@erclx/canon 4.89.0 → 4.92.0

package/claude/skills/session-map/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: session-map
-description: Writes the session map, the pre-compaction handoff at `.canon/tasks/session-<slug>.md`, from any session whatever role it holds, running the skill-drift step the write procedure opens with. Use when asked to "write the handoff", "write the session map", "save the session before it compacts", "we are about to compact", "hand off to the next session", or "leave a note for whoever picks this up". Do NOT use to route session facts to a context entry or the memory folder, which is `memory-capture` and writes a different artifact, and do NOT use to read a handoff back, which is `session-resume`.
+description: Writes the session map, the board-side handoff at `.canon/tasks/session-<slug>.md`, for an orchestrating session or on a request naming the session map or the task board, running the skill-drift step the write procedure opens with. Use when asked to "write the session map", "write the board handoff", or when a session holding `canon:role-orchestrator` hands off before a compaction. Do NOT use for a plain session about to compact, which is `session-compact` and writes a note outside the board. Do NOT use to route session facts to a context entry or the memory folder, which is `memory-capture` and writes a different artifact, and do NOT use to read a handoff back, which is `session-resume`.
 ---
 
 # Session map
@@ -13,7 +13,7 @@ Run every step rather than judging in advance that one has nothing to act on. Th
 
 ## What fires this
 
-Being asked is one route. The other is a `PreCompact` hook registered against the `manual` matcher, which a project may install and which blocks the first `/compact` of a session with a message naming this skill. The block fires once, so the next `/compact` proceeds whether or not a map was written, and an automatic compaction is never blocked. A project that registered no such hook reaches this skill by being asked alone.
+Being asked is the route for a plain session that wants a board-side map, and the orchestrator's handoff runbook is the route for that role. A plain session about to compact belongs to `session-compact`, which is what the `PreCompact` hook on the `manual` matcher names. That hook's message carries one sentence sending a session holding `canon:role-orchestrator` here.
 
 Decline where the session holds no reasoning a reader could not get faster from git. Say so in one line and write nothing. The standard already names a `## State` filled from the tree as non-conforming, and the file that carries three such sections is worse than an absent one, because a reader who finds a map trusts it. Declining is a result the caller can act on, where a padded map is a result that misleads.
 

package/claude/skills/session-resume/SKILL.md

@@ -7,11 +7,11 @@ description: Resumes a previous session by reading the handoff it left behind, t
 
 ## Step 1: read tracked work
 
-Resolve `.canon/plans/`, `.canon/memory/`, and `.canon/tasks/` at the main worktree root the way `session-worktree` does.
+Resolve `.canon/plans/`, `.canon/memory/`, `.canon/compact/`, and `.canon/tasks/` at the main worktree root the way `session-worktree` does.
 
 Read these in parallel, skipping any that do not exist:
 
-- the newest `.canon/tasks/session-*.md`: the handoff a previous session wrote before a compaction, per `${CLAUDE_SKILL_DIR}/../../standards/session.md`. It leads the report rather than the reads.
+- the newest `.canon/compact/*.md`, then the newest `.canon/tasks/session-*.md`: the handoff a previous session wrote before a compaction. The first is the note `session-compact` writes, and the second is the board-side map per `${CLAUDE_SKILL_DIR}/../../standards/session.md`, which stays readable. Whichever exists leads the report rather than the reads, and both lead it when both exist.
 - `.canon/tasks/index.md`: the folder catalog. Read this before any individual task file, and take the task list from it by dropping the `index`, `priority`, `backlog`, and `session-` rows, which are siblings rather than tasks.
 - `.canon/plans/*.md`: execution detail for in-progress tasks
 - `.canon/memory/index.md` and any memory files relevant to the top backlog item
@@ -48,4 +48,4 @@ Memory is updated only when a recorded fact becomes wrong, never on resume. A do
 
 This skill reads a handoff and never writes one. Reading and writing are two jobs, and the write happens at the close of a session rather than at its start.
 
-Name the standard when the session asks how to leave a handoff behind, and let the session follow it directly. Any session may write one, whatever role it holds, so nothing here routes the request to another skill. A role carrying sections of its own adds them over the core per that role's own runbook.
+Route a session asking how to leave a handoff behind to `session-compact`, which writes a note under `.canon/compact/`. A session holding the orchestrator role takes `session-map` instead, which writes the board-side map the standard governs, and a role carrying sections of its own adds them over the core per that role's own runbook.

package/docs/agents/audits.md

@@ -36,7 +36,7 @@ Each is invoked as the CLI the caller is running rather than as a global `canon`
 
 Five findings fail the run: an unresolved context citation, a banned character, word, or spelling, a relative link resolving to nothing on disk, a skill folder carrying no `REQUIREMENT.md`, and a credential-shaped value in the tree the package ships. Each is a fact with no false-positive class behind it.
 
-Four of the five are the ones `canon gate run` already fails a push on. The secret scan is the one entry gating without a stage behind it, added on that same fact-or-judgment test rather than as a side effect of registering a measure, and the architecture record already ranks content leaving the repository above content that stays.
+Four of the five are the ones `canon gate run` already fails a push on. The secret scan is the one entry gating without a stage behind it, added on that same fact-or-judgment test rather than as a side effect of registering a measure, and the toolkit already ranks content leaving the repository above content that stays.
 
 Everything else reports. A heavy bullet, a long entry, a board row nothing resolves, a degradation term in a comment, and an implementation reaching history ahead of its test are judgments a reader settles. A push failing on one of those teaches contributors to route around the stage, which is the split recorded across every audit here and the one this command inherits rather than moves.
 

package/docs/agents/commands.md

@@ -68,7 +68,7 @@ Full help: `canon <command> --help`. Behavior notes for the install and sync ver
 | `canon worktrees list`           | Report which worktrees are reclaimable, keyed on the pull request having merged, with every refusal and the removal route named (`--json`)                                                                                                                                                                                   |
 | `canon worktrees reclaim`        | Remove every reclaimable worktree and the branch behind it, reporting without acting under `--dry-run` (`--json`)                                                                                                                                                                                                            |
 | `canon comments scan`            | Measure comment density by language and comment kind, with a trend recomputed from git                                                                                                                                                                                                                                       |
-| `canon context audit`            | Report required sections, length, cited paths, reference form, catalog tables, provenance, superseded-decision narration, index drift, the architecture record's word weight, and wireframe states against their evidence folders                                                                                            |
+| `canon context audit`            | Report required sections, length, cited paths, reference form, catalog tables, provenance, superseded-decision narration, index drift, the architecture record against its own ceiling and entry cap and its word weight, and wireframe states against their evidence folders                                                |
 | `canon context classify diff`    | Classify the chunks a git range changed, each with its enclosing section, as keep, replace, history, or move (`--base`, `--doc-types`, `--json`)                                                                                                                                                                             |
 | `canon context classify sweep`   | Classify every section of the five canonical doc types, split at H3, as keep, rewrite, or move (`--doc-types`, `--json`)                                                                                                                                                                                                     |
 | `canon context classifier show`  | Report the resolved classifier backend and model and which source decided them (`--json`)                                                                                                                                                                                                                                    |

package/docs/agents/context-audit-checks.md

@@ -1,6 +1,6 @@
 ---
 title: Context audit checks
-description: What each non-gating check reports, the unit each checkpoint is measured in, the architecture record's length gate and claim coverage, which folders each check reaches, and what moved to the attribute tier
+description: What each non-gating check reports, the unit each checkpoint is measured in, the architecture record's length and entry cap gates and claim coverage, which folders each check reaches, and what moved to the attribute tier
 ---
 
 # Context audit checks
@@ -91,7 +91,9 @@ The JSON record carries the findings per entry as `entries[].narration` and the
 
 ## The architecture record
 
-Three findings read `canon/ARCHITECTURE.md` rather than a folder, and only the first is a fact.
+Four findings read `canon/ARCHITECTURE.md` rather than a folder, and only the first two are facts.
+
+The entry cap check counts the record's decisions against the cap it states for itself, in a clause of the form `This record holds at most 12 decisions.` Like the length check, the cap belongs to the record rather than to the toolkit, so a record stating none is measured and never gated. A decision is a `###` heading outside a fenced block, so the template a standard shows does not count, and a heading carrying two decisions counts once. The JSON record carries what it read as `architecture.entryCap`, absent where the record states no cap, and the audit catalog counts a record past it as `recordOverCount`.
 
 The length check compares the record against the ceiling it derives for itself, and only a record that states its own allowances has one. No standard sets a length rule for this document, so the numbers belong to whichever record declares them. The check reads a frame allowance and an allowance per decision out of the record's own prose and puts the ceiling at the frame plus the allowance times the decision count. The JSON record carries what it read as `architecture.allowances` and the reading as `architecture.lines` against `architecture.ceiling`.
 

package/docs/agents/context-audit.md

@@ -37,7 +37,9 @@ A run where no requested name resolves refuses, whichever list it read. Naming t
 
 ## Exit codes
 
-Exit codes are `0` for a clean run, `1` for a refusal, and `2` for a gating finding. An unresolved citation gates under every mode. An architecture record that states its own line allowances gates when it is past the ceiling those derive, on any run that measures it, which is every mode except `--citations-only`, and a record stating none is reported and never gated.
+Exit codes are `0` for a clean run, `1` for a refusal, and `2` for a gating finding. An unresolved citation gates under every mode. An architecture record that states its own line allowances gates when it is past the ceiling those derive, on any run that measures it, which is every mode except `--citations-only`. A record that states an entry cap gates the same way when it holds more decisions than the cap, and a record stating neither limit is reported and never gated.
+
+`bun run check` in the toolkit repository reads both limits through its own Architecture record stage rather than through this verb, since the verb's only gating stage there runs `--citations-only` and never opens the record.
 
 Entry length, reference form, table, provenance, narration, the record's claim classification, and every word figure print and return `0` under every mode, because each is a judgment or a weight read alongside one, and failing a push on either would make the check something to route around. Narration is the weakest of the printed measures, since whether two bullets share a subject is a call the measure approximates from structure alone, and one of the shapes it matches is the rejected alternative the standard asks an entry to keep.
 

package/docs/agents/index.md

@@ -13,7 +13,7 @@ CLI catalog and invocation rules for agents, split by command domain. Start with
 - [Census](census.md): Tracked-plus-untracked file count, a breakdown by extension, and a line total that skips whatever reads as binary
 - [Command catalog](commands.md): Every project-level command and every domain subcommand, plus the shape each domain exposes
 - [Comments](comments.md): Comment density by language and kind, the two structural exclusions, and how the degradation sweep finds its vocabulary
-- [Context audit checks](context-audit-checks.md): What each non-gating check reports, the unit each checkpoint is measured in, the architecture record's length gate and claim coverage, which folders each check reaches, and what moved to the attribute tier
+- [Context audit checks](context-audit-checks.md): What each non-gating check reports, the unit each checkpoint is measured in, the architecture record's length and entry cap gates and claim coverage, which folders each check reaches, and what moved to the attribute tier
 - [Context audit](context-audit.md): Running the audit, its flags and folder scope, the exit codes, the citation gate, and the widened gate the seed stage runs
 - [Doc classifier](context-classify.md): Classifying canonical-doc content as keep, replace/rewrite, history, or move in diff and sweep mode, the classifier setting pair, the record shape, and the exit codes
 - [Self-stated counts](counts.md): Reading a sentence that asserts a closed catalog's size, how a match is decided, the plausibility filter that keeps a generic word from matching a subset, and why the sweep reports rather than gates

package/docs/agents/review-classification.md

@@ -48,7 +48,7 @@ Most carry two spellings, the one a surface authors at and the one it reaches a
 
 `CLAUDE.md` is matched as a whole path rather than as a prefix, because a prefix reaches nothing that sits in no folder. A nested `docs/CLAUDE.md` stays informational.
 
-The set is data at `src/autoship/paths.ts`. That makes it permanently exempt from any later design that folds a machine-parsed list back into the surface citing it, per the machine-parsed clause in `canon/ARCHITECTURE.md`.
+The set is data at `src/autoship/paths.ts`. That makes it permanently exempt from any later design that folds a machine-parsed list back into the surface citing it, per the toolkit's machine-parsed clause: a rule restating the list a parser reads is two sources for one list.
 
 ## Exit codes and refusals
 

package/docs/agents/routing.md

@@ -5,7 +5,7 @@ description: Reading per CLAUDE.md section how many bullets name a path, what co
 
 # Routing report
 
-`canon claude routing` reports, per `CLAUDE.md` section, how many top-level bullets name a path and how many of those a path-scoped rule already covers. It answers the firing axis of the tier test in `.claude/rules/canon/claude/592-claude-md.md`, whether a fact applies every session or fires on one path, and which until this verb existed was a judgment nothing counted. `canon/ARCHITECTURE.md` names two further axes, conditional presence and updatability, that this verb does not check.
+`canon claude routing` reports, per `CLAUDE.md` section, how many top-level bullets name a path and how many of those a path-scoped rule already covers. It answers the firing axis of the tier test in `.claude/rules/canon/claude/592-claude-md.md`, whether a fact applies every session or fires on one path, and which until this verb existed was a judgment nothing counted. The tier test names two further axes, conditional presence and updatability, that this verb does not check.
 
 ```bash
 canon claude routing

package/docs/agents/state-scoped-risk.md

@@ -32,7 +32,7 @@ Three root files are read whether or not the field names them, being `package.js
 
 The corpus answers what the package publishes, which is narrower than what the repository holds. Measured against this repository on 2026-08-21, the scan read 544 files and left 593 of the 1139 git lists unread. Those include everything under `.claude/`, `wiki/`, and `internal/`, the workflow definitions under `.github/`, and the trees the publish negations remove, being `scripts/sandbox/`, `scripts/eval/`, and every test file. `src/capture/` was a fourth negation when that reading was taken and is not one now. The folder holds 5 tracked files, 2 of them tests the publish still excludes, so the corpus is 3 wider than the numbers above describe and the unread count is 3 smaller.
 
-A public repository makes that gap readable by anyone, so a clean run means no credential in the published tree rather than none in the repository. The run states the number on every pass, including a clean one, so the bound travels with the verdict. Widening the corpus to every tracked file is a separate decision, since the row this implements puts the shipped tree first on the record's rule that content leaving the repository gates harder than content that stays.
+A public repository makes that gap readable by anyone, so a clean run means no credential in the published tree rather than none in the repository. The run states the number on every pass, including a clean one, so the bound travels with the verdict. Widening the corpus to every tracked file is a separate decision, since the row this implements puts the shipped tree first on the toolkit's rule that content leaving the repository gates harder than content that stays.
 
 ### What it keys on
 

package/docs/agents/teach.md

@@ -7,6 +7,8 @@ description: Listing learning workspaces with what their records schedule next,
 
 Learning workspaces sit under `.canon/teach/<nn>-<topic>/`, and `standards/teach.md` fixes their layout, naming, and file formats, apart from the glossary, whose shape `standards/glossary.md` fixes, cited from the `teach-workspace` skill, so it travels with the file wherever a promotion lands it. Every verb here resolves that folder against the main worktree root rather than against the working directory, so a session standing in a linked worktree reaches the one workspace the learner has rather than opening a second.
 
+Passing `--root` a path already named `teach` reaches that folder directly rather than wrapping it in the `.canon/`-or-`.claude/` record-root lookup, which is what lets a workspace committed outside the record root, such as a worked example kept in version control on purpose, take every verb below the same as one under `.canon/teach/`.
+
 That root resolution is also why the writing verbs exist at all. The file-editing tools refuse a main-root path from a linked worktree and offer a worktree copy instead, and a caller naming only the destination reports a success that did not happen. A whole-file create still goes out as a shell heredoc. Changing a line inside a file that already exists has no shell route, because the stream editors are banned, so `resource` and `glossary` are the route for the two files a running workspace edits.
 
 ## List
@@ -25,7 +27,7 @@ canon teach list regular-expressions --json
 
 With no topic it reports one line per workspace, carrying the lesson, learning-record, reference-page, and glossary-term counts, plus `next`, the ordinal an open would take. With one it reports the filenames behind each count and the glossary entries themselves.
 
-A folder not named `NN-<topic>` is still listed rather than dropped, since dropping it hides the one folder that needs a fix. Its ordinal reads as absent, it sorts last, and it moves no ordinal, so a malformed name cannot push a new workspace into a number a reader already cites.
+A folder not named `NN-<topic>` is not a workspace, so the listing, `nav`, and every selector skip it and it moves no ordinal. That is what lets a teach root carry a sibling folder such as `evidence/` without it drawing as a stub row and receiving a contents page.
 
 The listing also names the required files a workspace does not carry, which is `MISSION.md`, `RESOURCES.md`, and `GLOSSARY.md`. That is a report rather than a refusal, because a workspace missing one is still a workspace a session can resume.
 
@@ -139,7 +141,7 @@ The order is drawn here rather than instructed, and that is the point of the ver
 
 ## Render
 
-`canon teach render` renders a lesson body's structural blocks to HTML, through the same components the fixture lesson under `examples/teach/00-fixture/` is generated from. It takes no topic and no `--root`, since the verb is a stateless transform reading nothing off a workspace on disk.
+`canon teach render` renders a lesson body's structural blocks to HTML, through the components `src/teach/render-fixture.tsx` composes by hand. It takes no topic and no `--root`, since the verb is a stateless transform reading nothing off a workspace on disk.
 
 ```bash
 echo '[{"type":"heading","level":1,"text":"Compass bearings"}]' | canon teach render --json

package/docs/workflow/ai-workflow.md

@@ -280,7 +280,8 @@ This section is the corpus the coverage claim is measured against: every name `c
 | `canon:role-worker`       | To assert the worker role for a cold session building one branch under one plan |
 | `canon:session-relay`     | When a worker or planner owes its controller a message and holds no send tool   |
 | `canon:session-resume`    | At the start of a session, to pick up what a previous one left                  |
-| `canon:session-map`       | At the close of a session, to write the handoff a compaction would destroy      |
+| `canon:session-compact`   | Before a compaction, to write a plain session's handoff note outside the board  |
+| `canon:session-map`       | At the close of an orchestrating session, to write its board-side handoff       |
 
 ### Keep the project current with the toolkit
 
@@ -304,6 +305,7 @@ This section is the corpus the coverage claim is measured against: every name `c
 | `canon:create-snippet`    | For a reusable prompt                                                                                                               |
 | `canon:create-standard`   | For a new authoring convention                                                                                                      |
 | `canon:draft-docs`        | For a brand-new `docs/*.md` page, drafted against `standards/docs.md`                                                               |
+| `canon:draft-ready`       | For finished files a worker should copy, written as a ready folder with its overview, thin plan, and task                           |
 | `canon:draft-context`     | For a brand-new `canon/context/<domain>.md` entry, drafted against `standards/context.md`                                           |
 | `canon:draft-wireframes`  | For a brand-new `canon/wireframes/<surface>.md` file, drafted against `standards/wireframes.md`                                     |
 | `canon:draft-figure`      | For a hand-drawn figure inside an existing doc, drafted against `standards/figures.md` and rendered through Mermaid or freehand SVG |

package/governance/rules/claude/540-architecture.md

@@ -10,3 +10,4 @@ paths:
 ## Authority
 
 - Follow the architecture standard for the overview, named decision entries, and risks. It is the single source. Read it with `canon standards architecture`.
+- Add a decision here only when it fills one of the standard's slots, and write any other decision into the context entry for the domain it constrains. At the record's stated cap, merge or retire an entry before adding one.

package/governance/rules/claude/563-ready.md

@@ -6,6 +6,10 @@ paths:
 
 # Ready standards
 
+## Writing a ready folder
+
+- Load the `canon:draft-ready` skill to write a ready folder, its overview, the thin plan, and the task row. It owns the procedure. Report it rather than proceeding silently when it does not resolve, since it ships with the plugin and this rule ships with the CLI.
+
 ## Authority
 
 - Follow the ready standard for the folder layout, ordinal naming, the overview frontmatter, the mirrored tree, and the thin-plan contract. It is the single source. Read it with `canon standards ready`.

package/governance/rules/ui/410-a11y.md

@@ -24,6 +24,12 @@ paths:
 - Arrow keys: navigate within composite widgets. Do not let them exit the widget.
 - Escape: closes any overlay, popover, dialog, or dropdown. Cancels in-progress edits.
 - Do not introduce non-standard key bindings for common actions.
+- Give every author-defined drag a single-pointer alternative and a keyboard path, such as move buttons or arrow-key reordering (WCAG 2.2 Dragging Movements, 2.5.7).
+
+## Pointer targets
+
+- Size a web pointer target at least 24 by 24 CSS pixels, or space it so a 24 pixel circle centered on it touches no other target (WCAG 2.2 Target Size Minimum, 2.5.8).
+- Size a native touch target at the platform figure, 44 points on iOS and 48 dp on Android. Do not apply the web figure to native, and do not apply the native figure as the web minimum.
 
 ## Composite widgets
 
@@ -34,6 +40,7 @@ paths:
 
 - Move focus into any overlay, popover, or dialog on open. Return focus to the trigger on close.
 - Never move focus on hover. Only on keyboard input or explicit pointer activation.
+- Do not let a sticky header, footer, or overlay fully cover the focused control. Scroll it into view clear of them (WCAG 2.2 Focus Not Obscured, 2.4.11).
 
 ## ARIA semantics
 
@@ -46,3 +53,5 @@ paths:
 - Always provide `alt` on `<img>`. Use `alt=""` for decorative images.
 - Describe the content or function of the image, not its appearance. Do not prefix with "Image of" or "Photo of".
 - Alt text for functional images (icons, buttons) should describe the action, not the graphic.
+- Give the visual boundary of a control and every graphic that carries meaning at least 3:1 contrast against adjacent colors (WCAG Non-text Contrast, 1.4.11).
+- Never make color the only carrier of a state, error, or distinction. Pair it with text, an icon, or a pattern (WCAG Use of Color, 1.4.1).

package/governance/rules/ui/420-forms.md

@@ -26,6 +26,15 @@ paths:
 - Show the error directly under the field that caused it, not under an unrelated field.
 - When a change to field A causes a conflict involving field B, show the error under field A (the field the user edited), not under field B.
 
+## Submission errors
+
+- When a failed submission carries several errors, move focus to a summary that links to each failing field. Keep the inline error beside each field.
+
+## Authentication and re-entry
+
+- Let a password manager fill sign-in fields and accept a pasted value. Do not block paste or autofill on a password or code field (WCAG 2.2 Accessible Authentication, 3.3.8).
+- Do not ask for information the user already gave earlier in the same flow. Prefill it or offer it for selection (WCAG 2.2 Redundant Entry, 3.3.7).
+
 ## Input sanitization
 
 - Trim leading and trailing whitespace from text inputs on blur or submit, not on every keystroke.

package/governance/rules/ui/460-design-taste.md

@@ -0,0 +1,29 @@
+---
+description: Route edits that decide how a surface looks to the design-taste skill for the layer ordering, the coherence locks, and the defaults a model reaches for
+paths:
+  - '**/*.css'
+  - '**/*.scss'
+  - 'canon/DESIGN.md'
+---
+
+# Design taste standards
+
+## Authority
+
+- Load the `canon:design-taste` skill for which design decision settles first, what must stay constant across a surface, and the defaults to reach past. It is the single source for all three.
+- Load it before drafting, not after revising. A revision recovers a color and never recovers the composition a draft already settled.
+- Report it rather than proceeding silently when the skill does not resolve. It ships with the plugin and this rule ships with the CLI, so a project that installed governance alone does not have it.
+- Do not work the layer ordering or the coherence locks from memory.
+
+## When this fires and when it does not
+
+- This rule scopes to the files where an undecided visual choice lands, which is the stylesheet and the design document. Building a surface somebody already decided is implementation rather than design, and the rules below carry what implementation owes.
+- Load the skill by name when a component edit makes a visual choice nobody has taken yet, such as a new section's shape, a spacing relationship, or a radius. The glob cannot see that intent and no glob can.
+- Do not load it to ship a decided design. A worker wiring a picked composition pays the read and gets nothing back.
+
+## Boundaries
+
+- Accessibility, keyboard interaction and ARIA are a separate topic. `410-a11y` routes them, on every rendered path.
+- States, empty and loading coverage, and destructive confirmation are a separate topic. `430-ux-completeness` routes them.
+- Rendered copy casing, button labels and error wording are a separate topic. `400-ui` routes them.
+- The floor those three carry is not restated in the skill, and it is not traded against a preference where the two collide.

package/governance/rules/ui/470-motion.md

@@ -0,0 +1,23 @@
+---
+description: Moving content controls and the reduced-motion preference for rendered UI
+paths:
+  - '**/*.tsx'
+  - '**/*.jsx'
+  - '**/*.astro'
+  - '**/*.html'
+  - '**/*.css'
+---
+
+# Motion standards
+
+## Moving content
+
+- Give any content that moves, blinks, or scrolls automatically for more than five seconds a control to pause, stop, or hide it (WCAG Pause, Stop, Hide, 2.2.2).
+- Halt an auto-advancing carousel or ticker while it holds keyboard focus or pointer hover.
+- Do not flash content more than three times in any one second.
+
+## Reduced motion
+
+- Honor `prefers-reduced-motion: reduce` for every animation and transition that conveys no state. Remove it or replace it with an instant change.
+- Keep essential state changes visible under reduced motion, using a fade or a static indicator instead of movement.
+- Do not start video or animated backgrounds on their own when the preference is set.

package/governance/stacks/astro.toml

@@ -1,2 +1,2 @@
 extends = "node"
-rules = ["210-astro", "350-security-web", "400-ui", "410-a11y", "430-ux-completeness", "440-surface-capture", "450-link-behavior"]
+rules = ["210-astro", "350-security-web", "400-ui", "410-a11y", "420-forms", "430-ux-completeness", "440-surface-capture", "450-link-behavior", "460-design-taste", "470-motion"]

package/governance/stacks/react.toml

@@ -1,2 +1,2 @@
 extends = "node"
-rules = ["200-react", "230-nextjs", "250-tailwind", "300-testing-ts", "305-e2e-reliability", "306-test-scope", "310-zod", "350-security-web", "400-ui", "410-a11y", "420-forms", "430-ux-completeness", "440-surface-capture", "450-link-behavior"]
+rules = ["200-react", "230-nextjs", "250-tailwind", "300-testing-ts", "305-e2e-reliability", "306-test-scope", "310-zod", "350-security-web", "400-ui", "410-a11y", "420-forms", "430-ux-completeness", "440-surface-capture", "450-link-behavior", "460-design-taste", "470-motion"]

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@erclx/canon",
   "type": "module",
-  "version": "4.89.0",
+  "version": "4.92.0",
   "description": "Infrastructure and quality tooling for developer workflows",
   "license": "MIT",
   "bin": {

package/src/audits/catalog.ts

@@ -168,6 +168,8 @@ function architectureCounts(
   // zero there would read as one measured and found conforming.
   const ceiling =
     typeof record.ceiling === 'number' ? record.ceiling : undefined
+  const entryCap =
+    typeof record.entryCap === 'number' ? record.entryCap : undefined
 
   let unverifiable = 0
   let unchecked = 0
@@ -188,6 +190,10 @@ function architectureCounts(
     ...(ceiling !== undefined && {
       recordOverLength: record.lines > ceiling ? 1 : 0,
     }),
+    // Absent on a record stating no entry cap, for the same reason.
+    ...(entryCap !== undefined && {
+      recordOverCount: decisions.length > entryCap ? 1 : 0,
+    }),
     recordUnverifiable: unverifiable,
     recordUnchecked: unchecked,
   }

package/src/autoship/paths.ts

@@ -7,7 +7,7 @@
  * application three times, so the set moved here and the body now calls a verb
  * that reads it. Being machine-parsed makes it permanently exempt from any
  * later design that folds a standard back into the surface citing it, per the
- * machine-parsed clause in `canon/ARCHITECTURE.md`.
+ * machine-parsed clause in `canon/context/standards/resolution.md`.
  */
 
 /**

package/src/claude/cases/authoring.ts

@@ -42,6 +42,11 @@ export const AUTHORING_CASES: readonly SkillCase[] = [
       'Write a brand-new docs page for the capture command, nothing under docs/ covers it yet.',
     expect: 'draft-docs',
   },
+  {
+    prompt:
+      'I already wrote the finished skill files, package them as a ready folder with a plan and a task for a worker to copy.',
+    expect: 'draft-ready',
+  },
   {
     prompt: 'This project has no README.md at all, write one from scratch.',
     expect: 'draft-readme',

package/src/claude/cases/misc.ts

@@ -12,6 +12,11 @@ export const MISC_CASES: readonly SkillCase[] = [
       'Show me a few different treatments for this callout so I can pick one by looking.',
     expect: 'draft-and-pick',
   },
+  {
+    prompt:
+      'Which layer of this landing page should I settle first, and what has to stay constant across it?',
+    expect: 'design-taste',
+  },
   {
     prompt:
       'This project has no logo yet. Draft one and give me a social card to go with it.',
@@ -29,6 +34,11 @@ export const MISC_CASES: readonly SkillCase[] = [
   {
     prompt:
       "We're about to hit the context limit, write the handoff before we lose state.",
+    expect: 'session-compact',
+  },
+  {
+    prompt:
+      'I am the orchestrating session and about to compact, so write the board handoff as a session map on the task board.',
     expect: 'session-map',
   },
   {

package/src/commands/capture.ts

@@ -42,6 +42,7 @@ type CaptureResult = Awaited<ReturnType<Renderer['captureSources']>>[number]
 export function register(program: Command): void {
   program
     .command('capture')
+    .helpOption('-h, --help', 'Show this help message')
     .description('Render HTML capture sources to PNG')
     .argument(
       '[source]',

package/src/commands/context.ts

@@ -20,6 +20,7 @@ import {
   architectureRel,
   type ArchitectureReport,
   coveredCount,
+  isOverCount,
   isOverLength,
   measureArchitecture,
   testableCount,
@@ -98,7 +99,7 @@ export function register(program: Command): void {
   context
     .command('audit')
     .description(
-      'Report required sections, entry length, citations, reference form, catalog tables, provenance, superseded-decision narration, index drift, the architecture record against its own ceiling and its word weight, and wireframe states against their evidence folders',
+      'Report required sections, entry length, citations, reference form, catalog tables, provenance, superseded-decision narration, index drift, the architecture record against its own ceiling, its own entry cap, and its word weight, and wireframe states against their evidence folders',
     )
     .argument('[path]', 'Project root, defaulting to the current directory')
     .helpOption('-h, --help', 'Show this help message')
@@ -124,9 +125,11 @@ export function register(program: Command): void {
         'An unresolved citation always gates. An architecture record that',
         'states its own line allowances gates when it is past the ceiling',
         'those derive, on any run except --citations-only, which never',
-        'measures it. A record stating no allowance is reported and never',
-        'gated. --gate widens the gate to the other two findings that are',
-        'facts rather than judgments: a missing required section and index',
+        'measures it. A record stating an entry cap gates the same way when',
+        'it holds more decisions than the cap. A record stating neither is',
+        'reported and never gated. --gate widens the gate to the other two',
+        'findings that are facts rather than judgments: a missing required',
+        'section and index',
         'drift. Entry length, reference form, table, provenance, narration,',
         'and the record claim classification are judgments under both.',
         '',
@@ -759,6 +762,7 @@ async function runAudit(
   const gating = isGating({
     unresolvedCitations: citations.unresolved.length,
     recordOverLength: record !== undefined && isOverLength(record),
+    recordOverCount: record !== undefined && isOverCount(record),
     sections,
     drift,
     wireframes,
@@ -1256,6 +1260,20 @@ function reportRecord(
     )
   }
 
+  if (report.entryCap === undefined) {
+    logInfo(
+      `${plural(decisions, 'decision')} and no entry cap stated, so the count is reported and never gated.`,
+    )
+  } else if (isOverCount(report)) {
+    logError(
+      `${plural(decisions, 'decision')} against a cap of ${report.entryCap}. Merge two or retire one, never compress.`,
+    )
+  } else {
+    logInfo(
+      `${plural(decisions, 'decision')} against a cap of ${report.entryCap}.`,
+    )
+  }
+
   if (decisions === 0) {
     logWarn('The record declares no decision, so nothing was classified.')
     return

package/src/commands/design.ts

@@ -26,12 +26,14 @@ import { mainWorktreeRoot } from '@/worktree'
 export function register(program: Command): void {
   const design = program
     .command('design')
+    .helpOption('-h, --help', 'Show this help message')
     .description(
       'Design system commands (regen, css, render, board, install, sync)',
     )
 
   design
     .command('regen')
+    .helpOption('-h, --help', 'Show this help message')
     .description(
       'Rewrite canon/DESIGN.md and the base stylesheet from src/design/tokens.ts',
     )
@@ -84,6 +86,7 @@ export function register(program: Command): void {
 
   design
     .command('css')
+    .helpOption('-h, --help', 'Show this help message')
     .description('Emit the design tokens and components as CSS on stdout')
     .option(
       '--no-components',
@@ -104,6 +107,7 @@ export function register(program: Command): void {
 
   design
     .command('render')
+    .helpOption('-h, --help', 'Show this help message')
     .description('Render DESIGN.md tokens to HTML and CSS preview')
     .option(
       '-s, --source <path>',
@@ -137,6 +141,7 @@ export function register(program: Command): void {
 
   design
     .command('board')
+    .helpOption('-h, --help', 'Show this help message')
     .description(
       'Generate the design board, an index over a project’s design surfaces',
     )

package/src/commands/feedback.ts

@@ -71,6 +71,7 @@ function writeLocal(body: string, mismatch: string | undefined): string {
 export function register(program: Command): void {
   program
     .command('feedback')
+    .helpOption('-h, --help', 'Show this help message')
     .description(
       'Write toolkit feedback from stdin to .canon/feedback/, or open a GitHub issue with --github',
     )

package/src/commands/slides.ts

@@ -11,10 +11,12 @@ import { intro, outro, palette } from '@/ui'
 export function register(program: Command): void {
   const slides = program
     .command('slides')
+    .helpOption('-h, --help', 'Show this help message')
     .description('Slide deck commands (render, list)')
 
   slides
     .command('render')
+    .helpOption('-h, --help', 'Show this help message')
     .description('Render a SLIDES.md source into a PowerPoint deck')
     .option('-s, --source <path>', 'Source SLIDES.md path', '.claude/SLIDES.md')
     .option(
@@ -82,6 +84,7 @@ export function register(program: Command): void {
 
   slides
     .command('list')
+    .helpOption('-h, --help', 'Show this help message')
     .description('List the available slide layouts')
     .option('--json', 'Output the layout catalog as JSON')
     .action((opts: { json?: boolean }) => {

package/src/commands/transcripts.ts

@@ -25,6 +25,7 @@ export async function resolveOutDir(opts: TranscriptOptions): Promise<string> {
 export function register(program: Command): void {
   program
     .command('transcripts <url>')
+    .helpOption('-h, --help', 'Show this help message')
     .description('Fetch a YouTube transcript with metadata frontmatter')
     .option(
       '-o, --out <path>',