From bbfd44eed29a858c1054c60b9fe5407d49de0c64 Mon Sep 17 00:00:00 2001
From: Stefan Hagen <stefan@hagen.link>
Date: Sun, 24 Nov 2024 00:09:48 +0100
Subject: [PATCH] Reworked boilerplate and spike for pdf-ication (WIP)

Signed-off-by: Stefan Hagen <stefan@hagen.link>
---
 csaf_2.1/prose/edit/Makefile                  |  11 +-
 csaf_2.1/prose/edit/bin/lapidify.py           | 646 +++++++++++++++
 csaf_2.1/prose/edit/etc/bind.txt              |  12 +-
 .../edit/etc/section-display-to-label.json    |  80 +-
 .../edit/etc/section-label-to-display.json    |  84 +-
 csaf_2.1/prose/edit/src/acknowledgements.md   |   2 +-
 .../prose/edit/src/additional-conventions.md  |   9 +-
 csaf_2.1/prose/edit/src/conformance.md        |  16 +-
 csaf_2.1/prose/edit/src/distributing.md       |  56 +-
 csaf_2.1/prose/edit/src/guidance-on-size.md   | 763 ++++++++++--------
 ...uction-01-changes-from-earlier-versions.md |   3 +
 .../edit/src/introduction-01-ipr-policy.md    |   7 -
 ...ry.md => introduction-02-glossary-data.md} |   0
 .../edit/src/introduction-02-glossary.md      |   3 +
 .../edit/src/introduction-02-terminology.md   |   7 -
 ...troduction-05-typographical-conventions.md |  10 +-
 csaf_2.1/prose/edit/src/notices.md            |  29 +
 csaf_2.1/prose/edit/src/profiles.md           |   5 +
 csaf_2.1/prose/edit/src/references.md         | 171 ++++
 csaf_2.1/prose/edit/src/revision-history.md   |   2 +-
 .../safety-security-and-data-protection.md    |   8 +
 ...a-elements-01-defs-03-full-product-name.md |  67 +-
 .../schema-elements-01-defs-04-language.md    |   9 +-
 .../src/schema-elements-01-defs-11-version.md |  20 +-
 ...chema-elements-02-props-03-product-tree.md |   5 +-
 ...ma-elements-02-props-04-vulnerabilities.md |  21 +-
 ...-24-multiple-definition-in-involvements.md |   6 +-
 ...-25-multiple-use-of-same-hash-algorithm.md |  18 +-
 .../src/tests-01-mndtr-27-profile-tests.md    |  18 +-
 csaf_2.1/prose/edit/src/tests-02-optional.md  |  40 +-
 .../prose/edit/src/tests-03-informative.md    |  54 +-
 31 files changed, 1651 insertions(+), 531 deletions(-)
 create mode 100755 csaf_2.1/prose/edit/bin/lapidify.py
 create mode 100644 csaf_2.1/prose/edit/src/introduction-01-changes-from-earlier-versions.md
 delete mode 100644 csaf_2.1/prose/edit/src/introduction-01-ipr-policy.md
 rename csaf_2.1/prose/edit/src/{introduction-02-terminology-glossary.md => introduction-02-glossary-data.md} (100%)
 create mode 100644 csaf_2.1/prose/edit/src/introduction-02-glossary.md
 delete mode 100644 csaf_2.1/prose/edit/src/introduction-02-terminology.md
 create mode 100644 csaf_2.1/prose/edit/src/notices.md
 create mode 100644 csaf_2.1/prose/edit/src/references.md

diff --git a/csaf_2.1/prose/edit/Makefile b/csaf_2.1/prose/edit/Makefile
index c3b531d28..1965b7297 100644
--- a/csaf_2.1/prose/edit/Makefile
+++ b/csaf_2.1/prose/edit/Makefile
@@ -1,5 +1,5 @@
 .DEFAULT_GOAL := build
-.PHONY: build
+.PHONY: build pdf
 build:
 	bin/volatile.py
 	cp -a build/tmp.md ../share/csaf-v2.1-draft.md
@@ -7,3 +7,12 @@ build:
 	bin/toccata.py
 	timeout 2 tidy -config etc/tidy-config.txt build/injected.html -ashtml | sed 's/<!\[CDATA\[//g; s/\]\]>//g;' > ../share/csaf-v2.1-draft.html
 	git status
+
+pdf:
+	bin/lapidify.py
+	mkdir -p build/render/pdf
+	cp -a build/bookmatter.tex.in build/render/pdf/
+	cp -a build/driver.tex.in build/render/pdf/
+	cp -a build/metadata.tex.in build/render/pdf/
+	cp -a build/setup.tex.in build/render/pdf/
+	cd build/render/pdf && liitos render ../../ -t csaf -f pdf -p -l "etiketti -e" && open this.pdf && cd -
diff --git a/csaf_2.1/prose/edit/bin/lapidify.py b/csaf_2.1/prose/edit/bin/lapidify.py
new file mode 100755
index 000000000..d8a6b91c8
--- /dev/null
+++ b/csaf_2.1/prose/edit/bin/lapidify.py
@@ -0,0 +1,646 @@
+#! /usr/bin/env python
+"""Lapidify - turning markdown to stone (PDF)."""
+import json
+import pathlib
+import re
+import os
+import sys
+from typing import Union
+
+import yaml
+
+ENCODING = 'utf-8'
+NL = '\n'
+CB_END = '}'
+COLON = ':'
+DASH = '-'
+DOT = '.'
+FULL_STOP = '.'
+HASH = '#'
+PARA = '§'
+SEMI = ';'
+SPACE = ' '
+TM = '™'
+
+# Optionally dump the look-up tables (LUT)s for section display and label:
+DUMP_LUT = bool(os.getenv('DUMP_LUT', ''))
+
+# Configuration and runtime parameter candidates:
+BINDER_AT = pathlib.Path('etc') / 'bind.txt'
+SOURCE_AT = pathlib.Path('src')
+BUILD_AT = pathlib.Path('build')
+SECTION_DISPLAY_TO_LABEL_AT = pathlib.Path('etc') / 'section-display-to-label.json'
+SECTION_LABEL_TO_DISPLAY_AT = pathlib.Path('etc') / 'section-label-to-display.json'
+EG_GLOBAL_TO_LABEL_AT = pathlib.Path('etc') / 'example-global-to-local.json'
+EG_LABEL_TO_GLOBAL_AT = pathlib.Path('etc') / 'example-local-to-global.json'
+
+# Parsers and magical literals:
+IS_CITE_REF = 'cite'
+CITE_REF_DETECT = re.compile(r'\[(?P<text>cite)\]\(#(?P<label>[^)]+)\)')  # [cite](#label) pattern
+IS_EG_REF = 'eg'
+EG_REF_DETECT = re.compile(r'\[(?P<text>eg)\]\(#(?P<label>[^)]+)\)')  # [eg](#label) pattern
+IS_SEC_REF = 'sec'
+SEC_REF_DETECT = re.compile(r'\[(?P<text>sec)\]\(#(?P<label>[^)1-9]+)\)')  # [sec](#label) pattern
+MD_REF_DETECT = re.compile(r'\[(?P<text>[^]]+)\]\(#(?P<target>[^)]+)\)')  # [ref](#anylabel) pattern
+
+# Detecting code block references with label values
+# e.g. ' #  ((#run-object)).'
+SEC_LABEL_BRACKET_CB_DETECT = re.compile(r'\ +#\ +[^(]+\((?P<label>\(#(?P<value>[0-9a-z-]+)\))\)\.')
+# e.g. ' #  (#run-object).'
+SEC_LABEL_FREE_CB_DETECT = re.compile(r'\ +#\ +[^(]+(?P<label>\(#(?P<value>[0-9a-z-]+)\))\.')
+
+# Reverse detection patterns for documentation purposes
+# e.g. ' # A run object (§3.14).' or ' #  (§3.1.2).'
+SEC_DISP_BRACKET_CB_DETECT = re.compile(r'\ +#\ +[^(]+\((?P<disp>§[0-9.]+)\)\.')
+SEC_DISP_FREE_CB_DETECT = re.compile(r'\ +#\ +[^(]+(?P<disp>§[0-9.]+)\.')  # e.g. ' # See §3.14.14.'
+
+# Specific tokens:
+HC_BEG = '<!--'
+HC_END = '-->'
+YAML_SEP = '---'
+TOK_TOC = '(#$thing$)'  # Transform phase ToC label string template replacing $thing$ with the old value
+TOK_SEC = "<a id='$thing$'></a>"  # Transform phase section title label string template ($thing$ -> old value)
+TOK_LAB = '{#'
+H = '#'
+YAML_X_SEP = DASH * 7
+TOC_HEADER = f"""{YAML_X_SEP}
+
+# Table of Contents
+"""
+CLEAN_MD_START = '# Introduction'
+LOGO_URL = 'https://docs.oasis-open.org/templates/OASISLogo-v3.0.png'
+LOGO_LOCAL_PATH = 'images/OASISLogo-v3.0.png'
+TOP_LOGO_LINE = f'![OASIS Logo]({LOGO_URL})'
+
+SEC_NO_TOC_POSTFIX = '{.unnumbered .unlisted}'
+
+SECTION_DISPLAY_TO_LABEL = {}
+SECTION_LABEL_TO_DISPLAY: dict[str, str] = {}
+SEC_LABEL_TEXT = {}  # Mapping section labels to the display text
+
+TOC_TEMPLATE = {
+    1: '$sec_cnt_disp$ [$text$](#$label$)  ',
+    2: '\t$sec_cnt_disp$ [$text$](#$label$)  ',
+    3: '\t\t$sec_cnt_disp$ [$text$](#$label$)  ',
+    4: '\t\t\t$sec_cnt_disp$ [$text$](#$label$)  ',
+    5: '\t\t\t\t$sec_cnt_disp$ [$text$](#$label$)  ',
+}
+
+TOK_EG = "<a id='$thing$'></a>"  # Transform phase example title label string template ($thing$ -> old value)
+EG_LABEL_TEXT: dict[str, str] = {}  # Mapping example labels to the display text
+
+# This value leads to empty line needed on GitHub to respect the new line for non-numerically starting lines
+TOC_VERTICAL_SPACER = ''
+
+# Data interface robustness hacks:
+CHILDREN = 'children'
+ENUMERATE = 'enumerate'
+LABEL = 'label'
+TOC = 'toc'
+
+CS_OF_SLOT: list[Union[str, None]] = []
+
+CITE_COSMETICS_TEMPLATE = '**\\[**<span id="$label$" class="anchor"></span>**$code$\\]** $text$'
+CITATION_SOURCES = ('introduction-03-normative-references.md', 'introduction-04-informative-references.md')
+GLOSSARY_SOURCES = ('introduction-02-terminology-glossary.md',)
+
+# Type declarations:
+META_TOC_TYPE = dict[str, dict[str, Union[bool, str, list[dict[str, str]]]]]
+
+
+def load_binder(binder_at: Union[str, pathlib.Path]) -> list[pathlib.Path]:
+    """Load the linear binder text file into a list of file paths."""
+    with open(binder_at, 'rt', encoding=ENCODING) as resource:
+        return [pathlib.Path(entry.strip()) for entry in resource.readlines() if entry.strip() and entry.strip() != 'frontmatter.md']
+
+
+def end_of_toc_in(text: str) -> bool:
+    """Detect the end of the table of contents."""
+    return text.startswith('#') and ' Introduction' in text
+
+
+def detect_meta(text_lines: list[str]) -> tuple[META_TOC_TYPE, list[str]]:
+    """Extract any YAML data from top, remove used lines from text lines, and yield meta as well as remaining lines."""
+    meta_lines = []
+    if text_lines[0].startswith(HC_BEG) and text_lines[1].startswith(YAML_SEP):
+        for line in text_lines[2:]:
+            if line.startswith(YAML_SEP):
+                break
+            meta_lines.append(line)
+
+    from_here = len(meta_lines) + 4
+    if from_here > 4:
+        text_lines = text_lines[from_here:]
+
+    return yaml.safe_load(''.join(meta_lines)) if meta_lines else {}, text_lines
+
+
+def load_document(path: Union[str, pathlib.Path]) -> tuple[META_TOC_TYPE, list[str]]:
+    """Load the text file into a list of strings and harvest any YAML meta info (if present remove the lines)."""
+    with open(path, 'rt', encoding=ENCODING) as resource:
+        return detect_meta(resource.readlines())
+
+
+def dump_assembly(text_lines: list[str], to_path: Union[str, pathlib.Path]) -> None:
+    """Dump the lines of text into the text file at path."""
+    with open(to_path, 'wt', encoding=ENCODING) as resource:
+        resource.write(''.join(text_lines))
+
+
+def label_derive_from(text: str) -> str:
+    """Transform text to kebab style conventional label assuming no newlines present."""
+    good_nuff = (' ', '.', ',', ';', '?', '!', '_', '(', ')', '[', ']', '{', '}', '<', '>', '\\', '/', '$', ':')
+    slug = text.strip()
+    for bad in good_nuff:
+        slug = slug.replace(bad, '-')
+    parts = slug.split('-')
+    slug = '-'.join(s for s in parts if s and s != '-')
+    return slug.lower()
+
+
+def label_in(text: str) -> bool:
+    """Detect if the text line contains a label."""
+    return '](#' in text
+
+
+def example_local_number(text: str) -> int:
+    """Harvest integer local number of example or zero (0) if failed."""
+    ls_text = text.lstrip()
+    if ls_text.startswith('*Example ') or ls_text.startswith('*Examples '):
+        rest = ls_text.split(SPACE, 1)[1]
+        de_colon = rest.split(COLON, 1)[0]
+        number = de_colon.split(SPACE, 1)[0] if SPACE in de_colon else de_colon
+        try:
+            return int(number)
+        except ValueError:
+            pass
+    return 0
+
+
+def example_in(text: str) -> bool:
+    """Detect if the text line contains a magic example token."""
+    return example_local_number(text) > 0
+
+
+def code_block_label_in(text: str) -> bool:
+    """Detect if the text line contains a code block section label."""
+    return '(#' in text and ' # ' in text
+
+
+def load_label_to_display_lut(path: Union[str, pathlib.Path] = SECTION_LABEL_TO_DISPLAY_AT) -> dict[str, str]:
+    """Load the LUT for section labels -> display."""
+    with pathlib.Path(path).open('rt', encoding=ENCODING) as handle:
+        return json.load(handle)
+
+
+def load_display_to_label_lut(path: Union[str, pathlib.Path] = SECTION_DISPLAY_TO_LABEL_AT) -> dict[str, str]:
+    """Load the LUT for section display -> labels."""
+    with pathlib.Path(path).open('rt', encoding=ENCODING) as handle:
+        return json.load(handle)
+
+
+def load_eg_label_to_global_lut(path: Union[str, pathlib.Path] = EG_LABEL_TO_GLOBAL_AT) -> dict[str, str]:
+    """Load the LUT for example labels -> global."""
+    with pathlib.Path(path).open('rt', encoding=ENCODING) as handle:
+        return json.load(handle)
+
+
+def load_eg_global_to_label_lut(path: Union[str, pathlib.Path] = EG_GLOBAL_TO_LABEL_AT) -> dict[str, str]:
+    """Load the LUT for example global -> labels."""
+    with pathlib.Path(path).open('rt', encoding=ENCODING) as handle:
+        return json.load(handle)
+
+
+def main(argv: list[str]) -> int:
+    """Drive the assembly."""
+
+    bind_seq_path = pathlib.Path(argv[0]) if argv else BINDER_AT
+    binder = load_binder(bind_seq_path)
+    for resource in binder:
+        if not (SOURCE_AT / resource).is_file():
+            print(f'Problem reading {resource}')
+            return 1
+
+    display_from = load_label_to_display_lut()
+    eg_global_from = load_eg_label_to_global_lut()
+
+    lines: list[str] = []
+    meta_hooks = {}
+    first_meta_slot = None
+    for resource in binder:
+        meta, part_lines = load_document(SOURCE_AT / resource)
+        if part_lines[-1] != NL:
+            part_lines.append(NL)
+        if meta:
+            meta_hooks[len(lines)] = meta
+            meta_hooks[len(lines) + len(part_lines) - 1] = {}
+            if first_meta_slot is None:
+                first_meta_slot = len(lines) + len(part_lines) - 1
+
+        if resource.name in CITATION_SOURCES:  # TODO: citation management -> class
+            patched = []
+            in_citation = False
+            for line in part_lines:
+                if line.startswith(HASH):
+                    patched.append(line)
+                    continue
+                if line.strip() and not line.startswith(COLON):
+                    # the term -> citation code, the visible text in the square brackets
+                    in_citation = True
+                    # prepare the data triplet
+                    code = line.strip()
+                    label = code.replace(COLON, SEMI).rstrip(TM)
+                    text = ''
+                    continue
+                if in_citation:
+                    if line.startswith(COLON):
+                        text += line.lstrip(COLON).strip()
+                        continue
+                    if line.strip():
+                        text += SPACE + line.strip()
+                        continue
+                    if not line.strip():
+                        citation = (
+                            CITE_COSMETICS_TEMPLATE.replace('$label$', label)
+                            .replace('$code$', code)
+                            .replace('$text$', text)
+                            + NL
+                        )
+                        in_citation = False
+                        patched.append(citation)
+                        patched.append(line)
+                        continue
+                else:
+                    patched.append(line)
+            part_lines = [a for a in patched]
+
+        # MAYBE_KEEP_BEAUTY_IN_DEFINITION_LIST_IMPLEMENTQATION_FOR_GLOSSARY
+        if resource.name in GLOSSARY_SOURCES and False:  # TODO: glossary management -> class
+            patched = ['<dl>' + NL]
+            in_definition = False
+            for line in part_lines:
+                if not in_definition and line.strip() and not line.startswith(COLON):
+                    # the term -> glossary term, the visible text in the square brackets for refs
+                    in_definition = True
+                    # prepare the data triplet
+                    term = line.strip()
+                    label = 'def;' + label_derive_from(term)
+                    definition = ''
+                    continue
+                if in_definition:
+                    if line.startswith(COLON):
+                        definition += line.lstrip(COLON).strip()
+                        # HACK A DID ACK
+                        definition = (
+                            definition.replace('_Examples_', '<em>Examples</em>')
+                            .replace('_Example_', '<em>Example</em>')
+                            .replace('**Notes**', '<strong>Notes</strong>')
+                            .replace('**Note**', '<strong>Note</strong>')
+                        )
+                        continue
+                    if line.strip():
+                        definition += NL + ' ' * 6 + line.strip()
+                        # HACK A DID ACK
+                        definition = (
+                            definition.replace('_Examples_', '<em>Examples</em>')
+                            .replace('_Example_', '<em>Example</em>')
+                            .replace('**Notes**', '<strong>Notes</strong>')
+                            .replace('**Note**', '<strong>Note</strong>')
+                        )
+                        continue
+                    if not line.strip():
+                        for ref in MD_REF_DETECT.finditer(definition):
+                            if ref:
+                                # Found ref in markdown format
+                                found = ref.groupdict()
+                                text = found['text']
+                                target = found['target']
+                                md_ref = f'[{text}](#{target})'
+                                html_ref = f'<a href="#{target}">{text}</a>'
+                                definition = definition.replace(md_ref, html_ref)
+
+                        item = f'{" " * 2}<dt id="{label}">{term}</dt>\n{" " * 2}<dd>{definition}</dd>\n'
+                        in_definition = False
+                        patched.append(item)
+                        continue
+                else:
+                    patched.append(line)
+            patched.append('</dl>' + NL + NL)
+            part_lines = [a for a in patched]
+
+        lines.extend(part_lines)
+
+    # TODO: counter management -> class
+    lvl_min, lvl_sup = 1, 7
+    sec_cnt = {f'{H * level} ': 0 for level in range(lvl_min, lvl_sup)}
+    sec_lvl = {f'{H * level} ': level for level in range(lvl_min, lvl_sup)}
+    lvl_sec = {level: f'{H * level} ' for level in range(lvl_min, lvl_sup)}
+    H1 = f'{H} '
+    cur_lvl = sec_lvl[H1]
+    meta_hook = {}
+    # TODO: ToC builder -> class
+    tic_toc = [TOC_HEADER]
+    mint = []
+    did_appendix_sep = False
+    clean_headings = False
+    current_cs = None
+    CS_OF_SLOT = [None for _ in lines]
+    for slot, line in enumerate(lines):
+        # MAYBE_MAKE_TOP_LOGO_LOCAL # NEW
+        if line.rstrip() == TOP_LOGO_LINE:
+            lines[slot] = line.replace(LOGO_URL, LOGO_LOCAL_PATH, 1)
+
+        if meta_hooks.get(slot) is not None:
+            meta_hook = meta_hooks[slot]
+        is_plain = True  # No special meta data needed
+        if line.startswith(CLEAN_MD_START):
+            clean_headings = True
+        CS_OF_SLOT[slot] = current_cs
+        for tag in sec_cnt:
+            if line.startswith(tag) and clean_headings:
+                # manage counter
+                if not meta_hook:
+                    # auto counters
+                    is_plain = True
+                    nxt_lvl = sec_lvl[tag]
+                    sec_cnt[tag] += 1
+                    if nxt_lvl < cur_lvl:
+                        for level in range(nxt_lvl + 1, lvl_sup):
+                            sec_cnt[lvl_sec[level]] = 0
+                    sec_cnt_disp_vec = []
+                    for s_tag, cnt in sec_cnt.items():
+                        if cnt == 0:
+                            raise RuntimeError(f'counting is hard: {sec_cnt} at {tag} for {slot}:{line.rstrip(NL)}')
+                        sec_cnt_disp_vec.append(str(cnt))
+                        if s_tag == tag:
+                            break
+                    sec_cnt_disp = FULL_STOP.join(sec_cnt_disp_vec)
+                    # Hack to amend first level numeric section counter displays with a full stop - do not ask ...
+                    if FULL_STOP not in sec_cnt_disp:
+                        sec_cnt_disp += FULL_STOP
+                else:
+                    # pull in counters from meta
+                    is_plain = False
+                    app_lvl = 1  # belt and braces ...
+                    text = line.split(tag, 1)[1].rstrip()
+                    if TOK_LAB in text:
+                        # special label
+                        label = text.split(TOK_LAB, 1)[1].rstrip(CB_END)
+                        text = text.split(TOK_LAB, 1)[0]
+                    if text == meta_hook[TOC][LABEL]:
+                        sec_cnt_disp = meta_hook[TOC][ENUMERATE]  # type: ignore
+                        app_lvl = 1
+                    elif meta_hook[TOC].get(CHILDREN):
+                        for cand in meta_hook[TOC][CHILDREN]:  # type: ignore
+                            if text == cand[LABEL]:  # type: ignore
+                                sec_cnt_disp = cand[ENUMERATE]  # type: ignore
+                                app_lvl = 2
+
+                # manage label
+                text = line.split(tag, 1)[1].rstrip()
+                xline = line
+                link_attributes = ''
+                if '{' in line:
+                    link_attributes = '{' + line.split('{', 1)[1]
+                if TOK_LAB in text:
+                    # special label
+                    label = text.split(TOK_LAB, 1)[1].rstrip(CB_END)
+                    reduced_text = text.split(TOK_LAB, 1)[0]
+                else:
+                    label = label_derive_from(text)
+                clean_sec_cnt_disp = (f'{sec_cnt_disp}' if is_plain else sec_cnt_disp).rstrip(FULL_STOP)
+                SEC_LABEL_TEXT[label] = clean_sec_cnt_disp
+                SECTION_DISPLAY_TO_LABEL[clean_sec_cnt_disp] = label
+                #                    MAYBE_NO_HTML_A_FOR_HEADING #
+                line = tag + text + link_attributes # + ' ' + TOK_SEC.replace('$thing$', label)
+                # MAYBE_FIND_THE_APPENDIX_UNDO_BUG_WIOLL_YOU_?
+
+                if line.rstrip() == '# References':
+                    line = line.rstrip().replace('# ', '# Appendix A. ', 1) + '{.unnumbered #references}' + NL
+
+
+                if line.rstrip() == '## Normative References':
+                    line = line.rstrip().replace('## ', '## A.1 ', 1) + '{.unnumbered #normative-references}' + NL
+
+                if line.rstrip() == '## Informative References':
+                    line = line.rstrip().replace('## ', '## A.2 ', 1) + '{.unnumbered #informative-references}' + NL
+
+
+                if line.rstrip() == '# Safety, Security, and Data Protection Considerations':
+                    line = line.rstrip().replace('# ', '# Appendix B. ', 1) + '{.unnumbered #safety-security-and-data-protection-considerations}' + NL
+
+
+                if line.rstrip() == '# Acknowledgments':
+                    line = line.rstrip().replace('# ', '# Appendix C. ', 1) + '{.unnumbered #acknowledgments}' + NL
+
+
+                if line.rstrip() == '# Revision History':
+                    line = line.rstrip().replace('# ', '# Appendix D. ', 1) + '{.unnumbered #revision-history}' + NL
+
+
+                if line.rstrip() == '# Notices':
+                    line = line.rstrip().replace('# ', '# Appendix E. ', 1) + '{.unnumbered #notices}' + NL
+
+
+                if line.rstrip() == '# Guidance on the Size of CSAF Documents':
+                    line = line.rstrip().replace('# ', '# Appendix F. ', 1) + '{.unnumbered #guidance-on-the-size-of-csaf-documents}' + NL
+
+
+                if line.rstrip() == '## File Size':
+                    line = line.rstrip().replace('## ', '## F.1 ', 1) + '{.unnumbered #file-size}' + NL
+
+                if line.rstrip() == '## Array Length':
+                    line = line.rstrip().replace('## ', '## F.2 ', 1) + '{.unnumbered #array-length}' + NL
+
+                if line.rstrip() == '## String Length':
+                    line = line.rstrip().replace('## ', '## F.3 ', 1) + '{.unnumbered #string-length}' + NL
+
+                if line.rstrip() == '## URI Length':
+                    line = line.rstrip().replace('## ', '## F.4 ', 1) + '{.unnumbered #uri-length}' + NL
+
+                if line.rstrip() == '## Enum':
+                    line = line.rstrip().replace('## ', '## F.5 ', 1) + '{.unnumbered #enum}' + NL
+
+                if line.rstrip() == '## Date':
+                    line = line.rstrip().replace('## ', '## F.6 ', 1) + '{.unnumbered #date}' + NL
+
+                if 'safety-security-and-data-protection-considerations' == label:
+                    print(xline)
+                    print('FOO', SEC_LABEL_TEXT[label])
+                    print('BAR', SECTION_DISPLAY_TO_LABEL[clean_sec_cnt_disp])
+                    print('BAZ', label)
+                    print('QUUX', line)
+                    print('TAG', tag)
+
+                # MAYBE_NO_SECTION_NUMBERS_AS_PART_OF_HEADING # line = line.replace(tag, f'{tag}{sec_cnt_disp} ', 1) + NL
+                lines[slot] = line
+                cur_lvl = nxt_lvl
+                if not did_appendix_sep and meta_hook and slot < first_meta_slot:  # type: ignore
+                    tic_toc.append(TOC_VERTICAL_SPACER)
+                    did_appendix_sep = True
+                toc_template = TOC_TEMPLATE[cur_lvl if not meta_hook else app_lvl]
+                tic_toc.append(
+                    toc_template.replace('$sec_cnt_disp$', sec_cnt_disp)
+                    .replace('$text$', text)
+                    .replace('$label$', label)
+                )
+                extended = False
+                if sec_cnt_disp.upper().isupper():
+                    extended = 2 if set(sec_cnt_disp).intersection('0123456789') else 1
+                    if extended == 2:
+                        extended = sec_cnt_disp.count(DOT) + 1
+                mint.append([list(sec_cnt.values()), extended, sec_cnt_disp, text, label])
+                current_cs = label  # Update state for label in non tag lines
+                # correct the default state assignment
+                CS_OF_SLOT[slot] = current_cs  # type: ignore
+
+            # MAYBE_SEC_NO_TOC_BEFORE_INTRODUCTION # NEW
+            if line.startswith(tag) and not clean_headings:
+                lines[slot] = line.rstrip() + SEC_NO_TOC_POSTFIX + NL
+
+    # Process the text display of citation refs
+    for slot, line in enumerate(lines):
+        if label_in(line):
+            for ref in CITE_REF_DETECT.finditer(line):
+                if ref:
+                    # Found citation label in markdown format
+                    found = ref.groupdict()
+                    trigger_text = found['text']
+                    if trigger_text != IS_CITE_REF:
+                        raise RuntimeError(f'false positive cite ref in ({line.rstrip(NL)})')
+                    label = found['label']
+                    text = label.replace(';', ':')
+                    sem_ref = f'[cite](#{label})'
+                    evil_ref = f'\\[[{text}](#{label})\\]'  # \[[GFMCMARK](#GFMCMARK)\]
+                    line = line.replace(sem_ref, evil_ref)
+                    lines[slot] = line
+
+    # Process the text display of example refs
+    for slot, line in enumerate(lines):
+        if example_in(line):
+            num = example_local_number(line)
+            section = CS_OF_SLOT[slot]
+            magic_label = f'{section}-eg-{num}'
+            pl_anchor = TOK_EG.replace('$thing$', magic_label)
+            line = line.rstrip(NL) + pl_anchor + NL
+            # now the UX bonus:
+            sec_disp = 'sec-' + display_from[section].replace(FULL_STOP, '-')  # type: ignore
+            sec_disp_num_label = f'{sec_disp}-eg-{num}'
+            sec_disp_num_anchor = TOK_EG.replace('$thing$', sec_disp_num_label)
+            line = line.rstrip(NL) + sec_disp_num_anchor + NL
+            # now the global counter extra:
+            global_example_num = eg_global_from[magic_label]
+            global_example_num_label = f'example-{global_example_num}'
+            global_example_num_anchor = TOK_EG.replace('$thing$', global_example_num_label)
+            line = line.rstrip(NL) + global_example_num_anchor + NL
+            # Update the list of lines
+            lines[slot] = line
+
+        if label_in(line):
+            for ref in EG_REF_DETECT.finditer(line):
+                if ref:
+                    # Found example label in markdown format
+                    found = ref.groupdict()
+                    trigger_text = found['text']
+                    if trigger_text != IS_EG_REF:
+                        raise RuntimeError(f'false positive example ref in ({line.rstrip(NL)})')
+                    label = found['label']
+                    text = label.replace(';', ':')
+                    sem_ref = f'[eg](#{label})'
+                    if '-eg-' not in label:  # TODO - refactor and clean up
+                        raise RuntimeError(f'bad label for example in ({line.rstrip(NL)})')
+                    section, number = label.split('-eg-', 1)
+                    if section == CS_OF_SLOT[slot]:
+                        print(f'detected local reference for {label} in ({line.rstrip(NL)})')
+                        evil_ref = f'\\[[{number}](#{label})\\]'  # [1](#a-sec-eg-1)
+                    else:
+                        print(f'detected remote reference for {label} in ({line.rstrip(NL)})')
+                        sec_disp = display_from[section]
+                        evil_ref = (
+                            f'\\[[{number} (of section {sec_disp})](#{label})\\]'  # [1 (of section 1.2.3)](#a-sec-eg-1)
+                        )
+                    line = line.replace(sem_ref, evil_ref)
+                    print(line.rstrip(NL))
+                    lines[slot] = line
+
+    # Process the text display of section refs
+    for slot, line in enumerate(lines):
+        if label_in(line):
+            for ref in SEC_REF_DETECT.finditer(line):
+                if ref:
+                    # Found section label in markdown format
+                    found = ref.groupdict()
+                    trigger_text = found['text']
+                    if trigger_text != IS_SEC_REF:
+                        raise RuntimeError(f'false positive sec ref in ({line.rstrip(NL)})')
+                    label = found['label']
+                    if label not in SEC_LABEL_TEXT:
+                        raise RuntimeError(f'missing register label for sec ref in ({line.rstrip(NL)})')
+                    text = SEC_LABEL_TEXT[label]
+                    sem_ref = f'[sec](#{label})'
+                    evil_ref = f'[{text}](#{label})'  # [GFMCMARK](#GFMCMARK)
+                    line = line.replace(sem_ref, evil_ref)
+                    lines[slot] = line
+
+    # Process the code blocks for references to map from label to display value
+    for slot, line in enumerate(lines):
+        if code_block_label_in(line):
+            for ref in SEC_LABEL_BRACKET_CB_DETECT.finditer(line):
+                if ref:
+                    # Found bracketed label ref to section in code block
+                    found = ref.groupdict()
+                    value = found['value']
+                    if not value or value not in display_from:
+                        continue
+                    label = found['label']
+                    display = display_from[value]
+                    sem_ref = label
+                    disp_ref = display
+                    line = line.replace(sem_ref, disp_ref)
+                    lines[slot] = line
+            for ref in SEC_LABEL_FREE_CB_DETECT.finditer(line):
+                if ref:
+                    # Found free label ref to section in code block
+                    found = ref.groupdict()
+                    value = found['value']
+                    if not value or value not in display_from:
+                        continue
+                    label = found['label']
+                    display = display_from[value]
+                    sem_ref = label
+                    disp_ref = display
+                    line = line.replace(sem_ref, disp_ref)
+                    lines[slot] = line
+
+    tic_toc.append(YAML_X_SEP)
+    tic_toc.append(NL)
+    # Inject the table of contents:
+    for slot, line in enumerate(lines):
+        if end_of_toc_in(line):
+            # MAYBE_NO_TOC # lines[slot] = NL.join(tic_toc) + line
+            break
+
+    # remove any trailing blank line
+    while lines[-1] == NL:
+        del lines[-1]
+
+    BUILD_AT.mkdir(parents=True, exist_ok=True)
+    dump_assembly(lines, BUILD_AT / 'pdf.md')
+
+    with open(BUILD_AT / 'toc-mint.json', 'wt', encoding=ENCODING) as handle:
+        json.dump(mint, handle, indent=2)
+
+    if DUMP_LUT:
+        with SECTION_DISPLAY_TO_LABEL_AT.open('wt', encoding=ENCODING) as handle:
+            json.dump(SECTION_DISPLAY_TO_LABEL, handle, indent=2)
+        SECTION_LABEL_TO_DISPLAY = {
+            label: disp for label, disp in sorted((label, disp) for disp, label in SECTION_DISPLAY_TO_LABEL.items())
+        }
+        with SECTION_LABEL_TO_DISPLAY_AT.open('wt', encoding=ENCODING) as handle:
+            json.dump(SECTION_LABEL_TO_DISPLAY, handle, indent=2)
+
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv[1:]))
diff --git a/csaf_2.1/prose/edit/etc/bind.txt b/csaf_2.1/prose/edit/etc/bind.txt
index 7179ce2bb..ecbc9b520 100644
--- a/csaf_2.1/prose/edit/etc/bind.txt
+++ b/csaf_2.1/prose/edit/etc/bind.txt
@@ -1,10 +1,8 @@
 frontmatter.md
 introduction-00.md
-introduction-01-ipr-policy.md
-introduction-02-terminology.md
-introduction-02-terminology-glossary.md
-introduction-03-normative-references.md
-introduction-04-informative-references.md
+introduction-01-changes-from-earlier-versions.md
+introduction-02-glossary.md
+introduction-02-glossary-data.md
 introduction-05-typographical-conventions.md
 design-considerations-00.md
 design-considerations-01-construction-principles.md
@@ -66,8 +64,10 @@ tests-01-mndtr-33-multiple-flags-with-vex-justification-codes-per-product.md
 tests-02-optional.md
 tests-03-informative.md
 distributing.md
-safety-security-and-data-protection.md
 conformance.md
+references.md
+safety-security-and-data-protection.md
 acknowledgements.md
 revision-history.md
+notices.md
 guidance-on-size.md
diff --git a/csaf_2.1/prose/edit/etc/section-display-to-label.json b/csaf_2.1/prose/edit/etc/section-display-to-label.json
index 55ddfad9a..0263c9a7b 100644
--- a/csaf_2.1/prose/edit/etc/section-display-to-label.json
+++ b/csaf_2.1/prose/edit/etc/section-display-to-label.json
@@ -1,10 +1,8 @@
 {
   "1": "introduction",
-  "1.1": "ipr-policy",
-  "1.2": "terminology",
-  "1.3": "normative-references",
-  "1.4": "informative-references",
-  "1.5": "typographical-conventions",
+  "1.1": "changes-from-earlier-versions",
+  "1.2": "glossary",
+  "1.3": "typographical-conventions",
   "2": "design-considerations",
   "2.1": "construction-principles",
   "3": "schema-elements",
@@ -236,38 +234,42 @@
   "7.3": "retrieving-rules",
   "7.3.1": "finding-provider-metadata.json",
   "7.3.2": "retrieving-csaf-documents",
-  "8": "safety-security-and-data-protection-considerations",
-  "9": "conformance",
-  "9.1": "conformance-targets",
-  "9.1.1": "conformance-clause-1-csaf-document",
-  "9.1.2": "conformance-clause-2-csaf-producer",
-  "9.1.3": "conformance-clause-3-csaf-direct-producer",
-  "9.1.4": "conformance-clause-4-csaf-converter",
-  "9.1.5": "conformance-clause-5-cvrf-csaf-converter",
-  "9.1.6": "conformance-clause-6-csaf-content-management-system",
-  "9.1.7": "conformance-clause-7-csaf-post-processor",
-  "9.1.8": "conformance-clause-8-csaf-modifier",
-  "9.1.9": "conformance-clause-9-csaf-translator",
-  "9.1.10": "conformance-clause-10-csaf-consumer",
-  "9.1.11": "conformance-clause-11-csaf-viewer",
-  "9.1.12": "conformance-clause-12-csaf-management-system",
-  "9.1.13": "conformance-clause-13-csaf-asset-matching-system",
-  "9.1.14": "conformance-clause-14-csaf-basic-validator",
-  "9.1.15": "conformance-clause-15-csaf-extended-validator",
-  "9.1.16": "conformance-clause-16-csaf-full-validator",
-  "9.1.17": "conformance-clause-17-csaf-sbom-matching-system",
-  "9.1.18": "conformance-clause-18-csaf-2-0-to-csaf-2-1-converter",
-  "9.1.19": "conformance-clause-19-csaf-library",
-  "9.1.20": "conformance-clause-20-csaf-library-with-basic-validation",
-  "9.1.21": "conformance-clause-21-csaf-library-with-extended-validation",
-  "9.1.22": "conformance-clause-22-csaf-library-with-full-validation",
-  "Appendix A.": "acknowledgments",
-  "Appendix B.": "revision-history",
-  "Appendix C.": "guidance-on-the-size-of-csaf-documents",
-  "C.1": "file-size",
-  "C.2": "array-length",
-  "C.3": "string-length",
-  "C.4": "uri-length",
-  "C.5": "enum",
-  "C.6": "date"
+  "8": "conformance",
+  "8.1": "conformance-targets",
+  "8.1.1": "conformance-clause-1-csaf-document",
+  "8.1.2": "conformance-clause-2-csaf-producer",
+  "8.1.3": "conformance-clause-3-csaf-direct-producer",
+  "8.1.4": "conformance-clause-4-csaf-converter",
+  "8.1.5": "conformance-clause-5-cvrf-csaf-converter",
+  "8.1.6": "conformance-clause-6-csaf-content-management-system",
+  "8.1.7": "conformance-clause-7-csaf-post-processor",
+  "8.1.8": "conformance-clause-8-csaf-modifier",
+  "8.1.9": "conformance-clause-9-csaf-translator",
+  "8.1.10": "conformance-clause-10-csaf-consumer",
+  "8.1.11": "conformance-clause-11-csaf-viewer",
+  "8.1.12": "conformance-clause-12-csaf-management-system",
+  "8.1.13": "conformance-clause-13-csaf-asset-matching-system",
+  "8.1.14": "conformance-clause-14-csaf-basic-validator",
+  "8.1.15": "conformance-clause-15-csaf-extended-validator",
+  "8.1.16": "conformance-clause-16-csaf-full-validator",
+  "8.1.17": "conformance-clause-17-csaf-sbom-matching-system",
+  "8.1.18": "conformance-clause-18-csaf-2-0-to-csaf-2-1-converter",
+  "8.1.19": "conformance-clause-19-csaf-library",
+  "8.1.20": "conformance-clause-20-csaf-library-with-basic-validation",
+  "8.1.21": "conformance-clause-21-csaf-library-with-extended-validation",
+  "8.1.22": "conformance-clause-22-csaf-library-with-full-validation",
+  "Appendix A.": "references",
+  "A.1": "normative-references",
+  "A.2": "informative-references",
+  "Appendix B.": "safety-security-and-data-protection-considerations",
+  "Appendix C.": "acknowledgments",
+  "Appendix D.": "revision-history",
+  "Appendix E.": "notices",
+  "Appendix F.": "guidance-on-the-size-of-csaf-documents",
+  "F.1": "file-size",
+  "F.2": "array-length",
+  "F.3": "string-length",
+  "F.4": "uri-length",
+  "F.5": "enum",
+  "F.6": "date"
 }
diff --git a/csaf_2.1/prose/edit/etc/section-label-to-display.json b/csaf_2.1/prose/edit/etc/section-label-to-display.json
index 9aed0ae6e..f3cbe7866 100644
--- a/csaf_2.1/prose/edit/etc/section-label-to-display.json
+++ b/csaf_2.1/prose/edit/etc/section-label-to-display.json
@@ -1,5 +1,5 @@
 {
-  "acknowledgments": "Appendix A.",
+  "acknowledgments": "Appendix C.",
   "acknowledgments-type": "3.1.1",
   "acknowledgments-type-example": "3.1.1.5",
   "acknowledgments-type-names": "3.1.1.1",
@@ -11,7 +11,7 @@
   "additional-conventions--sorting": "5.3",
   "additional-properties": "6.2.20",
   "same-timestamps-in-revision-history": "6.2.21",
-  "array-length": "C.2",
+  "array-length": "F.2",
   "branch-categories": "6.3.9",
   "branches-type": "3.1.2",
   "branches-type-branches": "3.1.2.1",
@@ -21,37 +21,38 @@
   "branches-type-name-under-product-version-range": "3.1.2.3.2",
   "branches-type-product": "3.1.2.4",
   "build-metadata-in-revision-history": "6.2.4",
+  "changes-from-.earlier-versions": "1.1",
   "circular-definition-of-product-id": "6.1.3",
   "conformance": "9",
-  "conformance-clause-1-csaf-document": "9.1.1",
-  "conformance-clause-10-csaf-consumer": "9.1.10",
-  "conformance-clause-11-csaf-viewer": "9.1.11",
-  "conformance-clause-12-csaf-management-system": "9.1.12",
-  "conformance-clause-13-csaf-asset-matching-system": "9.1.13",
-  "conformance-clause-14-csaf-basic-validator": "9.1.14",
-  "conformance-clause-15-csaf-extended-validator": "9.1.15",
-  "conformance-clause-16-csaf-full-validator": "9.1.16",
-  "conformance-clause-17-csaf-sbom-matching-system": "9.1.17",
-  "conformance-clause-18-csaf-2-0-to-csaf-2-1-converter": "9.1.18",
-  "conformance-clause-19-csaf-library": "9.1.19",
-  "conformance-clause-2-csaf-producer": "9.1.2",
-  "conformance-clause-20-csaf-library-with-basic-validation": "9.1.20",
-  "conformance-clause-21-csaf-library-with-extended-validation": "9.1.21",
-  "conformance-clause-22-csaf-library-with-full-validation": "9.1.22",
-  "conformance-clause-3-csaf-direct-producer": "9.1.3",
-  "conformance-clause-4-csaf-converter": "9.1.4",
-  "conformance-clause-5-cvrf-csaf-converter": "9.1.5",
-  "conformance-clause-6-csaf-content-management-system": "9.1.6",
-  "conformance-clause-7-csaf-post-processor": "9.1.7",
-  "conformance-clause-8-csaf-modifier": "9.1.8",
-  "conformance-clause-9-csaf-translator": "9.1.9",
-  "conformance-targets": "9.1",
+  "conformance-clause-1-csaf-document": "8.1.1",
+  "conformance-clause-10-csaf-consumer": "8.1.10",
+  "conformance-clause-11-csaf-viewer": "8.1.11",
+  "conformance-clause-12-csaf-management-system": "8.1.12",
+  "conformance-clause-13-csaf-asset-matching-system": "8.1.13",
+  "conformance-clause-14-csaf-basic-validator": "8.1.14",
+  "conformance-clause-15-csaf-extended-validator": "8.1.15",
+  "conformance-clause-16-csaf-full-validator": "8.1.16",
+  "conformance-clause-17-csaf-sbom-matching-system": "8.1.17",
+  "conformance-clause-18-csaf-2-0-to-csaf-2-1-converter": "8.1.18",
+  "conformance-clause-19-csaf-library": "8.1.19",
+  "conformance-clause-2-csaf-producer": "8.1.2",
+  "conformance-clause-20-csaf-library-with-basic-validation": "8.1.20",
+  "conformance-clause-21-csaf-library-with-extended-validation": "8.1.21",
+  "conformance-clause-22-csaf-library-with-full-validation": "8.1.22",
+  "conformance-clause-3-csaf-direct-producer": "8.1.3",
+  "conformance-clause-4-csaf-converter": "8.1.4",
+  "conformance-clause-5-cvrf-csaf-converter": "8.1.5",
+  "conformance-clause-6-csaf-content-management-system": "8.1.6",
+  "conformance-clause-7-csaf-post-processor": "8.1.7",
+  "conformance-clause-8-csaf-modifier": "8.1.8",
+  "conformance-clause-9-csaf-translator": "8.1.9",
+  "conformance-targets": "8.1",
   "construction-principles": "2.1",
   "contradicting-product-status": "6.1.6",
   "cve-in-field-ids": "6.2.17",
   "cvss-for-fixed-products": "6.2.19",
   "cwe": "6.1.11",
-  "date": "C.6",
+  "date": "F.6",
   "definitions": "3.1",
   "design-considerations": "2",
   "distributing-csaf-documents": "7",
@@ -87,8 +88,8 @@
   "document-references": "6.1.27.2",
   "document-status-draft": "6.1.17",
   "document-tracking-id-in-title": "6.2.22",
-  "enum": "C.5",
-  "file-size": "C.1",
+  "enum": "F.5",
+  "file-size": "F.1",
   "filename": "5.1",
   "finding-provider-metadata.json": "7.3.1",
   "flag-without-product-reference": "6.1.32",
@@ -104,15 +105,15 @@
   "full-product-name-type-product-identification-helper-sbom-urls": "3.1.3.3.5",
   "full-product-name-type-product-identification-helper-serial-numbers": "3.1.3.3.6",
   "full-product-name-type-product-identification-helper-skus": "3.1.3.3.7",
-  "guidance-on-the-size-of-csaf-documents": "Appendix C.",
+  "glossary": "1.2",
+  "guidance-on-the-size-of-csaf-documents": "Appendix F.",
   "impact-statement": "6.1.27.9",
   "inconsistent-cvss": "6.1.10",
-  "informative-references": "1.4",
+  "informative-references": "A.2",
   "informative-test": "6.3",
   "introduction": "1",
   "invalid-cvss": "6.1.8",
   "invalid-cvss-computation": "6.1.9",
-  "ipr-policy": "1.1",
   "language": "6.1.12",
   "language-type": "3.1.4",
   "latest-document-version": "6.1.16",
@@ -140,8 +141,9 @@
   "multiple-use-of-same-cve": "6.1.23",
   "multiple-use-of-same-hash-algorithm": "6.1.25",
   "non-draft-document-version": "6.1.20",
-  "normative-references": "1.3",
+  "normative-references": "A.1",
   "notes-type": "3.1.5",
+  "notices": "Appendix E.",
   "older-current-release-date-than-revision-history": "6.2.6",
   "older-initial-release-date-than-revision-history": "6.2.5",
   "optional-tests": "6.2",
@@ -168,6 +170,7 @@
   "prohibited-document-category-name": "6.1.26",
   "properties": "3.2",
   "purl": "6.1.13",
+  "references": "Appendix A.",
   "references-type": "3.1.10",
   "released-revision-history": "6.1.18",
   "remediation-without-product-reference": "6.1.29",
@@ -197,7 +200,7 @@
   "requirements": "7.1",
   "retrieving-csaf-documents": "7.3.2",
   "retrieving-rules": "7.3",
-  "revision-history": "Appendix B.",
+  "revision-history": "Appendix D.",
   "revision-history-entries-for-pre-release-versions": "6.1.19",
   "role-csaf-aggregator": "7.2.5",
   "role-csaf-lister": "7.2.4",
@@ -205,20 +208,19 @@
   "role-csaf-publisher": "7.2.1",
   "role-csaf-trusted-provider": "7.2.3",
   "roles": "7.2",
-  "safety-security-and-data-protection-considerations": "8",
+  "safety-security-and-data-protection-considerations": "Appendix B.",
   "schema-elements": "3",
   "schema-property": "3.2.1",
   "separation-in-data-stream": "5.2",
   "sorted-revision-history": "6.1.14",
   "spell-check": "6.3.8",
-  "string-length": "C.3",
-  "terminology": "1.2",
+  "string-length": "F.3",
   "tests": "6",
   "translation": "6.1.28",
   "translator": "6.1.15",
-  "typographical-conventions": "1.5",
+  "typographical-conventions": "1.3",
   "unused-definition-of-product-id": "6.2.1",
-  "uri-length": "C.4",
+  "uri-length": "F.4",
   "usage-of-cwe-allowed-with-review-for-vulnerability-mapping": "6.2.26",
   "usage-of-cwe-not-allowed-for-vulnerability-mapping": "6.2.25",
   "usage-of-deprecated-cwe": "6.2.23",
@@ -250,9 +252,9 @@
   "vulnerabilities-property-ids": "3.2.4.6",
   "vulnerabilities-property-involvements": "3.2.4.7",
   "vulnerabilities-property-metrics": "3.2.4.8",
-  "vulnerabilities-property-metrics-content": "3.2.4.8.1", 
-  "vulnerabilities-property-metrics-products": "3.2.4.8.2", 
-  "vulnerabilities-property-metrics-source": "3.2.4.8.3", 
+  "vulnerabilities-property-metrics-content": "3.2.4.8.1",
+  "vulnerabilities-property-metrics-products": "3.2.4.8.2",
+  "vulnerabilities-property-metrics-source": "3.2.4.8.3",
   "vulnerabilities-property-notes": "3.2.4.9",
   "vulnerabilities-property-product-status": "3.2.4.10",
   "vulnerabilities-property-references": "3.2.4.11",
diff --git a/csaf_2.1/prose/edit/src/acknowledgements.md b/csaf_2.1/prose/edit/src/acknowledgements.md
index 5efbc52f7..9e6470e81 100644
--- a/csaf_2.1/prose/edit/src/acknowledgements.md
+++ b/csaf_2.1/prose/edit/src/acknowledgements.md
@@ -3,7 +3,7 @@
 toc:
   auto: false
   label: Acknowledgments
-  enumerate: Appendix A.
+  enumerate: Appendix C.
 ---
 -->
 # Acknowledgments
diff --git a/csaf_2.1/prose/edit/src/additional-conventions.md b/csaf_2.1/prose/edit/src/additional-conventions.md
index 4ae6bc1fe..1d78ced08 100644
--- a/csaf_2.1/prose/edit/src/additional-conventions.md
+++ b/csaf_2.1/prose/edit/src/additional-conventions.md
@@ -76,7 +76,14 @@ Other fields MUST NOT contain Markdown.
 The `/product_tree` uses a nested structure for `branches`. Along a single path to a leaf, the recursion of `branches` is limited to 30 repetitions. Therefore, the longest path to a leaf is:
 
 ```
-/product_tree/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/product
+/product_tree/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/←
+branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/←
+branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/←
+branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/branches[]/←
+branches[]/branches[]/branches[]/product
 ```
 
+  > For the significance of the left pointing arrow character (`←`) at the end of lines in the preceding longest path to a leaf please
+  > cf. the guidance in section [sec](#typographical-conventions).
+
 -------
diff --git a/csaf_2.1/prose/edit/src/conformance.md b/csaf_2.1/prose/edit/src/conformance.md
index e619fdf4d..b9c8cda24 100644
--- a/csaf_2.1/prose/edit/src/conformance.md
+++ b/csaf_2.1/prose/edit/src/conformance.md
@@ -137,6 +137,7 @@ Secondly, the program fulfills the following for all items of:
     `/document/tracking/current_release_date` of the source document.
     If no such version exist, the first matching version published after the value of `/document/tracking/current_release_date`
     of the source document SHOULD be used.
+
     > This is done to create a deterministic conversion.
 
     If the CWE does not match at all, the CVRF CSAF converter MUST omit this CWE and output a warning that an invalid CWE was found and has
@@ -287,7 +288,7 @@ A CSAF content management system satisfies the "CSAF content management system"
   * `/document/category` (based on the templates from configuration)
 
 * When updating an existing CSAF document:
-  
+
   * prefills all fields which have be present in the existing CSAF document
   * adds a new item in `/document/tracking/revision_history[]`
   * updates the following fields with the values given below or based on the templates from configuration:
@@ -430,8 +431,10 @@ A CSAF asset matching system satisfies the "CSAF asset matching system" conforma
     * when a new CSAF document is inserted (for this CSAF document)
     * when a new asset is inserted (for this asset)
     * when the Major version in a CSAF document with semantic versioning changes (for this CSAF document)
+
     > These also apply if more than one CSAF document or asset was added.
     > To reduce the computational efforts the runs can be pooled into one run which fulfills all the tasks at once (batch mode).
+
   * Manually and automatically triggered runs SHOULD NOT be pooled.
 * provides at least the following statistics for the count of assets:
   * matching that CSAF document at all
@@ -475,7 +478,9 @@ A CSAF SBOM matching system satisfies the "CSAF SBOM matching system" conformanc
 
 * satisfies the "CSAF management system" conformance profile.
 * is an SBOM database or connects to one.
+
   > A repository or any other location that can be queried for SBOMs and their content is also considered an SBOM database.
+
 * matches the CSAF documents within the system to the respective SBOM components.
   This might be done with a probability which gives the user the chance to broaden or narrow the results.
   The process of matching is also referred to as "run of the SBOM matching module".
@@ -498,9 +503,12 @@ A CSAF SBOM matching system satisfies the "CSAF SBOM matching system" conformanc
     * when a new CSAF document is inserted (for this CSAF document)
     * when a new SBOM component is inserted (for this SBOM component)
     * when the Major version in a CSAF document with semantic versioning changes (for this CSAF document)
+
     > These also apply if more than one CSAF document or SBOM component was added.
     > To reduce the computational efforts the runs can be pooled into one run which fulfills all the tasks at once (batch mode).
+
   > Manually and automatically triggered runs should not be pooled.
+
 * provides at least the following statistics for the count of SBOM component:
   * matching that CSAF document at all
   * marked with a given status
@@ -522,9 +530,9 @@ Secondly, the program fulfills the following for all items of:
 * `/$schema`: The CSAF 2.0 to CSAF 2.1 converter MUST set property with the value prescribed by the schema.
 * `/document/csaf_version`: The CSAF 2.0 to CSAF 2.1 converter MUST update the value to `2.1`.
 * `/document/distribution/tlp/label`: If a TLP label is given, the CSAF 2.0 to CSAF 2.1 converter MUST convert it according to the table below:
-  
+
   | CSAF 2.0 (using TLP v1.0) | CSAF 2.1 (using TLP v2.0) |
-  |---------------------------|---------------------------|
+  |:--------------------------|:--------------------------|
   | `TLP:WHITE`               | `TLP:CLEAR`               |
   | `TLP:GREEN`               | `TLP:GREEN`               |
   | `TLP:AMBER`               | `TLP:AMBER`               |
@@ -534,6 +542,7 @@ Secondly, the program fulfills the following for all items of:
   option to use this label instead. If the TLP label changes through such conversion in a way that is not reflected in the table above, the
   the CSAF 2.0 to CSAF 2.1 converter MUST output a warning that the TLP label was taken from the distribution text. Such a warning MUST include
   both values: the converted one based on the table and the one from the distribution text.
+
   > This is a common case for CSAF 2.0 documents labeled as TLP:RED but actually intended to be TLP:AMBER+STRICT.
 
   If no TLP label was given, the CSAF 2.0 to CSAF 2.1 converter SHOULD assign `TLP:CLEAR` and output a warning that the default TLP has been set.
@@ -546,6 +555,7 @@ Secondly, the program fulfills the following for all items of:
   using the latest version that matches the `id` and `name` exactly and was published prior to the value of `/document/tracking/current_release_date`
   of the source document. If no such version exist, the first matching version published after the value of `/document/tracking/current_release_date`
   of the source document SHOULD be used.
+
   > This is done to create a deterministic conversion.
 
   The tool SHOULD implement an option to use the latest available CWE version at the time of the conversion that still matches.
diff --git a/csaf_2.1/prose/edit/src/distributing.md b/csaf_2.1/prose/edit/src/distributing.md
index 954498e55..659d4b76a 100644
--- a/csaf_2.1/prose/edit/src/distributing.md
+++ b/csaf_2.1/prose/edit/src/distributing.md
@@ -74,7 +74,8 @@ CSAF aggregator SHOULD display over any individual `publisher` values in the CSA
 
 ```
   {
-    "canonical_url": "https://www.example.com/.well-known/csaf/provider-metadata.json",
+    "canonical_url": "https://www.example.com/.well-known/csaf/←
+    provider-metadata.json",
     "distributions": [
       {
         "rolie": {
@@ -95,7 +96,8 @@ CSAF aggregator SHOULD display over any individual `publisher` values in the CSA
     "public_openpgp_keys": [
       {
         "fingerprint": "8F5F267907B2C4559DB360DB2294BA7D2B2298B1",
-        "url": "https://keys.example.net/vks/v1/by-fingerprint/8F5F267907B2C4559DB360DB2294BA7D2B2298B1"
+        "url": "https://keys.example.net/vks/v1/←
+        by-fingerprint/8F5F267907B2C4559DB360DB2294BA7D2B2298B1"
       }
     ],
     "publisher": {
@@ -107,6 +109,9 @@ CSAF aggregator SHOULD display over any individual `publisher` values in the CSA
   }
 ```
 
+  > For the significance of the left pointing arrow character (`←`) at the end of a line in the preceding example 1 please
+  > cf. the guidance in section [sec](#typographical-conventions).
+
 If a CSAF publisher (cf. section [sec](#role-csaf-publisher)) does not provide the `provider-metadata.json`,
 an aggregator SHOULD contact the CSAF publisher in question to determine the values for `list_on_CSAF_aggregators` and `mirror_on_CSAF_aggregators`.
 If that is impossible or if the CSAF publisher is unresponsive the following values MUST be used:
@@ -249,15 +254,18 @@ Each ROLIE feed document MUST be a JSON file that conforms with [cite](#RFC8322)
           "link": [
             {
               "rel": "self",
-              "href": "https://psirt.domain.tld/advisories/csaf/2024/esa-2024-001.json"
+              "href": "https://psirt.domain.tld/advisories/csaf/2024/←
+              esa-2024-001.json"
             },
             {
               "rel": "hash",
-              "href": "https://psirt.domain.tld/advisories/csaf/2024/esa-2024-001.json.sha512"
+              "href": "https://psirt.domain.tld/advisories/csaf/2024/←
+              esa-2024-001.json.sha512"
             },
             {
               "rel": "signature",
-              "href": "https://psirt.domain.tld/advisories/csaf/2024/esa-2024-001.json.asc"
+              "href": "https://psirt.domain.tld/advisories/csaf/2024/←
+              esa-2024-001.json.asc"
             }
           ],
           "published": "2024-01-01T11:00:00.000Z",
@@ -270,7 +278,8 @@ Each ROLIE feed document MUST be a JSON file that conforms with [cite](#RFC8322)
             "src": "https://psirt.domain.tld/advisories/csaf/2024/esa-2024-001.json"
           },
           "format": {
-            "schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/csaf_json_schema.json",
+            "schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/←
+            csaf_json_schema.json",
             "version": "2.1"
           }
         }
@@ -279,6 +288,9 @@ Each ROLIE feed document MUST be a JSON file that conforms with [cite](#RFC8322)
   }
 ```
 
+  > For the significance of the left pointing arrow character (`←`) at the end of lines in the preceding example 1 please
+  > cf. the guidance in section [sec](#typographical-conventions).
+
 Any existing hash file (requirement 18) MUST be listed in the corresponding entry of the ROLIE feed as an item of
 the array `link` having the `rel` value of `hash`.
 Any existing signature file (requirement 19) MUST be listed in the corresponding entry of the ROLIE feed as an item of the array `link`
@@ -464,13 +476,17 @@ The file `aggregator.json` SHOULD only list the latest version of the metadata o
   {
     "aggregator": {
       "category": "lister",
-      "contact_details": "Example CSAF Lister can be reached at contact_us@lister.example, or via our website at https://lister.example/security/csaf/aggregator/contact.",
-      "issuing_authority": "This service is provided as it is. It is free for everybody.",
+      "contact_details": "Example CSAF Lister can be reached at←
+       contact_us@lister.example, or via our website at←
+       https://lister.example/security/csaf/aggregator/contact.",
+      "issuing_authority": "This service is provided as it is.←
+       It is free for everybody.",
       "name": "Example CSAF Lister",
       "namespace": "https://lister.example"
     },
     "aggregator_version": "2.1",
-    "canonical_url": "https://aggregator.example/.well-known/csaf-aggregator/aggregator.json",
+    "canonical_url": "https://aggregator.example/.well-known/csaf-aggregator/←
+    aggregator.json",
     "csaf_providers": [
       {
         "metadata": {
@@ -499,6 +515,9 @@ The file `aggregator.json` SHOULD only list the latest version of the metadata o
   }
 ```
 
+  > For the significance of the left pointing arrow character (`←`) at the end of lines in the preceding example 1 please
+  > cf. the guidance in section [sec](#typographical-conventions).
+
 ### Requirement 22: Two disjoint issuing parties
 
 The file `aggregator.json` (requirement 21) lists at least two disjoint CSAF providers (including CSAF trusted providers)
@@ -520,13 +539,17 @@ Each such folder MUST at least:
   {
     "aggregator": {
       "category": "aggregator",
-      "contact_details": "Example Aggregator can be reached at contact_us@aggregator.example, or via our website at https://aggregator.example/security/csaf/aggregator/contact.",
-      "issuing_authority": "This service is provided as it is. It is free for everybody.",
+      "contact_details": "Example Aggregator can be reached at←
+       contact_us@aggregator.example, or via our website at←
+       https://aggregator.example/security/csaf/aggregator/contact.",
+      "issuing_authority": "This service is provided as it is.←
+       It is free for everybody.",
       "name": "Example Aggregator",
       "namespace": "https://aggregator.example"
     },
     "aggregator_version": "2.1",
-    "canonical_url": "https://aggregator.example/.well-known/csaf-aggregator/aggregator.json",
+    "canonical_url": "https://aggregator.example/.well-known/←
+    csaf-aggregator/aggregator.json",
     "csaf_providers": [
       {
         "metadata": {
@@ -539,7 +562,8 @@ Each such folder MUST at least:
           "url": "https://www.example.com/.well-known/csaf/provider-metadata.json"
         },
         "mirrors": [
-          "https://aggregator.example/.well-known/csaf-aggregator/Example_Company_ProductCERT/provider-metadata.json"
+          "https://aggregator.example/.well-known/csaf-aggregator/←
+          Example_Company_ProductCERT/provider-metadata.json"
         ]
       },
       {
@@ -553,7 +577,8 @@ Each such folder MUST at least:
           "url": "https://cert.example/advisories/csaf/provider-metadata.json"
         },
         "mirrors": [
-          "https://aggregator.example/.well-known/csaf-aggregator/Example_Coordinator_CERT/provider-metadata.json"
+          "https://aggregator.example/.well-known/csaf-aggregator/←
+          Example_Coordinator_CERT/provider-metadata.json"
         ]
       }
     ],
@@ -561,6 +586,9 @@ Each such folder MUST at least:
   }
 ```
 
+  > For the significance of the left pointing arrow character (`←`) at the end of lines in the preceding example 1 please
+  > cf. the guidance in section [sec](#typographical-conventions).
+
 ### Requirement 24: HTTP User-Agent
 
 Access to the CSAF related files and directories provided, for both metadata and documents, MUST be allowed independent of the
diff --git a/csaf_2.1/prose/edit/src/guidance-on-size.md b/csaf_2.1/prose/edit/src/guidance-on-size.md
index 8cfead215..0dd90edb6 100644
--- a/csaf_2.1/prose/edit/src/guidance-on-size.md
+++ b/csaf_2.1/prose/edit/src/guidance-on-size.md
@@ -3,20 +3,20 @@
 toc:
   auto: false
   label: Guidance on the Size of CSAF Documents
-  enumerate: Appendix C.
+  enumerate: Appendix F.
   children:
   - label: File size
-    enumerate: C.1
+    enumerate: F.1
   - label: Array length
-    enumerate: C.2
+    enumerate: F.2
   - label: String length
-    enumerate: C.3
+    enumerate: F.3
   - label: URI length
-    enumerate: C.4
+    enumerate: F.4
   - label: Enum
-    enumerate: C.5
+    enumerate: F.5
   - label: Date
-    enumerate: C.6
+    enumerate: F.6
 ---
 -->
 # Guidance on the Size of CSAF Documents
@@ -33,7 +33,7 @@ All _CSAF producers_ SHOULD NOT produce CSAF documents which exceed those limits
 
 > If you come across a case where these limits are exceeded, please provide feedback to the TC.
 
-## File size
+## File Size
 
 A CSAF document in the specified JSON format encoded in UTF-8 SHOULD conform to known size limits of current technologies parsing JSON content,
 e.g.: 50 MiB.
@@ -46,235 +46,314 @@ e.g.: 50 MiB.
 > In addition, the BSON format adds length information for the entries inside the document,
 > which adds to the size when storing CSAF document content in a BSON format.
 
-## Array length
-
-An array SHOULD NOT have more than:
-
-* 10 000 items for
-  * `/document/acknowledgments`
-  * `/document/acknowledgments[]/names`
-  * `/document/acknowledgments[]/urls`
-  * `/document/tracking/aliases`
-  * `/product_tree/branches[]/product/product_identification_helper/hashes`
-  * `/product_tree/branches[]/product/product_identification_helper/hashes[]/file_hashes`
-  * `/product_tree/branches[]/product/product_identification_helper/sbom_urls`
-  * `/product_tree/branches[]/product/product_identification_helper/x_generic_uris`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/sbom_urls`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris`
-  * `/product_tree/full_product_names[]/product_identification_helper/hashes`
-  * `/product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes`
-  * `/product_tree/full_product_names[]/product_identification_helper/sbom_urls`
-  * `/product_tree/full_product_names[]/product_identification_helper/x_generic_uris`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/sbom_urls`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris`
-  * `/vulnerabilities[]/acknowledgments`
-  * `/vulnerabilities[]/acknowledgments[]/names`
-  * `/vulnerabilities[]/acknowledgments[]/urls`
-  * `/vulnerabilities[]/cwes`
-  * `/vulnerabilities[]/ids`
-  * `/vulnerabilities[]/remediations[]/entitlements`
-
-* 40 000 items for
-  * `/document/notes`
-  * `/document/references`
-  * `/vulnerabilities[]/involvements`
-  * `/vulnerabilities[]/notes`
-  * `/vulnerabilities[]/references`
-
-* 100 000 for
-  * `/document/tracking/revision_history`
-  * `/product_tree/branches`
-  * `/product_tree(/branches[])*/branches`
-  * `/product_tree/branches[]/product/product_identification_helper/model_numbers`
-  * `/product_tree/branches[]/product/product_identification_helper/serial_numbers`
-  * `/product_tree/branches[]/product/product_identification_helper/skus`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/model_numbers`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/serial_numbers`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/skus`
-  * `/product_tree/full_product_names`
-  * `/product_tree/full_product_names[]/product_identification_helper/model_numbers`
-  * `/product_tree/full_product_names[]/product_identification_helper/serial_numbers`
-  * `/product_tree/full_product_names[]/product_identification_helper/skus`
-  * `/product_tree/product_groups[]/product_ids`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/model_numbers`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/serial_numbers`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/skus`
-  * `/vulnerabilities`
-
-* 10 000 000 for
-  * `/product_tree/relationships`
-  * `/product_tree/product_groups`
-  * `/vulnerabilities[]/remediations[]/group_ids`
-
-* 100 000 000 for
-  * `/vulnerabilities[]/flags`
-  * `/vulnerabilities[]/flags[]/group_ids`
-  * `/vulnerabilities[]/flags[]/product_ids`
-  * `/vulnerabilities[]/product_status/first_affected`
-  * `/vulnerabilities[]/product_status/first_fixed`
-  * `/vulnerabilities[]/product_status/fixed`
-  * `/vulnerabilities[]/product_status/known_affected`
-  * `/vulnerabilities[]/product_status/known_not_affected`
-  * `/vulnerabilities[]/product_status/last_affected`
-  * `/vulnerabilities[]/product_status/recommended`
-  * `/vulnerabilities[]/product_status/under_investigation`
-  * `/vulnerabilities[]/remediations`
-  * `/vulnerabilities[]/remediations[]/product_ids`
-  * `/vulnerabilities[]/metrics`
-  * `/vulnerabilities[]/metrics[]/products`
-  * `/vulnerabilities[]/threats`
-  * `/vulnerabilities[]/threats[]/group_ids`
-  * `/vulnerabilities[]/threats[]/product_ids`
-
-## String length
-
-A string SHOULD NOT have a length greater than:
-
-* 1000 for
-  * `/document/acknowledgments[]/names[]`
-  * `/document/acknowledgments[]/organization`
-  * `/document/aggregate_severity/text`
-  * `/document/category`
-  * `/document/lang`
-  * `/document/notes[]/audience`
-  * `/document/notes[]/title`
-  * `/document/publisher/name`
-  * `/document/source_lang`
-  * `/document/title`
-  * `/document/tracking/aliases[]`
-  * `/document/tracking/generator/engine/name`
-  * `/document/tracking/generator/engine/version`
-  * `/document/tracking/id`
-  * `/document/tracking/revision_history[]/legacy_version`
-  * `/document/tracking/revision_history[]/number`
-  * `/document/tracking/version`
-  * `/product_tree/branches[]/name`
-  * `/product_tree/branches[]/product/name`
-  * `/product_tree/branches[]/product/product_id`
-  * `/product_tree/branches[]/product/product_identification_helper/hashes[]/file_hashes[]/algorithm`
-  * `/product_tree/branches[]/product/product_identification_helper/hashes[]/file_hashes[]/value`
-  * `/product_tree/branches[]/product/product_identification_helper/hashes[]/filename`
-  * `/product_tree/branches[]/product/product_identification_helper/model_numbers[]`
-  * `/product_tree/branches[]/product/product_identification_helper/serial_numbers[]`
-  * `/product_tree/branches[]/product/product_identification_helper/skus[]`
-  * `/product_tree/branches[](/branches[])*/name`
-  * `/product_tree/branches[](/branches[])*/product/name`
-  * `/product_tree/branches[](/branches[])*/product/product_id`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes[]/algorithm`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes[]/value`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/filename`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/model_numbers[]`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/serial_numbers[]`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/skus[]`
-  * `/product_tree/full_product_names[]/name`
-  * `/product_tree/full_product_names[]/product_id`
-  * `/product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes[]/algorithm`
-  * `/product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes[]/value`
-  * `/product_tree/full_product_names[]/product_identification_helper/hashes[]/filename`
-  * `/product_tree/full_product_names[]/product_identification_helper/model_numbers[]`
-  * `/product_tree/full_product_names[]/product_identification_helper/serial_numbers[]`
-  * `/product_tree/full_product_names[]/product_identification_helper/skus[]`
-  * `/product_tree/product_groups[]/group_id`
-  * `/product_tree/product_groups[]/product_ids[]`
-  * `/product_tree/relationships[]/full_product_name/name`
-  * `/product_tree/relationships[]/full_product_name/product_id`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes[]/algorithm`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes[]/value`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/filename`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/model_numbers[]`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/serial_numbers[]`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/skus[]`
-  * `/product_tree/relationships[]/product_reference`
-  * `/product_tree/relationships[]/relates_to_product_reference`
-  * `/vulnerabilities[]/acknowledgments[]/names[]`
-  * `/vulnerabilities[]/acknowledgments[]/organization`
-  * `/vulnerabilities[]/cve`
-  * `/vulnerabilities[]/cwes[]/id`
-  * `/vulnerabilities[]/cwes[]/name`
-  * `/vulnerabilities[]/cwes[]/version`
-  * `/vulnerabilities[]/flags[]/group_ids[]`
-  * `/vulnerabilities[]/flags[]/product_ids[]`
-  * `/vulnerabilities[]/ids[]/system_name`
-  * `/vulnerabilities[]/ids[]/text`
-  * `/vulnerabilities[]/notes[]/audience`
-  * `/vulnerabilities[]/notes[]/title`
-  * `/vulnerabilities[]/product_status/first_affected[]`
-  * `/vulnerabilities[]/product_status/first_fixed[]`
-  * `/vulnerabilities[]/product_status/fixed[]`
-  * `/vulnerabilities[]/product_status/known_affected[]`
-  * `/vulnerabilities[]/product_status/known_not_affected[]`
-  * `/vulnerabilities[]/product_status/last_affected[]`
-  * `/vulnerabilities[]/product_status/recommended[]`
-  * `/vulnerabilities[]/product_status/under_investigation[]`
-  * `/vulnerabilities[]/remediations[]/group_ids[]`
-  * `/vulnerabilities[]/remediations[]/product_ids[]`
-  * `/vulnerabilities[]/metrics[]/content/cvss_v2/vectorString`
-  * `/vulnerabilities[]/metrics[]/content/cvss_v3/vectorString`
-  * `/vulnerabilities[]/metrics[]/content/cvss_v4/vectorString`
-  * `/vulnerabilities[]/scores[]/products[]`
-  * `/vulnerabilities[]/threats[]/group_ids[]`
-  * `/vulnerabilities[]/threats[]/product_ids[]`
-  * `/vulnerabilities[]/title`
-
-* 10 000 for
-  * `/document/acknowledgments[]/summary`
-  * `/document/distribution/text`
-  * `/document/publisher/contact_details`
-  * `/document/publisher/issuing_authority`
-  * `/document/references[]/summary`
-  * `/document/tracking/revision_history[]/summary`
-  * `/product_tree/branches[]/product/product_identification_helper/cpe`
-  * `/product_tree/branches[]/product/product_identification_helper/purl`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/cpe`
-  * `/product_tree/branches[](/branches[])*/product/product_identification_helper/purl`
-  * `/product_tree/full_product_names[]/product_identification_helper/cpe`
-  * `/product_tree/full_product_names[]/product_identification_helper/purl`
-  * `/product_tree/product_groups[]/summary`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/cpe`
-  * `/product_tree/relationships[]/full_product_name/product_identification_helper/purl`
-  * `/vulnerabilities[]/acknowledgments[]/summary`
-  * `/vulnerabilities[]/involvements[]/summary`
-  * `/vulnerabilities[]/references[]/summary`
-  * `/vulnerabilities[]/remediations[]/entitlements[]`
-
-* 30 000 for
-  * `/document/notes[]/text`
-  * `/vulnerabilities[]/notes[]/text`
-
-* 250 000 for
-  * `/vulnerabilities[]/remediations[]/details`
-  * `/vulnerabilities[]/remediations[]/restart_required/details`
-  * `/vulnerabilities[]/threats[]/details`
-
-## URI length
+## Array Length
+
+  > For the significance of the left pointing arrow character (`←`) at the end of lines in the following path listings please
+  > cf. the guidance in section [sec](#typographical-conventions).
+
+An array SHOULD NOT have more than 10 000 items for:
+
+```
+/document/acknowledgments<>
+/document/acknowledgments[]/names
+/document/acknowledgments[]/urls
+/document/tracking/aliases
+/product_tree/branches[]/product/product_identification_helper/hashes
+/product_tree/branches[]/product/product_identification_helper/hashes[]/←
+file_hashes
+/product_tree/branches[]/product/product_identification_helper/sbom_urls
+/product_tree/branches[]/product/product_identification_helper/x_generic_uris
+/product_tree/branches[](/branches[])*/product/product_identification_helper/←
+hashes
+/product_tree/branches[](/branches[])*/product/product_identification_helper/←
+hashes[]/file_hashes
+/product_tree/branches[](/branches[])*/product/product_identification_helper/←
+sbom_urls
+/product_tree/branches[](/branches[])*/product/product_identification_helper/←
+x_generic_uris
+/product_tree/full_product_names[]/product_identification_helper/hashes
+/product_tree/full_product_names[]/product_identification_helper/hashes[]/←
+file_hashes
+/product_tree/full_product_names[]/product_identification_helper/sbom_urls
+/product_tree/full_product_names[]/product_identification_helper/x_generic_uris
+/product_tree/relationships[]/full_product_name/product_identification_helper/←
+hashes
+/product_tree/relationships[]/full_product_name/product_identification_helper/←
+hashes[]/file_hashes
+/product_tree/relationships[]/full_product_name/product_identification_helper/←
+sbom_urls
+/product_tree/relationships[]/full_product_name/product_identification_helper/←
+x_generic_uris
+/vulnerabilities[]/acknowledgments
+/vulnerabilities[]/acknowledgments[]/names
+/vulnerabilities[]/acknowledgments[]/urls
+/vulnerabilities[]/cwes
+/vulnerabilities[]/ids
+/vulnerabilities[]/remediations[]/entitlements
+```
+
+An array SHOULD NOT have more than 40 000 items for:
+
+```
+/document/notes
+/document/references
+/vulnerabilities[]/involvements
+/vulnerabilities[]/notes
+/vulnerabilities[]/references
+```
+
+An array SHOULD NOT have more than 100 000 items for:
+
+```
+/document/tracking/revision_history
+/product_tree/branches
+/product_tree(/branches[])*/branches
+/product_tree/branches[]/product/product_identification_helper/model_numbers
+/product_tree/branches[]/product/product_identification_helper/serial_numbers
+/product_tree/branches[]/product/product_identification_helper/skus
+/product_tree/branches[](/branches[])*/product/product_identification_helper/←
+model_numbers
+/product_tree/branches[](/branches[])*/product/product_identification_helper/←
+serial_numbers
+/product_tree/branches[](/branches[])*/product/product_identification_helper/←
+skus
+/product_tree/full_product_names
+/product_tree/full_product_names[]/product_identification_helper/model_numbers
+/product_tree/full_product_names[]/product_identification_helper/serial_numbers
+/product_tree/full_product_names[]/product_identification_helper/skus
+/product_tree/product_groups[]/product_ids
+/product_tree/relationships[]/full_product_name/product_identification_helper/←
+model_numbers
+/product_tree/relationships[]/full_product_name/product_identification_helper/←
+serial_numbers
+/product_tree/relationships[]/full_product_name/product_identification_helper/←
+skus
+/vulnerabilities
+```
+
+An array SHOULD NOT have more than 10 000 000 items for:
+
+```
+/product_tree/relationships
+/product_tree/product_groups
+/vulnerabilities[]/remediations[]/group_ids
+```
+
+An array SHOULD NOT have more than 100 000 000 items for:
+
+```
+/vulnerabilities[]/flags
+/vulnerabilities[]/flags[]/group_ids
+/vulnerabilities[]/flags[]/product_ids
+/vulnerabilities[]/product_status/first_affected
+/vulnerabilities[]/product_status/first_fixed
+/vulnerabilities[]/product_status/fixed
+/vulnerabilities[]/product_status/known_affected
+/vulnerabilities[]/product_status/known_not_affected
+/vulnerabilities[]/product_status/last_affected
+/vulnerabilities[]/product_status/recommended
+/vulnerabilities[]/product_status/under_investigation
+/vulnerabilities[]/remediations
+/vulnerabilities[]/remediations[]/product_ids
+/vulnerabilities[]/metrics
+/vulnerabilities[]/metrics[]/products
+/vulnerabilities[]/threats
+/vulnerabilities[]/threats[]/group_ids
+/vulnerabilities[]/threats[]/product_ids
+```
+
+## String Length
+
+  > For the significance of the left pointing arrow character (`←`) at the end of lines in the following path listings please
+  > cf. the guidance in section [sec](#typographical-conventions).
+
+A string SHOULD NOT have a length greater than 1000 for:
+
+```
+/document/acknowledgments[]/names[]
+/document/acknowledgments[]/organization
+/document/aggregate_severity/text
+/document/category
+/document/lang
+/document/notes[]/audience
+/document/notes[]/title
+/document/publisher/name
+/document/source_lang
+/document/title
+/document/tracking/aliases[]
+/document/tracking/generator/engine/name
+/document/tracking/generator/engine/version
+/document/tracking/id
+/document/tracking/revision_history[]/legacy_version
+/document/tracking/revision_history[]/number
+/document/tracking/version
+/product_tree/branches[]/name
+/product_tree/branches[]/product/name
+/product_tree/branches[]/product/product_id
+/product_tree/branches[]/product/product_identification_helper/hashes[]/←
+file_hashes[]/algorithm
+/product_tree/branches[]/product/product_identification_helper/hashes[]/←
+file_hashes[]/value
+/product_tree/branches[]/product/product_identification_helper/hashes[]/←
+filename
+/product_tree/branches[]/product/product_identification_helper/model_numbers[]
+/product_tree/branches[]/product/product_identification_helper/serial_numbers[]
+/product_tree/branches[]/product/product_identification_helper/skus[]
+/product_tree/branches[](/branches[])*/name
+/product_tree/branches[](/branches[])*/product/name
+/product_tree/branches[](/branches[])*/product/product_id
+/product_tree/branches[](/branches[])*/product/product_identification_helper/←
+hashes[]/file_hashes[]/algorithm
+/product_tree/branches[](/branches[])*/product/product_identification_helper/←
+hashes[]/file_hashes[]/value
+/product_tree/branches[](/branches[])*/product/product_identification_helper/←
+hashes[]/filename
+/product_tree/branches[](/branches[])*/product/product_identification_helper/←
+model_numbers[]
+/product_tree/branches[](/branches[])*/product/product_identification_helper/←
+serial_numbers[]
+/product_tree/branches[](/branches[])*/product/product_identification_helper/←
+skus[]
+/product_tree/full_product_names[]/name
+/product_tree/full_product_names[]/product_id
+/product_tree/full_product_names[]/product_identification_helper/hashes[]/←
+file_hashes[]/algorithm
+/product_tree/full_product_names[]/product_identification_helper/hashes[]/←
+file_hashes[]/value
+/product_tree/full_product_names[]/product_identification_helper/hashes[]/←
+filename
+/product_tree/full_product_names[]/product_identification_helper/model_numbers[]
+/product_tree/full_product_names[]/product_identification_helper/serial_numbers[]
+/product_tree/full_product_names[]/product_identification_helper/skus[]
+/product_tree/product_groups[]/group_id
+/product_tree/product_groups[]/product_ids[]
+/product_tree/relationships[]/full_product_name/name
+/product_tree/relationships[]/full_product_name/product_id
+/product_tree/relationships[]/full_product_name/product_identification_helper/←
+hashes[]/file_hashes[]/algorithm
+/product_tree/relationships[]/full_product_name/product_identification_helper/←
+hashes[]/file_hashes[]/value
+/product_tree/relationships[]/full_product_name/product_identification_helper/←
+hashes[]/filename
+/product_tree/relationships[]/full_product_name/product_identification_helper/←
+model_numbers[]
+/product_tree/relationships[]/full_product_name/product_identification_helper/←
+serial_numbers[]
+/product_tree/relationships[]/full_product_name/product_identification_helper/←
+skus[]
+/product_tree/relationships[]/product_reference
+/product_tree/relationships[]/relates_to_product_reference
+/vulnerabilities[]/acknowledgments[]/names[]
+/vulnerabilities[]/acknowledgments[]/organization
+/vulnerabilities[]/cve
+/vulnerabilities[]/cwes[]/id
+/vulnerabilities[]/cwes[]/name
+/vulnerabilities[]/cwes[]/version
+/vulnerabilities[]/flags[]/group_ids[]
+/vulnerabilities[]/flags[]/product_ids[]
+/vulnerabilities[]/ids[]/system_name
+/vulnerabilities[]/ids[]/text
+/vulnerabilities[]/notes[]/audience
+/vulnerabilities[]/notes[]/title
+/vulnerabilities[]/product_status/first_affected[]
+/vulnerabilities[]/product_status/first_fixed[]
+/vulnerabilities[]/product_status/fixed[]
+/vulnerabilities[]/product_status/known_affected[]
+/vulnerabilities[]/product_status/known_not_affected[]
+/vulnerabilities[]/product_status/last_affected[]
+/vulnerabilities[]/product_status/recommended[]
+/vulnerabilities[]/product_status/under_investigation[]
+/vulnerabilities[]/remediations[]/group_ids[]
+/vulnerabilities[]/remediations[]/product_ids[]
+/vulnerabilities[]/metrics[]/content/cvss_v2/vectorString
+/vulnerabilities[]/metrics[]/content/cvss_v3/vectorString
+/vulnerabilities[]/metrics[]/content/cvss_v4/vectorString
+/vulnerabilities[]/scores[]/products[]
+/vulnerabilities[]/threats[]/group_ids[]
+/vulnerabilities[]/threats[]/product_ids[]
+/vulnerabilities[]/title
+```
+
+A string SHOULD NOT have a length greater than 10 000 for:
+
+```
+/document/acknowledgments[]/summary
+/document/distribution/text
+/document/publisher/contact_details
+/document/publisher/issuing_authority
+/document/references[]/summary
+/document/tracking/revision_history[]/summary
+/product_tree/branches[]/product/product_identification_helper/cpe
+/product_tree/branches[]/product/product_identification_helper/purl
+/product_tree/branches[](/branches[])*/product/product_identification_helper/cpe
+/product_tree/branches[](/branches[])*/product/product_identification_helper/purl
+/product_tree/full_product_names[]/product_identification_helper/cpe
+/product_tree/full_product_names[]/product_identification_helper/purl
+/product_tree/product_groups[]/summary
+/product_tree/relationships[]/full_product_name/product_identification_helper/cpe
+/product_tree/relationships[]/full_product_name/product_identification_helper/purl
+/vulnerabilities[]/acknowledgments[]/summary
+/vulnerabilities[]/involvements[]/summary
+/vulnerabilities[]/references[]/summary
+/vulnerabilities[]/remediations[]/entitlements[]
+```
+
+A string SHOULD NOT have a length greater than 30 000 for:
+
+```
+/document/notes[]/text
+/vulnerabilities[]/notes[]/text
+```
+
+A string SHOULD NOT have a length greater than 250 000 for:
+
+```
+/vulnerabilities[]/remediations[]/details
+/vulnerabilities[]/remediations[]/restart_required/details
+/vulnerabilities[]/threats[]/details
+```
+
+## URI Length
+
+  > For the significance of the left pointing arrow character (`←`) at the end of lines in the following path listing please
+  > cf. the guidance in section [sec](#typographical-conventions).
 
 A string with format `uri` SHOULD NOT have a length greater than 20000. This applies to:
 
-* `/document/acknowledgments[]/urls[]`
-* `/document/aggregate_severity/namespace`
-* `/document/distribution/tlp/url`
-* `/document/references[]/url`
-* `/document/publisher/namespace`
-* `/product_tree/branches[]/product/product_identification_helper/sbom_urls[]`
-* `/product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/namespace`
-* `/product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/uri`
-* `/product_tree/branches[](/branches[])*/product/product_identification_helper/sbom_urls[]`
-* `/product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris[]/namespace`
-* `/product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris[]/uri`
-* `/product_tree/full_product_names[]/product_identification_helper/sbom_urls[]`
-* `/product_tree/full_product_names[]/product_identification_helper/x_generic_uris[]/namespace`
-* `/product_tree/full_product_names[]/product_identification_helper/x_generic_uris[]/uri`
-* `/product_tree/relationships[]/full_product_name/product_identification_helper/sbom_urls[]`
-* `/product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris[]/namespace`
-* `/product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris[]/uri`
-* `/vulnerabilities[]/acknowledgments[]/urls[]`
-* `/vulnerabilities[]/metrics[]/source`
-* `/vulnerabilities[]/references[]/url`
-* `/vulnerabilities[]/remediations[]/url`
+```
+/document/acknowledgments[]/urls[]
+/document/aggregate_severity/namespace
+/document/distribution/tlp/url
+/document/references[]/url
+/document/publisher/namespace
+/product_tree/branches[]/product/product_identification_helper/sbom_urls[]
+/product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/←
+namespace
+/product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/←
+uri
+/product_tree/branches[](/branches[])*/product/product_identification_helper/←
+sbom_urls[]
+/product_tree/branches[](/branches[])*/product/product_identification_helper/←
+x_generic_uris[]/namespace
+/product_tree/branches[](/branches[])*/product/product_identification_helper/←
+x_generic_uris[]/uri
+/product_tree/full_product_names[]/product_identification_helper/←
+sbom_urls[]
+/product_tree/full_product_names[]/product_identification_helper/←
+x_generic_uris[]/namespace
+/product_tree/full_product_names[]/product_identification_helper/←
+x_generic_uris[]/uri
+/product_tree/relationships[]/full_product_name/product_identification_helper/←
+sbom_urls[]
+/product_tree/relationships[]/full_product_name/product_identification_helper/←
+x_generic_uris[]/namespace
+/product_tree/relationships[]/full_product_name/product_identification_helper/←
+x_generic_uris[]/uri
+/vulnerabilities[]/acknowledgments[]/urls[]
+/vulnerabilities[]/metrics[]/source
+/vulnerabilities[]/references[]/url
+/vulnerabilities[]/remediations[]/url
+```
 
 ## Enum
 
@@ -289,114 +368,118 @@ It seems to be safe to assume that the length of this value is not greater than
 * `/$schema` (64)
 
 For all other values, it seems to be safe to assume that the length of each value is not greater than 50.
-This applies to:
-
-* `/document/csaf_version` (3)
-* `/document/distribution/tlp/label` (12)
-* `/document/notes[]/category` (16)
-* `/document/publisher/category` (11)
-* `/document/references[]/category` (8)
-* `/document/tracking/status` (7)
-* `/product_tree/branches[]/category` (15)
-* `/product_tree/branches[](/branches[])*/category` (15)
-* `/product_tree/relationships[]/category` (21)
-* `/vulnerabilities[]/flags[]/label` (49)
-* `/vulnerabilities[]/involvements[]/party` (11)
-* `/vulnerabilities[]/involvements[]/status` (17)
-* `/vulnerabilities[]/notes[]/category` (16)
-* `/vulnerabilities[]/references[]/category` (8)
-* `/vulnerabilities[]/remediations[]/category` (14)
-* `/vulnerabilities[]/remediations[]/restart_required/category` (20)
-* `/vulnerabilities[]/metrics[]/content/cvss_v2/version` (3)
-* `/vulnerabilities[]/metrics[]/content/cvss_v2/accessVector` (16)
-* `/vulnerabilities[]/metrics[]/content/cvss_v2/accessComplexity` (6)
-* `/vulnerabilities[]/metrics[]/content/cvss_v2/authentication` (8)
-* `/vulnerabilities[]/metrics[]/content/cvss_v2/confidentialityImpact` (8)
-* `/vulnerabilities[]/metrics[]/content/cvss_v2/integrityImpact` (8)
-* `/vulnerabilities[]/metrics[]/content/cvss_v2/availabilityImpact` (8)
-* `/vulnerabilities[]/metrics[]/content/cvss_v2/exploitability` (16)
-* `/vulnerabilities[]/metrics[]/content/cvss_v2/remediationLevel` (13)
-* `/vulnerabilities[]/metrics[]/content/cvss_v2/reportConfidence` (14)
-* `/vulnerabilities[]/metrics[]/content/cvss_v2/collateralDamagePotential` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v2/targetDistribution` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v2/confidentialityRequirement` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v2/integrityRequirement` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v2/availabilityRequirement` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v3/version` (3)
-* `/vulnerabilities[]/metrics[]/content/cvss_v3/attackVector` (16)
-* `/vulnerabilities[]/metrics[]/content/cvss_v3/attackComplexity` (4)
-* `/vulnerabilities[]/metrics[]/content/cvss_v3/privilegesRequired` (4)
-* `/vulnerabilities[]/metrics[]/content/cvss_v3/userInteraction` (8)
-* `/vulnerabilities[]/metrics[]/content/cvss_v3/scope` (9)
-* `/vulnerabilities[]/metrics[]/content/cvss_v3/confidentialityImpact` (4)
-* `/vulnerabilities[]/metrics[]/content/cvss_v3/integrityImpact` (4)
-* `/vulnerabilities[]/metrics[]/content/cvss_v3/availabilityImpact` (4)
-* `/vulnerabilities[]/metrics[]/content/cvss_v3/baseSeverity` (8)
-* `/vulnerabilities[]/metrics[]/content/cvss_v3/exploitCodeMaturity` (16)
-* `/vulnerabilities[]/metrics[]/content/cvss_v3/remediationLevel` (13)
-* `/vulnerabilities[]/metrics[]/content/cvss_v3/reportConfidence` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v3/temporalSeverity` (8)
-* `/vulnerabilities[]/metrics[]/content/cvss_v3/confidentialityRequirement` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v3/integrityRequirement` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v3/availabilityRequirement` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v3/modifiedAttackVector` (16)
-* `/vulnerabilities[]/metrics[]/content/cvss_v3/modifiedAttackComplexity` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v3/modifiedPrivilegesRequired` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v3/modifiedUserInteraction` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v3/modifiedScope` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v3/modifiedConfidentialityImpact` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v3/modifiedIntegrityImpact` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v3/modifiedAvailabilityImpact` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v3/environmentalSeverity` (8)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/version` (3)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/attackVector` (8)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/attackComplexity` (4)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/attackRequirements` (7)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/privilegesRequired` (4)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/userInteraction` (7)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/vulnConfidentialityImpact` (4)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/vulnIntegrityImpact` (4)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/vulnAvailabilityImpact` (4)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/subConfidentialityImpact` (4)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/subIntegrityImpact` (4)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/subAvailabilityImpact` (4)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/exploitMaturity` (16)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/confidentialityRequirement` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/integrityRequirement` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/availabilityRequirement` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/modifiedAttackVector` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/modifiedAttackComplexity` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/modifiedAttackRequirements` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/modifiedPrivilegesRequired` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/modifiedUserInteraction` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/modifiedVulnConfidentialityImpact` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/modifiedVulnIntegrityImpact` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/modifiedVulnAvailabilityImpact` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/modifiedSubConfidentialityImpact` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/modifiedSubIntegrityImpact` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/modifiedSubAvailabilityImpact` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/Safety` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/Automatable` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/Recovery` (13)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/valueDensity` (12)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/vulnerabilityResponseEffort` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/providerUrgency` (11)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/baseSeverity` (8)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/threatSeverity` (8)
-* `/vulnerabilities[]/metrics[]/content/cvss_v4/environmentalSeverity` (8)
-* `/vulnerabilities[]/threats[]/category` (14)
+This applies to (the length given in parentheses following the path):
+
+```
+/document/csaf_version (3)
+/document/distribution/tlp/label (12)
+/document/notes[]/category (16)
+/document/publisher/category (11)
+/document/references[]/category (8)
+/document/tracking/status (7)
+/product_tree/branches[]/category (15)
+/product_tree/branches[](/branches[])*/category (15)
+/product_tree/relationships[]/category (21)
+/vulnerabilities[]/flags[]/label (49)
+/vulnerabilities[]/involvements[]/party (11)
+/vulnerabilities[]/involvements[]/status (17)
+/vulnerabilities[]/notes[]/category (16)
+/vulnerabilities[]/references[]/category (8)
+/vulnerabilities[]/remediations[]/category (14)
+/vulnerabilities[]/remediations[]/restart_required/category (20)
+/vulnerabilities[]/metrics[]/content/cvss_v2/version (3)
+/vulnerabilities[]/metrics[]/content/cvss_v2/accessVector (16)
+/vulnerabilities[]/metrics[]/content/cvss_v2/accessComplexity (6)
+/vulnerabilities[]/metrics[]/content/cvss_v2/authentication (8)
+/vulnerabilities[]/metrics[]/content/cvss_v2/confidentialityImpact (8)
+/vulnerabilities[]/metrics[]/content/cvss_v2/integrityImpact (8)
+/vulnerabilities[]/metrics[]/content/cvss_v2/availabilityImpact (8)
+/vulnerabilities[]/metrics[]/content/cvss_v2/exploitability (16)
+/vulnerabilities[]/metrics[]/content/cvss_v2/remediationLevel (13)
+/vulnerabilities[]/metrics[]/content/cvss_v2/reportConfidence (14)
+/vulnerabilities[]/metrics[]/content/cvss_v2/collateralDamagePotential (11)
+/vulnerabilities[]/metrics[]/content/cvss_v2/targetDistribution (11)
+/vulnerabilities[]/metrics[]/content/cvss_v2/confidentialityRequirement (11)
+/vulnerabilities[]/metrics[]/content/cvss_v2/integrityRequirement (11)
+/vulnerabilities[]/metrics[]/content/cvss_v2/availabilityRequirement (11)
+/vulnerabilities[]/metrics[]/content/cvss_v3/version (3)
+/vulnerabilities[]/metrics[]/content/cvss_v3/attackVector (16)
+/vulnerabilities[]/metrics[]/content/cvss_v3/attackComplexity (4)
+/vulnerabilities[]/metrics[]/content/cvss_v3/privilegesRequired (4)
+/vulnerabilities[]/metrics[]/content/cvss_v3/userInteraction (8)
+/vulnerabilities[]/metrics[]/content/cvss_v3/scope (9)
+/vulnerabilities[]/metrics[]/content/cvss_v3/confidentialityImpact (4)
+/vulnerabilities[]/metrics[]/content/cvss_v3/integrityImpact (4)
+/vulnerabilities[]/metrics[]/content/cvss_v3/availabilityImpact (4)
+/vulnerabilities[]/metrics[]/content/cvss_v3/baseSeverity (8)
+/vulnerabilities[]/metrics[]/content/cvss_v3/exploitCodeMaturity (16)
+/vulnerabilities[]/metrics[]/content/cvss_v3/remediationLevel (13)
+/vulnerabilities[]/metrics[]/content/cvss_v3/reportConfidence (11)
+/vulnerabilities[]/metrics[]/content/cvss_v3/temporalSeverity (8)
+/vulnerabilities[]/metrics[]/content/cvss_v3/confidentialityRequirement (11)
+/vulnerabilities[]/metrics[]/content/cvss_v3/integrityRequirement (11)
+/vulnerabilities[]/metrics[]/content/cvss_v3/availabilityRequirement (11)
+/vulnerabilities[]/metrics[]/content/cvss_v3/modifiedAttackVector (16)
+/vulnerabilities[]/metrics[]/content/cvss_v3/modifiedAttackComplexity (11)
+/vulnerabilities[]/metrics[]/content/cvss_v3/modifiedPrivilegesRequired (11)
+/vulnerabilities[]/metrics[]/content/cvss_v3/modifiedUserInteraction (11)
+/vulnerabilities[]/metrics[]/content/cvss_v3/modifiedScope (11)
+/vulnerabilities[]/metrics[]/content/cvss_v3/modifiedConfidentialityImpact (11)
+/vulnerabilities[]/metrics[]/content/cvss_v3/modifiedIntegrityImpact (11)
+/vulnerabilities[]/metrics[]/content/cvss_v3/modifiedAvailabilityImpact (11)
+/vulnerabilities[]/metrics[]/content/cvss_v3/environmentalSeverity (8)
+/vulnerabilities[]/metrics[]/content/cvss_v4/version (3)
+/vulnerabilities[]/metrics[]/content/cvss_v4/attackVector (8)
+/vulnerabilities[]/metrics[]/content/cvss_v4/attackComplexity (4)
+/vulnerabilities[]/metrics[]/content/cvss_v4/attackRequirements (7)
+/vulnerabilities[]/metrics[]/content/cvss_v4/privilegesRequired (4)
+/vulnerabilities[]/metrics[]/content/cvss_v4/userInteraction (7)
+/vulnerabilities[]/metrics[]/content/cvss_v4/vulnConfidentialityImpact (4)
+/vulnerabilities[]/metrics[]/content/cvss_v4/vulnIntegrityImpact (4)
+/vulnerabilities[]/metrics[]/content/cvss_v4/vulnAvailabilityImpact (4)
+/vulnerabilities[]/metrics[]/content/cvss_v4/subConfidentialityImpact (4)
+/vulnerabilities[]/metrics[]/content/cvss_v4/subIntegrityImpact (4)
+/vulnerabilities[]/metrics[]/content/cvss_v4/subAvailabilityImpact (4)
+/vulnerabilities[]/metrics[]/content/cvss_v4/exploitMaturity (16)
+/vulnerabilities[]/metrics[]/content/cvss_v4/confidentialityRequirement (11)
+/vulnerabilities[]/metrics[]/content/cvss_v4/integrityRequirement (11)
+/vulnerabilities[]/metrics[]/content/cvss_v4/availabilityRequirement (11)
+/vulnerabilities[]/metrics[]/content/cvss_v4/modifiedAttackVector (11)
+/vulnerabilities[]/metrics[]/content/cvss_v4/modifiedAttackComplexity (11)
+/vulnerabilities[]/metrics[]/content/cvss_v4/modifiedAttackRequirements (11)
+/vulnerabilities[]/metrics[]/content/cvss_v4/modifiedPrivilegesRequired (11)
+/vulnerabilities[]/metrics[]/content/cvss_v4/modifiedUserInteraction (11)
+/vulnerabilities[]/metrics[]/content/cvss_v4/modifiedVulnConfidentialityImpact (11)
+/vulnerabilities[]/metrics[]/content/cvss_v4/modifiedVulnIntegrityImpact (11)
+/vulnerabilities[]/metrics[]/content/cvss_v4/modifiedVulnAvailabilityImpact (11)
+/vulnerabilities[]/metrics[]/content/cvss_v4/modifiedSubConfidentialityImpact (11)
+/vulnerabilities[]/metrics[]/content/cvss_v4/modifiedSubIntegrityImpact (11)
+/vulnerabilities[]/metrics[]/content/cvss_v4/modifiedSubAvailabilityImpact (11)
+/vulnerabilities[]/metrics[]/content/cvss_v4/Safety (11)
+/vulnerabilities[]/metrics[]/content/cvss_v4/Automatable (11)
+/vulnerabilities[]/metrics[]/content/cvss_v4/Recovery (13)
+/vulnerabilities[]/metrics[]/content/cvss_v4/valueDensity (12)
+/vulnerabilities[]/metrics[]/content/cvss_v4/vulnerabilityResponseEffort (11)
+/vulnerabilities[]/metrics[]/content/cvss_v4/providerUrgency (11)
+/vulnerabilities[]/metrics[]/content/cvss_v4/baseSeverity (8)
+/vulnerabilities[]/metrics[]/content/cvss_v4/threatSeverity (8)
+/vulnerabilities[]/metrics[]/content/cvss_v4/environmentalSeverity (8)
+/vulnerabilities[]/threats[]/category (14)
+```
 
 ## Date
 
 The maximum length of strings representing a temporal value is given by the format specifier. This applies to:
 
-* `/document/tracking/current_release_date`
-* `/document/tracking/generator/date`
-* `/document/tracking/initial_release_date`
-* `/document/tracking/revision_history[]/date`
-* `/vulnerabilities[]/discovery_date`
-* `/vulnerabilities[]/flags[]/date`
-* `/vulnerabilities[]/release_date`
-* `/vulnerabilities[]/involvements[]/date`
-* `/vulnerabilities[]/remediations[]/date`
-* `/vulnerabilities[]/threats[]/date`
+```
+/document/tracking/current_release_date
+/document/tracking/generator/date
+/document/tracking/initial_release_date
+/document/tracking/revision_history[]/date
+/vulnerabilities[]/discovery_date
+/vulnerabilities[]/flags[]/date
+/vulnerabilities[]/release_date
+/vulnerabilities[]/involvements[]/date
+/vulnerabilities[]/remediations[]/date
+/vulnerabilities[]/threats[]/date
+```
diff --git a/csaf_2.1/prose/edit/src/introduction-01-changes-from-earlier-versions.md b/csaf_2.1/prose/edit/src/introduction-01-changes-from-earlier-versions.md
new file mode 100644
index 000000000..9bf76474a
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/introduction-01-changes-from-earlier-versions.md
@@ -0,0 +1,3 @@
+## Changes from Earlier Versions
+
+TBD
diff --git a/csaf_2.1/prose/edit/src/introduction-01-ipr-policy.md b/csaf_2.1/prose/edit/src/introduction-01-ipr-policy.md
deleted file mode 100644
index 7d8640cc1..000000000
--- a/csaf_2.1/prose/edit/src/introduction-01-ipr-policy.md
+++ /dev/null
@@ -1,7 +0,0 @@
-## IPR Policy
-
-This specification is provided under the [Non-Assertion](https://www.oasis-open.org/policies-guidelines/ipr/#Non-Assertion-Mode) Mode of
-the [OASIS IPR Policy](https://www.oasis-open.org/policies-guidelines/ipr/), the mode chosen when the Technical Committee was established.
-For information on whether any patents have been disclosed that may be essential to implementing this specification,
-and any offers of patent licensing terms, please refer to the Intellectual Property Rights section of the TC's
-web page ([https://www.oasis-open.org/committees/csaf/ipr.php](https://www.oasis-open.org/committees/csaf/ipr.php)).
diff --git a/csaf_2.1/prose/edit/src/introduction-02-terminology-glossary.md b/csaf_2.1/prose/edit/src/introduction-02-glossary-data.md
similarity index 100%
rename from csaf_2.1/prose/edit/src/introduction-02-terminology-glossary.md
rename to csaf_2.1/prose/edit/src/introduction-02-glossary-data.md
diff --git a/csaf_2.1/prose/edit/src/introduction-02-glossary.md b/csaf_2.1/prose/edit/src/introduction-02-glossary.md
new file mode 100644
index 000000000..a20c754cd
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/introduction-02-glossary.md
@@ -0,0 +1,3 @@
+## Glossary
+
+For purposes of this document, the following terms and definitions apply:
diff --git a/csaf_2.1/prose/edit/src/introduction-02-terminology.md b/csaf_2.1/prose/edit/src/introduction-02-terminology.md
deleted file mode 100644
index 72f718950..000000000
--- a/csaf_2.1/prose/edit/src/introduction-02-terminology.md
+++ /dev/null
@@ -1,7 +0,0 @@
-## Terminology
-
-The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED",
-"MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [cite](#RFC2119) and [cite](#RFC8174) when,
-and only when, they appear in all capitals, as shown here.
-
-For purposes of this document, the following terms and definitions apply:
diff --git a/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md b/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md
index 19cb00ef1..522b58de3 100644
--- a/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md
+++ b/csaf_2.1/prose/edit/src/introduction-05-typographical-conventions.md
@@ -1,6 +1,6 @@
 ## Typographical Conventions
 
-Keywords defined by this specification use this `monospaced` font.
+Keywords defined by this specification use `this monospaced font` to help distinguish these from common english words.
 
 ```
     Normative source code uses this paragraph style.
@@ -11,9 +11,15 @@ Some sections of this specification are illustrated with non-normative examples
 *Example 1:*
 
 ```
-    Informative examples also use this paragraph style but preceded by the text "Example(s)".
+    Informative examples also use this paragraph style, ←
+    but preceded by the text "Example(s)".
 ```
 
+The left pointing arrow character (`←`) at the end of the first line in the preceding example is inserted only to
+enable the display of code and examples within paged formats.
+Presence of this character indicates that the content of the following line is to be appended by
+(a) replacing that character, and (b) removing any amount of common left space indent of these lines.
+
 All examples in this document are informative only.
 
 All other text is normative unless otherwise labeled e.g. like the following informative comment:
diff --git a/csaf_2.1/prose/edit/src/notices.md b/csaf_2.1/prose/edit/src/notices.md
new file mode 100644
index 000000000..ad48decea
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/notices.md
@@ -0,0 +1,29 @@
+<!--
+---
+toc:
+  auto: false
+  label: Notices
+  enumerate: Appendix E.
+---
+-->
+# Notices
+
+Copyright 2024. All Rights Reserved.
+
+All capitalized terms in the following text have the meanings assigned to them in the OASIS Intellectual Property Rights Policy (the "OASIS IPR Policy"). The full [Policy](https://www.oasis-open.org/policies-guidelines/ipr/) may be found at the OASIS website.
+
+This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published, and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this section are included on all such copies and derivative works. However, this document itself may not be modified in any way, including by removing the copyright notice or references to OASIS, except as needed for the purpose of developing any document or deliverable produced by an OASIS Technical Committee (in which case the rules applicable to copyrights, as set forth in the OASIS IPR Policy, must be followed) or as required to translate it into languages other than English.
+
+The limited permissions granted above are perpetual and will not be revoked by OASIS or its successors or assigns.
+
+This document and the information contained herein is provided on an "AS IS" basis and OASIS DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY OWNERSHIP RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
+
+As stated in the OASIS IPR Policy, the following three paragraphs in brackets apply to OASIS Standards Final Deliverable documents (Committee Specification, Candidate OASIS Standard, OASIS Standard, or Approved Errata).
+
+\[OASIS requests that any OASIS Party or any other party that believes it has patent claims that would necessarily be infringed by implementations of this OASIS Standards Final Deliverable, to notify OASIS TC Administrator and provide an indication of its willingness to grant patent licenses to such patent claims in a manner consistent with the IPR Mode of the OASIS Technical Committee that produced this deliverable.\]
+
+\[OASIS invites any party to contact the OASIS TC Administrator if it is aware of a claim of ownership of any patent claims that would necessarily be infringed by implementations of this OASIS Standards Final Deliverable by a patent holder that is not willing to provide a license to such patent claims in a manner consistent with the IPR Mode of the OASIS Technical Committee that produced this OASIS Standards Final Deliverable. OASIS may include such claims on its website, but disclaims any obligation to do so.\]
+
+\[OASIS takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this OASIS Standards Final Deliverable or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights. Information on OASIS' procedures with respect to rights in any document or deliverable produced by an OASIS Technical Committee can be found on the OASIS website. Copies of claims of rights made available for publication and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this OASIS Standards Final Deliverable, can be obtained from the OASIS TC Administrator. OASIS makes no representation that any information or list of intellectual property rights will at any time be complete, or that any claims in such list are, in fact, Essential Claims.\]
+
+The name "OASIS" is a trademark of [OASIS](https://www.oasis-open.org/), the owner and developer of this specification, and should be used only to refer to the organization and its official outputs. OASIS welcomes reference to, and implementation and use of, specifications, while reserving the right to enforce its marks against misleading uses. Please see https://www.oasis-open.org/policies-guidelines/trademark/ for above guidance.
diff --git a/csaf_2.1/prose/edit/src/profiles.md b/csaf_2.1/prose/edit/src/profiles.md
index d17e5cb88..9cb88dfc0 100644
--- a/csaf_2.1/prose/edit/src/profiles.md
+++ b/csaf_2.1/prose/edit/src/profiles.md
@@ -136,7 +136,9 @@ A CSAF document SHALL fulfill the following requirements to satisfy the profile
     * `/vulnerabilities[]/cve`
     * `/vulnerabilities[]/ids`
   * `/vulnerabilities[]/notes`
+
     > Provides details about the vulnerability.
+
 * For each item in
   * `/vulnerabilities[]/product_status/known_not_affected` an impact statement SHALL exist as machine readable flag
     in `/vulnerabilities[]/flags` or as human readable justification in `/vulnerabilities[]/threats`.
@@ -145,12 +147,15 @@ A CSAF document SHALL fulfill the following requirements to satisfy the profile
   * `/vulnerabilities[]/product_status/known_affected` additional product specific information SHALL be provided
     in `/vulnerabilities[]/remediations` as an action statement.
     Optional, additional information MAY also be provide through `/vulnerabilities[]/notes` and `/vulnerabilities[]/threats`.
+
     > The use of the categories `no_fix_planned` and `none_available` for an action statement is permitted.
+
   > Even though Product status lists Product IDs, Product Group IDs can be used in the `remediations` and `threats` object.
   > However, it MUST be ensured that for each Product ID the required information according to its product status as stated
   > in the two points above is available. This implies that all products with the status `known_not_affected` MUST have an
   > impact statement and all products with the status `known_affected` MUST have additional product specific information
   > regardless of whether that is referenced through the Product ID or a Product Group ID.
+
 * The value of `/document/category` SHALL be `csaf_vex`.
 
 -------
diff --git a/csaf_2.1/prose/edit/src/references.md b/csaf_2.1/prose/edit/src/references.md
new file mode 100644
index 000000000..77202d414
--- /dev/null
+++ b/csaf_2.1/prose/edit/src/references.md
@@ -0,0 +1,171 @@
+<!--
+---
+toc:
+  auto: false
+  label: References
+  enumerate: Appendix A.
+  children:
+  - label: Normative References
+    enumerate: A.1
+  - label: Informative References
+    enumerate: A.2
+---
+-->
+# References
+
+This appendix contains the normative and informative references that are used in this document.
+
+While any hyperlinks included in this appendix were valid at the time of publication, OASIS cannot guarantee their long-term validity.
+
+## Normative References
+
+The following documents are referenced in such a way that some or all of their content constitutes requirements of this document.
+
+JSON-Schema-Core
+:    _JSON Schema: A Media Type for Describing JSON Documents_, draft-bhutton-json-schema-00, December 2020, <https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-00>.
+
+JSON-Schema-Validation
+:    _JSON Schema Validation: A Vocabulary for Structural Validation of JSON_, draft-bhutton-json-schema-validation-00, December 2020, <https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-validation-00>.
+
+JSON-Hyper-Schema
+:    _JSON Hyper-Schema: A Vocabulary for Hypermedia Annotation of JSON_, draft-handrews-json-schema-hyperschema-02, September 2019, <https://json-schema.org/draft/2019-09/json-schema-hypermedia.html>.
+
+Relative-JSON-Pointers
+:    _Relative JSON Pointers_, draft-bhutton-relative-json-pointer-00, December 2020, <https://datatracker.ietf.org/doc/html/draft-bhutton-relative-json-pointer-00>.
+
+RFC2119
+:    Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, <https://www.rfc-editor.org/info/rfc2119>.
+
+RFC7464
+:    Williams, N., "JavaScript Object Notation (JSON) Text Sequences", RFC 7464, DOI 10.17487/RFC7464, February 2015, <https://www.rfc-editor.org/info/rfc7464>.
+
+RFC8174
+:    Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, <https://www.rfc-editor.org/info/rfc8174>.
+
+RFC8259
+:    T. Bray, Ed., "The JavaScript Object Notation (JSON) Data Interchange Format", RFC 8259, DOI 10.17487/RFC8259, December 2017, <https://www.rfc-editor.org/info/rfc8259>.
+
+## Informative References
+
+CPE23-A
+:    _Common Platform Enumeration: Applicability Language Specification Version 2.3 (NISTIR 7698)_, D. Waltermire, P. Cichonski, K. Scarfone, Editors, NIST Interagency Report 7698, August 2011, https://dx.doi.org/10.6028/NIST.IR.7698.
+
+CPE23-D
+:    _Common Platform Enumeration: Dictionary Specification Version 2.3_, P. Cichonski, D. Waltermire, K. Scarfone, Editors, NIST Interagency Report 7697, August 2011, https://dx.doi.org/10.6028/NIST.IR.7697.
+
+CPE23-M
+:    _Common Platform Enumeration: Naming Matching Specification Version 2.3_, M. Parmelee, H. Booth, D. Waltermire, K. Scarfone, Editors, NIST Interagency Report 7696, August 2011, https://dx.doi.org/10.6028/NIST.IR.7696.
+
+CPE23-N
+:    _Common Platform Enumeration: Naming Specification Version 2.3_, B. Cheikes, D. Waltermire, K. Scarfone, Editors, NIST Interagency Report 7695, August 2011, https://dx.doi.org/10.6028/NIST.IR.7695.
+
+CSAF-v2.0
+:    _Common Security Advisory Framework Version 2.0_. Edited by Langley Rock, Stefan Hagen, and Thomas Schmidt. 18 November 2022. OASIS Standard. https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html. Latest stage: https://docs.oasis-open.org/csaf/csaf/v2.0/csaf-v2.0.html.
+
+CVE
+:    _Common Vulnerability and Exposures (CVE) – The Standard for Information Security Vulnerability Names_, MITRE, 1999, https://cve.mitre.org/about/.
+
+CVE-NF
+:    _Common Vulnerability and Exposures (CVE) – The Standard for Information Security Vulnerability Names - CVE ID Syntax Change_, MITRE, January 01, 2014, https://cve.mitre.org/cve/identifiers/syntaxchange.html.
+
+CVRF-1-1
+:    _The Common Vulnerability Reporting Framework (CVRF) Version 1.1_, M. Schiffman, Editor, May 2012, Internet Consortium for Advancement of Security on the Internet (ICASI), https://www.icasi.org/the-common-vulnerability-reporting-framework-cvrf-v1-1/.
+
+CVRF-v1.2
+:    _CSAF Common Vulnerability Reporting Framework (CVRF) Version 1.2_. Edited by Stefan Hagen. 13 September 2017. OASIS Committee Specification 01. https://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/cs01/csaf-cvrf-v1.2-cs01.html. Latest version: https://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csaf-cvrf-v1.2.html.
+
+CVSS2
+:    _A Complete Guide to the Common Vulnerability Scoring System Version 2.0_, P. Mell, K. Scarfone, S. Romanosky, Editors, First.org, Inc., June 2007, https://www.first.org/cvss/cvss-v2-guide.pdf.
+
+CVSS30
+:    _Common Vulnerability Scoring System v3.0: Specification Document_, FIRST.Org, Inc., June 2019, https://www.first.org/cvss/v3.0/cvss-v30-specification_v1.9.pdf.
+
+CVSS31
+:    _Common Vulnerability Scoring System v3.1: Specification Document_, FIRST.Org, Inc., June 2019, https://www.first.org/cvss/v3-1/cvss-v31-specification_r1.pdf.
+
+CVSS40
+:    _Common Vulnerability Scoring System v4.0: Specification Document_, FIRST.Org, Inc., 09 November 2023, https://www.first.org/cvss/v4-0/cvss-v40-specification.pdf.
+
+CWE
+:    _Common Weakness Enumeration (CWE) – A Community-Developed List of Software Weakness Types_, MITRE, 2005, http://cwe.mitre.org/about/.
+
+CYCLONEDX13
+:    _CycloneDX Software Bill-of-Material Specification JSON schema version 1.3_, cyclonedx.org, May 2021, https://github.com/CycloneDX/specification/blob/1.3/schema/bom-1.3.schema.json.
+
+GFMCMARK
+:    _GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C_, https://github.com/github/cmark.
+
+GFMENG
+:    _GitHub Engineering: A formal spec for GitHub Flavored Markdown_, https://githubengineering.com/a-formal-spec-for-github-markdown/.
+
+ISO8601
+:    _Data elements and interchange formats — Information interchange — Representation of dates and times_, International Standard, ISO 8601:2004(E), December 1, 2004, https://www.iso.org/standard/40874.html.
+
+ISO19770-2
+:    _Information technology — IT asset management — Part 2: Software identification tag_, International Standard, ISO 19770-2:2015, September 30, 2015, <https://www.iso.org/standard/65666.html>.
+
+ISO29147
+:    _Information technology — Security techniques — Vulnerability disclosure_, International Standard, ISO/IEC 29147:2018, October, 2018, <https://www.iso.org/standard/72311.html>.
+
+OPENSSL
+:    _GTLS/SSL and crypto library_, OpenSSL Software Foundation, https://www.openssl.org/.
+
+PURL
+:    _Package URL (purl)_, GitHub Project, https://github.com/package-url/purl-spec.
+
+RFC3339
+:    Klyne, G. and C. Newman, "Date and Time on the Internet: Timestamps", RFC 3339, DOI 10.17487/RFC3339, July 2002, <https://www.rfc-editor.org/info/rfc3339>.
+
+RFC3552
+:    Rescorla, E. and B. Korver, "Guidelines for Writing RFC Text on Security Considerations", BCP 72, RFC 3552, DOI 10.17487/RFC3552, July 2003, <https://www.rfc-editor.org/info/rfc3552>.
+
+RFC3986
+:    Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, DOI 10.17487/RFC3986, January 2005, <https://www.rfc-editor.org/info/rfc3986>.
+
+RFC4880
+:    Callas, J., Donnerhacke, L., Finney, H., Shaw, D., and R. Thayer, "OpenPGP Message Format", RFC 4880, DOI 10.17487/RFC4880, November 2007, <https://www.rfc-editor.org/info/rfc4880>.
+
+RFC7231
+:    Fielding, R., Ed., and J. Reschke, Ed., "Hypertext Transfer Protocol (HTTP/1.1): Semantics and Content", RFC 7231, DOI 10.17487/RFC7231, June 2014, <https://www.rfc-editor.org/info/rfc7231>.
+
+RFC7464
+:    N. Williams., "JavaScript Object Notation (JSON) Text Sequences", RFC 7464, DOI 10.17487/RFC7464, February 2015, <https://www.rfc-editor.org/info/rfc7464>.
+
+RFC8322
+:    Field, J., Banghart, S., and D. Waltermire, "Resource-Oriented Lightweight Information Exchange (ROLIE)", RFC 8322, DOI 10.17487/RFC8322, February 2018, <https://www.rfc-editor.org/info/rfc8322>.
+
+RFC8615
+:    Nottingham, M., "Well-Known Uniform Resource Identifiers (URIs)", RFC 8615, DOI 10.17487/RFC8615, May 2019, <https://www.rfc-editor.org/info/rfc8615>.
+
+RFC9116
+:    Foudil, E. and Y. Shafranovich, "A File Format to Aid in Security Vulnerability Disclosure", RFC 9116, DOI 10.17487/RFC9116, April 2022, <https://www.rfc-editor.org/info/rfc9116>.
+
+SCAP12
+:    _The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.2_, D. Waltermire, S. Quinn, K. Scarfone, A. Halbardier, Editors, NIST Spec. Publ. 800‑126 rev. 2, September 2011, <https://dx.doi.org/10.6028/NIST.SP.800-126r2>.
+
+SECURITY-TXT
+:    Foudil, E. and Shafranovich, Y., _Security.txt Project_, <https://securitytxt.org/>.
+
+SemVer
+:    _Semantic Versioning 2.0.0_, T. Preston-Werner, June 2013, <https://semver.org/>.
+
+SPDX22
+:    _The Software Package Data Exchange (SPDX®) Specification Version 2.2_, Linux Foundation and its Contributors, 2020, <https://spdx.github.io/spdx-spec/>.
+
+VERS
+:    _vers: a mostly universal version range specifier_, Part of the purl GitHub Project, <https://github.com/package-url/purl-spec/blob/version-range-spec/VERSION-RANGE-SPEC.rst>.
+
+VEX
+:    _Vulnerability-Exploitability eXchange (VEX) - An Overview_, VEX sub-group of the Framing Working Group in the NTIA SBOM initiative, 27 September 2021, <https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf>.
+
+VEX-Justification
+:    _Vulnerability Exploitability eXchange (VEX) - Status Justifications_, VEX sub-group of the Framing Working Group in the CISA SBOM initiative, June 2022, <https://www.cisa.gov/sites/default/files/publications/VEX_Status_Justification_Jun22.pdf>.
+
+XML
+:    _Extensible Markup Language (XML) 1.0 (Fifth Edition)_, T. Bray, J. Paoli, M. Sperberg-McQueen, E. Maler, F. Yergeau, Editors, W3C Recommendation, November 26, 2008, <https://www.w3.org/TR/2008/REC-xml-20081126/>. Latest version available at <https://www.w3.org/TR/xml>.
+
+XML-Schema-1
+:    _W3C XML Schema Definition Language (XSD) 1.1 Part 1: Structures_, S. Gao, M. Sperberg-McQueen, H. Thompson, N. Mendelsohn, D. Beech, M. Maloney, Editors, W3C Recommendation, April 5, 2012, <https://www.w3.org/TR/2012/REC-xmlschema11-1-20120405/>. Latest version available at <https://www.w3.org/TR/xmlschema11-1/>.
+
+XML-Schema-2
+:    _W3C XML Schema Definition Language (XSD) 1.1 Part 2_: Datatypes W3C XML Schema Definition Language (XSD) 1.1 Part 2: Datatypes, D. Peterson, S. Gao, A. Malhotra, M. Sperberg-McQueen, H. Thompson, Paul V. Biron, Editors, W3C Recommendation, April 5, 2012, <https://www.w3.org/TR/2012/REC-xmlschema11-2-20120405/>. Latest version available at <https://www.w3.org/TR/xmlschema11-2/>.
diff --git a/csaf_2.1/prose/edit/src/revision-history.md b/csaf_2.1/prose/edit/src/revision-history.md
index 96dc4072a..f8e6a3fcd 100644
--- a/csaf_2.1/prose/edit/src/revision-history.md
+++ b/csaf_2.1/prose/edit/src/revision-history.md
@@ -3,7 +3,7 @@
 toc:
   auto: false
   label: Revision History
-  enumerate: Appendix B.
+  enumerate: Appendix D.
 ---
 -->
 # Revision History
diff --git a/csaf_2.1/prose/edit/src/safety-security-and-data-protection.md b/csaf_2.1/prose/edit/src/safety-security-and-data-protection.md
index ed29c5ab2..4e9c492fe 100644
--- a/csaf_2.1/prose/edit/src/safety-security-and-data-protection.md
+++ b/csaf_2.1/prose/edit/src/safety-security-and-data-protection.md
@@ -1,3 +1,11 @@
+<!--
+---
+toc:
+  auto: false
+  label: Safety, Security, and Data Protection Considerations
+  enumerate: Appendix B.
+---
+-->
 # Safety, Security, and Data Protection Considerations
 
 CSAF documents are based on JSON, thus the security considerations of [cite](#RFC8259) apply and are repeated here as service for the reader:
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-defs-03-full-product-name.md b/csaf_2.1/prose/edit/src/schema-elements-01-defs-03-full-product-name.md
index 1eb28bff9..523589164 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-01-defs-03-full-product-name.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-defs-03-full-product-name.md
@@ -47,7 +47,7 @@ and `x_generic_uris`, one is mandatory.
 ```
     "product_identification_helper": {
       // ...
-      "properties": { 
+      "properties": {
         "cpe": {
           // ...
         },
@@ -81,9 +81,17 @@ and `x_generic_uris`, one is mandatory.
 Common Platform Enumeration representation (`cpe`) of value type `string` of 5 or more characters with `pattern` (regular expression):
 
 ```
-    ^((cpe:2\\.3:[aho\\*\\-](:(((\\?*|\\*?)([a-zA-Z0-9\\-\\._]|(\\\\[\\\\\\*\\?!\"#\\$%&'\\(\\)\\+,\\/:;<=>@\\[\\]\\^`\\{\\|\\}~]))+(\\?*|\\*?))|[\\*\\-])){5}(:(([a-zA-Z]{2,3}(-([a-zA-Z]{2}|[0-9]{3}))?)|[\\*\\-]))(:(((\\?*|\\*?)([a-zA-Z0-9\\-\\._]|(\\\\[\\\\\\*\\?!\"#\\$%&'\\(\\)\\+,\\/:;<=>@\\[\\]\\^`\\{\\|\\}~]))+(\\?*|\\*?))|[\\*\\-])){4})|([c][pP][eE]:\\/[AHOaho]?(:[A-Za-z0-9\\._\\-~%]*){0,6}))$
+    ^((cpe:2\\.3:[aho\\*\\-](:(((\\?*|\\*?)([a-zA-Z0-9\\-\\._]|(\\\\[\\\\\\*\\?!←
+    \"#\\$%&'\\(\\)\\+,\\/:;<=>@\\[\\]\\^`\\{\\|\\}~]))+(\\?*|\\*?))|[\\*\\-])){5}←
+    (:(([a-zA-Z]{2,3}(-([a-zA-Z]{2}|[0-9]{3}))?)|[\\*\\-]))(:(((\\?*|\\*?)←
+    ([a-zA-Z0-9\\-\\._]|(\\\\[\\\\\\*\\?!\"#\\$%&'\\(\\)\\+,\\/:;←
+    <=>@\\[\\]\\^`\\{\\|\\}~]))+(\\?*|\\*?))|[\\*\\-])){4})|←
+    ([c][pP][eE]:\\/[AHOaho]?(:[A-Za-z0-9\\._\\-~%]*){0,6}))$
 ```
 
+  > For the significance of the left pointing arrow character (`←`) at the end of lines in the preceding representation please
+  > cf. the guidance in section [sec](#typographical-conventions).
+
 The Common Platform Enumeration (CPE) attribute refers to a method for naming platforms external to this specification.
 See [CPE23-N] for details.
 
@@ -159,14 +167,14 @@ These values are derived from the currently supported digests OpenSSL [cite](#OP
 >
 >```
 >  Supported digests:
->  -blake2b512                -blake2s256                -md4                      
->  -md5                       -md5-sha1                  -ripemd                   
->  -ripemd160                 -rmd160                    -sha1                     
->  -sha224                    -sha256                    -sha3-224                 
->  -sha3-256                  -sha3-384                  -sha3-512                 
->  -sha384                    -sha512                    -sha512-224               
->  -sha512-256                -shake128                  -shake256                 
->  -sm3                       -ssl3-md5                  -ssl3-sha1                
+>  -blake2b512                -blake2s256                -md4
+>  -md5                       -md5-sha1                  -ripemd
+>  -ripemd160                 -rmd160                    -sha1
+>  -sha224                    -sha256                    -sha3-224
+>  -sha3-256                  -sha3-384                  -sha3-512
+>  -sha384                    -sha512                    -sha512-224
+>  -sha512-256                -shake128                  -shake256
+>  -sm3                       -ssl3-md5                  -ssl3-sha1
 >  -whirlpool
 >```
 
@@ -181,11 +189,16 @@ The Value of the cryptographic hash attribute contains the cryptographic hash va
 *Examples 2:*
 
 ```
-    37df33cb7464da5c7f077f4d56a32bc84987ec1d85b234537c1c1a4d4fc8d09dc29e2e762cb5203677bf849a2855a0283710f1f5fe1d6ce8d5ac85c645d0fcb3
+    37df33cb7464da5c7f077f4d56a32bc84987ec1d85b234537c1c1a4d4fc8d09dc29e2e762cb520←
+    3677bf849a2855a0283710f1f5fe1d6ce8d5ac85c645d0fcb3
     4775203615d9534a8bfca96a93dc8b461a489f69124a130d786b42204f3341cc
-    9ea4c8200113d49d26505da0e02e2f49055dc078d1ad7a419b32e291c7afebbb84badfbd46dec42883bea0b2a1fa697c
+    9ea4c8200113d49d26505da0e02e2f49055dc078d1ad7a419b32e291c7afebbb84badfbd46dec4←
+    2883bea0b2a1fa697c
 ```
 
+  > For the significance of the left pointing arrow character (`←`) at the end of lines in the preceding examples please
+  > cf. the guidance in section [sec](#typographical-conventions).
+
 The filename representation (`filename`) of value type `string` with one or more characters contains the name of
 the file which is identified by the hash values.
 
@@ -228,7 +241,7 @@ the component to identify.
 
 If a part of a model number of the component to identify is given,
 it SHOULD begin with the first character of the model number and stop at any point.
-Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
+Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).
 Two `*` MUST NOT follow each other.
 
 *Examples 1:*
@@ -276,10 +289,14 @@ Any given SBOM URL of value type `string` with format `uri` contains a URL of on
 *Examples 1:*
 
 ```
-    https://raw.githubusercontent.com/CycloneDX/bom-examples/master/SBOM/keycloak-10.0.2/bom.json
+    https://raw.githubusercontent.com/CycloneDX/bom-examples/master/SBOM/←
+    keycloak-10.0.2/bom.json
     https://swinslow.net/spdx-examples/example4/main-bin-v2
 ```
 
+  > For the significance of the left pointing arrow character (`←`) at the end of the first line in the preceding examples 1 please
+  > cf. the guidance in section [sec](#typographical-conventions).
+
 ##### Full Product Name Type - Product Identification Helper - Serial Numbers
 
 The list of serial numbers (`serial_numbers`) of value type `array` with 1 or more unique items contains
@@ -302,7 +319,7 @@ abbreviated (partial) serial number of the component to identify.
 
 If a part of a serial number of the component to identify is given,
 it SHOULD begin with the first character of the serial number and stop at any point.
-Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
+Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).
 Two `*` MUST NOT follow each other.
 
 ##### Full Product Name Type - Product Identification Helper - SKUs
@@ -319,9 +336,9 @@ In the latter case the remediations SHALL include the new stock keeping units or
 
 ```
     "skus": {
-        //...  
+        //...
       "items": {
-        //...  
+        //...
       }
     },
 ```
@@ -333,7 +350,7 @@ abbreviated (partial) stock keeping unit (SKU) of the component to identify.
 
 If a part of a stock keeping unit of the component to identify is given, it SHOULD begin with the first character of
 the stock keeping unit and stop at any point.
-Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).  
+Characters which SHOULD NOT be matched MUST be replaced by either `?` (for a single character) or `*` (for zero or more characters).
 Two `*` MUST NOT follow each other.
 
 ##### Full Product Name Type - Product Identification Helper - Generic URIs
@@ -347,7 +364,7 @@ either vendor-specific or derived from a standard not yet supported.
       "items": {
         // ...
       }
-    }  
+    }
 ```
 
 Any such Generic URI item of value type `object` provides the two mandatory properties Namespace (`namespace`) and URI (`uri`).
@@ -376,7 +393,8 @@ The URI (`uri`) of value type `string` with format `uri` contains the identifier
           "x_generic_uris": [
             {
               "namespace": "https://cyclonedx.org/capabilities/bomlink/",
-              "uri": "urn:cdx:411dafd2-c29f-491a-97d7-e97de5bc2289/1#pkg:maven/org.jboss.logging/jboss-logging@3.4.1.Final?type=jar"
+              "uri": "urn:cdx:411dafd2-c29f-491a-97d7-e97de5bc2289/1#pkg:maven/←
+              org.jboss.logging/jboss-logging@3.4.1.Final?type=jar"
             }
           ]
 ```
@@ -386,8 +404,13 @@ The URI (`uri`) of value type `string` with format `uri` contains the identifier
 ```
           "x_generic_uris": [
             {
-              "namespace": "https://spdx.github.io/spdx-spec/latest/document-creation-information/#65-spdx-document-namespace-field",
-              "uri": "https://swinslow.net/spdx-examples/example4/main-bin-v2#SPDXRef-libc"
+              "namespace": "https://spdx.github.io/spdx-spec/latest/←
+              document-creation-information/#65-spdx-document-namespace-field",
+              "uri": "https://swinslow.net/spdx-examples/example4/←
+              main-bin-v2#SPDXRef-libc"
             }
           ]
 ```
+
+  > For the significance of the left pointing arrow character (`←`) at the end of lines in the preceding examples 1 and 2 please
+  > cf. the guidance in section [sec](#typographical-conventions).
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-defs-04-language.md b/csaf_2.1/prose/edit/src/schema-elements-01-defs-04-language.md
index 7d33605d6..439f55500 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-01-defs-04-language.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-defs-04-language.md
@@ -3,9 +3,16 @@
 Language type (`lang_t`) has value type `string` with `pattern` (regular expression):
 
 ```
-    ^(([A-Za-z]{2,3}(-[A-Za-z]{3}(-[A-Za-z]{3}){0,2})?|[A-Za-z]{4,8})(-[A-Za-z]{4})?(-([A-Za-z]{2}|[0-9]{3}))?(-([A-Za-z0-9]{5,8}|[0-9][A-Za-z0-9]{3}))*(-[A-WY-Za-wy-z0-9](-[A-Za-z0-9]{2,8})+)*(-[Xx](-[A-Za-z0-9]{1,8})+)?|[Xx](-[A-Za-z0-9]{1,8})+|[Ii]-[Dd][Ee][Ff][Aa][Uu][Ll][Tt]|[Ii]-[Mm][Ii][Nn][Gg][Oo])$
+    ^(([A-Za-z]{2,3}(-[A-Za-z]{3}(-[A-Za-z]{3}){0,2})?|[A-Za-z]{4,8})←
+    (-[A-Za-z]{4})?(-([A-Za-z]{2}|[0-9]{3}))?(-([A-Za-z0-9]{5,8}|←
+    [0-9][A-Za-z0-9]{3}))*(-[A-WY-Za-wy-z0-9](-[A-Za-z0-9]{2,8})+)*←
+    (-[Xx](-[A-Za-z0-9]{1,8})+)?|[Xx](-[A-Za-z0-9]{1,8})+|←
+    [Ii]-[Dd][Ee][Ff][Aa][Uu][Ll][Tt]|[Ii]-[Mm][Ii][Nn][Gg][Oo])$
 ```
 
+  > For the significance of the left pointing arrow character (`←`) at the end of lines in the preceding `pattern` please
+  > cf. the guidance in section [sec](#typographical-conventions).
+
 The value identifies a language, corresponding to IETF BCP 47 / RFC 5646.
 See IETF language registry: <https://www.iana.org/assignments/language-subtag-registry/language-subtag-registry>
 
diff --git a/csaf_2.1/prose/edit/src/schema-elements-01-defs-11-version.md b/csaf_2.1/prose/edit/src/schema-elements-01-defs-11-version.md
index 0ea807e64..0939d88ec 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-01-defs-11-version.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-01-defs-11-version.md
@@ -3,9 +3,14 @@
 The Version (`version_t`) type has value type `string` with `pattern` (regular expression):
 
 ```
-    ^(0|[1-9][0-9]*)$|^((0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)$
+    ^(0|[1-9][0-9]*)$|^((0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)←
+    (?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*←
+    [a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)$
 ```
 
+  > For the significance of the left pointing arrow character (`←`) at the end of lines in the preceding `pattern` please
+  > cf. the guidance in section [sec](#typographical-conventions).
+
 The version specifies a version string to denote clearly the evolution of the content of the document.
 There are two options how it can be used:
 
@@ -52,9 +57,14 @@ The following rules apply:
 Semantic versioning derived the rules from [SemVer]. The regular expression for this type is:
 
 ```
-^((0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)$
+^((0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*←
+[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?←
+(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?)$
 ```
 
+  > For the significance of the left pointing arrow character (`←`) at the end of lines in the preceding regular expression please
+  > cf. the guidance in section [sec](#typographical-conventions).
+
 The goal of this structure is to provide additional information to the end user whether a new comparison with the asset database is needed.
 The "public API" in regards to CSAF is the CSAF document with its structure and content.
 This results in the following rules:
@@ -161,5 +171,9 @@ This results in the following rules:
        *Example 5:*
 
        ```
-       1.0.0-alpha < 1.0.0-alpha.1 < 1.0.0-alpha.beta < 1.0.0-beta < 1.0.0-beta.2 < 1.0.0-beta.11 < 1.0.0-rc.1 < 1.0.0
+       1.0.0-alpha < 1.0.0-alpha.1 < 1.0.0-alpha.beta < 1.0.0-beta < 1.0.0-beta.2←
+        < 1.0.0-beta.11 < 1.0.0-rc.1 < 1.0.0
        ```
+
+        > For the significance of the left pointing arrow character (`←`) at the end of lines in the preceding example 5 please
+        > cf. the guidance in section [sec](#typographical-conventions).
diff --git a/csaf_2.1/prose/edit/src/schema-elements-02-props-03-product-tree.md b/csaf_2.1/prose/edit/src/schema-elements-02-props-03-product-tree.md
index ddf95d1f4..ca23929b0 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-02-props-03-product-tree.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-02-props-03-product-tree.md
@@ -176,12 +176,15 @@ the Full Product Name element, which is referenced as the second element of the
         "relates_to_product_reference": "CSAFPID-908070602",
         "full_product_name": {
           "product_id": "CSAFPID-908070603",
-          "name": "Cisco AnyConnect Secure Mobility Client 2.3.185 installed on Microsoft Windows"
+          "name": "Cisco AnyConnect Secure Mobility Client 2.3.185 installed on←
+           Microsoft Windows"
         }
       }
     ]
   }
 ```
+  > For the significance of the left pointing arrow character (`←`) at the end of the third line in the preceding example 2 please
+  > cf. the guidance in section [sec](#typographical-conventions).
 
 > The product `Cisco AnyConnect Secure Mobility Client 4.9.04053"` (Product ID: `CSAFPID-908070601`) and the product `Microsoft Windows`
 > (Product ID: `CSAFPID-908070602`) form together a new product with the separate Product ID `CSAFPID-908070603`.
diff --git a/csaf_2.1/prose/edit/src/schema-elements-02-props-04-vulnerabilities.md b/csaf_2.1/prose/edit/src/schema-elements-02-props-04-vulnerabilities.md
index af56fb699..d8ee09290 100644
--- a/csaf_2.1/prose/edit/src/schema-elements-02-props-04-vulnerabilities.md
+++ b/csaf_2.1/prose/edit/src/schema-elements-02-props-04-vulnerabilities.md
@@ -146,9 +146,13 @@ in the CWE specification.
 ```
     Cross-Site Request Forgery (CSRF)
     Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
-    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
+    Improper Neutralization of Input During Web Page Generation←
+     ('Cross-site Scripting')
 ```
 
+  > For the significance of the left pointing arrow character (`←`) at the end of the third line in the preceding example 2 please
+  > cf. the guidance in section [sec](#typographical-conventions).
+
 The CWE version (`version`) has value type `string` with `pattern` (regular expression):
 
 ```
@@ -478,11 +482,13 @@ Vulnerability notes (`notes`) of value type Notes Type (`notes_t`) holds notes a
 
 The following combinations of `category` and `title` have a special meaning and MUST be used as stated below:
 
-| `category` | `title` | content of `text` |
-|---------------|---------------|-------------------|
-| `description` | CVE Description | Contains the official and unchanged CVE description for this specific vulnerability. |
-| `description` | Preconditions | Contains a description of the preconditions that have to be fulfilled to be able to exploit the vulnerability, e.g. user account or physical access. |
-| `summary` | Vulnerability Summary | Contains a summary of the vulnerability which is not the official CVE description. |
+| `category`    | `title`               | content of `text`                                                                                                                                    |
+|:--------------|:----------------------|:-----------------------------------------------------------------------------------------------------------------------------------------------------|
+| `description` | CVE Description       | Contains the official and unchanged CVE description for this specific vulnerability.                                                                 |
+| `description` | Preconditions         | Contains a description of the preconditions that have to be fulfilled to be able to exploit the vulnerability, e.g. user account or physical access. |
+| `summary`     | Vulnerability Summary | Contains a summary of the vulnerability which is not the official CVE description.                                                                   |
+
+Table: Semantics for values of `text`fields from combination of `category` and `title`values.
 
 #### Vulnerabilities Property - Product Status
 
@@ -658,7 +664,8 @@ The text in field `details` SHOULD contain details about why there is no fix or
 The values `none_available` and `vendor_fix` are mutually exclusive per product.
 
 > An issuing party might choose to use this category to announce that a fix is currently developed.
-It is recommended that this also includes a date when a customer can expect the fix to be ready and distributed.  
+
+It is recommended that this also includes a date when a customer can expect the fix to be ready and distributed.
 
 The value `no_fix_planned` indicates that there is no fix for the vulnerability and it is not planned to provide one at any time.
 This is often the case when a product has been orphaned, declared end-of-life, or otherwise deprecated.
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-24-multiple-definition-in-involvements.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-24-multiple-definition-in-involvements.md
index b58f53015..2fdb9cb65 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-24-multiple-definition-in-involvements.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-24-multiple-definition-in-involvements.md
@@ -8,6 +8,9 @@ The relevant path for this test is:
     /vulnerabilities[]/involvements
 ```
 
+  > For the significance of the left pointing arrow character (`←`) at the end of the summary value line in the following example 1 please
+  > cf. the guidance in section [sec](#typographical-conventions).
+
 *Example 1 (which fails the test):*
 
 ```
@@ -23,7 +26,8 @@ The relevant path for this test is:
           "date": "2023-08-23T10:00:00.000Z",
           "party": "vendor",
           "status": "in_progress",
-          "summary": "The vendor has released a mitigation and is working to fully resolve the issue."
+          "summary": "The vendor has released a mitigation and is working to fully←
+           resolve the issue."
         }
       ]
     }
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-25-multiple-use-of-same-hash-algorithm.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-25-multiple-use-of-same-hash-algorithm.md
index 600e04c84..fd74978a2 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-25-multiple-use-of-same-hash-algorithm.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-25-multiple-use-of-same-hash-algorithm.md
@@ -5,11 +5,17 @@ It MUST be tested that the same hash algorithm is not used multiple times in one
 The relevant paths for this test are:
 
 ```
-  /product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes
-  /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes
-  /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/←
+  hashes[]/file_hashes
+  /product_tree/full_product_names[]/product_identification_helper/hashes[]/←
+  file_hashes
+  /product_tree/relationships[]/full_product_name/product_identification_helper/←
+  hashes[]/file_hashes
 ```
 
+  > For the significance of the left pointing arrow character (`←`) at the end of lines in the preceding
+  > paths listing and following example 1 please cf. the guidance in section [sec](#typographical-conventions).
+
 *Example 1 (which fails the test):*
 
 ```
@@ -24,11 +30,13 @@ The relevant paths for this test are:
               "file_hashes": [
                 {
                   "algorithm": "sha256",
-                  "value": "026a37919b182ef7c63791e82c9645e2f897a3f0b73c7a6028c7febf62e93838"
+                  "value": "026a37919b182ef7c63791e82c9645e2f897a3f0b73c7←
+                  a6028c7febf62e93838"
                 },
                 {
                   "algorithm": "sha256",
-                  "value": "0a853ce2337f0608489ac596a308dc5b7b19d35a52b10bf31261586ac368b175"
+                  "value": "0a853ce2337f0608489ac596a308dc5b7b19d35a52b10←
+                  bf31261586ac368b175"
                 }
               ],
               "filename": "product_a.so"
diff --git a/csaf_2.1/prose/edit/src/tests-01-mndtr-27-profile-tests.md b/csaf_2.1/prose/edit/src/tests-01-mndtr-27-profile-tests.md
index 0ae0ee698..a67712cd6 100644
--- a/csaf_2.1/prose/edit/src/tests-01-mndtr-27-profile-tests.md
+++ b/csaf_2.1/prose/edit/src/tests-01-mndtr-27-profile-tests.md
@@ -24,13 +24,17 @@ The relevant path for this test is:
   /document/notes
 ```
 
+  > For the significance of the left pointing arrow character (`←`) at the end of a line in the following
+  > example 1 please cf. the guidance in section [sec](#typographical-conventions).
+
 *Example 1 (which fails the test):*
 
 ```
   "notes": [
     {
       "category": "legal_disclaimer",
-      "text": "The CSAF document is provided to You \"AS IS\" and \"AS AVAILABLE\" and with all faults and defects without warranty of any kind.",
+      "text": "The CSAF document is provided to You \"AS IS\" and \"AS AVAILABLE\"←
+       and with all faults and defects without warranty of any kind.",
       "title": "Terms of Use"
     }
   ]
@@ -55,6 +59,9 @@ The relevant path for this test is:
   /document/references
 ```
 
+  > For the significance of the left pointing arrow character (`←`) at the end of a line in the following
+  > example 1 please cf. the guidance in section [sec](#typographical-conventions).
+
 *Example 1 (which fails the test):*
 
 ```
@@ -62,7 +69,8 @@ The relevant path for this test is:
     {
       "category": "self",
       "summary": "The canonical URL.",
-      "url": "https://example.com/security/data/csaf/2024/oasis_csaf_tc-csaf_2_1-2024-6-1-27-02-01.json"
+      "url": "https://example.com/security/data/csaf/2024/←
+      oasis_csaf_tc-csaf_2_1-2024-6-1-27-02-01.json"
     }
   ]
 ```
@@ -343,6 +351,9 @@ The relevant path for this test is:
   /vulnerabilities[]/remediations
 ```
 
+  > For the significance of the left pointing arrow character (`←`) at the end of a line in the following
+  > example 1 please cf. the guidance in section [sec](#typographical-conventions).
+
 *Example 1 (which fails the test):*
 
 ```
@@ -385,7 +396,8 @@ The relevant path for this test is:
       "remediations": [
         {
           "category": "no_fix_planned",
-          "details": "These products are end-of-life. Therefore, no fix will be provided.",
+          "details": "These products are end-of-life. Therefore, no fix will be←
+           provided.",
           "group_ids": [
             "CSAFGID-0001"
           ]
diff --git a/csaf_2.1/prose/edit/src/tests-02-optional.md b/csaf_2.1/prose/edit/src/tests-02-optional.md
index 623ee2000..ef6f99170 100644
--- a/csaf_2.1/prose/edit/src/tests-02-optional.md
+++ b/csaf_2.1/prose/edit/src/tests-02-optional.md
@@ -46,7 +46,7 @@ a remediation exists.
 The relevant paths for this test are:
 
 ```
-  /vulnerabilities[]/product_status/first_affected[]  
+  /vulnerabilities[]/product_status/first_affected[]
   /vulnerabilities[]/product_status/known_affected[]
   /vulnerabilities[]/product_status/last_affected[]
   /vulnerabilities[]/product_status/under_investigation[]
@@ -84,7 +84,7 @@ a metric object exists which covers this product.
 The relevant paths for this test are:
 
 ```
-  /vulnerabilities[]/product_status/first_affected[]  
+  /vulnerabilities[]/product_status/first_affected[]
   /vulnerabilities[]/product_status/known_affected[]
   /vulnerabilities[]/product_status/last_affected[]
 ```
@@ -246,11 +246,17 @@ It MUST be tested that the hash algorithm `md5` is not the only one present.
 The relevant paths for this test are:
 
 ```
-  /product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes
-  /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes
-  /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/←
+  hashes[]/file_hashes
+  /product_tree/full_product_names[]/product_identification_helper/hashes[]/←
+  file_hashes
+  /product_tree/relationships[]/full_product_name/product_identification_helper/←
+  hashes[]/file_hashes
 ```
 
+  > For the significance of the left pointing arrow character (`←`) at the end of lines in the preceding
+  > listing of relevant paths please cf. the guidance in section [sec](#typographical-conventions).
+
 *Example 1 (which fails the test):*
 
 ```
@@ -289,11 +295,17 @@ It MUST be tested that the hash algorithm `sha1` is not the only one present.
 The relevant paths for this test are:
 
 ```
-  /product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes
-  /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes
-  /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/←
+  hashes[]/file_hashes
+  /product_tree/full_product_names[]/product_identification_helper/hashes[]/←
+  file_hashes
+  /product_tree/relationships[]/full_product_name/product_identification_helper/←
+  hashes[]/file_hashes
 ```
 
+  > For the significance of the left pointing arrow character (`←`) at the end of lines in the preceding
+  > listing of relevant paths please cf. the guidance in section [sec](#typographical-conventions).
+
 *Example 1 (which fails the test):*
 
 ```
@@ -360,6 +372,9 @@ The relevant path for this test is:
   /document/references
 ```
 
+  > For the significance of the left pointing arrow character (`←`) at the end of one line in the following
+  > example 1 please cf. the guidance in section [sec](#typographical-conventions).
+
 *Example 1 (which fails the test):*
 
 ```
@@ -369,7 +384,8 @@ The relevant path for this test is:
       {
         "category": "self",
         "summary": "A non-canonical URL.",
-        "url": "https://example.com/security/data/csaf/2024/oasis_csaf_tc-csaf_2.1-2024-6-2-11-01_1.json"
+        "url": "https://example.com/security/data/csaf/2024/←
+        oasis_csaf_tc-csaf_2.1-2024-6-2-11-01_1.json"
       }
     ],
     // ...
@@ -690,10 +706,14 @@ The relevant path for this test is:
   /document/title
 ```
 
+  > For the significance of the left pointing arrow character (`←`) at the end of one line in the following
+  > example 1 please cf. the guidance in section [sec](#typographical-conventions).
+
 *Example 1 (which fails the test):*
 
 ```
-    "title": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-22-01: Optional test: Document Tracking ID in Title (failing example 1)",
+    "title": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-22-01: Optional test: Document←
+     Tracking ID in Title (failing example 1)",
     "tracking": {
       // ...
       "id": "OASIS_CSAF_TC-CSAF_2.1-2024-6-2-22-01",
diff --git a/csaf_2.1/prose/edit/src/tests-03-informative.md b/csaf_2.1/prose/edit/src/tests-03-informative.md
index 21ae1b7a5..712157387 100644
--- a/csaf_2.1/prose/edit/src/tests-03-informative.md
+++ b/csaf_2.1/prose/edit/src/tests-03-informative.md
@@ -148,11 +148,17 @@ It MUST be tested that the length of the hash value is not shorter than 64 chara
 The relevant paths for this test are:
 
 ```
-  /product_tree/branches[](/branches[])*/product/product_identification_helper/hashes[]/file_hashes[]/value
-  /product_tree/full_product_names[]/product_identification_helper/hashes[]/file_hashes[]/value
-  /product_tree/relationships[]/full_product_name/product_identification_helper/hashes[]/file_hashes[]/value
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/←
+  hashes[]/file_hashes[]/value
+  /product_tree/full_product_names[]/product_identification_helper/hashes[]/←
+  file_hashes[]/value
+  /product_tree/relationships[]/full_product_name/product_identification_helper/←
+  hashes[]/file_hashes[]/value
 ```
 
+  > For the significance of the left pointing arrow character (`←`) at the end of lines in the preceding
+  > listing of relevant paths please cf. the guidance in section [sec](#typographical-conventions).
+
 *Example 1 (which fails the test):*
 
 ```
@@ -198,28 +204,42 @@ The relevant paths for this test are:
   /document/references[]/url
   /document/publisher/namespace
   /product_tree/branches[]/product/product_identification_helper/sbom_urls[]
-  /product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/namespace
-  /product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/uri
-  /product_tree/branches[](/branches[])*/product/product_identification_helper/sbom_urls[]
-  /product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris[]/namespace
-  /product_tree/branches[](/branches[])*/product/product_identification_helper/x_generic_uris[]/uri
+  /product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/←
+  namespace
+  /product_tree/branches[]/product/product_identification_helper/x_generic_uris[]/←
+  uri
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/←
+  sbom_urls[]
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/←
+  x_generic_uris[]/namespace
+  /product_tree/branches[](/branches[])*/product/product_identification_helper/←
+  x_generic_uris[]/uri
   /product_tree/full_product_names[]/product_identification_helper/sbom_urls[]
-  /product_tree/full_product_names[]/product_identification_helper/x_generic_uris[]/namespace
-  /product_tree/full_product_names[]/product_identification_helper/x_generic_uris[]/uri
-  /product_tree/relationships[]/full_product_name/product_identification_helper/sbom_urls[]
-  /product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris[]/namespace
-  /product_tree/relationships[]/full_product_name/product_identification_helper/x_generic_uris[]/uri
+  /product_tree/full_product_names[]/product_identification_helper/x_generic_uris[]←
+  /namespace
+  /product_tree/full_product_names[]/product_identification_helper/x_generic_uris[]←
+  /uri
+  /product_tree/relationships[]/full_product_name/product_identification_helper/←
+  sbom_urls[]
+  /product_tree/relationships[]/full_product_name/product_identification_helper/←
+  x_generic_uris[]/namespace
+  /product_tree/relationships[]/full_product_name/product_identification_helper/←
+  x_generic_uris[]/uri
   /vulnerabilities[]/acknowledgments[]/urls[]
   /vulnerabilities[]/references[]/url
   /vulnerabilities[]/remediations[]/url
 ```
 
+  > For the significance of the left pointing arrow character (`←`) at the end of lines in the preceding
+  > listing of relevant paths and following example 1 please cf. the guidance in section [sec](#typographical-conventions).
+
 *Example 1 (which fails the test):*
 
 ```
     "references": [
       {
-        "summary": "A URL that does not resolve with HTTP status code in the interval between (including) 200 and (excluding) 400.",
+        "summary": "A URL that does not resolve with HTTP status code in the←
+         interval between (including) 200 and (excluding) 400.",
         "url": "https://example.invalid"
       }
     ]
@@ -243,13 +263,17 @@ The relevant paths for this test are:
   /vulnerabilities[]/references[]/url
 ```
 
+  > For the significance of the left pointing arrow character (`←`) at the end of a line in the following
+  > example 1 please cf. the guidance in section [sec](#typographical-conventions).
+
 *Example 1 (which fails the test):*
 
 ```
     "references": [
       {
         "category": "self",
-        "summary": "A URL that does not resolve with HTTP status code in the interval between (including) 200 and (excluding) 400.",
+        "summary": "A URL that does not resolve with HTTP status code in the←
+         interval between (including) 200 and (excluding) 400.",
         "url": "https://example.invalid"
       }
     ]