@erclx/canon 5.23.0 → 5.24.0

package/claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "canon",
   "description": "Runs your agent's work and keeps its code good, on one setup for every repo.",
-  "version": "5.23.0",
+  "version": "5.24.0",
   "author": {
     "name": "Eric Le",
     "url": "https://github.com/erclx"

package/claude/skills/canon-operator/REQUIREMENT.md

@@ -27,6 +27,7 @@ The last failure is a section no route reaches. `## Route` maps an intent or a d
 - Run the CLI non-interactively and report the command run, what changed, and the full path of anything written
 - Read the overwrite contract from the body before any install or sync, and name each surface it lists as overwritten before running one
 - Read the reverse walk beside the forward sections, so a folder the toolkit stopped shipping reaches the user
+- Read `unmovedSurfaces` from the report itself, since the drift status ignores it by design, and name `canon migrate surface-roots` without running either form
 - Name an unmigrated domain's root and install path for the user to move themselves, since no skill covers the move
 - Route a measurement intent to the audit offers from the route table itself, rather than leaving the section reachable only by reading past the table
 - Rank a lifecycle row against the audit offers where the route table itself states it, so a session acting on the lifecycle row reads the ranking without opening the section being ranked

package/claude/skills/canon-operator/SKILL.md

@@ -22,10 +22,11 @@ Load a domain doc with `canon docs <topic>` only when the intent touches that do
 
 Run `canon sync --check . --json` before routing. It reports what a target is behind on across every surface, so the intent comes from the project state rather than from the user having to know it already. Skip only when the user named a single operation to run.
 
-Read seven fields off the report and carry each to `## Route`:
+Read eight fields off the report and carry each to `## Route`:
 
 - `unmigrated`: a domain sitting at the root layout with nothing under `.claude/`. The most urgent finding, because that domain reports no drift of its own while being entirely behind
 - `superseded`: a file a newer seed folder replaced. No command moves it, since the content is the project's own, so this routes to `canon:target-check` for the full per-domain reading rather than ending at the report
+- `unmovedSurfaces`: a surface held only at its `.claude/` spelling, each entry carrying `rel` and `movesTo`. Every other field reads clean for such a target, and the report's drift status ignores it by design, so read the array itself rather than an exit status
 - `seeds`: entries are `matching`, `stale`, `drifted`, or `missing`. Anything but `matching` needs the seed handoff
 - `domains[].entries`: per-file `stale`, `customized`, `stranded`, and `orphaned` as before, plus `retired` for a rule the toolkit no longer ships, which the next sync deletes
 - `reverse`: what the target holds that no live catalog claims. `unclaimed` lists folders at roots the toolkit stopped shipping, each with an `attribution` of `dropped`, `unattributed`, or `project`. Act on the first two and leave `project` alone, which history proved the project owns
@@ -34,6 +35,8 @@ Read seven fields off the report and carry each to `## Route`:
 
 State what the report found in one line per finding before acting on any of it.
 
+An `unmovedSurfaces` key the report does not carry at all is likewise a CLI predating the field rather than a target with nothing to move. Say the section was unread and name the installed CLI version as the cause.
+
 A `reverse` key the report does not carry at all is a CLI predating the field rather than a target with nothing unclaimed. Say the walk did not run and name the CLI version as the cause. Reading the absent key as an empty answer reports a clean target to a project nobody has looked at, and answering it from a filesystem walk of your own is worse, since that reaches a verdict the attribution the field carries is the only thing entitled to make.
 
 ## Route
@@ -44,6 +47,7 @@ The two can name different rows, and a reply answers both rather than picking on
 
 - A domain in `unmigrated`: name it, the root path, and the install path. No command moves it, so the user runs the relocation themselves
 - Anything in `superseded`: name which files and what replaced them, then hand off to `canon:target-check`, which reports and never moves or deletes the file
+- Anything in `unmovedSurfaces`: name `canon migrate surface-roots`, which only reports its plan until `--write` is passed, with each entry's `rel` and `movesTo`, and run neither form, since the move rewrites tracked paths
 - A folder in `unclaimed`: name it and the attribution it carries. No command moves it and the content may be the project's own, so the decision is the user's
 
 - First-time scaffold of a fresh project: hand off to `target-setup`

package/claude/skills/draft-doc/REQUIREMENT.md

@@ -19,6 +19,7 @@ The same procedure ran as five skills, one per kind, each restating the read, th
 - Check the catalog by exact name and by title and description, since a subject can be covered under a name the request does not guess
 - Confirm the resolved path, the kind's detections, and the full content with the user before writing, since placement and detection are judgment calls with no diff to preview them against
 - Regenerate the catalog of the folder the document landed in, where the kind keeps one, so the next run's collision check sees it
+- Draft a README from the template for every detected project type and combine them, never the closest one, since a project that is a CLI and a plugin owes its reader both
 - Carry each kind's own musts in its reference: the root check for context and wireframes, tier detection and the two modes for wireframes, both placement tests and a fetched source for the wiki, and project detection and rendered-value badges for the readme
 
 ## Must not

package/claude/skills/draft-doc/references/readme/agent-facing.md

@@ -0,0 +1,59 @@
+![<Project name> logo](<committed logo path>)
+
+# <Project name>
+
+[![<build status>](<badge image URL>)](<run history URL>)
+[![<license>](<badge image URL>)](<license URL>)
+
+<One-line claim taken from the repository description.>
+
+<Two or three sentences expanding the claim: the conventions or tooling an agent working here picks up, and what a session gains from them.>
+
+## Installation
+
+### Requirements
+
+- <Agent tool and minimum version>
+- <Runtime the listing command needs>
+
+### Set up
+
+```bash
+<clone command>
+<setup command, when a session needs one>
+```
+
+## Usage
+
+### What an agent loads first
+
+`<file an agent reads at session start>` carries <what that file holds>. It points at <the files it imports or links>.
+
+### List what the project exposes
+
+```bash
+<command that lists skills, rules, or commands>
+```
+
+### Where things live
+
+| Path       | Holds        |
+| ---------- | ------------ |
+| `<folder>` | <What it is> |
+
+## Documentation
+
+<Link to the full conventions reference.>
+
+## Support
+
+- <Where to open an issue>
+- <Where to ask a question>
+
+## Contributing
+
+See the [contributing guidelines](<CONTRIBUTING.md path>).
+
+## License
+
+[<License name>](<LICENSE path>)

package/claude/skills/draft-doc/references/readme/application.md

@@ -0,0 +1,66 @@
+![<Project name> logo](<committed logo path>)
+
+# <Project name>
+
+[![<build status>](<badge image URL>)](<run history URL>)
+[![<license>](<badge image URL>)](<license URL>)
+
+<One-line claim taken from the manifest or repository description.>
+
+[<Live site name>](<live URL>)
+
+![<What the screenshot depicts>](<committed image path>)
+
+<Two or three sentences expanding the claim: who the product is for, then what they do with it.>
+
+## Features
+
+- <Benefit the user gets>
+- <Benefit the user gets>
+
+## Installation
+
+### Requirements
+
+- <Runtime and version>
+- <Service the app depends on>
+
+### Set up
+
+```bash
+<clone command>
+<dependency install command>
+```
+
+## Usage
+
+### Run locally
+
+```bash
+<dev server command>
+```
+
+<Address the app serves on.>
+
+### Configuration
+
+| Variable | Purpose            | Default     |
+| -------- | ------------------ | ----------- |
+| `<NAME>` | <What it controls> | `<default>` |
+
+### Deploy
+
+<Where the app deploys and the command or workflow that does it.>
+
+## Support
+
+- <Where to open an issue>
+- <Where to ask a question>
+
+## Contributing
+
+See the [contributing guidelines](<CONTRIBUTING.md path>).
+
+## License
+
+[<License name>](<LICENSE path>)

package/claude/skills/draft-doc/references/readme/cli.md

@@ -0,0 +1,64 @@
+![<Project name> logo](<committed logo path>)
+
+# <Project name>
+
+[![<package version>](<badge image URL>)](<registry page URL>)
+[![<build status>](<badge image URL>)](<run history URL>)
+[![<license>](<badge image URL>)](<license URL>)
+
+<One-line claim taken from the manifest description.>
+
+<Two or three sentences expanding the claim: the task a reader repeats by hand, then what the command does about it.>
+
+## Features
+
+- <Benefit the reader gets>
+- <Benefit the reader gets>
+
+## Installation
+
+```bash
+<global install or one-shot run command>
+```
+
+<Runtime or platform requirement, when one exists.>
+
+## Usage
+
+### Run a command
+
+```bash
+<command> <argument>
+```
+
+### Flags
+
+```bash
+<command> --<flag> <value>
+<command> --<flag>
+```
+
+| Flag       | Effect         |
+| ---------- | -------------- |
+| `--<flag>` | <What it does> |
+
+### Exit codes
+
+<What each non-zero exit means, when a script depends on it.>
+
+## Documentation
+
+<Link to the full command reference.>
+
+## Support
+
+- <Where to open an issue>
+- <Where to ask a question>
+
+## Contributing
+
+See the [contributing guidelines](<CONTRIBUTING.md path>).
+
+## License
+
+[<License name>](<LICENSE path>)

package/claude/skills/draft-doc/references/readme/library.md

@@ -0,0 +1,57 @@
+![<Project name> logo](<committed logo path>)
+
+# <Project name>
+
+[![<package version>](<badge image URL>)](<registry page URL>)
+[![<build status>](<badge image URL>)](<run history URL>)
+[![<license>](<badge image URL>)](<license URL>)
+
+<One-line claim taken from the manifest description.>
+
+[<Live site name>](<live URL>)
+
+![<What the screenshot depicts>](<committed image path>)
+
+<Two or three sentences expanding the claim: the problem a reader recognizes, then what the library does about it.>
+
+## Features
+
+- <Benefit the reader gets>
+- <Benefit the reader gets>
+
+## Installation
+
+```bash
+<install command for the package manager the project uses>
+```
+
+## Usage
+
+### Quickstart
+
+```<language>
+<Import and one call that shows the core behavior>
+```
+
+### <Second common task>
+
+```<language>
+<Snippet for the task>
+```
+
+## Documentation
+
+<Link to the full API reference.>
+
+## Support
+
+- <Where to open an issue>
+- <Where to ask a question>
+
+## Contributing
+
+See the [contributing guidelines](<CONTRIBUTING.md path>).
+
+## License
+
+[<License name>](<LICENSE path>)

package/claude/skills/draft-doc/references/readme/plugin.md

@@ -0,0 +1,66 @@
+![<Project name> logo](<committed logo path>)
+
+# <Project name>
+
+[![<build status>](<badge image URL>)](<run history URL>)
+[![<license>](<badge image URL>)](<license URL>)
+
+<One-line claim taken from the plugin manifest description.>
+
+<Two or three sentences expanding the claim: the work a session repeats, then what the plugin adds to it.>
+
+## Features
+
+- <Skill, command, or hook and what it gives the user>
+- <Skill, command, or hook and what it gives the user>
+
+## Installation
+
+### <First channel name>
+
+```bash
+<install command for this channel>
+```
+
+### <Second channel name>
+
+```bash
+<install command for this channel>
+```
+
+### Update
+
+```bash
+<update command>
+```
+
+## Usage
+
+### Invoke a skill
+
+```text
+/<plugin name>:<skill name> <argument>
+```
+
+### What the plugin adds
+
+| Name     | Kind                      | Purpose        |
+| -------- | ------------------------- | -------------- |
+| `<name>` | <skill, command, or hook> | <What it does> |
+
+### Configuration
+
+<Setting the plugin reads and where the user sets it, when one exists.>
+
+## Support
+
+- <Where to open an issue>
+- <Where to ask a question>
+
+## Contributing
+
+See the [contributing guidelines](<CONTRIBUTING.md path>).
+
+## License
+
+[<License name>](<LICENSE path>)

package/claude/skills/draft-doc/references/readme.md

@@ -24,16 +24,44 @@ The target path is the placement. A README keeps no catalog, so there is no coll
 
 ## Detect
 
-- Read the project's manifest (`package.json`, `pyproject.toml`, `Cargo.toml`, or equivalent) for a `bin` field or CLI entry point, an installable package name, and its declared dependencies.
-- Check for a `claude/skills/` or `.claude/skills/` folder, a `plugin.json`, or a marketplace manifest, each naming an agent-facing or marketplace-distributed surface.
-- Note every type that applies rather than stopping at the first match, since a project is often several at once and the draft covers each one.
+Read the project's manifest (`package.json`, `pyproject.toml`, `Cargo.toml`, or equivalent) and the tree, then test each type on its own signal. Note every type that matches rather than stopping at the first, since a project is often several at once.
+
+- Library: an installable package name, counted only when no application, CLI, or plugin signal matches, since a named package is also what a site, a CLI, or a plugin carries. An agent-facing match leaves it in place, so a library with a `CLAUDE.md` still gets its quickstart.
+- CLI: a `bin` field, a `[project.scripts]` table in `pyproject.toml`, a `[[bin]]` table in `Cargo.toml`, or a CLI entry point.
+- Application: a site framework dependency, a site config file, or an app entry point.
+- Agent-facing: a `.claude/skills/` folder, or a file an agent loads such as `CLAUDE.md`.
+- Plugin: a `plugin.json` or a marketplace manifest.
+
+A match on no type falls back to the standard's generic template. Say so in the preview, and never force the nearest type.
+
 - Check for a page. A dependency on a site framework or a site config file in the manifest or the tree marks a project as having one. Read a live URL separately, from a `homepage` field or a deploy config, since a project can have a page and no known URL.
 - A monorepo can carry a page in one package and a CLI in another, so both signals may fire. Report each rather than picking one.
 - Look for the mark and the screenshot among images the project already commits: scan the existing README for image references, then the asset and public folders.
 
+## Pick
+
+Read the template for each detected type from `readme/`, beside this file:
+
+- `readme/library.md`
+- `readme/cli.md`
+- `readme/application.md`
+- `readme/agent-facing.md`
+- `readme/plugin.md`
+
+Each is a whole page of slots and structure, so fill it from the manifest and the tree rather than from memory. The standard still owns voice and content, and a template carries no rule of its own.
+
+A project matching one type drafts from that template. A project matching several combines them:
+
+- Keep one H1, one header block, and one description.
+- Order the sections as the standard orders them.
+- Add each extra type's usage or install subsection under the shared `## Installation` or `## Usage` H2, never as a second H2 of the same name.
+- Drop a template section the page already carries rather than repeating it.
+
+Between agent-facing and plugin alone, a repository with no plugin manifest takes only the agent-facing template, and a plugin that is not agent-facing in its own repository takes only the plugin template. A CLI or an application that also matches agent-facing keeps its own template beside it.
+
 ## Draft
 
-- Draft the H1, a 2-3 sentence description in plain text, then the required sections, then whichever optional sections and per-type content Detect found. A README takes no frontmatter.
+- Start from the picked or combined template. Draft the H1, a 2-3 sentence description in plain text, then the required sections, then whichever optional sections and per-type content Detect found. A README takes no frontmatter.
 - Open the page with the standard's header block, filling each slot from what Detect found: mark, title, badges, a one-line claim from the manifest description, the live link, then the product screenshot.
 - Fill the screenshot slot only with an image the project already commits, referenced with alt text naming what it depicts. This kind cannot capture one. Omit the slot when no such image exists and say so in the preview. Never write a placeholder path or invent a mark.
 - Omit the link and the screenshot for a project with no page, and the mark for a project with none, without a note in the drafted page. A project with a page and no known URL gets the screenshot slot, and the Confirm step asks for the link.
@@ -48,6 +76,7 @@ Add these lines, then confirm them with the path:
 
 - `**Target:** <root | nested>`
 - `**Detected:** <project types>`
+- `**Templates:** <each template read, or the generic fallback>`
 - `**Header:** <each slot as filled (source) or skipped (reason)>`
 - `**Badges:** <candidates and what backs each one, or none>`
 

package/docs/agents/canvas.md

@@ -11,6 +11,10 @@ description: The canvas server, its content format, and the verbs that list, arr
 
 `canvas serve` serves the canvas on `127.0.0.1`, walks ports like `canon serve`, refuses a `Host` other than loopback on its own port, and runs until interrupted. Each frame gets the project's token stylesheet injected, being this toolkit's tokens in its own checkout, else `.claude/design/base.css` plus anything under `.claude/design/project/`, else none with a notice. An open canvas reloads a frame whose file changes.
 
+The toolkit's own tokens arrive with the font faces they name embedded, so a frame renders in them on a machine that never installed them. An installed base owns its fonts and gets no faces added.
+
+Before it binds a port, `canvas serve` checks that `preact` and `@preact/signals` resolve from the package the CLI runs from, never from the served project. When either is missing it refuses with reason `missing-client-deps` and names `bun install` in the detail, rather than serving a shell that loads as a blank page.
+
 The write routes the shell posts to also refuse a request carrying an `Origin` other than the server's own, and a body that is not JSON.
 
 ## List and add
@@ -37,7 +41,7 @@ A pick is refused as `address-mismatch` when the browser builds elements the fil
 
 The operator edits the same set from the inspector, which posts to the same writer with the hash the frame was served with. An edit made against a version of the file Claude has since rewritten is refused as `stale-address` and the shell reloads the frame, so nothing lands on a shifted element. A color picked from the project's tokens is written as `var(--<name>)`. Both writers take the frame file's lock, and an edit that keeps the selected element where it was keeps the selection fresh.
 
-Inline style beats a class, so an operator's edit masks a class change Claude makes later. Read a frame's inline styles before restyling it, and remove one the change should replace. A property outside the set, or a value carrying `;`, `{`, `}`, `<`, `>`, or a line break, is refused as `invalid-edit`.
+Inline style beats a class, so an operator's edit masks a class change Claude makes later. Read a frame's inline styles before restyling it, and remove one the change should replace. The inspector marks a color or background set inline with the word `raw` when its value names no `var()` and is not `currentColor` or a CSS-wide keyword, since that value stays fixed when the theme changes. A property outside the set, or a value carrying `;`, `{`, `}`, `<`, `>`, or a line break, is refused as `invalid-edit`.
 
 The Theme tab in the shell lists what the token stylesheet defines, grouped as color, spacing, radius, font family, font size, and other. The page record at `/api/pages` carries the same list as `tokens.groups`.
 

package/docs/workflow/visual-design-workflow.md

@@ -14,7 +14,7 @@ The tier framework sits alongside [Claude Design](../../wiki/claude/design.md),
 
 ## Tier 0: prose only
 
-The default. `canon/DESIGN.md` holds visual intent as prose plus token tables for color, typography, spacing, borders, motion, and iconography. `.claude/WIREFRAMES.md` holds each surface's regions and states.
+The default. `canon/DESIGN.md` holds visual intent as token tables for color, typography, spacing, and borders, with one Personality paragraph and at most three one-line rules a section, motion and iconography included. `.claude/WIREFRAMES.md` holds each surface's regions and states.
 
 Claude Code reads both and writes the implementation. Works for CLI tools, internal dashboards, admin panels, and backend-focused projects.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@erclx/canon",
   "type": "module",
-  "version": "5.23.0",
+  "version": "5.24.0",
   "description": "Runs your agent's work and keeps its code good, on one setup for every repo.",
   "license": "MIT",
   "bin": {

package/src/canvas/client/inspector.tsx

@@ -76,15 +76,49 @@ function positionRows(element: Element): Row[] {
   ]
 }
 
+function inlineValue(element: Element, property: string): string {
+  return 'style' in element
+    ? (element as HTMLElement).style.getPropertyValue(property)
+    : ''
+}
+
+/** Values that defer to something else, so they follow the theme as it does. */
+const DEFERRING = new Set([
+  'currentcolor',
+  'inherit',
+  'initial',
+  'unset',
+  'revert',
+  'revert-layer',
+])
+
+/**
+ * A color that stays put when the theme changes: one naming no token anywhere
+ * in it and deferring to nothing, so `color-mix()` over a `var()` is not raw.
+ */
+export function isRawValue(value: string): boolean {
+  const normalized = value.trim().toLowerCase()
+  return (
+    normalized !== '' &&
+    !normalized.includes('var(') &&
+    !DEFERRING.has(normalized)
+  )
+}
+
+/**
+ * Inherited and stylesheet values are not the element's own, so only an
+ * inline value counts.
+ */
+function isRawInline(element: Element, property: string): boolean {
+  return isRawValue(inlineValue(element, property))
+}
+
 /**
  * What the element states inline, else the value the browser settled on, so
  * an edit starts from what the operator sees.
  */
 function currentValue(element: Element, property: string): string {
-  const inline =
-    'style' in element
-      ? (element as HTMLElement).style.getPropertyValue(property)
-      : ''
+  const inline = inlineValue(element, property)
   if (inline) return inline
   return (
     element.ownerDocument.defaultView
@@ -223,6 +257,14 @@ function ElementFields({
                 isBusy={isBusy}
                 onCommit={commit(field.property)}
               />
+              {field.isColor && isRawInline(node, field.property) ? (
+                <span
+                  class="raw"
+                  title="Set as a raw value, so it will not follow the theme. Pick a token to fix it"
+                >
+                  raw
+                </span>
+              ) : null}
               {field.isColor ? (
                 <TokenPicker
                   label={field.label}

package/src/canvas/client/shell.css

@@ -490,6 +490,13 @@ code {
   cursor: pointer;
 }
 
+.raw {
+  flex: none;
+  align-self: center;
+  color: var(--color-text-secondary);
+  cursor: help;
+}
+
 .field:hover,
 .token-picker:hover {
   border-color: var(--color-muted);

package/src/canvas/tokens.ts

@@ -138,7 +138,15 @@ export function resolveFrameTokens(
   options: TokenOptions = {},
 ): FrameTokens {
   if (options.isOwnCheckout ?? isOwnCheckout(root)) {
-    return { source: 'toolkit', css: buildDesignCss() }
+    /*
+     * Faces embedded, since the type tokens name `Geist Variable` and a
+     * machine with only static Geist installed renders every frame in the
+     * fallback. An installed base owns its fonts, so that branch gets none.
+     */
+    return {
+      source: 'toolkit',
+      css: buildDesignCss(undefined, { embedFonts: true }),
+    }
   }
 
   const files = installedFiles(root)

package/src/commands/canvas.ts

@@ -20,6 +20,7 @@ import {
   STYLE_PROPERTIES,
 } from '@/canvas/edit'
 import { CANVAS_PORT, startCanvas } from '@/canvas/server'
+import { PROJECT_ROOT } from '@/project-root'
 import { resolveFrameTokens } from '@/canvas/tokens'
 import { displayPath, parsePort, waitForInterrupt } from '@/serve/report'
 import {
@@ -49,9 +50,35 @@ interface Refused {
     | 'no-root'
     | 'no-server'
     | 'capture-failed'
+    | 'missing-client-deps'
   readonly detail: string
 }
 
+const CLIENT_DEPS = ['preact', '@preact/signals'] as const
+
+/**
+ * Refuses when the shell's client packages do not resolve from `from`, since
+ * the bundler then answers `/` with an empty page rather than an error. The
+ * caller passes the package root the binary runs from, never the served
+ * project's, so a global install serving a target finds its own copies.
+ */
+export function missingClientDeps(from: string): Refused | undefined {
+  const missing = CLIENT_DEPS.filter((name) => {
+    try {
+      Bun.resolveSync(name, from)
+      return false
+    } catch {
+      return true
+    }
+  })
+  if (missing.length === 0) return undefined
+  return {
+    ok: false,
+    reason: 'missing-client-deps',
+    detail: `${missing.join(', ')} not installed in ${from}, so the canvas shell cannot load. Run bun install there`,
+  }
+}
+
 type RootOutcome = { readonly ok: true; readonly root: string } | Refused
 
 /**
@@ -637,6 +664,8 @@ async function runServe(
     return refuseServe(resolved.reason, resolved.detail, emitJson)
   }
   const { root } = resolved
+  const missing = missingClientDeps(PROJECT_ROOT)
+  if (missing) return refuseServe(missing.reason, missing.detail, emitJson)
   /*
    * Imported here rather than at the top, so a command module the test runner
    * loads never asks it for an HTML module it cannot parse.

package/src/design/budget.ts

@@ -0,0 +1,149 @@
+/**
+ * The prose budget `standards/design.md` sets for a design record, and the
+ * counter the `design` gate stage reads it through.
+ *
+ * The limits live here and in the standard, never in the stage, so the stage
+ * names a failure without restating what it measured against.
+ *
+ * A row is excluded on the same test `table()` in `@/design/parse` reads one
+ * by, a line opening with a pipe, so a code span carrying a pipe or a cell
+ * carrying the uncertainty tag never reaches the count. A line opening with
+ * `<` is dropped the way `prose()` drops it, and so is a fenced block or an
+ * HTML comment spanning several lines, which `prose()` would read in part. A
+ * `###` subsection counts toward the `##` section holding it, since the
+ * standard fixes the sections and a subheading is no way past the cap.
+ */
+export const DESIGN_BUDGET = {
+  /** Words before the first `##` section, the title excluded. */
+  leadWords: 40,
+  /** Words in `## Personality`, held to one paragraph. */
+  personalityWords: 60,
+  personalityParagraphs: 1,
+  /** Bullets or paragraphs in any other section, beside its table. */
+  rules: 3,
+  /** Words in one of those rules, the proxy for one line. */
+  ruleWords: 25,
+} as const
+
+const PERSONALITY = 'Personality'
+
+/** A list item at any depth, which starts a rule of its own. */
+const BULLET = /^\s*(?:[-*+]|\d+[.)])\s+/
+
+interface Section {
+  readonly heading: string | undefined
+  readonly lines: readonly string[]
+}
+
+/**
+ * Every place the record exceeds the budget, one sentence each, in document
+ * order. An empty list is a record within budget, including an empty one.
+ */
+export function measureDesignProse(source: string): string[] {
+  const findings: string[] = []
+
+  for (const section of splitSections(source)) {
+    const rules = readRules(section.lines)
+    const total = rules.reduce((sum, rule) => sum + rule, 0)
+
+    if (section.heading === undefined) {
+      if (total > DESIGN_BUDGET.leadWords) {
+        findings.push(
+          `The lead holds ${total} words against a cap of ${DESIGN_BUDGET.leadWords}`,
+        )
+      }
+    } else if (section.heading === PERSONALITY) {
+      if (rules.length > DESIGN_BUDGET.personalityParagraphs) {
+        findings.push(
+          `${PERSONALITY} holds ${rules.length} paragraphs against a cap of ${DESIGN_BUDGET.personalityParagraphs}`,
+        )
+      }
+      if (total > DESIGN_BUDGET.personalityWords) {
+        findings.push(
+          `${PERSONALITY} holds ${total} words against a cap of ${DESIGN_BUDGET.personalityWords}`,
+        )
+      }
+    } else {
+      if (rules.length > DESIGN_BUDGET.rules) {
+        findings.push(
+          `${section.heading} holds ${rules.length} rules against a cap of ${DESIGN_BUDGET.rules}`,
+        )
+      }
+      rules.forEach((words, index) => {
+        if (words > DESIGN_BUDGET.ruleWords) {
+          findings.push(
+            `${section.heading} rule ${index + 1} holds ${words} words against a cap of ${DESIGN_BUDGET.ruleWords}`,
+          )
+        }
+      })
+    }
+  }
+
+  return findings
+}
+
+/** The lead under an undefined heading, then each `##` section in order. */
+function splitSections(source: string): Section[] {
+  const sections: { heading: string | undefined; lines: string[] }[] = [
+    { heading: undefined, lines: [] },
+  ]
+  for (const line of source.split('\n')) {
+    const match = line.match(/^##\s+(.+?)\s*$/)
+    if (match) {
+      sections.push({ heading: match[1], lines: [] })
+    } else if (!/^#\s/.test(line)) {
+      sections[sections.length - 1].lines.push(line)
+    }
+  }
+  return sections
+}
+
+/**
+ * The word count of each rule in a section. A rule opens on a bullet or on
+ * the first prose line after a break, and every following prose line joins it
+ * until a blank line, a table row, a heading, or the next bullet.
+ */
+function readRules(lines: readonly string[]): number[] {
+  const rules: number[] = []
+  let isOpen = false
+  let isFenced = false
+  let isCommented = false
+
+  for (const line of lines) {
+    const trimmed = line.trim()
+    if (isCommented) {
+      isCommented = !trimmed.includes('-->')
+      continue
+    }
+    if (trimmed.startsWith('<!--')) {
+      isCommented = !trimmed.includes('-->', 4)
+      isOpen = false
+      continue
+    }
+    if (trimmed.startsWith('```')) {
+      isFenced = !isFenced
+      isOpen = false
+      continue
+    }
+    if (
+      isFenced ||
+      trimmed === '' ||
+      trimmed.startsWith('|') ||
+      trimmed.startsWith('#') ||
+      trimmed.startsWith('<')
+    ) {
+      isOpen = false
+      continue
+    }
+    const text = trimmed.replace(BULLET, '')
+    const count = text.split(/\s+/).filter(Boolean).length
+    if (BULLET.test(line) || !isOpen) {
+      rules.push(count)
+      isOpen = true
+    } else {
+      rules[rules.length - 1] += count
+    }
+  }
+
+  return rules
+}

package/src/design/document.ts

@@ -88,6 +88,20 @@ function borderRows(tokens: readonly BorderToken[]): string[][] {
   })
 }
 
+/**
+ * The lead a reader meets before the first section. It points at the module
+ * and at the context entry, since the record carries values and one-line rules
+ * and every reason behind them lives in the entry.
+ */
+const LEAD = [
+  'Authoring guidance: `standards/design.md`. Rendered from `src/design/tokens.ts` by `canon design regen`, so edit the module and never this file.',
+  'Why each value was chosen lives in `canon/context/design/tokens.md`.',
+].join(' ')
+
+function bullets(rules: readonly string[]): string {
+  return rules.map((rule) => `- ${rule}`).join('\n')
+}
+
 function section(heading: string, ...blocks: string[]): string {
   return [`## ${heading}`, ...blocks.filter((block) => block !== '')].join(
     '\n\n',
@@ -98,21 +112,19 @@ export function renderDesignDocument(tokens: DesignTokens = TOKENS): string {
   const body = [
     '# Design',
     '',
-    'Authoring guidance: `standards/design.md`.',
-    '',
-    tokens.preamble,
+    LEAD,
     '',
     section('Personality', tokens.personality),
     '',
     section(
       'Color',
-      tokens.colorNote,
+      bullets(tokens.colorRules),
       formatTable(['Role', 'Intent', 'Value'], colorRows(tokens.color)),
     ),
     '',
     section(
       'Typography',
-      tokens.typographyNote,
+      bullets(tokens.typographyRules),
       formatTable(
         ['Role', 'Family', 'Weight', 'Size', 'Line height'],
         typeRows(tokens.typography),
@@ -121,24 +133,24 @@ export function renderDesignDocument(tokens: DesignTokens = TOKENS): string {
     '',
     section(
       'Spacing',
-      tokens.spacingNote,
+      bullets(tokens.spacingRules),
       formatTable(['Step', 'Multiplier', 'Value'], spaceRows(tokens.spacing)),
     ),
     '',
     section(
       'Borders',
-      tokens.bordersNote,
+      bullets(tokens.bordersRules),
       formatTable(
         ['Role', 'Radius', 'Width', 'When used'],
         borderRows(tokens.borders),
       ),
     ),
     '',
-    section('Layout', tokens.layout),
+    section('Layout', bullets(tokens.layout)),
     '',
-    section('Motion', tokens.motion),
+    section('Motion', bullets(tokens.motion)),
     '',
-    section('Iconography', tokens.iconography),
+    section('Iconography', bullets(tokens.iconography)),
   ]
 
   return `${body.join('\n')}\n`

package/src/design/render.ts

@@ -328,7 +328,17 @@ function sectionBorders(rows: Row[]): string {
   return `<h2>Borders</h2>\n<table><thead><tr><th>Role</th><th>Radius</th><th>Width</th><th>When used</th><th>Sample</th></tr></thead><tbody>${body}</tbody></table>`
 }
 
+/** A section the record writes as one-line rules draws them as a list. */
+const BULLET = /^[-*+]\s+/
+
 function sectionLine(title: string, text: string): string {
   if (!text) return ''
-  return `<h2>${title}</h2>\n<p>${escape(text)}</p>`
+  const lines = text.split('\n')
+  if (!lines.every((line) => BULLET.test(line))) {
+    return `<h2>${title}</h2>\n<p>${escape(text)}</p>`
+  }
+  const items = lines
+    .map((line) => `<li>${escape(line.replace(BULLET, ''))}</li>`)
+    .join('')
+  return `<h2>${title}</h2>\n<ul>${items}</ul>`
 }

package/src/design/tokens.ts

@@ -59,21 +59,25 @@ export interface BorderToken {
   readonly verify?: readonly ('radius' | 'width')[]
 }
 
+/**
+ * Every prose slot is a list of one-line rules rather than a string, so a
+ * bullet is the unit the renderer emits and the prose budget counts, and a
+ * value needing a paragraph of why goes to `canon/context/design/tokens.md`.
+ */
 export interface DesignTokens {
   readonly personality: string
   readonly color: readonly ColorToken[]
-  readonly colorNote: string
+  readonly colorRules: readonly string[]
   readonly typeScale: readonly TypeStep[]
   readonly typography: readonly TypeToken[]
-  readonly typographyNote: string
+  readonly typographyRules: readonly string[]
   readonly spacing: readonly SpaceToken[]
-  readonly spacingNote: string
+  readonly spacingRules: readonly string[]
   readonly borders: readonly BorderToken[]
-  readonly bordersNote: string
-  readonly layout: string
-  readonly motion: string
-  readonly iconography: string
-  readonly preamble: string
+  readonly bordersRules: readonly string[]
+  readonly layout: readonly string[]
+  readonly motion: readonly string[]
+  readonly iconography: readonly string[]
 }
 
 /** The monospace stack, taken by code and by the terminal frames a page embeds. */
@@ -94,35 +98,14 @@ const DARK_GROUNDS = ['background', 'surface'] as const
 const LIGHT_GROUNDS = ['light-background', 'light-surface'] as const
 
 export const TOKENS: DesignTokens = {
-  preamble: [
-    'This document is rendered from `src/design/tokens.ts` by `canon design regen`, and the `design` stage of `bun run check` fails when the two disagree. Edit the module, never this file.',
-    '',
-    'The values below are the system rather than a reading of one. Until 2026-09-01 this record transcribed two surfaces and agreed with nothing else, which is what made a change to it reach nobody. The slide theme, the token preview, and a teach workspace stylesheet now read the module this file is rendered from, so a value changed there changes what all three render.',
-    '',
-    'The two rendered captures read it as well. `scripts/core/regen-hero.ts` fills `assets/captures/hero.html.tmpl` and `assets/captures/install.html.tmpl` with what `canon design css --no-components` emits, so both frames now carry the custom properties rather than their own copies of the hex, and a value moved here moves what the next capture renders.',
-    '',
-    'The terminal framing is the one surface left holding its own values, and that is a decision rather than a gap. `scripts/lib/ui.sh` and `src/ui.ts` each spell six escape constants, and `canon/context/scripts/framing.md` records one color source per language with a check behind each, so generating a third spelling from here would break the rule those two checks enforce. What the record is still incomplete about is the other half of those six: `WHITE` and `GREY` name no role below, so the terminal palette is described here in part rather than in whole.',
-  ].join('\n'),
-
-  personality: [
-    'Warm neutrals carry the frame under a single rust accent, set in Geist. The subject is a toolkit for people who read documents and diffs as much as they run commands, so the voice is a proportional one and the page reads as prose. One accent carries every count, link, and primary action. Promoting a second and third into structural roles is what reads as a generated interface, so the palette stays at one.',
-    '',
-    'Monospace is a role the page uses rather than its voice. The `code` role takes it, and so does any terminal frame a surface embeds, since those show what the shell printed and matching the shell is what makes them legible. Every other role is Geist.',
-  ].join('\n'),
+  personality:
+    'Warm neutrals under one rust accent, set in Geist. The page reads as prose, and monospace appears only where a surface shows what a shell printed. One accent carries every count, link, and primary action.',
 
-  colorNote: [
-    'Every role clears WCAG AA at 4.5:1 against each ground it declares, asserted in `src/design/contrast.test.ts`.',
-    '',
-    'Warning and error hold ANSI codes because that is what `scripts/lib/ui.sh` writes and no rendered surface implements an equivalent. Giving either a hex value would invent a mapping no file has, so they carry no contrast reading either.',
-    '',
-    'Success is the one of the three that does have a rendered equivalent, which is why it carries a hex. `assets/captures/install.html` marks every confirmed step with it, and the shell writes `ANSI 32` for the same role, so the two are one role in two registers rather than one value in two spellings. The hex is what the rendered surface picked and no reading claims the terminal renders that value. It declares `background` alone as its ground, since that is the only role it is drawn on, where every other dark text role is drawn on both. It is the one role below that is not derived.',
-    '',
-    "Every other role is derived rather than picked, solved in OKLCH by binary search for the lightness that hits a target contrast against its ground, using this module's own anchors. Six anchors are the whole system: ground lightness 0.985 light and 0.165 dark, neutral chroma 0.003 light and 0.004 dark, neutral hue 90 both, accent hue 22 light and 28 dark, accent chroma 0.13 light and 0.12 dark for a mark and 0.095 light and 0.09 dark for a fill. Only the mark step is rendered below, in `accent`. That token already stands in for a fill in practice: `assets/captures/hero.html`'s `.cmd` rule paints its whole background with `var(--color-accent)` and sets text on top, which is a fill use rather than a mark one. The fill chroma step has no token of its own yet, so a lower-saturation `accent-fill` would recolor that button rather than introduce a new consumer. Targets, which are inputs rather than results: text 13.5, body 8.6, secondary 5.6, muted 4.6, accent 5.2. Dark is its own anchor set rather than an inversion of light, and every arm measured in the groundwork behind this landed on identical neutral ratios, which is what made the accent choice a question about hue alone.",
-    '',
-    '`muted` and `light-muted` solve against `surface` rather than `background`. Both declare two grounds and the groundwork solved its target against one, so the recorded hex cleared 4.6 against `background` and read 4.40 dark, 4.24 light against `surface`, the tighter of the two since surface sits a step closer to its text color. The values here are re-solved for the same 4.6 target read against `surface` instead, which clears both: 4.58 dark, 4.56 light against `surface`, and 4.80 dark, 4.95 light against `background`.',
-    '',
-    'The accent is a quiet red at hue 22 light, 28 dark, chosen over a vivid red that read as an error state against a page reporting success, over indigo which carries less distinctiveness at hue 280 in tooling already dominated by that hue, and over rust at hue 42, a larger temperature shift than the problem required. The debt this accepts: `error` and `warning` now share a register with the most repeated element on every rendered surface, so both need differentiating by lightness or by an icon rather than by hue, and that work is unscheduled.',
-  ].join('\n'),
+  colorRules: [
+    'One accent. Never promote a second color into a structural role.',
+    'Every text role clears WCAG AA at 4.5:1 against each ground it is drawn on.',
+    '`warning` and `error` exist only in the terminal, as ANSI codes.',
+  ],
 
   color: [
     {
@@ -242,15 +225,11 @@ export const TOKENS: DesignTokens = {
     },
   ],
 
-  typographyNote: [
-    'Seven sizes are on offer, named `t0` through `t6` and emitted as custom properties beside the roles. They are 3.175, 2.375, 1.375, 1.125, 0.9375, 0.8125 and 0.6875 rem, which paint at 50.8, 38, 22, 18, 15, 13 and 11 pixels, and each role takes one. A step answers what sizes exist and a role answers what a stylesheet asks for, so the two stay separate: a role whose step did not move renders as it did, and a role that moved is the only thing that changes what a surface paints. Two steps, `t3` at 18 pixels and `t6` at 11, are offered with no role pointing at them yet.',
-    '',
-    'Every role but `code` is Geist and `code` is monospace. The hero headline takes the largest step at 50.8 pixels, which no other role reaches, since a headline set at the display cap reads as an opening rather than as a section heading.',
-    '',
-    'A tagged cell is one no rendering surface exercises yet, which is a declaration the system has not tested rather than one it has.',
-    '',
-    'Two rules set tracking and no others touch it. The label role carries `0.05em`, and the display role tightens to `-0.01em`.',
-  ].join('\n'),
+  typographyRules: [
+    'Geist for every role except `code`, which is monospace.',
+    'Tracking: `label` at `0.05em`, `display` at `-0.01em`, nothing else.',
+    'Sizes come from seven steps, `t0` to `t6`. A role takes one step.',
+  ],
 
   typeScale: [
     { step: 't0', size: '3.175rem' },
@@ -312,11 +291,9 @@ export const TOKENS: DesignTokens = {
     },
   ],
 
-  spacingNote: [
-    'Seven steps run from a quarter rem to six, at 4, 8, 14, 24, 40, 64 and 96 pixels on a 16 pixel root. The scale is not a grid of one base, since the 14 between the 8 and the 24 is the step a control needs and no multiple of four supplies it, so the multiplier column counts quarter rems rather than claiming a unit.',
-    '',
-    'The outer window padding of the capture frames, which the previous record carried as a three-value frame register, is not part of the scale. Those frames set their own padding in the template and read no step, so the register is retired here rather than mapped onto steps no frame uses.',
-  ].join('\n'),
+  spacingRules: [
+    'Seven steps. `md` sits at 3.5 because a control needs 14 pixels.',
+  ],
 
   spacing: [
     { step: 'xs', multiplier: '1', value: '0.25rem' },
@@ -328,9 +305,9 @@ export const TOKENS: DesignTokens = {
     { step: '3xl', multiplier: '24', value: '6rem' },
   ],
 
-  bordersNote: [
-    'Every border is one pixel solid at the `border` role, and that value appears in no text role. Three radii appear, and the two blocks carrying the largest and smallest have no border at all, so radius and width are independent here rather than paired. Nothing renders a pill, so both of its cells stay tagged.',
-  ].join('\n'),
+  bordersRules: [
+    'Every border is one pixel solid in `border`. Radius and width are independent.',
+  ],
 
   borders: [
     {
@@ -372,17 +349,19 @@ export const TOKENS: DesignTokens = {
     },
   ],
 
-  layout:
-    'Capture widths are 320, 768, 1280 and 1536 pixels, declared once in `tooling/web/configs/e2e/screenshot.ts`, with 320 and 1280 committed as evidence. 320 is the reflow floor. Every range the width queries in the generated base and teach stylesheets lay out holds at least one of these widths, so a capture photographs every layout state those stylesheets have, and a design test fails when a query moves or is added so that it opens a range none of them reaches. The landing page under `web/` sets its own `max-width` media queries between 430 and 1100 pixels per component rather than from a shared scale.',
+  layout: [
+    'Capture widths: 320, 768, 1280, 1536. 320 is the reflow floor.',
+    'Every width query in the generated stylesheets opens a range one of these widths reaches.',
+  ],
 
-  motion:
-    'Motion is not used. No transition, animation, or keyframe declaration appears on any rendered surface, and the capture pipeline screenshots a static frame.',
+  motion: [
+    'None. No transition, animation, or keyframe on any rendered surface.',
+  ],
 
   iconography: [
-    'No icon library is installed. `assets/brand/mark.svg` is the one authored icon, embedded inline in the hero topbar, and the surfaces otherwise draw literal glyph characters: `│ ├ ✓ ! ✗ + - ◆ ◇ ❯` for the terminal framing.',
-    '',
-    'The same mark ships in five independently-maintained copies that carry different colors by design rather than by drift, each fitted to the chrome it renders on: the dark accent for a dark-chrome surface, the light accent for a light-chrome one, and the pair the web favicon takes from `src/design/favicon.ts`, which teach pages also take by rendering the live mark. Unifying them or repairing the one that looks drifted would break the fit each was chosen for. `canon/context/design/tokens.md` carries which file holds each copy.',
-  ].join('\n'),
+    'No icon library. `assets/brand/mark.svg` is the one authored icon.',
+    'The terminal draws glyphs: `│ ├ ✓ ! ✗ + - ◆ ◇ ❯`.',
+  ],
 }
 
 /** A role's value, or `undefined` where the record declares no such role. */

package/src/gate/measures.ts

@@ -22,6 +22,8 @@ import {
   PRACTICE_SKILLS,
   SHIPPED_CORPUS,
 } from '@/claude/skills-audit'
+import { measureDesignProse } from '@/design/budget'
+import { DESIGN_DOCUMENT } from '@/design/regen'
 import { listRepositoryFiles } from '@/git-files'
 import { ceilingFindings } from '@/markdown/ceiling'
 import { resolveMarkdown } from '@/markdown/files'
@@ -325,6 +327,53 @@ export const canonicalRecords: Measure = async (ctx) => {
   return { emissions }
 }
 
+/**
+ * The design records this repository holds, each read against the prose
+ * budget in `@/design/budget`. The worked example is read beside the record,
+ * since it is the one a target copies its shape from.
+ */
+const DESIGN_RECORDS = [
+  DESIGN_DOCUMENT,
+  join('examples', 'design', 'DESIGN.md'),
+] as const
+
+export const designProse: Measure = async (ctx) => {
+  const failures: string[] = []
+  const emissions: Emission[] = []
+
+  for (const rel of DESIGN_RECORDS) {
+    const path = join(ctx.root, rel)
+    if (!existsSync(path)) continue
+    let source: string
+    try {
+      source = readFileSync(path, 'utf8')
+    } catch {
+      return {
+        emissions: [],
+        unmeasured: `${rel} could not be read, so its prose was not counted.`,
+      }
+    }
+    const findings = measureDesignProse(source)
+    if (findings.length > 0) {
+      failures.push(
+        `${findings.map((finding) => `${finding} in ${rel}`).join('. ')}.`,
+      )
+    } else {
+      emissions.push(info(`${rel} within the prose budget`))
+    }
+  }
+
+  if (failures.length > 0) {
+    return {
+      emissions: [],
+      failure: `${failures.join(' ')} Cut to the budget in standards/design.md, moving the why to the context entry.`,
+    }
+  }
+  if (emissions.length === 0)
+    emissions.push(info('No design record to measure'))
+  return { emissions }
+}
+
 /**
  * Every skill body and reference against the no-dated-provenance rule, across
  * both corpora `auditSkills` reads.

package/src/gate/stages.ts

@@ -10,6 +10,7 @@ import {
   auditSet,
   captureStamps,
   clientCommandCitations,
+  designProse,
   documentCeiling,
   folderEchoedNames,
   markdownBans,
@@ -234,7 +235,9 @@ export const STAGES: readonly Stage[] = [
     // from `src/design/tokens.ts`, the base stylesheet from
     // `src/design/neutral.ts`, and none is edited by hand. Four artifacts
     // from two token sources is the cost of the token move, and a render step that has to run is only safe while something fails
-    // when it did not, which is this.
+    // when it did not, which is this. The record and the worked example are
+    // then counted against the prose budget, which the drift asserts cannot
+    // see since a regenerated paragraph agrees with its source.
     id: 'design',
     label: 'Design',
     checks: [
@@ -277,6 +280,7 @@ export const STAGES: readonly Stage[] = [
         failure:
           'The tab icon drifted from the token source. Run bun run check and commit web/public/favicon.svg.',
       },
+      { kind: 'measure', measure: designProse },
     ],
     success: 'Design source clean',
   },

package/standards/design.md

@@ -33,10 +33,20 @@ Does not govern:
 
 ## Format
 
-- Use tables for token systems, one row per token. Use short bullets for component rules, one decision per line.
+- Use tables for token systems, one row per token. Write every other rule as a short bullet, one decision per line, within `## Prose budget`.
 - Plain English over technical notation. If a section could be removed and the developer would still build correctly from wireframes and code alone, remove it.
 - Keep table headers and role names intact so the render tooling can parse the token tables.
 
+## Prose budget
+
+The record is a lookup, so its prose stays short enough to scan beside the tables. Why a value was chosen belongs in the project's context entry for design, never here.
+
+- Personality: one paragraph of at most 60 words
+- Any other section: at most 3 rules beside its table, each at most 25 words. A bullet is one rule, and so is a paragraph.
+- The lead before the first section: at most 40 words
+
+Headings and table rows are never counted, and a section holding a table and no rules is within budget. A bullet wrapping over several lines counts as one rule, and a nested bullet counts as its own.
+
 ## The uncertainty tag
 
 A cell no source anchors ends in ` ? verify`, written inside the cell rather than as a trailing column, since a trailing marker breaks the table parse. A cell wrapping itself in a code span carries the tag inside the span, as in `` `#ffffff ? verify` ``. Both spellings parse.
@@ -93,9 +103,9 @@ The column headers are the strings the renderer parses, read by exact key, so th
 
 ## Motion
 
-<whether motion is used at all, and if so the default duration and easing>
+- <whether motion is used at all, and if so the default duration and easing>
 
 ## Iconography
 
-<style, source library, and whether custom icons are allowed>
+- <style, source library, and whether custom icons are allowed>
 ```

package/tooling/claude/seeds/.claude/hooks/scratch-guard.sh

@@ -57,5 +57,5 @@ marker="$marker_dir/$key"
 mkdir -p "$marker_dir"
 : >"$marker"
 
-msg='Temporary file write outside the project scratch folder. Write temp files to .canon/tmp/<slug>/ in the project root, or .claude/.tmp/<slug>/ where the project carries no .canon/ root, not system temp. See the Scratch rule (604-scratch, under canon/ in your installed governance rules).'
+msg='Temporary file write outside the project scratch folder. Write temp files to .canon/tmp/<slug>/ in the project root, not system temp. See the Scratch rule (604-scratch, under canon/ in your installed governance rules).'
 jq -nc --arg msg "$msg" '{hookSpecificOutput:{hookEventName:"PreToolUse",additionalContext:$msg}}'