@erclx/canon 4.6.1 → 4.8.0

package/src/commands/capture.ts

@@ -1,22 +1,37 @@
 import { existsSync } from 'node:fs'
 import { relative, resolve } from 'node:path'
 import type { Command } from 'commander'
-import { frameError, intro, logError, logInfo, outro, pipeOutput } from '@/ui'
+import {
+  INSTALL_BROWSER,
+  isBrowserMissing,
+  isEngineMissing,
+} from '@/browser/engine'
+import {
+  frameError,
+  intro,
+  logError,
+  logInfo,
+  logWarn,
+  outro,
+  pipeOutput,
+} from '@/ui'
 
 const DEFAULT_SOURCE = 'assets'
-const DEFAULT_SELECTOR = '.window'
 
 /**
- * Both aliases are type queries rather than imports, so `@/capture/render`
- * never appears in this module's runtime import list.
+ * Both aliases are type queries rather than imports, so naming the render
+ * module's types adds no static import of it. The only reference that survives
+ * to runtime is the `import()` inside the action.
  */
 type Renderer = typeof import('@/capture/render')
 type CaptureResult = Awaited<ReturnType<Renderer['captureSources']>>[number]
 
 /**
- * Holds wiring only. Every browser reference sits behind `loadRenderer`,
- * because `src/cli.ts` imports this module at startup and the render module is
- * excluded from the published package.
+ * Holds wiring only. Every browser reference sits behind a dynamic import,
+ * because `src/cli.ts` imports this module at startup and resolving the engine
+ * there would put a browser launch in front of every other command. That is the
+ * same reason `src/commands/demo.ts`, `src/commands/inventory.ts`, and
+ * `src/commands/driver.ts` state for themselves.
  */
 export function register(program: Command): void {
   program
@@ -24,20 +39,27 @@ export function register(program: Command): void {
     .description('Render HTML capture sources to PNG')
     .argument('[source]', 'HTML file or a directory of them', DEFAULT_SOURCE)
     .option('-o, --out <dir>', 'Output directory, defaults beside the source')
-    .option('-s, --selector <selector>', 'Element to capture', DEFAULT_SELECTOR)
+    .option('-s, --selector <selector>', 'Element to capture')
     .action(
       async (
         source: string,
-        opts: { out?: string; selector: string },
+        opts: { out?: string; selector?: string },
       ): Promise<void> => {
-        const renderer = await loadRenderer()
-        if (!renderer) {
+        /**
+         * Refused rather than defaulted, and refused ahead of every other
+         * check, so the message names the invocation rather than whatever the
+         * working directory happens to hold. The element a capture crops to is
+         * a property of the page's own markup, and the class this command used
+         * to assume is declared by two committed sources in one repository.
+         */
+        if (!opts.selector) {
           frameError(
-            'capture is toolkit-only and is absent from an installed canon',
+            '--selector names the element to capture and has no default. See canon capture --help.',
           )
           process.exitCode = 1
           return
         }
+        const selector = opts.selector
 
         const sourcePath = resolve(process.cwd(), source)
         if (!existsSync(sourcePath)) {
@@ -49,8 +71,9 @@ export function register(program: Command): void {
         intro('Capture')
         let results: CaptureResult[]
         try {
+          const renderer = await import('@/capture/render')
           results = await renderer.captureSources(sourcePath, {
-            selector: opts.selector,
+            selector,
             outDir: opts.out ? resolve(process.cwd(), opts.out) : undefined,
           })
         } catch (error) {
@@ -85,16 +108,28 @@ export function register(program: Command): void {
 }
 
 /**
- * Closes an open frame around a failure the render module raised for the whole
- * run rather than for one source, such as a browser binary that is not
- * installed. The engine's own message is readable, so it is passed through
- * intact instead of being summarized.
+ * Closes an open frame around a failure that stopped the whole run rather than
+ * one source. Two of them are setup states rather than defects and each names
+ * the step that clears it: an engine package that never resolved, and a browser
+ * binary that was never downloaded. Every other failure passes through intact,
+ * since the engine's own message is readable and summarizing it loses what it
+ * said.
  */
 function reportInFrame(error: unknown): void {
+  if (isEngineMissing(error)) {
+    logError('the browser engine is not installed in this project')
+    logWarn(`Install it with: ${INSTALL_BROWSER}`)
+    outro()
+    return
+  }
+
   const message = error instanceof Error ? error.message : String(error)
   const [first, ...rest] = message.split('\n')
   logError(first ?? 'capture failed')
   if (rest.length) pipeOutput(rest.join('\n'))
+  if (isBrowserMissing(error)) {
+    logWarn(`Install the browser binary with: ${INSTALL_BROWSER}`)
+  }
   outro()
 }
 
@@ -107,27 +142,3 @@ function displayPath(path: string): string {
   const fromCwd = relative(process.cwd(), path)
   return fromCwd.startsWith('..') ? path : fromCwd
 }
-
-/**
- * Reports absence only when the module or its engine cannot be resolved, which
- * is the published-package case. Any other import failure is a defect inside
- * the render module and propagates, rather than being reported as a feature
- * the package left out.
- */
-async function loadRenderer(): Promise<Renderer | undefined> {
-  try {
-    return await import('@/capture/render')
-  } catch (error) {
-    if (isModuleNotFound(error)) return undefined
-    throw error
-  }
-}
-
-function isModuleNotFound(error: unknown): boolean {
-  return (
-    typeof error === 'object' &&
-    error !== null &&
-    'code' in error &&
-    error.code === 'ERR_MODULE_NOT_FOUND'
-  )
-}

package/src/commands/demo.ts

@@ -61,7 +61,7 @@ export function register(program: Command): void {
         '  1  refused, with the reason on stderr',
         '',
         'Examples:',
-        '  canon demo compile .claude/.tmp/screencast/inline-edit.md',
+        '  canon demo compile .canon/tmp/screencast/inline-edit.md',
         '  canon demo compile draft.md --out demos --force',
         '',
       ].join('\n'),

package/src/commands/design.ts

@@ -17,7 +17,7 @@ export function register(program: Command): void {
     .option(
       '-o, --out <path>',
       'Output directory',
-      creationRel('review', 'design'),
+      creationRel(process.cwd(), 'review', 'design'),
     )
     .action((opts: { source: string; out: string }) => {
       const sourcePath = resolve(process.cwd(), opts.source)

package/src/commands/feedback.ts

@@ -40,10 +40,10 @@ function isToolkitSource(): boolean {
  * single ignore entry and the single backed-folder entry it already had.
  */
 function writeLocal(body: string): string {
-  // Creation, so the destination is the creation default rather than the
-  // resolved read root. A toolkit checkout that has migrated its records already
-  // carries the folder and resolves the same path either way.
-  const relativeDir = creationRel('review', 'feedback')
+  // Resolved against the same root the write joins onto, so a checkout that has
+  // not migrated its records writes this beside the ones already there rather
+  // than opening a second root nothing reads.
+  const relativeDir = creationRel(PROJECT_ROOT, 'review', 'feedback')
   const reviewDir = join(PROJECT_ROOT, relativeDir)
   mkdirSync(reviewDir, { recursive: true })
   const filename = `feedback-${deriveSlug(body)}-${timestamp()}.md`
@@ -57,7 +57,7 @@ export function register(program: Command): void {
   program
     .command('feedback')
     .description(
-      'Write toolkit feedback from stdin to .claude/review/feedback/, or open a GitHub issue with --github',
+      'Write toolkit feedback from stdin to .canon/review/feedback/, or open a GitHub issue with --github',
     )
     .option(
       '--github',

package/src/commands/gov.ts

@@ -66,7 +66,17 @@ import {
   select,
 } from '@/ui'
 
-const PAYLOAD_REL = creationRel(SCRATCH, 'gov', 'rules.md')
+/**
+ * Where the rules payload lands, resolved per target rather than once at import.
+ *
+ * The record root a project uses is a fact about that project, and this command
+ * writes into a target the caller named, so a value computed here against this
+ * process's own tree would point every target at whichever root the toolkit
+ * happens to hold.
+ */
+function payloadRel(root: string): string {
+  return creationRel(root, SCRATCH, 'gov', 'rules.md')
+}
 const RULES_REL = join('.claude', 'rules')
 
 interface InstallOptions {
@@ -170,7 +180,7 @@ export function register(program: Command): void {
 
   gov
     .command('build')
-    .description('Concatenate installed rules into .claude/.tmp/gov/rules.md')
+    .description('Concatenate installed rules into .canon/tmp/gov/rules.md')
     .argument('[target]', 'Target directory', '.')
     .helpOption('-h, --help', 'Show this help message')
     .action(async (target: string) => {
@@ -1222,6 +1232,7 @@ async function runBuild(target: string): Promise<number> {
   intro('canon gov build')
 
   const resolved = resolve(target)
+  const payload = payloadRel(resolved)
   const rulesDir = join(resolved, RULES_REL)
 
   if (!existsSync(rulesDir)) {
@@ -1237,7 +1248,7 @@ async function runBuild(target: string): Promise<number> {
   }
 
   const shouldBuild = await select({
-    message: `Build ${files.length} rules to ${PAYLOAD_REL}?`,
+    message: `Build ${files.length} rules to ${payload}?`,
     options: [
       { value: true, label: 'Yes' },
       { value: false, label: 'No' },
@@ -1252,15 +1263,15 @@ async function runBuild(target: string): Promise<number> {
   }
 
   logStep('Building rules payload')
-  const output = join(resolved, PAYLOAD_REL)
+  const output = join(resolved, payload)
   await mkdir(dirname(output), { recursive: true })
   await writeFile(output, buildRulesPayload(files))
-  logAdd(PAYLOAD_REL)
+  logAdd(payload)
 
   const { GREEN, NC } = palette(process.stderr)
   outro()
   process.stderr.write(
-    `${GREEN}✓ Rules built (${files.length} rules → ${PAYLOAD_REL})${NC}\n`,
+    `${GREEN}✓ Rules built (${files.length} rules → ${payload})${NC}\n`,
   )
   return 0
 }

package/src/commands/intake.ts

@@ -47,7 +47,7 @@ interface AnswerCommandOptions {
 export function register(program: Command): void {
   const intake = program
     .command('intake')
-    .description('Read and answer intake folders in .claude/intake/')
+    .description('Read and answer intake folders in .canon/intake/')
     .helpOption('-h, --help', 'Show this help message')
 
   intake

package/src/commands/migrate.ts

@@ -1,7 +1,14 @@
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
 import type { Command } from 'commander'
 import { listRepositoryFiles } from '@/git-files'
-import { applyRename, readSources } from '@/migrate/apply'
+import { applyRecordsMove, applyRename, readSources } from '@/migrate/apply'
 import { isToolkitOwned, planRename, type RenamePlan } from '@/migrate/plan'
+import {
+  ignoresDestination,
+  planRecordsMove,
+  type RecordsPlan,
+} from '@/migrate/records'
 import { logError, logInfo, logStep, logWarn, pipeOutput, plural } from '@/ui'
 
 interface RenameOptions {
@@ -128,12 +135,176 @@ function toRecord(
   }
 }
 
+interface RecordsOptions {
+  readonly json?: boolean
+  readonly write?: boolean
+  readonly root?: string
+}
+
+/**
+ * Moves a project's session records to `.canon/` and repoints what cites them.
+ *
+ * The ignore gate runs before anything is planned. Every folder being moved is
+ * ignored where it stands, so landing them under a root the project does not
+ * ignore publishes the memory pen into the next commit, and reporting a plan
+ * the caller cannot safely apply is worse than refusing to draw one.
+ */
+async function runRecords(opts: RecordsOptions): Promise<number> {
+  const root = opts.root ?? process.cwd()
+
+  const gitignore = readGitignore(root)
+  if (gitignore === undefined) {
+    logError(
+      `No .gitignore at ${root}, so the records cannot be moved somewhere they stay ignored.`,
+    )
+    return 1
+  }
+
+  if (!ignoresDestination(gitignore)) {
+    logError(
+      'This project does not ignore .canon/, and every record folder being moved is ignored where it stands.',
+    )
+    logError(
+      'Run canon tooling sync --write to take the ignore entry, then run this again.',
+    )
+    return 1
+  }
+
+  const files = await listRepositoryFiles(root)
+  if (files === undefined) {
+    logError(`Could not list files under ${root}. Is it a git repository?`)
+    return 1
+  }
+
+  const plan = planRecordsMove(root, await readSources(root, files))
+
+  // stdout, so the record pipes clean. `pipeOutput` frames to stderr, which is
+  // where this command's report belongs and where a JSON record does not.
+  if (opts.json) {
+    process.stdout.write(
+      `${JSON.stringify(toRecordsRecord(plan, opts.write))}\n`,
+    )
+  }
+
+  reportRecords(plan)
+
+  if (plan.collisions.length > 0) {
+    logError(
+      `${plural(plan.collisions.length, 'destination')} already exist under .canon/. Merging two record folders is not a call this verb takes.`,
+    )
+    for (const path of plan.collisions) logError(`  ${path}`)
+    return 1
+  }
+
+  if (plan.moves.length === 0 && plan.entries.length === 0) return 0
+
+  if (!opts.write) {
+    logWarn('Nothing was written. Pass --write to apply this plan.')
+    return 2
+  }
+
+  const applied = await applyRecordsMove(root, plan)
+  logStep(
+    `Rewrote ${plural(applied.written, 'file')} and moved ${plural(applied.moved, 'folder')}.`,
+  )
+
+  // `failed` carries a citation the write loop could not land as well as a
+  // folder the rename loop stopped on, so the line names a path rather than a
+  // folder. Reading a rejected write back as a folder that would not move sends
+  // the reader looking at the wrong half of the verb.
+  if (applied.failed.length > 0) {
+    logError(`Could not write ${plural(applied.failed.length, 'path')}.`)
+    for (const path of applied.failed) logError(`  ${path}`)
+    return 1
+  }
+
+  return 0
+}
+
+function readGitignore(root: string): string | undefined {
+  try {
+    return readFileSync(join(root, '.gitignore'), 'utf8')
+  } catch {
+    return undefined
+  }
+}
+
+function reportRecords(plan: RecordsPlan): void {
+  logInfo(`${plural(plan.moves.length, 'folder')} to move.`)
+  for (const move of plan.moves) logInfo(`  ${move.from} -> ${move.to}`)
+  logInfo(
+    `${plural(plan.entries.length, 'file')} to change, ${plural(plan.rewritten, 'citation')} to rewrite.`,
+  )
+  logInfo(`${plural(plan.kept, 'citation')} marked to keep the old root.`)
+
+  if (plan.excluded.length > 0) {
+    logInfo(`${plural(plan.excluded.length, 'file')} excluded from the sweep.`)
+  }
+}
+
+function toRecordsRecord(
+  plan: RecordsPlan,
+  wrote: boolean | undefined,
+): unknown {
+  return {
+    ok: plan.collisions.length === 0,
+    wrote: wrote === true,
+    moves: plan.moves,
+    collisions: plan.collisions,
+    files: plan.entries.length,
+    rewritten: plan.rewritten,
+    kept: plan.kept,
+    excluded: plan.excluded.length,
+    paths: plan.entries.map((entry) => ({
+      path: entry.path,
+      rewritten: entry.rewritten,
+    })),
+  }
+}
+
 export function register(program: Command): void {
   const migrate = program
     .command('migrate')
-    .description('Move a project off the retired aitk name')
+    .description('Move a project off a retired name or layout')
     .helpOption('-h, --help', 'Show this help message')
 
+  migrate
+    .command('records')
+    .description('Move the gitignored session records to .canon/')
+    .helpOption('-h, --help', 'Show this help message')
+    .option('--json', 'Add a machine-readable record on stdout')
+    .option('--write', 'Apply the plan rather than reporting it')
+    .option(
+      '--root <path>',
+      'Project root, defaulting to the working directory',
+    )
+    .addHelpText(
+      'after',
+      [
+        '',
+        'Exit codes:',
+        '  0  nothing to move, or --write applied the whole plan',
+        '  1  refused, or a move failed',
+        '  2  a plan exists and --write was not passed',
+        '',
+        'The project has to ignore .canon/ before anything moves. Every folder',
+        'this relocates is ignored where it stands, and landing one under a root',
+        'the project tracks publishes the memory pen into the next commit.',
+        '',
+        'A line carrying canon-keep-record-root, or the line below it, keeps the',
+        'old root. Prose that dates a decision needs it; a live path does not.',
+        '',
+        'Examples:',
+        '  canon migrate records',
+        '  canon migrate records --write',
+        '  canon migrate records --json',
+        '',
+      ].join('\n'),
+    )
+    .action(async (opts: RecordsOptions) => {
+      process.exitCode = await runRecords(opts)
+    })
+
   migrate
     .command('rename')
     .description('Rewrite every unprotected aitk token to canon')

package/src/commands/pr.ts

@@ -130,7 +130,7 @@ export function register(program: Command): void {
         'Examples:',
         '  canon pr key-changes',
         '  canon pr key-changes 1265 --json',
-        '  canon pr key-changes --body .claude/.tmp/body.md --base origin/main',
+        '  canon pr key-changes --body .canon/tmp/body.md --base origin/main',
         '',
       ].join('\n'),
     )

package/src/commands/records.ts

@@ -226,7 +226,7 @@ function backupHelp(verb: 'push' | 'pull'): string {
     '',
     ...direction,
     '',
-    'The history lives in a second git directory at .claude/.records.git, pointed at a',
+    'The history lives in a second git directory at .canon/.records.git, pointed at a',
     'private repository a person creates once. The verbs refuse with the setup command',
     'when it is absent, and refuse when its origin is also a remote of this project.',
     '',

package/src/commands/serve.ts

@@ -36,8 +36,8 @@ export function register(program: Command): void {
         'starts it in the background and reads the record off stdout.',
         '',
         'Examples:',
-        '  canon serve .claude/teach',
-        '  canon serve .claude/teach --entry 03-fde-system-design/index.html',
+        '  canon serve .canon/teach',
+        '  canon serve .canon/teach --entry 03-fde-system-design/index.html',
         '  canon serve dist --port 4000 --json',
         '',
       ].join('\n'),

package/src/commands/slides.ts

@@ -20,7 +20,7 @@ export function register(program: Command): void {
     .option(
       '-o, --out <path>',
       'Output directory',
-      creationRel('review', 'slides'),
+      creationRel(process.cwd(), 'review', 'slides'),
     )
     .option('-v, --variant <variant>', 'Override variant (light or dark)')
     .option(

package/src/commands/tasks.ts

@@ -76,7 +76,7 @@ interface OutcomeCommandOptions {
 export function register(program: Command): void {
   const tasks = program
     .command('tasks')
-    .description('Manage the task board in .claude/tasks/')
+    .description('Manage the task board in .canon/tasks/')
     .helpOption('-h, --help', 'Show this help message')
 
   tasks
@@ -157,8 +157,8 @@ export function register(program: Command): void {
         '',
         'Locations:',
         '  unstated  the task carries no Plan: line',
-        '  live      the target resolves inside .claude/plans/',
-        '  archived  the target resolves inside .claude/plans/archive/',
+        '  live      the target resolves inside .canon/plans/',
+        '  archived  the target resolves inside .canon/plans/archive/',
         '  outside   the target resolves somewhere else',
         '',
         'Exit codes:',
@@ -201,11 +201,11 @@ export function register(program: Command): void {
         'exit code, which a shell function wrapping canon can flatten to zero.',
         '',
         'A relative path resolves against the project root first and against',
-        '.claude/tasks/ second, so the ../plans/ link a board row writes works.',
+        '.canon/tasks/ second, so the ../plans/ link a board row writes works.',
         '',
         'Examples:',
         '  canon tasks plan-answers dispatch-answer-gate',
-        '  canon tasks plan-answers .claude/plans/feature-dispatch-answer-gate.md',
+        '  canon tasks plan-answers .canon/plans/feature-dispatch-answer-gate.md',
         '  canon tasks plan-answers ../plans/feature-dispatch-answer-gate.md',
         '  canon tasks plan-answers dispatch-answer-gate --json',
         '',

package/src/commands/teach.ts

@@ -76,7 +76,7 @@ interface GlossaryCommandOptions {
 export function register(program: Command): void {
   const teach = program
     .command('teach')
-    .description('Manage learning workspaces in .claude/teach/')
+    .description('Manage learning workspaces in .canon/teach/')
     .helpOption('-h, --help', 'Show this help message')
 
   teach

package/src/context/audit.ts

@@ -19,7 +19,7 @@ import { isStubSeed } from '@/seed-marker'
  * Every reason `canon context audit` refuses for.
  *
  * `no-folders` is the one ordinary absence: a project that never adopted
- * `.claude/context/`, `.claude/diagrams/`, or `.claude/wireframes/` names no
+ * `.claude/context/`, `.canon/diagrams/`, or `.claude/wireframes/` names no
  * corpus this audit can measure, the same state `no-skills` reads for the
  * skill corpora. The other four are a malformed invocation or a checkout git
  * cannot read, which stay a break rather than an absence.

package/src/demo/compile.ts

@@ -5,7 +5,7 @@ import type { Beat, Draft } from '@/demo/beats'
  * separate artifacts on purpose: a beat carries no target, no wait condition,
  * and no timing, and putting those four fields on every beat would destroy the
  * property the draft was designed around. See
- * `.claude/groundwork/38-demo-recorder/06-decision.md`.
+ * `.canon/groundwork/38-demo-recorder/06-decision.md`.
  *
  * A compiled plan is committed rather than scratch, because the timing below is
  * a starting point the operator tunes and the draft cannot reproduce a tuned

package/src/demo/drive.ts

@@ -20,15 +20,12 @@ declare global {
  * the demo feature adds lives here, and `src/commands/demo.ts` reaches it
  * through a dynamic import so no other command resolves the engine at startup.
  *
- * Unlike `@/capture/render`, this module ships. The capture command is excluded
- * from the published package because it regenerates images committed to this
- * repository, and that reason does not transfer to a command whose whole
- * purpose is running in someone else's project.
- *
  * It imports `playwright-core` rather than `@playwright/test`, which stays a
- * development dependency for the capture module. Shipping puts the import in
- * every target's dependency tree, and a target needs the driver rather than a
- * test runner and an assertion library. Both are pinned to one version rather
+ * development dependency the published tarball never carries. Shipping puts the
+ * import in every target's dependency tree, and a target needs the driver
+ * rather than a test runner and an assertion library. Every browser module here
+ * takes the same import for that reason, `@/capture/render` included since it
+ * started shipping too. Both are pinned to one version rather
  * than a range, because `bunx playwright install chromium` fetches the browser
  * revision the installed engine expects and a float would leave a target
  * resolving a binary its engine cannot launch.

package/src/driver/drive.ts

@@ -23,19 +23,18 @@ import type {
  * `src/commands/driver.ts` reaches it through a dynamic import so no other
  * command resolves the engine at startup.
  *
- * Like `@/demo/drive` and `@/inventory/walk`, and unlike `@/capture/render`,
- * this module ships. A command whose whole purpose is measuring someone else's
- * page cannot stay toolkit-only, and nothing here reaches into `@/capture/`,
- * which `files` in `package.json` excludes from the published package, so the
- * two surfaces move independently.
+ * Like `@/demo/drive`, `@/inventory/walk`, and `@/capture/render`, this module
+ * ships. A command whose whole purpose is measuring someone else's page cannot
+ * stay toolkit-only, and nothing here reaches into `@/capture/`, so the two
+ * surfaces move independently.
  *
  * What separates it from `canon capture` is the axis it adds. A render answers
  * about a page as it loads, and every defect that exists only after a menu
  * opens, an answer is chosen, or the page scrolls is invisible to one. Probes
  * therefore run after a step rather than on arrival, and a run reaches the load
- * state by opening with a `wait` step of its own. That matters most where
- * capture does not run, since it is toolkit-only and this command is then the
- * only thing measuring the page at all.
+ * state by opening with a `wait` step of its own. That matters most where no
+ * capture runs against the page, since this command is then the only thing
+ * measuring it at all.
  */
 
 /** Each probe keyed by the name a caller writes in the run. */

package/src/gate/measures.ts

@@ -100,7 +100,7 @@ export const SANDBOX_UNDECLARED_CEILING = 47
 export const AUDITS_BASELINE = '.claude/canon/baseline.json'
 
 export const HERO_STAMP_FAILURE =
-  'The hero set disagrees with the stamp written when the image was captured. Run canon capture assets/hero.html and commit all three files together.'
+  'The hero set disagrees with the stamp written when the image was captured. Run canon capture assets/hero.html --selector .window and commit all three files together.'
 
 function parseJson(payload: string): unknown {
   try {

package/src/gate/stages.ts

@@ -189,7 +189,7 @@ export const STAGES: readonly Stage[] = [
         kind: 'drift',
         pathspec: 'assets/hero.html',
         failure:
-          'Hero counts drifted. Run bun run check, then canon capture assets/hero.html, and commit assets/hero.html with assets/hero.png and assets/hero.stamp.',
+          'Hero counts drifted. Run bun run check, then canon capture assets/hero.html --selector .window, and commit assets/hero.html with assets/hero.png and assets/hero.stamp.',
       },
       { kind: 'measure', measure: heroStamp },
     ],

package/src/gov/citations.ts

@@ -357,7 +357,7 @@ function globMatches(root: string, glob: string): boolean {
 /**
  * Which of `paths` git ignores, or nothing when git could not answer.
  *
- * Session scratch is the class this reaches. `.claude/tasks/index.md` is real
+ * Session scratch is the class this reaches. `.canon/tasks/index.md` is real
  * in a live project, absent from a fresh clone and from every linked worktree,
  * and a rule naming it is right either way. Resolving against the filesystem
  * alone would make the verdict depend on which tree the check ran in.