@erclx/canon 4.90.0 → 4.93.0

package/claude/skills/session-compact/references/handoff-note.md

@@ -0,0 +1,68 @@
+---
+title: Handoff note
+description: What each section of a compact handoff carries, what stays out, and the test every line passes
+---
+
+# Handoff note
+
+The shape `session-compact` writes. It lives here rather than in `standards/` because one skill reads it and a standard nothing else cites has no second reader to correct it.
+
+## The test every line passes
+
+Would a compaction destroy this, and can no other artifact give it back?
+
+A line failing either half comes out. The tree, the git log, a groundwork record and the task board all survive a compaction, so restating any of them spends the reader's trust on something they already had.
+
+## Frontmatter
+
+```markdown
+---
+title: <what the session settled, as a sentence>
+description: <what it decided, what it measured, what it left open, and the date>
+category: Compact
+---
+```
+
+## The sections
+
+### The opening line
+
+One sentence naming this as throwaway and pointing at whatever durable record holds the detail. A reader who knows the note is disposable reads it differently from one who thinks it is the record.
+
+### `## Where the work is`
+
+The paths, and how to run what is there. A later session's first cost is finding the thing, and a wrong guess about which folder is current wastes more than this section costs.
+
+Name what was not touched too. A session that changed no source says so, since a reader otherwise opens `git status` expecting a diff.
+
+### `## What was decided`
+
+One bullet per decision, each naming what it beat. A decision with no rejected alternative reads as arbitrary and gets reopened by the next session that dislikes it.
+
+Where a decision rests on a measurement, give the number rather than the conclusion. `27 spacing values became 7` survives a reader disagreeing with it, where `the spacing was tidied` does not.
+
+### `## What is open`
+
+Numbered, because a reader picks one. Each carries what is unresolved and what would settle it.
+
+A thing deliberately not done belongs here, marked as such. An open question and a declined option look identical to a later session unless the note separates them.
+
+### `## Where to pick up`
+
+One instruction. Not a list, not a menu, not a recommendation with alternatives.
+
+Where the next move is a measurement rather than a decision, say so, since a session handed an open question reaches for a pick by default and spends a round on a question nobody needed answered.
+
+### `## Cautions`
+
+Only what cost this session time and would cost the next one the same. A command whose output goes to stderr, a tool reading something other than what its name suggests, a generator that deletes more than it wrote.
+
+Not general advice. A caution a reader could have guessed is noise around the two that matter.
+
+## What stays out
+
+- A `## State` section. A session that committed nothing has no state, and one that did has it in the log.
+- The tree, the file counts, and the folder listing. All survive a compaction.
+- The session's narrative. What was tried and abandoned belongs in the record the track keeps, or in memory if it generalizes, or nowhere.
+- A lesson already written to `.canon/memory/`. Cite the entry by name rather than restating it.
+- Anything the reader would have to take on trust. Every claim carries a file, a commit, or a record.

package/claude/skills/session-map/REQUIREMENT.md

@@ -1,6 +1,6 @@
 ---
 name: session-map
-description: Why the write procedure needs a route any session can take, why the door carries the drift step and its ref recovery, and why it states none of the shape the standard already fixes
+description: Why the write procedure needs a board-side route for the orchestrator and for a request naming the map, why the door carries the drift step and its ref recovery, and why it states none of the shape the standard already fixes
 ---
 
 # Session map requirement
@@ -23,7 +23,7 @@ A body that restates the sections, the frontmatter, or the numbered steps become
 
 ## Must
 
-- Write from any session whatever role it holds, without asserting one
+- Write for an orchestrating session, or on a request naming the session map or the board, without asserting a role the session does not hold
 - Cite the standard for the filename, the frontmatter, the sections, the numbered procedure, and the citation rule rather than restating any of them
 - Run the drift step and state how to recover the ref it reads from how long the session has run
 - Record what the drift verb names, and read a refusal as the boundary of what the verb can read
@@ -50,6 +50,7 @@ A body that restates the sections, the frontmatter, or the numbered steps become
 
 ## Out of scope
 
+- The handoff a plain session writes before a compaction, which is a note outside the board with no drift step and no `## State`: `session-compact`. Both skills once claimed the phrases "write the handoff" and "about to compact", so this description narrows to the orchestrator and to a request naming the map or the board, and a plain session belongs to `session-compact`.
 - Reading a handoff back at the start of the next session: `session-resume`
 - Routing a session fact to the context entry that owns it, and writing what no entry owns to the memory folder: `memory-capture`
 - The sections a role adds over the core three, which belong to that role's own surface. `role-orchestrator` owns the orchestrator's and cites this route for the generic half.

package/claude/skills/session-map/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: session-map
-description: Writes the session map, the pre-compaction handoff at `.canon/tasks/session-<slug>.md`, from any session whatever role it holds, running the skill-drift step the write procedure opens with. Use when asked to "write the handoff", "write the session map", "save the session before it compacts", "we are about to compact", "hand off to the next session", or "leave a note for whoever picks this up". Do NOT use to route session facts to a context entry or the memory folder, which is `memory-capture` and writes a different artifact, and do NOT use to read a handoff back, which is `session-resume`.
+description: Writes the session map, the board-side handoff at `.canon/tasks/session-<slug>.md`, for an orchestrating session or on a request naming the session map or the task board, running the skill-drift step the write procedure opens with. Use when asked to "write the session map", "write the board handoff", or when a session holding `canon:role-orchestrator` hands off before a compaction. Do NOT use for a plain session about to compact, which is `session-compact` and writes a note outside the board. Do NOT use to route session facts to a context entry or the memory folder, which is `memory-capture` and writes a different artifact, and do NOT use to read a handoff back, which is `session-resume`.
 ---
 
 # Session map
@@ -13,7 +13,7 @@ Run every step rather than judging in advance that one has nothing to act on. Th
 
 ## What fires this
 
-Being asked is one route. The other is a `PreCompact` hook registered against the `manual` matcher, which a project may install and which blocks the first `/compact` of a session with a message naming this skill. The block fires once, so the next `/compact` proceeds whether or not a map was written, and an automatic compaction is never blocked. A project that registered no such hook reaches this skill by being asked alone.
+Being asked is the route for a plain session that wants a board-side map, and the orchestrator's handoff runbook is the route for that role. A plain session about to compact belongs to `session-compact`, which is what the `PreCompact` hook on the `manual` matcher names. That hook's message carries one sentence sending a session holding `canon:role-orchestrator` here.
 
 Decline where the session holds no reasoning a reader could not get faster from git. Say so in one line and write nothing. The standard already names a `## State` filled from the tree as non-conforming, and the file that carries three such sections is worse than an absent one, because a reader who finds a map trusts it. Declining is a result the caller can act on, where a padded map is a result that misleads.
 

package/claude/skills/session-resume/SKILL.md

@@ -7,11 +7,11 @@ description: Resumes a previous session by reading the handoff it left behind, t
 
 ## Step 1: read tracked work
 
-Resolve `.canon/plans/`, `.canon/memory/`, and `.canon/tasks/` at the main worktree root the way `session-worktree` does.
+Resolve `.canon/plans/`, `.canon/memory/`, `.canon/compact/`, and `.canon/tasks/` at the main worktree root the way `session-worktree` does.
 
 Read these in parallel, skipping any that do not exist:
 
-- the newest `.canon/tasks/session-*.md`: the handoff a previous session wrote before a compaction, per `${CLAUDE_SKILL_DIR}/../../standards/session.md`. It leads the report rather than the reads.
+- the newest `.canon/compact/*.md`, then the newest `.canon/tasks/session-*.md`: the handoff a previous session wrote before a compaction. The first is the note `session-compact` writes, and the second is the board-side map per `${CLAUDE_SKILL_DIR}/../../standards/session.md`, which stays readable. Whichever exists leads the report rather than the reads, and both lead it when both exist.
 - `.canon/tasks/index.md`: the folder catalog. Read this before any individual task file, and take the task list from it by dropping the `index`, `priority`, `backlog`, and `session-` rows, which are siblings rather than tasks.
 - `.canon/plans/*.md`: execution detail for in-progress tasks
 - `.canon/memory/index.md` and any memory files relevant to the top backlog item
@@ -48,4 +48,4 @@ Memory is updated only when a recorded fact becomes wrong, never on resume. A do
 
 This skill reads a handoff and never writes one. Reading and writing are two jobs, and the write happens at the close of a session rather than at its start.
 
-Name the standard when the session asks how to leave a handoff behind, and let the session follow it directly. Any session may write one, whatever role it holds, so nothing here routes the request to another skill. A role carrying sections of its own adds them over the core per that role's own runbook.
+Route a session asking how to leave a handoff behind to `session-compact`, which writes a note under `.canon/compact/`. A session holding the orchestrator role takes `session-map` instead, which writes the board-side map the standard governs, and a role carrying sections of its own adds them over the core per that role's own runbook.

package/claude/skills/teach-workspace/references/lesson-craft.md

@@ -73,7 +73,7 @@ The stepper hides and shows and sets nothing else, so how a selected option look
 
 ## The block list
 
-`canon teach render` takes a JSON array of blocks and renders it through the same components the fixture lesson is generated from. Four types, and every structural body composes from them:
+`canon teach render` takes a JSON array of blocks and renders it through the same components a lesson body composes. Four types, and every structural body composes from them:
 
 - `{"type":"heading","level":1|2,"text":"<text>"}`: an `<h1>` or `<h2>`.
 - `{"type":"paragraph","text":"<text>","lede":true}`: a `<p>`, marked `lede` for the dek that opens the lesson.

package/docs/agents/capture.md

@@ -5,11 +5,11 @@ description: Rendering HTML sources to PNG, what the command asserts about fonts
 
 # Capture
 
-`canon capture [source] --selector <sel>` renders HTML sources to PNG, which is how a generated documentation image is rebuilt from the markup it was generated out of. The source defaults to `assets/`, where a directory expands to every `.html` directly inside it, so adding a capture means dropping a file beside the first one and running the same command. That default is a generic starting point rather than a convention every target shares, and it stays because a missing folder still refuses loud, naming the argument, rather than failing silently. This repository no longer takes it: its own sources moved to `assets/captures/` and its images stayed in `assets/`, so a run here names the source explicitly and sends the output where that run wants it, `--out assets` to rebuild the committed images and somewhere disposable to preview them.
+`canon capture [source] --selector <sel>` renders HTML sources to PNG, which is how a generated documentation image is rebuilt from the markup it was generated out of. The source defaults to `assets/`, where a directory expands to every `.html` directly inside it, so adding a capture means dropping a file beside the first one and running the same command. That default is a generic starting point rather than a convention every target shares, and it stays because a missing folder still refuses loud, naming the argument, rather than failing silently. This repository no longer takes it: its own sources moved to `assets/captures/` and its images moved to `assets/evidence/`, so a run here names the source explicitly and sends the output where that run wants it, `--out assets/evidence` to rebuild the committed images and somewhere disposable to preview them.
 
 ```bash
 canon capture --selector .window
-canon capture assets/captures/install.html --selector .window --out assets
+canon capture assets/captures/install.html --selector .window --out assets/evidence
 canon capture assets/captures --selector .window --out .canon/review/captures
 canon capture https://example.com --selector .window --out preview.png
 ```
@@ -18,13 +18,13 @@ canon capture https://example.com --selector .window --out preview.png
 
 ## What this repository captures
 
-A capture set here spans two folders. `assets/captures/` holds five sources and the template each is written from, and `assets/` holds the five images a document points at with the stamp answering for each. One run over the source folder rebuilds every image, and it takes `--out assets` to put each PNG where its document points rather than beside the markup it rendered. None of the five is edited by hand. `scripts/core/regen-hero.sh` writes each `.html` from the template beside it, filling one shared value map into all of them, and `bun run check` regenerates them and fails on the difference.
+A capture set here spans two folders. `assets/captures/` holds five sources and the template each is written from, and `assets/evidence/` holds the five images a document points at with the stamp answering for each, under the segment `canon pr evidence` compares. One run over the source folder rebuilds every image, and it takes `--out assets/evidence` to put each PNG where its document points rather than beside the markup it rendered. None of the five is edited by hand. `scripts/core/regen-hero.sh` writes each `.html` from the template beside it, filling one shared value map into all of them, and `bun run check` regenerates them and fails on the difference.
 
 Three of the five take catalog data, so a stack gaining a rule moves the frame on the next run. `install.html` and `task-board.html` are the two exceptions: the first holds terminal text from a real run and the second holds a hand-frozen snapshot of a gitignored board, each in its template rather than derived from a live catalog at build time.
 
-`assets/captures/` is read flat and never descends, by the regeneration script, by this command, and by the drift stage alike. A source nested a further folder down is skipped by all three with nothing reported, so a new frame is a template dropped directly in rather than a folder of its own. The split is what retired the name prefix the flat layout used to need: a frame is named for itself now, since `assets/` no longer mixes markup in with the images.
+`assets/captures/` is read flat and never descends, by the regeneration script, by this command, and by the drift stage alike. A source nested a further folder down is skipped by all three with nothing reported, so a new frame is a template dropped directly in rather than a folder of its own. The split is what retired the name prefix the flat layout used to need: a frame is named for itself now, since `assets/captures/` no longer mixes markup in with the images.
 
-Only the HTML is asserted for drift. The PNG is a chromium render whose bytes move with the browser version, so rebuild it with `canon capture assets/captures --selector .window --out assets` when the check reports the HTML changed.
+Only the HTML is asserted for drift. The PNG is a chromium render whose bytes move with the browser version, so rebuild it with `canon capture assets/captures --selector .window --out assets/evidence` when the check reports the HTML changed.
 
 Every render writes a stamp beside its PNG, `hero.png` next to `hero.stamp`, holding the source filename, a `source-sha256` over the markup bytes it read, and an `image-sha256` over the image bytes it wrote. Both digests are what `bun run check` compares, so a markup edit committed without a capture and a PNG swapped under unchanged markup each fail. The stamp is tracked and commits alongside the pair. A capture that cannot write it reports that source as failed and exits 1, so an image whose stamp never landed is reported rather than passed over.
 
@@ -34,6 +34,7 @@ Neither digest is ever written by hand. A digest is what the gate compares, so a
 | ------------------ | ------------------------------------------------------------------------------------------------------ |
 | `--out <dir>`      | Write every PNG here instead of beside its source. For a URL source, names the destination PNG itself. |
 | `--selector <sel>` | Element to capture, required and never defaulted                                                       |
+| `--width <px>`     | Render at this viewport width so a media query resolves there. One whole number of 1 or more.          |
 
 ## What the command asserts
 
@@ -50,3 +51,9 @@ The command ships to targets, alongside `demo`, `inventory`, and `drive`. It was
 Shipping it also fixed what the exclusion was hiding. The render module imported the `@playwright/test` development dependency, which no published tarball carries. Every browser reference still sits behind a dynamic import, so a browser loads for this command rather than in front of every other one.
 
 `demo.md` and `driver.md` cover two of the other three browser commands. What separates this one is that a capture renders a single state, from a file on disk or a named `http(s)://` URL, where the rest drive a running application.
+
+## Capturing at a width
+
+`--width` sets the browser viewport and leaves the page alone. A media query answers to the viewport, so a wrapper narrowed to 390px renders a thin column of the desktop layout and proves nothing about the mobile one. The height stays at Playwright's default of 720, which keeps `vh` units where they are without the flag. A run that passes no `--width` passes no viewport option at all, so every committed image renders as before and no stamp digest moves.
+
+The flag takes one integer and no list. A sweep across breakpoints is one run per width, and the caller picks `--out` for each, since two widths written into one directory overwrite each other under the source's name. A value that is not a whole number of 1 or more refuses ahead of the browser import, naming the flag.

package/docs/agents/commands.md

@@ -103,8 +103,8 @@ Full help: `canon <command> --help`. Behavior notes for the install and sync ver
 | `canon gate run`                 | Run every stage that guards a branch here, scoping shell, types, and tests to the changed set (`--all`, `--no-write`, `--nested`, `--json`)                                                                                                                                                                                  |
 | `canon inventory [subject]`      | Walk every route a project declares and group its elements by the property each computes, as a listing rather than a gate (`--json`)                                                                                                                                                                                         |
 | `canon drive <url> <run>`        | Walk a page through named interactions and measure each state it reaches, reporting findings rather than gating (`--json`)                                                                                                                                                                                                   |
-| `canon capture [source]`         | Render an HTML source or an `http(s)://` URL to PNG and prove the font each one declares resolved (`--selector` required, `--out`)                                                                                                                                                                                           |
-| `canon serve [dir]`              | Serve a directory on the loopback interface and print the link that opens it, running until interrupted (`--port`, `--entry`, `--json`)                                                                                                                                                                                      |
+| `canon capture [source]`         | Render an HTML source or an `http(s)://` URL to PNG and prove the font each one declares resolved (`--selector` required, `--out`, `--width`)                                                                                                                                                                                |
+| `canon serve [dir]`              | Serve a directory on the loopback interface and print the link that opens it, running until interrupted (`--port`, `--entry`, `--index`, `--json`)                                                                                                                                                                           |
 | `canon upgrade`                  | Reinstall the CLI globally with the package manager the install path names (`--json`)                                                                                                                                                                                                                                        |
 
 `canon serve` drives no browser, which is what separates it from the four that do. All four ship now that `capture` does, so the line between them is the engine rather than the package. A generated page loses its script to an editor preview and to a `file://` open, so the link is the delivery rather than a convenience, and every generated surface here reaches a reader through one. A teach lesson's stylesheet is embedded rather than linked, so only its script still needs a server. It binds `127.0.0.1` and never a wildcard, because what it is pointed at is routinely a gitignored record tree. It sends `cache-control: no-store`, since a preview exists to be edited and reloaded and a cached stylesheet reads as a fix that did not work.
@@ -113,7 +113,7 @@ A port already in use is the ordinary case rather than a refusal, so it walks fo
 
 A request naming a directory is redirected to its trailing-slash form rather than answered in place. A browser resolves a relative asset against the last slash of the URL it is on, so answering `/lesson` directly leaves the page asking for `/course.css` instead of `/lesson/course.css`, and it renders unstyled through the server that exists to prevent exactly that.
 
-Containment is tested after symlinks are followed rather than on the path as written, and the test sits immediately before the read rather than beside the request that produced it. Resolving a request lexically clears a link pointing outside the served root, and this repository is a live instance of that shape, since `claude/standards` and `claude/snippets` are links out of `claude/`. Position is what makes the property hold: a directory request appends its index after the request path has been checked, so a check placed earlier leaves that index untested. An `--entry` that escapes the root refuses with `no-entry` before a port is taken, because `url` is the field a caller hands to a reader.
+Containment is tested after symlinks are followed rather than on the path as written, and the test sits immediately before the read rather than beside the request that produced it. Resolving a request lexically clears a link pointing outside the served root, and this repository is a live instance of that shape, since `claude/standards` and `claude/snippets` are links out of `claude/`. Position is what makes the property hold: a directory request appends its index after the request path has been checked, so a check placed earlier leaves that index untested. `--index` answers a directory holding no `index.html` with a listing read per request, where the default stays a 404. Every entry the listing names takes the same containment test a request for it would, so a link out of the root is absent rather than greyed, and dotfiles are hidden. With no `--entry` and no root `index.html`, the printed link is `/` and `entryExists` reads true. An `--entry` that escapes the root refuses with `no-entry` before a port is taken, because `url` is the field a caller hands to a reader.
 
 `canon demo` is the second browser command and the one that ships, since its purpose is running in a target rather than regenerating what this repository commits. It needs a browser binary the package does not carry, installed once with `bunx playwright install chromium`.
 

package/docs/agents/rule-citations.md

@@ -73,7 +73,7 @@ A rule under `governance/rules/` installs into a target, and its `paths:` entrie
 
 `internal/rules/` ships nowhere. The tree it governs is the tree present, which makes the question answerable, and all 14 of its globs across 7 rules match at the commit this shipped on.
 
-What that leaves unreached is a glob that matches real files and still reaches none of the work it was scoped at. `governance/rules/lib/305-e2e-reliability.md` scopes itself at `e2e/*.ts` and `e2e/**/*.ts`, and no probe in this repository is written under `e2e/`, so the rule asking a session to watch a new guard fail never fired for the session writing guards. Resolution is mechanical and reach is a judgment about where the work happens, so only the first is here.
+What that leaves unreached is a glob that matches real files and still reaches none of the work it was scoped at. `governance/rules/lib/305-e2e-reliability.md` scoped itself at `e2e/*.ts` and `e2e/**/*.ts` and now reads `**/e2e/**/*.ts`. No probe in this repository is written under `e2e/`, so the rule asking a session to watch a new guard fail never fired for the session writing guards. Resolution is mechanical and reach is a judgment about where the work happens, so only the first is here.
 
 ## The exemption marker
 

package/docs/agents/teach.md

@@ -27,7 +27,7 @@ canon teach list regular-expressions --json
 
 With no topic it reports one line per workspace, carrying the lesson, learning-record, reference-page, and glossary-term counts, plus `next`, the ordinal an open would take. With one it reports the filenames behind each count and the glossary entries themselves.
 
-A folder not named `NN-<topic>` is still listed rather than dropped, since dropping it hides the one folder that needs a fix. Its ordinal reads as absent, it sorts last, and it moves no ordinal, so a malformed name cannot push a new workspace into a number a reader already cites.
+A folder not named `NN-<topic>` is not a workspace, so the listing, `nav`, and every selector skip it and it moves no ordinal. That is what lets a teach root carry a sibling folder such as `evidence/` without it drawing as a stub row and receiving a contents page.
 
 The listing also names the required files a workspace does not carry, which is `MISSION.md`, `RESOURCES.md`, and `GLOSSARY.md`. That is a report rather than a refusal, because a workspace missing one is still a workspace a session can resume.
 
@@ -141,7 +141,7 @@ The order is drawn here rather than instructed, and that is the point of the ver
 
 ## Render
 
-`canon teach render` renders a lesson body's structural blocks to HTML, through the same components the fixture lesson under `examples/teach/00-fixture/` is generated from. It takes no topic and no `--root`, since the verb is a stateless transform reading nothing off a workspace on disk.
+`canon teach render` renders a lesson body's structural blocks to HTML, through the three lesson components. It takes no topic and no `--root`, since the verb is a stateless transform reading nothing off a workspace on disk.
 
 ```bash
 echo '[{"type":"heading","level":1,"text":"Compass bearings"}]' | canon teach render --json

package/docs/workflow/ai-workflow.md

@@ -280,7 +280,8 @@ This section is the corpus the coverage claim is measured against: every name `c
 | `canon:role-worker`       | To assert the worker role for a cold session building one branch under one plan |
 | `canon:session-relay`     | When a worker or planner owes its controller a message and holds no send tool   |
 | `canon:session-resume`    | At the start of a session, to pick up what a previous one left                  |
-| `canon:session-map`       | At the close of a session, to write the handoff a compaction would destroy      |
+| `canon:session-compact`   | Before a compaction, to write a plain session's handoff note outside the board  |
+| `canon:session-map`       | At the close of an orchestrating session, to write its board-side handoff       |
 
 ### Keep the project current with the toolkit
 
@@ -304,6 +305,7 @@ This section is the corpus the coverage claim is measured against: every name `c
 | `canon:create-snippet`    | For a reusable prompt                                                                                                               |
 | `canon:create-standard`   | For a new authoring convention                                                                                                      |
 | `canon:draft-docs`        | For a brand-new `docs/*.md` page, drafted against `standards/docs.md`                                                               |
+| `canon:draft-ready`       | For finished files a worker should copy, written as a ready folder with its overview, thin plan, and task                           |
 | `canon:draft-context`     | For a brand-new `canon/context/<domain>.md` entry, drafted against `standards/context.md`                                           |
 | `canon:draft-wireframes`  | For a brand-new `canon/wireframes/<surface>.md` file, drafted against `standards/wireframes.md`                                     |
 | `canon:draft-figure`      | For a hand-drawn figure inside an existing doc, drafted against `standards/figures.md` and rendered through Mermaid or freehand SVG |

package/governance/rules/claude/563-ready.md

@@ -6,6 +6,10 @@ paths:
 
 # Ready standards
 
+## Writing a ready folder
+
+- Load the `canon:draft-ready` skill to write a ready folder, its overview, the thin plan, and the task row. It owns the procedure. Report it rather than proceeding silently when it does not resolve, since it ships with the plugin and this rule ships with the CLI.
+
 ## Authority
 
 - Follow the ready standard for the folder layout, ordinal naming, the overview frontmatter, the mirrored tree, and the thin-plan contract. It is the single source. Read it with `canon standards ready`.

package/governance/rules/lib/305-e2e-reliability.md

@@ -1,8 +1,7 @@
 ---
 description: Enforce settled waits and falsifiable guards in end-to-end tests
 paths:
-  - 'e2e/*.ts'
-  - 'e2e/**/*.ts'
+  - '**/e2e/**/*.ts'
 ---
 
 # End-to-end reliability standards
@@ -14,6 +13,8 @@ paths:
 - Bound every settle with an explicit timeout.
 - Do not raise a timeout to clear a failure that reproduces under load. Replace the wait with a settle.
 - Do not read a value once after a pause. Poll it.
+- Settle a smooth scroll on the `scrollend` event. Fall back to a stillness window only when the target was already in view.
+- Run with motion reduced unless the test asserts motion, and opt back in per test.
 
 ## Falsifiable guards
 

package/governance/rules/lib/306-test-scope.md

@@ -1,8 +1,7 @@
 ---
 description: Enforce which specs and which engines an end-to-end run covers at each point in the loop
 paths:
-  - 'e2e/*.ts'
-  - 'e2e/**/*.ts'
+  - '**/e2e/**/*.ts'
 ---
 
 # Test scope standards

package/governance/rules/ui/410-a11y.md

@@ -24,6 +24,12 @@ paths:
 - Arrow keys: navigate within composite widgets. Do not let them exit the widget.
 - Escape: closes any overlay, popover, dialog, or dropdown. Cancels in-progress edits.
 - Do not introduce non-standard key bindings for common actions.
+- Give every author-defined drag a single-pointer alternative and a keyboard path, such as move buttons or arrow-key reordering (WCAG 2.2 Dragging Movements, 2.5.7).
+
+## Pointer targets
+
+- Size a web pointer target at least 24 by 24 CSS pixels, or space it so a 24 pixel circle centered on it touches no other target (WCAG 2.2 Target Size Minimum, 2.5.8).
+- Size a native touch target at the platform figure, 44 points on iOS and 48 dp on Android. Do not apply the web figure to native, and do not apply the native figure as the web minimum.
 
 ## Composite widgets
 
@@ -34,6 +40,7 @@ paths:
 
 - Move focus into any overlay, popover, or dialog on open. Return focus to the trigger on close.
 - Never move focus on hover. Only on keyboard input or explicit pointer activation.
+- Do not let a sticky header, footer, or overlay fully cover the focused control. Scroll it into view clear of them (WCAG 2.2 Focus Not Obscured, 2.4.11).
 
 ## ARIA semantics
 
@@ -46,3 +53,5 @@ paths:
 - Always provide `alt` on `<img>`. Use `alt=""` for decorative images.
 - Describe the content or function of the image, not its appearance. Do not prefix with "Image of" or "Photo of".
 - Alt text for functional images (icons, buttons) should describe the action, not the graphic.
+- Give the visual boundary of a control and every graphic that carries meaning at least 3:1 contrast against adjacent colors (WCAG Non-text Contrast, 1.4.11).
+- Never make color the only carrier of a state, error, or distinction. Pair it with text, an icon, or a pattern (WCAG Use of Color, 1.4.1).

package/governance/rules/ui/420-forms.md

@@ -26,6 +26,15 @@ paths:
 - Show the error directly under the field that caused it, not under an unrelated field.
 - When a change to field A causes a conflict involving field B, show the error under field A (the field the user edited), not under field B.
 
+## Submission errors
+
+- When a failed submission carries several errors, move focus to a summary that links to each failing field. Keep the inline error beside each field.
+
+## Authentication and re-entry
+
+- Let a password manager fill sign-in fields and accept a pasted value. Do not block paste or autofill on a password or code field (WCAG 2.2 Accessible Authentication, 3.3.8).
+- Do not ask for information the user already gave earlier in the same flow. Prefill it or offer it for selection (WCAG 2.2 Redundant Entry, 3.3.7).
+
 ## Input sanitization
 
 - Trim leading and trailing whitespace from text inputs on blur or submit, not on every keystroke.

package/governance/rules/ui/460-design-taste.md

@@ -0,0 +1,29 @@
+---
+description: Route edits that decide how a surface looks to the design-taste skill for the layer ordering, the coherence locks, and the defaults a model reaches for
+paths:
+  - '**/*.css'
+  - '**/*.scss'
+  - 'canon/DESIGN.md'
+---
+
+# Design taste standards
+
+## Authority
+
+- Load the `canon:design-taste` skill for which design decision settles first, what must stay constant across a surface, and the defaults to reach past. It is the single source for all three.
+- Load it before drafting, not after revising. A revision recovers a color and never recovers the composition a draft already settled.
+- Report it rather than proceeding silently when the skill does not resolve. It ships with the plugin and this rule ships with the CLI, so a project that installed governance alone does not have it.
+- Do not work the layer ordering or the coherence locks from memory.
+
+## When this fires and when it does not
+
+- This rule scopes to the files where an undecided visual choice lands, which is the stylesheet and the design document. Building a surface somebody already decided is implementation rather than design, and the rules below carry what implementation owes.
+- Load the skill by name when a component edit makes a visual choice nobody has taken yet, such as a new section's shape, a spacing relationship, or a radius. The glob cannot see that intent and no glob can.
+- Do not load it to ship a decided design. A worker wiring a picked composition pays the read and gets nothing back.
+
+## Boundaries
+
+- Accessibility, keyboard interaction and ARIA are a separate topic. `410-a11y` routes them, on every rendered path.
+- States, empty and loading coverage, and destructive confirmation are a separate topic. `430-ux-completeness` routes them.
+- Rendered copy casing, button labels and error wording are a separate topic. `400-ui` routes them.
+- The floor those three carry is not restated in the skill, and it is not traded against a preference where the two collide.

package/governance/rules/ui/470-motion.md

@@ -0,0 +1,23 @@
+---
+description: Moving content controls and the reduced-motion preference for rendered UI
+paths:
+  - '**/*.tsx'
+  - '**/*.jsx'
+  - '**/*.astro'
+  - '**/*.html'
+  - '**/*.css'
+---
+
+# Motion standards
+
+## Moving content
+
+- Give any content that moves, blinks, or scrolls automatically for more than five seconds a control to pause, stop, or hide it (WCAG Pause, Stop, Hide, 2.2.2).
+- Halt an auto-advancing carousel or ticker while it holds keyboard focus or pointer hover.
+- Do not flash content more than three times in any one second.
+
+## Reduced motion
+
+- Honor `prefers-reduced-motion: reduce` for every animation and transition that conveys no state. Remove it or replace it with an instant change.
+- Keep essential state changes visible under reduced motion, using a fade or a static indicator instead of movement.
+- Do not start video or animated backgrounds on their own when the preference is set.

package/governance/stacks/astro.toml

@@ -1,2 +1,2 @@
 extends = "node"
-rules = ["210-astro", "350-security-web", "400-ui", "410-a11y", "430-ux-completeness", "440-surface-capture", "450-link-behavior"]
+rules = ["210-astro", "300-testing-ts", "305-e2e-reliability", "306-test-scope", "350-security-web", "400-ui", "410-a11y", "420-forms", "430-ux-completeness", "440-surface-capture", "450-link-behavior", "460-design-taste", "470-motion"]

package/governance/stacks/react.toml

@@ -1,2 +1,2 @@
 extends = "node"
-rules = ["200-react", "230-nextjs", "250-tailwind", "300-testing-ts", "305-e2e-reliability", "306-test-scope", "310-zod", "350-security-web", "400-ui", "410-a11y", "420-forms", "430-ux-completeness", "440-surface-capture", "450-link-behavior"]
+rules = ["200-react", "230-nextjs", "250-tailwind", "300-testing-ts", "305-e2e-reliability", "306-test-scope", "310-zod", "350-security-web", "400-ui", "410-a11y", "420-forms", "430-ux-completeness", "440-surface-capture", "450-link-behavior", "460-design-taste", "470-motion"]

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@erclx/canon",
   "type": "module",
-  "version": "4.90.0",
+  "version": "4.93.0",
   "description": "Infrastructure and quality tooling for developer workflows",
   "license": "MIT",
   "bin": {
@@ -19,7 +19,8 @@
     "tsconfig.json",
     "!scripts/sandbox",
     "!scripts/eval",
-    "!**/*.test.ts"
+    "!**/*.test.ts",
+    "!**/*.test.tsx"
   ],
   "publishConfig": {
     "access": "public"

package/scripts/core/regen-hero.sh

@@ -18,10 +18,11 @@
 # Only the HTML regenerates here. The PNG beside it is a chromium render whose
 # bytes move with the browser version, so asserting it in verify.sh would fail
 # on a machine whose chromium differs rather than on a stale count. Rebuild the
-# images with `canon capture assets/captures --selector .window --out assets`
+# images with `canon capture assets/captures --selector .window --out assets/evidence`
 # after this script reports a change. The markup and the image sit in two
-# folders, so that run reads the sources here and sends every PNG and stamp back
-# up to assets/, where the documents point. The selector has no default, since
+# folders, so that run reads the sources here and sends every PNG and stamp to
+# assets/evidence/, where the documents point and where `canon pr evidence`
+# compares a changed image. The selector has no default, since
 # the element a capture crops to belongs to the page rather than to the command,
 # and `.window` is the class this repository's own sources declare.
 # That capture also writes a .stamp beside each PNG, which records the digest of

package/src/capture/render.ts

@@ -25,6 +25,7 @@ import { formatStamp, hashSource, stampPath } from '@/capture/stamp'
  */
 
 const DEVICE_SCALE_FACTOR = 2
+const DEFAULT_VIEWPORT_HEIGHT = 720
 const FONT_PROBE_SIZE = 72
 const FONT_PROBE_TEXT = 'canon capture 0123456789'
 const ABSENT_FAMILY = '__canon_absent_family__'
@@ -32,6 +33,7 @@ const ABSENT_FAMILY = '__canon_absent_family__'
 export interface CaptureOptions {
   selector: string
   outDir?: string
+  width?: number
 }
 
 export type CaptureResult =
@@ -54,7 +56,9 @@ export async function captureSources(
   const browser = await chromium.launch()
   try {
     return await Promise.all(
-      sources.map((source) => captureOne(browser, source, options.selector)),
+      sources.map((source) =>
+        captureOne(browser, source, options.selector, options.width),
+      ),
     )
   } finally {
     await browser.close()
@@ -69,9 +73,19 @@ async function captureOne(
   browser: Browser,
   source: CaptureSource,
   selector: string,
+  width: number | undefined,
 ): Promise<CaptureResult> {
+  /**
+   * A viewport rather than a wrapper, since a media query answers to the
+   * viewport. Absent leaves the option out so the browser default stands and
+   * every committed capture renders as before. The height is Playwright's own
+   * default, which keeps `vh` units where they were.
+   */
   const page = await browser.newPage({
     deviceScaleFactor: DEVICE_SCALE_FACTOR,
+    ...(width === undefined
+      ? {}
+      : { viewport: { width, height: DEFAULT_VIEWPORT_HEIGHT } }),
   })
   try {
     await page.goto(

package/src/claude/cases/authoring.ts

@@ -42,6 +42,11 @@ export const AUTHORING_CASES: readonly SkillCase[] = [
       'Write a brand-new docs page for the capture command, nothing under docs/ covers it yet.',
     expect: 'draft-docs',
   },
+  {
+    prompt:
+      'I already wrote the finished skill files, package them as a ready folder with a plan and a task for a worker to copy.',
+    expect: 'draft-ready',
+  },
   {
     prompt: 'This project has no README.md at all, write one from scratch.',
     expect: 'draft-readme',

package/src/claude/cases/misc.ts

@@ -12,6 +12,11 @@ export const MISC_CASES: readonly SkillCase[] = [
       'Show me a few different treatments for this callout so I can pick one by looking.',
     expect: 'draft-and-pick',
   },
+  {
+    prompt:
+      'Which layer of this landing page should I settle first, and what has to stay constant across it?',
+    expect: 'design-taste',
+  },
   {
     prompt:
       'This project has no logo yet. Draft one and give me a social card to go with it.',
@@ -29,6 +34,11 @@ export const MISC_CASES: readonly SkillCase[] = [
   {
     prompt:
       "We're about to hit the context limit, write the handoff before we lose state.",
+    expect: 'session-compact',
+  },
+  {
+    prompt:
+      'I am the orchestrating session and about to compact, so write the board handoff as a session map on the task board.',
     expect: 'session-map',
   },
   {

package/src/cli.ts

@@ -121,7 +121,7 @@ function showHelp(): void {
     `${GREY}│${NC}    canon design board`,
     `${GREY}│${NC}    canon slides render`,
     `${GREY}│${NC}    canon slides list --json`,
-    `${GREY}│${NC}    canon capture assets/captures/install.html --selector .window --out assets`,
+    `${GREY}│${NC}    canon capture assets/captures/install.html --selector .window --out assets/evidence`,
     `${GREY}│${NC}    canon serve .canon/teach`,
     `${GREY}│${NC}    canon inventory focus --json`,
     `${GREY}│${NC}    canon drive http://localhost:4173 run.json --json`,