diff --git a/crates/daemon/assets/index.html b/crates/daemon/assets/index.html
index 90e11893..cbb02acc 100644
--- a/crates/daemon/assets/index.html
+++ b/crates/daemon/assets/index.html
@@ -4107,8 +4107,12 @@
                aria-label="playbook markdown"></div>
           <div class="playbook-cursor-layer" id="playbookCursorLayer"></div>
           <div class="playbook-empty" id="playbookEmpty" hidden></div>
-          <div class="playbook-selection-menu" id="playbookSelectionMenu" hidden>
-            <button type="button" id="playbookSelectionRunBtn"
+          <!-- Keyboard-reachable (spec 0196): Tab moves focus from the editor
+               into this menu, so its rows must be genuinely focusable menu
+               items rather than a pointer-only affordance. -->
+          <div class="playbook-selection-menu" id="playbookSelectionMenu" hidden
+               role="menu" aria-label="playbook selection actions">
+            <button type="button" role="menuitem" id="playbookSelectionRunBtn"
                     title="Run selected playbook text on this session (Shift: run in a fork)">
               <span aria-hidden="true">▶</span><span>Run</span>
             </button>
@@ -5069,6 +5073,16 @@ <h2 id="operatorViewTitle"></h2>
     // it. The DOM selection's own anchor *is* the mark, so no offset is
     // stored here — only whether the region is active.
     mark: false,
+    // Selection menu focus model (spec 0196). `dismissed` is the first stage
+    // of Escape's two-stage cancel: the menu is hidden while the selection
+    // stays live, so the next Tab reaches the editor's indent command instead
+    // of the menu. `range` is the selection snapshotted when focus leaves the
+    // editor for the menu, because a blurred contenteditable does not reliably
+    // keep a readable Range and every menu action needs to know what to run.
+    // `mark` parks the armed-region flag while focus is in the menu: focusing
+    // a button blurs the editor, and the blur handler disarms the mark, which
+    // would otherwise cost Escape its second stage on a keyboard selection.
+    menu: { dismissed: false, range: null, mark: false },
     // Desktop pointer hover affordance for Playbook shimmer/session clips.
     // { kind, sessionId, anchorEl, token, term, clientX, clientY } | null.
     hover: null,
@@ -10469,12 +10483,20 @@ <h2 id="operatorViewTitle"></h2>
 }
 
 function playbookHideSelectionMenu() {
+  // While the menu holds keyboard focus the user is driving it; a stray
+  // selection recompute must not yank the menu — and the focus with it — out
+  // from under them. Explicit dismissal clears `hidden` directly instead.
+  if (playbookSelectionMenuEl.contains(document.activeElement)) return;
   playbookSelectionMenuEl.hidden = true;
 }
 
 function playbookUpdateSelectionMenu() {
   const runnable = playbookRunnableSelectionRange();
-  if (!runnable) { playbookHideSelectionMenu(); return; }
+  // An empty region also retires the dismissal, so the *next* selection opens
+  // a fresh menu. That is what restores the menu after a keyboard selection,
+  // whose region is momentarily empty between C-Space and the first motion.
+  if (!runnable) { state.playbook.menu.dismissed = false; playbookHideSelectionMenu(); return; }
+  if (state.playbook.menu.dismissed) { playbookHideSelectionMenu(); return; }
   const rect = playbookSelectionFocusRect(runnable.sel, runnable.range);
   if (!rect || (!rect.width && !rect.height)) { playbookHideSelectionMenu(); return; }
   const editor = playbookEditorEl.getBoundingClientRect();
@@ -10495,6 +10517,168 @@ <h2 id="operatorViewTitle"></h2>
   playbookSelectionMenuEl.style.top = Math.round(top) + "px";
 }
 
+// --- Playbook selection menu focus (spec 0196) ------------------------------
+// The TUI lets bare Tab carry focus from the editor into the visible selection
+// menu; Tab/S-Tab and the arrows walk its rows, Enter runs the focused one, and
+// Escape peels the menu off while leaving the selection live so the next Tab
+// reaches the editor's indent command. The web menu was pointer-only, so Tab
+// fell through to the contenteditable and `insertText` replaced the user's
+// selected text with an indent — losing the selection instead of acting on it.
+// These mirror the TUI contract rather than inventing a second web one.
+
+/** The menu's focusable rows in visual order: Run, then one per verb. */
+function playbookSelectionMenuItems() {
+  return Array.from(playbookSelectionMenuEl.querySelectorAll("button"));
+}
+
+function playbookSelectionMenuVisible() {
+  return !playbookSelectionMenuEl.hidden;
+}
+
+/**
+ * Move focus into the menu, reopening it first if Escape had dismissed it.
+ *
+ * The live Range is snapshotted here: focusing a button blurs the
+ * contenteditable, and a blurred editor's selection is not reliably readable
+ * afterwards, while every menu action needs it back to know what to run.
+ */
+function playbookFocusSelectionMenu() {
+  if (!playbookRunnableSelectionRange()) return false;
+  state.playbook.menu.dismissed = false;
+  playbookUpdateSelectionMenu();
+  if (!playbookSelectionMenuVisible()) return false;
+  const items = playbookSelectionMenuItems();
+  if (!items.length) return false;
+  const sel = window.getSelection();
+  state.playbook.menu.range = sel && sel.rangeCount ? sel.getRangeAt(0).cloneRange() : null;
+  state.playbook.menu.mark = state.playbook.mark;
+  items[0].focus();
+  return true;
+}
+
+/** Put the snapshotted selection back so the run/verb paths can read it. */
+function playbookRestoreMenuSelection() {
+  const range = state.playbook.menu.range;
+  if (!range) return;
+  const sel = window.getSelection();
+  if (!sel) return;
+  try { sel.removeAllRanges(); sel.addRange(range); } catch (_) {}
+}
+
+/** Hand focus, and the selection it was holding, back to the editor. */
+function playbookReturnFocusToEditor() {
+  try { playbookInputEl.focus(); } catch (_) {}
+  playbookRestoreMenuSelection();
+  // Re-arm the region the menu borrowed, so the caret motions still extend it
+  // and a second Escape still cancels it — the state the user left behind.
+  state.playbook.mark = state.playbook.menu.mark;
+  state.playbook.menu.range = null;
+  state.playbook.menu.mark = false;
+}
+
+/**
+ * Escape's first stage: hide the menu but keep the selection, so the next Tab
+ * indents the selected lines and a second Escape cancels the region. Menu
+ * dismissal and selection cancellation stay separate actions (spec 0196).
+ */
+function playbookDismissSelectionMenu() {
+  state.playbook.menu.dismissed = true;
+  playbookReturnFocusToEditor();
+  playbookSelectionMenuEl.hidden = true;
+  playbookSetMsg("selection menu dismissed");
+}
+
+/** Move focus `delta` rows through the menu, wrapping at both ends. */
+function playbookMoveSelectionMenuFocus(delta) {
+  const items = playbookSelectionMenuItems();
+  if (!items.length) return;
+  const at = items.indexOf(document.activeElement);
+  const from = at < 0 ? 0 : at + delta;
+  items[((from % items.length) + items.length) % items.length].focus();
+}
+
+/** Run the focused row against the snapshotted selection. */
+async function playbookActivateSelectionMenuItem(btn, fork) {
+  if (!btn) return;
+  playbookRestoreMenuSelection();
+  state.playbook.menu.range = null;
+  state.playbook.menu.mark = false;
+  state.playbook.menu.dismissed = false;
+  if (btn.dataset.verb) await playbookRunVerb(btn.dataset.verb, fork);
+  else await playbookRun(fork);
+  try { playbookInputEl.focus(); } catch (_) {}
+  playbookClearSelection();
+}
+
+/** Index of the editor line containing `node`, or -1 when it is outside. */
+function playbookLineIndexOf(node) {
+  let el = node && node.nodeType === 3 ? node.parentNode : node;
+  while (el && el.parentNode !== playbookInputEl) el = el.parentNode;
+  if (!el || el.parentNode !== playbookInputEl) return -1;
+  return Array.prototype.indexOf.call(playbookInputEl.children, el);
+}
+
+/**
+ * Tab with the menu dismissed: nest — or with Shift, un-nest — every list line
+ * the selection spans, matching the TUI's selected-list indent (spec 0094).
+ * Only markdown list lines move; fenced code and prose are left alone. The
+ * selection is restored across the edit so the band stays selected for a
+ * second Tab, and the key is consumed either way so a no-op never falls
+ * through to the contenteditable and eats the selection.
+ */
+function playbookIndentSelectedLines(outdent) {
+  const runnable = playbookRunnableSelectionRange();
+  if (!runnable) return false;
+  const range = runnable.range;
+  const startIdx = playbookLineIndexOf(range.startContainer);
+  let endIdx = playbookLineIndexOf(range.endContainer);
+  if (startIdx < 0 || endIdx < 0 || endIdx < startIdx) return false;
+  // A selection ending exactly at a line start does not really include that
+  // line's text, so it is not indented (same rule as the TUI's range end).
+  if (endIdx > startIdx && range.endOffset === 0) endIdx -= 1;
+
+  const kinds = playbookMultilineFenceKinds(playbookSerialize());
+  let changed = false;
+  for (let i = startIdx; i <= endIdx; i++) {
+    const el = playbookInputEl.children[i];
+    if (!el) continue;
+    if ((kinds[i] || "markdown") !== "markdown") continue;
+    const stripped = playbookSerializeInline(el).replace(/^ +/, "");
+    if (!stripped.startsWith("- ") && !stripped.startsWith("* ")) continue;
+    const first = el.firstChild;
+    if (outdent) {
+      if (!first || first.nodeType !== 3) continue;
+      const lead = /^ {1,2}/.exec(first.data);
+      if (!lead) continue;
+      first.data = first.data.slice(lead[0].length);
+    } else if (first && first.nodeType === 3) {
+      first.data = "  " + first.data;
+    } else {
+      el.insertBefore(document.createTextNode("  "), first);
+    }
+    changed = true;
+  }
+  if (!changed) return true;
+
+  const sel = window.getSelection();
+  if (sel) {
+    const band = document.createRange();
+    const last = playbookInputEl.children[endIdx];
+    band.setStart(playbookInputEl.children[startIdx], 0);
+    band.setEnd(last, last.childNodes.length);
+    try { sel.removeAllRanges(); sel.addRange(band); } catch (_) {}
+  }
+  // The DOM was edited programmatically, so no `input` event fires to drive
+  // playbookOnInput's pipeline — run the parts this edit invalidates. The mark
+  // deliberately survives: indenting acts on the region, it does not consume it.
+  playbookApplyLineDecorations();
+  playbookUpdateDirty();
+  playbookRenderCursors();
+  playbookUpdateSelectionMenu();
+  playbookOnLocalEdit();
+  return true;
+}
+
 function playbookClearSelection() {
   const sel = window.getSelection();
   if (sel) sel.removeAllRanges();
@@ -11333,6 +11517,7 @@ <h2 id="operatorViewTitle"></h2>
     ...verbs.map((v) => {
       const btn = document.createElement("button");
       btn.type = "button";
+      btn.setAttribute("role", "menuitem");
       btn.className = "playbook-selection-verb-btn";
       btn.dataset.verb = v.name;
       btn.title = `${v.description || v.label} (Shift: run in a fork)`;
@@ -12060,6 +12245,14 @@ <h2 id="operatorViewTitle"></h2>
     playbookCancelMark();
     return;
   }
+  // C-o focuses the selection menu: the TUI's original focus chord, kept as a
+  // compatibility alias that can also reopen a menu Escape dismissed.
+  if (e.ctrlKey && !e.metaKey && !e.altKey && (e.key === "o" || e.key === "O")
+      && playbookRunnableSelectionRange()) {
+    e.preventDefault();
+    playbookFocusSelectionMenu();
+    return;
+  }
   // With the mark armed, every caret motion extends the region from it rather
   // than collapsing the selection — the whole point of setting a mark. This
   // precedes the C-f binding below so C-f extends too.
@@ -12090,9 +12283,27 @@ <h2 id="operatorViewTitle"></h2>
     return;
   }
   if (e.key === "Escape" && state.playbook.find) { e.preventDefault(); playbookCloseFind(); playbookInputEl.focus(); return; }
+  // Escape peels the transient menu off before it cancels the region: with the
+  // menu gone the selection is still live, so the next Tab reaches the indent
+  // command and a second Escape clears the region (spec 0196's two stages).
+  if (e.key === "Escape" && playbookSelectionMenuVisible() && playbookRunnableSelectionRange()) {
+    e.preventDefault();
+    playbookDismissSelectionMenu();
+    return;
+  }
   if (e.key === "Escape" && state.playbook.mark) { e.preventDefault(); playbookCancelMark(); return; }
   if (e.key === "Tab" && !mod) {
     e.preventDefault();
+    // Tab's jobs in the TUI's order (spec 0196): enter a visible selection
+    // menu, indent the selected list lines once Escape has dismissed that
+    // menu, and otherwise insert a plain tab stop. With a selection live it
+    // must never reach the contenteditable — `insertText` would replace the
+    // selected text with the indent, destroying what the menu acts on.
+    if (playbookRunnableSelectionRange()) {
+      if (playbookSelectionMenuVisible()) { playbookFocusSelectionMenu(); return; }
+      playbookIndentSelectedLines(e.shiftKey);
+      return;
+    }
     document.execCommand("insertText", false, "  ");
     return;
   }
@@ -12135,6 +12346,10 @@ <h2 id="operatorViewTitle"></h2>
   // A click (or drag) hands selection back to the mouse; the flag must not
   // survive it, or the next arrow key would extend from the new caret.
   playbookInputEl.addEventListener("pointerdown", () => playbookDeactivateMark());
+  // A pointer press starts a fresh selection gesture, so it retires an earlier
+  // Escape dismissal — otherwise the menu would stay hidden for a brand-new
+  // mouse selection made after the keyboard dismissed the previous one.
+  playbookInputEl.addEventListener("pointerdown", () => { state.playbook.menu.dismissed = false; });
   playbookInputEl.addEventListener("pointerup", () => playbookUpdateSelectionMenu());
   // Copy/cut consume the region (emacs deactivates the mark after
   // kill-ring-save); the highlight itself is left to the browser.
@@ -12179,9 +12394,29 @@ <h2 id="operatorViewTitle"></h2>
   playbookSelectionRunBtn.addEventListener("mousedown", async (e) => {
     e.preventDefault();
     e.stopPropagation();
-    await playbookRun(e.shiftKey);
-    playbookClearSelection();
-    try { playbookInputEl.focus(); } catch (_) {}
+    await playbookActivateSelectionMenuItem(playbookSelectionRunBtn, e.shiftKey);
+  });
+  // Keyboard-driven menu (spec 0196): Tab/S-Tab and the arrows walk the rows,
+  // Enter runs the focused one (Shift: in a fork), Escape hands focus back to
+  // the editor with the selection intact, C-g cancels selection and menu both.
+  playbookSelectionMenuEl.addEventListener("keydown", async (e) => {
+    if (e.key === "Tab") { e.preventDefault(); playbookMoveSelectionMenuFocus(e.shiftKey ? -1 : 1); return; }
+    if (e.key === "ArrowDown") { e.preventDefault(); playbookMoveSelectionMenuFocus(1); return; }
+    if (e.key === "ArrowUp") { e.preventDefault(); playbookMoveSelectionMenuFocus(-1); return; }
+    if (e.key === "Escape") { e.preventDefault(); playbookDismissSelectionMenu(); return; }
+    if (e.ctrlKey && !e.metaKey && !e.altKey && (e.key === "g" || e.key === "G")) {
+      e.preventDefault();
+      playbookReturnFocusToEditor();
+      playbookClearSelection();
+      playbookSetMsg("selection canceled");
+      return;
+    }
+    if (e.key === "Enter" || e.key === " ") {
+      // preventDefault so the browser does not also synthesize a click on the
+      // focused button, which would run the action a second time.
+      e.preventDefault();
+      await playbookActivateSelectionMenuItem(e.target.closest("button"), e.shiftKey);
+    }
   });
   // Delegated: verb buttons are rebuilt by playbookRenderSelectionVerbs
   // whenever the verb list changes, so a per-button listener would need
@@ -12191,9 +12426,7 @@ <h2 id="operatorViewTitle"></h2>
     if (!btn) return;
     e.preventDefault();
     e.stopPropagation();
-    await playbookRunVerb(btn.dataset.verb, e.shiftKey);
-    playbookClearSelection();
-    try { playbookInputEl.focus(); } catch (_) {}
+    await playbookActivateSelectionMenuItem(btn, e.shiftKey);
   });
   playbookFindBtn.addEventListener("click", () => {
     if (state.playbook.find) { playbookCloseFind(); playbookInputEl.focus(); } else playbookOpenFind();
diff --git a/crates/e2e/tests/web_smoke.rs b/crates/e2e/tests/web_smoke.rs
index 079e2b1e..70f56d7d 100644
--- a/crates/e2e/tests/web_smoke.rs
+++ b/crates/e2e/tests/web_smoke.rs
@@ -1671,6 +1671,187 @@ async fn web_client_loads_and_websocket_connects() {
         "cancelling the mark must not edit the document: {mark_cleared:?}"
     );
 
+    // Playbook selection menu focus (spec 0196): bare Tab moves focus into the
+    // visible selection menu instead of reaching the contenteditable, where
+    // `insertText` would replace the very selection the menu acts on. Escape
+    // then peels the menu off while the selection stays live, so the next Tab
+    // nests the selected list lines. Driven with trusted CDP key events, and
+    // with Tab carrying its `text`, so the browser's own default action is
+    // genuinely in play for the `preventDefault` assertions.
+    page.evaluate(
+        r#"
+        (() => {
+          window.__menuSaved = {
+            sessions: state.sessions,
+            currentId: state.currentId,
+            mode: state.mode,
+            mountedId: state.playbook.mountedId,
+            docById: state.playbook.docById,
+            html: playbookInputEl.innerHTML,
+            wrapHidden: playbookWrapEl.hidden,
+          };
+          const markdown = '- alpha item\n- beta item\n';
+          state.sessions = [
+            { id: 's-menu', title: 'Menu', harness: 'smith', state: 'running', has_pty: true },
+          ];
+          state.currentId = 's-menu';
+          state.mode = 'playbook';
+          state.playbook.mountedId = 's-menu';
+          state.playbook.docById = new Map([['s-menu', {
+            version: 1,
+            templateId: null,
+            saved: playbookNormalizeClipIds(markdown),
+            live: playbookNormalizeClipIds(markdown),
+            blocks: playbookBlockSpans(markdown),
+            pendingLive: 0,
+          }]]);
+          playbookWrapEl.hidden = false;
+          playbookRenderDoc(markdown);
+          state.playbook.mark = false;
+          state.playbook.menu.dismissed = false;
+          playbookInputEl.focus();
+          // Select "alpha" on the first list line, as a pointer drag would.
+          const text = playbookInputEl.children[0].firstChild;
+          const range = document.createRange();
+          range.setStart(text, 2);
+          range.setEnd(text, 7);
+          const sel = window.getSelection();
+          sel.removeAllRanges();
+          sel.addRange(range);
+          playbookUpdateSelectionMenu();
+          return true;
+        })()
+        "#,
+    )
+    .await
+    .expect("stage playbook selection menu fixture");
+
+    let menu_probe = r#"
+        (() => ({
+          activeInMenu: playbookSelectionMenuEl.contains(document.activeElement),
+          activeIsEditor: document.activeElement === playbookInputEl,
+          activeId: document.activeElement ? document.activeElement.id : null,
+          itemCount: playbookSelectionMenuEl.querySelectorAll('button').length,
+          menuVisible: !playbookSelectionMenuEl.hidden,
+          selection: window.getSelection().toString(),
+          text: playbookSerialize(),
+        }))()
+        "#;
+
+    let menu_shown: serde_json::Value = page
+        .evaluate(menu_probe)
+        .await
+        .expect("evaluate playbook selection menu shown")
+        .into_value::<serde_json::Value>()
+        .expect("json object");
+    assert_eq!(
+        menu_shown["menuVisible"], true,
+        "a non-empty selection should surface the menu: {menu_shown:?}"
+    );
+
+    press_key_with_text(&page, "Tab", "Tab", 9, "\t").await;
+    let menu_focused: serde_json::Value = page
+        .evaluate(menu_probe)
+        .await
+        .expect("evaluate playbook selection menu focus")
+        .into_value::<serde_json::Value>()
+        .expect("json object");
+    assert_eq!(
+        menu_focused["activeInMenu"], true,
+        "Tab must move focus into the selection menu: {menu_focused:?}"
+    );
+    assert_eq!(
+        menu_focused["activeId"], "playbookSelectionRunBtn",
+        "Tab should land on the menu's first row: {menu_focused:?}"
+    );
+    assert_eq!(
+        menu_focused["text"], "- alpha item\n- beta item\n",
+        "Tab must not insert a tab or replace the selection: {menu_focused:?}"
+    );
+    assert_eq!(
+        menu_focused["selection"], "alpha",
+        "Tab must leave the selection the menu acts on intact: {menu_focused:?}"
+    );
+
+    // Tab again walks the menu rather than escaping it.
+    press_key_with_text(&page, "Tab", "Tab", 9, "\t").await;
+    let menu_walked: serde_json::Value = page
+        .evaluate(menu_probe)
+        .await
+        .expect("evaluate playbook selection menu walk")
+        .into_value::<serde_json::Value>()
+        .expect("json object");
+    assert_eq!(
+        menu_walked["activeInMenu"], true,
+        "Tab inside the menu should move between rows, not leave: {menu_walked:?}"
+    );
+    assert_eq!(
+        menu_walked["text"], "- alpha item\n- beta item\n",
+        "menu navigation must not edit the document: {menu_walked:?}"
+    );
+
+    // Escape hands focus back with the selection alive, and dismisses the menu.
+    press_key_chord(&page, "Escape", "Escape", 27, 0).await;
+    let menu_dismissed: serde_json::Value = page
+        .evaluate(menu_probe)
+        .await
+        .expect("evaluate playbook selection menu dismissed")
+        .into_value::<serde_json::Value>()
+        .expect("json object");
+    assert_eq!(
+        menu_dismissed["activeIsEditor"], true,
+        "Escape should return focus to the editor: {menu_dismissed:?}"
+    );
+    assert_eq!(
+        menu_dismissed["menuVisible"], false,
+        "Escape should dismiss the menu: {menu_dismissed:?}"
+    );
+    assert_eq!(
+        menu_dismissed["selection"], "alpha",
+        "Escape dismisses the menu without cancelling the selection: {menu_dismissed:?}"
+    );
+
+    // With the menu gone the editor owns Tab again: it nests the selected list
+    // line instead of replacing the selection with an indent.
+    press_key_with_text(&page, "Tab", "Tab", 9, "\t").await;
+    let menu_indent: serde_json::Value = page
+        .evaluate(
+            r#"
+            (() => {
+              const out = {
+                selection: window.getSelection().toString(),
+                text: playbookSerialize(),
+              };
+              const saved = window.__menuSaved;
+              state.sessions = saved.sessions;
+              state.currentId = saved.currentId;
+              state.mode = saved.mode;
+              state.playbook.mountedId = saved.mountedId;
+              state.playbook.docById = saved.docById;
+              state.playbook.mark = false;
+              state.playbook.menu.dismissed = false;
+              state.playbook.menu.range = null;
+              playbookInputEl.innerHTML = saved.html;
+              playbookWrapEl.hidden = saved.wrapHidden;
+              window.getSelection().removeAllRanges();
+              playbookSelectionMenuEl.hidden = true;
+              return out;
+            })()
+            "#,
+        )
+        .await
+        .expect("evaluate playbook selection menu indent")
+        .into_value::<serde_json::Value>()
+        .expect("json object");
+    assert_eq!(
+        menu_indent["text"], "  - alpha item\n- beta item\n",
+        "Tab with the menu dismissed should nest the selected list line: {menu_indent:?}"
+    );
+    assert_eq!(
+        menu_indent["selection"], "  - alpha item",
+        "indenting acts on the selection instead of destroying it: {menu_indent:?}"
+    );
+
     // Mobile regression: selecting a PTY-backed session from the list must not
     // focus xterm when the native keyboard is hidden, or iOS/Android pop the
     // keyboard just because the user changed selection. If the keyboard was
@@ -4904,6 +5085,32 @@ impl Drop for ScreencastRecording {
 /// CDP's `Input.dispatchKeyEvent` modifier bit for Ctrl.
 const CDP_MODIFIER_CTRL: i64 = 2;
 
+/// Dispatch a real key press that also carries its `text`, so the browser runs
+/// the insertion default action a text-less key event skips. Tab needs this:
+/// without `text` the contenteditable would never try to replace the selection,
+/// and "the document is unchanged" would pass even with the handler removed.
+async fn press_key_with_text(page: &Page, key: &str, code: &str, vk: i64, text: &str) {
+    let down = DispatchKeyEventParams::builder()
+        .r#type(DispatchKeyEventType::KeyDown)
+        .key(key)
+        .code(code)
+        .windows_virtual_key_code(vk)
+        .native_virtual_key_code(vk)
+        .text(text)
+        .build()
+        .expect("build key event");
+    page.execute(down).await.expect("dispatch key down");
+    let up = DispatchKeyEventParams::builder()
+        .r#type(DispatchKeyEventType::KeyUp)
+        .key(key)
+        .code(code)
+        .windows_virtual_key_code(vk)
+        .native_virtual_key_code(vk)
+        .build()
+        .expect("build key event");
+    page.execute(up).await.expect("dispatch key up");
+}
+
 /// Dispatch a real (trusted) key press, modifiers included.
 ///
 /// `press_key` in chromiumoxide cannot carry modifiers, and a synthesized
diff --git a/specs/0196-playbook-selection-menu-focus-model.md b/specs/0196-playbook-selection-menu-focus-model.md
index 9546550c..fa992375 100644
--- a/specs/0196-playbook-selection-menu-focus-model.md
+++ b/specs/0196-playbook-selection-menu-focus-model.md
@@ -1,16 +1,25 @@
 # 0196-playbook-selection-menu-focus-model
 
 Status: accepted
-Date: 2026-08-18
+Date: 2026-08-21
 Area: ux
-Scope: how keyboard focus moves between the playbook editor and the selection action menu while a selection is active.
+Scope: how keyboard focus moves between the playbook editor and the selection action menu while a selection is active, in every client that offers the menu.
 
 ## Decision
 
 Making a non-empty selection in the Playbook shows a passive selection action
 menu. Bare Tab transfers keyboard focus into that visible menu without
 changing the document. Once focused, Tab moves forward through the menu rows;
-S-Tab moves backward. The passive menu advertises Tab as its entry key.
+S-Tab moves backward, as do the arrow keys. Enter activates the focused row.
+The passive menu advertises Tab as its entry key where it has a frame to
+advertise on.
+
+This is a client-independent contract. Any Playbook editor that shows the
+selection menu owes the user this focus model, whichever text surface it is
+built on. A client whose surface would consume Tab as an edit must suppress
+that default explicitly: the whole point of the binding is that a selection is
+live, so a Tab that reaches the text surface replaces the very text the menu
+was offering to act on.
 
 Esc dismisses an open selection menu but preserves the text selection. With
 the menu absent, the editor owns the next key: Tab and S-Tab nest and un-nest
@@ -23,6 +32,13 @@ dismissed while the selection remained active, `C-o` may reopen and focus it.
 `C-g` remains the direct universal-cancel path that clears the selection and
 menu together.
 
+Menu focus is real focus, not a painted highlight: in a client with a focus
+concept of its own, the focused row is what that platform reports as focused
+and exposes to assistive technology. Borrowing focus must not cost the user
+their region — a client whose editor drops selection state on blur restores it
+when focus comes back, so the motions that extended the region still extend it
+and Escape's second stage still has something to cancel.
+
 ## Reason
 
 The menu needs a discoverable, single-key keyboard entry point, while selected
@@ -44,9 +60,19 @@ context menu and the durable editing range one indivisible state. Retaining
 - The advertised entry key and the actual binding must not drift apart.
 - Focused-menu Tab/S-Tab navigation remains symmetric, including terminals
   that report S-Tab as Shift+Tab rather than BackTab.
+- A client adding the selection menu inherits all three states and both Escape
+  stages. Shipping the menu without the focus model is the regression this
+  spec exists to prevent: Tab then falls through to the text surface and
+  destroys the selection instead of acting on it.
+- Because the menu is focusable, it is part of the client's focus order and
+  accessibility tree, and dismissal must return focus somewhere deliberate —
+  the editor, with the selection still live.
 
 ## Non-Goals
 
-- What Enter should do while the menu is merely shown; this spec fixes Tab and
-  Escape ownership, not Enter's meaning.
-- Web UI menu focus, which has its own pointer-first interaction model.
+- What Enter should do while the menu is merely *shown* but unfocused; this
+  spec fixes Tab and Escape ownership, and Enter's meaning only once a row
+  actually holds focus.
+- Pointer interaction, which is unchanged and remains the primary path in
+  clients that have a pointer. Keyboard reachability is additive to it.
+- Which rows the menu offers, and how each is spelled per client.