@erclx/canon 4.117.0 → 4.119.0

package/src/sync/engine.ts

@@ -8,8 +8,11 @@ import {
   type DomainHashes,
   hashFile,
   readStamp,
+  type Stamp,
+  type StampDomain,
   type StampSource,
   stampedHashes,
+  stampedVersion,
   toStampKey,
   writeStamp,
 } from '@/sync/stamp'
@@ -26,6 +29,8 @@ import {
   palette,
   select,
 } from '@/ui'
+import { compareVersions, parseVersion } from '@/version/compare'
+import { readInstalled, UNKNOWN_LABEL } from '@/version/installed'
 
 /**
  * One installed file in three path flavours: absolute, relative to the
@@ -58,10 +63,17 @@ export type SyncChange =
  * who moved it. `stale` and `customized` need the stamp to tell apart, so
  * `drifted` stays the verdict for a difference no stamp covers.
  *
- * `orphaned` and `stranded` both mean the walk found no source, and they are
- * separate because they need opposite treatment. A project-authored file is
- * orphaned and stays that way forever. A stamped file the toolkit no longer
- * installs to is stranded, which is a relocation waiting on a decision.
+ * `orphaned`, `retired`, and `stranded` all mean the walk found no source, and
+ * they are separate because they need different treatment. A project-authored
+ * file is orphaned and stays that way forever. A file under a root the toolkit
+ * owns outright is retired, since only the toolkit ever wrote there, and a
+ * sync deletes it. A stamped file the toolkit no longer installs to is
+ * stranded, which is a relocation waiting on a decision.
+ *
+ * `renamed` is the fourth sourceless state and the only one that installs.
+ * It is a retired file whose rule the adapter declares still ships under a
+ * new name, so the sync deletes the old file and copies the rule to the new
+ * one.
  *
  * `missing` is the one state the walk cannot produce on its own, since the
  * walk only iterates files that exist. It comes from `collectMissing`
@@ -73,6 +85,8 @@ export type EntryState =
   | 'customized'
   | 'drifted'
   | 'orphaned'
+  | 'retired'
+  | 'renamed'
   | 'stranded'
   | 'missing'
 
@@ -152,6 +166,25 @@ export interface SyncAdapter {
    * inference orphans a file sitting anywhere else.
    */
   readonly projectSubdir?: string
+  /**
+   * Every file under `installedRoot` is the toolkit's, so a walked file with
+   * no source is a leftover of a rule the toolkit retired or renamed rather
+   * than something a project wrote. Setting it turns that file into a
+   * `retired` entry and queues its delete, edited or not, whatever the stamp
+   * holds, or a `renamed` one when `locateSuccessor` names where it ships
+   * now. Unset, the file stays `orphaned` and untouched.
+   */
+  readonly ownsInstalledRoot?: boolean
+  /**
+   * Where a sourceless file's rule ships now, when the toolkit declares it
+   * renamed rather than retired. Reached only on a root the adapter owns and
+   * never past the newer-install guard. Unset, or returning nothing, leaves
+   * the file `retired`.
+   */
+  locateSuccessor?(
+    file: InstalledFile,
+    target: string,
+  ): { readonly source: string; readonly dest: string } | undefined
   /** Defaults to applying. */
   readonly nonInteractive?: NonInteractivePolicy
   /** Runs on a completed sync, including one with no changes. */
@@ -195,16 +228,20 @@ export function listInstalled(
 
 /**
  * Classifies every installed file against its source without writing anything.
- * A file with no source is left alone rather than deleted, which is what keeps
- * project-authored rules alive across a sync.
+ * A file with no source is deleted only when the adapter owns its installed
+ * root outright, and left alone otherwise, which is what keeps a
+ * project-authored file alive across a sync of a root the project shares.
  */
 export function planSync(adapter: SyncAdapter, target: string): SyncPlan {
   const entries: ScanEntry[] = []
   const changes: SyncChange[] = []
   const unattributed: UnattributedFile[] = []
 
-  const hashes = stampedHashes(readStamp(target), adapter.stamp?.domain)
+  const stamp = readStamp(target)
+  const hashes = stampedHashes(stamp, adapter.stamp?.domain)
+  const newerInstall = newerInstallingVersion(stamp, adapter.stamp?.domain)
   const walked = new Set<string>()
+  const pendingCopies = new Set<string>()
 
   for (const file of listInstalled(
     adapter.installedRoot(target),
@@ -222,7 +259,46 @@ export function planSync(adapter: SyncAdapter, target: string): SyncPlan {
     const source = adapter.locateSource(file)
 
     if (source === undefined || !existsSync(source)) {
-      entries.push(misplacedOrphan(adapter, target, file))
+      if (adapter.ownsInstalledRoot !== true) {
+        entries.push(misplacedOrphan(adapter, target, file))
+        continue
+      }
+
+      if (newerInstall !== undefined) {
+        entries.push(heldForNewerInstall(file, newerInstall))
+        continue
+      }
+
+      const successor = adapter.locateSuccessor?.(file, target)
+      if (successor === undefined) {
+        entries.push({
+          state: 'retired',
+          rel: file.rel,
+          notice: `${file.rel} (no longer shipped by the toolkit, removing)`,
+        })
+        changes.push({ kind: 'delete', dest: file.path, rel: file.rel })
+        continue
+      }
+
+      const destRel = relative(target, successor.dest)
+      entries.push({
+        state: 'renamed',
+        rel: file.rel,
+        notice: renamedNotice(file, destRel, attribute(hashes, file)),
+      })
+
+      // A second predecessor of one successor, or a successor the target
+      // already holds, still loses its old file but must not overwrite.
+      if (!existsSync(successor.dest) && !pendingCopies.has(successor.dest)) {
+        pendingCopies.add(successor.dest)
+        changes.push({
+          kind: 'copy',
+          source: successor.source,
+          dest: successor.dest,
+          rel: destRel,
+        })
+      }
+      changes.push({ kind: 'delete', dest: file.path, rel: file.rel })
       continue
     }
 
@@ -438,6 +514,10 @@ function report(adapter: SyncAdapter, plan: SyncPlan): void {
       )
     else if (entry.state === 'customized')
       logWarn(`${entry.rel} (locally customized)`)
+    else if (entry.state === 'retired')
+      logWarn(entry.notice ?? `${entry.rel} (no longer shipped by the toolkit)`)
+    else if (entry.state === 'renamed')
+      logWarn(entry.notice ?? `${entry.rel} (renamed by the toolkit)`)
     else if (entry.state === 'stranded')
       logWarn(`${entry.rel} (installed here by an older toolkit, now moved)`)
     else if (entry.state === 'missing')
@@ -528,6 +608,10 @@ function isProjectAuthored(adapter: SyncAdapter, file: InstalledFile): boolean {
  * Naming the destination is all this does. Moving the file rewrites a path the
  * project's own rules, skills, and docs may cite, so the sync leaves it where
  * it is.
+ *
+ * An adapter declaring `ownsInstalledRoot` never reaches this, since owning
+ * the root answers the question neither the name nor the stamp can, and its
+ * sourceless file is retired instead.
  */
 function misplacedOrphan(
   adapter: SyncAdapter,
@@ -549,6 +633,65 @@ function misplacedOrphan(
   }
 }
 
+/**
+ * The release that last wrote this domain, when it is newer than the one
+ * running. A binary older than that release cannot tell a rule it retired
+ * from one added after it, so it holds every sourceless file rather than
+ * deleting rules the newer release installed. An unparseable side holds too,
+ * since deleting on a comparison that never ran is the failure this guards.
+ * A stamp with no version predates the field and is never newer.
+ */
+function newerInstallingVersion(
+  stamp: Stamp | undefined,
+  domain: StampDomain | undefined,
+): { readonly stamped: string; readonly running: string } | undefined {
+  if (domain === undefined) return undefined
+
+  const stamped = stampedVersion(stamp, domain)
+  if (stamped === undefined) return undefined
+
+  const running = readInstalled().version ?? UNKNOWN_LABEL
+  const parsedStamped = parseVersion(stamped)
+  const parsedRunning = parseVersion(running)
+
+  if (
+    parsedStamped !== undefined &&
+    parsedRunning !== undefined &&
+    compareVersions(parsedStamped, parsedRunning) <= 0
+  ) {
+    return undefined
+  }
+
+  return { stamped, running }
+}
+
+/**
+ * The new name gets the toolkit's source rather than the old file's content,
+ * so a local edit is dropped the way a retire drops one. With no stamp the
+ * edit cannot be proven either way, so the line hedges rather than asserts.
+ */
+function renamedNotice(
+  file: InstalledFile,
+  destRel: string,
+  state: EntryState,
+): string {
+  const base = `${file.rel} (renamed to ${destRel} by the toolkit, moving`
+  if (state === 'customized') return `${base}. Local edits were not carried.)`
+  if (state === 'drifted') return `${base}. Any local edits were not carried.)`
+  return `${base})`
+}
+
+function heldForNewerInstall(
+  file: InstalledFile,
+  versions: { readonly stamped: string; readonly running: string },
+): ScanEntry {
+  return {
+    state: 'orphaned',
+    rel: file.rel,
+    notice: `${file.rel} (installed by canon ${versions.stamped}, newer than this ${versions.running}. Upgrade canon to sync it.)`,
+  }
+}
+
 function isInside(target: string, path: string): boolean {
   const rel = relative(target, path)
   return rel !== '' && !rel.startsWith('..') && !isAbsolute(rel)
@@ -567,8 +710,9 @@ function hasUnattributedDrift(plan: SyncPlan): boolean {
 /**
  * Records what the toolkit placed, after the copies land, so a partial apply
  * that throws leaves the previous stamp rather than a claim the target does not
- * meet. A file with no source, or one orphaned by location, is
- * project-authored and stays out.
+ * meet. A file with no source stays out, whether it is project-authored or a
+ * retired leftover a declined sync did not delete, and so does one orphaned by
+ * location.
  *
  * Reads the installed tree rather than the caller's file list, so a partial
  * install still stamps the domain's whole installed set.

package/src/sync/stamp.ts

@@ -5,6 +5,8 @@ import { dirname, join, sep } from 'node:path'
 import { execa } from 'execa'
 import { resolveExisting } from '@/legacy-path'
 import { recordTarget } from '@/targets/registry'
+import { compareVersions, parseVersion } from '@/version/compare'
+import { readInstalled } from '@/version/installed'
 
 /**
  * Domains the stamp can record. Governance and design both attribute file by
@@ -38,6 +40,14 @@ export type DomainHashes = Readonly<Record<string, string>>
 export interface DomainStamp {
   /** Toolkit revision this domain last synced from. Absent outside a git clone. */
   readonly commit?: string
+  /**
+   * Newest canon release that has written this domain. A sync deletes an
+   * installed file its toolkit does not ship, and a binary older than the one
+   * that installed the file cannot tell a retired file from one added after
+   * its own release, so this is what it reads before deleting anything.
+   * Absent on a stamp written before the field existed.
+   */
+  readonly version?: string
   readonly syncedAt: string
   readonly files: DomainHashes
   /**
@@ -178,6 +188,14 @@ function readStampFile(path: string): Stamp | undefined {
   }
 }
 
+/** The newest canon release that has written this domain, when one was recorded. */
+export function stampedVersion(
+  stamp: Stamp | undefined,
+  domain: StampDomain,
+): string | undefined {
+  return stamp?.domains[domain]?.version
+}
+
 /** The revision this domain last synced from, which bounds its upstream range. */
 export function stampedCommit(
   stamp: Stamp | undefined,
@@ -245,9 +263,11 @@ async function putDomain(
   const previous = readStamp(target)
   const previousRecord = previous?.domains[source.domain]
   const commit = await toolkitCommit(source.toolkitRoot)
+  const version = newerVersion(readInstalled().version, previousRecord?.version)
 
   const record: DomainStamp = {
     ...(commit === undefined ? {} : { commit }),
+    ...(version === undefined ? {} : { version }),
     syncedAt: now.toISOString(),
     files: payload.files ?? previousRecord?.files ?? {},
     ...resolveChainField(payload.chain, previousRecord?.chain),
@@ -304,6 +324,27 @@ async function readCommit(root: string): Promise<string | undefined> {
     : undefined
 }
 
+/**
+ * Keeps the newer of the running release and the one already recorded, so an
+ * older binary syncing after a newer one cannot lower the mark and let a later
+ * run delete a rule the newer release installed. An unparseable side loses to
+ * a parseable one, and a recorded value survives an unreadable manifest.
+ */
+function newerVersion(
+  running: string | undefined,
+  recorded: string | undefined,
+): string | undefined {
+  if (running === undefined) return recorded
+  if (recorded === undefined) return running
+
+  const parsedRunning = parseVersion(running)
+  const parsedRecorded = parseVersion(recorded)
+  if (parsedRecorded === undefined) return running
+  if (parsedRunning === undefined) return recorded
+
+  return compareVersions(parsedRecorded, parsedRunning) > 0 ? recorded : running
+}
+
 /**
  * A write naming no chain keeps the domain's previous one rather than dropping
  * it, since `writeStamp` and `writeChainStamp` each touch one half of a
@@ -365,6 +406,9 @@ function isDomainStamp(value: unknown): value is DomainStamp {
   if (value.commit !== undefined && typeof value.commit !== 'string') {
     return false
   }
+  if (value.version !== undefined && typeof value.version !== 'string') {
+    return false
+  }
   if (value.chain !== undefined && !isStringArray(value.chain)) return false
 
   return Object.values(value.files).every((hash) => typeof hash === 'string')

package/src/tasks/archive.ts

@@ -46,6 +46,7 @@ export const ARCHIVE_REFUSALS = [
   'ambiguous',
   'no-outcomes',
   'open-outcomes',
+  'earlier-slice',
   'bad-input',
 ] as const
 
@@ -235,12 +236,19 @@ export function readOutcomes(text: string): TaskOutcomes {
 
 /**
  * Reads the `Pull request:` line `git-pr` writes when a pull request opens.
- * The number is a bare `#NNN` the way `Issue:` is, since neither is a path and
- * a full URL would write the remote into a gitignored file.
+ * Each number is a bare `#NNN` the way `Issue:` is, since neither is a path and
+ * a full URL would write the remote into a gitignored file. A task shipped in
+ * slices lists one per slice, oldest first, so the line reads as a list. A line
+ * carrying anything besides that list reads as naming none, rather than as the
+ * numbers that happened to parse.
  */
-export function readPullRequest(text: string): number | undefined {
-  const match = /^Pull request:\s*#(\d+)\s*$/m.exec(text)
-  return match ? Number(match[1]) : undefined
+export function readPullRequest(text: string): readonly number[] {
+  const match = /^Pull request:[ \t]*(#\d+(?:[ \t]*,[ \t]*#\d+)*)[ \t]*$/m.exec(
+    text,
+  )
+  if (!match) return []
+
+  return match[1].split(',').map((entry) => Number(entry.trim().slice(1)))
 }
 
 /**
@@ -628,11 +636,13 @@ async function matchByPullRequest(
   const read = await Promise.all(
     stems.map(async (stem) => ({
       stem,
-      number: readPullRequest(await readFile(join(dir, `${stem}.md`), 'utf8')),
+      numbers: readPullRequest(await readFile(join(dir, `${stem}.md`), 'utf8')),
     })),
   )
 
-  return read.filter((entry) => entry.number === number).map(({ stem }) => stem)
+  return read
+    .filter((entry) => entry.numbers.includes(number))
+    .map(({ stem }) => stem)
 }
 
 /**
@@ -748,6 +758,17 @@ export async function archiveTask(
   const from = join(dir, `${stem}.md`)
   const text = await readFile(from, 'utf8')
 
+  // `docs-fold` ticks outcomes at ship time, before the merge, so an earlier
+  // slice merging after the last slice shipped would find every box ticked
+  // while the last slice is still open. Only the last number closes the task.
+  const last = readPullRequest(text).at(-1)
+  if (selector.kind === 'pull-request' && last !== selector.number) {
+    return refuse(
+      'earlier-slice',
+      `${stem} lists #${last} after #${selector.number}, so the task closes when #${last} merges.`,
+    )
+  }
+
   const { open, closed, cut } = readOutcomes(text)
 
   if (open.length > 0) {

package/src/tasks/record.ts

@@ -10,6 +10,7 @@ import {
   OUTCOME_PATTERN,
   planLine,
   readPlanTarget,
+  readPullRequest,
   tasksDir,
 } from '@/tasks/archive'
 
@@ -49,7 +50,7 @@ export type RecordSelector =
   | { readonly kind: 'stem'; readonly stem: string }
   | { readonly kind: 'plan'; readonly plan: string }
 
-export type LineAction = 'added' | 'corrected' | 'unchanged'
+export type LineAction = 'added' | 'appended' | 'corrected' | 'unchanged'
 
 export interface PullRequestRecorded {
   readonly ok: true
@@ -101,9 +102,10 @@ function planKey(reference: string): string {
 
 /**
  * Places the `Pull request:` line under the origin lines the task already
- * carries, and corrects the number in place when the line exists. A task with
- * no origin line takes it under the H1, which is the only other anchor the
- * board format guarantees.
+ * carries. A task shipped in slices lists every pull request, so a new number
+ * appends to an existing line rather than replacing it, and a line that does
+ * not read as a list is replaced whole. A task with no origin line takes it
+ * under the H1, which is the only other anchor the board format guarantees.
  */
 export function writePullRequestLine(
   text: string,
@@ -114,9 +116,14 @@ export function writePullRequestLine(
   const existing = lines.findIndex((entry) => entry.startsWith('Pull request:'))
 
   if (existing !== -1) {
-    if (lines[existing] === line) return { text, action: 'unchanged' }
-    lines[existing] = line
-    return { text: lines.join('\n'), action: 'corrected' }
+    const listed = readPullRequest(lines[existing])
+    if (listed.includes(number)) return { text, action: 'unchanged' }
+    if (listed.length === 0) {
+      lines[existing] = line
+      return { text: lines.join('\n'), action: 'corrected' }
+    }
+    lines[existing] = `${lines[existing].trimEnd()}, #${number}`
+    return { text: lines.join('\n'), action: 'appended' }
   }
 
   const origin = lastOriginLine(lines)
@@ -143,8 +150,8 @@ function lastOriginLine(lines: readonly string[]): number | undefined {
 }
 
 /**
- * Places the `Plan:` line right after the H1, mirroring
- * `writePullRequestLine`'s add/correct/unchanged shape. `Plan:` is the first
+ * Places the `Plan:` line right after the H1, and corrects the target in place
+ * when the line exists, since a task runs under one plan. `Plan:` is the first
  * origin line a task carries, so it anchors on the heading itself rather than
  * on the last origin line above it.
  */

package/src/tasks/validate.ts

@@ -1071,7 +1071,9 @@ async function checkCitedTask(
   const { open, closed } = readOutcomes(text)
   if (open.length > 0 || closed.length === 0) return nothing()
 
-  const pullRequest = readPullRequest(text)
+  // The last number is the newest slice, and an earlier one closed without
+  // merging never lands, so only the last says whether the work reached trunk.
+  const pullRequest = readPullRequest(text).at(-1)
   if (pullRequest === undefined) {
     return untestedRow(
       group,

package/standards/plan.md

@@ -31,6 +31,7 @@ A plan works when a session holding none of the conversation that produced it ca
 - Which decisions are already settled, and which are still open?
 - For each open decision, what happens when nobody answers it?
 - What is likely to go wrong, and where does the work collide with something already in flight?
+- How is each outcome proven, and which input would break it?
 
 A plan failing these is non-conforming even when it satisfies every shape rule below.
 
@@ -53,10 +54,12 @@ The document opens with `# Feature: <short title>` and one paragraph stating wha
 | `## Summary`          | three to five one-line bullets: the goal, the deliverables, the trade-off | Always        |
 | `**Constraints:**`    | durable rules the work must respect                                       | When supplied |
 | `**Files to touch:**` | each file with a one-line reason                                          | Always        |
+| `**Verification:**`   | the test or command that proves each outcome                              | Always        |
 | `**Risks:**`          | conflicts, coupling, and the tricky spots                                 | Always        |
+| `**Review focus:**`   | the inputs or states that would break the change, for the reviewer        | Always        |
 | `**Questions:**`      | numbered open decisions, each with a suggestion and an answer slot        | Always        |
 
-- Write each marker as the table gives it. `Summary` opens the prose a reader scans, so it takes an H2, and the four that follow are labels over lists rather than sections of prose.
+- Write each marker as the table gives it. `Summary` opens the prose a reader scans, so it takes an H2, and the six that follow are labels over lists rather than sections of prose.
 - A section written in the other spelling is still that section. `## Risks` and `**Risks:**` name one thing, and a plan carrying either has stated its risks, so neither reads as an omission. Write the table's form in a new plan and leave an existing plan's spelling alone.
 - Both spellings break a depth run, so `canon markdown audit` reads either as the seam it is and reports a plan for a section that genuinely runs long rather than for its whole body. The markdown standard states the rule.
 - Write `None identified.` under a required section with nothing to report rather than dropping the marker. A dropped section and an unconsidered one read identically.
@@ -87,11 +90,23 @@ A dead constraint fails silently in the expensive direction. A session honoring
 
 A constraint naming a `.canon/ready/` folder is a third shape beside the two above. It makes that folder's files the verbatim source for the paths this plan's `**Files to touch:**` lists, per `ready.md`, so the executing session copies those paths rather than authoring them.
 
+### Verification
+
+- Name, for each outcome, the test or the command that proves it, as one bullet leading with the outcome and ending on the command in backticks.
+- Write a command a later session can run as given, from the project root. A description of what would be checked leaves the executing session to invent the check.
+- Name the visual check where no test reaches, and say it is visual, so a reader can tell a proof from a look.
+
 ### Risks
 
 - Name the collision rather than the category. A risk a reader cannot act on is padding.
 - Where the work establishes a resource with more than one consumer, list the consumers and mark each one read or write. A policy stated over that resource has to hold for the writers and not only for the consumer that prompted it.
 
+### Review focus
+
+- Name each input or state that would break the change if the implementation got it wrong, one bullet each, with what the change must do there.
+- Write it for the reviewer rather than the builder. The session writing the plan understood the risk before any diff existed, and this section is where that understanding reaches the review pass.
+- Keep it apart from `**Risks:**`. A risk is something the work might collide with, and a focus item is something the finished diff must be shown to handle, so a reviewer confirms the second and the executing session plans around the first.
+
 ## The suggested-and-answer contract
 
 Every question carries a `- Suggested:` line and an empty `- Answer:` slot below it.
@@ -165,10 +180,18 @@ This contract inverts the one an intake folder keeps, where an empty slot means
 
 - `<path/to/file>`: <reason>
 
+**Verification:**
+
+- <outcome>: `<test or command that proves it>`
+
 **Risks:**
 
 - <conflict, coupling, or tricky spot>
 
+**Review focus:**
+
+- <input or state that would break the change>: <what the change must do there>
+
 **Questions:**
 
 1. <question>

package/standards/tasks.md

@@ -173,6 +173,8 @@ Add no third heading. Status stays inline on an outcome rather than becoming an
 
 Size the outcomes so one pull request closes all of them. A task whose outcomes span two pull requests ships the first half and leaves the rest open, with nothing recording which outcomes the merged work covered, so the board reads as in-progress work that no branch is carrying. Split the task before handing it off rather than after. This is what `## Archiving` below depends on, since a task closes whole or not at all.
 
+A sliced task is the one allowed exception: a task the operator decided to ship across several pull requests on purpose, one slice each. Its `Pull request:` line lists every slice, so the board records which merged work covered which outcomes, and it closes whole when the last slice's merge finds every outcome ticked.
+
 Prefix the H1 with the `vX.Y:` phase label, then a short title whose form depends on the task type:
 
 - Feature: an outcome describing what the user can now do
@@ -227,15 +229,15 @@ A project that archived plans before the folder nested under `.canon/plans/` hol
 
 One plan per task. A plan cited by two tasks is a misfile rather than a shape to design for, which is why the sweep counts citations before archiving: the count is a guard against the misfile stranding a pointer, not support for the shape.
 
-`canon tasks plan-link <task> <plan>` writes or corrects the `Plan:` line, mirroring how `canon tasks pull-request` writes its own. `plan-feature` calls it right after the plan file lands, when an existing task names the feature, so the line is a mechanical write rather than hand-edited markdown.
+`canon tasks plan-link <task> <plan>` writes or corrects the `Plan:` line. `plan-feature` calls it right after the plan file lands, when an existing task names the feature, so the line is a mechanical write rather than hand-edited markdown.
 
 `Groundwork:` points at `../groundwork/<slug>/`, the folder `plan-groundwork` fills. It names the surface it points at the way `Plan:` does. Use this key alone. `Research record` and `Decision record` are earlier spellings of the same thing and both convert to it.
 
 `Intake:` points at `../intake/<slug>/`, the folder an intake pass fills. Use it rather than `Groundwork:`, because a groundwork track measures one question in depth while an intake dispositions many across a tree, and one key covering both loses which kind of pass produced the task. The line names the folder rather than an item inside it. A task routinely promotes several items at once, so an anchored line would name one and drop the rest, and the item numbers belong in that task's `## Findings`.
 
-`Pull request:` records which pull request carries the task's work, as a bare `#NNN` the way `Issue:` does. It is not an origin, so a task without one is well-formed. `git-pr` writes it when a pull request opens, which is the one step that always runs whether the chain drives it or a person does.
+`Pull request:` records which pull requests carry the task's work, each as a bare `#NNN` the way `Issue:` does. It lists every pull request that shipped part of the task, oldest first and separated by commas, as in `Pull request: #NNN, #NNN`, and a task shipped whole lists one. It is not an origin, so a task without one is well-formed. `git-pr` writes it when a pull request opens, which is the one step that always runs whether the chain drives it or a person does, and appends to the line rather than replacing it.
 
-The line is what lets a merge close its own task. Every merge on `main` is a squash carrying the number in its subject, so the number survives where a branch name does not, and `canon tasks archive --pull-request <n>` resolves the task from it. Without the line the board can only be swept blind, and a blind sweep cannot tell a shipped task from an abandoned one. One task, one pull request: two tasks naming the same number refuse to archive rather than both moving.
+The line is what lets a merge close its own task. Every merge on `main` is a squash carrying the number in its subject, so the number survives where a branch name does not, and `canon tasks archive --pull-request <n>` finds the task by any number the line lists and archives it only on the last, since outcomes are ticked at ship time and an earlier slice can merge after the last one shipped. Without the line the board can only be swept blind, and a blind sweep cannot tell a shipped task from an abandoned one. One pull request, one task: two tasks naming the same number refuse to archive rather than both moving.
 
 ## What goes in
 

package/governance/rules/core/091-channel.md

@@ -1,13 +0,0 @@
----
-description: The addressing and timing a session holding neither role-worker nor role-planner owes when it must message whoever dispatched it
----
-
-# Channel standards
-
-## A session holding neither role
-
-- Resolve the addressee at send time through `canon sessions list --json`, keyed on the id or branch the dispatcher named at launch, never by name prefix. A name is derived from what a session turns out to be doing and goes stale before a build finishes.
-- Send a block out as a message before it becomes an interactive prompt. A session already waiting on input never reaches the tool round that drains an inbound message, so an answer relayed afterwards arrives under the open question and changes nothing.
-- Leave the message content, and which transition earns one, to whatever dispatched this session. Both are task-specific and already stated where they apply.
-- A session holding `canon:role-worker` or `canon:role-planner` follows that body's own addressee ladder instead, stated in its own `## The channel` section. This rule states what neither role leaves stated elsewhere, not a replacement for either ladder.
-- Report it rather than proceeding silently when neither skill resolves to check against. Both ship with the plugin and this rule ships with the CLI, so a project that installed governance alone does not have them.