@erclx/canon 4.48.0 → 4.49.0

package/claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "canon",
   "description": "Automated governance, versioning, and discovery tools for Claude Code.",
-  "version": "4.48.0",
+  "version": "4.49.0",
   "author": {
     "name": "Eric Le",
     "url": "https://github.com/erclx"

package/claude/skills/claude-autoship/REQUIREMENT.md

@@ -38,7 +38,7 @@ Review is the step that varies most. It gets skipped on a diff that needed one,
 ## Guards
 
 - Detached HEAD: stop, no slug resolves
-- No approved plan at the branch's plan path: stop and route to the planning skill
+- No approved plan at the branch-derived plan path: stop, name the branch the slug came from, and say the invocation carried no argument, so a plan or a task path may be passed
 - Uncommitted changes unrelated to the plan: stop
 - No diff baseline against main: stop
 - Empty changed-file list: stop, and never advise removing the output from `.gitignore` to get past it

package/claude/skills/claude-autoship/SKILL.md

@@ -47,7 +47,7 @@ Resolve `<plan>` in this order, stopping at the first match:
 
 1. **Caller-supplied task.** The invocation carried a path under `.canon/tasks/`. If it does not resolve to a file, stop: `❌ No task at <path>. Path was supplied, not derived, so check it and re-run.` Read that task's first `Plan:` line and take what it names as `<plan>`, per `${CLAUDE_SKILL_DIR}/../../standards/tasks.md`.
 2. **Caller-supplied plan.** The invocation carried something else. Accept it as a plan path or a bare slug, in the same position `claude-worktree` tier 0 accepts its name. A bare slug resolves to `.canon/plans/feature-<slug>.md`, and a path is taken as given from the main worktree root. If it does not resolve to a file, stop: `❌ No plan at <path>. Path was supplied, not derived, so check it and re-run.`
-3. **Derived.** `.canon/plans/feature-<slug>.md`, from the `<slug>` the Guards derived. If it does not exist, stop: `❌ No approved plan at .canon/plans/feature-<slug>.md. Run /claude-feature first.`
+3. **Derived.** `.canon/plans/feature-<slug>.md`, from the `<slug>` the Guards derived. If it does not exist, stop: `❌ No approved plan at .canon/plans/feature-<slug>.md, where <slug> was derived from the current branch, <branch>. The invocation carried no argument, so pass a plan or a task path, or run /claude-feature first.`
 
 Only a path reaches tier 1, and a bare slug is read as a plan's throughout. The two would collide on any similar name, and a caller who means the task holds its path already, having read it off the board. One plan per task is what makes the tier 1 read unambiguous, so it takes the first `Plan:` line and never scans for a second.
 

package/claude/skills/claude-docs/SKILL.md

@@ -148,7 +148,7 @@ Read `.claude/context/index.md` at `pwd` to see which domain entries exist. Skip
 
 Two sources feed this step, the same split Step 2 runs on. The diff carries what the repository changed. The routed facts carry what the session learned, which a diff cannot show.
 
-**Routed facts.** Derive `<slug>` per `${CLAUDE_SKILL_DIR}/../../standards/slug.md`, falling back to `latest` on an empty result, and read `.canon/tmp/memory-routing/<slug>.md` at the main worktree root. `claude-memory-capture` writes it, one H2 per target entry naming the path, with the fact underneath. Fold each fact into the entry its heading names, then delete the handoff file so a later run does not fold it twice.
+**Routed facts.** Derive `<slug>` per `${CLAUDE_SKILL_DIR}/../../standards/slug.md`, falling back to `latest` on an empty result, and read `.canon/tmp/memory-routing/<slug>.md` at the main worktree root. `claude-memory-capture` writes it, one H2 per target entry naming the path, with the fact underneath. Fold each fact into the entry its heading names, which for a nested `.claude/context/<domain>/index.md` heading is the sibling file the fact belongs under rather than the generated index itself. Then delete the handoff file so a later run does not fold it twice.
 
 This half is not diff-scoped and must not be. A gotcha a session hit while working is exactly the fact the diff never shows, and scoping it to changed files would drop the entries worth keeping. The handoff is a named input rather than a scan, so the reach stays bounded to what capture decided.
 
@@ -156,10 +156,10 @@ Skip this half silently when the file is absent, which is every run where nothin
 
 **The diff.** When the baseline is unusable, scope this half to the working tree and untracked files, and skip it only when that set is empty, reporting `⚠ No diff to scope against. Skipped the context refresh.` The routed half still runs, since it reads a file rather than a diff.
 
-Reuse the diff from the baseline above, names and content both. For each existing `.claude/context/<domain>.md`:
+Reuse the diff from the baseline above, names and content both. For each domain listed in `.claude/context/index.md`, read its own entry: a flat `.claude/context/<domain>.md`, or, for a domain split into a folder, its `.claude/context/<domain>/index.md` and every sibling file that index links. Follow the index rather than globbing the folder, since a folder can hold a file the index does not list yet.
 
-- Map the entry's section headings to the changed files. An entry is relevant when its prose references files, modules, or decisions touched by the diff.
-- For each relevant entry, rewrite only the sections affected by the diff. Same pattern as `docs-sync`. Do not touch unrelated sections.
+- Map the entry's section headings, whether they sit in one flat file or spread across a nested domain's sibling files, to the changed files. An entry is relevant when its prose references files, modules, or decisions touched by the diff.
+- For each relevant entry, rewrite only the sections affected by the diff. Same pattern as `docs-sync`. Do not touch unrelated sections. Never rewrite a split domain's own `index.md` directly, since a regen overwrites it the same way it overwrites the top-level catalog. Rewrite the sibling file the affected section actually lives in instead.
 - Write a reference to another entry as the path that entry sits at, rather than as its bare filename. `${CLAUDE_SKILL_DIR}/../../standards/context.md` states the form, and a bare name strands the reference once a domain splits into subfolders.
 
 ### When the diff removes a capability
@@ -173,11 +173,11 @@ Grep the tree for the name that went, rather than for the paths the diff carries
 
 Report each hit as an ordinary rewrite.
 
-Do not create new entries automatically. New entries are a deliberate decision: the user invokes `claude-docs --new-context <domain>` (future flag) or hand-creates the file following `${CLAUDE_SKILL_DIR}/../../standards/context.md`. Auto-creation risks padding `.claude/context/` with low-signal entries.
+Do not create new entries automatically. Before treating a domain as new, confirm it holds no entry under either spelling, `.claude/context/<domain>.md` or `.claude/context/<domain>/index.md`, since a domain already split into a folder still passes a check that only looked for the flat file. New entries are a deliberate decision: the user invokes `claude-docs --new-context <domain>` (future flag) or hand-creates the file following `${CLAUDE_SKILL_DIR}/../../standards/context.md`. Auto-creation risks padding `.claude/context/` with low-signal entries.
 
-Write each updated entry immediately. Output one line per file:
+Write each updated entry immediately. Output one line per file, naming the path this run actually wrote rather than always the flat template:
 
-`✅ Context: .claude/context/<domain>.md`
+`✅ Context: .claude/context/<domain>.md` for a flat entry, or `✅ Context: .claude/context/<domain>/<sub-area>.md` for the sibling file a nested edit landed in
 
 Add a line naming the handoff when one was consumed:
 

package/claude/skills/claude-memory-capture/SKILL.md

@@ -44,7 +44,9 @@ For each project candidate, match its subject against `.claude/context/index.md`
 
 Fail closed. A project candidate matching no entry stays a memory file, and so does one matching two entries where neither is clearly the owner. The residue is what the folder is for, and a fact filed under the wrong entry is worse than one in memory because a context entry is a surface sessions trust.
 
-Do not edit a context entry here. `claude-docs` owns those edits and folds the routed facts in on its own pass, or two skills write one file at the same step. Write each routed fact to `.canon/tmp/memory-routing/<slug>.md` at the main worktree root instead, appending when the file exists. An append is a whole-file operation the shell does directly, so send it as a plain single `Bash` command carrying a heredoc:
+Do not edit a context entry here. `claude-docs` owns those edits and folds the routed facts in on its own pass, or two skills write one file at the same step. Write each routed fact to `.canon/tmp/memory-routing/<slug>.md` at the main worktree root instead, appending when the file exists. Name the heading with the entry's own path from `.claude/context/index.md`, flat or the nested `index.md`, since that heading is what tells `claude-docs`'s routed-facts fold which file to open. An append is a whole-file operation the shell does directly, so send it as a plain single `Bash` command carrying a heredoc:
+
+A flat domain takes:
 
 ```markdown
 ## .claude/context/<domain>.md
@@ -52,6 +54,14 @@ Do not edit a context entry here. `claude-docs` owns those edits and folds the r
 <the fact in one or two sentences, stated as a fact about the domain rather than as a session narrative>
 ```
 
+A domain split into a folder takes its own generated index instead:
+
+```markdown
+## .claude/context/<domain>/index.md
+
+<the fact in one or two sentences, stated as a fact about the domain rather than as a session narrative>
+```
+
 Derive `<slug>` per `${CLAUDE_SKILL_DIR}/../../standards/slug.md`. Fall back to `latest` on an empty result.
 
 The handoff is a file rather than a spoken result so the routed fact survives a compaction between this step and the `claude-docs` pass, and so the standalone caller leaves something behind for a later `/claude-docs` to consume.
@@ -80,7 +90,7 @@ Run `canon records validate memory` when the writes are done and fix what it nam
 
 Respond with one line per fact routed, written, or updated:
 
-- `➡️ Routed: <fact subject> → .claude/context/<domain>.md`
+- `➡️ Routed: <fact subject> → .claude/context/<domain>.md` for a flat entry, or `→ .claude/context/<domain>/index.md` for a nested one, matching the heading the routing file carries
 - `✅ Wrote: .canon/memory/<file> (<type>)`
 - `✏️ Updated: .canon/memory/<file> (<type>)`
 

package/claude/skills/claude-teach/SKILL.md

@@ -43,6 +43,8 @@ A topic the listing already carries is a resume, and anything else is a new work
 
 On a resume, run `canon teach list <topic> --json` for the files behind each count, then read the highest-numbered learning record and `GLOSSARY.md`. Those carry where the learner stopped and what they got wrong. The listing record carries `success`, the mission's success lines, which are the exit criteria this workspace is finished against. Report them with what is already met before teaching anything.
 
+It also carries `due`, what the learning records schedule, soonest first. Each entry names the item, its date, the rung it has reached, whether it is `overdue`, and the two dates the next record could write. Read it here rather than later: it is the input to what this session opens on, and `canon teach lesson` takes a `--slug` naming a choice already made. Report what is overdue before proposing a lesson. An empty `due` on a workspace holding records means no record scheduled anything, which is a gap in the records rather than a clear schedule.
+
 On a new workspace, settle the starting point first, by asking rather than by assuming. Difficulty with no floor under it teaches nobody, and the mission cannot be written without it.
 
 Then open the workspace, which derives the ordinal and writes all three required files:
@@ -75,13 +77,15 @@ A claim nothing was read for is the failure this step exists against. Where no s
 
 Pick the next lesson from the learning records rather than from the subject's own order. The target is the band immediately past what the learner can already do unaided, which `${CLAUDE_SKILL_DIR}/references/pedagogy.md` states in full.
 
-Open with retrieval on what the last session got wrong, before anything new. A learner who cannot retrieve the previous lesson is not ready for the next one, and moving on anyway buys fluency that decays.
+Open on what `due` reports as overdue, oldest date first, before anything new. Where nothing is overdue, open on retrieval of what the last session got wrong. A learner who cannot retrieve the previous lesson is not ready for the next one, and moving on anyway buys fluency that decays.
+
+Reading the last record alone is what the schedule replaces. A topic missed three sessions ago and never revisited is invisible to that read and sits in `due` with a date already past, which is the whole reason the field exists.
 
 ## Step 4: write the lesson and the reference
 
 Two outputs with two lifetimes, and the split decides the format.
 
-- A lesson is a self-contained page carrying its own quiz and the feedback for each answer. It embeds one shared stylesheet rather than restating styles, and it is disposable and never promoted.
+- A lesson is a self-contained page carrying its own quiz, a teach-back block, and the feedback for each question. It embeds one shared stylesheet rather than restating styles, and it is disposable and never promoted.
 - A reference page goes to `reference/<slug>.md`, written for a reader with no learner in it. This is the half that survives the workspace, so it is written in markdown to pass the authoring gates a promotion would put it through.
 
 Resolve the lesson before writing it, rather than composing its name or its quiz order by hand:
@@ -101,6 +105,14 @@ It writes nothing and reports three things:
 
 Write the correct option first, then present the options in the order `order` reports, reading it as authored indices where `0` is the correct one. Take the order as given. Position drawn here rather than chosen is the whole reason the verb exists, and a lesson that reorders on its own judgment puts the answer back in the first slot.
 
+### The quiz and the teach-back block
+
+The quiz markup is a contract rather than a convention. `canon teach nav` splices a stepper into the lesson that gates on exactly the class names and nesting `${CLAUDE_SKILL_DIR}/references/lesson-craft.md` states under `## Quiz construction`, so a quiz in any other shape shows every question at once and nothing reports it. That is the leak this shape closes: a later stem naming what an earlier question asked for answers it while both sit on screen.
+
+Write each option as a `<label class="opt" data-k="<letter>">` holding a radio `<input>` and a `<span>`, every option in one question sharing a `name` and each question taking a different one, the correct option carrying `data-a="1"`, and one `.fb` block as the last child of the `.q`. Never write a `<button class="opt">` in a new lesson. That is the shape written before the stepper, kept working by an injected script the button itself still triggers, and a lesson mixing the two gets both mechanisms.
+
+Then carry a teach-back block beside the quiz. A quiz is recognition and the pedagogy prefers production, so a lesson offering only a quiz tests the weak form. Ask for an explanation to a named audience, and carry a `<details>` listing what a complete explanation covers, closed by default, so a learner reading with no session in the room can grade themselves. The reference states both shapes in full.
+
 Write the chrome as four empty marker pairs rather than composing it by hand: `<!-- canon:teach:style -->`/`<!-- /canon:teach:style -->` inside `<head>`, and `<!-- canon:teach:header -->`, `<!-- canon:teach:footnav -->`, and `<!-- canon:teach:scripts -->` each with its own close marker, in that order in `<body>`. Write the authored `<h1>`, lede, body, and quiz between the header's close marker and the footnav's open marker, and nothing else anywhere in the file. Then run:
 
 ```bash
@@ -145,10 +157,26 @@ Do this on every run that opens or resumes a workspace, including one that write
 
 ## Step 5: record what happened
 
-Write `learning-records/<nnnn>-<slug>.md` before the session ends, carrying the lessons covered, what the learner retrieved unaided, what they got wrong with the wrong answer itself, and what to revisit.
+Write `learning-records/<nnnn>-<slug>.md` before the session ends, carrying the lessons covered, what the learner retrieved unaided, what they got wrong with the wrong answer itself, and a `## Revisit` section.
 
 Record the wrong answer rather than the count. The next session places the learner from this file, and a tally carries no misconception to work against.
 
+Record what the teach-back left out under what the learner got wrong, naming the concept and where the explanation broke. A produced answer and a selected one are both retrieval failures the next session places from, so a second heading would split one input across two sections.
+
+Then write `## Revisit`, one bullet per item, in the shape `${CLAUDE_SKILL_DIR}/../../standards/teach.md` fixes:
+
+```markdown
+## Revisit
+
+- **<what comes back up>**: due <YYYY-MM-DD>, rung <n>
+```
+
+Take both the date and the rung from the `due` entry Step 1 already read, copying `hit` for an item the learner retrieved unaided and `miss` for one they did not, with the rung stepped the same way. Do not compute a date from the ladder. A session told to widen a gap still picks the number by judgment, which is the reason the verb reports both dates at all.
+
+An item the records have never scheduled has no `due` entry to copy from. Open it at rung 1, dated the day after this session, which is the ladder's floor and the one number this body states. Every later date for it comes from the verb.
+
+An entry outside this shape schedules nothing and nothing reports that it was skipped, so write the shape exactly. A later record naming the same item supersedes an earlier entry, so revise a schedule by writing the new bullet rather than editing the record it was set in.
+
 Then restate the mission's success lines with what is now met, reading them from the `success` the lesson verb already reported rather than from `MISSION.md` by eye. Report each line as met or not met, and name what the learner did that meets it. A mission whose lines are all met is finished, and saying so is what closes a workspace.
 
 ## Step 6: propose where the durable half belongs

package/claude/skills/claude-teach/references/lesson-craft.md

@@ -49,9 +49,56 @@ The quiz is the retrieval, so a leak in its construction turns it into a reading
 - Write every option to the same length, in words and in characters. A longer option reads as the considered one.
 - Write the correct option first and let the ordering verb place it. Position is not the author's to pick: an author who varies it by hand still varies it by judgment, and the judgment settles on the first slot.
 - Make each wrong option a misconception someone actually holds. An obviously wrong option removes itself and shrinks the question.
-- Write feedback for every option, including the correct one, saying why rather than whether
+- Write one feedback block per question, covering the correct option and why each distractor fails, saying why rather than whether. One block reads as an explanation where a block per option reads as four verdicts, and only the explanation names what separates a wrong option from the answer.
 - Give feedback after the attempt, never alongside the question
 
+### The markup
+
+The quiz shape is a contract rather than a convention. `canon teach nav` splices a stepper into the lesson that gates on exactly these class names and this nesting, so a quiz written in any other shape renders with every question on screen at once and nothing reports it.
+
+```html
+<div class="quiz">
+<h2>Retrieval check</h2>
+
+<div class="q"><p class="q-stem">1. <stem></p>
+<label class="opt" data-k="A"><input type="radio" name="q1"><span><the option text></span></label>
+<label class="opt" data-k="B"><input type="radio" name="q1" data-a="1"><span><the option text></span></label>
+<div class="fb"><b>Correct: <the answer in a few words>.</b> <why each distractor fails.></div></div>
+</div>
+```
+
+- Give every option in one question the same `name`, and a different `name` per question. Options sharing a name across two questions let one answer clear another.
+- Mark the correct option with `data-a="1"` and leave the others without the attribute
+- Carry `data-k` on the `label`, since the workspace stylesheet renders the key letter from it
+- Keep `.fb` the last child of its `.q`. The stepper reveals it as a direct child, and a feedback block nested deeper stays hidden.
+- Put the option text in a `<span>` inside the label rather than bare beside the input, so the workspace can lay the two out
+- Never write a `<button class="opt">` in a new lesson. That is the shape written before the stepper, and it is kept working by an injected script the presence of a button is what still triggers.
+
+The stepper hides and shows and sets nothing else, so how a selected option looks, and whether a wrong one is marked as wrong, is the workspace stylesheet's to grow. Name the correct option in the feedback text for that reason: it is what a learner reads to find out whether they were right.
+
+## Teach back
+
+A quiz is recognition and a teach-back is production, which is the form retrieval practice prefers. Carry both: the quiz places the learner against options someone could hold, and the teach-back is where the learner finds out what they cannot say without help.
+
+- Ask for an explanation to a named audience rather than for an answer. Asking the learner to explain to somebody who has never written a pattern why a lazy quantifier is not an optional one gives the explanation a floor, where asking them to explain lazy quantifiers gives it none.
+- Ask about the thing the lesson was for, not a detail beside it. A teach-back on a footnote tests attention rather than the material.
+- Carry a self-check the learner can open, as a `<details>` listing what a complete explanation covers, closed by default. A learner reading with no session in the room otherwise gets an ask they cannot grade, and closed leaks nothing.
+- Write the self-check as what the explanation has to cover rather than as the explanation itself. A model answer is read instead of produced, which turns the block back into reading.
+
+```html
+<div class="teach-back">
+<h2>Explain it back</h2>
+<p>Without looking above: <the ask, naming who it is for.></p>
+<details><summary>What a complete explanation covers</summary>
+<ul>
+<li><a point the explanation has to reach></li>
+</ul>
+</details>
+</div>
+```
+
+It needs no styles of its own beyond what the workspace already gives a section and a `<details>`.
+
 ## Tokens travel with the course
 
 A lesson carries its own values in the shared stylesheet rather than reading a host project's. A workspace runs in any project and most carry no token record at all, so a lesson inheriting one is a lesson that renders unstyled wherever the record is absent, with nothing reporting it.

package/claude/skills/claude-teach/references/pedagogy.md

@@ -25,13 +25,23 @@ Pulling an answer out of memory strengthens it far more than reading it again. R
 - Let the learner fail an attempt before correcting it. A failed retrieval followed by the answer beats being told first.
 - Do not cue the answer in the question. A question restating the material tests reading rather than memory.
 
+The teach-back block is the production form this section prefers, and it is why a lesson carries one beside its quiz rather than a quiz alone. A quiz is recognition, so a lesson offering only one tests the weak form and reports it as retrieval. Asking the learner to explain the material to somebody who does not have it makes them produce the whole structure rather than pick from four, and what the explanation leaves out is the gap the next session places from.
+
+- Carry a teach-back block in every lesson, asking for an explanation rather than an answer
+- Name the audience the explanation is for, since an explanation with no reader has no floor to sit above
+- Record what the explanation left out under what the learner got wrong. A produced answer and a selected one are both retrieval failures, and splitting them across two sections splits one placement input.
+
 ## Spacing
 
 The same total time spread across days beats the same time in one sitting. Forgetting between sessions is the mechanism rather than the cost, because effortful retrieval is what strengthens the trace.
 
 - Revisit a topic after the learner has begun to forget it, not while it is still fresh
 - Widen the gap each time a topic is retrieved correctly, and shorten it after a miss
-- Name what to revisit and roughly when in the learning record, so the next session has a schedule rather than a guess
+- Name what to revisit and when in the learning record, so the next session has a schedule rather than a guess
+
+The ladder is 1, 3, 7, 16, and 35 days. A topic retrieved unaided moves up a rung and a miss drops it back one, held inside the ladder at either end, so a topic the learner keeps missing stays on the shortest gap rather than restarting a sequence.
+
+Do not compute a date from that ladder by hand. `canon teach list <topic> --json` reports the schedule with both dates already resolved for every item, which is what turns the ladder into a number to copy rather than a rule to apply. An author told to widen a gap still picks the gap by judgment, and this is the same reason quiz option order is drawn by a verb rather than stated here.
 
 ## Interleaving
 

package/claude/skills/claude-teach/references/promotion.md

@@ -14,11 +14,11 @@ A reference page that reads like a lesson is a lesson wearing the wrong extensio
 
 Sort by who owns the subject, which is the test the wiki already runs. The reader's activity decided the workspace and decides nothing here.
 
-| The page's subject                                             | Destination                   |
-| -------------------------------------------------------------- | ----------------------------- |
-| Owned by someone outside the project, such as a tool or vendor | the project's wiki            |
-| How this project itself works, for the people who build it     | `.claude/context/<domain>.md` |
-| Written for someone consuming what this project ships          | the project's public docs     |
+| The page's subject                                             | Destination                                                                                                 |
+| -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
+| Owned by someone outside the project, such as a tool or vendor | the project's wiki                                                                                          |
+| How this project itself works, for the people who build it     | `.claude/context/<domain>.md`, or the domain's own nested `index.md` when it is already split into a folder |
+| Written for someone consuming what this project ships          | the project's public docs                                                                                   |
 
 A page a reader cannot sort by that question is a page whose subject has not been settled. Say which two destinations it sits between and let the operator choose, rather than picking the nearer one.
 

package/claude/skills/migration-claude-md/SKILL.md

@@ -37,7 +37,7 @@ Split `CLAUDE.md` by `##` heading. Score each section against this order:
 For each section proposed for a move:
 
 - Path-scoped: propose `.claude/rules/<subdir>/<n>-<slug>.md` with a `paths:` glob. Pick the subdir and a free number the way `create-rule` does. If `.claude/rules/<subdir>/` already holds a rule on the topic, mark as "conflict" and skip.
-- Domain narrative: propose `.claude/context/<domain>.md`. If the entry already exists, propose appending rather than creating.
+- Domain narrative: propose `.claude/context/<domain>.md`. If the entry already exists, flat or as a same-named `.claude/context/<domain>/` folder, propose appending to the file that owns it rather than creating a duplicate flat entry beside a domain already split.
 
 ## Step 4: output
 
@@ -55,6 +55,7 @@ Print one grouped proposal block. Omit empty groups.
 ## Extract to a context entry
 
 - `## <heading>` → `.claude/context/<domain>.md` (<reason>)
+- `## <heading>` → `.claude/context/<domain>/<sub-area>.md`, appending to the domain's existing sibling file (<reason>)
 
 ## Needs manual split
 

package/claude/skills/migration-context/SKILL.md

@@ -44,7 +44,7 @@ For each file, score against this rule order:
 
 For every file proposed for a move:
 
-- If `.claude/context/<filename>` already exists, mark as "conflict" and skip the move.
+- If `.claude/context/<filename>` already exists, or a same-named folder exists at `.claude/context/` with `<filename>`'s `.md` extension dropped, mark as "conflict" and skip the move. A folder of the same name is still a collision, since the domain already lives there split into siblings.
 - Run `git grep -n "docs/<filename>"` (or grep equivalent) to list inbound references in `CLAUDE.md`, `README.md`, and other markdown. Report each as a TODO line. Do not rewrite.
 
 ## Step 4: output

package/docs/agents/audits.md

@@ -11,20 +11,22 @@ description: Running every health check as one set, what the single verdict mean
 canon audits run
 canon audits run --json
 canon audits run --record
+canon audits run --corpus tracked --corpus per-machine
 canon audits list --json
 ```
 
-| Option          | Behavior                                                         |
-| --------------- | ---------------------------------------------------------------- |
-| `--json`        | Add a machine-readable record on stdout, keeping the frame       |
-| `--root <path>` | Measure this tree instead of the current worktree                |
-| `--record`      | Write this run's tracked counts to `.claude/canon/baseline.json` |
+| Option            | Behavior                                                                                                   |
+| ----------------- | ---------------------------------------------------------------------------------------------------------- |
+| `--json`          | Add a machine-readable record on stdout, keeping the frame                                                 |
+| `--root <path>`   | Measure this tree instead of the current worktree                                                          |
+| `--record`        | Write this run's tracked counts to `.claude/canon/baseline.json`                                           |
+| `--corpus <name>` | Limit the run to one corpus (`tracked`, `per-machine`, `upstream`), repeatable, defaulting to every corpus |
 
 ## What it runs
 
 Nineteen verbs, listed by `canon audits list`. Each runs once in its fullest form, and the aggregate reads that verb's own record rather than imposing a shared envelope on it. Every one of those records already has consumers naming its keys, so a common shape would be a breaking change bought for tidiness.
 
-The verbs walk separate trees and share no state, so they run together. Measured on the authoring machine at twelve verbs, a run finished in 0.8 seconds of wall clock against 4.4 seconds of processor, which is under every other stage in `bun run check`. `canon deps audit` is the one that changes that reading, since it reaches a network rather than a tree and its latency is the index's rather than this machine's.
+The verbs walk separate trees and share no state, so they run together. Measured on the authoring machine at twelve verbs, a run finished in 0.8 seconds of wall clock against 4.4 seconds of processor, which is under every other stage in `bun run check`. `canon deps audit` is the one that changes that reading, since it reaches a network rather than a tree and its latency is the index's rather than this machine's: three clean runs measured 44.7, 77.6, and 62.9 seconds, and a stalled lookup runs to an explicit 120-second timeout rather than to bun's own 299-second ceiling. `--corpus` is what keeps a caller from paying that cost when it wants only the corpora on this disk.
 
 Sixteen of the nineteen read a tree on this disk, the one added by `restated.md` and the one added by `census.md` among them, since the first reads four such trees against each other and the second counts every file in one. The two added by `state-scoped-risk.md` read committed state rather than an arriving change, which is the gap every review surface here leaves by construction, and the one added by `label-coverage.md` reads a branch range against a map the project declares.
 
@@ -93,6 +95,8 @@ A hand-edited baseline that does not parse refuses the whole run. Reading a brok
 
 ## In the verify pipeline
 
-`bun run check` runs the set as a reporting stage after the three gating stages, and never fails on it. Those three stages keep their own specific remedies, so the aggregate reports the rest and the growth, and a fact still fails the push at the stage that names what to do about it.
+`bun run check` runs a reporting stage after the three gating stages, and never fails on it. Those three stages keep their own specific remedies, so the aggregate reports the rest and the growth, and a fact still fails the push at the stage that names what to do about it.
 
-The stage reads `summary`, a flat object of scalars published beside the nested arrays. Every key in it is unique across the whole record, so a shell stage greps one out without a JSON parser. The three verbs the gating stages already ran walk their trees a second time here, which is the 0.8 seconds measured above and the reason the whole set runs rather than only the part those stages skip: one verdict over every audit is the value, and a stage measuring a subset would report a health nobody took.
+The stage runs `--corpus tracked --corpus per-machine` rather than the full set, so `deps` and its network latency sit outside the gate entirely. A weekly job reads the advisory index instead, on a schedule rather than on every push. `summary.audited` in the gate's own record therefore reads 19 against the 20 `canon audits run` reaches with no filter.
+
+The stage reads `summary`, a flat object of scalars published beside the nested arrays. Every key in it is unique across the whole record, so a shell stage greps one out without a JSON parser. The three verbs the gating stages already ran walk their trees a second time here, which is the 0.8 seconds measured above and the reason the scoped set runs rather than only the part those stages skip: one verdict over the corpora describing this tree is the value, and a stage measuring a narrower subset would report a health nobody took.

package/docs/agents/commands.md

@@ -37,7 +37,7 @@ Full help: `canon <command> --help`. Behavior notes for the install and sync ver
 | `canon tasks validate`        | Report board rows whose shape, order, plan, task file, group, file set, or blocker does not hold (`--json`)                                                                                                                        |
 | `canon intake list`           | Report intake folder counts, or one folder's items, keeping what is unread with `--unread` (`--json`)                                                                                                                              |
 | `canon intake answer`         | Write selections into one cluster's answer slots, repeating `--set <item>=<answer>` (`--json`)                                                                                                                                     |
-| `canon teach list`            | Report learning workspaces and the ordinal a new one takes, or what one workspace holds (`--json`)                                                                                                                                 |
+| `canon teach list`            | Report learning workspaces and the ordinal a new one takes, or what one workspace holds and what its records schedule (`--json`)                                                                                                   |
 | `canon teach open`            | Open a workspace at the next ordinal with its mission, resources, and glossary files (`--json`)                                                                                                                                    |
 | `canon teach resource`        | Record sources and leads in a workspace, repeating `--read` or `--lead` as `<title>=<url>` (`--json`)                                                                                                                              |
 | `canon teach glossary`        | Add terms to a workspace glossary alphabetically, repeating `--term <term>=<definition>` (`--json`)                                                                                                                                |
@@ -79,7 +79,7 @@ Full help: `canon <command> --help`. Behavior notes for the install and sync ver
 | `canon repo metadata propose` | Compare a description, homepage, and topic set computed from the README and `package.json` against what the remote carries, writing nothing (`--root`, `--json`)                                                                   |
 | `canon repo metadata apply`   | Write an explicitly supplied description, homepage, or topic set to the remote through `gh repo edit` (`--description`, `--homepage`, `--topics`, `--root`, `--json`)                                                              |
 | `canon census [path]`         | Report tracked file count, a breakdown by extension, and a line total that skips whatever reads as binary (`--json`)                                                                                                               |
-| `canon audits run`            | Run every audit as one set, report per check under one verdict, and compare each count to the recorded baseline (`--json`, `--record`)                                                                                             |
+| `canon audits run`            | Run every audit as one set, report per check under one verdict, and compare each count to the recorded baseline (`--json`, `--record`, `--corpus`)                                                                                 |
 | `canon audits list`           | List every audit the set runs, with the corpus each reads and whether it gates (`--json`)                                                                                                                                          |
 | `canon gate run`              | Run every stage that guards a branch here, scoping shell, types, and tests to the changed set (`--all`, `--no-write`, `--nested`, `--json`)                                                                                        |
 | `canon inventory [subject]`   | Walk every route a project declares and group its elements by the property each computes, as a listing rather than a gate (`--json`)                                                                                               |

package/docs/agents/gate.md

@@ -77,8 +77,13 @@ One code for a failure, which is what a `bun run` caller and a git hook both rea
     "unmeasured": 0,
     "failed": 0
   },
-  "stages": [{ "id": "indexes", "label": "Indexes", "status": "passed" }]
+  "ms": 44453,
+  "stages": [
+    { "id": "indexes", "label": "Indexes", "status": "passed", "ms": 210 }
+  ]
 }
 ```
 
 A failing stage carries its remedy in `failure`, and the same line goes to stderr so a caller reading neither the record nor the frame is still told what to fix.
+
+`ms` carries the wall time each stage's checks took, including every process spawn, and the top-level `ms` sums them. Neither reading changes what a stage measures. Both exist so a slow run is attributable to a stage rather than read off a stopwatch held against the whole thing.

package/docs/agents/index.md

@@ -44,6 +44,6 @@ CLI catalog and invocation rules for agents, split by command domain. Start with
 - [Superseded values](superseded.md): Reading where the tree still asserts a value a changed convention no longer produces, why the sweep keys on the value rather than the file, the family stem behind a templated citation, the exemption marker, the blind spots it cannot reach, and why it reports rather than gates
 - [Targets](targets.md): The projects this toolkit installed into, the record the install writes against the sweep that backs it, what bounds each answer, and the cross-target pull request read
 - [Tasks](tasks.md): Selecting a shipped task by stem or pull request, recording a number and closing an outcome, the refusal reasons, the board and backlog checks validate runs, and why the board root defaults to the main worktree
-- [Teach](teach.md): Listing learning workspaces and the ordinal a new one takes, opening one with its required files, recording sources and glossary terms, resolving what the next lesson needs before it is written, rewriting the root listing, a contents page, and each lesson's chrome from its marker regions, the refusal reasons, and why every write here runs through a verb
+- [Teach](teach.md): Listing learning workspaces with what their records schedule next, opening one with its required files, recording sources and glossary terms, resolving what the next lesson needs before it is written, rewriting the root listing, a contents page, and each lesson's chrome and quiz stepper from its marker regions, the refusal reasons, and why every write here runs through a verb
 - [Test order](test-order.md): Reading where an implementation reached history ahead of its test, how a pair is decided, the three verdicts, the coverage the pairing cannot reach, and why the check reports rather than gates
 - [Worktrees](worktrees.md): Reporting which worktrees are reclaimable, removing the ones that are, the record a hook reads back, why the reading keys on the pull request rather than on git ancestry, the refusals it names, and the two removal shapes

package/docs/agents/teach.md

@@ -1,6 +1,6 @@
 ---
 title: Teach
-description: Listing learning workspaces and the ordinal a new one takes, opening one with its required files, recording sources and glossary terms, resolving what the next lesson needs before it is written, rewriting the root listing, a contents page, and each lesson's chrome from its marker regions, the refusal reasons, and why every write here runs through a verb
+description: Listing learning workspaces with what their records schedule next, opening one with its required files, recording sources and glossary terms, resolving what the next lesson needs before it is written, rewriting the root listing, a contents page, and each lesson's chrome and quiz stepper from its marker regions, the refusal reasons, and why every write here runs through a verb
 ---
 
 # Teach
@@ -29,6 +29,12 @@ A folder not named `NN-<topic>` is still listed rather than dropped, since dropp
 
 The listing also names the required files a workspace does not carry, which is `MISSION.md`, `RESOURCES.md`, and `GLOSSARY.md`. That is a report rather than a refusal, because a workspace missing one is still a workspace a session can resume.
 
+Every record carries `due`, read from the `## Revisit` sections of the workspace's learning records and sorted soonest first. Each entry names the `item`, its `date`, the `rung` it has reached on the spacing ladder, `overdue` once that date has arrived or passed, and the `record` the surviving entry was written in. A later record supersedes an earlier entry for the same item, matched without regard to case, since the schedule is the state of one topic rather than a log of every time it was set.
+
+Each entry also carries `hit` and `miss`, the two dates the next record could write. The ladder is 1, 3, 7, 16, and 35 days, a retrieval the learner passed unaided moving up a rung and a miss dropping back one, both held inside the ladder at either end. Reporting both dates is what lets a session copy one rather than compute it, on the same reasoning that put quiz option order in `canon teach lesson`.
+
+The field rides on the listing rather than on `canon teach lesson`, because a session needs the schedule before it has chosen what to teach and that verb takes a `--slug` naming a choice already made. An entry not written in the shape the standard fixes is skipped rather than reported, since a note carrying no date has no date to schedule.
+
 ## Open
 
 `canon teach open` creates a workspace at the next ordinal and writes all three required files.
@@ -152,6 +158,14 @@ A lesson carries its chrome as four marker pairs the authoring skill writes empt
 
 A lesson missing one of the four marker pairs is refused by name rather than rewritten, and every other lesson in the run still rewrites. The record's `skipped` list carries the refused files and which marker each is missing.
 
+The `style` region carries the quiz stepper after the workspace stylesheet, for every lesson but the one shape named three paragraphs down, so it wins the cascade at equal specificity and reaches a workspace seeded before it existed. The stepper is CSS over the radio inputs a quiz is written from: it hides every question that follows one holding no checked input, and hides a question's feedback until that question does. The general sibling combinator is what keeps that from depending on the markup contract holding, since it selects the same questions as the adjacent one for a quiz written correctly and goes on gating when anything sits between two of them, where the adjacent one matches nothing and shows them all at once. Gating there rather than in a script is what keeps a later stem from answering an earlier question with nothing to bind, and the whole block sits inside `@supports selector(:has(*))`, so an engine without `:has()` renders every question rather than a stepper showing nothing. Feedback there follows the workspace stylesheet, shown by one that says nothing about `.fb` and hidden by one grown under the retired script.
+
+The block hides and shows and sets nothing else, which leaves a workspace's own layout for a question and its own appearance for an option and a feedback panel. The one value it names is `display: block` on revealed feedback, since every stylesheet grown under the retired script carries `.fb { display: none }` and nothing adds the class that used to reveal it.
+
+One detector decides both regions. A lesson carrying `<button class="opt"`, the shape written before the stepper, takes the feedback script and no stepper, and every other lesson takes the stepper and no script. That is a detector rather than a mode, since a lesson has one shape or the other, and removing the script outright would leave the lessons already written showing no feedback at all.
+
+Splicing the stepper into a lesson of either shape was measured against a browser and reverted. Its rules match a button question, which can never hold a checked radio, so a lesson given both hides every question past the first for good and outranks the class the script reveals feedback with. Nothing else caught that: the markup is valid, the splice succeeds, and the page renders.
+
 ## Opening a workspace
 
 No `canon teach` verb serves the workspace. `canon serve` does, taking the teach root as its directory and the workspace contents page as its entry:

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@erclx/canon",
   "type": "module",
-  "version": "4.48.0",
+  "version": "4.49.0",
   "description": "Infrastructure and quality tooling for developer workflows",
   "license": "MIT",
   "bin": {

package/scripts/tooling/verify.sh

@@ -131,7 +131,8 @@ main() {
     run_phase "Prepare" bash -c "cd '$tmp_dir' && $prepare"
   fi
 
-  run_phase "Sync" bash -c "cd '$tmp_dir' && CANON_NON_INTERACTIVE=1 canon tooling sync $stack . --write"
+  log_info "Sync resolves via bun $PROJECT_ROOT/src/cli.ts, not PATH canon"
+  run_phase "Sync" bash -c "cd '$tmp_dir' && CANON_NON_INTERACTIVE=1 bun '$PROJECT_ROOT/src/cli.ts' tooling sync $stack . --write"
 
   if [ -f "$tmp_dir/package.json" ]; then
     run_phase "lint:fix" bash -c "cd '$tmp_dir' && bun run lint:fix"
@@ -178,4 +179,6 @@ main() {
   fi
 }
 
-main "$@"
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+  main "$@"
+fi

package/src/audits/catalog.ts

@@ -100,6 +100,8 @@ export interface AuditResult {
   readonly counts?: Record<string, number>
   /** Why the audit did not report, present only on `unmeasured`. */
   readonly reason?: string
+  /** Wall time the spawn took, from the aggregate's own clock. */
+  readonly ms: number
 }
 
 /** The exit code every command here sets when it refuses. */
@@ -816,6 +818,7 @@ export function classify(
   spec: AuditSpec,
   exitCode: number,
   stdout: string,
+  ms = 0,
 ): AuditResult {
   const base = {
     id: spec.id,
@@ -823,6 +826,7 @@ export function classify(
     tracked: isTracked(spec),
     corpus: spec.corpus,
     exitCode,
+    ms,
   }
 
   let record: unknown

package/src/audits/run.ts

@@ -1,10 +1,32 @@
 import { join } from 'node:path'
 import { execa } from 'execa'
 import type { Delta } from '@/audits/baseline'
-import { type AuditResult, type AuditSpec, classify } from '@/audits/catalog'
+import {
+  type AuditResult,
+  type AuditSpec,
+  classify,
+  type Corpus,
+} from '@/audits/catalog'
 import { gitEnv } from '@/git-env'
 import { PROJECT_ROOT } from '@/project-root'
 
+/** Every value a corpus filter accepts, matching the `Corpus` union. */
+export const CORPORA: readonly Corpus[] = ['tracked', 'per-machine', 'upstream']
+
+/**
+ * The catalog scoped to the requested corpora, or the whole set when none
+ * were named. `--corpus` on `audits run` reads this, and so does `auditSet`
+ * in `src/gate/measures.ts`, which excludes the upstream corpus so the gate
+ * reads only what describes this tree.
+ */
+export function auditsFor(
+  specs: readonly AuditSpec[],
+  requested: readonly string[],
+): readonly AuditSpec[] {
+  if (requested.length === 0) return specs
+  return specs.filter((spec) => requested.includes(spec.corpus))
+}
+
 /** At least one audit reported a finding that is a fact. */
 export const EXIT_FINDING = 2
 
@@ -77,9 +99,10 @@ export async function runAudits(
 ): Promise<AuditResult[]> {
   return Promise.all(
     specs.map(async (spec) => {
+      const startedAt = performance.now()
       try {
         const { exitCode, stdout } = await spawn(spec)
-        return classify(spec, exitCode, stdout)
+        return classify(spec, exitCode, stdout, performance.now() - startedAt)
       } catch (error) {
         return {
           id: spec.id,
@@ -89,6 +112,7 @@ export async function runAudits(
           corpus: spec.corpus,
           exitCode: 1,
           reason: `could not be started: ${error instanceof Error ? error.message : String(error)}`,
+          ms: performance.now() - startedAt,
         }
       }
     }),

package/src/commands/audits.ts

@@ -9,8 +9,10 @@ import {
   readBaseline,
   writeBaseline,
 } from '@/audits/baseline'
-import { AUDITS, type AuditResult } from '@/audits/catalog'
+import { AUDITS, type AuditResult, type Corpus } from '@/audits/catalog'
 import {
+  auditsFor,
+  CORPORA,
   exitCodeFor,
   runAudits,
   spawnAudit,
@@ -25,6 +27,11 @@ interface RunCommandOptions {
   readonly json?: boolean
   readonly record?: boolean
   readonly root?: string
+  readonly corpus?: readonly string[]
+}
+
+function collectCorpus(value: string, previous: string[]): string[] {
+  return [...previous, value]
 }
 
 interface ListCommandOptions {
@@ -52,6 +59,12 @@ export function register(program: Command): void {
       '--record',
       `Write this run's tracked counts to ${BASELINE_REL} as the new baseline`,
     )
+    .option(
+      '--corpus <corpus>',
+      `Limit the run to one corpus (${CORPORA.join(', ')}), repeatable. Defaults to every corpus`,
+      collectCorpus,
+      [] as string[],
+    )
     .addHelpText(
       'after',
       [
@@ -81,6 +94,7 @@ export function register(program: Command): void {
         '  canon audits run',
         '  canon audits run --json',
         '  canon audits run --record',
+        '  canon audits run --corpus tracked --corpus per-machine',
         '',
       ].join('\n'),
     )
@@ -175,6 +189,28 @@ async function headCommit(root: string): Promise<string> {
 async function runAll(opts: RunCommandOptions): Promise<number> {
   const emitJson = opts.json ?? false
   const root = opts.root ?? (await currentWorktreeRoot())
+  const requested = opts.corpus ?? []
+
+  const invalid = requested.filter(
+    (corpus) => !CORPORA.includes(corpus as Corpus),
+  )
+  if (invalid.length > 0) {
+    const message = `Unknown corpus ${invalid.join(', ')}. Valid corpora: ${CORPORA.join(', ')}.`
+    if (emitJson) {
+      process.stderr.write(`${message}\n`)
+      process.stdout.write(
+        `${JSON.stringify({ ok: false, reason: 'bad-corpus', message })}\n`,
+      )
+      return 1
+    }
+    intro('canon audits run')
+    logStep('Refused')
+    logError(message)
+    outro()
+    return 1
+  }
+
+  const audits = auditsFor(AUDITS, requested)
 
   let baseline: Baseline | undefined
   try {
@@ -195,7 +231,7 @@ async function runAll(opts: RunCommandOptions): Promise<number> {
     return 1
   }
 
-  const results = await runAudits(AUDITS, spawnAudit(root))
+  const results = await runAudits(audits, spawnAudit(root))
   const deltas = compareBaseline(baseline, results)
   const summary = summarize(results, deltas)
 

package/src/commands/gate.ts

@@ -134,11 +134,13 @@ async function runGate(opts: RunCommandOptions): Promise<number> {
         scoped: changed.scoped,
         changed: changed.files.length,
         summary,
-        stages: results.map(({ id, label, status, failure }) => ({
+        ms: results.reduce((total, result) => total + result.ms, 0),
+        stages: results.map(({ id, label, status, failure, ms }) => ({
           id,
           label,
           status,
           failure,
+          ms,
         })),
       })}\n`,
     )

package/src/commands/teach.ts

@@ -11,6 +11,7 @@ import {
   type ReadOutcome,
   readWorkspace,
   recordSources,
+  type RevisitItem,
   type Source,
   type SourceOutcome,
   type TeachRefused,
@@ -104,6 +105,11 @@ export function register(program: Command): void {
         'With no topic it reports one line per workspace and the ordinal an',
         'open would take. With one it reports the files behind each count.',
         '',
+        'Every record carries due, what the learning records schedule, each',
+        'entry with its date, its rung, and the date to write on a hit and',
+        'on a miss, so a session picks the next lesson from the schedule',
+        'rather than from the last session alone.',
+        '',
         'A workspace not named NN-<topic> is still listed. It sorts last and',
         'moves no ordinal, since dropping it hides the folder needing a fix.',
         '',
@@ -711,6 +717,17 @@ function reportRefusal(
   return 1
 }
 
+/**
+ * One scheduled revisit, carrying both ladder dates rather than the rung alone.
+ * A session copies the date the outcome names instead of computing one from a
+ * ladder stated in prose.
+ */
+function describeRevisit(item: RevisitItem): string {
+  const when = item.overdue ? `due ${item.date}` : item.date
+
+  return `${item.item}: ${when}, rung ${item.rung} (hit ${item.hit}, miss ${item.miss}), from ${item.record}`
+}
+
 function describe(workspace: WorkspaceSummary): string {
   return `${workspace.slug}: ${workspace.lessons} lesson(s), ${workspace.records} record(s), ${workspace.reference} reference page(s), ${workspace.terms} term(s)`
 }
@@ -795,6 +812,9 @@ function reportWorkspace(
   )
   for (const line of workspace.success) logInfo(line)
 
+  logStep(workspace.due.length > 0 ? 'Revisit' : 'Revisit (nothing scheduled)')
+  for (const item of workspace.due) logInfo(describeRevisit(item))
+
   if (workspace.missing.length > 0) {
     logStep('Missing a required file')
     logWarn(`no ${workspace.missing.join(' and no ')}`)

package/src/deps/audit.ts

@@ -38,6 +38,15 @@ export interface Advisory {
  */
 export type AuditRefusal = 'no-manifest' | 'no-lockfile' | 'no-record'
 
+/**
+ * The ceiling on `bun audit --json`, which carries no timeout of its own and
+ * runs to bun's own 299-second ceiling on a stall. Three consecutive clean
+ * runs on this tree measured 44.7, 77.6, and 62.9 seconds, so 120 seconds
+ * leaves margin over the slowest observed pass while still bounding a stall
+ * well under bun's own ceiling.
+ */
+const AUDIT_TIMEOUT_MS = 120_000
+
 /** The lockfiles a resolved dependency set leaves behind, in any manager. */
 const LOCKFILES = [
   'bun.lock',
@@ -115,6 +124,22 @@ export function countBySeverity(
   return counts
 }
 
+/**
+ * The message a caller reads for a refusal with no advisory record, naming a
+ * stall as its own cause rather than folding it into "no output on stdout",
+ * which is what an empty stdout reads as either way.
+ */
+export function noRecordMessage(result: {
+  readonly timedOut: boolean
+  readonly stderr: string
+}): string {
+  if (result.timedOut) {
+    return `timed out after ${AUDIT_TIMEOUT_MS}ms waiting on the advisory index`
+  }
+  const line = result.stderr.trim().split('\n').pop()
+  return line !== undefined && line !== '' ? line : 'no output on stdout'
+}
+
 /**
  * Shells the runtime's own advisory command rather than carrying an index.
  *
@@ -138,6 +163,7 @@ export async function auditDependencies(root: string): Promise<DepsAudit> {
   const result = await execa('bun', ['audit', '--json'], {
     cwd: root,
     reject: false,
+    timeout: AUDIT_TIMEOUT_MS,
   })
 
   const advisories = parseAdvisories(result.stdout)
@@ -145,7 +171,7 @@ export async function auditDependencies(root: string): Promise<DepsAudit> {
     return {
       kind: 'refused',
       reason: 'no-record',
-      message: result.stderr.trim().split('\n').pop() ?? 'no output on stdout',
+      message: noRecordMessage(result),
     }
   }
 

package/src/gate/measures.ts

@@ -686,10 +686,15 @@ interface AuditSummary {
 
 /**
  * The three stages gating on the three findings here that are facts sit above,
- * and this stage reports the rest. It runs the whole set anyway rather than
- * only what those stages skip, because the aggregate's own value is one verdict
- * over every audit, and a stage measuring a subset would report a health this
- * repository never took.
+ * and this stage reports the rest. It runs every tracked and per-machine audit
+ * rather than only what those stages skip, because the aggregate's own value
+ * is one verdict over the corpora describing this tree, and a stage measuring
+ * a narrower subset would report a health this repository never took.
+ *
+ * The upstream corpus is excluded. `deps` reaches a network index rather than
+ * this tree, and its wall time dwarfs every other stage combined, so a push
+ * gated on it waits on a lookup this tree's own health never depended on. A
+ * scheduled `verify.yml` job reports the advisory instead.
  *
  * This reports and never fails. Growth in a judgment count is the thing the
  * baseline exists to make visible, and failing a push on one would teach a
@@ -697,7 +702,15 @@ interface AuditSummary {
  * specific stage above that names its own remedy.
  */
 export const auditSet: Measure = async (ctx) => {
-  const run = await ctx.cli(['audits', 'run', '--json'])
+  const run = await ctx.cli([
+    'audits',
+    'run',
+    '--corpus',
+    'tracked',
+    '--corpus',
+    'per-machine',
+    '--json',
+  ])
 
   if (run.stdout.trim() === '') {
     return {

package/src/gate/sequencer.ts

@@ -27,6 +27,8 @@ export interface StageResult {
   readonly emissions: readonly Emission[]
   /** The remedy line a failed stage prints, naming what to do about it. */
   readonly failure?: string
+  /** Wall time the stage's checks took, including every process spawn. */
+  readonly ms: number
 }
 
 export interface GateContext extends MeasureContext {
@@ -133,6 +135,17 @@ export async function runStage(
   stage: Stage,
   ctx: GateContext,
 ): Promise<StageResult> {
+  const startedAt = performance.now()
+  const result = await executeStage(stage, ctx)
+  return { ...result, ms: performance.now() - startedAt }
+}
+
+type StageOutcome = Omit<StageResult, 'ms'>
+
+async function executeStage(
+  stage: Stage,
+  ctx: GateContext,
+): Promise<StageOutcome> {
   if (stage.scope !== undefined && !hasChanged(stage.scope, ctx.changed)) {
     return {
       id: stage.id,

package/src/tasks/archive.ts

@@ -496,6 +496,22 @@ async function resolveStem(
 
   if (selector.kind === 'stem') {
     if (!stems.includes(selector.stem)) {
+      const prefixed = stems.filter((stem) => stem.startsWith(selector.stem))
+      if (prefixed.length === 1) {
+        const [match] = prefixed
+        return refuse(
+          'no-match',
+          `${selector.stem} does not name a task by itself. One task starts with it: ${match}. Pass the full name to archive it.`,
+          [match],
+        )
+      }
+      if (prefixed.length > 1) {
+        return refuse(
+          'ambiguous',
+          `${selector.stem} does not name a task by itself. ${prefixed.length} tasks start with it. Pass the full name to archive one.`,
+          prefixed,
+        )
+      }
       return refuse(
         'no-match',
         `No task named ${selector.stem} on the board.`,

package/src/teach/nav.ts

@@ -50,6 +50,55 @@ const CLOSE_OUTSIDE_CLICK_SCRIPT = `<script>
 })();
 </script>`
 
+/**
+ * The stepper, as CSS over the radio inputs a lesson's quiz is written from.
+ *
+ * A quiz showing every question at once lets a later stem answer an earlier
+ * question, which is a leak no wording of the questions closes. Gating on
+ * `:has()` rather than on a script keeps the page working with nothing to bind,
+ * and the radio input is what records an answer with no handler in the loop.
+ *
+ * The general sibling combinator is what keeps the gate from depending on the
+ * markup contract holding. It selects the same questions as `+` for a quiz
+ * written correctly, and it goes on gating when anything sits between two of
+ * them, where `+` matches nothing and shows every later question at once. That
+ * is the leak this block exists to close, arriving through a shape nothing
+ * rejects.
+ *
+ * The two hide rules select the unanswered state alone, so a workspace's own
+ * `display` for a question survives being stepped through. Feedback has to be
+ * shown by a rule naming a value, because every stylesheet grown under the
+ * retired script carries `.fb { display: none }` and nothing adds the class
+ * that revealed it. Appearance stays the workspace's: this block hides and
+ * shows and sets nothing else.
+ *
+ * `@supports` wraps every rule, so an engine without `:has()` renders every
+ * question rather than a stepper showing nothing. Feedback there follows the
+ * workspace: a fresh stylesheet shows it and one grown under the retired script
+ * keeps it hidden. Showing it unconditionally outside the wrapper was measured
+ * and reverted, since that rule outranks `.fb { display: none }` on every
+ * engine and would reveal the feedback in the button-shape lessons the script
+ * still drives.
+ */
+const QUIZ_CSS = `@supports selector(:has(*)) {
+  .quiz .q:not(:has(input[type="radio"]:checked)) ~ .q { display: none; }
+  .quiz .q:not(:has(input[type="radio"]:checked)) .fb { display: none; }
+  .quiz .q:has(input[type="radio"]:checked) > .fb { display: block; }
+}`
+
+/**
+ * The button shape a lesson written before the stepper carries. It is a
+ * detector rather than a mode: a lesson has one shape or the other, and which
+ * one it has decides both the style and the scripts region.
+ */
+const LEGACY_OPTION = '<button class="opt"'
+
+/**
+ * What reveals feedback in a lesson written against `LEGACY_OPTION`. The radio
+ * shape needs none of it, so a lesson carrying no button option gets no script,
+ * and removing this outright would leave the lessons already written showing no
+ * feedback at all.
+ */
 const QUIZ_SCRIPT =
   '<script>document.querySelectorAll(".q").forEach(function(q){var f=q.querySelector(".fb");q.querySelectorAll(".opt").forEach(function(b){b.addEventListener("click",function(){if(f.classList.contains("show"))return;q.querySelectorAll(".opt").forEach(function(o){o.dataset.state=o.dataset.a==="1"?"right":(o===b?"chosen":"wrong");});f.classList.add("show");});});});</script>'
 
@@ -662,11 +711,20 @@ async function rewriteLesson(
     metas.map<TrackState>((_, i) => (i === index ? 'here' : 'done')),
   )
 
+  // One detector decides both mechanisms, because a lesson carries one quiz
+  // shape or the other and the two cannot share a page. The stepper's rules
+  // match a button question that can never hold a checked radio, so a lesson
+  // given both would hide every question past the first for good and outrank
+  // the class the script reveals feedback with.
+  const legacy = html.includes(LEGACY_OPTION)
+
   const regions: ReadonlyArray<readonly [Region, string]> = [
-    ['style', `<style>\n${css}\n</style>`],
+    // The stepper follows the workspace stylesheet so it wins the cascade at
+    // equal specificity, which is what reaches a workspace seeded before it.
+    ['style', `<style>\n${legacy ? css : `${css}\n${QUIZ_CSS}`}\n</style>`],
     ['header', header],
     ['footnav', renderFootNav(metas, index)],
-    ['scripts', renderScripts(html.includes('class="quiz"'), false)],
+    ['scripts', renderScripts(legacy, false)],
   ]
 
   for (const [region, content] of regions) {

package/src/teach/workspace.ts

@@ -75,6 +75,44 @@ const ORDINAL_WIDTH = 2
 
 const DATE_LENGTH = 'YYYY-MM-DD'.length
 
+const MS_PER_DAY = 24 * 60 * 60 * 1000
+
+/** The heading a learning record schedules its revisits under. */
+const REVISIT_HEADING = '## Revisit'
+
+/**
+ * The gaps a revisit item moves through, in days. A rung is a one-based index
+ * into this list, widening after a retrieval the learner passed unaided and
+ * narrowing after a miss, which is the spacing rule the pedagogy reference
+ * states. The values are here rather than in a skill body because a session
+ * told to widen a gap still picks the number by judgment.
+ */
+const REVISIT_LADDER = [1, 3, 7, 16, 35] as const
+
+/**
+ * One scheduled entry, as a learning record spells it. The rung is carried in
+ * the record rather than derived from how many records name the item, since a
+ * miss drops it back and a count only ever climbs.
+ */
+const REVISIT_ENTRY =
+  /^-\s+\*\*(.+?)\*\*:\s*due\s+(\d{4}-\d{2}-\d{2}),\s*rung\s+([1-9]\d*)\s*$/
+
+export interface RevisitItem {
+  /** What comes back up, as the record names it. */
+  readonly item: string
+  /** The day it comes back up, as `YYYY-MM-DD`. */
+  readonly date: string
+  readonly rung: number
+  /** True once that day has arrived or passed. */
+  readonly overdue: boolean
+  /** The date to schedule when the learner retrieves it unaided. */
+  readonly hit: string
+  /** The date to schedule when they miss it. */
+  readonly miss: string
+  /** The record the surviving entry was written in. */
+  readonly record: string
+}
+
 export interface WorkspaceSummary {
   readonly slug: string
   /** `NaN` when the folder name carries no ordinal, which a listing reports. */
@@ -99,6 +137,12 @@ export interface WorkspaceDetail extends WorkspaceSummary {
   readonly glossary: readonly string[]
   /** The mission's success lines, which a session reports progress against. */
   readonly success: readonly string[]
+  /**
+   * What the learning records schedule, soonest first. A session reads this
+   * before it has chosen what to teach, which is why it rides on the listing
+   * rather than on the verb that resolves a lesson already picked.
+   */
+  readonly due: readonly RevisitItem[]
 }
 
 export interface WorkspacesListed {
@@ -242,6 +286,103 @@ function successLines(text: string): string[] {
   )
 }
 
+/**
+ * Whether a `YYYY-MM-DD` string names a real day.
+ *
+ * The entry pattern admits `2026-13-45`, since it counts digits rather than
+ * reading a calendar, and `addDays` throws on a date that names no day, so a
+ * single mistyped record would take down every listing that reads the
+ * workspace. Every date reaching `addDays` passes here first.
+ */
+function isDay(date: string): boolean {
+  return !Number.isNaN(Date.parse(`${date}T00:00:00Z`))
+}
+
+/** A day offset from a real `YYYY-MM-DD` date, back out in the same form. */
+function addDays(date: string, days: number): string {
+  const start = Date.parse(`${date}T00:00:00Z`)
+  return new Date(start + days * MS_PER_DAY).toISOString().slice(0, DATE_LENGTH)
+}
+
+/** A rung moved by one step, held inside the ladder at both ends. */
+function stepRung(rung: number, step: number): number {
+  return Math.min(REVISIT_LADDER.length, Math.max(1, rung + step))
+}
+
+function gapFor(rung: number, step: number): number {
+  return REVISIT_LADDER[stepRung(rung, step) - 1]
+}
+
+export interface RecordText {
+  readonly file: string
+  readonly text: string
+}
+
+/**
+ * Every revisit a workspace's learning records schedule, soonest first.
+ *
+ * Records arrive in read order and a later one supersedes an earlier entry for
+ * the same item, since the schedule is the state of one topic rather than a log
+ * of every time it was set. Matching is case-insensitive on the item, so a
+ * session that capitalized differently in a later record still supersedes
+ * rather than opening a second schedule beside the first.
+ *
+ * An entry not in the recorded shape is skipped rather than reported. A note
+ * carrying no date schedules nothing, which is what the standard's anti-pattern
+ * names, and this reader has no date to put on it. A date naming no real day is
+ * skipped on the same footing, since a schedule nothing can order is a note.
+ */
+export function readRevisits(
+  records: readonly RecordText[],
+  today: string,
+): RevisitItem[] {
+  if (!isDay(today)) return []
+
+  const scheduled = new Map<
+    string,
+    { item: string; date: string; rung: number; record: string }
+  >()
+
+  for (const record of records) {
+    const lines = record.text.split('\n')
+    const section = sectionRange(
+      unfenced(record.text),
+      REVISIT_HEADING,
+      lines.length,
+    )
+
+    if (!section) continue
+
+    for (const block of bulletBlocks(lines.slice(section.start, section.end))) {
+      const match = REVISIT_ENTRY.exec(block.join(' ').replace(/\s+/g, ' '))
+      if (!match || !isDay(match[2])) continue
+
+      scheduled.set(match[1].toLowerCase(), {
+        item: match[1],
+        date: match[2],
+        rung: Number(match[3]),
+        record: record.file,
+      })
+    }
+  }
+
+  return [...scheduled.values()]
+    .map((entry) => ({
+      item: entry.item,
+      date: entry.date,
+      rung: entry.rung,
+      overdue: entry.date <= today,
+      hit: addDays(today, gapFor(entry.rung, 1)),
+      miss: addDays(today, gapFor(entry.rung, -1)),
+      record: entry.record,
+    }))
+    .sort(
+      (left, right) =>
+        left.date.localeCompare(right.date) ||
+        left.item.localeCompare(right.item),
+    )
+}
+
 /** The ordinal a folder name carries, or `NaN` when it carries none. */
 function ordinalOf(slug: string): number {
   const match = WORKSPACE_NAME.exec(slug)
@@ -272,6 +413,15 @@ async function summarize(
     filesIn(dir, TEACH_REFERENCE, '.md'),
   ])
 
+  // Read order is filename order, which is record order, so a later record
+  // supersedes an earlier schedule for the same item.
+  const records = await Promise.all(
+    recordFiles.map(async (file) => ({
+      file,
+      text: await readFile(join(dir, TEACH_RECORDS, file), 'utf8'),
+    })),
+  )
+
   return {
     slug,
     ordinal: match ? Number(match[1]) : Number.NaN,
@@ -291,6 +441,7 @@ async function summarize(
     referenceFiles,
     glossary,
     success: mission === undefined ? [] : successLines(mission),
+    due: readRevisits(records, today()),
   }
 }
 

package/standards/teach.md

@@ -90,11 +90,27 @@ One record per session the learner worked through, holding what happened rather
 
 - The lessons covered, by number
 - What the learner retrieved correctly without help
-- What they got wrong, and what the wrong answer was
-- What to revisit, and roughly when
+- What they got wrong, and what the wrong answer was, including what an explanation the learner produced left out
+- A `## Revisit` section scheduling what comes back up
 
 Record the wrong answer rather than the fact of an error. A wrong answer names the misconception, and the count alone names nothing.
 
+A produced explanation and a selected option are both retrieval, so a gap in an explanation goes under what the learner got wrong rather than under a heading of its own. Name the concept and where the explanation broke. Splitting the two puts one input to the next session's placement across two sections, and the placement reads both or neither.
+
+### The revisit section
+
+Write one bullet per item, in this shape and no other:
+
+```markdown
+## Revisit
+
+- **<what comes back up>**: due <YYYY-MM-DD>, rung <n>
+```
+
+The rung is where the item sits on the spacing ladder, and it travels in the record rather than being counted from how many records name the item, since a miss drops it back and a count only climbs. A later record naming the same item supersedes an earlier one, so revise the schedule by writing the new entry rather than editing the old record.
+
+Take the date and the rung from what the surface driving the workspace reports rather than picking either. An entry outside this shape schedules nothing, and nothing reports that it was skipped.
+
 ## GLOSSARY.md
 
 Required in every workspace, holding one entry per term the subject defines. The glossary reference the `canon:claude-teach` skill carries fixes what an entry looks like, how the file orders and groups them, and which terms it carries, so this standard states only that the file exists and sits at the workspace root. That reference ships with the plugin rather than installing here, because a promoted glossary keeps its shape wherever it lands and no project folder covers every destination. Say so and stop rather than working the shape from memory when the project has no plugin to read it from.
@@ -122,6 +138,7 @@ A source found and not read is listed as a lead because a link attached to a pag
 - **The mission with no test.** Success stated as understanding rather than as a task leaves nothing able to say the mission is finished.
 - **The lesson filed as reference.** A page written to be worked through once sits in `lessons/`, and putting it in `reference/` puts disposable output in the half that gets promoted.
 - **The record that counts errors.** A tally of how many were missed carries none of the misconception, which is the only part a later session can act on.
+- **The revisit note with no date.** A line naming what to come back to and not when is read by nothing and schedules nothing, so the next session picks from the last record alone, which is the state the section exists to end.
 - **The date left in the body.** A frontmatter field and a sentence both claiming the opening date resolve to whichever a reader happens to hit, and only one of them is readable by a walker.
 - **The renumbered folder.** Closing a gap in the ordinals moves every name a reader or a record already cited.
 

package/standards/wireframes.md

@@ -30,6 +30,14 @@ A wireframe works when someone can rebuild the surface from it without opening t
 
 A wireframe that fails these is non-conforming regardless of whether it satisfies every section rule below. The fences are the means. These three questions are the test.
 
+## Transcription wireframes
+
+A wireframe regenerated from an already-built surface's own render code may carry what the sections below forbid: the source file and function, the class or token names driving each region, and pixel-exact geometry. Open the file by naming that source: the render function, the stylesheet rule, or the built file the block was read off. The citation is what separates a transcription wireframe from one that merely broke the rules below, since a role label with nothing behind it is unchecked and a class name traced to a real file and line is not.
+
+A drafted-ahead wireframe states intent in role terms because nothing exists yet to check it against. A regenerated one is checkable against the code it mirrors, and a role label standing in for the real class name would throw that check away. The two documents answer different questions, so one set of rules cannot govern both.
+
+Route detail the source citation does not already carry to `.claude/context/` as usual: algorithms, event-handler code, workarounds, and rejected approaches stay out of the wireframe regardless of which mode it is written in.
+
 ## Frontmatter
 
 - `title` (required): sentence case, names the surface (`Header`, `Section nav`, `Footer`).
@@ -41,7 +49,7 @@ Both fields feed `.claude/wireframes/index.md` when regenerated.
 
 - Draw each surface as an ASCII block inside a `plaintext` fence. One fence per distinct layout.
 - Label regions with `←` annotations. Never use `#` for annotations.
-- Show a region's role, not its styling. `← status pill` reads better than a class name or hex value.
+- Show a region's role, not its styling. `← status pill` reads better than a class name or hex value. A transcription wireframe is the exception: see `## Transcription wireframes`.
 - Keep the grid honest. The ASCII proportions should match the intended widths, since conveying proportion is the wireframe's job.
 
 ## Variants
@@ -63,7 +71,7 @@ Both fields feed `.claude/wireframes/index.md` when regenerated.
 
 ## What moves to .claude/context/
 
-Implementation detail that answers how the surface is built belongs in a `.claude/context/` entry, not the wireframe:
+This section does not govern a transcription wireframe's citation of its own source. See `## Transcription wireframes`. Implementation detail that answers how the surface is built belongs in a `.claude/context/` entry, not the wireframe:
 
 - Algorithms, event-handler code, and lifecycle ordering
 - Framework component names, props, and CSS class or token names