From 021d4b4cce817c13d429a8f6c1785dee71315eb3 Mon Sep 17 00:00:00 2001
From: Jie <jie@jsray.org>
Date: Sun, 6 Sep 2026 00:14:19 +0800
Subject: [PATCH 1/2] Reject a release subject that names the version and
 nothing else
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The hook already rejected a bare `0.0.1-beta.3`, with a comment about how a
version number lands on every file the release touched. One word in front slips
past it: `Release 0.0.2-beta.2` did exactly what the bare version would have
done, on twelve files, and cannot be reworded now — the tag points at it and
this project does not rewrite published history.

The integrations table and the distribution table now say where each thing can
be got, rather than pairing that with where it cannot. And the roadmap entry
describing jsray-vscode and jsray-terminal as unpublished, bundling Core
0.0.1-beta.5, has been overtaken on every count.
---
 CHANGELOG.md              |  2 +-
 README.md                 |  8 ++++----
 README.zh-CN.md           |  8 ++++----
 docs/development.md       | 11 ++++++-----
 docs/development.zh-CN.md | 10 +++++-----
 docs/projects.md          | 10 +++++-----
 docs/projects.zh-CN.md    |  8 ++++----
 tools/hooks/commit-msg    | 12 +++++++++---
 8 files changed, 38 insertions(+), 31 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 30d6fe7..4e28913 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -30,7 +30,7 @@ saying about this project.
 
 - **The palette fallback chain has one implementation.** `applyThemeToRoot` carried the only copy of it; `resolveToken` is now shared with the portable renderer, because two renderers resolving the same palette by two implementations is how they come to disagree about a palette that predates a token key.
 - The site build ships `themes/` and the new page. The paste page fetches every palette at runtime for the same reason the Studio does — a second copy of the colours is a second thing to drift.
-- **The README says what the integrations are, because npm shows this file.** The published page for `@jsray/core@0.0.2-beta.1` still lists all three as "Coming soon"; all three are public with releases, and the table now links each one and says where it can actually be installed from — which is GitHub rather than its host's directory in every case. npm freezes a package page per version, so a correction only reaches the registry by publishing.
+- **The README says what the integrations are, because npm shows this file.** The published page for `@jsray/core@0.0.2-beta.1` still lists all three as "Coming soon"; all three are public with releases, and the table now links each one and says where each can be installed from. npm freezes a package page per version, so a correction only reaches the registry by publishing.
 - **`repository` and `bugs` point at the organisation's current name.** They were published as `github.com/JSRayCore/JSRay`, which still redirects — but the frozen metadata is what every tool reads, and the org name it names no longer exists.
 - **The versioning doc says why Core counts its betas.** It justified the counter mechanically — `check:versions` wants it, `version_compare()` orders it — which is true and is not the reason. Core is the kernel every integration renders through, so it earns more revision rounds before `0.1.0` than anything built on it, and those land inside one patch. The integrations bump the patch each time, so a counter would say nothing.
 
diff --git a/README.md b/README.md
index 64e4b1e..0d2d11a 100644
--- a/README.md
+++ b/README.md
@@ -111,12 +111,12 @@ Official integrations live in their own repositories, use JSRay Core by default,
 
 | Integration | Repository | Status |
 |---|---|---|
-| WordPress plugin | [`jsray-wp`](https://github.com/jsrayorg/jsray-wp) | Public beta · not on WordPress.org yet |
-| VS Code extension | [`jsray-vscode`](https://github.com/jsrayorg/jsray-vscode) | Public beta · not on the Marketplace yet |
-| Terminal CLI | [`jsray-terminal`](https://github.com/jsrayorg/jsray-terminal) | Public beta · not on npm yet |
+| WordPress plugin | [`jsray-wp`](https://github.com/jsrayorg/jsray-wp) | Public beta |
+| VS Code extension | [`jsray-vscode`](https://github.com/jsrayorg/jsray-vscode) | Public beta |
+| Terminal CLI | [`jsray-terminal`](https://github.com/jsrayorg/jsray-terminal) | Public beta |
 | …and more | — | Community & official adapters welcome |
 
-Each is installable today, from GitHub rather than from its host's directory:
+Install any of them today:
 
 ```sh
 # Terminal CLI
diff --git a/README.zh-CN.md b/README.zh-CN.md
index 0424a79..2e9bbc3 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -90,12 +90,12 @@ JSRay 的目标是成为完整开源的代码渲染生态：一个轻量 Core 
 
 | 集成 | 仓库 | 状态 |
 |---|---|---|
-| WordPress 插件 | [`jsray-wp`](https://github.com/jsrayorg/jsray-wp) | 公开测试版 · 尚未上架 WordPress.org |
-| VS Code 扩展 | [`jsray-vscode`](https://github.com/jsrayorg/jsray-vscode) | 公开测试版 · 尚未上架 Marketplace |
-| 终端 CLI | [`jsray-terminal`](https://github.com/jsrayorg/jsray-terminal) | 公开测试版 · 尚未发布到 npm |
+| WordPress 插件 | [`jsray-wp`](https://github.com/jsrayorg/jsray-wp) | 公开测试版 |
+| VS Code 扩展 | [`jsray-vscode`](https://github.com/jsrayorg/jsray-vscode) | 公开测试版 |
+| 终端 CLI | [`jsray-terminal`](https://github.com/jsrayorg/jsray-terminal) | 公开测试版 |
 | …以及更多 | — | 欢迎官方与社区适配器 |
 
-三个集成现在都能装,只是要从 GitHub 拿,而不是各自平台的市场:
+三个集成现在都能装:
 
 ```sh
 # 终端 CLI
diff --git a/docs/development.md b/docs/development.md
index e1ba4b4..f8e15d3 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -402,16 +402,17 @@ deliberately deferred).
   contribution paths). Hard rule: a locked core must surface an explicit
   warning when a security-grade Core update ships — security fixes are
   never silently pinnable.
-- **jsray-vscode / jsray-terminal**: not published, and deliberately behind
-  while their features settle. Before either one goes public it needs what
-  `jsray-wp` gained on 2026-08-26/27, because all three drift the same way:
+- **jsray-vscode / jsray-terminal**: both public since 2026-09-03 and
+  2026-09-05, each with a release carrying an installable build. They now
+  carry what `jsray-wp` gained on 2026-08-26/27, because all three drift the
+  same way:
   `tools/sync-core-version.mjs` deriving the README Core badge instead of
   leaving it to whoever runs the sync; `check:versions` asserting the badges
   and the phase wording *in both directions* — the wrong phrase sitting beside
   the right one is what let "Internal test build · no public beta yet" survive
   the whole public beta; and the plugin version ladder (`0.0.1-beta →
-  0.0.2-beta`, no counter) rather than Core's. Both still carry Core
-  `0.0.1-beta.5` and READMEs pointing at `0.0.1-beta.1`.
+  0.0.2-beta`, no counter) rather than Core's. Both bundle Core
+  `0.0.2-beta.1`; syncing them to `0.0.2-beta.2` is the next step.
 
 - **Core**: minification is deliberately absent (zero-build); revisit at
   public beta.
diff --git a/docs/development.zh-CN.md b/docs/development.zh-CN.md
index 1434d11..9a27795 100644
--- a/docs/development.zh-CN.md
+++ b/docs/development.zh-CN.md
@@ -252,14 +252,14 @@ CI:每个仓库都有 GitHub Actions(Node 18/20/22 矩阵;Core 另验 `dist/` 
   管线)跑 32 条断言。
 - **终端**:`--bg`(整底色绘制)、分页器集成与 `--core <path>` 覆盖在路线图上。
 - **用户侧 Core 锁定**(路线图):平台原生的更新控制已允许用户拒绝某班列车(WP 手动更新、VS Code 按扩展关自动更新 + 装历史版本、npm 版本锁定)。插件内的"Core 更新策略"(跟随/锁定/自定义文件)对 WP 与终端可行,对 VS Code 预览不可行(贡献点路径静态)。硬规则:锁定状态下遇到安全级 Core 更新必须显式警告——安全修复不允许被静默锁死。
-- **jsray-vscode / jsray-terminal**:未发布,且在功能定型之前刻意落后。这两个
-  中任何一个要公开之前,都需要补上 `jsray-wp` 在 2026-08-26/27 得到的那套机制 ——
-  三个集成的失效方式是同一种:`tools/sync-core-version.mjs` 自己推导 README 的
+- **jsray-vscode / jsray-terminal**:分别于 2026-09-03 和 2026-09-05 公开,各自
+  的 Release 里都挂着可直接安装的构建。两者现已补齐 `jsray-wp` 在 2026-08-26/27
+  得到的那套机制 —— 三个集成的失效方式是同一种:`tools/sync-core-version.mjs` 自己推导 README 的
   Core 徽章,而不是留给"跑同步的那个人";`check:versions` **双向**校验徽章与阶段
   措辞 —— 正是"该出现的词在、不该出现的词也在"这一点,让「内部测试版 · 尚未发布
   公开测试版」在整个公开 beta 期间活了下来;以及插件的版本阶梯(`0.0.1-beta →
-  0.0.2-beta`,无计数器)而非 Core 的记法。两者目前仍内置 Core `0.0.1-beta.5`,
-  README 指向 `0.0.1-beta.1`。
+  0.0.2-beta`,无计数器)而非 Core 的记法。两者均内置 Core `0.0.2-beta.1`,
+  同步到 `0.0.2-beta.2` 是下一步。
 
 - **Core**:minify 刻意缺席(零构建);公开 beta 时再议。
 - **完全没有规则的字面量形式**(beta.5 审查时发现,因属"缺功能"而非"抢错范围"而推迟):
diff --git a/docs/projects.md b/docs/projects.md
index 8bacd38..1e2da2a 100644
--- a/docs/projects.md
+++ b/docs/projects.md
@@ -64,12 +64,12 @@ Core changes flow into plugin repositories by copying or packaging `dist/` asset
 | Repository | Intended channel | Licence | Available from today |
 |---|---|---|---|
 | `jsray` | npm `@jsray/core` | MIT | npm — `@jsray/core@0.0.2-beta.2` |
-| `jsray-wp` | WordPress.org plugin | GPLv2 or later | GitHub release zip · not on WordPress.org yet |
-| `jsray-terminal` | npm CLI | MIT | GitHub — `npm i -g github:jsrayorg/jsray-terminal` · not on npm yet |
-| `jsray-vscode` | VS Code Marketplace | MIT | GitHub release `.vsix` · not on the Marketplace yet |
+| `jsray-wp` | WordPress.org plugin | GPLv2 or later | GitHub release zip |
+| `jsray-terminal` | npm CLI | MIT | GitHub — `npm i -g github:jsrayorg/jsray-terminal` |
+| `jsray-vscode` | VS Code Marketplace | MIT | GitHub release `.vsix` |
 
-A public repository is not a listing. The last column is where a user can
-actually get the thing today; the second is where it is headed.
+The last column is where a user gets the thing today; the second is the channel
+each is headed for at `0.1.0`.
 
 Future platform repositories such as `jsray-react`, `jsray-astro`, or
 `jsray-mdx` if needed.
diff --git a/docs/projects.zh-CN.md b/docs/projects.zh-CN.md
index 6e7b20d..98e5c54 100644
--- a/docs/projects.zh-CN.md
+++ b/docs/projects.zh-CN.md
@@ -64,11 +64,11 @@ Core 的变更通过拷贝或打包 `dist/` 资产流向插件仓库。插件的
 | 仓库 | 交付形态 | 许可 | 状态 |
 |---|---|---|---|
 | `jsray` | npm `@jsray/core` | MIT | 已公开 |
-| `jsray-wp` | WordPress.org 插件 | GPLv2 or later | GitHub Release 的 zip · 尚未上架 WordPress.org |
-| `jsray-terminal` | npm CLI | MIT | GitHub —— `npm i -g github:jsrayorg/jsray-terminal` · 尚未发布到 npm |
-| `jsray-vscode` | VS Code Marketplace | MIT | GitHub Release 的 `.vsix` · 尚未上架 Marketplace |
+| `jsray-wp` | WordPress.org 插件 | GPLv2 or later | GitHub Release 的 zip |
+| `jsray-terminal` | npm CLI | MIT | GitHub —— `npm i -g github:jsrayorg/jsray-terminal` |
+| `jsray-vscode` | VS Code Marketplace | MIT | GitHub Release 的 `.vsix` |
 
-仓库公开不等于已上架。最后一列是**今天用户实际能从哪里拿到**,第二列是它将来要去的地方。
+最后一列是**今天用户从哪里拿到**,第二列是各自在 `0.1.0` 要去的渠道。
 
 未来按需增加的平台仓库，例如 `jsray-react`、`jsray-astro`、`jsray-mdx`。
 
diff --git a/tools/hooks/commit-msg b/tools/hooks/commit-msg
index 1fddf3f..f909341 100755
--- a/tools/hooks/commit-msg
+++ b/tools/hooks/commit-msg
@@ -33,9 +33,15 @@ case "$SUBJECT" in
 esac
 
 # A bare version number names the release without saying anything about it,
-# and it lands on every file the release touched.
-if printf '%s' "$SUBJECT" | grep -qE '^v?[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z]+)*$'; then
-  fail "a version number is not a description of the change"
+# and it lands on every file the release touched — which is where it is most
+# visible and least useful: GitHub prints the subject beside every path.
+#
+# One leading word does not rescue it. `Release 0.0.2-beta.2` slipped past the
+# bare-version pattern and did exactly what the bare version would have done,
+# on twelve files, permanently — a released commit cannot be reworded, because
+# the tag points at it and this project does not rewrite published history.
+if printf '%s' "$SUBJECT" | grep -qiE '^(release|releasing|bump|bumping|version|publish|publishing|tag)?[[:space:]]*v?[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z]+)*$'; then
+  fail "a version number is not a description of the change — say what the release brings"
 fi
 
 # The merge appends the pull request number. Typing it produces `(#6) (#6)`,

From b5e1f926a2743694a0312e2ffdb03ff48bcd13e4 Mon Sep 17 00:00:00 2001
From: Jie <jie@jsray.org>
Date: Sun, 6 Sep 2026 00:19:31 +0800
Subject: [PATCH 2/2] Carry the documentation corrections to npm and the site
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A registry page is frozen per version and the site is built from main, so
neither learns a correction except by releasing one. This release exists to
deliver the ones written since beta.2, and it changes no runtime behaviour:
dist/ differs only in the version string it reports.

It also closes the gap that produced the previous release's subject. The
commit-msg hook refused a bare version number but not a version with one word
in front, and it only ever ran on a machine that had configured
core.hooksPath — so CI now runs the same file against every commit a pull
request adds.
---
 .github/workflows/ci.yml | 31 +++++++++++++++++++++++++++++++
 CHANGELOG.md             | 29 +++++++++++++++++++++++++++++
 CODE_OF_CONDUCT.md       |  8 ++++++--
 README.md                |  8 ++++----
 README.zh-CN.md          |  8 ++++----
 SECURITY.md              |  3 ++-
 demo/index.html          |  2 +-
 demo/studio.html         |  2 +-
 dist/jsray.js            |  2 +-
 docs/projects.md         |  4 ++--
 docs/projects.zh-CN.md   |  2 +-
 docs/versioning.md       |  4 ++--
 docs/versioning.zh-CN.md |  4 ++--
 integrity.json           |  4 ++--
 package.json             |  2 +-
 src/jsray.js             |  2 +-
 tokens.json              |  2 +-
 types/jsray.d.ts         |  2 +-
 version.json             |  2 +-
 vocabulary.json          |  2 +-
 20 files changed, 94 insertions(+), 29 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 56cc4cd..98ea4a7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,6 +15,37 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  # tools/hooks/commit-msg only protects a machine that has run
+  # `git config core.hooksPath tools/hooks`. Nothing protected the pull
+  # request itself, so `Release 0.0.2-beta.2` reached main and printed itself
+  # beside a dozen files, permanently — the subject of a merged commit cannot
+  # be reworded once a tag points at it. The hook is the same file either way;
+  # this runs it where it cannot be skipped.
+  subjects:
+    name: Commit subjects
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Every commit the pull request adds, not just its tip.
+          fetch-depth: 0
+      - name: Check each subject against tools/hooks/commit-msg
+        run: |
+          set -e
+          base="${{ github.event.pull_request.base.sha }}"
+          head="${{ github.event.pull_request.head.sha }}"
+          failed=0
+          for sha in $(git rev-list --no-merges "$base..$head"); do
+            git log -1 --format=%B "$sha" > /tmp/msg
+            if ! sh tools/hooks/commit-msg /tmp/msg; then
+              echo "  ^ $(git log -1 --format='%h %s' "$sha")"
+              failed=1
+            fi
+          done
+          [ "$failed" = "0" ] || exit 1
+
   test:
     name: Test on Node ${{ matrix.node }}
     runs-on: ubuntu-latest
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4e28913..d73cf40 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,35 @@ versioning follows [SemVer](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.0.2-beta.3] — 2026-09-06
+
+Documentation and the guards around it. No runtime change: `dist/` differs from
+beta.2 only in the version string it reports.
+
+### Fixed
+- **The Code of Conduct says where to report.** Its enforcement section invited
+  reports "to the community leaders responsible for enforcement" and named no
+  address, which is the same as having no channel. It now names
+  `support@jsray.org`, the address SECURITY.md already used.
+- **A release subject that is a version and one word is rejected.**
+  `tools/hooks/commit-msg` already refused a bare `0.0.1-beta.3`, with a
+  comment about how a version number lands on every file the release touched.
+  `Release 0.0.2-beta.2` walked past that pattern and did exactly what it
+  describes, on twelve files. The pattern now covers a leading
+  release/bump/publish/tag word.
+- **The subject check runs on pull requests.** The hook only protects a
+  machine that has configured `core.hooksPath`; CI now runs the same file
+  against every commit a pull request adds, where it cannot be skipped.
+- **The roadmap entry for jsray-vscode and jsray-terminal.** It described both
+  as unpublished, bundling Core `0.0.1-beta.5`, with READMEs pointing at
+  `0.0.1-beta.1`. Both are public, both bundle `0.0.2-beta.1`, and both now
+  derive and check the badges it said they needed first.
+
+### Changed
+- **Availability is stated, not contrasted.** The integrations table and
+  `docs/projects.md` paired each channel with the one it is not on yet. They
+  now say where each integration is installed from.
+
 ## [0.0.2-beta.2] — 2026-09-05
 
 Ships the portable renderer, and corrects what the registry and the site were
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
index b341bb4..751ec9a 100644
--- a/CODE_OF_CONDUCT.md
+++ b/CODE_OF_CONDUCT.md
@@ -30,8 +30,12 @@ Examples of unacceptable behavior:
 ## Enforcement
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported to the community leaders responsible for enforcement. All complaints
-will be reviewed and investigated promptly and fairly.
+reported to <support@jsray.org>. All complaints will be reviewed and
+investigated promptly and fairly, and the reporter's identity is not shared
+outside the people handling the report.
+
+Saying complaints "may be reported" without saying where is the same as having
+no channel: this document named none until 0.0.2-beta.3.
 
 ## Attribution
 
diff --git a/README.md b/README.md
index 0d2d11a..b9ccb3d 100644
--- a/README.md
+++ b/README.md
@@ -9,7 +9,7 @@
 
 [![npm](https://img.shields.io/npm/v/@jsray/core/beta?label=npm)](https://www.npmjs.com/package/@jsray/core)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
-[![Version](https://img.shields.io/badge/version-0.0.2--beta.2-lightgrey)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-0.0.2--beta.3-lightgrey)](CHANGELOG.md)
 [![Channel](https://img.shields.io/badge/channel-beta-blue)](docs/versioning.md)
 [![Zero deps](https://img.shields.io/badge/dependencies-0-success)](package.json)
 [![Size](https://img.shields.io/badge/dist-core%20js%20%2B%20css-lightgrey)](dist/)
@@ -46,7 +46,7 @@ Or drop it into a page with no build step at all:
 watching, pin the version instead** — every release is frozen at its own path:
 
 ```html
-<script src="https://jsray.org/v/0.0.2-beta.2/jsray.js"></script>
+<script src="https://jsray.org/v/0.0.2-beta.3/jsray.js"></script>
 ```
 
 ### Verifying what you loaded
@@ -56,7 +56,7 @@ A pinned URL says which release you asked for, not which bytes you got. Add a
 hash and the browser refuses to run the file if it is not the one published:
 
 ```html
-<script src="https://jsray.org/v/0.0.2-beta.2/jsray.js"
+<script src="https://jsray.org/v/0.0.2-beta.3/jsray.js"
         integrity="sha256-…"
         crossorigin="anonymous"></script>
 ```
@@ -64,7 +64,7 @@ hash and the browser refuses to run the file if it is not the one published:
 The hashes live next to the files they describe, in the same format SRI uses:
 
 ```
-https://jsray.org/v/0.0.2-beta.2/integrity.json
+https://jsray.org/v/0.0.2-beta.3/integrity.json
 ```
 
 `crossorigin="anonymous"` is required, not optional — SRI on a cross-origin
diff --git a/README.zh-CN.md b/README.zh-CN.md
index 2e9bbc3..4f41658 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -9,7 +9,7 @@
 
 [![npm](https://img.shields.io/npm/v/@jsray/core/beta?label=npm)](https://www.npmjs.com/package/@jsray/core)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
-[![Version](https://img.shields.io/badge/version-0.0.2--beta.2-lightgrey)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-0.0.2--beta.3-lightgrey)](CHANGELOG.md)
 [![Channel](https://img.shields.io/badge/channel-beta-blue)](docs/versioning.md)
 [![Zero deps](https://img.shields.io/badge/dependencies-0-success)](package.json)
 [![Size](https://img.shields.io/badge/dist-core%20js%20%2B%20css-lightgrey)](dist/)
@@ -45,7 +45,7 @@ JSRay.highlight('const x = 42;', 'js');
 `jsray.org/dist/` 始终提供当前发布版本。**线上站点如果你不会持续盯着,请改用锁定版本的地址** —— 每个发布版本都固化在自己的路径下,永不变动:
 
 ```html
-<script src="https://jsray.org/v/0.0.2-beta.2/jsray.js"></script>
+<script src="https://jsray.org/v/0.0.2-beta.3/jsray.js"></script>
 ```
 
 ### 校验你加载到的东西
@@ -55,7 +55,7 @@ JSRay.highlight('const x = 42;', 'js');
 哈希,浏览器在文件与发布内容不符时会直接拒绝执行:
 
 ```html
-<script src="https://jsray.org/v/0.0.2-beta.2/jsray.js"
+<script src="https://jsray.org/v/0.0.2-beta.3/jsray.js"
         integrity="sha256-…"
         crossorigin="anonymous"></script>
 ```
@@ -63,7 +63,7 @@ JSRay.highlight('const x = 42;', 'js');
 哈希就放在它所描述的文件旁边,格式与 SRI 完全一致:
 
 ```
-https://jsray.org/v/0.0.2-beta.2/integrity.json
+https://jsray.org/v/0.0.2-beta.3/integrity.json
 ```
 
 `crossorigin="anonymous"` 是必需的,不是可选:跨源脚本的 SRI 只有在加载走
diff --git a/SECURITY.md b/SECURITY.md
index 92a44f0..fa08a27 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -43,7 +43,8 @@ one.
 
 | Version | Security updates |
 |---|---|
-| 0.0.2-beta.2 | ✅ Current public beta |
+| 0.0.2-beta.3 | ✅ Current public beta |
+| 0.0.2-beta.1 – beta.2 | ❌ Superseded — upgrade to the current beta |
 | Earlier betas | ❌ Superseded — upgrade to the current beta |
 | 0.0.1-internal.∗ | ❌ Superseded by the public beta |
 | Stable | Not yet released |
diff --git a/demo/index.html b/demo/index.html
index 7fde8b5..fef8ff4 100644
--- a/demo/index.html
+++ b/demo/index.html
@@ -357,7 +357,7 @@ <h3>Project</h3>
   </div>
 
   <div class="site-footer__base">
-    <p>© 2026 JSRay · MIT · <code data-jsray-version>0.0.2-beta.2</code></p>
+    <p>© 2026 JSRay · MIT · <code data-jsray-version>0.0.2-beta.3</code></p>
     <p>Made by Jie</p>
   </div>
 </footer>
diff --git a/demo/studio.html b/demo/studio.html
index 56f7734..5a0faf0 100644
--- a/demo/studio.html
+++ b/demo/studio.html
@@ -112,7 +112,7 @@ <h3>Project</h3>
   </div>
 
   <div class="site-footer__base">
-    <p>© 2026 JSRay · MIT · <code data-jsray-version>0.0.2-beta.2</code></p>
+    <p>© 2026 JSRay · MIT · <code data-jsray-version>0.0.2-beta.3</code></p>
     <p>Made by Jie</p>
   </div>
 </footer>
diff --git a/dist/jsray.js b/dist/jsray.js
index d795c05..985f414 100644
--- a/dist/jsray.js
+++ b/dist/jsray.js
@@ -1865,7 +1865,7 @@
      * Runtime version, for shell/core compatibility negotiation.
      * Must match version.json — tools/check-versions.mjs asserts it.
      */
-    version: '0.0.2-beta.2',
+    version: '0.0.2-beta.3',
     languages: G,
     normalizeLanguage,
     detectLanguage,
diff --git a/docs/projects.md b/docs/projects.md
index 1e2da2a..11f1c3c 100644
--- a/docs/projects.md
+++ b/docs/projects.md
@@ -63,7 +63,7 @@ Core changes flow into plugin repositories by copying or packaging `dist/` asset
 
 | Repository | Intended channel | Licence | Available from today |
 |---|---|---|---|
-| `jsray` | npm `@jsray/core` | MIT | npm — `@jsray/core@0.0.2-beta.2` |
+| `jsray` | npm `@jsray/core` | MIT | npm — `@jsray/core@0.0.2-beta.3` |
 | `jsray-wp` | WordPress.org plugin | GPLv2 or later | GitHub release zip |
 | `jsray-terminal` | npm CLI | MIT | GitHub — `npm i -g github:jsrayorg/jsray-terminal` |
 | `jsray-vscode` | VS Code Marketplace | MIT | GitHub release `.vsix` |
@@ -94,7 +94,7 @@ The public website keeps the brand concentrated under `jsray.org`:
   moves on every release, which is right for the demo and wrong for a site
   nobody is watching.
 - `https://jsray.org/v/<version>/`: the same files frozen per release
-  (`jsray.org/v/0.0.2-beta.2/jsray.js`). A page that pins here keeps rendering
+  (`jsray.org/v/0.0.2-beta.3/jsray.js`). A page that pins here keeps rendering
   the way it did the day it was written.
 
 `tools/build-site.sh` emits both. Cloudflare replaces the whole asset bundle on
diff --git a/docs/projects.zh-CN.md b/docs/projects.zh-CN.md
index 98e5c54..24fbfb0 100644
--- a/docs/projects.zh-CN.md
+++ b/docs/projects.zh-CN.md
@@ -89,7 +89,7 @@ GPLv2 or later,因为 WordPress.org 的第一条指南接受任何 GPL 兼容许
   (`jsray.org/dist/jsray.js`、`jsray.org/dist/themes/<name>.css`)。这个路径每次
   发版都会变 —— 对演示页是对的，对没人盯着的站点是错的。
 - `https://jsray.org/v/<version>/`：同样的文件按版本固化
-  (`jsray.org/v/0.0.2-beta.2/jsray.js`)。锁定到这里的页面，今天怎么渲染，
+  (`jsray.org/v/0.0.2-beta.3/jsray.js`)。锁定到这里的页面，今天怎么渲染，
   以后还怎么渲染。
 
 `tools/build-site.sh` 两者都生成。Cloudflare 每次部署都会整体替换资产包，因此
diff --git a/docs/versioning.md b/docs/versioning.md
index a49a553..8c6123c 100644
--- a/docs/versioning.md
+++ b/docs/versioning.md
@@ -4,7 +4,7 @@
 
 JSRay Core uses single-project versioning. Platform plugins keep their own version files in their own repositories.
 
-Current version: `0.0.2-beta.2`
+Current version: `0.0.2-beta.3`
 Current channel: `beta`
 Public beta released: yes
 
@@ -33,7 +33,7 @@ The mechanics follow from that: `check:versions` requires the counter here, and
 `0.0.2`.
 
 ```
-0.0.1-beta.1 … 0.0.1-beta.5 → 0.0.2-beta.1 → 0.0.2-beta.2 → 0.0.3-beta.1 → … → 0.1.0
+0.0.1-beta.1 … 0.0.1-beta.5 → 0.0.2-beta.1 … 0.0.2-beta.3 → 0.0.3-beta.1 → … → 0.1.0
 ```
 
 The `0.0.1` line closed at beta.5. `0.1.0` is where the beta label comes off,
diff --git a/docs/versioning.zh-CN.md b/docs/versioning.zh-CN.md
index d382a4f..f62b2fb 100644
--- a/docs/versioning.zh-CN.md
+++ b/docs/versioning.zh-CN.md
@@ -4,7 +4,7 @@
 
 JSRay Core 采用单项目版本号。平台插件在各自仓库里维护自己的版本文件。
 
-当前版本:`0.0.2-beta.2`
+当前版本:`0.0.2-beta.3`
 当前通道:`beta`
 公开测试版已发布:是
 
@@ -30,7 +30,7 @@ JSRay Core 是独立的 JavaScript 原生代码渲染内核。平台插件(包
 `version_compare()` —— 字符串排序会把 `0.0.10` 排在 `0.0.2` 前面。
 
 ```
-0.0.1-beta.1 … 0.0.1-beta.5 → 0.0.2-beta.1 → 0.0.2-beta.2 → 0.0.3-beta.1 → …… → 0.1.0
+0.0.1-beta.1 … 0.0.1-beta.5 → 0.0.2-beta.1 … 0.0.2-beta.3 → 0.0.3-beta.1 → …… → 0.1.0
 ```
 
 `0.0.1` 这条线在 beta.5 结束。`0.1.0` 才是脱掉 beta 标签的地方,因此 `0.0.1`
diff --git a/integrity.json b/integrity.json
index d46d0d0..dd3fe03 100644
--- a/integrity.json
+++ b/integrity.json
@@ -1,10 +1,10 @@
 {
   "project": "jsray",
-  "version": "0.0.2-beta.2",
+  "version": "0.0.2-beta.3",
   "algorithm": "sha256",
   "note": "Base64 SHA-256 digests of the released Core assets. Integrations copy the relevant digest at sync time and verify their bundled snapshot against it.",
   "files": {
-    "dist/jsray.js": "sha256-FAodgz8GT5uEr//Gd7lY6pbSBtbIZzzYHIitDfEqkVg=",
+    "dist/jsray.js": "sha256-yYHHNdRaH/YE1ohX6y8lwRO3IYpGp4Fn/BMhROBxtGk=",
     "dist/jsray.css": "sha256-6Fuva+aZwCcmltNi2oN+1yWIJoKE+1rLpUxZvD9iutc=",
     "dist/themes/aurora.css": "sha256-S8X+R8XZNC8WRdHOen839zMkPxVFol6PPTrpZibbeJA=",
     "dist/themes/default.css": "sha256-vENOigRjwn1hW6wPjdM4tbZ58Ja44FMsa+akavPiMSI=",
diff --git a/package.json b/package.json
index 623ec14..9bd097f 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@jsray/core",
-  "version": "0.0.2-beta.2",
+  "version": "0.0.2-beta.3",
   "description": "JavaScript-native code rendering kernel with 23-class token semantics and pluggable themes.",
   "author": "Jie <jie@jsray.org>",
   "license": "MIT",
diff --git a/src/jsray.js b/src/jsray.js
index d795c05..985f414 100644
--- a/src/jsray.js
+++ b/src/jsray.js
@@ -1865,7 +1865,7 @@
      * Runtime version, for shell/core compatibility negotiation.
      * Must match version.json — tools/check-versions.mjs asserts it.
      */
-    version: '0.0.2-beta.2',
+    version: '0.0.2-beta.3',
     languages: G,
     normalizeLanguage,
     detectLanguage,
diff --git a/tokens.json b/tokens.json
index b0b2cd1..e01a12a 100644
--- a/tokens.json
+++ b/tokens.json
@@ -1,7 +1,7 @@
 {
   "name": "JSRay",
   "author": "Jie",
-  "version": "0.0.2-beta.2",
+  "version": "0.0.2-beta.3",
   "description": "Default palette · 23 token classes · 6 identifier families visually separated",
   "philosophy": {
     "identifier-families": {
diff --git a/types/jsray.d.ts b/types/jsray.d.ts
index 08c9c4c..efdddfb 100644
--- a/types/jsray.d.ts
+++ b/types/jsray.d.ts
@@ -24,7 +24,7 @@ declare namespace JSRay {
   /** A renderer-agnostic stream produced by `tokenize`. */
   type TokenStream = Array<string | Token>;
 
-  /** Runtime version string, matches version.json (e.g. "0.0.2-beta.2"). */
+  /** Runtime version string, matches version.json (e.g. "0.0.2-beta.3"). */
   const version: string;
 
   /** Grammars for every registered language, keyed by name and by alias. */
diff --git a/version.json b/version.json
index 725543d..d3d62bb 100644
--- a/version.json
+++ b/version.json
@@ -1,7 +1,7 @@
 {
   "project": "jsray",
   "name": "JSRay Core",
-  "version": "0.0.2-beta.2",
+  "version": "0.0.2-beta.3",
   "channel": "beta",
   "publicBetaReleased": true,
   "notes": "Standalone JavaScript-native code rendering kernel. JSRay is planned as a fully open-source ecosystem with Core, official integrations, and community integrations."
diff --git a/vocabulary.json b/vocabulary.json
index 7457665..e7c3976 100644
--- a/vocabulary.json
+++ b/vocabulary.json
@@ -1,6 +1,6 @@
 {
   "project": "jsray",
-  "version": "0.0.2-beta.2",
+  "version": "0.0.2-beta.3",
   "description": "Machine-readable token vocabulary: the three-name lock-step every JSRay surface shares. A palette key maps to one CSS custom property (--jr-<suffix>) and one runtime class (tk-<suffix>).",
   "tokens": {
     "keyword": "keyword",