diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml
new file mode 100644
index 0000000..0ebb2f1
--- /dev/null
+++ b/.github/workflows/typecheck.yml
@@ -0,0 +1,40 @@
+name: Type check
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  typecheck:
+    name: Pyright (Python ${{ matrix.python-version }})
+    runs-on: windows-latest
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        # The widened stub bound selects distinct releases on 3.9 and 3.10+.
+        python-version: ["3.9", "3.10"]
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - name: Set up uv and Python
+        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        with:
+          version: "0.13.4"
+          python-version: ${{ matrix.python-version }}
+          enable-cache: false
+      - name: Install declared development dependencies
+        run: uv sync --group dev
+      - name: Show resolved Windows stubs
+        run: uv run --no-sync python -c "from importlib.metadata import version; print(version('types-pywin32'))"
+      - name: Run configured Pyright
+        run: uv run --no-sync pyright --pythonpath .venv/Scripts/python.exe
diff --git a/agent-notes/repair/task6-libloader-pr15-ci.md b/agent-notes/repair/task6-libloader-pr15-ci.md
new file mode 100644
index 0000000..fb3c9e6
--- /dev/null
+++ b/agent-notes/repair/task6-libloader-pr15-ci.md
@@ -0,0 +1,60 @@
+# Exercise the changed Windows stubs in PR CI
+
+## Goal
+
+Wire the existing dev-group/Pyright authority for libloader PR #15. Smallest
+change: one roughly 40-line workflow and this single task note; no product,
+dependency, support, test or existing release-workflow changes.
+
+## State
+
+Exact origin git@github.com:accessibleapps/libloader.git. Fresh master/base
+a753993f635fe355a0e98e8e4f51a357e7667a89; original open PR #15 head
+f1da9d1237881fa87c00ac4f1f90f6e52b4141bf on
+dependabot/pip/types-pywin32-lt-313.0.0. The PR only widens the dev-only stub
+bound from <310 to <313. Actual Claude approved that original source diff but
+identified missing type-check execution. The push-only distribution build is
+green; it does not install dev dependencies or run Pyright.
+
+New isolated branch repair/task6-libloader-pr15-ci is feature-derived at
+task-6/worktrees/libloader-ci. Separate local-review and remote feature backups
+backup/task6-libloader-pr15-local-before-ci and
+backup/task6-libloader-pr15-remote-before-ci both retain the original f1da9d1
+head. Canonical master, detached review checkout, ignored environment/lock and
+untracked test_architecture_fix.py/tmpclaude-085a-cwd remain untouched.
+
+## Decisions and why
+
+Read global instructions, all tracked source/config/workflow/readme files,
+repository-ci skill and current primary PyPI metadata. No repository AGENTS,
+CLAUDE, .agents or existing task note. No tracked lock or tracked tests.
+
+Python 3.9 resolves changed stubs 311.0.0.20251008 (Requires-Python >=3.9), while
+3.10+ resolves 312.0.0.20261006 (>=3.10). Python 3.8 retains unchanged
+308.0.0.20241221. Therefore use only 3.9 and 3.10 on Windows to exercise the two
+changed dependency branches, not a support-version/platform matrix. Keep
+requires-python >=3.8 and configured Pyright pythonVersion=3.8 unchanged.
+
+Install the existing dev group, print the actual installed stub version, run
+configured Pyright with the selected venv interpreter. Static checking calls
+no COM service and loads no user DLL. CI resolves dependencies because there is
+no authoritative tracked lock; no lock is added. Existing push build/tag release
+workflow remains byte-identical. New workflow uses verified full action pins,
+uv 0.13.4, contents:read, no stored checkout credentials/cache, 10-minute timeout
+and workflow/ref cancellation. No extra lint/tests/scripts are introduced.
+
+## Surprises
+
+Canonical uv.lock is ignored user work, not tracked command authority. The
+original workflow's green package build does not test the changed stub bound.
+The new workflow is not yet published or claimed green; no local CI is run.
+Actionlint v1.7.12 passed and zizmor v1.31.1 offline reported no findings for
+the authored YAML. CRLF-aware diff check and unchanged source/manifest/release
+workflow checks passed. No project lock or runtime output was generated.
+
+## Next step
+
+Return the committed workflow/note diff and exact local head for coordinator
+review before publication. Obtain actual final-head Claude review
+and relevant hosted success before merge. Preserve original feature tips and
+do not edit PR descriptions, release workflow or source.
diff --git a/pyproject.toml b/pyproject.toml
index 7a8bdd2..703fccc 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -34,7 +34,7 @@ dependencies = [
 dev = [
     "ruff>=0.8.0",
     "pyright>=1.1.0",
-    "types-pywin32<310.0.0",
+    "types-pywin32<313.0.0",
 ]
 
 [tool.ruff]