@erclx/canon 4.85.0 → 4.86.0

package/claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "canon",
   "description": "Automated governance, versioning, and discovery tools for Claude Code.",
-  "version": "4.85.0",
+  "version": "4.86.0",
   "author": {
     "name": "Eric Le",
     "url": "https://github.com/erclx"

package/claude/skills/auto-ship/SKILL.md

@@ -212,7 +212,7 @@ Respond with up to five lines:
 <N minor findings kept in .canon/review/branch/review-<slug>.md>
 <N facts routed to context entries>
 <N memories captured in .canon/memory/>
-<Memory proposal at .canon/review/memory/memory-review-<slug>.md>
+<Memory proposal at .canon/memory/review/memory-review-<slug>.md>
 ```
 
 `<state>` is whatever the Step 8 read returned, being `draft` or `ready, unsupervised`, rather than the state the undo asked for. Writing the word `draft` there unconditionally is what this line used to do, and it named a state no step had read.

package/claude/skills/docs-fold/SKILL.md

@@ -228,7 +228,7 @@ Sweep the branch reports this session never opened. List `.canon/review/branch/r
 
 What that removes is a local-only review on a branch deleted before it opened a pull request. `review-branch` says so where a reader meets the report, and the sweep runs anyway rather than keeping every report against the one case, since nothing else ever clears them.
 
-Memory receipts sweep board-wide rather than by slug. Scan every `.canon/review/memory/memory-review-*.md`, not only the one matching this slug. `memory-review` writes its receipt after this skill has run in every ship chain, so a sweep keyed on the current slug looks for a file that does not exist yet, and no later branch looks for it either because a slug is unique per feature. Scanning the folder is what makes the sweep fire at all.
+Memory receipts sweep board-wide rather than by slug. Scan every `.canon/memory/review/memory-review-*.md`, not only the one matching this slug. `memory-review` writes its receipt after this skill has run in every ship chain, so a sweep keyed on the current slug looks for a file that does not exist yet, and no later branch looks for it either because a slug is unique per feature. Scanning the folder is what makes the sweep fire at all.
 
 For each receipt, count the H2 items still marked 📝 pending:
 

package/claude/skills/draft-and-pick/REQUIREMENT.md

@@ -19,11 +19,12 @@ Without this skill, a session facing a decision nobody can settle from a diff:
 - Reads a driver record as a verdict and drops an arm on it. `canon drive` reports findings and never gates, so a run filtering the arms on a probe reading has made a claim the probe catalog has not earned.
 - Reads a color without compositing its alpha, samples a round control at the corner of its bounding box, or confirms a panel's dimensions while it sits above the viewport. Each reads as a passing measurement about something no reader sees.
 - Meets a machine with no browser binary and reports on the arms anyway, since nothing in the default flow separates a render that failed from one that was never attempted.
+- Hand-writes a mockup of a surface a running app already serves, which drifts from what ships by a few pixels and a few words the moment the app's own markup or stylesheet moves on.
 
 ## Must
 
 - Produce three to five arms with the shipping state among them, each carrying an id, a label, and what the arm costs.
-- Author the whole candidate set as one self-contained page and render it once, so the comparison arrives as one image.
+- Author the whole candidate set as one self-contained page and render it once, so the comparison arrives as one image, except where the surface under decision is a running app: there the page links a copy of the built stylesheet rather than inlining it, per `references/live-arms.md`.
 - Vary one property across the arms, so the answer names a difference.
 - Render before reporting on any arm, and report a missing browser binary as a refusal naming the repair rather than describing an arm nobody has seen.
 - Take the pick through the structured question surface, with the recommendation ranked first and marked, and every option carrying its cost.

package/claude/skills/draft-and-pick/SKILL.md

@@ -28,8 +28,9 @@ Write every arm side by side on one self-contained HTML page at `<dest>/candidat
 - One page for the pick, never a set of separate images handed to the operator to compare from memory. The comparison they judge is `candidates.html`, which Step 3 renders and Step 4 asks about. The per-arm files exist only for Step 6's archival capture, once the pick is made, and only the last pass through this step is what Step 6 finds there.
 - Wrap each arm's markup in the same class on both files, chosen once per run and reused everywhere, so one selector addresses an arm on the combined page and on its own standalone file alike.
 - Label each arm on the page with its id and its cost, so the render carries what the question will ask about.
-- Inline every style, script, and asset the page needs. The render reads the file off disk, so a page reaching for a build step or a network font renders without it and the arms differ by something nobody chose.
-- Declare a font stack the machine resolves, such as `system-ui` behind a generic fallback. The render refuses a page that would rewrap against a substitute rather than shipping a false comparison, so a page naming no font at all is refused on whatever the default resolves to.
+- Take the live-app branch instead when the surface under decision is a running app: lift the rendered markup and link a copy of the built stylesheet rather than inlining, per `${CLAUDE_SKILL_DIR}/references/live-arms.md`.
+- On the default path, inline every style, script, and asset the page needs. The render reads the file off disk, so a page reaching for a build step or a network font renders without it and the arms differ by something nobody chose.
+- On the default path, declare a font stack the machine resolves, such as `system-ui` behind a generic fallback. The render refuses a page that would rewrap against a substitute rather than shipping a false comparison, so a page naming no font at all is refused on whatever the default resolves to.
 - Vary one property across the arms. A page whose arms differ in three ways answers no question, since the pick cannot say which difference decided it.
 
 ## Step 3: render and hand off

package/claude/skills/draft-and-pick/references/live-arms.md

@@ -0,0 +1,19 @@
+# Live app arms
+
+Read when the surface under decision is a running app rather than a static mockup: the operator's request names a route or URL of the project's own app, or the decision is about a surface a build command serves. Skip it for a decision with nothing running to lift from, which stays on Step 2's default inlined path.
+
+## Lift from the app
+
+- Dump the rendered markup of the surface under decision from the built page, after it has loaded, into a file under `<dest>`. Strip scripts from the dump.
+- Copy the built stylesheet and font files beside the page, at the path the dumped markup links them from, so a candidate page renders with the stylesheet the app ships. Every arm then differs from the shipped page only by what the arm names.
+- Trim a large dump to the part the decision needs, and keep the wrapper classes intact so layout rules keyed to them still resolve.
+- Size each frame to the content width the decision names rather than the window width, since a container query reads the frame.
+- Write copy an arm introduces with `write-human`, and take every other word from the dump.
+
+## The page
+
+- Generate the page with a short script, one per round, so a shared change is one edit and a rerun.
+- Put a theme button on the page that flips the app's own theme switch on the root, rather than drawing each frame once per theme. Read `?arm=<id>&theme=<name>` to strip every other arm and the button for capture. Skip the button for an app that ships one theme.
+- Print each frame's measurement under it from a script in the page, so the numbers the operator reads are the browser's.
+- Write an index page linking one page per arm when an arm is a whole page or a route rather than a frame, with thumbnails copied beside it.
+- Name anything the preview cannot reproduce, such as an asset whose colors follow the browser rather than the page's theme button, rather than fixing the page around it.

package/claude/skills/git-ship/SKILL.md

@@ -58,7 +58,7 @@ Output up to four lines:
 ✅ Shipped
 <N facts routed to context entries>
 <N memories captured in .canon/memory/>
-<Memory proposal at .canon/review/memory/memory-review-<slug>.md>
+<Memory proposal at .canon/memory/review/memory-review-<slug>.md>
 ```
 
 Omit the second line if nothing routed. Omit the third and fourth if `memory-capture` wrote no memory file this session, since an empty pen means no scoped review and no proposal.

package/claude/skills/memory-capture/SKILL.md

@@ -68,7 +68,7 @@ The handoff is a file rather than a spoken result so the routed fact survives a
 
 ## Step 4: dedupe
 
-For each remaining candidate, grep `.canon/memory/` for an existing file on the same topic. If one exists, update it in place rather than create a new file. Read it first and write the whole file back, since the guard above rules out editing a line inside it.
+For each remaining candidate, grep the top-level `*.md` files in `.canon/memory/` for an existing file on the same topic, never its `review/` or `archive/` subfolders, since a hit there is a receipt or a retired entry rather than a live one to update. If one exists, update it in place rather than create a new file. Read it first and write the whole file back, since the guard above rules out editing a line inside it.
 
 ## Step 5: write the residue
 

package/claude/skills/memory-review/SKILL.md

@@ -5,7 +5,7 @@ description: Reviews `.canon/memory/` and proposes per-entry actions (promote to
 
 # Memory review
 
-This skill drives the full memory review lifecycle in five phases. Pick the phase from what the user said and whether a review receipt already exists at `<main-root>/.canon/review/memory/memory-review-*.md`.
+This skill drives the full memory review lifecycle in five phases. Pick the phase from what the user said and whether a review receipt already exists at `<main-root>/.canon/memory/review/memory-review-*.md`.
 
 What an entry looks like and why a retired one is moved rather than deleted are fixed by `${CLAUDE_SKILL_DIR}/../../standards/memory.md`. Read it before rewriting an entry, since a promotion rewrites the rule and a rewrite has to leave the entry conforming.
 
@@ -23,7 +23,7 @@ If the user re-pings the skill with no new phrase and a receipt exists, default
 
 - All `.canon/memory/` reads, edits, and archive moves resolve at the main worktree root, not the current worktree. Resolve that root the way `session-worktree` does.
 - If no `.canon/memory/` directory exists at the main worktree root, stop: `❌ No .canon/memory/ directory found.`
-- If `.canon/memory/` contains no `*.md` entries other than `index.md`, stop: `✅ No memory entries to review.`
+- If `.canon/memory/` contains no top-level `*.md` entries other than `index.md`, stop: `✅ No memory entries to review.` The pen holds two subfolders now, `review/` and `archive/`, and neither is a memory entry, so this count and every entry read below stay at the top level and never recurse into either.
 - Cleanup is exempt from the two stops above. It works on receipts in `.canon/review/`, and a drained pen is the normal state once Apply has run, so a pen-shaped stop would strand the receipt it exists to delete.
 - Resolve the main root via `git worktree list --porcelain | grep -m 1 '^worktree ' | cut -d' ' -f2-`, falling back to `pwd`. All review and memory reads anchor here.
 - From a linked worktree the file-editing tools refuse every main-root path, so each write below goes out through `Bash` as a plain single command. The receipt and a memory entry are both short and this session has read them whole, so a rewrite replaces the file with a heredoc rather than editing a line inside it. Promotion targets are tracked files at `pwd` and keep taking `Edit`.
@@ -42,7 +42,7 @@ Propose is the ship-time entry point. The ship skills run it right after capture
 Read in parallel from the project root:
 
 - `.canon/memory/index.md`: the generated index
-- every other `*.md` file under `.canon/memory/`: individual entries with frontmatter (`title`, `description`, `category`)
+- every other top-level `*.md` file in `.canon/memory/`, never its `review/` or `archive/` subfolders: individual entries with frontmatter (`title`, `description`, `category`)
 
 ### Step 2: read promotion targets
 
@@ -72,7 +72,7 @@ For each in-scope entry (see Scope), pick one action:
 - **Hand off to governance**: the rule is coding-standards class (typescript, testing, naming, error-handling, performance, logging, concurrency, planning), never a cross-domain behavior rule. Do not author the rule file inline. Never edit the synced `.claude/rules/` copies of toolkit rules, because `canon gov sync` overwrites them. Stop at handoff. This and **Promote to an always-loaded rule** never both claim one entry: class names the topic (coding-standards routes here), firing axis names the rest (applies-every-session routes to the rule promote).
   - In the toolkit repo, point the user at `internal-governance` and `${CLAUDE_SKILL_DIR}/../../standards/rule.md`, which own the source-of-truth rules under `governance/rules/`.
   - In a target project, point the user at the `create-rule` skill, which scaffolds a project-local rule under `.claude/rules/`.
-- **Retire**: the rule is stale, already absorbed into a durable surface, too vague to phrase as a rule, or a one-time incident narrative. Apply moves the file to `.canon/tmp/memory-archive/` rather than deleting it.
+- **Retire**: the rule is stale, already absorbed into a durable surface, too vague to phrase as a rule, or a one-time incident narrative. Apply moves the file to `.canon/memory/archive/` rather than deleting it.
 
 Retire is an archive, not a deletion, which `${CLAUDE_SKILL_DIR}/../../standards/memory.md` states as the rule and this skill executes. The archive is worth less than a plan's, since a promoted entry survives in its destination and a stale one is discarded on purpose, which is why the move is cheap rather than free.
 
@@ -92,11 +92,11 @@ Rules that resist crisp one-line phrasing default to **Retire** over promote. Ne
 
 Derive `<slug>` per `${CLAUDE_SKILL_DIR}/../../standards/slug.md`. Fall back to `latest` on an empty result.
 
-Write the full proposal to `.canon/review/memory/memory-review-<slug>.md` at the main worktree root. Do not print it inline. Read `${CLAUDE_SKILL_DIR}/references/receipt-format.md` for the file structure, the item template, and how each action type varies the body. The four phases below rewrite items inside an existing receipt rather than authoring one, so none of them opens it.
+Write the full proposal to `.canon/memory/review/memory-review-<slug>.md` at the main worktree root. Do not print it inline. Read `${CLAUDE_SKILL_DIR}/references/receipt-format.md` for the file structure, the item template, and how each action type varies the body. The four phases below rewrite items inside an existing receipt rather than authoring one, so none of them opens it.
 
 A phase changing items reads the receipt, applies every change for that phase, and writes the whole file back in one command. Batching is what keeps a per-item rewrite from costing a full read each time, and it is the only route from a linked worktree, where the guard above rules out editing a line in place.
 
-Tell the user `✅ Wrote proposal to .canon/review/memory/memory-review-<slug>.md`. Ask them to fill in `Decision:` per item, then re-ping with "discuss" for question rounds or "apply" to commit.
+Tell the user `✅ Wrote proposal to .canon/memory/review/memory-review-<slug>.md`. Ask them to fill in `Decision:` per item, then re-ping with "discuss" for question rounds or "apply" to commit.
 
 Rewrite the review file in place whenever the proposal changes mid-review. The file stays the source of truth for the current decisions.
 
@@ -104,7 +104,7 @@ Rewrite the review file in place whenever the proposal changes mid-review. The f
 
 Trigger: user says "challenge the promotes", "challenge before apply", or asks for a high-bar pass. Run before Apply. No mutations to memory files or promotion targets. Review file only.
 
-1. Read the latest `.canon/review/memory/memory-review-*.md` at the main root.
+1. Read the latest `.canon/memory/review/memory-review-*.md` at the main root.
 2. For each promote item, apply three tests:
    - **Absorbed**: grep the target surface for the rule's keywords. If already stated or implied, flip to retire.
    - **Delta**: if the rule is a nice-to-have next to existing bullets, flip to retire.
@@ -115,7 +115,7 @@ Trigger: user says "challenge the promotes", "challenge before apply", or asks f
 
 Trigger: user says "discuss", "respond to questions", or any `Decision:` value contains `?` or an unrecognized verb. No mutations to memory files or targets. Review file only. Multi-round.
 
-1. Read the latest `.canon/review/memory/memory-review-*.md` at the main root.
+1. Read the latest `.canon/memory/review/memory-review-*.md` at the main root.
 2. For each item whose `Decision:` contains `?` or any unrecognized verb (anything other than `apply`, `skip`, `defer`):
    - Write a `Take:` line under `Decision:`, separated by exactly one blank line. If a `Take:` line already exists, overwrite it.
    - Format: pick + one-line reason. Max 2 sentences. Decision-help style. State the recommendation (`apply` / `skip` / `retire` / specific alternative) first, then the reason. Do not enumerate tradeoffs unless one changes the call.
@@ -157,7 +157,7 @@ Action by action type:
 - **Hand off**: do not edit governance. Archive the memory file only if the user confirmed the handoff explicitly. Otherwise leave it in place.
 - **Retire**: archive the memory file.
 
-Archiving means creating `.canon/tmp/memory-archive/` at the main worktree root and moving the file there under its original name, overwriting any file already at that name. Send the `mkdir -p` and the `mv` as two plain commands rather than joining them with `&&`, which is refused as compound from a linked worktree. Never delete a memory entry. Nothing recovers one from a gitignored folder.
+Archiving means creating `.canon/memory/archive/` at the main worktree root and moving the file there under its original name, overwriting any file already at that name. Send the `mkdir -p` and the `mv` as two plain commands rather than joining them with `&&`, which is refused as compound from a linked worktree. Never delete a memory entry. Nothing recovers one from a gitignored folder.
 
 Do not hand-edit `.canon/memory/index.md`. Once every archive move is done, regenerate it instead:
 
@@ -189,11 +189,11 @@ End with: `✅ Applied: <nums> | ⏭ Skipped: <nums> | 📝 Pending: <nums>`. Om
 
 Trigger: user says "cleanup" or "delete the receipt" after Apply has run.
 
-Cleanup folds one receipt's skips and removes that receipt, and does nothing else. It is the fallback route now that Apply and `docs-fold` Step 10 each collect a resolved receipt on their own, so it reaches a file those two left behind rather than being the only collector. Apply is still the only phase that moves a memory entry out of the pen, and it does so per approved item into `.canon/tmp/memory-archive/`. A user asking to sweep stale memories wants Propose, which classifies entries and writes a decision slot per entry.
+Cleanup folds one receipt's skips and removes that receipt, and does nothing else. It is the fallback route now that Apply and `docs-fold` Step 10 each collect a resolved receipt on their own, so it reaches a file those two left behind rather than being the only collector. Apply is still the only phase that moves a memory entry out of the pen, and it does so per approved item into `.canon/memory/archive/`. A user asking to sweep stale memories wants Propose, which classifies entries and writes a decision slot per entry.
 
-If no `.canon/review/memory/memory-review-*.md` exists at the main root, stop: `✅ No review receipt to clean up.` Every other refusal in this skill carries a message, and the phase reads a receipt before it does anything else.
+If no `.canon/memory/review/memory-review-*.md` exists at the main root, stop: `✅ No review receipt to clean up.` Every other refusal in this skill carries a message, and the phase reads a receipt before it does anything else.
 
-1. Read the latest `.canon/review/memory/memory-review-*.md` at the main root and confirm Apply has run against it. If any item is still 📝 pending, stop and name the pending numbers.
+1. Read the latest `.canon/memory/review/memory-review-*.md` at the main root and confirm Apply has run against it. If any item is still 📝 pending, stop and name the pending numbers.
 2. Collect it per the collection rule in `${CLAUDE_SKILL_DIR}/../../standards/memory.md`, folding each ⏭ skipped item before the file goes. The fold happens wherever a receipt is collected, so this phase runs the same rule the Apply sweep does.
 3. Delete that one file. Leave every other receipt beside it in place, because the pending test above covers the file it read and nothing has tested the rest.
 4. Leave every memory entry in the pen. A skip records the decline on the entry and keeps the file, and applied promotions, governance handoffs, and user-type memories each stay as the review left them.
@@ -206,7 +206,7 @@ Output one line per action taken in the most recent phase:
 
 - `✅ Promoted: .canon/memory/<memory-file> → <target>`
 - `✅ Handed off: .canon/memory/<memory-file> → governance`
-- `📦 Retired: .canon/memory/<memory-file> → .canon/tmp/memory-archive/`
+- `📦 Retired: .canon/memory/<memory-file> → .canon/memory/archive/`
 - `🗑  Swept: .canon/review/<review-file>, folded <n> skips`
 - `⏭ Kept: .canon/review/<review-file>, <n> items pending`
 

package/claude/skills/memory-review/references/receipt-format.md

@@ -5,7 +5,7 @@ description: The proposal file structure, its item template, and how each action
 
 # Memory review receipt format
 
-The shape Step 4 of the Propose phase writes to `.canon/review/memory/memory-review-<slug>.md`. Only Propose writes this file. Challenge, Discuss, and Apply rewrite items inside a receipt that already exists, and Cleanup deletes one, so none of the four needs this file.
+The shape Step 4 of the Propose phase writes to `.canon/memory/review/memory-review-<slug>.md`. Only Propose writes this file. Challenge, Discuss, and Apply rewrite items inside a receipt that already exists, and Cleanup deletes one, so none of the four needs this file.
 
 ## Structure
 

package/claude/skills/role-worker/SKILL.md

@@ -22,9 +22,10 @@ running and re-invoking it would restart the build.
 
 ## Where the session stands
 
-- Resolve `.canon/plans/`, `.canon/tasks/`, `.canon/review/`, and `.canon/memory/` at the main worktree root, never against the linked worktree this session builds in. Those folders are gitignored, so `git worktree add` never creates them and the copy beside the build is absent rather than empty.
+- Resolve `.canon/plans/`, `.canon/tasks/`, `.canon/review/`, `.canon/memory/`, and `.canon/ready/` at the main worktree root, never against the linked worktree this session builds in. Those folders are gitignored, so `git worktree add` never creates them and the copy beside the build is absent rather than empty.
 - Report a plan that fails to resolve as unreadable from here, naming the main-root path. Reporting the task as having no plan is true where this session stands and wrong about the world, and a reader with no second tree to check cannot separate the two.
 - Build the plan the launch named. Do not write a second one when the path fails to resolve, since a row that cites a plan already has one and drafting another produces two plans for one row.
+- Copy a ready folder's files verbatim to the paths its plan's constraints name, when the plan's `**Constraints:**` block names one, and edit only what the gate or the overview's own list requires. A rewrite discards the text the handoff exists to carry.
 - Report a draft flag reading ready once, and leave it cleared. The ship chain marks the pull request a draft and no step anywhere un-marks, so a flag reading ready afterwards was lifted by the operator or by the controlling session that closed the review, each acting directly on the pull request, which GitHub requires before a merge. Re-drafting fights them, which four sessions did on 2026-08-31 on a belief no surface in the tree states.
 - Refuse an instruction to lift the mark yourself, whoever sends it. This session cannot verify who is asking or whether review actually closed, so the refusal holds regardless of the sender's claimed authority. A controlling session instructed a worker to lift the mark instead of taking the act itself on 2026-09-07, and the worker complied and reported against the surface rather than the outcome.
 - Rewrite a plan question's `- Suggested:` line as `overridden at execution to <pick>,` plus the measurement when this build decides against an unanswered one, leaving the `- Answer:` slot blank, and put the same deviation in one line under the open task's `## Findings`, per `${CLAUDE_SKILL_DIR}/../../standards/plan.md`.

package/claude/skills/ux-walkthrough/SKILL.md

@@ -27,7 +27,7 @@ A walkthrough turns what the operator sees in a running app into findings and pi
 2. **Take the operator's list in their order.** Name each item as a finding with the walkthrough letter and a number, such as T1, and confirm the order once rather than per item.
 3. **Measure before drafting.** Read the component behind the finding and pull the numbers off the built page, per `${CLAUDE_SKILL_DIR}/references/measuring.md`. Write the finding into the walkthrough file with those numbers before any arm exists.
 4. **Route a finding with no visible choice.** A parse defect, a stale figure or a broken invariant gets recorded as a finding with no draft and goes into the batch as a proposed row, not as a pick.
-5. **Draft three or four arms.** Follow `draft-and-pick` Steps 1 and 2 for the arms, with arm 0 the shipped state, one property varied and a cost on each. Build the page from the app's own rendered markup, per `${CLAUDE_SKILL_DIR}/references/candidate-pages.md`.
+5. **Draft three or four arms.** Follow `draft-and-pick` Steps 1 and 2 for the arms, with arm 0 the shipped state, one property varied and a cost on each. Take `draft-and-pick`'s live-app branch of Step 2 to build the page from the app's own rendered markup, per `${CLAUDE_SKILL_DIR}/references/candidate-pages.md`.
 6. **Look before handing anything over.** Capture every arm in every theme the app ships into `.canon/walkthroughs/<nn>-<slug>/evidence/<nn>-<slug>/`, with the finding's number as the prefix, open the captures, and fix what rendered wrong before the operator sees the page.
 7. **Hand the link, then ask.** Emit `http://localhost:<port>/<nn>-<slug>/candidates.html` in a message that ends the turn, confirmed with a `200`, carrying no question. Take any reply after that message as the operator having looked, an explicit "go" included, rather than holding for a stated confirmation, and only then put the choice through the structured question surface with the recommendation first.
 8. **Record the pick.** Write what won, what it beat and by which numbers, where the evidence is, and the build criteria, per `${CLAUDE_SKILL_DIR}/references/record.md`. Read every figure you quote back from the page or the data file first, and correct the record where the question quoted one wrong.
@@ -44,7 +44,7 @@ A walkthrough turns what the operator sees in a running app into findings and pi
 
 ## What this delegates
 
-- `draft-and-pick` owns the arm discipline and the structured question. This walkthrough departs from its Step 2 inlining and its Step 6 apply and delete, for the reasons `${CLAUDE_SKILL_DIR}/references/candidate-pages.md` states.
+- `draft-and-pick` owns the arm discipline and the structured question. This walkthrough takes its live-app branch of Step 2 and departs from its Step 6 apply and delete, for the reasons `${CLAUDE_SKILL_DIR}/references/candidate-pages.md` states.
 - `write-human` carries the voice of every recorded passage and any copy an arm puts in front of a reader.
 - `plan-feature` and whoever dispatches builds turn a batch into plans and code.
 - `canon capture`, `canon serve` and `canon sessions list` own the render, the address and the roster.

package/claude/skills/ux-walkthrough/references/candidate-pages.md

@@ -2,25 +2,10 @@
 
 Read when drafting arms for a finding. Skip it for a finding with no visible choice.
 
-## Build from the app
-
-- Dump the rendered markup of the surface under test from the built page, after it has loaded, into a JSON file in scratch. Strip scripts from the dump.
-- Copy the built stylesheet and font files under `.canon/tmp/`, at the path the dumped markup links them from, so a candidate page renders with the stylesheet the app ships. Every arm then differs from the shipped page only by what the arm names.
-- Trim a large dump to the part the finding needs, and keep the wrapper classes intact so layout rules keyed to them still resolve.
-- Size each frame to the content width the finding names rather than the window width, since a container query reads the frame.
-- Write copy an arm introduces with `write-human`, and take every other word from the dump.
-
-## The page
-
-- Generate the page with a short script, one per round, so a shared change is one edit and a rerun.
-- Put a theme button on the page that flips the app's own theme switch on the root, rather than drawing each frame once per theme. Read `?arm=<id>&theme=<name>` to strip every other arm and the button for capture. Skip the button for an app that ships one theme.
-- Print each frame's measurement under it from a script in the page, so the numbers the operator reads are the browser's.
-- Write an index page linking one page per arm when an arm is a whole page or a route rather than a frame, with thumbnails copied beside it.
-- Name anything the preview cannot reproduce, such as an asset whose colors follow the browser rather than the page's theme button, rather than fixing the page around it.
+Follow `${CLAUDE_SKILL_DIR}/../draft-and-pick/SKILL.md` Step 2's live-app branch for lifting the markup, copying the stylesheet, and building the page, which routes to its own `references/live-arms.md`. What follows is only where this walkthrough departs from that shared path.
 
 ## Where this departs from draft-and-pick
 
 - Capture into the walkthrough's own numbered evidence folder instead of the folder `draft-and-pick` Step 6 archives arms into, per `${CLAUDE_SKILL_DIR}/references/record.md`.
-- Link the app's built stylesheet instead of inlining every asset. Lifted markup needs the real stylesheet, and an inlined copy is the drift this avoids.
 - Keep `candidates.html` and never apply the winning arm. The walkthrough records and a build applies.
 - Leave `.canon/tmp/<nn>-<slug>/` in place until the picks are built, and never delete the round's evidence folder.

package/docs/agents/commands.md

@@ -62,6 +62,7 @@ Full help: `canon <command> --help`. Behavior notes for the install and sync ver
 | `canon migrate record-tree`      | Repoint the old-root citations inside the records themselves, scoped to the live folders and reporting every line without `--write` (`--root`, `--json`)                                                                                                                                                               |
 | `canon migrate rule-layout`      | Move a target's installed rules from the flat `.claude/rules/<subdir>/` layout to `.claude/rules/canon/<subdir>/`, reporting the plan without `--write` (`--root`, `--json`)                                                                                                                                           |
 | `canon migrate scratch-evidence` | Move a folder under `.tmp/` that a durable record cites as evidence to `.canon/review/evidence/`, repointing every citation live or archived, reporting the plan without `--write` (`--root`, `--json`)                                                                                                                |
+| `canon migrate record-layout`    | Fold review receipts from `.canon/review/memory/` and the retired-entry archive from `.canon/tmp/memory-archive/` under the memory pen itself, repointing every citation live or archived, reporting the plan without `--write` (`--root`, `--json`)                                                                   |
 | `canon sessions list`            | Resolve live sessions to the worktree and branch each holds, filtered by `--branch` (`--json`)                                                                                                                                                                                                                         |
 | `canon worktrees list`           | Report which worktrees are reclaimable, keyed on the pull request having merged, with every refusal and the removal route named (`--json`)                                                                                                                                                                             |
 | `canon worktrees reclaim`        | Remove every reclaimable worktree and the branch behind it, reporting without acting under `--dry-run` (`--json`)                                                                                                                                                                                                      |
@@ -187,6 +188,8 @@ Every citation in scope is reported with its file, its line number, and the line
 
 A destination that already holds the same bytes marks the flat file a duplicate, which `--write` deletes rather than moves. One holding different bytes is a real collision: neither file is touched, it is reported by name, and every other planned move still applies independently. Run this before `canon gov install` or `canon gov sync` against a target still on the flat layout, since neither bootstrap verb detects or clears it on its own.
 
+`migrate record-layout` folds two record folders under the memory pen: review receipts move from `.canon/review/memory/` to `.canon/memory/review/`, and retired entries move from `.canon/tmp/memory-archive/` to `.canon/memory/archive/`, backed for the first time since `memory/` is a folder `canon records push` carries and `tmp/` is not. Each move is refused independently when its destination already exists, and the citation repoint sweeps every folder `canon records push` carries, archives included, since an archived receipt still cites the row it retired. The same `canon-keep-record-root` marker and second-run idempotence check apply. A receipt sitting at the flat `review/` root, from before `.canon/review/memory/` existed, matches neither mapped move and is reported by name rather than moved.
+
 ## Version skew
 
 `canon sync --check` and `canon claude skills drift` are the two moments a target

package/docs/workflow/ai-workflow.md

@@ -166,7 +166,7 @@ Capture leads rather than trails because a routed fact edits a tracked file, whi
 
 If capture wrote at least one memory file, `memory-review` then proposes a decision-ready fix scoped to those entries while context is fresh, otherwise it is skipped. It stops at Propose. Review the receipt and run Apply yourself, on its own commit separate from the feature.
 
-Run `memory-review` standalone to curate the whole pen. An entry it retires moves to `.canon/tmp/memory-archive/` rather than being deleted, since the folder is gitignored and a bulk pass has no undo.
+Run `memory-review` standalone to curate the whole pen. An entry it retires moves to `.canon/memory/archive/` rather than being deleted, since a bulk pass has no undo.
 
 The receipt is collected once every item on it has been decided, and it survives untouched while any item is still pending. Whichever runs first takes it: Apply collects the receipt it has resolved, and `docs-fold` scans the folder on every shipped branch for one an earlier session left behind. Before the file goes, each declined item is folded into the entry it was about, since a promotion survives in its target and in git while a decline is recorded nowhere else. `canon standards memory` states what a fold writes and which entry types take one.
 

package/governance/rules/claude/563-ready.md

@@ -0,0 +1,11 @@
+---
+description: Route .canon/ready/ edits to the ready standard for the folder layout, the overview frontmatter, and the thin-plan contract
+paths:
+  - '.canon/ready/**'
+---
+
+# Ready standards
+
+## Authority
+
+- Follow the ready standard for the folder layout, ordinal naming, the overview frontmatter, the mirrored tree, and the thin-plan contract. It is the single source. Read it with `canon standards ready`.

package/governance/rules/core/045-memory.md

@@ -8,5 +8,5 @@ description: Keep memory writes scoped to .canon/memory/ and out of context-owne
 
 - Write all memory files to `.canon/memory/`, not `~/.claude/projects/`
 - A fact about a domain goes to that domain's `canon/context/` entry, not to memory. `canon:memory-capture` routes it there and `canon:docs-fold` folds it in. Memory keeps only what no context entry owns. Report it rather than proceeding silently when either skill does not resolve. Both ship with the plugin and this rule ships with the CLI, so a project that installed governance alone does not have them.
-- Never delete a memory entry. Retire one by moving it to `.canon/tmp/memory-archive/`. A bulk retire runs through the shell, where no file edit fires a path-scoped rule, and the folder is gitignored with nothing to recover from.
+- Never delete a memory entry. Retire one by moving it to `.canon/memory/archive/`, which `canon records push` backs. A bulk retire runs through the shell, where no file edit fires a path-scoped rule.
 - Follow the memory standard for the filename and type prefix, the frontmatter, the body shape each type carries, and the lifecycle. Read it with `canon standards memory`. Check every entry in the pen against that standard and fix what breaks it, since nothing keeps the folder conforming on its own.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@erclx/canon",
   "type": "module",
-  "version": "4.85.0",
+  "version": "4.86.0",
   "description": "Infrastructure and quality tooling for developer workflows",
   "license": "MIT",
   "bin": {

package/src/commands/migrate.ts

@@ -30,6 +30,13 @@ import {
   planSurfaceRootsMove,
   type SurfaceRootsPlan,
 } from '@/migrate/surface-roots'
+import {
+  applyRecordLayout,
+  planRecordLayout,
+  readRecordLayoutCorpus,
+  type RecordLayoutPlan,
+  walkRecordLayoutCorpus,
+} from '@/migrate/record-layout'
 import {
   applyScratchEvidence,
   planScratchEvidence,
@@ -746,6 +753,102 @@ function toScratchEvidenceRecord(
   }
 }
 
+interface RecordLayoutOptions {
+  readonly json?: boolean
+  readonly write?: boolean
+  readonly root?: string
+}
+
+/**
+ * Moves review receipts from `.canon/review/memory/` to `.canon/memory/review/`
+ * and retired entries from `.canon/tmp/memory-archive/` to
+ * `.canon/memory/archive/`, and repoints the citations that name either.
+ */
+async function runRecordLayout(opts: RecordLayoutOptions): Promise<number> {
+  const root = opts.root ?? process.cwd()
+
+  const files = await walkRecordLayoutCorpus(root)
+  const sources = await readRecordLayoutCorpus(files)
+  const plan = planRecordLayout(root, sources)
+
+  if (opts.json) {
+    process.stdout.write(
+      `${JSON.stringify(toRecordLayoutRecord(plan, opts.write))}\n`,
+    )
+  }
+
+  reportRecordLayout(plan)
+
+  if (plan.collisions.length > 0) {
+    logError(
+      `${plural(plan.collisions.length, 'destination')} already occupied. Neither side moved.`,
+    )
+    for (const collision of plan.collisions) logError(`  ${collision}`)
+  }
+
+  if (plan.moves.length === 0 && plan.entries.length === 0) {
+    return plan.collisions.length > 0 ? 1 : 0
+  }
+
+  if (!opts.write) {
+    logWarn('Nothing was written. Pass --write to apply this plan.')
+    return 2
+  }
+
+  const applied = await applyRecordLayout(plan)
+  logStep(
+    `Moved ${plural(applied.moved, 'folder')} and rewrote ${plural(applied.written, 'file')}.`,
+  )
+
+  if (applied.failed.length > 0) {
+    logError(`Could not write ${plural(applied.failed.length, 'file')}.`)
+    for (const path of applied.failed) logError(`  ${path}`)
+    return 1
+  }
+
+  return plan.collisions.length > 0 ? 1 : 0
+}
+
+function reportRecordLayout(plan: RecordLayoutPlan): void {
+  logInfo(`${plural(plan.moves.length, 'folder')} to move.`)
+  for (const move of plan.moves) {
+    logInfo(`  ${move.from} -> ${move.to}`)
+  }
+
+  logInfo(
+    `${plural(plan.entries.length, 'file')} to change, ${plural(plan.rewritten, 'citation')} to rewrite.`,
+  )
+  for (const entry of plan.entries) {
+    logInfo(`  ${entry.path}: ${plural(entry.rewritten, 'citation')}`)
+  }
+
+  if (plan.strays.length > 0) {
+    logWarn(
+      `${plural(plan.strays.length, 'stray receipt')} at the flat review/ root. Not moved, move by hand into memory/review/.`,
+    )
+    for (const stray of plan.strays) logWarn(`  ${stray}`)
+  }
+}
+
+function toRecordLayoutRecord(
+  plan: RecordLayoutPlan,
+  wrote: boolean | undefined,
+): unknown {
+  return {
+    ok: true,
+    wrote: wrote === true,
+    moves: plan.moves.map((move) => ({ from: move.from, to: move.to })),
+    collisions: plan.collisions,
+    files: plan.entries.length,
+    rewritten: plan.rewritten,
+    strays: plan.strays,
+    paths: plan.entries.map((entry) => ({
+      path: entry.path,
+      rewritten: entry.rewritten,
+    })),
+  }
+}
+
 interface RuleLayoutOptions {
   readonly json?: boolean
   readonly write?: boolean
@@ -1031,6 +1134,45 @@ export function register(program: Command): void {
       process.exitCode = await runScratchEvidence(opts)
     })
 
+  migrate
+    .command('record-layout')
+    .description('Fold memory review receipts and archive under memory/')
+    .helpOption('-h, --help', 'Show this help message')
+    .option('--json', 'Add a machine-readable record on stdout')
+    .option('--write', 'Apply the plan rather than reporting it')
+    .option(
+      '--root <path>',
+      'Project root, defaulting to the working directory',
+    )
+    .addHelpText(
+      'after',
+      [
+        '',
+        'Moves review receipts from .canon/review/memory/ to',
+        '.canon/memory/review/, and retired entries from',
+        '.canon/tmp/memory-archive/ to .canon/memory/archive/, backed for',
+        'the first time, and repoints every citation that names either,',
+        'live or archived.',
+        '',
+        'A receipt sitting at the flat review/ root, the shape memory-review',
+        'wrote before review/memory/ existed, is reported rather than moved.',
+        '',
+        'Exit codes:',
+        '  0  nothing to move, or --write applied the whole plan',
+        '  1  a write failed, or an unresolved collision remains',
+        '  2  a plan exists and --write was not passed',
+        '',
+        'Examples:',
+        '  canon migrate record-layout',
+        '  canon migrate record-layout --write',
+        '  canon migrate record-layout --json',
+        '',
+      ].join('\n'),
+    )
+    .action(async (opts: RecordLayoutOptions) => {
+      process.exitCode = await runRecordLayout(opts)
+    })
+
   migrate
     .command('rename')
     .description('Rewrite every unprotected aitk token to canon')

package/src/migrate/record-layout.ts

@@ -0,0 +1,346 @@
+/**
+ * The memory pen's review receipts and retired entries, folded under the pen
+ * itself rather than sitting in three separate record folders.
+ *
+ * `.canon/review/memory/` and `.canon/tmp/memory-archive/` move to
+ * `.canon/memory/review/` and `.canon/memory/archive/`, the second one backed
+ * for the first time: `canon records push` carries every top-level `.canon/`
+ * entry except `EXCLUDED_ENTRIES`, and `tmp/` is one of the three names that
+ * set excludes. `canon/ARCHITECTURE.md`'s "A durable record is named for what
+ * it is, not for how long it lives" already names the cost this closes: two
+ * surfaces both named for memory archived to two different places.
+ *
+ * The move and the citation repoint follow `scratch-evidence.ts`'s shape: a
+ * dry run by default, `--write` to apply, a collision refusal, the
+ * `canon-keep-record-root` marker honored, and archives swept on purpose,
+ * since an archived receipt still cites the row it retired.
+ *
+ * `moves` is a data table rather than one function per pair, so a later
+ * intake batch in the same folder-layout group appends an entry instead of
+ * restructuring the module.
+ */
+
+import { existsSync, readdirSync } from 'node:fs'
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises'
+import { dirname, join } from 'node:path'
+import { presentFolders } from '@/records/backup'
+import { recordDir, SCRATCH, spell, type RecordRoot } from '@/record-root'
+
+const CANON: RecordRoot = '.canon'
+const CLAUDE: RecordRoot = '.claude'
+
+export interface RecordLayoutMove {
+  readonly from: readonly string[]
+  readonly to: readonly string[]
+}
+
+/**
+ * Every folder this migration moves, as a record-relative path on each side.
+ *
+ * Derived from the plan's own mapping: the review folder's memory receipts
+ * fold into the pen at `memory/review/`, and the scratch archive folds in at
+ * `memory/archive/`. A later batch in the same intake group appends here
+ * rather than adding a second table.
+ */
+export const RECORD_LAYOUT_MOVES: readonly RecordLayoutMove[] = [
+  { from: ['review', 'memory'], to: ['memory', 'review'] },
+  { from: [SCRATCH, 'memory-archive'], to: ['memory', 'archive'] },
+]
+
+/** Where a move's source sits today. */
+export function sourcePath(root: string, move: RecordLayoutMove): string {
+  const [folder, ...rest] = move.from
+  return recordDir(root, folder, ...rest)
+}
+
+/** Where it lands after, always under whichever root `memory/` resolves at. */
+export function destinationPath(root: string, move: RecordLayoutMove): string {
+  const [folder, ...rest] = move.to
+  return recordDir(root, folder, ...rest)
+}
+
+function escape(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
+
+/**
+ * The prefixes a citation of a move's source is spelled with: absolute at
+ * either record root, spelled the way each root spells the leading segment,
+ * and relative one and two directories up, in both spellings, since a
+ * relative citation carries no root of its own to read the spelling from.
+ */
+function oldPrefixes(from: readonly string[]): readonly string[] {
+  const [head, ...rest] = from
+  const canonSuffix = [spell(CANON, head), ...rest].join('/')
+  const claudeSuffix = [spell(CLAUDE, head), ...rest].join('/')
+
+  const prefixes = new Set<string>([
+    `.canon/${canonSuffix}/`,
+    `.claude/${claudeSuffix}/`,
+  ])
+  for (const suffix of [canonSuffix, claudeSuffix]) {
+    prefixes.add(`../${suffix}/`)
+    prefixes.add(`../../${suffix}/`)
+  }
+
+  return [...prefixes]
+}
+
+function citationPattern(move: RecordLayoutMove): RegExp {
+  const alternation = oldPrefixes(move.from).map(escape).join('|')
+  return new RegExp(`(?:${alternation})`, 'g')
+}
+
+interface Rewrite {
+  readonly pattern: RegExp
+  readonly destination: string
+}
+
+/** One rewrite per move, paired with its citation pattern. */
+function buildRewrites(moves: readonly RecordLayoutMove[]): readonly Rewrite[] {
+  return moves.map((move) => ({
+    pattern: citationPattern(move),
+    destination: `.canon/${move.to.join('/')}/`,
+  }))
+}
+
+/**
+ * Marks a line naming a moved path on purpose, the same marker
+ * `scratch-evidence.ts` and `records.ts` read: on the line itself or on the
+ * nearest non-blank line above it.
+ */
+const KEEP_MARKER = 'canon-keep-record-root'
+
+function isKept(lines: readonly string[], index: number): boolean {
+  if (lines[index]?.includes(KEEP_MARKER)) return true
+
+  let above = index - 1
+  while (above >= 0 && lines[above]?.trim() === '') above -= 1
+
+  return above >= 0 && (lines[above]?.includes(KEEP_MARKER) ?? false)
+}
+
+function rewriteLine(line: string, rewrites: readonly Rewrite[]): string {
+  return rewrites.reduce(
+    (current, { pattern, destination }) =>
+      current.replace(pattern, destination),
+    line,
+  )
+}
+
+interface RewriteOutcome {
+  readonly text: string
+  readonly count: number
+}
+
+/**
+ * Rewrites every unmarked citation a move covers into its destination,
+ * counting each as it goes. A file naming no such path returns
+ * byte-identical with a count of zero, and a marked line is returned
+ * unchanged and uncounted.
+ */
+function applyRewrites(
+  text: string,
+  rewrites: readonly Rewrite[],
+): RewriteOutcome {
+  const lines = text.split('\n')
+  let count = 0
+
+  const rewritten = lines.map((line, index) => {
+    if (isKept(lines, index)) return line
+
+    for (const { pattern } of rewrites) {
+      count += [...line.matchAll(pattern)].length
+    }
+    return rewriteLine(line, rewrites)
+  })
+
+  return { text: rewritten.join('\n'), count }
+}
+
+/** The files under every present backed folder at `root`, archives included. */
+export async function walkRecordLayoutCorpus(root: string): Promise<string[]> {
+  const files: string[] = []
+
+  for (const folder of presentFolders(root)) {
+    const dir = recordDir(root, folder)
+    if (!existsSync(dir)) continue
+
+    const glob = new Bun.Glob('**/*')
+    for await (const path of glob.scan({
+      cwd: dir,
+      onlyFiles: true,
+      dot: true,
+    })) {
+      files.push(join(dir, path))
+    }
+  }
+
+  return files.sort()
+}
+
+export interface RecordLayoutSource {
+  readonly path: string
+  readonly text: string
+}
+
+/** Reads every file the walk found, skipping one that carries a NUL byte. */
+export async function readRecordLayoutCorpus(
+  paths: readonly string[],
+): Promise<RecordLayoutSource[]> {
+  const sources: RecordLayoutSource[] = []
+
+  for (const path of paths) {
+    const bytes = await readFile(path).catch(() => undefined)
+    if (bytes === undefined || bytes.includes(0)) continue
+
+    sources.push({ path, text: bytes.toString('utf8') })
+  }
+
+  return sources
+}
+
+export interface FolderMove {
+  readonly move: RecordLayoutMove
+  readonly from: string
+  readonly to: string
+}
+
+export interface CitationEntry {
+  readonly path: string
+  readonly text: string
+  readonly rewritten: number
+}
+
+export interface RecordLayoutPlan {
+  readonly moves: readonly FolderMove[]
+  readonly collisions: readonly string[]
+  readonly entries: readonly CitationEntry[]
+  readonly rewritten: number
+  readonly strays: readonly string[]
+}
+
+const STRAY_RECEIPT_PATTERN = /^memory-review-.*\.md$/
+
+/**
+ * A receipt sitting at the flat `review/` root, the shape `memory-review`
+ * wrote before `.canon/review/memory/` existed. Neither mapped move covers
+ * it, since it sits one level above the folder either move reads, so it is
+ * reported rather than moved: widening the table for one stray file trades a
+ * data-shaped mapping for a special case.
+ */
+export function strayReceipts(root: string): string[] {
+  const dir = recordDir(root, 'review')
+  const entries = existsSync(dir)
+    ? readdirSync(dir, { withFileTypes: true })
+    : []
+
+  return entries
+    .filter((entry) => entry.isFile() && STRAY_RECEIPT_PATTERN.test(entry.name))
+    .map((entry) => join(dir, entry.name))
+    .sort()
+}
+
+/**
+ * Every mapped move found on disk, with its destination, refusing a move
+ * whose destination is already occupied rather than merging into it.
+ */
+export function planFolderMoves(root: string): {
+  moves: FolderMove[]
+  collisions: string[]
+} {
+  const moves: FolderMove[] = []
+  const collisions: string[] = []
+
+  for (const move of RECORD_LAYOUT_MOVES) {
+    const from = sourcePath(root, move)
+    if (!existsSync(from)) continue
+
+    const to = destinationPath(root, move)
+    if (existsSync(to)) {
+      collisions.push(to)
+      continue
+    }
+
+    moves.push({ move, from, to })
+  }
+
+  return { moves, collisions }
+}
+
+/**
+ * What the migration would do, without doing it. Pure over the sources it is
+ * handed, so a caller reports and applies from the same value. A file whose
+ * text does not change is dropped.
+ */
+export function planRecordLayout(
+  root: string,
+  sources: readonly RecordLayoutSource[],
+): RecordLayoutPlan {
+  const { moves, collisions } = planFolderMoves(root)
+  const collidedDestinations = new Set(collisions)
+  const covered = RECORD_LAYOUT_MOVES.filter(
+    (move) => !collidedDestinations.has(destinationPath(root, move)),
+  )
+  const rewrites = buildRewrites(covered)
+  const entries: CitationEntry[] = []
+
+  for (const source of sources) {
+    const { text, count } = applyRewrites(source.text, rewrites)
+    if (count === 0) continue
+
+    entries.push({ path: source.path, text, rewritten: count })
+  }
+
+  return {
+    moves,
+    collisions,
+    entries,
+    rewritten: entries.reduce((sum, entry) => sum + entry.rewritten, 0),
+    strays: strayReceipts(root),
+  }
+}
+
+export interface RecordLayoutResult {
+  readonly moved: number
+  readonly written: number
+  readonly failed: readonly string[]
+}
+
+/**
+ * Writes the plan: every citation rewrite first, then every folder move.
+ *
+ * A citation can sit inside a file the plan is about to move, since the walk
+ * carries archives on purpose and a receipt can cite the row it retired.
+ * Rewriting first is what keeps that write landing on a path that still
+ * exists: renaming the folder first would send `writeFile` at the pre-move
+ * path into a directory `rename` already cleared.
+ */
+export async function applyRecordLayout(
+  plan: RecordLayoutPlan,
+): Promise<RecordLayoutResult> {
+  let moved = 0
+  let written = 0
+  const failed: string[] = []
+
+  for (const entry of plan.entries) {
+    const done = await writeFile(entry.path, entry.text)
+      .then(() => true)
+      .catch(() => false)
+
+    if (done) written += 1
+    else failed.push(entry.path)
+  }
+
+  for (const move of plan.moves) {
+    await mkdir(dirname(move.to), { recursive: true })
+    const done = await rename(move.from, move.to)
+      .then(() => true)
+      .catch(() => false)
+
+    if (done) moved += 1
+    else failed.push(move.from)
+  }
+
+  return { moved, written, failed }
+}

package/src/migrate/record-tree.ts

@@ -60,7 +60,7 @@ export const OBJECT_STORE = '.records.git'
  * `archive` is the substantive one: an archived plan or a retired memory entry
  * describes work that closed, and a path inside that sentence is history rather
  * than a pointer. It is pruned at any depth because the archives do not all sit
- * at the same one, `review/memory/archive/` being two levels down.
+ * at the same one, `memory/review/archive/` being two levels down.
  */
 export const PRUNED_SEGMENTS: readonly string[] = [
   'archive',

package/src/record-root.ts

@@ -70,6 +70,7 @@ export const RECORD_ENTRIES: readonly string[] = [
   'memory',
   'plans',
   'proposals',
+  'ready',
   'review',
   'tasks',
   'teach',

package/standards/index.md

@@ -27,6 +27,7 @@ Reference docs for consistent authoring across the toolkit and target projects.
 - [Pull request reference](pr.md): Pull request title and body conventions
 - [Publish reference](publish.md): Scan an author runs against finished text, the cross-reference form each destination takes, and the response to an unreadable source
 - [Readme reference](readme.md): Readme voice, structure, and content conventions
+- [Ready reference](ready.md): Folder layout, ordinal naming, the overview frontmatter, the thin-plan contract, and the archive lifecycle for a finished-file handoff
 - [Requirements reference](requirements.md): Shape and content rules for canon/REQUIREMENTS.md
 - [Governance rule reference](rule.md): Rule frontmatter, body shape, and voice for .claude/rules files
 - [Session map reference](session.md): Filename and location, the sections a handoff carries, the write and read procedures, and how a role extends it

package/standards/memory.md

@@ -88,7 +88,7 @@ Capture the pattern rather than the recovery. What was tried, what failed, and w
 
 ## Links
 
-Link a related entry as `[[name]]`, where `name` is the target's filename stem without the extension. Link freely: the folder is flat and the links are the only structure it has.
+Link a related entry as `[[name]]`, where `name` is the target's filename stem without the extension. Link freely: an entry sits flat at the top level and the links are the only structure among them. `review/` and `archive/` hold receipts and retirements rather than entries, so neither takes a link.
 
 - Place links inside the body part they support, not in a list of their own at the end.
 - A link naming an entry nobody has written yet is legal, and it marks a rule worth writing rather than a defect.

package/standards/plan.md

@@ -85,6 +85,8 @@ A constraint measured against work in flight expires when that work merges, and
 
 A dead constraint fails silently in the expensive direction. A session honoring one ships the dangling citation the change created and reports success, where a session crossing a live constraint collides visibly and is caught.
 
+A constraint naming a `.canon/ready/` folder is a third shape beside the two above. It makes that folder's files the verbatim source for the paths this plan's `**Files to touch:**` lists, per `ready.md`, so the executing session copies those paths rather than authoring them.
+
 ### Risks
 
 - Name the collision rather than the category. A risk a reader cannot act on is padding.

package/standards/ready.md

@@ -0,0 +1,105 @@
+---
+title: Ready reference
+description: Folder layout, ordinal naming, the overview frontmatter, the thin-plan contract, and the archive lifecycle for a finished-file handoff
+---
+
+# Ready reference
+
+Applies to a ready folder at `.canon/ready/<nn>-<slug>/`. A warm session that has already written a skill, a rule, or another finished file uses it to hand the exact text to the worker that ships it, since a plan only describes a change and a cold worker reading a description writes the file again from scratch. The folder holds the finished files themselves, laid out at their destination paths, so the worker's job is to copy rather than to author.
+
+The folder is gitignored, and backed wherever a records remote is configured: `canon records push` and `canon records pull` protect it against the machine being lost there, refuse with `no-remote` where it is not, and protect nothing against a folder deleted before anyone has pushed. That is why the archive step below is a move rather than a cleanup.
+
+## Scope
+
+Governs a ready folder under `.canon/ready/<nn>-<slug>/`: folder layout, ordinal naming, the overview's frontmatter, what the mirrored tree holds, the thin-plan contract that ships it, and the lifecycle from the live folder to the archive.
+
+Does not govern:
+
+- The thin plan itself, its filename, its sections, and its suggested-and-answer contract: `plan.md`
+- The task file that reaches a ready folder through a plan, and the origin line pointing back at it: `tasks.md`
+- Voice, rhythm, and sentence construction: the `write-human` skill
+- Headings, punctuation, word choice, and file references: `markdown.md`
+- Whether a change earns a ready folder over a plan a worker builds from scratch, which belongs to the warm session deciding how to hand off its own work
+
+## What a working ready folder looks like
+
+A ready folder works when a worker that has never seen the warm session's conversation can copy from it alone:
+
+- Which destination path does each file land at, and does the folder hold nothing else?
+- What is the worker still responsible for that the files themselves do not carry, such as a docs sync, a sandbox scenario, or a test?
+- What branch type does the change take?
+- Is every path the folder mirrors also declared in the thin plan's `**Files to touch:**`?
+
+A ready folder failing these is non-conforming even when it satisfies every shape rule below.
+
+## Folder name
+
+- Name the folder `<nn>-<slug>`, a two-digit zero-padded ordinal followed by a kebab-case slug matching the plan's own slug.
+- The ordinal marks a folder per handoff, opened once by the warm session that writes it. It runs on its own sequence, separate from groundwork and intake's shared one, since a ready folder is not a measurement track.
+- With no folder holding an entry yet, the first one opened takes `01`. Read the highest existing `.canon/ready/<nn>-*/` folder, including the archive, and take the next integer.
+- Never renumber an existing folder. The ordinal is the order it opened, and the pull request that shipped it cites the folder by that name.
+
+## 00-overview.md
+
+Every ready folder carries `00-overview.md` at its root, beside the mirrored tree. It orients the worker and states what the files themselves cannot.
+
+- `title` (required): the change in sentence case
+- `description` (required): one line naming what the handoff carries
+- `type` (required): the branch type the plan should take, one of the types `branch.md` fixes
+- `destinations` (required): the list of destination paths the folder mirrors, matching the thin plan's `**Files to touch:**` exactly
+
+```yaml
+---
+title: <Change in sentence case>
+description: <one line naming what the handoff carries>
+type: <feat | fix | chore | ...>
+destinations:
+  - <path/to/file>
+---
+```
+
+Below the frontmatter, state in prose what the worker still owns beyond copying the files: a docs sync, a sandbox scenario update, a test the files do not include, or "nothing further" where the files are the whole of the change.
+
+## The mirrored tree
+
+- Every other file in the folder sits at the same relative path its destination has in the project, so `standards/ready.md` inside the destination tree sits at `<nn>-<slug>/standards/ready.md` inside the ready folder.
+- Carry no file the destination tree would not carry. A ready folder is a source for `git mv`-shaped copies, not a scratch pad for the warm session's own notes. Anything else belongs in the plan or in the pull request body.
+- Write each file exactly as it should land. The worker copies verbatim and edits only what the gate or the overview's own list requires, so a placeholder or a half-finished passage ships as written.
+
+## The thin-plan contract
+
+- A ready folder ships through an ordinary task row and a plan at `.canon/plans/feature-<slug>.md`, per `plan.md`. No new plan shape exists for it.
+- Name the ready folder in the plan's `**Constraints:**`, stating that the folder's files are the verbatim source for the paths the plan's `**Files to touch:**` lists.
+- List every destination path in `**Files to touch:**`, matching `00-overview.md`'s `destinations` field. A path the plan omits is invisible to `plan-reach`'s collision check, so a mismatch between the two lists is a defect in the plan rather than a variant the standard permits.
+- Keep the plan itself thin. Its `**Files to touch:**` entries may point at the ready folder's own copy for the reason behind each file rather than restating it, since the overview and the files already carry the detail a plan would otherwise duplicate.
+
+## Lifecycle
+
+- Write the ready folder in the same session that writes the files it carries. A folder assembled later from memory is a plan with extra steps, not a handoff.
+- Move the folder to `.canon/ready/archive/<nn>-<slug>/` by hand when the task that shipped it archives. No board verb currently automates this move. `canon tasks archive` moves the task and its plan and leaves the ready folder where it is.
+- Never delete a ready folder. The archived copy sits beside the merged pull request as the exact text that shipped, the way an archived plan sits beside the reasoning that produced it.
+
+## Anti-patterns
+
+- **The folder with an undeclared destination.** A file the plan's `**Files to touch:**` does not list passes the collision check unseen, and a second track can write the same path without either side finding out.
+- **The rewritten copy.** A worker that reads the folder's files as inspiration and writes its own version loses the exact text the handoff exists to carry.
+- **The folder as scratch.** Notes, alternates, or draft passages left in the folder beside the real files leave the worker guessing which is the source.
+- **The folder left live after shipping.** A ready folder nobody moves to the archive reads as unshipped work to the next session that lists the live folder.
+
+## Template
+
+```markdown
+.canon/ready/<nn>-<slug>/
+├── 00-overview.md
+└── <path/to/file> # mirrors the destination tree, one entry per file
+```
+
+```yaml
+---
+title: <Change in sentence case>
+description: <one line naming what the handoff carries>
+type: <feat | fix | chore | ...>
+destinations:
+  - <path/to/file>
+---
+```

package/standards/skill.md

@@ -210,7 +210,7 @@ Without this skill, a session <observed failure>, <observed failure>.
 ### Output and tuning
 
 - Skill success lines emit the full relative path from the project root (`<dir>/<file>`) for any file written, updated, or deleted. A bare filename names a file the reader cannot open. The `## Output` section of the project's instruction file sets the form that path takes, so a skill body states which path is emitted and leaves the form to that section.
-- Before a skill writes anything, decide whether the output is a deliverable the project keeps or a toolkit session record. A deliverable lands among the project's own tracked files. A session record lands under `.canon/`, in the named subfolder for its kind (`tasks/`, `plans/`, `review/`, `memory/`, `groundwork/`, `intake/`, `proposals/`, `diagrams/`, `teach/`, or `walkthroughs/`, with `tmp/` for scratch nothing else claims), never in a folder the body invents. `canon/ARCHITECTURE.md`'s per-folder decisions are the precedent for which kind takes which folder.
+- Before a skill writes anything, decide whether the output is a deliverable the project keeps or a toolkit session record. A deliverable lands among the project's own tracked files. A session record lands under `.canon/`, in the named subfolder for its kind (`tasks/`, `plans/`, `review/`, `memory/`, `groundwork/`, `intake/`, `proposals/`, `diagrams/`, `teach/`, `ready/`, or `walkthroughs/`, with `tmp/` for scratch nothing else claims), never in a folder the body invents. `canon/ARCHITECTURE.md`'s per-folder decisions are the precedent for which kind takes which folder.
 - Codify a skill's posted or generated output as a fenced template, and keep the body consistent with every capability the frontmatter description names.
 - When a skill gathers user input or pre-seeds a template, attach a concrete proposed default to every question, derived from project context. Accept "use defaults" as a bulk-confirm.
 - Separate correctness axes (routing, sourcing, escalation, decline) from shape axes (line count, formatting, variant sprawl) when tuning a skill. Tighten only on correctness regressions. Do not convert soft caps to hard caps for aesthetic drift when correctness passes.

package/tooling/claude/seeds/.claude/hooks/memory-index.sh

@@ -33,6 +33,16 @@ case "$file_path" in
 *) exit 0 ;;
 esac
 
+# A shell `case` `*` crosses `/`, so the match above also catches a receipt
+# under memory/review/ or a retired entry under memory/archive/. Neither is
+# a pen entry the index renders, so both exit here before the regen call.
+case "$file_path" in
+*/.claude/memory/review/* | */.canon/memory/review/* | \
+  */.claude/memory/archive/* | */.canon/memory/archive/*)
+  exit 0
+  ;;
+esac
+
 case "$file_path" in
 */.claude/memory/index.md | */.canon/memory/index.md) exit 0 ;;
 esac