Record council backfill rules in the interaction contract

docs/architecture/10-interaction-and-feedback.md

@@ -142,6 +142,28 @@ lives in [04 · Routing & Global Events](04-routing-and-events.md).
 _(Consulted via `/council` → WAI-ARIA APG `windowsplitter`. This bullet is the contract;
 cite it, not the APG file.)_
 
+**Resolved — segmented (single-select) controls.** A "pick one of N" control (fit modes,
+the Draft/Published view) is a **radio group**, never a row of `aria-pressed` toggles
+(those model N independent booleans). Use the shared `SegmentedControl`: `role="radiogroup"`
+
+- `role="radio"`/`aria-checked`, a **roving tabindex** (only the selected option is a tab
+  stop), and Arrow/Home/End to move-and-select (APG → Radio Group). One widget so the keyboard
+  model is defined once. _(Tabs were a candidate for Draft/Published; we chose radio group for
+  consistency with the other segmented controls and to avoid tabpanel wiring to Monaco.)_
+
+**Resolved — selectable lists.** A row the user selects must be a real `<button>` (or a
+proper option), not a click handler on `<li>` (mouse-only, no keyboard, no role). It is
+**not** an APG `listbox` when a row contains its own controls (e.g. a delete button) — APG
+forbids interactive children in a listbox. Mark the active row with `aria-current="true"`
+**only on that row** (don't emit `aria-current="false"` everywhere). Arrow-key roving
+_between_ rows is a later enhancement; button-per-row tab stops are the acceptable baseline.
+
+**Resolved — one live region per shared message.** When the same error feeds two surfaces
+(the §1 "one producer, two subscribers" case — render errors via `PreviewStore`), exactly
+**one** subscriber is the live region (`role="alert"` on the editor, where focus is); the
+other shows the text visually with no live role. Two live regions would announce the same
+message twice.
+
 ## 6. Motion & accessibility as default
 
 Not features to add later — the baseline every surface is built on.
@@ -153,6 +175,14 @@ Not features to add later — the baseline every surface is built on.
   draft dot has a `title`/`aria-label`.
 - **Every control is labelled.** Icon-only buttons, toggles, and fields carry accessible
   names so assistive tech can announce them.
+- **A binary toggle exposes its state, not just its action.** A theme/on-off control is a
+  toggle button (`aria-pressed`) or `switch` (`aria-checked`) with a **stable** name, so AT
+  announces the current state at parity with the icon a sighted user sees — not just "switch
+  to dark" (APG → Button / Switch). The `ThemeToggle` uses `aria-pressed` + a stable label.
+- **The shell has a heading and a bypass.** The app exposes an `<h1>` (not a styled `<span>`)
+  so there's a heading outline, and a **skip link** as the first focusable element so
+  keyboard users can bypass the header into `#main` (WCAG 2.4.1 / GOV.UK). Same-type
+  landmarks carry distinct accessible names.
 - **Contrast holds in every theme.** A theme that can't meet legible contrast in part of
   the UI is not complete (spec §10 / §07).