@erclx/canon 4.113.0 → 4.115.0

package/governance/rules/lang/130-go.md

@@ -0,0 +1,40 @@
+---
+description: Enforce Go naming, error wrapping, context passing, and package boundaries
+paths:
+  - '**/*.go'
+---
+
+# Go standards
+
+## Casing conventions
+
+- Use `MixedCaps` for exported names and `mixedCaps` for unexported ones. Never use underscores in a Go identifier.
+- Name packages with one short lowercase word. Do not use `util`, `common`, or `helpers` as a package name.
+- Do not repeat the package name in an exported identifier (`user.New`, not `user.NewUser`).
+- Keep initialisms in one case (`userID`, `HTTPClient`), never `userId` or `HttpClient`.
+
+## Errors
+
+- Return an error as the last result value.
+- Wrap an error with `fmt.Errorf("...: %w", err)` when adding context.
+- Match an error with `errors.Is` or `errors.As`. Never compare `err.Error()` strings.
+- Never discard an error with `_`.
+- Do not `panic` for a failure a caller can expect. Reserve it for a broken invariant.
+
+## Context
+
+- Pass `context.Context` as the first parameter, named `ctx`.
+- Never store a `context.Context` in a struct field.
+- Do not pass a `nil` context. Use `context.TODO()` where none is available yet.
+
+## Interfaces
+
+- Declare an interface in the package that consumes it, not the one that implements it.
+- Keep an interface to the methods its consumer calls.
+- Accept interfaces and return concrete types.
+
+## Packages
+
+- Place code no other module may import under `internal/`.
+- Do not perform side effects in `init`. Wire dependencies explicitly from `main`.
+- Do not hold mutable state in a package-level variable.

package/governance/rules/lang/140-php.md

@@ -0,0 +1,31 @@
+---
+description: Enforce PHP strict types, PSR-4 layout, immutable data shapes, and exception handling
+paths:
+  - '**/*.php'
+---
+
+# PHP standards
+
+## Strictness
+
+- Open every file with `declare(strict_types=1);`.
+- Declare native parameter, return, and property types. Do not rely on a docblock type where a native one exists.
+- Compare with `===` and `!==`. Never use loose `==` or `!=`.
+
+## Layout
+
+- Autoload classes through PSR-4 from `composer.json`. Do not `require` a class file by hand.
+- Declare one class, interface, trait, or enum per file, named after the file.
+
+## Data shapes
+
+- Use a backed `enum` for a closed set over class constants.
+- Use `readonly` properties or a `readonly` class for value objects.
+- Declare classes `final` unless they are designed for extension.
+- Do not pass an associative array across a public boundary where a typed object fits.
+
+## Errors
+
+- Throw a domain exception for a failure. Do not return `false` or `null` to signal one.
+- Never suppress an error with the `@` operator.
+- Do not use `extract`, variable variables, or `eval`.

package/governance/rules/lib/335-testing-go.md

@@ -0,0 +1,35 @@
+---
+description: Enforce Go testing package, table-driven cases, and test helper patterns for Go tests
+paths:
+  - '**/*_test.go'
+---
+
+# Go testing tooling
+
+## Layer
+
+- Load the `canon:test-craft` skill to pick the layer a test belongs at before choosing the tooling below, and report it rather than proceeding silently when the skill does not resolve.
+
+## Framework
+
+- Use the standard `testing` package. Do not add an assertion library for what `t.Errorf` and `t.Fatalf` already state.
+- Place a test beside the code it tests, in a `_test.go` file of the same package.
+- Use an external `<pkg>_test` package when a test should see only the exported API.
+
+## Table-driven cases
+
+- Write cases as a slice of structs run through `t.Run`, over one test function per case.
+- Give every case a `name` field and pass it to `t.Run`.
+
+## Helpers and setup
+
+- Call `t.Helper()` first in every test helper.
+- Use `t.Cleanup` over `defer` for teardown a helper registers.
+- Use `t.TempDir` and `t.Setenv` over hand-rolled temp directories or environment stashes.
+- Use `net/http/httptest` over a real listener.
+
+## Concurrency
+
+- Do not synchronize with `time.Sleep`. Wait on a channel, a `sync.WaitGroup`, or a deadline.
+- Run tests with `-race`.
+- Mark a test `t.Parallel()` only when it shares no mutable state with another test.

package/governance/rules/lib/336-testing-php.md

@@ -0,0 +1,30 @@
+---
+description: Enforce PHPUnit test classes, attributes, and strict assertions for PHP tests
+paths:
+  - 'tests/**/*.php'
+  - '**/*Test.php'
+---
+
+# PHP testing tooling
+
+## Layer
+
+- Load the `canon:test-craft` skill to pick the layer a test belongs at before choosing the tooling below, and report it rather than proceeding silently when the skill does not resolve.
+
+## Framework
+
+- Use PHPUnit for all tests.
+- Declare each test class `final` and extend `PHPUnit\Framework\TestCase`.
+- Place tests under `tests/`, mirroring the `src/` namespace layout, in files named `*Test.php`.
+
+## Attributes
+
+- Use attributes (`#[Test]`, `#[DataProvider]`, `#[CoversClass]`) over docblock annotations.
+- Use a static data provider method for table-driven cases over per-case test methods.
+
+## Assertions and doubles
+
+- Use `assertSame` over `assertEquals`.
+- Use `expectException` over `try` and `catch` for expected exceptions.
+- Use `createStub` where no interaction is asserted. Reserve `createMock` for asserting a call.
+- Do not make real network calls. Use a fake or a stubbed client.

package/governance/rules/lib/360-security-server.md

@@ -4,6 +4,8 @@ paths:
   - '**/*.py'
   - '**/*.ts'
   - '**/*.js'
+  - '**/*.go'
+  - '**/*.php'
 ---
 
 # Server security standards

package/governance/rules/lib/370-database.md

@@ -4,6 +4,8 @@ paths:
   - '**/*.py'
   - '**/*.ts'
   - '**/*.js'
+  - '**/*.go'
+  - '**/*.php'
   - '**/*.sql'
 ---
 

package/governance/rules/ui/410-a11y.md

@@ -60,3 +60,4 @@ paths:
 
 - Let content reflow at a viewport 320 CSS pixels wide with no loss of content or function and no two-dimensional scrolling. Only content whose meaning depends on both axes, such as a data table, a map, or a diagram, may scroll sideways (WCAG Reflow, 1.4.10, Level AA).
 - Treat 320 as the criterion's own test condition rather than a device width. It is equivalent to a 1280 pixel window at 400 percent zoom, so a layout that breaks there breaks for a person who zooms.
+- Hold the same 320 floor for the content region beside persistent chrome a person can resize. The criterion measures the viewport, so this extension is this rule's own rather than the criterion's: a panel widened to 480 in a 768 window leaves 288 for the content, under the floor at a window the criterion passes. `440-surface-capture` states where the frame for it gets taken.

package/governance/rules/ui/440-surface-capture.md

@@ -28,6 +28,8 @@ paths:
 - Capture the full page. Do not capture a component in isolation.
 - Declare the widths a layout case captures. Always include 320, the reflow floor from the reflow criterion in `410-a11y`, then add each breakpoint bucket the project writes rules for, read from the `## Layout` section of `DESIGN.md`.
 - Fall back to the 320 floor alone when the project has no `DESIGN.md` or its record carries no `## Layout` section. Do not impose another project's breakpoints.
+- Add a layout case at each bound when a surface renders persistent chrome a person can resize, such as a draggable sidebar or a split pane, one with the chrome at its narrowest and one at its widest. Take both at the narrowest declared width where the chrome stays persistent rather than collapsing, since a frame where it has turned into an overlay shows none of the width it takes.
+- Read those bounds from the code that clamps the chrome, since `## Layout` has no slot for them. Judge each frame by the content width left beside the chrome rather than by the window width, against the 320 floor `410-a11y` holds for that region.
 - Apply the declaration to a case that covers layout only. A case driving a menu open or an answer chosen tests a state, so it takes one width rather than the full set.
 - Read a capture at 320 as proof that a frame was taken there, not that the page reflows correctly. The criterion is stated in `410-a11y` and nothing here enforces it.
 - Write the capture into a folder named `evidence`. The image is collected for the pull request comment when any segment of its path is literally `evidence` and its filename carries an image extension, so the folder name is fixed and its position in the tree is the project's own.

package/governance/stacks/nextjs.toml

@@ -0,0 +1,2 @@
+extends = "react"
+rules = ["230-nextjs"]

package/governance/stacks/react.toml

@@ -1,2 +1,2 @@
 extends = "node"
-rules = ["200-react", "230-nextjs", "250-tailwind", "300-testing-ts", "305-e2e-reliability", "306-test-scope", "310-zod", "350-security-web", "400-ui", "410-a11y", "420-forms", "430-ux-completeness", "440-surface-capture", "450-link-behavior", "460-design-taste", "465-interface-casing","470-motion"]
+rules = ["200-react", "250-tailwind", "300-testing-ts", "305-e2e-reliability", "306-test-scope", "310-zod", "350-security-web", "400-ui", "410-a11y", "420-forms", "430-ux-completeness", "440-surface-capture", "450-link-behavior", "460-design-taste", "465-interface-casing","470-motion"]

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@erclx/canon",
   "type": "module",
-  "version": "4.113.0",
+  "version": "4.115.0",
   "description": "Infrastructure and quality tooling for developer workflows",
   "license": "MIT",
   "bin": {

package/src/audits/catalog.ts

@@ -2,6 +2,7 @@ import type { SkillsAuditRefusal } from '@/claude/skills-audit'
 import type { RankRefusal } from '@/claude/skills-rank'
 import type { ReachRefusal } from '@/claude/skills-reach'
 import type { ContextAuditRefusal } from '@/context/audit'
+import type { SweepVerdict } from '@/context/classify/patterns'
 import type { AuditRefusal } from '@/deps/audit'
 import type { RestatedRefusal } from '@/gov/restated'
 import type { LabelAuditRefusal } from '@/labels/audit'
@@ -199,6 +200,45 @@ function architectureCounts(
   }
 }
 
+/**
+ * The retained key for each verdict the sweep can return. A record rather than
+ * a list, so the compiler fails here when the classifier gains a verdict,
+ * instead of that verdict's sections dropping out of the tally.
+ */
+const PLACEMENT_KEYS: Record<SweepVerdict, string> = {
+  KEEP: 'keep',
+  REWRITE: 'rewrite',
+  MOVE: 'move',
+}
+
+function isPlacementVerdict(value: unknown): value is SweepVerdict {
+  return typeof value === 'string' && Object.hasOwn(PLACEMENT_KEYS, value)
+}
+
+/**
+ * Tallies the sweep's findings by verdict, with a zero for a verdict nothing
+ * returned, so a baseline reads the same three keys on every run.
+ *
+ * `KEEP` is retained beside the two that ask for a change. It moves when a
+ * section is added or split, which is what tells a falling `rewrite` count
+ * from a corpus that shrank.
+ */
+function placementCounts(record: unknown): Record<string, number> | undefined {
+  const findings = asObject(record)?.findings
+  if (!Array.isArray(findings)) return undefined
+
+  const counts: Record<string, number> = Object.fromEntries(
+    Object.values(PLACEMENT_KEYS).map((key) => [key, 0]),
+  )
+  for (const finding of findings) {
+    const verdict = asObject(finding)?.verdict
+    if (!isPlacementVerdict(verdict)) return undefined
+    counts[PLACEMENT_KEYS[verdict]] += 1
+  }
+
+  return counts
+}
+
 function contextCounts(record: unknown): Record<string, number> | undefined {
   const root = asObject(record)
   if (root === undefined) return undefined
@@ -502,6 +542,18 @@ export const AUDITS: readonly AuditSpec[] = [
     absentReasons: ['no-folders'] satisfies ContextAuditRefusal[],
     counts: contextCounts,
   },
+  {
+    id: 'placement',
+    label: 'Context placement',
+    // Pinned to the regex layer rather than the resolved classifier setting.
+    // A count that moves with whichever model a machine runs is not
+    // comparable across clones, and the model layer turns a sub-second read
+    // into a multi-minute one. `document-health` is where the model reads.
+    argv: ['context', 'classify', 'sweep', '--backend', 'off', '--json'],
+    gatingExits: [],
+    corpus: 'tracked',
+    counts: placementCounts,
+  },
   {
     id: 'markdown',
     label: 'Markdown corpus',

package/src/commands/context.ts

@@ -14,6 +14,8 @@ import {
   missingSections,
   PROVENANCE_FOLDER,
   REQUIRED_SECTIONS,
+  REQUIRED_SECTIONS_BY_FOLDER,
+  requiredSections,
   type SectionFinding,
 } from '@/context/audit'
 import {
@@ -129,8 +131,9 @@ export function register(program: Command): void {
         'it holds more decisions than the cap. A record stating neither is',
         'reported and never gated. --gate widens the gate to the other two',
         'findings that are facts rather than judgments: a missing required',
-        'section and index',
-        'drift. Entry length, reference form, table, provenance, narration,',
+        'section and index drift. A context entry requires Overview and',
+        'Layout, and a wireframe requires Regions, States, Copy, and Not on',
+        'this surface. Entry length, reference form, table, provenance, narration,',
         'and the record claim classification are judgments under both.',
         '',
         'Depth and bullet weight are stated over every markdown file rather',
@@ -740,6 +743,10 @@ async function runAudit(
           renderWidth: RENDER_WIDTH,
           provenanceFolder: PROVENANCE_FOLDER,
           requiredSections: REQUIRED_SECTIONS,
+          // Keyed on the audited folder name. The flat key above stays for a
+          // caller that read it before wireframes owed a section, since turning
+          // it into this map would break that caller without an error.
+          requiredSectionsByFolder: REQUIRED_SECTIONS_BY_FOLDER,
           // Three states rather than two, so a record showing no finding says
           // which terms were looked for. The key is absent when the run never
           // scanned, which is `--citations-only`, and null when it scanned and
@@ -946,7 +953,8 @@ function reportReferenceForm(
 
 /**
  * Names the path each finding belongs to, which is an entry in the folder named
- * under `.claude/` and the folder itself in a domain split across one. States
+ * under `.claude/`, the folder itself in a domain split across one, and the
+ * file in any wireframe folder. States
  * the reach on every run for the reason the provenance report does.
  *
  * This prints ahead of the four readability measures because a missing section
@@ -959,19 +967,31 @@ function reportSections(
 ): void {
   logStep('Sections')
 
-  const governed = folders.filter(governsContent)
-  if (governed.length === 0) {
+  const names = [
+    ...new Set(
+      folders
+        .filter((folder) => requiredSections(folder).length > 0)
+        .map((folder) => folder.name),
+    ),
+  ]
+  if (names.length === 0) {
     logInfo(
-      `Out of scope. The list is stated in the standard governing canon/${PROVENANCE_FOLDER}/, and no audited folder is that one.`,
+      `Out of scope. The lists are stated in the standards governing ${Object.keys(
+        REQUIRED_SECTIONS_BY_FOLDER,
+      )
+        .map((name) => `canon/${name}/`)
+        .join(' and ')}, and no audited folder is one of them.`,
     )
     return
   }
 
+  for (const name of names) {
+    logInfo(
+      `canon/${name}/ requires ${REQUIRED_SECTIONS_BY_FOLDER[name].join(', ')}.`,
+    )
+  }
   logInfo(
-    `Covers canon/${PROVENANCE_FOLDER}/ alone, whose standard requires ${REQUIRED_SECTIONS.join(' and ')}.`,
-  )
-  logInfo(
-    'A heading at any level counts. Each entry answers for itself, except in a domain split across a folder, where a sibling answers for the rest.',
+    'A heading at any level counts. Each entry answers for itself, except in a context domain split across a folder, where a sibling answers for the rest. A wireframe answers for itself in every folder.',
   )
 
   if (missing.length === 0) {

package/src/commands/records.ts

@@ -330,6 +330,12 @@ function backupHelp(verb: 'push' | 'pull'): string {
           'It commits nothing outside the folders above and leaves the project working',
           'tree untouched. The push runs even when this call committed nothing, since a',
           'previous run can have committed and then failed to reach the network.',
+          '',
+          'Before staging, it refuses the whole push as unsafe-payload when any new or',
+          'changed file is over 25 MB or carries a credential canon secrets scan would',
+          'report, naming each path. Nothing is staged or committed when it refuses.',
+          'A push the remote rejects undoes the commit this call made, so the records',
+          'stay on disk and no later run sends that commit again.',
         ]
       : [
           'It refuses rather than discarding local records that never reached the remote,',
@@ -569,6 +575,12 @@ async function runPush(opts: BackupCommandOptions): Promise<number> {
   if (outcome.firstSeen.length > 0) {
     logWarn(`first seen: ${outcome.firstSeen.join(', ')}`)
   }
+  for (const path of outcome.added) logInfo(`added: ${path}`)
+  if (outcome.dropped.length > 0) {
+    logWarn(
+      `excluded but still tracked, removed from the history going forward: ${outcome.dropped.join(', ')}`,
+    )
+  }
   logStep(outcome.pushed ? 'Pushed' : 'Nothing to push')
   logInfo(
     outcome.commit
@@ -609,7 +621,11 @@ async function runPull(opts: BackupCommandOptions): Promise<number> {
  */
 function reportRefusal(
   banner: string,
-  outcome: { readonly reason: string; readonly message: string },
+  outcome: {
+    readonly reason: string
+    readonly message: string
+    readonly blocked?: readonly unknown[]
+  },
   emitJson: boolean,
 ): number {
   if (emitJson) {
@@ -619,6 +635,7 @@ function reportRefusal(
         ok: false,
         reason: outcome.reason,
         message: outcome.message,
+        ...(outcome.blocked ? { blocked: outcome.blocked } : {}),
       })}\n`,
     )
     return 1

package/src/commands/teach.ts

@@ -797,6 +797,7 @@ function reportNav(
         root: outcome.root,
         contents: outcome.contents,
         lessons: outcome.lessons,
+        reference: outcome.reference,
         skipped: outcome.skipped,
       })}\n`,
     )
@@ -810,9 +811,11 @@ function reportNav(
   for (const path of outcome.contents) logInfo(path)
   logStep('Lessons rewritten')
   logInfo(String(outcome.lessons))
+  logStep('Reference pages rendered')
+  logInfo(String(outcome.reference))
 
   if (outcome.skipped.length > 0) {
-    logStep('Refused, missing a chrome marker')
+    logStep('Refused, missing a chrome marker or the markdown renderer')
     for (const skip of outcome.skipped) {
       logWarn(`${skip.file}: no ${skip.missing}`)
     }

package/src/commands/tooling.ts

@@ -20,6 +20,7 @@ import {
 import { readReference, resolveReference } from '@/tooling/read'
 import { scan, type ScanResult } from '@/tooling/scan'
 import { recordToolingChain } from '@/tooling/stamp'
+import { subfolderPath } from '@/tooling/subfolder'
 import {
   intro,
   isNonInteractive,
@@ -93,6 +94,11 @@ export function register(program: Command): void {
         '  canon tooling sync base',
         '  canon tooling sync base --check',
         '  CANON_NON_INTERACTIVE=1 canon tooling sync base --write',
+        '  canon tooling sync vite-react web --skip base',
+        '',
+        'A target below its git root syncs as a subfolder. It withholds',
+        '.github/, which GitHub reads only at the root, and writes a nested',
+        'cspell.json registering the stack word lists.',
         '',
         'To gate CI on tooling drift, run headlessly with neither flag. That',
         'exits 1 when a file would be replaced and 0 when none would, which is',
@@ -358,7 +364,7 @@ async function runSync(
 
   const result = scan(prepared.chain, prepared.target)
 
-  report(result)
+  report(result, prepared.target)
 
   if (opts.diff !== undefined) {
     if (opts.diff.json) {
@@ -568,7 +574,7 @@ async function promptForStack(): Promise<string | undefined> {
   })
 }
 
-function report(result: ScanResult): void {
+function report(result: ScanResult, target: string): void {
   logStep('Scanning configs')
   for (const entry of result.configs) {
     if (entry.state === 'matching') logInfo(entry.rel)
@@ -580,6 +586,8 @@ function report(result: ScanResult): void {
     if (entry.state === 'new') logAdd(entry.rel)
   }
 
+  if (result.withheld.length > 0) reportWithheld(result, target)
+
   logStep('Scanning seeds')
   for (const entry of result.seeds) {
     if (entry.state === 'present') logInfo(entry.rel)
@@ -591,6 +599,7 @@ function report(result: ScanResult): void {
   if (result.hasPackageJson) {
     reportPackage(result)
   } else {
+    logStep('Scanning package.json')
     logWarn(
       "Skipped scripts and deps: no package.json found (run 'bun init' to enable)",
     )
@@ -605,6 +614,20 @@ function report(result: ScanResult): void {
   }
 }
 
+function reportWithheld(result: ScanResult, target: string): void {
+  logStep('Withheld from a subfolder')
+  for (const entry of result.withheld) logWarn(entry.rel)
+  for (const entry of result.withheld) {
+    if (entry.present) {
+      logWarn(`${entry.rel} is already here, and GitHub never reads this copy`)
+    }
+  }
+  logInfo(
+    'GitHub reads workflows only at the repository root. Add a root job that runs this folder with:',
+  )
+  logInfo(`working-directory: ${subfolderPath(target) ?? '.'}`)
+}
+
 function reportPackage(result: ScanResult): void {
   if (result.scripts.length > 0) {
     logStep('Scanning scripts')

package/src/context/audit.ts

@@ -45,19 +45,35 @@ export const CATALOG_ROW_CHECKPOINT = 6
 const CATALOG_NAMED_RATIO = 0.6
 
 /**
- * Sections `standards/context.md` marks required, in the order it states them.
+ * Required sections per audited folder name, each in the order its standard
+ * states them.
  *
- * The list is held here rather than read out of the standard, the way the four
- * checkpoints above quote their numbers. A parser over the standard's prose
+ * The lists are held here rather than read out of the standards, the way the
+ * four checkpoints above quote their numbers. A parser over a standard's prose
  * would decide which sections are required from the wording around them, so it
  * fails on a rewrite of that wording rather than on a defect in an entry.
  *
  * These names do not generalize the way a length threshold does, which is why
- * the measure is scoped to the folder `governsContent` names. A diagram entry
- * declares a heading per kind and a wireframe entry per screen, and neither
- * sibling standard states a required section at all.
+ * each list is keyed on the folder whose standard states it. `context.md`
+ * requires an overview and a layout. `wireframes.md` asks four questions of a
+ * surface and answers each in a section, so those four are required and
+ * `## Behavior` is not, since a static surface has no interaction to state. A
+ * diagram entry declares a heading per kind and its standard requires none.
  */
-export const REQUIRED_SECTIONS: readonly string[] = ['Overview', 'Layout']
+export const REQUIRED_SECTIONS_BY_FOLDER: Readonly<
+  Record<string, readonly string[]>
+> = {
+  context: ['Overview', 'Layout'],
+  wireframes: ['Regions', 'States', 'Copy', 'Not on this surface'],
+}
+
+/**
+ * The context standard's list, kept as its own export because the audit record
+ * has published it flat under `checkpoints.requiredSections` since before any
+ * other folder required a section.
+ */
+export const REQUIRED_SECTIONS: readonly string[] =
+  REQUIRED_SECTIONS_BY_FOLDER.context
 
 const HEADING_TEXT = /^#{1,6}\s+(.+?)\s*$/
 const TABLE_ROW = /^\s*\|/
@@ -226,7 +242,7 @@ export interface EntryReport {
   readonly bareReferences: readonly BareReferenceFinding[]
   /**
    * Required sections this entry declares, in the standard's order, and empty
-   * outside the folder whose standard names them. What the folder is short of
+   * outside a folder whose standard names them. What the folder is short of
    * is `missingSections`, since one entry answers for its siblings.
    */
   readonly sections: readonly string[]
@@ -550,17 +566,20 @@ function narration(
  * Fenced blocks are skipped for the reason the scans above skip them. A
  * standard quoted inside an example declares nothing about the entry quoting it.
  */
-function declaredSections(lines: readonly BodyLine[]): string[] {
+function declaredSections(
+  lines: readonly BodyLine[],
+  required: readonly string[],
+): string[] {
   const found = new Set<string>()
 
   for (const line of lines) {
     if (line.fenced) continue
 
     const match = line.text.match(HEADING_TEXT)
-    if (match && REQUIRED_SECTIONS.includes(match[1])) found.add(match[1])
+    if (match && required.includes(match[1])) found.add(match[1])
   }
 
-  return REQUIRED_SECTIONS.filter((section) => found.has(section))
+  return required.filter((section) => found.has(section))
 }
 
 /**
@@ -611,7 +630,9 @@ function bareReferences(
  * The caller passes jurisdiction rather than deriving it from `rel`, because a
  * path prefix hardcodes what `--folder` exists to override and misses a domain
  * split into `context/<sub-area>/`. Sibling names arrive the same way and for
- * the same reason, since the folder an entry sits in is what holds them.
+ * the same reason, since the folder an entry sits in is what holds them. The
+ * required sections arrive apart from jurisdiction, since a wireframe owes
+ * sections under a standard that states no provenance rule.
  */
 export function measureEntry(
   rel: string,
@@ -619,6 +640,7 @@ export function measureEntry(
   governsContent = true,
   terms?: NarrationTerms,
   siblings: readonly string[] = [],
+  required: readonly string[] = governsContent ? REQUIRED_SECTIONS : [],
 ): EntryReport {
   const lines = bodyLines(source)
 
@@ -632,7 +654,7 @@ export function measureEntry(
     provenance: governsContent ? provenance(lines) : [],
     narration: governsContent && terms ? narration(lines, terms) : [],
     bareReferences: bareReferences(lines, siblings),
-    sections: governsContent ? declaredSections(lines) : [],
+    sections: declaredSections(lines, required),
     stub: isStubSeed(source),
     governed: governsContent,
   }
@@ -713,6 +735,7 @@ export async function measureFolders(
           governsContent(folder),
           terms,
           names.filter((name) => name !== self),
+          requiredSections(folder),
         ),
       )
     }
@@ -726,6 +749,13 @@ export function governsContent(folder: AuditedFolder): boolean {
   return folder.name === PROVENANCE_FOLDER
 }
 
+/** Names the sections the folder's standard requires, empty where it states none. */
+export function requiredSections(folder: AuditedFolder): readonly string[] {
+  return Object.hasOwn(REQUIRED_SECTIONS_BY_FOLDER, folder.name)
+    ? REQUIRED_SECTIONS_BY_FOLDER[folder.name]
+    : []
+}
+
 /**
  * Reports whether a bare sibling name here is a reference by construction.
  *
@@ -765,6 +795,11 @@ export function matchesSiblings(folder: AuditedFolder): boolean {
  * The standard sanctions omitting `## Layout` from a domain owning no paths,
  * which no measure can tell from an entry that forgot it. An entry of that
  * shape therefore reports, which is a reason this is printed and never gated on.
+ *
+ * A wireframe folder answers per file whether nested or not, since its
+ * standard keeps one surface per file. A subfolder of wireframes groups
+ * surfaces the way the named context folder groups domains, so a conforming
+ * sibling there says nothing about the surface beside it.
  */
 export function missingSections(
   root: string,
@@ -774,11 +809,12 @@ export function missingSections(
   const byRel = new Map(entries.map((entry) => [entry.rel, entry]))
   const findings: SectionFinding[] = []
 
-  const shortOf = (declared: readonly string[]): string[] =>
-    REQUIRED_SECTIONS.filter((name) => !declared.includes(name))
-
   for (const folder of folders) {
-    if (!governsContent(folder) || folder.entries.length === 0) continue
+    const required = requiredSections(folder)
+    if (required.length === 0 || folder.entries.length === 0) continue
+
+    const shortOf = (declared: readonly string[]): string[] =>
+      required.filter((name) => !declared.includes(name))
 
     // A stub owes no sections, so it is dropped before either branch rather
     // than inside them. Leaving one in the split-folder aggregate would let a
@@ -790,7 +826,7 @@ export function missingSections(
 
     if (reports.length === 0) continue
 
-    if (folder.nested) {
+    if (folder.nested && governsContent(folder)) {
       const missing = shortOf(reports.flatMap((entry) => entry.sections))
       if (missing.length > 0) findings.push({ rel: folder.rel, missing })
       continue