diff --git a/Cargo.lock b/Cargo.lock
index 17c5e9327..1934dee3b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2986,7 +2986,7 @@ checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
 [[package]]
 name = "registry-cli-docs"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "clap",
  "registry-evidence",
@@ -3001,7 +3001,7 @@ dependencies = [
 
 [[package]]
 name = "registry-evidence"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "assert-json-diff",
  "async-trait",
@@ -3059,7 +3059,7 @@ dependencies = [
 
 [[package]]
 name = "registry-evidence-authoring"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "anyhow",
  "jsonschema",
@@ -3073,7 +3073,7 @@ dependencies = [
 
 [[package]]
 name = "registry-evidence-client"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "base64",
  "chrono",
@@ -3100,7 +3100,7 @@ dependencies = [
 
 [[package]]
 name = "registry-evidence-client-node"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "base64",
  "chrono",
@@ -3123,7 +3123,7 @@ dependencies = [
 
 [[package]]
 name = "registry-evidence-client-py"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "base64",
  "chrono",
@@ -3146,7 +3146,7 @@ dependencies = [
 
 [[package]]
 name = "registry-evidence-oid4vci"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "async-trait",
  "axum",
@@ -3183,7 +3183,7 @@ dependencies = [
 
 [[package]]
 name = "registry-evidence-verifier"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "base64",
  "chrono",
@@ -3203,7 +3203,7 @@ dependencies = [
 
 [[package]]
 name = "registry-evidencectl"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "anyhow",
  "axum",
@@ -3240,7 +3240,7 @@ dependencies = [
 
 [[package]]
 name = "registry-language-server"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -3259,7 +3259,7 @@ dependencies = [
 
 [[package]]
 name = "registry-manifest-cli"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "registry-manifest-core",
  "serde",
@@ -3270,7 +3270,7 @@ dependencies = [
 
 [[package]]
 name = "registry-manifest-core"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "oxiri",
  "oxjsonld",
@@ -3285,7 +3285,7 @@ dependencies = [
 
 [[package]]
 name = "registry-mint"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "async-trait",
  "axum",
@@ -3325,7 +3325,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-audit"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "async-trait",
  "hmac 0.13.0",
@@ -3347,7 +3347,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-authcommon"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "base64",
  "proptest",
@@ -3364,11 +3364,11 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-buildinfo"
-version = "0.21.0"
+version = "0.22.0"
 
 [[package]]
 name = "registry-platform-canonical-json"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "ryu-js",
  "serde",
@@ -3378,7 +3378,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-config"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "base64",
  "registry-platform-crypto",
@@ -3394,7 +3394,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-crypto"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "async-trait",
  "aws-lc-rs",
@@ -3420,7 +3420,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-httpsec"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "axum",
  "http",
@@ -3436,7 +3436,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-httputil"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "async-trait",
  "axum",
@@ -3470,7 +3470,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-oidc"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "axum",
  "base64",
@@ -3486,7 +3486,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-sdjwt"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "async-trait",
  "base64",
@@ -3504,7 +3504,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-sqlite"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "rusqlite",
  "rustix",
@@ -3517,7 +3517,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-testing"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "async-trait",
  "axum",
@@ -3540,7 +3540,7 @@ dependencies = [
 
 [[package]]
 name = "registry-relay-client"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "async-trait",
  "axum",
@@ -3558,7 +3558,7 @@ dependencies = [
 
 [[package]]
 name = "registry-relay-client-node"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "axum",
  "napi",
@@ -3574,7 +3574,7 @@ dependencies = [
 
 [[package]]
 name = "registry-relay-client-py"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "pyo3",
  "pyo3-build-config",
@@ -3589,11 +3589,11 @@ dependencies = [
 
 [[package]]
 name = "registry-relay-http-contract"
-version = "0.21.0"
+version = "0.22.0"
 
 [[package]]
 name = "registry-relay-v2"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "async-trait",
  "axum",
@@ -3648,7 +3648,7 @@ dependencies = [
 
 [[package]]
 name = "registry-relayctl"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "clap",
  "hex",
diff --git a/Cargo.toml b/Cargo.toml
index 9e7ff8cc5..e7b9d3cb5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -39,7 +39,7 @@ exclude = [
 resolver = "2"
 
 [workspace.package]
-version = "0.21.0"
+version = "0.22.0"
 edition = "2021"
 rust-version = "1.95"
 license = "Apache-2.0"
@@ -50,35 +50,35 @@ repository = "https://github.com/registrystack/registry-stack"
 unsafe_code = "forbid"
 
 [workspace.dependencies]
-registry-evidence = { path = "crates/registry-evidence", version = "0.21.0" }
-registry-evidence-authoring = { path = "crates/registry-evidence-authoring", version = "0.21.0" }
-registry-evidence-client = { path = "crates/registry-evidence-client", version = "0.21.0" }
-registry-evidence-client-node = { path = "crates/registry-evidence-client-node", version = "0.21.0" }
-registry-evidence-client-py = { path = "crates/registry-evidence-client-py", version = "0.21.0" }
-registry-evidence-oid4vci = { path = "crates/registry-evidence-oid4vci", version = "0.21.0" }
-registry-evidence-verifier = { path = "crates/registry-evidence-verifier", version = "0.21.0" }
-registry-evidencectl = { path = "crates/registry-evidencectl", version = "0.21.0" }
-registry-language-server = { path = "crates/registry-language-server", version = "0.21.0" }
-registry-manifest-core = { path = "crates/registry-manifest-core", version = "0.21.0" }
-registry-mint = { path = "crates/registry-mint", version = "0.21.0" }
-registry-relay-http-contract = { path = "crates/registry-relay-http-contract", version = "0.21.0" }
-registry-relay-client = { path = "crates/registry-relay-client", version = "0.21.0" }
-registry-relay-client-node = { path = "crates/registry-relay-client-node", version = "0.21.0" }
-registry-relay-client-py = { path = "crates/registry-relay-client-py", version = "0.21.0" }
-registry-relay-v2 = { path = "crates/registry-relay-v2", version = "0.21.0" }
-registry-relayctl = { path = "crates/registry-relayctl", version = "0.21.0" }
-registry-platform-audit = { path = "crates/registry-platform-audit", version = "0.21.0" }
-registry-platform-authcommon = { path = "crates/registry-platform-authcommon", version = "0.21.0" }
-registry-platform-buildinfo = { path = "crates/registry-platform-buildinfo", version = "0.21.0" }
-registry-platform-canonical-json = { path = "crates/registry-platform-canonical-json", version = "0.21.0" }
-registry-platform-config = { path = "crates/registry-platform-config", version = "0.21.0" }
-registry-platform-crypto = { path = "crates/registry-platform-crypto", version = "0.21.0" }
-registry-platform-httpsec = { path = "crates/registry-platform-httpsec", version = "0.21.0", default-features = false }
-registry-platform-httputil = { path = "crates/registry-platform-httputil", version = "0.21.0" }
-registry-platform-oidc = { path = "crates/registry-platform-oidc", version = "0.21.0" }
-registry-platform-sdjwt = { path = "crates/registry-platform-sdjwt", version = "0.21.0" }
-registry-platform-sqlite = { path = "crates/registry-platform-sqlite", version = "0.21.0" }
-registry-platform-testing = { path = "crates/registry-platform-testing", version = "0.21.0" }
+registry-evidence = { path = "crates/registry-evidence", version = "0.22.0" }
+registry-evidence-authoring = { path = "crates/registry-evidence-authoring", version = "0.22.0" }
+registry-evidence-client = { path = "crates/registry-evidence-client", version = "0.22.0" }
+registry-evidence-client-node = { path = "crates/registry-evidence-client-node", version = "0.22.0" }
+registry-evidence-client-py = { path = "crates/registry-evidence-client-py", version = "0.22.0" }
+registry-evidence-oid4vci = { path = "crates/registry-evidence-oid4vci", version = "0.22.0" }
+registry-evidence-verifier = { path = "crates/registry-evidence-verifier", version = "0.22.0" }
+registry-evidencectl = { path = "crates/registry-evidencectl", version = "0.22.0" }
+registry-language-server = { path = "crates/registry-language-server", version = "0.22.0" }
+registry-manifest-core = { path = "crates/registry-manifest-core", version = "0.22.0" }
+registry-mint = { path = "crates/registry-mint", version = "0.22.0" }
+registry-relay-http-contract = { path = "crates/registry-relay-http-contract", version = "0.22.0" }
+registry-relay-client = { path = "crates/registry-relay-client", version = "0.22.0" }
+registry-relay-client-node = { path = "crates/registry-relay-client-node", version = "0.22.0" }
+registry-relay-client-py = { path = "crates/registry-relay-client-py", version = "0.22.0" }
+registry-relay-v2 = { path = "crates/registry-relay-v2", version = "0.22.0" }
+registry-relayctl = { path = "crates/registry-relayctl", version = "0.22.0" }
+registry-platform-audit = { path = "crates/registry-platform-audit", version = "0.22.0" }
+registry-platform-authcommon = { path = "crates/registry-platform-authcommon", version = "0.22.0" }
+registry-platform-buildinfo = { path = "crates/registry-platform-buildinfo", version = "0.22.0" }
+registry-platform-canonical-json = { path = "crates/registry-platform-canonical-json", version = "0.22.0" }
+registry-platform-config = { path = "crates/registry-platform-config", version = "0.22.0" }
+registry-platform-crypto = { path = "crates/registry-platform-crypto", version = "0.22.0" }
+registry-platform-httpsec = { path = "crates/registry-platform-httpsec", version = "0.22.0", default-features = false }
+registry-platform-httputil = { path = "crates/registry-platform-httputil", version = "0.22.0" }
+registry-platform-oidc = { path = "crates/registry-platform-oidc", version = "0.22.0" }
+registry-platform-sdjwt = { path = "crates/registry-platform-sdjwt", version = "0.22.0" }
+registry-platform-sqlite = { path = "crates/registry-platform-sqlite", version = "0.22.0" }
+registry-platform-testing = { path = "crates/registry-platform-testing", version = "0.22.0" }
 
 anyhow = { version = "1" }
 assert-json-diff = { version = "2" }
diff --git a/crates/registry-evidence-client-node/README.md b/crates/registry-evidence-client-node/README.md
index 418289aaa..97661dca4 100644
--- a/crates/registry-evidence-client-node/README.md
+++ b/crates/registry-evidence-client-node/README.md
@@ -6,7 +6,7 @@ client, via [napi-rs](https://napi.rs). Every Evidence semantic decision
 own; this crate is a thin `#[napi]` surface plus a JSON conversion layer, and
 re-implements none of it.
 
-Starting with Registry Stack v0.21.1, install the exact client version that
+Starting with Registry Stack v0.22.0, install the exact client version that
 matches the Evidence deployment:
 
 ```sh
diff --git a/crates/registry-evidence-client-node/index.js b/crates/registry-evidence-client-node/index.js
index 13625d7cb..c3767e660 100644
--- a/crates/registry-evidence-client-node/index.js
+++ b/crates/registry-evidence-client-node/index.js
@@ -77,8 +77,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/evidence-client-android-arm64')
         const bindingPackageVersion = require('@registrystack/evidence-client-android-arm64/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -93,8 +93,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/evidence-client-android-arm-eabi')
         const bindingPackageVersion = require('@registrystack/evidence-client-android-arm-eabi/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -114,8 +114,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/evidence-client-win32-x64-gnu')
         const bindingPackageVersion = require('@registrystack/evidence-client-win32-x64-gnu/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -130,8 +130,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/evidence-client-win32-x64-msvc')
         const bindingPackageVersion = require('@registrystack/evidence-client-win32-x64-msvc/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -147,8 +147,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/evidence-client-win32-ia32-msvc')
         const bindingPackageVersion = require('@registrystack/evidence-client-win32-ia32-msvc/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -163,8 +163,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/evidence-client-win32-arm64-msvc')
         const bindingPackageVersion = require('@registrystack/evidence-client-win32-arm64-msvc/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -182,8 +182,8 @@ function requireNative() {
     try {
       const binding = require('@registrystack/evidence-client-darwin-universal')
       const bindingPackageVersion = require('@registrystack/evidence-client-darwin-universal/package.json').version
-      if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-        throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+      if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+        throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
       }
       return binding
     } catch (e) {
@@ -198,8 +198,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/evidence-client-darwin-x64')
         const bindingPackageVersion = require('@registrystack/evidence-client-darwin-x64/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -214,8 +214,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/evidence-client-darwin-arm64')
         const bindingPackageVersion = require('@registrystack/evidence-client-darwin-arm64/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -234,8 +234,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/evidence-client-freebsd-x64')
         const bindingPackageVersion = require('@registrystack/evidence-client-freebsd-x64/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -250,8 +250,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/evidence-client-freebsd-arm64')
         const bindingPackageVersion = require('@registrystack/evidence-client-freebsd-arm64/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -271,8 +271,8 @@ function requireNative() {
         try {
           const binding = require('@registrystack/evidence-client-linux-x64-musl')
           const bindingPackageVersion = require('@registrystack/evidence-client-linux-x64-musl/package.json').version
-          if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -287,8 +287,8 @@ function requireNative() {
         try {
           const binding = require('@registrystack/evidence-client-linux-x64-gnu')
           const bindingPackageVersion = require('@registrystack/evidence-client-linux-x64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -305,8 +305,8 @@ function requireNative() {
         try {
           const binding = require('@registrystack/evidence-client-linux-arm64-musl')
           const bindingPackageVersion = require('@registrystack/evidence-client-linux-arm64-musl/package.json').version
-          if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -321,8 +321,8 @@ function requireNative() {
         try {
           const binding = require('@registrystack/evidence-client-linux-arm64-gnu')
           const bindingPackageVersion = require('@registrystack/evidence-client-linux-arm64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -339,8 +339,8 @@ function requireNative() {
         try {
           const binding = require('@registrystack/evidence-client-linux-arm-musleabihf')
           const bindingPackageVersion = require('@registrystack/evidence-client-linux-arm-musleabihf/package.json').version
-          if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -355,8 +355,8 @@ function requireNative() {
         try {
           const binding = require('@registrystack/evidence-client-linux-arm-gnueabihf')
           const bindingPackageVersion = require('@registrystack/evidence-client-linux-arm-gnueabihf/package.json').version
-          if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -373,8 +373,8 @@ function requireNative() {
         try {
           const binding = require('@registrystack/evidence-client-linux-loong64-musl')
           const bindingPackageVersion = require('@registrystack/evidence-client-linux-loong64-musl/package.json').version
-          if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -389,8 +389,8 @@ function requireNative() {
         try {
           const binding = require('@registrystack/evidence-client-linux-loong64-gnu')
           const bindingPackageVersion = require('@registrystack/evidence-client-linux-loong64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -407,8 +407,8 @@ function requireNative() {
         try {
           const binding = require('@registrystack/evidence-client-linux-riscv64-musl')
           const bindingPackageVersion = require('@registrystack/evidence-client-linux-riscv64-musl/package.json').version
-          if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -423,8 +423,8 @@ function requireNative() {
         try {
           const binding = require('@registrystack/evidence-client-linux-riscv64-gnu')
           const bindingPackageVersion = require('@registrystack/evidence-client-linux-riscv64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -440,8 +440,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/evidence-client-linux-ppc64-gnu')
         const bindingPackageVersion = require('@registrystack/evidence-client-linux-ppc64-gnu/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -456,8 +456,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/evidence-client-linux-s390x-gnu')
         const bindingPackageVersion = require('@registrystack/evidence-client-linux-s390x-gnu/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -476,8 +476,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/evidence-client-openharmony-arm64')
         const bindingPackageVersion = require('@registrystack/evidence-client-openharmony-arm64/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -492,8 +492,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/evidence-client-openharmony-x64')
         const bindingPackageVersion = require('@registrystack/evidence-client-openharmony-x64/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -508,8 +508,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/evidence-client-openharmony-arm')
         const bindingPackageVersion = require('@registrystack/evidence-client-openharmony-arm/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -648,8 +648,8 @@ if (!nativeBinding || forceWasi) {
       if (!candidateFailed) {
         if (process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
           const bindingPackageVersion = require('@registrystack/evidence-client-wasm32-wasi/package.json').version
-          if (bindingPackageVersion !== '0.21.0') {
-            throw new Error(`WASI binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0') {
+            throw new Error(`WASI binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
         }
         wasiBinding = require('@registrystack/evidence-client-wasm32-wasi')
diff --git a/crates/registry-evidence-client-node/npm/darwin-arm64/package.json b/crates/registry-evidence-client-node/npm/darwin-arm64/package.json
index 39338c31f..70747183a 100644
--- a/crates/registry-evidence-client-node/npm/darwin-arm64/package.json
+++ b/crates/registry-evidence-client-node/npm/darwin-arm64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@registrystack/evidence-client-darwin-arm64",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "cpu": ["arm64"],
   "main": "evidence-client.darwin-arm64.node",
   "files": ["evidence-client.darwin-arm64.node"],
diff --git a/crates/registry-evidence-client-node/npm/linux-arm64-gnu/package.json b/crates/registry-evidence-client-node/npm/linux-arm64-gnu/package.json
index e7152aa0e..5c64485f1 100644
--- a/crates/registry-evidence-client-node/npm/linux-arm64-gnu/package.json
+++ b/crates/registry-evidence-client-node/npm/linux-arm64-gnu/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@registrystack/evidence-client-linux-arm64-gnu",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "cpu": ["arm64"],
   "main": "evidence-client.linux-arm64-gnu.node",
   "files": ["evidence-client.linux-arm64-gnu.node"],
diff --git a/crates/registry-evidence-client-node/npm/linux-x64-gnu/package.json b/crates/registry-evidence-client-node/npm/linux-x64-gnu/package.json
index 20b4ae26f..803d2124b 100644
--- a/crates/registry-evidence-client-node/npm/linux-x64-gnu/package.json
+++ b/crates/registry-evidence-client-node/npm/linux-x64-gnu/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@registrystack/evidence-client-linux-x64-gnu",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "cpu": ["x64"],
   "main": "evidence-client.linux-x64-gnu.node",
   "files": ["evidence-client.linux-x64-gnu.node"],
diff --git a/crates/registry-evidence-client-node/package-lock.json b/crates/registry-evidence-client-node/package-lock.json
index 285ff4dcd..75ed9c45a 100644
--- a/crates/registry-evidence-client-node/package-lock.json
+++ b/crates/registry-evidence-client-node/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@registrystack/evidence-client",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@registrystack/evidence-client",
-      "version": "0.21.0",
+      "version": "0.22.0",
       "license": "Apache-2.0",
       "devDependencies": {
         "@napi-rs/cli": "3.8.2"
@@ -15,9 +15,9 @@
         "node": ">=22.12.0"
       },
       "optionalDependencies": {
-        "@registrystack/evidence-client-darwin-arm64": "0.21.0",
-        "@registrystack/evidence-client-linux-arm64-gnu": "0.21.0",
-        "@registrystack/evidence-client-linux-x64-gnu": "0.21.0"
+        "@registrystack/evidence-client-darwin-arm64": "0.22.0",
+        "@registrystack/evidence-client-linux-arm64-gnu": "0.22.0",
+        "@registrystack/evidence-client-linux-x64-gnu": "0.22.0"
       }
     },
     "node_modules/@emnapi/core": {
diff --git a/crates/registry-evidence-client-node/package.json b/crates/registry-evidence-client-node/package.json
index 1249e7d0b..8023c71d5 100644
--- a/crates/registry-evidence-client-node/package.json
+++ b/crates/registry-evidence-client-node/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@registrystack/evidence-client",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "description": "Node.js binding for the Evidence relying-party client, via napi-rs.",
   "license": "Apache-2.0",
   "publishConfig": { "access": "public", "provenance": true },
@@ -44,8 +44,8 @@
     "@napi-rs/cli": "3.8.2"
   },
   "optionalDependencies": {
-    "@registrystack/evidence-client-darwin-arm64": "0.21.0",
-    "@registrystack/evidence-client-linux-arm64-gnu": "0.21.0",
-    "@registrystack/evidence-client-linux-x64-gnu": "0.21.0"
+    "@registrystack/evidence-client-darwin-arm64": "0.22.0",
+    "@registrystack/evidence-client-linux-arm64-gnu": "0.22.0",
+    "@registrystack/evidence-client-linux-x64-gnu": "0.22.0"
   }
 }
diff --git a/crates/registry-evidence-client-py/Cargo.toml b/crates/registry-evidence-client-py/Cargo.toml
index 339eeec93..89cbf02c5 100644
--- a/crates/registry-evidence-client-py/Cargo.toml
+++ b/crates/registry-evidence-client-py/Cargo.toml
@@ -29,7 +29,7 @@ chrono.workspace = true
 # multiple candidates for rmeta dependency`, which no `use` path syntax can
 # resolve). One consistent alias, used everywhere this crate reaches the SDK,
 # avoids that rather than special-casing test code against production code.
-evidence-client-sdk = { package = "registry-evidence-client", path = "../registry-evidence-client", version = "0.21.0" }
+evidence-client-sdk = { package = "registry-evidence-client", path = "../registry-evidence-client", version = "0.22.0" }
 pyo3.workspace = true
 registry-platform-crypto.workspace = true
 serde_json.workspace = true
diff --git a/crates/registry-evidence-client-py/README.md b/crates/registry-evidence-client-py/README.md
index 8529566e3..6e39e2303 100644
--- a/crates/registry-evidence-client-py/README.md
+++ b/crates/registry-evidence-client-py/README.md
@@ -8,7 +8,7 @@ re-implements none of it.
 
 The package is named `registry-evidence-client` and imported as
 `registry_evidence_client` (matching the crate's own `[lib]` name). Starting
-with Registry Stack v0.21.1, install the exact client version that matches the
+with Registry Stack v0.22.0, install the exact client version that matches the
 Evidence deployment:
 
 ```sh
diff --git a/crates/registry-evidence-client-py/pyproject.toml b/crates/registry-evidence-client-py/pyproject.toml
index d48aaf05d..435a194af 100644
--- a/crates/registry-evidence-client-py/pyproject.toml
+++ b/crates/registry-evidence-client-py/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "registry-evidence-client"
-version = "0.21.0"
+version = "0.22.0"
 description = "Python binding for the Evidence relying-party client, via PyO3."
 readme = "README.md"
 license = { text = "Apache-2.0" }
diff --git a/crates/registry-relay-client-node/README.md b/crates/registry-relay-client-node/README.md
index 4d3902ee5..9ea39d645 100644
--- a/crates/registry-relay-client-node/README.md
+++ b/crates/registry-relay-client-node/README.md
@@ -4,7 +4,7 @@ Thin napi-rs binding for the Rust `registry-relay-client` SDK. It exposes no
 JavaScript HTTP, routing, authentication, retry, or problem parsing logic.
 All Relay wire handling remains in the wrapped Rust client.
 
-Starting with Registry Stack v0.21.1, install the exact client version that
+Starting with Registry Stack v0.22.0, install the exact client version that
 matches the Relay deployment:
 
 ```sh
diff --git a/crates/registry-relay-client-node/index.js b/crates/registry-relay-client-node/index.js
index c18f06538..07fee6ade 100644
--- a/crates/registry-relay-client-node/index.js
+++ b/crates/registry-relay-client-node/index.js
@@ -77,8 +77,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/relay-client-android-arm64')
         const bindingPackageVersion = require('@registrystack/relay-client-android-arm64/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -93,8 +93,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/relay-client-android-arm-eabi')
         const bindingPackageVersion = require('@registrystack/relay-client-android-arm-eabi/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -114,8 +114,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/relay-client-win32-x64-gnu')
         const bindingPackageVersion = require('@registrystack/relay-client-win32-x64-gnu/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -130,8 +130,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/relay-client-win32-x64-msvc')
         const bindingPackageVersion = require('@registrystack/relay-client-win32-x64-msvc/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -147,8 +147,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/relay-client-win32-ia32-msvc')
         const bindingPackageVersion = require('@registrystack/relay-client-win32-ia32-msvc/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -163,8 +163,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/relay-client-win32-arm64-msvc')
         const bindingPackageVersion = require('@registrystack/relay-client-win32-arm64-msvc/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -182,8 +182,8 @@ function requireNative() {
     try {
       const binding = require('@registrystack/relay-client-darwin-universal')
       const bindingPackageVersion = require('@registrystack/relay-client-darwin-universal/package.json').version
-      if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-        throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+      if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+        throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
       }
       return binding
     } catch (e) {
@@ -198,8 +198,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/relay-client-darwin-x64')
         const bindingPackageVersion = require('@registrystack/relay-client-darwin-x64/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -214,8 +214,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/relay-client-darwin-arm64')
         const bindingPackageVersion = require('@registrystack/relay-client-darwin-arm64/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -234,8 +234,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/relay-client-freebsd-x64')
         const bindingPackageVersion = require('@registrystack/relay-client-freebsd-x64/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -250,8 +250,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/relay-client-freebsd-arm64')
         const bindingPackageVersion = require('@registrystack/relay-client-freebsd-arm64/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -271,8 +271,8 @@ function requireNative() {
         try {
           const binding = require('@registrystack/relay-client-linux-x64-musl')
           const bindingPackageVersion = require('@registrystack/relay-client-linux-x64-musl/package.json').version
-          if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -287,8 +287,8 @@ function requireNative() {
         try {
           const binding = require('@registrystack/relay-client-linux-x64-gnu')
           const bindingPackageVersion = require('@registrystack/relay-client-linux-x64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -305,8 +305,8 @@ function requireNative() {
         try {
           const binding = require('@registrystack/relay-client-linux-arm64-musl')
           const bindingPackageVersion = require('@registrystack/relay-client-linux-arm64-musl/package.json').version
-          if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -321,8 +321,8 @@ function requireNative() {
         try {
           const binding = require('@registrystack/relay-client-linux-arm64-gnu')
           const bindingPackageVersion = require('@registrystack/relay-client-linux-arm64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -339,8 +339,8 @@ function requireNative() {
         try {
           const binding = require('@registrystack/relay-client-linux-arm-musleabihf')
           const bindingPackageVersion = require('@registrystack/relay-client-linux-arm-musleabihf/package.json').version
-          if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -355,8 +355,8 @@ function requireNative() {
         try {
           const binding = require('@registrystack/relay-client-linux-arm-gnueabihf')
           const bindingPackageVersion = require('@registrystack/relay-client-linux-arm-gnueabihf/package.json').version
-          if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -373,8 +373,8 @@ function requireNative() {
         try {
           const binding = require('@registrystack/relay-client-linux-loong64-musl')
           const bindingPackageVersion = require('@registrystack/relay-client-linux-loong64-musl/package.json').version
-          if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -389,8 +389,8 @@ function requireNative() {
         try {
           const binding = require('@registrystack/relay-client-linux-loong64-gnu')
           const bindingPackageVersion = require('@registrystack/relay-client-linux-loong64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -407,8 +407,8 @@ function requireNative() {
         try {
           const binding = require('@registrystack/relay-client-linux-riscv64-musl')
           const bindingPackageVersion = require('@registrystack/relay-client-linux-riscv64-musl/package.json').version
-          if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -423,8 +423,8 @@ function requireNative() {
         try {
           const binding = require('@registrystack/relay-client-linux-riscv64-gnu')
           const bindingPackageVersion = require('@registrystack/relay-client-linux-riscv64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -440,8 +440,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/relay-client-linux-ppc64-gnu')
         const bindingPackageVersion = require('@registrystack/relay-client-linux-ppc64-gnu/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -456,8 +456,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/relay-client-linux-s390x-gnu')
         const bindingPackageVersion = require('@registrystack/relay-client-linux-s390x-gnu/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -476,8 +476,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/relay-client-openharmony-arm64')
         const bindingPackageVersion = require('@registrystack/relay-client-openharmony-arm64/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -492,8 +492,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/relay-client-openharmony-x64')
         const bindingPackageVersion = require('@registrystack/relay-client-openharmony-x64/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -508,8 +508,8 @@ function requireNative() {
       try {
         const binding = require('@registrystack/relay-client-openharmony-arm')
         const bindingPackageVersion = require('@registrystack/relay-client-openharmony-arm/package.json').version
-        if (bindingPackageVersion !== '0.21.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.22.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -648,8 +648,8 @@ if (!nativeBinding || forceWasi) {
       if (!candidateFailed) {
         if (process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
           const bindingPackageVersion = require('@registrystack/relay-client-wasm32-wasi/package.json').version
-          if (bindingPackageVersion !== '0.21.0') {
-            throw new Error(`WASI binding package version mismatch, expected 0.21.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.22.0') {
+            throw new Error(`WASI binding package version mismatch, expected 0.22.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
         }
         wasiBinding = require('@registrystack/relay-client-wasm32-wasi')
diff --git a/crates/registry-relay-client-node/npm/darwin-arm64/package.json b/crates/registry-relay-client-node/npm/darwin-arm64/package.json
index b8dd140bb..a79c8bffc 100644
--- a/crates/registry-relay-client-node/npm/darwin-arm64/package.json
+++ b/crates/registry-relay-client-node/npm/darwin-arm64/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@registrystack/relay-client-darwin-arm64",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "cpu": [
     "arm64"
   ],
diff --git a/crates/registry-relay-client-node/npm/linux-arm64-gnu/package.json b/crates/registry-relay-client-node/npm/linux-arm64-gnu/package.json
index 8d2ee20a4..a56bcd8a1 100644
--- a/crates/registry-relay-client-node/npm/linux-arm64-gnu/package.json
+++ b/crates/registry-relay-client-node/npm/linux-arm64-gnu/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@registrystack/relay-client-linux-arm64-gnu",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "cpu": [
     "arm64"
   ],
diff --git a/crates/registry-relay-client-node/npm/linux-x64-gnu/package.json b/crates/registry-relay-client-node/npm/linux-x64-gnu/package.json
index 9ee38df0a..9485cfbd5 100644
--- a/crates/registry-relay-client-node/npm/linux-x64-gnu/package.json
+++ b/crates/registry-relay-client-node/npm/linux-x64-gnu/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@registrystack/relay-client-linux-x64-gnu",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "cpu": [
     "x64"
   ],
diff --git a/crates/registry-relay-client-node/package-lock.json b/crates/registry-relay-client-node/package-lock.json
index 87da9ba07..3a2bdc567 100644
--- a/crates/registry-relay-client-node/package-lock.json
+++ b/crates/registry-relay-client-node/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@registrystack/relay-client",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@registrystack/relay-client",
-      "version": "0.21.0",
+      "version": "0.22.0",
       "license": "Apache-2.0",
       "devDependencies": {
         "@napi-rs/cli": "3.8.2",
@@ -17,9 +17,9 @@
         "node": ">=22.12.0"
       },
       "optionalDependencies": {
-        "@registrystack/relay-client-darwin-arm64": "0.21.0",
-        "@registrystack/relay-client-linux-arm64-gnu": "0.21.0",
-        "@registrystack/relay-client-linux-x64-gnu": "0.21.0"
+        "@registrystack/relay-client-darwin-arm64": "0.22.0",
+        "@registrystack/relay-client-linux-arm64-gnu": "0.22.0",
+        "@registrystack/relay-client-linux-x64-gnu": "0.22.0"
       }
     },
     "node_modules/@emnapi/core": {
diff --git a/crates/registry-relay-client-node/package.json b/crates/registry-relay-client-node/package.json
index 4d8c67000..4b88e2c50 100644
--- a/crates/registry-relay-client-node/package.json
+++ b/crates/registry-relay-client-node/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@registrystack/relay-client",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "description": "Node.js binding for the Registry Relay V2 client, via napi-rs.",
   "license": "Apache-2.0",
   "publishConfig": { "access": "public", "provenance": true },
@@ -30,8 +30,8 @@
     "typescript": "6.0.3"
   },
   "optionalDependencies": {
-    "@registrystack/relay-client-darwin-arm64": "0.21.0",
-    "@registrystack/relay-client-linux-arm64-gnu": "0.21.0",
-    "@registrystack/relay-client-linux-x64-gnu": "0.21.0"
+    "@registrystack/relay-client-darwin-arm64": "0.22.0",
+    "@registrystack/relay-client-linux-arm64-gnu": "0.22.0",
+    "@registrystack/relay-client-linux-x64-gnu": "0.22.0"
   }
 }
diff --git a/crates/registry-relay-client-py/Cargo.toml b/crates/registry-relay-client-py/Cargo.toml
index 34db2e9a9..498a0d17d 100644
--- a/crates/registry-relay-client-py/Cargo.toml
+++ b/crates/registry-relay-client-py/Cargo.toml
@@ -21,7 +21,7 @@ extension-module = ["pyo3/extension-module"]
 [dependencies]
 pyo3.workspace = true
 registry-platform-crypto.workspace = true
-relay-client-sdk = { package = "registry-relay-client", path = "../registry-relay-client", version = "0.21.0" }
+relay-client-sdk = { package = "registry-relay-client", path = "../registry-relay-client", version = "0.22.0" }
 serde.workspace = true
 serde_json.workspace = true
 tokio.workspace = true
diff --git a/crates/registry-relay-client-py/README.md b/crates/registry-relay-client-py/README.md
index 7aaaa56bb..ecedfdbd9 100644
--- a/crates/registry-relay-client-py/README.md
+++ b/crates/registry-relay-client-py/README.md
@@ -6,7 +6,7 @@ a configured private-key-JWT provider may perform a separate token acquisition
 or refresh exchange. The binding does not implement HTTP routing,
 authentication, retries, pagination, or Relay Problem Details itself.
 
-Starting with Registry Stack v0.21.1, install the exact client version that
+Starting with Registry Stack v0.22.0, install the exact client version that
 matches the Relay deployment:
 
 ```sh
diff --git a/crates/registry-relay-client-py/pyproject.toml b/crates/registry-relay-client-py/pyproject.toml
index b88231b4d..43798c68c 100644
--- a/crates/registry-relay-client-py/pyproject.toml
+++ b/crates/registry-relay-client-py/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "registry-relay-client"
-version = "0.21.0"
+version = "0.22.0"
 description = "Python binding for the Registry Relay V2 client, via PyO3."
 readme = "README.md"
 license = { text = "Apache-2.0" }
diff --git a/docs/site/scripts/deployment-documentation-truth.test.mjs b/docs/site/scripts/deployment-documentation-truth.test.mjs
index 9130e9cdc..77d95bc0d 100644
--- a/docs/site/scripts/deployment-documentation-truth.test.mjs
+++ b/docs/site/scripts/deployment-documentation-truth.test.mjs
@@ -96,7 +96,7 @@ test('current docs stay under /dev/ while v0.15.2 remains the released archive',
     }
     assert.equal(docset.status, 'archived', `${docset.id} must expose its release-train status`);
     const expectedAvailability =
-      ['v0.21.0', 'v0.20.1', 'v0.20.0', 'v0.18.0', 'v0.17.0', 'v0.16.3', 'v0.15.1', 'v0.15.0'].includes(docset.id)
+      ['v0.22.0', 'v0.21.0', 'v0.20.1', 'v0.20.0', 'v0.18.0', 'v0.17.0', 'v0.16.3', 'v0.15.1', 'v0.15.0'].includes(docset.id)
         ? 'candidate'
         : docset.id.startsWith('v')
           ? 'released'
diff --git a/docs/site/scripts/notary-retirement.test.mjs b/docs/site/scripts/notary-retirement.test.mjs
index 973f3f145..5c8fbabfa 100644
--- a/docs/site/scripts/notary-retirement.test.mjs
+++ b/docs/site/scripts/notary-retirement.test.mjs
@@ -71,7 +71,7 @@ test('removes the current Notary docs sources and generated product plumbing', (
   const historicalNotaryDocsets = docsets.docsets.filter(
     (entry) =>
       entry.status === 'archived' &&
-      !['v0.17.0', 'v0.18.0', 'v0.20.0', 'v0.20.1', 'v0.21.0'].includes(entry.id),
+      !['v0.17.0', 'v0.18.0', 'v0.20.0', 'v0.20.1', 'v0.21.0', 'v0.22.0'].includes(entry.id),
   );
   for (const docset of historicalNotaryDocsets) {
     assert.ok(docset.products['registry-notary'], `${docset.id} lost its historical Notary pin`);
diff --git a/docs/site/src/content/docs/changelog.mdx b/docs/site/src/content/docs/changelog.mdx
index b38d3c505..fc6a34466 100644
--- a/docs/site/src/content/docs/changelog.mdx
+++ b/docs/site/src/content/docs/changelog.mdx
@@ -18,11 +18,34 @@ relevant product pages on this site rather than duplicating release notes.
 
 ## Unreleased
 
-- Added Registry Mint's opt-in client-secret compatibility profile for managed
-  standard OAuth clients, while retaining `private_key_jwt` as the default and
-  sole method for Evidence and delegated authority.
-- Added owner-only secret provisioning, per-installation registration,
-  rotation and revocation guidance, and a QGIS Client Credentials walkthrough.
+## 2026-08-14
+
+Documentation prepared for the v0.22.0 beta-33 release:
+
+- Documented the explicit container-private Evidence listener mode, native
+  Evidence, Mint, and Relay deployment checks, and the common Compose runtime
+  preflight.
+- Documented Relay issuer identity independently from OIDC discovery or direct
+  JWKS transport while preserving canonical discovery compatibility.
+- Added Registry Mint's opt-in client-secret profile for managed standard OAuth
+  clients, while retaining `private_key_jwt` as the default and sole method
+  for Evidence and delegated authority.
+- Added owner-only client-secret provisioning, per-installation registration,
+  bounded rotation and revocation guidance, and a QGIS Client Credentials
+  walkthrough. The walkthrough is configuration guidance, not release-gate
+  interoperability evidence.
+- Documented the npm and PyPI distribution transaction for the exact
+  checksum-covered Evidence and Relay client packages. Registry publication is
+  accepted only when registry digests match the candidate bytes.
+- Documented that the Relay installer verifies and installs matching `relay`
+  and `relayctl` binaries together on Linux amd64 and preserves the previous
+  pair on failure.
+- Documented eager Evidence trusted-key validation, Mint's reserved `scope`
+  authority boundary, categorical Relay editor diagnostics, and governed-only
+  Relay project indexing.
+- Hardened synchronized product documentation so it is compiled as inert
+  Markdown and refuses active raw HTML or unsafe rendered destinations.
+- Added the v0.22.0 beta-33 candidate documentation archive.
 
 ## 2026-08-13
 
diff --git a/docs/site/src/content/docs/reference/cli/evidence-oid4vci.mdx b/docs/site/src/content/docs/reference/cli/evidence-oid4vci.mdx
index aa3c11a46..f8ffebea2 100644
--- a/docs/site/src/content/docs/reference/cli/evidence-oid4vci.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidence-oid4vci.mdx
@@ -18,7 +18,7 @@ Registry Stack wallet delivery front end for Evidence credentials.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidence-oid4vci/check.mdx b/docs/site/src/content/docs/reference/cli/evidence-oid4vci/check.mdx
index 7540d8c03..04c5f49ac 100644
--- a/docs/site/src/content/docs/reference/cli/evidence-oid4vci/check.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidence-oid4vci/check.mdx
@@ -18,7 +18,7 @@ Load and validate the configuration and the client key, then exit.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidence-oid4vci/inspect.mdx b/docs/site/src/content/docs/reference/cli/evidence-oid4vci/inspect.mdx
index 86b752514..f78771148 100644
--- a/docs/site/src/content/docs/reference/cli/evidence-oid4vci/inspect.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidence-oid4vci/inspect.mdx
@@ -18,7 +18,7 @@ Validate the deployment and print its derived protocol metadata.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidence-oid4vci/openapi.mdx b/docs/site/src/content/docs/reference/cli/evidence-oid4vci/openapi.mdx
index 0c13320b1..fcf4e5206 100644
--- a/docs/site/src/content/docs/reference/cli/evidence-oid4vci/openapi.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidence-oid4vci/openapi.mdx
@@ -18,7 +18,7 @@ Render the deterministic OpenAPI 3.1 contract, then exit.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidence-oid4vci/serve.mdx b/docs/site/src/content/docs/reference/cli/evidence-oid4vci/serve.mdx
index 575eecd3e..3edb1a9b0 100644
--- a/docs/site/src/content/docs/reference/cli/evidence-oid4vci/serve.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidence-oid4vci/serve.mdx
@@ -18,7 +18,7 @@ Serve the delivery endpoints until terminated.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidence.mdx b/docs/site/src/content/docs/reference/cli/evidence.mdx
index 3487cd7f7..9dec15c45 100644
--- a/docs/site/src/content/docs/reference/cli/evidence.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidence.mdx
@@ -18,7 +18,7 @@ Evidence Gateway Version 1.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidence/check.mdx b/docs/site/src/content/docs/reference/cli/evidence/check.mdx
index fdda60834..9068eef61 100644
--- a/docs/site/src/content/docs/reference/cli/evidence/check.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidence/check.mdx
@@ -18,7 +18,7 @@ Validate and compile the complete immutable bundle, and validate the mounted sec
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidence/evaluate.mdx b/docs/site/src/content/docs/reference/cli/evidence/evaluate.mdx
index 1548d4109..6bc284ae2 100644
--- a/docs/site/src/content/docs/reference/cli/evidence/evaluate.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidence/evaluate.mdx
@@ -18,7 +18,7 @@ Evaluate one bundle-owned fixture without source or credential access.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidence/serve.mdx b/docs/site/src/content/docs/reference/cli/evidence/serve.mdx
index 02ae4a21a..55496fb77 100644
--- a/docs/site/src/content/docs/reference/cli/evidence/serve.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidence/serve.mdx
@@ -18,7 +18,7 @@ Start the native Evidence Gateway HTTP service.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidence/verify-audit.mdx b/docs/site/src/content/docs/reference/cli/evidence/verify-audit.mdx
index 7e16b9075..4f2ea2a19 100644
--- a/docs/site/src/content/docs/reference/cli/evidence/verify-audit.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidence/verify-audit.mdx
@@ -18,7 +18,7 @@ Run a full out-of-band verification pass over the audit chain.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Description
 
diff --git a/docs/site/src/content/docs/reference/cli/evidence/verify-presentation.mdx b/docs/site/src/content/docs/reference/cli/evidence/verify-presentation.mdx
index a29207c01..6b4cd8124 100644
--- a/docs/site/src/content/docs/reference/cli/evidence/verify-presentation.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidence/verify-presentation.mdx
@@ -18,7 +18,7 @@ Re-verify one stored holder-bound presentation offline against a pinned key set.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Description
 
diff --git a/docs/site/src/content/docs/reference/cli/evidence/verify.mdx b/docs/site/src/content/docs/reference/cli/evidence/verify.mdx
index b83cde64b..ff35f3313 100644
--- a/docs/site/src/content/docs/reference/cli/evidence/verify.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidence/verify.mdx
@@ -18,7 +18,7 @@ Re-verify one stored signed response offline against a pinned key set.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Description
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl.mdx b/docs/site/src/content/docs/reference/cli/evidencectl.mdx
index 312970a39..42d98f761 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl.mdx
@@ -18,7 +18,7 @@ Evidence adopter tooling: keys, source authoring, fixture runs.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/access.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/access.mdx
index 9101c0651..9dbdd3e6d 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/access.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/access.mdx
@@ -18,7 +18,7 @@ Manage local caller access policies and clients.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/access/client.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/access/client.mdx
index c955d339f..f0027f56c 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/access/client.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/access/client.mdx
@@ -18,7 +18,7 @@ Register and revoke local Evidence Gateway clients.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/access/client/add.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/access/client/add.mdx
index 461d57a01..d03bb7d24 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/access/client/add.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/access/client/add.mdx
@@ -18,7 +18,7 @@ Add one local client and generate its private key.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/access/client/list.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/access/client/list.mdx
index 4f0ffb70d..433a678da 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/access/client/list.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/access/client/list.mdx
@@ -18,7 +18,7 @@ List local clients and their policy membership.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/access/client/revoke.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/access/client/revoke.mdx
index 255e044ec..2779b842d 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/access/client/revoke.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/access/client/revoke.mdx
@@ -18,7 +18,7 @@ Revoke one local client.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/access/policy.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/access/policy.mdx
index 5aafab77e..5929b85f3 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/access/policy.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/access/policy.mdx
@@ -18,7 +18,7 @@ Define which authored questions a policy may request.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/access/policy/add.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/access/policy/add.mdx
index 73de2f430..42ad4c828 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/access/policy/add.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/access/policy/add.mdx
@@ -18,7 +18,7 @@ Add one governed access policy.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/access/policy/list.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/access/policy/list.mdx
index 3a3e9d7df..de6bc1ce3 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/access/policy/list.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/access/policy/list.mdx
@@ -18,7 +18,7 @@ List governed access policies.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/audit.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/audit.mdx
index 4845c26c9..02e2e3d73 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/audit.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/audit.mdx
@@ -18,7 +18,7 @@ Inspect stopped local audit history.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/audit/show.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/audit/show.mdx
index 75da7bcf6..08d48c608 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/audit/show.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/audit/show.mdx
@@ -18,7 +18,7 @@ Show a minimized view of stopped local audit history.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/build.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/build.mdx
index 5f7f3e1d0..97bc2557a 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/build.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/build.mdx
@@ -18,7 +18,7 @@ Compile an editable project into a reviewed deployment candidate.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/dev.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/dev.mdx
index 2999036f9..1bc5c5354 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/dev.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/dev.mdx
@@ -18,7 +18,7 @@ Run the private local Registry Mint and Evidence Gateway pair.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/dev/clean.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/dev/clean.mdx
index cc383557c..17e72202b 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/dev/clean.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/dev/clean.mdx
@@ -18,7 +18,7 @@ Remove one completed stopped local generation.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/dev/stop.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/dev/stop.mdx
index 289c19026..81239c3c0 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/dev/stop.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/dev/stop.mdx
@@ -18,7 +18,7 @@ Stop the active local Registry Mint and Evidence Gateway pair.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/doctor.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/doctor.mdx
index 634580820..caeb0905e 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/doctor.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/doctor.mdx
@@ -18,7 +18,7 @@ Report every project artifact whose mode or owner the runtime refuses.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/fixtures.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/fixtures.mdx
index 339b2b068..31c1d1b51 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/fixtures.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/fixtures.mdx
@@ -18,7 +18,7 @@ Drive the evidence binary across a project's bundle fixtures.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/fixtures/run.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/fixtures/run.mdx
index b7e8cec27..ab607a6e0 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/fixtures/run.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/fixtures/run.mdx
@@ -18,7 +18,7 @@ Run `evidence check` and every bundle fixture through `evidence evaluate`.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/jwks.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/jwks.mdx
index 0334bc571..4f925e6f4 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/jwks.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/jwks.mdx
@@ -18,7 +18,7 @@ Assemble a public JWKS document from public JWK files.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/keygen.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/keygen.mdx
index 4dae71fbb..a138f1af3 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/keygen.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/keygen.mdx
@@ -18,7 +18,7 @@ Generate Evidence Gateway deployment key material as owner-only files.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/keygen/client-assertion.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/keygen/client-assertion.mdx
index 341cd4b99..757e62ce6 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/keygen/client-assertion.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/keygen/client-assertion.mdx
@@ -18,7 +18,7 @@ Keypair a source's `clientAssertionKeyRef` points at, for a token endpoint that
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/keygen/holder.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/keygen/holder.mdx
index 60555cca1..3ed3fb2eb 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/keygen/holder.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/keygen/holder.mdx
@@ -18,7 +18,7 @@ P-256 ES256 holder keypair for SD-JWT VC confirmation binding.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/keygen/secret.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/keygen/secret.mdx
index 4784eca57..f75c1cab8 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/keygen/secret.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/keygen/secret.mdx
@@ -18,7 +18,7 @@ One random raw secret file, 32 bytes (audit or subject-binding HMAC).
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Description
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/keygen/signing.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/keygen/signing.mdx
index 855c61c4d..22edb2ba5 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/keygen/signing.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/keygen/signing.mdx
@@ -18,7 +18,7 @@ P-256 ES256 signing keypair as private and public JWK files.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/keygen/token.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/keygen/token.mdx
index 49b111b65..3ef606fb7 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/keygen/token.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/keygen/token.mdx
@@ -18,7 +18,7 @@ One random bearer token file, printable and header-safe.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/new.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/new.mdx
index 7bd94563e..079d70733 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/new.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/new.mdx
@@ -18,7 +18,7 @@ Start an editable Evidence Gateway project from OpenAPI or a SQLite extract.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/request.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/request.mdx
index f3f063ae7..5271f8afc 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/request.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/request.mdx
@@ -18,7 +18,7 @@ Prepare a closed request for the active local project.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/request/prepare.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/request/prepare.mdx
index 269d6ec7f..26e2edb5a 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/request/prepare.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/request/prepare.mdx
@@ -18,7 +18,7 @@ Prepare the request, authorization header, and verification context.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/source.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/source.mdx
index e54424a12..d7c868f79 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/source.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/source.mdx
@@ -18,7 +18,7 @@ Work with a project's sources, starting from their own API documents.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/source/mock.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/source/mock.mdx
index a10a6e3e3..e5afbe8a0 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/source/mock.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/source/mock.mdx
@@ -18,7 +18,7 @@ Generate, inspect, and serve a local synthetic source API.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/source/mock/check.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/source/mock/check.mdx
index 0d00e1d16..f85835f39 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/source/mock/check.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/source/mock/check.mdx
@@ -18,7 +18,7 @@ Validate edited configuration and response bodies without writing or binding.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/source/mock/generate.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/source/mock/generate.mdx
index 13c45e605..f12a8c5ac 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/source/mock/generate.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/source/mock/generate.mdx
@@ -18,7 +18,7 @@ Create editable configuration and response bodies without overwriting files.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/source/mock/serve.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/source/mock/serve.mdx
index 0fc667534..64bdf9ed4 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/source/mock/serve.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/source/mock/serve.mdx
@@ -18,7 +18,7 @@ Serve schema-valid synthetic responses from OpenAPI or exact edited cases.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/source/suggest.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/source/suggest.mdx
index f15ff3ec4..8ac1be047 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/source/suggest.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/source/suggest.mdx
@@ -18,7 +18,7 @@ Suggest source configuration from an OpenAPI document.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/tooling.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/tooling.mdx
index 41126af76..2c4187b7c 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/tooling.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/tooling.mdx
@@ -18,7 +18,7 @@ Advanced: editor and tooling integration surfaces.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/tooling/editor.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/tooling/editor.mdx
index 745ce4d64..b9232399d 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/tooling/editor.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/tooling/editor.mdx
@@ -18,7 +18,7 @@ Write project-local schema mappings for a YAML-aware editor.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/tooling/language-server.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/tooling/language-server.mdx
index 112a20273..578e55a8e 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/tooling/language-server.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/tooling/language-server.mdx
@@ -18,7 +18,7 @@ Run cross-file navigation over the Language Server Protocol.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/evidencectl/verify.mdx b/docs/site/src/content/docs/reference/cli/evidencectl/verify.mdx
index 60061c5f7..478cae29a 100644
--- a/docs/site/src/content/docs/reference/cli/evidencectl/verify.mdx
+++ b/docs/site/src/content/docs/reference/cli/evidencectl/verify.mdx
@@ -18,7 +18,7 @@ Verify one retained Evidence Gateway response offline.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/index.mdx b/docs/site/src/content/docs/reference/cli/index.mdx
index 222fc6839..10e6e1a12 100644
--- a/docs/site/src/content/docs/reference/cli/index.mdx
+++ b/docs/site/src/content/docs/reference/cli/index.mdx
@@ -18,7 +18,7 @@ Use these generated references for exact command syntax, arguments, options, def
 
 ## Contract status
 
-The pages in this section are generated from the public Clap command trees for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+The pages in this section are generated from the public Clap command trees for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Registry Relay
 
diff --git a/docs/site/src/content/docs/reference/cli/mint.mdx b/docs/site/src/content/docs/reference/cli/mint.mdx
index 7b9044bbb..7ed2bf4ea 100644
--- a/docs/site/src/content/docs/reference/cli/mint.mdx
+++ b/docs/site/src/content/docs/reference/cli/mint.mdx
@@ -18,7 +18,7 @@ Registry Stack token issuer.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/mint/check.mdx b/docs/site/src/content/docs/reference/cli/mint/check.mdx
index 5c5fa0afe..77ed3d2a5 100644
--- a/docs/site/src/content/docs/reference/cli/mint/check.mdx
+++ b/docs/site/src/content/docs/reference/cli/mint/check.mdx
@@ -18,7 +18,7 @@ Load the configuration, keys, audit chain, and client registry, then exit.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/mint/client-secret.mdx b/docs/site/src/content/docs/reference/cli/mint/client-secret.mdx
index b506dcfb7..edf371a2b 100644
--- a/docs/site/src/content/docs/reference/cli/mint/client-secret.mdx
+++ b/docs/site/src/content/docs/reference/cli/mint/client-secret.mdx
@@ -18,7 +18,7 @@ Provision high-entropy credentials for compatible managed clients.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/mint/client-secret/generate.mdx b/docs/site/src/content/docs/reference/cli/mint/client-secret/generate.mdx
index a5b9337c5..6deb83897 100644
--- a/docs/site/src/content/docs/reference/cli/mint/client-secret/generate.mdx
+++ b/docs/site/src/content/docs/reference/cli/mint/client-secret/generate.mdx
@@ -18,7 +18,7 @@ Generate one credential file and print its non-secret fingerprint.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/mint/healthcheck.mdx b/docs/site/src/content/docs/reference/cli/mint/healthcheck.mdx
index e53fd2a96..cb60c33ce 100644
--- a/docs/site/src/content/docs/reference/cli/mint/healthcheck.mdx
+++ b/docs/site/src/content/docs/reference/cli/mint/healthcheck.mdx
@@ -18,7 +18,7 @@ Probe a numeric private readiness endpoint without ambient proxy use.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/mint/serve.mdx b/docs/site/src/content/docs/reference/cli/mint/serve.mdx
index 01cc8c34a..2c839336b 100644
--- a/docs/site/src/content/docs/reference/cli/mint/serve.mdx
+++ b/docs/site/src/content/docs/reference/cli/mint/serve.mdx
@@ -18,7 +18,7 @@ Serve the token endpoint until terminated.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/mint/token.mdx b/docs/site/src/content/docs/reference/cli/mint/token.mdx
index cffd80c60..df784eede 100644
--- a/docs/site/src/content/docs/reference/cli/mint/token.mdx
+++ b/docs/site/src/content/docs/reference/cli/mint/token.mdx
@@ -18,7 +18,7 @@ Obtain an access token from a running token endpoint, as a client would.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Description
 
diff --git a/docs/site/src/content/docs/reference/cli/mint/verify-audit.mdx b/docs/site/src/content/docs/reference/cli/mint/verify-audit.mdx
index 26dd60439..2d5398088 100644
--- a/docs/site/src/content/docs/reference/cli/mint/verify-audit.mdx
+++ b/docs/site/src/content/docs/reference/cli/mint/verify-audit.mdx
@@ -18,7 +18,7 @@ Verify the retained keyed Mint audit chain named by the configuration.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/relay.mdx b/docs/site/src/content/docs/reference/cli/relay.mdx
index 12e6a8d85..3027c3682 100644
--- a/docs/site/src/content/docs/reference/cli/relay.mdx
+++ b/docs/site/src/content/docs/reference/cli/relay.mdx
@@ -18,7 +18,7 @@ Compiled read-only Registry Relay runtime.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/relay/check.mdx b/docs/site/src/content/docs/reference/cli/relay/check.mdx
index 8f46ed33a..fdcda0f9d 100644
--- a/docs/site/src/content/docs/reference/cli/relay/check.mdx
+++ b/docs/site/src/content/docs/reference/cli/relay/check.mdx
@@ -18,7 +18,7 @@ Validate the sealed package and every deployment dependency without taking the l
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/relay/healthcheck.mdx b/docs/site/src/content/docs/reference/cli/relay/healthcheck.mdx
index 417c7fe23..253749800 100644
--- a/docs/site/src/content/docs/reference/cli/relay/healthcheck.mdx
+++ b/docs/site/src/content/docs/reference/cli/relay/healthcheck.mdx
@@ -18,7 +18,7 @@ Probe an unauthenticated Relay liveness endpoint.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/relay/serve.mdx b/docs/site/src/content/docs/reference/cli/relay/serve.mdx
index 0dc715034..5ea374931 100644
--- a/docs/site/src/content/docs/reference/cli/relay/serve.mdx
+++ b/docs/site/src/content/docs/reference/cli/relay/serve.mdx
@@ -18,7 +18,7 @@ Verify and activate one sealed Registry package, then serve it.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/relayctl.mdx b/docs/site/src/content/docs/reference/cli/relayctl.mdx
index b944940ab..2235b892e 100644
--- a/docs/site/src/content/docs/reference/cli/relayctl.mdx
+++ b/docs/site/src/content/docs/reference/cli/relayctl.mdx
@@ -18,7 +18,7 @@ Relay V2 project authoring, validation, and packaging.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/relayctl/check.mdx b/docs/site/src/content/docs/reference/cli/relayctl/check.mdx
index 1a5226413..e04e0d189 100644
--- a/docs/site/src/content/docs/reference/cli/relayctl/check.mdx
+++ b/docs/site/src/content/docs/reference/cli/relayctl/check.mdx
@@ -18,7 +18,7 @@ Compile and validate an authoring project.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/relayctl/diff.mdx b/docs/site/src/content/docs/reference/cli/relayctl/diff.mdx
index e8b3ad86d..23164d1d9 100644
--- a/docs/site/src/content/docs/reference/cli/relayctl/diff.mdx
+++ b/docs/site/src/content/docs/reference/cli/relayctl/diff.mdx
@@ -18,7 +18,7 @@ Classify meaning, disclosure, and security changes between projects.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/relayctl/generate.mdx b/docs/site/src/content/docs/reference/cli/relayctl/generate.mdx
index 42f0da355..710ec7901 100644
--- a/docs/site/src/content/docs/reference/cli/relayctl/generate.mdx
+++ b/docs/site/src/content/docs/reference/cli/relayctl/generate.mdx
@@ -18,7 +18,7 @@ Generate deterministic artifacts from the compiled project.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/relayctl/init.mdx b/docs/site/src/content/docs/reference/cli/relayctl/init.mdx
index eb9627353..624f561f6 100644
--- a/docs/site/src/content/docs/reference/cli/relayctl/init.mdx
+++ b/docs/site/src/content/docs/reference/cli/relayctl/init.mdx
@@ -18,7 +18,7 @@ Initialize a complete authoring project with unreviewed starters.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/relayctl/inspect.mdx b/docs/site/src/content/docs/reference/cli/relayctl/inspect.mdx
index f8124af23..39b6873d4 100644
--- a/docs/site/src/content/docs/reference/cli/relayctl/inspect.mdx
+++ b/docs/site/src/content/docs/reference/cli/relayctl/inspect.mdx
@@ -18,7 +18,7 @@ Inspect SQLite structure without reading row values.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/relayctl/package.mdx b/docs/site/src/content/docs/reference/cli/relayctl/package.mdx
index e4bab9998..85595f924 100644
--- a/docs/site/src/content/docs/reference/cli/relayctl/package.mdx
+++ b/docs/site/src/content/docs/reference/cli/relayctl/package.mdx
@@ -18,7 +18,7 @@ Build a deterministic sealed deployment package.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/relayctl/test.mdx b/docs/site/src/content/docs/reference/cli/relayctl/test.mdx
index f228974f7..b3cfd1754 100644
--- a/docs/site/src/content/docs/reference/cli/relayctl/test.mdx
+++ b/docs/site/src/content/docs/reference/cli/relayctl/test.mdx
@@ -18,7 +18,7 @@ Run the project's offline fixture cases through the shared kernel.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/relayctl/tooling.mdx b/docs/site/src/content/docs/reference/cli/relayctl/tooling.mdx
index dfe35778d..e2ae2d471 100644
--- a/docs/site/src/content/docs/reference/cli/relayctl/tooling.mdx
+++ b/docs/site/src/content/docs/reference/cli/relayctl/tooling.mdx
@@ -18,7 +18,7 @@ Advanced editor and language-server integration surfaces.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/relayctl/tooling/editor.mdx b/docs/site/src/content/docs/reference/cli/relayctl/tooling/editor.mdx
index 0eb3c5ff8..7f3c8e1e5 100644
--- a/docs/site/src/content/docs/reference/cli/relayctl/tooling/editor.mdx
+++ b/docs/site/src/content/docs/reference/cli/relayctl/tooling/editor.mdx
@@ -18,7 +18,7 @@ Write project-local schema mappings for VS Code and Zed.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/content/docs/reference/cli/relayctl/tooling/language-server.mdx b/docs/site/src/content/docs/reference/cli/relayctl/tooling/language-server.mdx
index dc44e83af..50b622cb2 100644
--- a/docs/site/src/content/docs/reference/cli/relayctl/tooling/language-server.mdx
+++ b/docs/site/src/content/docs/reference/cli/relayctl/tooling/language-server.mdx
@@ -18,7 +18,7 @@ Run Relay V2 authoring support over the Language Server Protocol.
 
 ## Contract status
 
-This page is generated from the public Clap command tree for Registry Stack source version `0.21.0` and catalog SHA-256 `0499aa2018ddaa3de409020eb95981d0dabf9cc7048172b3343ff07a54005e0d`. Hidden implementation commands are omitted.
+This page is generated from the public Clap command tree for Registry Stack source version `0.22.0` and catalog SHA-256 `424da2501da66db526fec2337b87e0be9ca937a8308783992fe5dcf43a21ff0d`. Hidden implementation commands are omitted.
 
 ## Usage
 
diff --git a/docs/site/src/data/archive-lock.yaml b/docs/site/src/data/archive-lock.yaml
index f7f8dba84..fb3cf9e25 100644
--- a/docs/site/src/data/archive-lock.yaml
+++ b/docs/site/src/data/archive-lock.yaml
@@ -90,3 +90,7 @@ archives:
     bundle_sha256: 2c0e509bd26ad76dbb1a5b9d18622dc73b30c4a99a5f7efe5de6173cad4aa6e6
     root_tree_sha256: 8d73f12f6fb32fb7023fd8a9827b7a9790763c19d08fddb74b10b8179ae428de
     version_tree_sha256: b6ae5c8978922778c9b1715a98ca1083165b3952247bfa3abe52ea010764f63c
+  v0.22.0:
+    bundle_sha256: 2c28e1fa225424d2b07346c8ab409db6aa978256488c4359032ce0223a8759f9
+    root_tree_sha256: bc051350d993f6a20f59dc8540c680cec395b38097433fc181aa0eb1f15d5cd4
+    version_tree_sha256: 2c167436177b054bba0fd4420885274b768ba72de6d99cd9a2bd7be9c2b91ed1
diff --git a/docs/site/src/data/contracts.yaml b/docs/site/src/data/contracts.yaml
index 4f3840bde..a413544cf 100644
--- a/docs/site/src/data/contracts.yaml
+++ b/docs/site/src/data/contracts.yaml
@@ -35,7 +35,7 @@
   surface: Portable `metadata.yaml` documents, compiled metadata model, public services, forms, policies, requirements, evidence type lists, evidence offering metadata, and evaluation profile metadata.
   source_of_truth:
     label: Registry Manifest core
-    url: https://github.com/registrystack/registry-stack/blob/v0.21.0/crates/registry-manifest-core/src/lib.rs
+    url: https://github.com/registrystack/registry-stack/blob/v0.22.0/crates/registry-manifest-core/src/lib.rs
   consumer_note: Runtime source paths, scopes, table or view names, endpoint locations, credentials, and other deployment bindings belong in consuming service configuration, not manifests.
 - id: registry-manifest.cpsv-ap-service-catalogue
   name: CPSV-AP Service Catalogue Render Contract
@@ -44,7 +44,7 @@
   surface: CPSV-AP JSON-LD service catalogue, CCCEV requirements, grouped evidence type lists, local form-definition links, DCAT data services, and form JSON Schemas.
   source_of_truth:
     label: Registry Manifest CPSV-AP fixture
-    url: https://github.com/registrystack/registry-stack/tree/v0.21.0/products/manifest/fixtures/cpsv-ap
+    url: https://github.com/registrystack/registry-stack/tree/v0.22.0/products/manifest/fixtures/cpsv-ap
   consumer_note: Each CCCEV evidence type list is one grouped option; multiple lists on a requirement are alternatives.
 - id: registry-manifest.static-publication
   name: Static Discovery Bundle
@@ -53,5 +53,5 @@
   surface: Static index, catalog JSON, evidence offerings, policies, DCAT, CPSV-AP, BRegDCAT-AP, SHACL, OGC Records item collection, entity JSON Schemas, form JSON Schemas, and embedded SKOS-shaped codelist nodes.
   source_of_truth:
     label: Registry Manifest CLI
-    url: https://github.com/registrystack/registry-stack/tree/v0.21.0/crates/registry-manifest-cli
+    url: https://github.com/registrystack/registry-stack/tree/v0.22.0/crates/registry-manifest-cli
   consumer_note: The bundle can be hosted as static files without running Registry Relay.
diff --git a/docs/site/src/data/docsets.yaml b/docs/site/src/data/docsets.yaml
index 875bb74ba..4275368ee 100644
--- a/docs/site/src/data/docsets.yaml
+++ b/docs/site/src/data/docsets.yaml
@@ -23,6 +23,28 @@ docsets:
       registry-evidence:
         version: main source (unreleased)
         ref: HEAD
+  - id: v0.22.0
+    label: v0.22.0
+    path: /v/0.22.0/
+    status: archived
+    availability: candidate
+    source: registry-stack-v0.22.0
+    repo_docs_source: monorepo
+    published_at: 2026-08-14
+    description: Registry Stack v0.22.0 beta-33 candidate documentation set.
+    products:
+      registry-stack:
+        version: v0.22.0
+        ref: v0.22.0
+      registry-relay:
+        version: v0.22.0
+        ref: v0.22.0
+      registry-manifest:
+        version: v0.22.0
+        ref: v0.22.0
+      registry-evidence:
+        version: v0.22.0
+        ref: v0.22.0
   - id: v0.21.0
     label: v0.21.0
     path: /v/0.21.0/
diff --git a/docs/site/src/data/generated/cli-reference.json b/docs/site/src/data/generated/cli-reference.json
index 07352f597..c19eb9843 100644
--- a/docs/site/src/data/generated/cli-reference.json
+++ b/docs/site/src/data/generated/cli-reference.json
@@ -1,6 +1,6 @@
 {
   "schema_version": "registry.cli-reference/v2",
-  "source_version": "0.21.0",
+  "source_version": "0.22.0",
   "binaries": [
     {
       "name": "evidence",
diff --git a/docs/site/src/data/generated/contracts.json b/docs/site/src/data/generated/contracts.json
index 49fb58ad2..34ab5f9aa 100644
--- a/docs/site/src/data/generated/contracts.json
+++ b/docs/site/src/data/generated/contracts.json
@@ -31,7 +31,7 @@
     "surface": "Portable `metadata.yaml` documents, compiled metadata model, public services, forms, policies, requirements, evidence type lists, evidence offering metadata, and evaluation profile metadata.",
     "source_of_truth": {
       "label": "Registry Manifest core",
-      "url": "https://github.com/registrystack/registry-stack/blob/v0.21.0/crates/registry-manifest-core/src/lib.rs"
+      "url": "https://github.com/registrystack/registry-stack/blob/v0.22.0/crates/registry-manifest-core/src/lib.rs"
     },
     "consumer_note": "Runtime source paths, scopes, table or view names, endpoint locations, credentials, and other deployment bindings belong in consuming service configuration, not manifests."
   },
@@ -43,7 +43,7 @@
     "surface": "CPSV-AP JSON-LD service catalogue, CCCEV requirements, grouped evidence type lists, local form-definition links, DCAT data services, and form JSON Schemas.",
     "source_of_truth": {
       "label": "Registry Manifest CPSV-AP fixture",
-      "url": "https://github.com/registrystack/registry-stack/tree/v0.21.0/products/manifest/fixtures/cpsv-ap"
+      "url": "https://github.com/registrystack/registry-stack/tree/v0.22.0/products/manifest/fixtures/cpsv-ap"
     },
     "consumer_note": "Each CCCEV evidence type list is one grouped option; multiple lists on a requirement are alternatives."
   },
@@ -55,7 +55,7 @@
     "surface": "Static index, catalog JSON, evidence offerings, policies, DCAT, CPSV-AP, BRegDCAT-AP, SHACL, OGC Records item collection, entity JSON Schemas, form JSON Schemas, and embedded SKOS-shaped codelist nodes.",
     "source_of_truth": {
       "label": "Registry Manifest CLI",
-      "url": "https://github.com/registrystack/registry-stack/tree/v0.21.0/crates/registry-manifest-cli"
+      "url": "https://github.com/registrystack/registry-stack/tree/v0.22.0/crates/registry-manifest-cli"
     },
     "consumer_note": "The bundle can be hosted as static files without running Registry Relay."
   }
diff --git a/docs/site/src/data/generated/docsets.json b/docs/site/src/data/generated/docsets.json
index ccd7bc8f2..deabc72c8 100644
--- a/docs/site/src/data/generated/docsets.json
+++ b/docs/site/src/data/generated/docsets.json
@@ -31,6 +31,35 @@
         }
       }
     },
+    {
+      "id": "v0.22.0",
+      "label": "v0.22.0",
+      "path": "/v/0.22.0/",
+      "status": "archived",
+      "availability": "candidate",
+      "source": "registry-stack-v0.22.0",
+      "repo_docs_source": "monorepo",
+      "published_at": "2026-08-14",
+      "description": "Registry Stack v0.22.0 beta-33 candidate documentation set.",
+      "products": {
+        "registry-stack": {
+          "version": "v0.22.0",
+          "ref": "v0.22.0"
+        },
+        "registry-relay": {
+          "version": "v0.22.0",
+          "ref": "v0.22.0"
+        },
+        "registry-manifest": {
+          "version": "v0.22.0",
+          "ref": "v0.22.0"
+        },
+        "registry-evidence": {
+          "version": "v0.22.0",
+          "ref": "v0.22.0"
+        }
+      }
+    },
     {
       "id": "v0.21.0",
       "label": "v0.21.0",
diff --git a/docs/site/src/data/repo-docs.yaml b/docs/site/src/data/repo-docs.yaml
index 1f80908ec..30c215114 100644
--- a/docs/site/src/data/repo-docs.yaml
+++ b/docs/site/src/data/repo-docs.yaml
@@ -32,7 +32,7 @@ repos:
         standards_referenced: [govstack-digital-registries, sdmx, openapi, json-schema, shacl, json-ld]
         exclude_docsets: [v0.18.0, v0.17.0, v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
         docset_overrides:
-          - docsets: [v0.21.0, v0.20.1, v0.20.0]
+          - docsets: [v0.22.0, v0.21.0, v0.20.1, v0.20.0]
             standards_referenced: [govstack-digital-registries, sdmx, openapi, json-schema, shacl, json-ld]
             last_reviewed: unreviewed
         description: Approved Relay V2 product concept covering the registry contract, the compiler, the read-only source boundary, and the acceptance set.
@@ -45,7 +45,7 @@ repos:
         standards_referenced: [govstack-digital-registries, sdmx, openapi, json-schema, shacl, json-ld]
         exclude_docsets: [v0.18.0, v0.17.0, v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
         docset_overrides:
-          - docsets: [v0.21.0, v0.20.1, v0.20.0]
+          - docsets: [v0.22.0, v0.21.0, v0.20.1, v0.20.0]
             standards_referenced: [govstack-digital-registries, sdmx, openapi, json-schema, shacl, json-ld]
             last_reviewed: unreviewed
         description: Maintained directional mapping from Relay V2 to the pinned GovStack drafts and the aligned SDMX read subset. Makes no conformance claim.
@@ -66,7 +66,7 @@ repos:
         last_reviewed: unreviewed
         standards_referenced: [dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, skos, json-schema, json-ld, odrl, sp-dci, w3c-did, prov-o, govstack-digital-registries]
         docset_overrides:
-          - docsets: [v0.21.0, v0.20.1, v0.20.0, v0.18.0, v0.17.0, v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3]
+          - docsets: [v0.22.0, v0.21.0, v0.20.1, v0.20.0, v0.18.0, v0.17.0, v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3]
             standards_referenced: [dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, skos, json-schema, json-ld, odrl, sp-dci, w3c-did, prov-o, govstack-digital-registries]
             last_reviewed: unreviewed
           - docsets: [beta-2026-06-12]
@@ -85,7 +85,7 @@ repos:
           - docsets: [beta-2026-06-12]
             standards_referenced: [dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, json-schema, json-ld, odrl]
             last_reviewed: unreviewed
-          - docsets: [v0.21.0, v0.20.1, v0.20.0, v0.18.0, v0.17.0, v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3]
+          - docsets: [v0.22.0, v0.21.0, v0.20.1, v0.20.0, v0.18.0, v0.17.0, v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3]
             standards_referenced: [dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, skos, json-schema, json-ld, odrl]
             last_reviewed: unreviewed
       - src: products/manifest/docs/profile-fixtures.md
@@ -97,7 +97,7 @@ repos:
         last_reviewed: unreviewed
         standards_referenced: [sp-dci]
         docset_overrides:
-          - docsets: [v0.21.0, v0.20.1, v0.20.0, v0.18.0, v0.17.0, v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
+          - docsets: [v0.22.0, v0.21.0, v0.20.1, v0.20.0, v0.18.0, v0.17.0, v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
             standards_referenced: [sp-dci]
             last_reviewed: unreviewed
       - src: products/manifest/docs/reference.md
@@ -112,7 +112,7 @@ repos:
           - docsets: [beta-2026-06-12]
             standards_referenced: [dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, json-schema, json-ld, cccev, odrl, w3c-did]
             last_reviewed: unreviewed
-          - docsets: [v0.21.0, v0.20.1, v0.20.0, v0.18.0, v0.17.0, v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3]
+          - docsets: [v0.22.0, v0.21.0, v0.20.1, v0.20.0, v0.18.0, v0.17.0, v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3]
             standards_referenced: [dcat, bregdcat-ap, cpsv-ap, ogc-api-records, shacl, skos, json-schema, json-ld, cccev, odrl, w3c-did]
             last_reviewed: unreviewed
       - src: products/manifest/docs/itb-semic-validation.md
@@ -124,7 +124,7 @@ repos:
         standards_referenced: [dcat, bregdcat-ap, shacl, skos, json-schema, json-ld]
         exclude_docsets: [beta-5, beta-4, beta-3, beta-2026-06-12]
         docset_overrides:
-          - docsets: [v0.21.0, v0.20.1, v0.20.0, v0.18.0, v0.17.0, v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
+          - docsets: [v0.22.0, v0.21.0, v0.20.1, v0.20.0, v0.18.0, v0.17.0, v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1]
             standards_referenced: [dcat, bregdcat-ap, shacl, skos, json-schema, json-ld]
             last_reviewed: unreviewed
   registry-evidence:
@@ -144,7 +144,7 @@ repos:
         standards_referenced: [openapi, json-schema, sd-jwt-vc]
         exclude_docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
         docset_overrides:
-          - docsets: [v0.21.0, v0.20.1, v0.20.0, v0.18.0, v0.17.0]
+          - docsets: [v0.22.0, v0.21.0, v0.20.1, v0.20.0, v0.18.0, v0.17.0]
             standards_referenced: [openapi, json-schema, sd-jwt-vc]
             last_reviewed: unreviewed
         description: Operator and integrator documentation for Evidence Gateway, the minimum-disclosure assertion service.
@@ -157,7 +157,7 @@ repos:
         standards_referenced: [cccev, json-schema, openapi, sd-jwt-vc]
         exclude_docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
         docset_overrides:
-          - docsets: [v0.21.0, v0.20.1, v0.20.0, v0.18.0, v0.17.0]
+          - docsets: [v0.22.0, v0.21.0, v0.20.1, v0.20.0, v0.18.0, v0.17.0]
             standards_referenced: [cccev, json-schema, openapi, sd-jwt-vc]
             last_reviewed: unreviewed
         description: Approved Version 1 product concept covering the boundary, data model, trust and privacy invariants, native API, and acceptance set.
@@ -170,7 +170,7 @@ repos:
         standards_referenced: [json-schema, openapi, sd-jwt-vc]
         exclude_docsets: [v0.17.0, v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
         docset_overrides:
-          - docsets: [v0.21.0, v0.20.1, v0.20.0, v0.18.0]
+          - docsets: [v0.22.0, v0.21.0, v0.20.1, v0.20.0, v0.18.0]
             standards_referenced: [json-schema, openapi, sd-jwt-vc]
             last_reviewed: unreviewed
         description: Complete reference for the editable Evidence authoring project, its validation layers, local key material, and access policies.
@@ -183,7 +183,7 @@ repos:
         standards_referenced: []
         exclude_docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
         docset_overrides:
-          - docsets: [v0.21.0, v0.20.1, v0.20.0, v0.18.0, v0.17.0]
+          - docsets: [v0.22.0, v0.21.0, v0.20.1, v0.20.0, v0.18.0, v0.17.0]
             standards_referenced: []
             last_reviewed: unreviewed
         description: Deterministic local curl checkpoint against the Evidence Gateway server with a mock source and an in-memory test JWKS.
@@ -196,7 +196,7 @@ repos:
         standards_referenced: [sd-jwt-vc]
         exclude_docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
         docset_overrides:
-          - docsets: [v0.21.0, v0.20.1, v0.20.0, v0.18.0, v0.17.0]
+          - docsets: [v0.22.0, v0.21.0, v0.20.1, v0.20.0, v0.18.0, v0.17.0]
             standards_referenced: [sd-jwt-vc]
             last_reviewed: unreviewed
         description: Source-testing contract with the deterministic mock matrix, opt-in public demo smoke tests, and credential handling rules.
@@ -209,7 +209,7 @@ repos:
         standards_referenced: [sd-jwt-vc]
         exclude_docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
         docset_overrides:
-          - docsets: [v0.21.0, v0.20.1, v0.20.0, v0.18.0, v0.17.0]
+          - docsets: [v0.22.0, v0.21.0, v0.20.1, v0.20.0, v0.18.0, v0.17.0]
             standards_referenced: [sd-jwt-vc]
             last_reviewed: unreviewed
         description: Deterministic local demo that issues one assertion in both later-verifiable formats and re-verifies the credential offline.
@@ -222,7 +222,7 @@ repos:
         standards_referenced: [openapi, sd-jwt-vc]
         exclude_docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
         docset_overrides:
-          - docsets: [v0.21.0, v0.20.1, v0.20.0, v0.18.0, v0.17.0]
+          - docsets: [v0.22.0, v0.21.0, v0.20.1, v0.20.0, v0.18.0, v0.17.0]
             standards_referenced: [openapi, sd-jwt-vc]
             last_reviewed: unreviewed
         description: Supported deployment shape, requester authority and purpose duties, required configuration and secrets, and readiness, audit, and key obligations.
@@ -235,7 +235,7 @@ repos:
         standards_referenced: []
         exclude_docsets: [v0.16.3, v0.16.2, v0.16.1, v0.16.0, v0.15.2, v0.15.1, v0.15.0, v0.13.0, v0.12.2, v0.12.1, v0.12.0, v0.11.0, v0.10.0, v0.9.0, v0.8.4, v0.8.3, v0.8.2, v0.8.1, beta-5, beta-4, beta-3, beta-2026-06-12]
         docset_overrides:
-          - docsets: [v0.21.0, v0.20.1, v0.20.0, v0.18.0, v0.17.0]
+          - docsets: [v0.22.0, v0.21.0, v0.20.1, v0.20.0, v0.18.0, v0.17.0]
             standards_referenced: []
             last_reviewed: unreviewed
         description: Measured baseline of the audit-durability throughput trade and the deferred work that would recover most of the cost.
diff --git a/products/evidence/generated/registry-evidence.openapi.json b/products/evidence/generated/registry-evidence.openapi.json
index 05cda6981..b2261eea2 100644
--- a/products/evidence/generated/registry-evidence.openapi.json
+++ b/products/evidence/generated/registry-evidence.openapi.json
@@ -1682,7 +1682,7 @@
   "info": {
     "description": "Minimum-disclosure signed assertion service, Version 1.",
     "title": "Registry Evidence API",
-    "version": "0.21.0"
+    "version": "0.22.0"
   },
   "openapi": "3.1.0",
   "paths": {
diff --git a/products/manifest/CHANGELOG.md b/products/manifest/CHANGELOG.md
index 762378b82..c808aaff7 100644
--- a/products/manifest/CHANGELOG.md
+++ b/products/manifest/CHANGELOG.md
@@ -7,6 +7,10 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+## [0.22.0] - 2026-08-14
+
+- No user-visible Registry Manifest format changes.
+
 ## [0.21.0] - 2026-08-13
 
 - No user-visible Registry Manifest format changes.
diff --git a/products/manifest/docs/release-notes.md b/products/manifest/docs/release-notes.md
index b81f09261..5f7b575af 100644
--- a/products/manifest/docs/release-notes.md
+++ b/products/manifest/docs/release-notes.md
@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+## 0.22.0
+
+- Registry Manifest has no user-visible format changes in this release.
+
 ## 0.21.0
 
 - Registry Manifest has no user-visible format changes in this release.
diff --git a/products/manifest/fuzz/Cargo.lock b/products/manifest/fuzz/Cargo.lock
index b5632c72d..d570005ba 100644
--- a/products/manifest/fuzz/Cargo.lock
+++ b/products/manifest/fuzz/Cargo.lock
@@ -188,7 +188,7 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
 [[package]]
 name = "registry-manifest-cli"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "registry-manifest-core",
  "serde",
@@ -199,7 +199,7 @@ dependencies = [
 
 [[package]]
 name = "registry-manifest-core"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "oxiri",
  "registry-platform-canonical-json",
@@ -223,7 +223,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-canonical-json"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "ryu-js",
  "serde",
diff --git a/products/platform/CHANGELOG.md b/products/platform/CHANGELOG.md
index 9b12eac94..003402cd0 100644
--- a/products/platform/CHANGELOG.md
+++ b/products/platform/CHANGELOG.md
@@ -2,6 +2,13 @@
 
 ## Unreleased
 
+## v0.22.0 - 2026-08-14
+
+- Shared file-secret validation accepts owner-only mode `0400` for read-only
+  mounts and mode `0600` for read-write files. It continues to reject linked,
+  non-regular, executable, group-readable, and world-readable secret files.
+- No separately versioned Registry Platform API changes.
+
 ## v0.21.0 - 2026-08-13
 
 - No separately versioned Registry Platform API changes. This release adds
diff --git a/products/platform/fuzz/Cargo.lock b/products/platform/fuzz/Cargo.lock
index 0350d2c7f..d23c96b37 100644
--- a/products/platform/fuzz/Cargo.lock
+++ b/products/platform/fuzz/Cargo.lock
@@ -1514,7 +1514,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-authcommon"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "base64",
  "registry-platform-crypto",
@@ -1529,7 +1529,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-canonical-json"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "ryu-js",
  "serde",
@@ -1539,7 +1539,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-crypto"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "async-trait",
  "aws-lc-rs",
@@ -1580,7 +1580,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-httputil"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "async-trait",
  "base64",
@@ -1606,7 +1606,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-oidc"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "base64",
  "jsonwebtoken",
@@ -1621,7 +1621,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-sdjwt"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "base64",
  "getrandom 0.4.3",
@@ -1637,7 +1637,7 @@ dependencies = [
 
 [[package]]
 name = "registry-platform-sqlite"
-version = "0.21.0"
+version = "0.22.0"
 dependencies = [
  "rusqlite",
  "rustix",
diff --git a/release/OPERATIONS.md b/release/OPERATIONS.md
index 72ed0fe0b..428acf818 100644
--- a/release/OPERATIONS.md
+++ b/release/OPERATIONS.md
@@ -74,7 +74,7 @@ not part of later releases.
 
 ### Provision client registries
 
-Registry Stack v0.21.1 and later promote the exact candidate Evidence and Relay client
+Registry Stack v0.22.0 and later promote the exact candidate Evidence and Relay client
 packages to npm and PyPI before the GitHub Release becomes public. The two
 publication jobs use GitHub-hosted runners and OpenID Connect trusted
 publishing. Do not add npm or PyPI write tokens to the repository.
@@ -438,7 +438,7 @@ It verifies the annotated tag target, latest published non-prerelease state,
 every downloadable asset against GitHub's digest metadata, the exact
 `SHA256SUMS` closure and its protected-main Sigstore identity, the release-body
 manifest binding, every final OCI digest, and one maintained binary version
-smoke. For v0.21.1 and later, the publication workflow also verifies the npm
+smoke. For v0.22.0 and later, the publication workflow also verifies the npm
 SHA-512 integrity and PyPI SHA-256 digest of every client package before
 docs promotion. The public verifier is read-only and can be rerun
 independently.
diff --git a/release/VERIFY.md b/release/VERIFY.md
index 3904a948d..d74a8627d 100644
--- a/release/VERIFY.md
+++ b/release/VERIFY.md
@@ -156,7 +156,7 @@ private-candidate recovery and evidence-regeneration procedure for a failed gate
 
 ## Verify client registries
 
-Registry Stack v0.21.1 and later publish the checksum-covered Evidence and Relay client
+Registry Stack v0.22.0 and later publish the checksum-covered Evidence and Relay client
 packages to npm and PyPI. With the release assets still in the current
 directory, compare every registry version with its release tarball or wheel:
 
diff --git a/release/manifests/registry-stack-beta-33.yaml b/release/manifests/registry-stack-beta-33.yaml
new file mode 100644
index 000000000..f225c730b
--- /dev/null
+++ b/release/manifests/registry-stack-beta-33.yaml
@@ -0,0 +1,28 @@
+stack:
+  release: beta-33
+  version: 0.22.0
+  source_repo: registrystack/registry-stack
+  source_tag: v0.22.0
+
+artifacts:
+  registry-manifest: 0.22.0
+  relay: 0.22.0
+  relayctl: 0.22.0
+  evidence: 0.22.0
+  evidencectl: 0.22.0
+  mint: 0.22.0
+  evidence-oid4vci: 0.22.0
+  evidencectl-installer: 0.22.0
+  evidence-client-node: 0.22.0
+  evidence-client-python: 0.22.0
+  relay-installer: 0.22.0
+  registry-docs: 0.22.0
+  relay-client-node: 0.22.0
+  relay-client-python: 0.22.0
+
+identifier_catalog:
+  path: products/identifiers/generated/catalog.v1.json
+  sha256: 7a8130406862922a1c52f81a43577446713ab10ffe76b49179946ad861af3ac9
+  entry_count: 47
+
+external: {}
diff --git a/release/notes/v0.22.0.md b/release/notes/v0.22.0.md
new file mode 100644
index 000000000..5db0846fe
--- /dev/null
+++ b/release/notes/v0.22.0.md
@@ -0,0 +1,117 @@
+# Registry Stack v0.22.0
+
+Registry Stack v0.22.0 is the beta-33 minor release. It adds explicit
+container-deployment contracts, managed OAuth-client compatibility for Registry
+Mint, client package distribution through npm and PyPI, and security and
+tooling hardening. The minor version reflects these material additive
+distribution and configuration surfaces. It does not retire a product or
+require a Registry Manifest format migration.
+
+## Container deployment and preflight
+
+- Evidence Gateway may explicitly set
+  `listener.networkExposure: container-private` and bind `0.0.0.0` or `::`
+  when the operator confines the container network and terminates TLS
+  upstream. Omitting the field preserves the existing `private-address`
+  contract. Concrete public addresses, hostnames, and multicast addresses
+  remain prohibited.
+- Evidence and Registry Mint add
+  `check --require-runtime-dependencies`. Registry Relay adds
+  `relay check --runtime <runtime.yaml>`. These commands validate the mounted
+  deployment and its serving dependencies without opening the public listener.
+- The Compose deployment preflight checks the rendered deployment for the
+  fixed non-root runtime identity, read-only configuration and secret mounts,
+  durable audit storage, constrained networking, and the product-native checks
+  in their actual mount and network context.
+- Relay may bind the exact accepted JWT issuer through `trustedIssuer` while
+  selecting either an OIDC discovery transport or a direct `jwksUrl`.
+  Existing runtimes may continue to omit `trustedIssuer` when their
+  `discoveryUrl` is the canonical issuer discovery URL.
+- Owner-only file secrets may be mounted read-only as mode `0400` or
+  read-write as mode `0600`. Group-readable, world-readable, executable,
+  linked, or non-regular secret files remain rejected.
+- The official runtime images carry machine-readable UID and GID labels for
+  the fixed non-root process identity.
+
+## Registry Mint compatibility for managed OAuth clients
+
+- Registry Mint adds an opt-in client-secret compatibility profile for managed
+  clients that support OAuth 2.0 Client Credentials but cannot sign a
+  `private_key_jwt` assertion. It accepts `client_secret_basic` and
+  `client_secret_post`.
+- `private_key_jwt` remains the default and the only client-authentication
+  method for Evidence authority and delegated authority. Client-secret
+  registrations may use only the standard authorization profile.
+- Mint reads scopes, direct claims, principal, and audience from the governed
+  client registration. A token request cannot add, replace, or widen that
+  authority. Standard-profile access tokens remain bounded to a maximum
+  lifetime of 900 seconds.
+- `mint client-secret generate` creates a new owner-only credential file,
+  refuses to replace an existing file, and prints only its SHA-256
+  fingerprint. Registrations retain one or two fingerprints for bounded
+  rotation and never store the raw credential.
+- Adopter documentation includes configuration guidance for one managed QGIS
+  installation using Client Credentials. This is configuration guidance, not
+  a claim that QGIS interoperability was exercised as a release gate.
+
+## Client packages and Relay installation
+
+- The release closure retains checksum-covered Evidence and Relay Node.js
+  tarballs and Python wheels as GitHub Release assets.
+- The publication transaction is configured to promote those exact candidate
+  bytes as `@registrystack/evidence-client` and
+  `@registrystack/relay-client` on npm, and as
+  `registry-evidence-client` and `registry-relay-client` on PyPI. npm SHA-512
+  integrity and PyPI SHA-256 digests must match the candidate before the
+  GitHub Release becomes public.
+- The Relay installer downloads, verifies, and installs matching `relay` and
+  `relayctl` binaries together on Linux amd64. If either binary cannot be
+  verified or installed, the installer preserves the previous pair.
+- Install a client package only at the exact Registry Stack version used by
+  the corresponding runtime. Do not treat an npm `0.0.0` package-identity
+  bootstrap as a usable client release.
+
+## Security and tooling hardening
+
+- Registry Mint refuses delegated subject mappings rooted at `scope`, so
+  subject data cannot overwrite registered authorization.
+- The Evidence verifier validates trusted P-256 public keys when trust is
+  configured and rejects coordinates that do not represent a valid curve
+  point before processing a response.
+- Relay editor setup reports categorical failures without exposing absolute
+  project paths or source content.
+- The Relay language server indexes only the entry documents and the governed
+  files referenced by the current project, rather than treating every safe
+  relative file as project-owned.
+- Product documentation synchronized into the site is compiled as inert
+  Markdown. Raw active HTML and unsafe rendered link destinations are refused.
+
+## Compatibility and upgrade requirements
+
+- Existing Evidence runtime files that omit `listener.networkExposure` retain
+  the `private-address` behavior.
+- Existing Relay runtimes using canonical issuer discovery remain valid
+  without `trustedIssuer`. Use the new field when issuer identity and
+  discovery or JWKS transport use different authorities.
+- Existing Registry Mint `private_key_jwt` registrations require no
+  authentication migration. Client-secret authentication must be enabled
+  explicitly per managed installation.
+- Rename any delegated Mint subject mapping rooted at `scope` before loading
+  the client registry with v0.22.0.
+- Relay installer users should expect `relayctl` to be installed and upgraded
+  with the `relay` runtime.
+- Registry Manifest has no user-visible format change in this release.
+
+## Release boundaries
+
+- Beta publication promotes one verified candidate from protected `main`
+  without rebuilding binaries, client packages, documentation, or runtime
+  image manifests.
+- Candidate image scanning must complete successfully and applicable advisory
+  decisions must carry the required exposure evidence.
+- Exact already-completed image and client-registry operations may be
+  reconciled during a retry. A mismatched immutable image or package version
+  requires a new release version.
+- Hosted deployments, external conformance, the documented QGIS walkthrough,
+  and adopter-specific rollout exercises remain outside this release's
+  critical path.