "base64",
  "jsonwebtoken",
@@ -1555,7 +1555,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-replay"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "async-trait",
  "getrandom 0.4.3",
@@ -1566,7 +1566,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-sdjwt"
-version = "0.10.0"
+version = "0.11.0"
 dependencies = [
  "base64",
  "getrandom 0.4.3",
diff --git a/release/READINESS.md b/release/READINESS.md
index 9d0628295..d2223976b 100644
--- a/release/READINESS.md
+++ b/release/READINESS.md
@@ -122,7 +122,13 @@ What 1.0 promises the institutions that run this.
       [v0.9.0 -> v0.10.0 -> v0.9.0 procedure](exercises/upgrade-v0.9.0-to-v0.10.0.md)
       adds the stopped-writer Notary Redis-to-PostgreSQL cutover, separate Relay
       consultation state bootstrap, multi-instance semantics, and typed-state
-      backup and restore gate for beta-12.
+      backup and restore gate for beta-12. The
+      [v0.10.0 -> v0.11.0 -> v0.10.0 procedure](exercises/upgrade-v0.10.0-to-v0.11.0.md)
+      adds beta-13 proof for issuance provenance narrowing, old-evaluation
+      rejection and re-evaluation, ambiguous credential rejection, retained
+      audit recovery, and version-matched rollback. It requires no database
+      migration solely for issuance narrowing and does not claim a successful
+      run until finalized-source and published-asset evidence are added.
 - [ ] Single-node Compose deployment behind an institution-owned reverse proxy,
       IAM, and front rate limiter documented. Evidence:
       [`single-node-compose-behind-proxy.mdx`](../docs/site/src/content/docs/operate/single-node-compose-behind-proxy.mdx)
diff --git a/release/VERIFY.md b/release/VERIFY.md
index 5a8780774..b1c037cfe 100644
--- a/release/VERIFY.md
+++ b/release/VERIFY.md
@@ -89,7 +89,7 @@ working directory rather than the `verify-v0.8.4` directory above.
 ### Download The v0.9.0+ Assets
 
 ```bash
-tag=v0.10.0
+tag=v0.11.0
 asset=registryctl-${tag}-linux-amd64
 image_lock=registryctl-${tag}-image-lock.json
 image_lock_sbom=${image_lock}.spdx.json
diff --git a/release/exercises/upgrade-v0.10.0-to-v0.11.0.md b/release/exercises/upgrade-v0.10.0-to-v0.11.0.md
new file mode 100644
index 000000000..e7e0c8d09
--- /dev/null
+++ b/release/exercises/upgrade-v0.10.0-to-v0.11.0.md
@@ -0,0 +1,163 @@
+# Upgrade and rollback: v0.10.0 -> v0.11.0 -> v0.10.0
+
+Status: release-gate procedure prepared on 2026-07-18. No successful execution
+is claimed by this preparation change. A source-build run may be recorded
+against the finalized source ref before tagging. The complete gate uses the
+immutable published assets after the tag workflow and must pass before release
+acceptance and closeout.
+
+## Purpose
+
+Prove that an operator can apply the beta-13 issuance, authentication,
+configuration, and audit-recovery changes without crossing product trust
+boundaries, and can restore the complete v0.10.0 deployment if rollback is
+required.
+
+This procedure does not claim a stable upgrade contract. Rollback restores
+version-matched software, configuration, databases, audit evidence,
+anti-rollback state, and key-lifecycle records. It never starts a v0.10.0
+binary against state changed by v0.11.0 traffic unless a product-specific
+attestation proves the state contract and recovery point are safe.
+
+## Fixed inputs
+
+- Baseline source and images: annotated tag `v0.10.0` and its immutable image
+  digests.
+- Candidate source: the finalized beta-13 manifest source ref.
+- Candidate images: source-built before tagging, then the immutable digests
+  published by the `v0.11.0` tag workflow for the post-tag pass.
+- Crosswalk: `1d44ec735fdc8a7c719264b339574371e8330337`.
+- Topology: one Relay, one paired Notary, separate product-owned PostgreSQL
+  databases, and one generated project using the matching registryctl image
+  lock.
+
+Record exact refs, image ids or digests, database versions, registryctl and
+image-lock versions, orchestration version, host architecture, and timestamps.
+Do not use `latest` or another mutable reference.
+
+## Back up before upgrade
+
+1. Remove issuance and evaluation callers from traffic and stop every v0.10.0
+   Relay and Notary writer.
+2. Back up each complete PostgreSQL database, product configuration, signed
+   bundles, source and project files, secret references, audit files and
+   shipping cursors, anti-rollback state, signer references, Relay keyring
+   lifecycle inputs, and Notary sensitive-state key version.
+3. Record hashes, ownership, permissions, schema fingerprints, and the last
+   acknowledged audit watermark without printing secrets or subject data.
+4. Keep the v0.10.0 restore set immutable and separate from v0.11.0 state.
+5. Record baseline liveness, readiness, one allowed and denied Relay request,
+   one evaluation, one direct issuance when enabled, and one duplicate replay
+   rejection.
+
+## Prepare v0.11.0 configuration
+
+1. Install registryctl v0.11.0 with the exact
+   `registryctl-v0.11.0-image-lock.json`. Regenerate the project and run its
+   offline fixture tests, authoring check, and build. Confirm the five public
+   starters remain HTTP, DHIS2 Tracker, OpenCRVS DCI, FHIR R4, and exact
+   snapshot.
+2. Remove every source-free, self-attested, delegated, or evaluation-only
+   claim from credential profiles. Credential issuance must select only
+   non-delegated registry-backed claims whose complete dependency closure is
+   compiler-pinned to exact Relay consultations.
+3. Review each Relay Script diagnostic. Unknown host calls and unsupported
+   arities are authoring failures, not runtime fallbacks. Confirm diagnostics
+   contain locations and valid signatures but no authored argument values.
+4. Update empty environment-variable handling. An unset or empty `${VAR}` now
+   fails; use `${VAR:-fallback}` or an intentionally empty `${VAR:-}` only
+   where the consuming field permits it.
+5. Update callers to send exactly one primary credential channel. Remove any
+   logic that simultaneously sends `Authorization` and `x-api-key` or expects
+   fallback from one to the other.
+6. Validate Relay configuration against the committed Draft 2020-12 schema and
+   both products' runtime `doctor` commands. Schema validation proves structure
+   only; the runtime checks must separately attest referenced resources,
+   authorities, roles, and deployment gates.
+
+No database migration is required solely for the issuance narrowing. If either
+product reports a different schema fingerprint or requires a state install for
+another included change, stop and follow that product's exact release runbook.
+Do not infer a migration from this procedure or alter tables manually.
+
+## Candidate upgrade proof
+
+1. Start one v0.11.0 Relay and one v0.11.0 Notary without caller traffic.
+   Require both to report `0.11.0`, pass liveness, verify retained audit state,
+   and attest readiness.
+2. Prove one authorized purpose-bound Relay request succeeds and one denied
+   request remains denied.
+3. Present `Authorization` and `x-api-key` together to each applicable public
+   API. Require `auth.multiple_credentials` before candidate validation, then
+   confirm restricted audit evidence does not reveal which candidate was
+   valid.
+4. Evaluate one registry-backed claim and retain its exact compiler pin,
+   normalized Relay execution provenance, selected roots, and result without
+   recording subject data.
+5. Attempt direct issuance from a retained v0.10.0 evaluation. It must fail
+   before signer access. When OID4VCI is enabled, repeat the same negative
+   proof through the credential endpoint.
+6. Re-evaluate the same claim under v0.11.0. Confirm every selected credential
+   root's dependency closure is registry-backed, non-delegated, compiler-pinned,
+   and bound to one normalized record per unique Relay execution. Direct
+   issuance may then proceed. Repeat the OID4VCI path when enabled.
+7. Evaluate and render one permitted source-free or delegated evaluation, then
+   prove issuance remains rejected. Evaluation and rendering capability must
+   not become credential capability.
+8. Restart both products and repeat retained evaluation, replay rejection,
+   issuance provenance, audit-chain, and readiness checks.
+
+The local `registryctl add notary` tutorial may be used as an evaluation
+canary. It does not replace the issuance negatives above and does not count as
+wallet, credential-presentation, or OID4VCI interoperability proof.
+
+## Audit inconsistency recovery proof
+
+Use a disposable copy of the candidate audit state, never the primary release
+evidence set.
+
+1. Stop the product, introduce a controlled retained-chain inconsistency in the
+   disposable copy, and restart without traffic.
+2. Confirm `/healthz` remains live while `/ready` latches unavailable with
+   `audit.chain.inconsistent`. Confirm the response exposes no audit contents.
+3. Stop the process. Run the product's offline audit quarantine command with
+   the deployed configuration. It must acquire the single-writer lock, retain
+   the corrupt files, and open a hash-linked break segment.
+4. Restart and require retained-chain verification and readiness. Preserve the
+   quarantined segment and recovery record as evidence.
+5. Separately induce a transient I/O or secret-resolution failure and confirm
+   it is not misclassified as a confirmed chain inconsistency.
+
+## Rollback proof
+
+1. Stop every v0.11.0 writer. Preserve the v0.11.0 databases, generated
+   closure, audit evidence, and issued public verification material.
+2. Confirm no v0.11.0 issuance or other acknowledged state exists after the
+   v0.10.0 recovery point. If it does, keep the affected database offline and
+   fix forward unless a reviewed product recovery procedure proves rollback
+   safe.
+3. Restore the complete v0.10.0 databases, configuration, exact binaries or
+   image digests, image lock, anti-rollback state, audit state, signer
+   references, and key-lifecycle material from the immutable backup.
+4. Start one v0.10.0 instance of each product without traffic. Require the
+   recorded baseline schema fingerprints, retained-chain verification,
+   liveness, and readiness.
+5. Repeat the baseline allowed and denied Relay requests, evaluation, direct
+   issuance when enabled, and duplicate replay rejection.
+6. Verify backup hashes and prove that sources, audit evidence, the v0.10.0
+   databases, and the retained v0.11.0 state were not silently rewritten.
+
+Rollback succeeds only when the restored topology matches the baseline and no
+v0.11.0 acknowledged state is discarded. Keep any v0.11.0 public signing keys
+published for the lifetime of credentials issued during the candidate run.
+
+## Acceptance record
+
+Record pass or fail for every step, exact refs and digests, redacted schema and
+readiness facts, diagnostic codes, and the recovery-point decision. Do not
+record raw credentials, tokens, subject identifiers, database URLs, source
+records, or audit contents.
+
+The source preparation alone does not claim successful execution, full
+OID4VCI interoperability, a hosted promotion, an audit completion, an external
+pilot, or stable 1.0 readiness.
diff --git a/release/manifests/registry-stack-beta-13.yaml b/release/manifests/registry-stack-beta-13.yaml
new file mode 100644
index 000000000..41eb44fa0
--- /dev/null
+++ b/release/manifests/registry-stack-beta-13.yaml
@@ -0,0 +1,31 @@
+stack:
+  release: beta-13
+  version: 0.11.0
+  source_repo: registrystack/registry-stack
+  source_ref: cb795ea3a09ba81df59c56520d1a4ad039c0fa79
+  source_tag: v0.11.0
+  status: release-candidate
+
+artifacts:
+  registry-notary: 0.11.0
+  registry-notary-cel-worker: 0.11.0
+  registry-relay: 0.11.0
+  registry-relay-rhai-worker: 0.11.0
+  registry-manifest-cli: 0.11.0
+  registryctl: 0.11.0
+  registryctl-image-lock: 0.11.0
+  registry-docs: 0.11.0
+
+external:
+  crosswalk:
+    repo: PublicSchema/crosswalk
+    ref: 1d44ec735fdc8a7c719264b339574371e8330337
+    status: tested external input
+
+warnings:
+  - code: hosted-publication-held
+    classification: hosted-gate-held
+    detail: Source beta may ship; hosted/public announcement remains held until Solmara Lab is atomically repinned to the published v0.11.0 digests and its adopter smoke passes.
+  - code: solmara-adopter-repin-pending
+    classification: adopter-gate-pending
+    detail: Solmara Lab consumes released images and will be repinned and validated only after immutable v0.11.0 digests exist.
diff --git a/release/notes/v0.11.0.md b/release/notes/v0.11.0.md
new file mode 100644
index 000000000..8c2b4f4d7
--- /dev/null
+++ b/release/notes/v0.11.0.md
@@ -0,0 +1,131 @@
+# Registry Stack v0.11.0
+
+Registry Stack v0.11.0 is the beta-13 technical release after v0.10.0. It is a
+pre-1.0 release for evaluation, integration pilots, and public review. It does
+not promise stable 1.0 compatibility, completed OID4VCI interoperability,
+hosted promotion, audit completion, or an external pilot result.
+
+## Highlights
+
+- Direct and OID4VCI credential issuance now accepts only fresh,
+  non-delegated stored evaluations whose selected credential claims have a
+  complete registry-backed dependency closure. Every claim is bound to an
+  exact compiler-pinned Relay consultation and normalized Relay execution
+  provenance before signer access.
+- Source-free, self-attested, delegated, and other evaluation-only claims can
+  still be evaluated and rendered, but cannot be configured for credential
+  issuance. Existing v0.10.0 evaluations remain readable and renderable and
+  must be re-evaluated before issuance.
+- Relay and Notary reject requests that contain more than one primary
+  credential channel before parsing either candidate. The generic
+  `auth.multiple_credentials` result does not reveal whether either candidate
+  was valid.
+- Claim evaluation formats now have one closed contract. Omitted `formats`
+  defaults to canonical claim-result JSON; explicit empty, unknown, CCCEV-only,
+  and SD-JWT evaluation-format lists fail configuration validation. SD-JWT
+  remains a credential issuance format.
+- Relay publishes a reproducible Draft 2020-12 runtime configuration schema
+  and provides bounded, value-free diagnostics for unknown or incorrectly
+  called Script host functions.
+- `registryctl check` aggregates safe authoring diagnostics. Project inputs
+  may bind bounded target attributes, and `init --from` installs deterministic
+  project-local schema mappings for VS Code and Zed.
+- Optional Registry Stack navigation for VS Code and Zed is available only as
+  a source-installed developer preview. The language server and editor
+  extensions are not marketplace packages or separate release artifacts.
+  Registryctl's generated schema mappings remain the stable beta authoring
+  workflow.
+- Registryctl continues to expose exactly five public starters: HTTP, DHIS2
+  Tracker, OpenCRVS DCI, FHIR R4, and exact snapshot. A checked-in catalog
+  distinguishes those starters from additional maintained and conformance
+  workspaces.
+- `registryctl add notary` supplies a local registry-backed Notary evaluation
+  tutorial over the generated benefits workbook. It proves an evaluation path
+  only and does not prove credential issuance, wallet behavior, credential
+  presentation, or OID4VCI interoperability.
+- Relay and Notary latch readiness after a confirmed retained audit-chain
+  inconsistency and provide offline quarantine recovery. Transient operational
+  failures remain distinct from a confirmed integrity failure.
+
+## Migration From v0.10.0
+
+Keep complete, version-matched v0.10.0 and v0.11.0 restore sets and follow the
+[upgrade and rollback exercise](../exercises/upgrade-v0.10.0-to-v0.11.0.md)
+before admitting traffic.
+
+### Re-evaluate before credential issuance
+
+- No PostgreSQL schema migration is required solely for the narrowed issuance
+  trust boundary. Do not treat that as permission to reuse old evaluations.
+- Drain issuance traffic, deploy the matching v0.11.0 Relay and Notary
+  generation, and re-evaluate every claim that may be issued. Direct and
+  OID4VCI issuance reject a v0.10.0 evaluation before signer access.
+- Credential profiles may select only non-delegated registry-backed claims
+  whose full dependency closure has exact compiler pins and normalized Relay
+  execution provenance. Remove source-free, self-attested, delegated, and
+  evaluation-only claims from credential profiles. They remain available for
+  evaluation and rendering.
+- Re-run both direct issuance and any enabled OID4VCI path after re-evaluation.
+  This release does not claim full wallet or OID4VCI interoperability.
+
+### Update authentication callers
+
+- Send exactly one primary credential channel. Requests containing both
+  `Authorization` and `x-api-key` now fail with
+  `auth.multiple_credentials`, even when one candidate is malformed or valid.
+- Do not depend on fallback between credential channels or on an error that
+  identifies the accepted candidate.
+
+### Update claim evaluation formats
+
+- Omit claim `formats` to use canonical
+  `application/vnd.registry-notary.claim-result+json`, or include that format
+  explicitly. CCCEV JSON-LD may be added only alongside the canonical format.
+- Remove explicit empty lists, unknown formats, CCCEV-only lists, and SD-JWT
+  from claim evaluation formats. Keep SD-JWT under credential-profile issuance
+  configuration. Subject-access `allowed_formats` follows the same evaluation
+  boundary.
+
+### Regenerate and validate configuration
+
+- Configuration `${VAR}` expansion now rejects both unset and empty variables.
+  Use `${VAR:-fallback}` for an explicit fallback and `${VAR:-}` only when the
+  consumer deliberately accepts an empty value.
+- Regenerate project outputs with registryctl v0.11.0 and its matching
+  `registryctl-v0.11.0-image-lock.json`. Run `registryctl test`, `check`, and
+  `build`; review every aggregated diagnostic before signing or deploying the
+  new closure.
+- Relay operators can reproduce the committed runtime schema with
+  `registry-relay schema --format json`. A schema-valid document proves
+  structure only. It does not prove that referenced files, credentials,
+  network authorities, deployment gates, or security posture are deployable.
+- Existing registryctl project-local schema mappings remain supported. The
+  optional navigation preview requires source installation and is not needed
+  for validation, completion, hover, or formatting.
+
+### Verify retained audit state
+
+- Start one v0.11.0 instance of each product without traffic and require a
+  successful retained-chain verification before admitting callers.
+- A confirmed inconsistency latches readiness. Stop the process and use the
+  product's offline audit quarantine command under the existing single-writer
+  lock, retain the corrupt segment as evidence, then restart and attest the new
+  break segment.
+- Do not use quarantine for transient I/O or secret-resolution failures and do
+  not delete, truncate, or rewrite audit files.
+
+## Release Evidence
+
+The release workflow retains the existing eight-artifact public inventory:
+Registry Notary, the Notary CEL worker, Registry Relay, the Relay Rhai worker,
+Registry Manifest CLI, registryctl, the registryctl image lock, and Registry
+Docs. The workflow also publishes the associated images, checksums, SBOMs,
+reports, capsule, signatures, and provenance. The language server and editor
+previews are source-installed developer tools and are not added to that
+inventory.
+
+Crosswalk remains pinned at
+`1d44ec735fdc8a7c719264b339574371e8330337`. Solmara Lab and hosted publication
+remain held until immutable v0.11.0 assets exist, Solmara is repinned to their
+exact digests, and its separate adopter gate passes. This source note does not
+claim that result.
diff --git a/release/scripts/test_registry_release.py b/release/scripts/test_registry_release.py
index 5d4331fb8..a3eea1e76 100755
--- a/release/scripts/test_registry_release.py
+++ b/release/scripts/test_registry_release.py
@@ -217,7 +217,7 @@ def test_validate_docsets_matches_release_manifests(self) -> None:
         result = run_tool("validate-docsets")
 
         self.assertEqual(0, result.returncode, result.stderr)
-        self.assertIn("validated 6 versioned docsets", result.stdout)
+        self.assertIn("validated 7 versioned docsets", result.stdout)
 
     def test_validate_docsets_rejects_external_ref_drift(self) -> None:
         with tempfile.TemporaryDirectory() as tmp: