@erclx/canon 4.48.0 → 4.48.1

package/claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "canon",
   "description": "Automated governance, versioning, and discovery tools for Claude Code.",
-  "version": "4.48.0",
+  "version": "4.48.1",
   "author": {
     "name": "Eric Le",
     "url": "https://github.com/erclx"

package/claude/skills/claude-autoship/REQUIREMENT.md

@@ -38,7 +38,7 @@ Review is the step that varies most. It gets skipped on a diff that needed one,
 ## Guards
 
 - Detached HEAD: stop, no slug resolves
-- No approved plan at the branch's plan path: stop and route to the planning skill
+- No approved plan at the branch-derived plan path: stop, name the branch the slug came from, and say the invocation carried no argument, so a plan or a task path may be passed
 - Uncommitted changes unrelated to the plan: stop
 - No diff baseline against main: stop
 - Empty changed-file list: stop, and never advise removing the output from `.gitignore` to get past it

package/claude/skills/claude-autoship/SKILL.md

@@ -47,7 +47,7 @@ Resolve `<plan>` in this order, stopping at the first match:
 
 1. **Caller-supplied task.** The invocation carried a path under `.canon/tasks/`. If it does not resolve to a file, stop: `❌ No task at <path>. Path was supplied, not derived, so check it and re-run.` Read that task's first `Plan:` line and take what it names as `<plan>`, per `${CLAUDE_SKILL_DIR}/../../standards/tasks.md`.
 2. **Caller-supplied plan.** The invocation carried something else. Accept it as a plan path or a bare slug, in the same position `claude-worktree` tier 0 accepts its name. A bare slug resolves to `.canon/plans/feature-<slug>.md`, and a path is taken as given from the main worktree root. If it does not resolve to a file, stop: `❌ No plan at <path>. Path was supplied, not derived, so check it and re-run.`
-3. **Derived.** `.canon/plans/feature-<slug>.md`, from the `<slug>` the Guards derived. If it does not exist, stop: `❌ No approved plan at .canon/plans/feature-<slug>.md. Run /claude-feature first.`
+3. **Derived.** `.canon/plans/feature-<slug>.md`, from the `<slug>` the Guards derived. If it does not exist, stop: `❌ No approved plan at .canon/plans/feature-<slug>.md, where <slug> was derived from the current branch, <branch>. The invocation carried no argument, so pass a plan or a task path, or run /claude-feature first.`
 
 Only a path reaches tier 1, and a bare slug is read as a plan's throughout. The two would collide on any similar name, and a caller who means the task holds its path already, having read it off the board. One plan per task is what makes the tier 1 read unambiguous, so it takes the first `Plan:` line and never scans for a second.
 

package/claude/skills/claude-docs/SKILL.md

@@ -148,7 +148,7 @@ Read `.claude/context/index.md` at `pwd` to see which domain entries exist. Skip
 
 Two sources feed this step, the same split Step 2 runs on. The diff carries what the repository changed. The routed facts carry what the session learned, which a diff cannot show.
 
-**Routed facts.** Derive `<slug>` per `${CLAUDE_SKILL_DIR}/../../standards/slug.md`, falling back to `latest` on an empty result, and read `.canon/tmp/memory-routing/<slug>.md` at the main worktree root. `claude-memory-capture` writes it, one H2 per target entry naming the path, with the fact underneath. Fold each fact into the entry its heading names, then delete the handoff file so a later run does not fold it twice.
+**Routed facts.** Derive `<slug>` per `${CLAUDE_SKILL_DIR}/../../standards/slug.md`, falling back to `latest` on an empty result, and read `.canon/tmp/memory-routing/<slug>.md` at the main worktree root. `claude-memory-capture` writes it, one H2 per target entry naming the path, with the fact underneath. Fold each fact into the entry its heading names, which for a nested `.claude/context/<domain>/index.md` heading is the sibling file the fact belongs under rather than the generated index itself. Then delete the handoff file so a later run does not fold it twice.
 
 This half is not diff-scoped and must not be. A gotcha a session hit while working is exactly the fact the diff never shows, and scoping it to changed files would drop the entries worth keeping. The handoff is a named input rather than a scan, so the reach stays bounded to what capture decided.
 
@@ -156,10 +156,10 @@ Skip this half silently when the file is absent, which is every run where nothin
 
 **The diff.** When the baseline is unusable, scope this half to the working tree and untracked files, and skip it only when that set is empty, reporting `⚠ No diff to scope against. Skipped the context refresh.` The routed half still runs, since it reads a file rather than a diff.
 
-Reuse the diff from the baseline above, names and content both. For each existing `.claude/context/<domain>.md`:
+Reuse the diff from the baseline above, names and content both. For each domain listed in `.claude/context/index.md`, read its own entry: a flat `.claude/context/<domain>.md`, or, for a domain split into a folder, its `.claude/context/<domain>/index.md` and every sibling file that index links. Follow the index rather than globbing the folder, since a folder can hold a file the index does not list yet.
 
-- Map the entry's section headings to the changed files. An entry is relevant when its prose references files, modules, or decisions touched by the diff.
-- For each relevant entry, rewrite only the sections affected by the diff. Same pattern as `docs-sync`. Do not touch unrelated sections.
+- Map the entry's section headings, whether they sit in one flat file or spread across a nested domain's sibling files, to the changed files. An entry is relevant when its prose references files, modules, or decisions touched by the diff.
+- For each relevant entry, rewrite only the sections affected by the diff. Same pattern as `docs-sync`. Do not touch unrelated sections. Never rewrite a split domain's own `index.md` directly, since a regen overwrites it the same way it overwrites the top-level catalog. Rewrite the sibling file the affected section actually lives in instead.
 - Write a reference to another entry as the path that entry sits at, rather than as its bare filename. `${CLAUDE_SKILL_DIR}/../../standards/context.md` states the form, and a bare name strands the reference once a domain splits into subfolders.
 
 ### When the diff removes a capability
@@ -173,11 +173,11 @@ Grep the tree for the name that went, rather than for the paths the diff carries
 
 Report each hit as an ordinary rewrite.
 
-Do not create new entries automatically. New entries are a deliberate decision: the user invokes `claude-docs --new-context <domain>` (future flag) or hand-creates the file following `${CLAUDE_SKILL_DIR}/../../standards/context.md`. Auto-creation risks padding `.claude/context/` with low-signal entries.
+Do not create new entries automatically. Before treating a domain as new, confirm it holds no entry under either spelling, `.claude/context/<domain>.md` or `.claude/context/<domain>/index.md`, since a domain already split into a folder still passes a check that only looked for the flat file. New entries are a deliberate decision: the user invokes `claude-docs --new-context <domain>` (future flag) or hand-creates the file following `${CLAUDE_SKILL_DIR}/../../standards/context.md`. Auto-creation risks padding `.claude/context/` with low-signal entries.
 
-Write each updated entry immediately. Output one line per file:
+Write each updated entry immediately. Output one line per file, naming the path this run actually wrote rather than always the flat template:
 
-`✅ Context: .claude/context/<domain>.md`
+`✅ Context: .claude/context/<domain>.md` for a flat entry, or `✅ Context: .claude/context/<domain>/<sub-area>.md` for the sibling file a nested edit landed in
 
 Add a line naming the handoff when one was consumed:
 

package/claude/skills/claude-memory-capture/SKILL.md

@@ -44,7 +44,9 @@ For each project candidate, match its subject against `.claude/context/index.md`
 
 Fail closed. A project candidate matching no entry stays a memory file, and so does one matching two entries where neither is clearly the owner. The residue is what the folder is for, and a fact filed under the wrong entry is worse than one in memory because a context entry is a surface sessions trust.
 
-Do not edit a context entry here. `claude-docs` owns those edits and folds the routed facts in on its own pass, or two skills write one file at the same step. Write each routed fact to `.canon/tmp/memory-routing/<slug>.md` at the main worktree root instead, appending when the file exists. An append is a whole-file operation the shell does directly, so send it as a plain single `Bash` command carrying a heredoc:
+Do not edit a context entry here. `claude-docs` owns those edits and folds the routed facts in on its own pass, or two skills write one file at the same step. Write each routed fact to `.canon/tmp/memory-routing/<slug>.md` at the main worktree root instead, appending when the file exists. Name the heading with the entry's own path from `.claude/context/index.md`, flat or the nested `index.md`, since that heading is what tells `claude-docs`'s routed-facts fold which file to open. An append is a whole-file operation the shell does directly, so send it as a plain single `Bash` command carrying a heredoc:
+
+A flat domain takes:
 
 ```markdown
 ## .claude/context/<domain>.md
@@ -52,6 +54,14 @@ Do not edit a context entry here. `claude-docs` owns those edits and folds the r
 <the fact in one or two sentences, stated as a fact about the domain rather than as a session narrative>
 ```
 
+A domain split into a folder takes its own generated index instead:
+
+```markdown
+## .claude/context/<domain>/index.md
+
+<the fact in one or two sentences, stated as a fact about the domain rather than as a session narrative>
+```
+
 Derive `<slug>` per `${CLAUDE_SKILL_DIR}/../../standards/slug.md`. Fall back to `latest` on an empty result.
 
 The handoff is a file rather than a spoken result so the routed fact survives a compaction between this step and the `claude-docs` pass, and so the standalone caller leaves something behind for a later `/claude-docs` to consume.
@@ -80,7 +90,7 @@ Run `canon records validate memory` when the writes are done and fix what it nam
 
 Respond with one line per fact routed, written, or updated:
 
-- `➡️ Routed: <fact subject> → .claude/context/<domain>.md`
+- `➡️ Routed: <fact subject> → .claude/context/<domain>.md` for a flat entry, or `→ .claude/context/<domain>/index.md` for a nested one, matching the heading the routing file carries
 - `✅ Wrote: .canon/memory/<file> (<type>)`
 - `✏️ Updated: .canon/memory/<file> (<type>)`
 

package/claude/skills/claude-teach/references/promotion.md

@@ -14,11 +14,11 @@ A reference page that reads like a lesson is a lesson wearing the wrong extensio
 
 Sort by who owns the subject, which is the test the wiki already runs. The reader's activity decided the workspace and decides nothing here.
 
-| The page's subject                                             | Destination                   |
-| -------------------------------------------------------------- | ----------------------------- |
-| Owned by someone outside the project, such as a tool or vendor | the project's wiki            |
-| How this project itself works, for the people who build it     | `.claude/context/<domain>.md` |
-| Written for someone consuming what this project ships          | the project's public docs     |
+| The page's subject                                             | Destination                                                                                                 |
+| -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
+| Owned by someone outside the project, such as a tool or vendor | the project's wiki                                                                                          |
+| How this project itself works, for the people who build it     | `.claude/context/<domain>.md`, or the domain's own nested `index.md` when it is already split into a folder |
+| Written for someone consuming what this project ships          | the project's public docs                                                                                   |
 
 A page a reader cannot sort by that question is a page whose subject has not been settled. Say which two destinations it sits between and let the operator choose, rather than picking the nearer one.
 

package/claude/skills/migration-claude-md/SKILL.md

@@ -37,7 +37,7 @@ Split `CLAUDE.md` by `##` heading. Score each section against this order:
 For each section proposed for a move:
 
 - Path-scoped: propose `.claude/rules/<subdir>/<n>-<slug>.md` with a `paths:` glob. Pick the subdir and a free number the way `create-rule` does. If `.claude/rules/<subdir>/` already holds a rule on the topic, mark as "conflict" and skip.
-- Domain narrative: propose `.claude/context/<domain>.md`. If the entry already exists, propose appending rather than creating.
+- Domain narrative: propose `.claude/context/<domain>.md`. If the entry already exists, flat or as a same-named `.claude/context/<domain>/` folder, propose appending to the file that owns it rather than creating a duplicate flat entry beside a domain already split.
 
 ## Step 4: output
 
@@ -55,6 +55,7 @@ Print one grouped proposal block. Omit empty groups.
 ## Extract to a context entry
 
 - `## <heading>` → `.claude/context/<domain>.md` (<reason>)
+- `## <heading>` → `.claude/context/<domain>/<sub-area>.md`, appending to the domain's existing sibling file (<reason>)
 
 ## Needs manual split
 

package/claude/skills/migration-context/SKILL.md

@@ -44,7 +44,7 @@ For each file, score against this rule order:
 
 For every file proposed for a move:
 
-- If `.claude/context/<filename>` already exists, mark as "conflict" and skip the move.
+- If `.claude/context/<filename>` already exists, or a same-named folder exists at `.claude/context/` with `<filename>`'s `.md` extension dropped, mark as "conflict" and skip the move. A folder of the same name is still a collision, since the domain already lives there split into siblings.
 - Run `git grep -n "docs/<filename>"` (or grep equivalent) to list inbound references in `CLAUDE.md`, `README.md`, and other markdown. Report each as a TODO line. Do not rewrite.
 
 ## Step 4: output

package/docs/agents/audits.md

@@ -11,20 +11,22 @@ description: Running every health check as one set, what the single verdict mean
 canon audits run
 canon audits run --json
 canon audits run --record
+canon audits run --corpus tracked --corpus per-machine
 canon audits list --json
 ```
 
-| Option          | Behavior                                                         |
-| --------------- | ---------------------------------------------------------------- |
-| `--json`        | Add a machine-readable record on stdout, keeping the frame       |
-| `--root <path>` | Measure this tree instead of the current worktree                |
-| `--record`      | Write this run's tracked counts to `.claude/canon/baseline.json` |
+| Option            | Behavior                                                                                                   |
+| ----------------- | ---------------------------------------------------------------------------------------------------------- |
+| `--json`          | Add a machine-readable record on stdout, keeping the frame                                                 |
+| `--root <path>`   | Measure this tree instead of the current worktree                                                          |
+| `--record`        | Write this run's tracked counts to `.claude/canon/baseline.json`                                           |
+| `--corpus <name>` | Limit the run to one corpus (`tracked`, `per-machine`, `upstream`), repeatable, defaulting to every corpus |
 
 ## What it runs
 
 Nineteen verbs, listed by `canon audits list`. Each runs once in its fullest form, and the aggregate reads that verb's own record rather than imposing a shared envelope on it. Every one of those records already has consumers naming its keys, so a common shape would be a breaking change bought for tidiness.
 
-The verbs walk separate trees and share no state, so they run together. Measured on the authoring machine at twelve verbs, a run finished in 0.8 seconds of wall clock against 4.4 seconds of processor, which is under every other stage in `bun run check`. `canon deps audit` is the one that changes that reading, since it reaches a network rather than a tree and its latency is the index's rather than this machine's.
+The verbs walk separate trees and share no state, so they run together. Measured on the authoring machine at twelve verbs, a run finished in 0.8 seconds of wall clock against 4.4 seconds of processor, which is under every other stage in `bun run check`. `canon deps audit` is the one that changes that reading, since it reaches a network rather than a tree and its latency is the index's rather than this machine's: three clean runs measured 44.7, 77.6, and 62.9 seconds, and a stalled lookup runs to an explicit 120-second timeout rather than to bun's own 299-second ceiling. `--corpus` is what keeps a caller from paying that cost when it wants only the corpora on this disk.
 
 Sixteen of the nineteen read a tree on this disk, the one added by `restated.md` and the one added by `census.md` among them, since the first reads four such trees against each other and the second counts every file in one. The two added by `state-scoped-risk.md` read committed state rather than an arriving change, which is the gap every review surface here leaves by construction, and the one added by `label-coverage.md` reads a branch range against a map the project declares.
 
@@ -93,6 +95,8 @@ A hand-edited baseline that does not parse refuses the whole run. Reading a brok
 
 ## In the verify pipeline
 
-`bun run check` runs the set as a reporting stage after the three gating stages, and never fails on it. Those three stages keep their own specific remedies, so the aggregate reports the rest and the growth, and a fact still fails the push at the stage that names what to do about it.
+`bun run check` runs a reporting stage after the three gating stages, and never fails on it. Those three stages keep their own specific remedies, so the aggregate reports the rest and the growth, and a fact still fails the push at the stage that names what to do about it.
 
-The stage reads `summary`, a flat object of scalars published beside the nested arrays. Every key in it is unique across the whole record, so a shell stage greps one out without a JSON parser. The three verbs the gating stages already ran walk their trees a second time here, which is the 0.8 seconds measured above and the reason the whole set runs rather than only the part those stages skip: one verdict over every audit is the value, and a stage measuring a subset would report a health nobody took.
+The stage runs `--corpus tracked --corpus per-machine` rather than the full set, so `deps` and its network latency sit outside the gate entirely. A weekly job reads the advisory index instead, on a schedule rather than on every push. `summary.audited` in the gate's own record therefore reads 19 against the 20 `canon audits run` reaches with no filter.
+
+The stage reads `summary`, a flat object of scalars published beside the nested arrays. Every key in it is unique across the whole record, so a shell stage greps one out without a JSON parser. The three verbs the gating stages already ran walk their trees a second time here, which is the 0.8 seconds measured above and the reason the scoped set runs rather than only the part those stages skip: one verdict over the corpora describing this tree is the value, and a stage measuring a narrower subset would report a health nobody took.

package/docs/agents/commands.md

@@ -79,7 +79,7 @@ Full help: `canon <command> --help`. Behavior notes for the install and sync ver
 | `canon repo metadata propose` | Compare a description, homepage, and topic set computed from the README and `package.json` against what the remote carries, writing nothing (`--root`, `--json`)                                                                   |
 | `canon repo metadata apply`   | Write an explicitly supplied description, homepage, or topic set to the remote through `gh repo edit` (`--description`, `--homepage`, `--topics`, `--root`, `--json`)                                                              |
 | `canon census [path]`         | Report tracked file count, a breakdown by extension, and a line total that skips whatever reads as binary (`--json`)                                                                                                               |
-| `canon audits run`            | Run every audit as one set, report per check under one verdict, and compare each count to the recorded baseline (`--json`, `--record`)                                                                                             |
+| `canon audits run`            | Run every audit as one set, report per check under one verdict, and compare each count to the recorded baseline (`--json`, `--record`, `--corpus`)                                                                                 |
 | `canon audits list`           | List every audit the set runs, with the corpus each reads and whether it gates (`--json`)                                                                                                                                          |
 | `canon gate run`              | Run every stage that guards a branch here, scoping shell, types, and tests to the changed set (`--all`, `--no-write`, `--nested`, `--json`)                                                                                        |
 | `canon inventory [subject]`   | Walk every route a project declares and group its elements by the property each computes, as a listing rather than a gate (`--json`)                                                                                               |

package/docs/agents/gate.md

@@ -77,8 +77,13 @@ One code for a failure, which is what a `bun run` caller and a git hook both rea
     "unmeasured": 0,
     "failed": 0
   },
-  "stages": [{ "id": "indexes", "label": "Indexes", "status": "passed" }]
+  "ms": 44453,
+  "stages": [
+    { "id": "indexes", "label": "Indexes", "status": "passed", "ms": 210 }
+  ]
 }
 ```
 
 A failing stage carries its remedy in `failure`, and the same line goes to stderr so a caller reading neither the record nor the frame is still told what to fix.
+
+`ms` carries the wall time each stage's checks took, including every process spawn, and the top-level `ms` sums them. Neither reading changes what a stage measures. Both exist so a slow run is attributable to a stage rather than read off a stopwatch held against the whole thing.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@erclx/canon",
   "type": "module",
-  "version": "4.48.0",
+  "version": "4.48.1",
   "description": "Infrastructure and quality tooling for developer workflows",
   "license": "MIT",
   "bin": {

package/scripts/tooling/verify.sh

@@ -131,7 +131,8 @@ main() {
     run_phase "Prepare" bash -c "cd '$tmp_dir' && $prepare"
   fi
 
-  run_phase "Sync" bash -c "cd '$tmp_dir' && CANON_NON_INTERACTIVE=1 canon tooling sync $stack . --write"
+  log_info "Sync resolves via bun $PROJECT_ROOT/src/cli.ts, not PATH canon"
+  run_phase "Sync" bash -c "cd '$tmp_dir' && CANON_NON_INTERACTIVE=1 bun '$PROJECT_ROOT/src/cli.ts' tooling sync $stack . --write"
 
   if [ -f "$tmp_dir/package.json" ]; then
     run_phase "lint:fix" bash -c "cd '$tmp_dir' && bun run lint:fix"
@@ -178,4 +179,6 @@ main() {
   fi
 }
 
-main "$@"
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+  main "$@"
+fi

package/src/audits/catalog.ts

@@ -100,6 +100,8 @@ export interface AuditResult {
   readonly counts?: Record<string, number>
   /** Why the audit did not report, present only on `unmeasured`. */
   readonly reason?: string
+  /** Wall time the spawn took, from the aggregate's own clock. */
+  readonly ms: number
 }
 
 /** The exit code every command here sets when it refuses. */
@@ -816,6 +818,7 @@ export function classify(
   spec: AuditSpec,
   exitCode: number,
   stdout: string,
+  ms = 0,
 ): AuditResult {
   const base = {
     id: spec.id,
@@ -823,6 +826,7 @@ export function classify(
     tracked: isTracked(spec),
     corpus: spec.corpus,
     exitCode,
+    ms,
   }
 
   let record: unknown

package/src/audits/run.ts

@@ -1,10 +1,32 @@
 import { join } from 'node:path'
 import { execa } from 'execa'
 import type { Delta } from '@/audits/baseline'
-import { type AuditResult, type AuditSpec, classify } from '@/audits/catalog'
+import {
+  type AuditResult,
+  type AuditSpec,
+  classify,
+  type Corpus,
+} from '@/audits/catalog'
 import { gitEnv } from '@/git-env'
 import { PROJECT_ROOT } from '@/project-root'
 
+/** Every value a corpus filter accepts, matching the `Corpus` union. */
+export const CORPORA: readonly Corpus[] = ['tracked', 'per-machine', 'upstream']
+
+/**
+ * The catalog scoped to the requested corpora, or the whole set when none
+ * were named. `--corpus` on `audits run` reads this, and so does `auditSet`
+ * in `src/gate/measures.ts`, which excludes the upstream corpus so the gate
+ * reads only what describes this tree.
+ */
+export function auditsFor(
+  specs: readonly AuditSpec[],
+  requested: readonly string[],
+): readonly AuditSpec[] {
+  if (requested.length === 0) return specs
+  return specs.filter((spec) => requested.includes(spec.corpus))
+}
+
 /** At least one audit reported a finding that is a fact. */
 export const EXIT_FINDING = 2
 
@@ -77,9 +99,10 @@ export async function runAudits(
 ): Promise<AuditResult[]> {
   return Promise.all(
     specs.map(async (spec) => {
+      const startedAt = performance.now()
       try {
         const { exitCode, stdout } = await spawn(spec)
-        return classify(spec, exitCode, stdout)
+        return classify(spec, exitCode, stdout, performance.now() - startedAt)
       } catch (error) {
         return {
           id: spec.id,
@@ -89,6 +112,7 @@ export async function runAudits(
           corpus: spec.corpus,
           exitCode: 1,
           reason: `could not be started: ${error instanceof Error ? error.message : String(error)}`,
+          ms: performance.now() - startedAt,
         }
       }
     }),

package/src/commands/audits.ts

@@ -9,8 +9,10 @@ import {
   readBaseline,
   writeBaseline,
 } from '@/audits/baseline'
-import { AUDITS, type AuditResult } from '@/audits/catalog'
+import { AUDITS, type AuditResult, type Corpus } from '@/audits/catalog'
 import {
+  auditsFor,
+  CORPORA,
   exitCodeFor,
   runAudits,
   spawnAudit,
@@ -25,6 +27,11 @@ interface RunCommandOptions {
   readonly json?: boolean
   readonly record?: boolean
   readonly root?: string
+  readonly corpus?: readonly string[]
+}
+
+function collectCorpus(value: string, previous: string[]): string[] {
+  return [...previous, value]
 }
 
 interface ListCommandOptions {
@@ -52,6 +59,12 @@ export function register(program: Command): void {
       '--record',
       `Write this run's tracked counts to ${BASELINE_REL} as the new baseline`,
     )
+    .option(
+      '--corpus <corpus>',
+      `Limit the run to one corpus (${CORPORA.join(', ')}), repeatable. Defaults to every corpus`,
+      collectCorpus,
+      [] as string[],
+    )
     .addHelpText(
       'after',
       [
@@ -81,6 +94,7 @@ export function register(program: Command): void {
         '  canon audits run',
         '  canon audits run --json',
         '  canon audits run --record',
+        '  canon audits run --corpus tracked --corpus per-machine',
         '',
       ].join('\n'),
     )
@@ -175,6 +189,28 @@ async function headCommit(root: string): Promise<string> {
 async function runAll(opts: RunCommandOptions): Promise<number> {
   const emitJson = opts.json ?? false
   const root = opts.root ?? (await currentWorktreeRoot())
+  const requested = opts.corpus ?? []
+
+  const invalid = requested.filter(
+    (corpus) => !CORPORA.includes(corpus as Corpus),
+  )
+  if (invalid.length > 0) {
+    const message = `Unknown corpus ${invalid.join(', ')}. Valid corpora: ${CORPORA.join(', ')}.`
+    if (emitJson) {
+      process.stderr.write(`${message}\n`)
+      process.stdout.write(
+        `${JSON.stringify({ ok: false, reason: 'bad-corpus', message })}\n`,
+      )
+      return 1
+    }
+    intro('canon audits run')
+    logStep('Refused')
+    logError(message)
+    outro()
+    return 1
+  }
+
+  const audits = auditsFor(AUDITS, requested)
 
   let baseline: Baseline | undefined
   try {
@@ -195,7 +231,7 @@ async function runAll(opts: RunCommandOptions): Promise<number> {
     return 1
   }
 
-  const results = await runAudits(AUDITS, spawnAudit(root))
+  const results = await runAudits(audits, spawnAudit(root))
   const deltas = compareBaseline(baseline, results)
   const summary = summarize(results, deltas)
 

package/src/commands/gate.ts

@@ -134,11 +134,13 @@ async function runGate(opts: RunCommandOptions): Promise<number> {
         scoped: changed.scoped,
         changed: changed.files.length,
         summary,
-        stages: results.map(({ id, label, status, failure }) => ({
+        ms: results.reduce((total, result) => total + result.ms, 0),
+        stages: results.map(({ id, label, status, failure, ms }) => ({
           id,
           label,
           status,
           failure,
+          ms,
         })),
       })}\n`,
     )

package/src/deps/audit.ts

@@ -38,6 +38,15 @@ export interface Advisory {
  */
 export type AuditRefusal = 'no-manifest' | 'no-lockfile' | 'no-record'
 
+/**
+ * The ceiling on `bun audit --json`, which carries no timeout of its own and
+ * runs to bun's own 299-second ceiling on a stall. Three consecutive clean
+ * runs on this tree measured 44.7, 77.6, and 62.9 seconds, so 120 seconds
+ * leaves margin over the slowest observed pass while still bounding a stall
+ * well under bun's own ceiling.
+ */
+const AUDIT_TIMEOUT_MS = 120_000
+
 /** The lockfiles a resolved dependency set leaves behind, in any manager. */
 const LOCKFILES = [
   'bun.lock',
@@ -115,6 +124,22 @@ export function countBySeverity(
   return counts
 }
 
+/**
+ * The message a caller reads for a refusal with no advisory record, naming a
+ * stall as its own cause rather than folding it into "no output on stdout",
+ * which is what an empty stdout reads as either way.
+ */
+export function noRecordMessage(result: {
+  readonly timedOut: boolean
+  readonly stderr: string
+}): string {
+  if (result.timedOut) {
+    return `timed out after ${AUDIT_TIMEOUT_MS}ms waiting on the advisory index`
+  }
+  const line = result.stderr.trim().split('\n').pop()
+  return line !== undefined && line !== '' ? line : 'no output on stdout'
+}
+
 /**
  * Shells the runtime's own advisory command rather than carrying an index.
  *
@@ -138,6 +163,7 @@ export async function auditDependencies(root: string): Promise<DepsAudit> {
   const result = await execa('bun', ['audit', '--json'], {
     cwd: root,
     reject: false,
+    timeout: AUDIT_TIMEOUT_MS,
   })
 
   const advisories = parseAdvisories(result.stdout)
@@ -145,7 +171,7 @@ export async function auditDependencies(root: string): Promise<DepsAudit> {
     return {
       kind: 'refused',
       reason: 'no-record',
-      message: result.stderr.trim().split('\n').pop() ?? 'no output on stdout',
+      message: noRecordMessage(result),
     }
   }
 

package/src/gate/measures.ts

@@ -686,10 +686,15 @@ interface AuditSummary {
 
 /**
  * The three stages gating on the three findings here that are facts sit above,
- * and this stage reports the rest. It runs the whole set anyway rather than
- * only what those stages skip, because the aggregate's own value is one verdict
- * over every audit, and a stage measuring a subset would report a health this
- * repository never took.
+ * and this stage reports the rest. It runs every tracked and per-machine audit
+ * rather than only what those stages skip, because the aggregate's own value
+ * is one verdict over the corpora describing this tree, and a stage measuring
+ * a narrower subset would report a health this repository never took.
+ *
+ * The upstream corpus is excluded. `deps` reaches a network index rather than
+ * this tree, and its wall time dwarfs every other stage combined, so a push
+ * gated on it waits on a lookup this tree's own health never depended on. A
+ * scheduled `verify.yml` job reports the advisory instead.
  *
  * This reports and never fails. Growth in a judgment count is the thing the
  * baseline exists to make visible, and failing a push on one would teach a
@@ -697,7 +702,15 @@ interface AuditSummary {
  * specific stage above that names its own remedy.
  */
 export const auditSet: Measure = async (ctx) => {
-  const run = await ctx.cli(['audits', 'run', '--json'])
+  const run = await ctx.cli([
+    'audits',
+    'run',
+    '--corpus',
+    'tracked',
+    '--corpus',
+    'per-machine',
+    '--json',
+  ])
 
   if (run.stdout.trim() === '') {
     return {

package/src/gate/sequencer.ts

@@ -27,6 +27,8 @@ export interface StageResult {
   readonly emissions: readonly Emission[]
   /** The remedy line a failed stage prints, naming what to do about it. */
   readonly failure?: string
+  /** Wall time the stage's checks took, including every process spawn. */
+  readonly ms: number
 }
 
 export interface GateContext extends MeasureContext {
@@ -133,6 +135,17 @@ export async function runStage(
   stage: Stage,
   ctx: GateContext,
 ): Promise<StageResult> {
+  const startedAt = performance.now()
+  const result = await executeStage(stage, ctx)
+  return { ...result, ms: performance.now() - startedAt }
+}
+
+type StageOutcome = Omit<StageResult, 'ms'>
+
+async function executeStage(
+  stage: Stage,
+  ctx: GateContext,
+): Promise<StageOutcome> {
   if (stage.scope !== undefined && !hasChanged(stage.scope, ctx.changed)) {
     return {
       id: stage.id,

package/src/tasks/archive.ts

@@ -496,6 +496,22 @@ async function resolveStem(
 
   if (selector.kind === 'stem') {
     if (!stems.includes(selector.stem)) {
+      const prefixed = stems.filter((stem) => stem.startsWith(selector.stem))
+      if (prefixed.length === 1) {
+        const [match] = prefixed
+        return refuse(
+          'no-match',
+          `${selector.stem} does not name a task by itself. One task starts with it: ${match}. Pass the full name to archive it.`,
+          [match],
+        )
+      }
+      if (prefixed.length > 1) {
+        return refuse(
+          'ambiguous',
+          `${selector.stem} does not name a task by itself. ${prefixed.length} tasks start with it. Pass the full name to archive one.`,
+          prefixed,
+        )
+      }
       return refuse(
         'no-match',
         `No task named ${selector.stem} on the board.`,

package/standards/wireframes.md

@@ -30,6 +30,14 @@ A wireframe works when someone can rebuild the surface from it without opening t
 
 A wireframe that fails these is non-conforming regardless of whether it satisfies every section rule below. The fences are the means. These three questions are the test.
 
+## Transcription wireframes
+
+A wireframe regenerated from an already-built surface's own render code may carry what the sections below forbid: the source file and function, the class or token names driving each region, and pixel-exact geometry. Open the file by naming that source: the render function, the stylesheet rule, or the built file the block was read off. The citation is what separates a transcription wireframe from one that merely broke the rules below, since a role label with nothing behind it is unchecked and a class name traced to a real file and line is not.
+
+A drafted-ahead wireframe states intent in role terms because nothing exists yet to check it against. A regenerated one is checkable against the code it mirrors, and a role label standing in for the real class name would throw that check away. The two documents answer different questions, so one set of rules cannot govern both.
+
+Route detail the source citation does not already carry to `.claude/context/` as usual: algorithms, event-handler code, workarounds, and rejected approaches stay out of the wireframe regardless of which mode it is written in.
+
 ## Frontmatter
 
 - `title` (required): sentence case, names the surface (`Header`, `Section nav`, `Footer`).
@@ -41,7 +49,7 @@ Both fields feed `.claude/wireframes/index.md` when regenerated.
 
 - Draw each surface as an ASCII block inside a `plaintext` fence. One fence per distinct layout.
 - Label regions with `←` annotations. Never use `#` for annotations.
-- Show a region's role, not its styling. `← status pill` reads better than a class name or hex value.
+- Show a region's role, not its styling. `← status pill` reads better than a class name or hex value. A transcription wireframe is the exception: see `## Transcription wireframes`.
 - Keep the grid honest. The ASCII proportions should match the intended widths, since conveying proportion is the wireframe's job.
 
 ## Variants
@@ -63,7 +71,7 @@ Both fields feed `.claude/wireframes/index.md` when regenerated.
 
 ## What moves to .claude/context/
 
-Implementation detail that answers how the surface is built belongs in a `.claude/context/` entry, not the wireframe:
+This section does not govern a transcription wireframe's citation of its own source. See `## Transcription wireframes`. Implementation detail that answers how the surface is built belongs in a `.claude/context/` entry, not the wireframe:
 
 - Algorithms, event-handler code, and lifecycle ordering
 - Framework component names, props, and CSS class or token names