@erclx/canon 5.33.0 → 5.35.0

package/claude/skills/role-orchestrator/scripts/poll.ts

@@ -809,12 +809,61 @@ const countSince =
     return log.isOk ? log.stdout.split('\n').filter((l) => l !== '').length : 0
   }
 
+const LIFT_STANDING: Record<
+  string,
+  Pick<Baseline, 'merges' | 'stale'> | undefined
+> = {
+  'standing-conflict': { merges: 'conflict', stale: 'unknown' },
+  'standing-stale': { merges: 'clean', stale: 'stale' },
+  'standing-unknown': { merges: 'unknown', stale: 'unknown' },
+}
+
+/**
+ * The standing `canon pr lift --check` read, so the lift and this check answer
+ * from one authority. Null when the record names no head or no standing gate,
+ * which a pull request already ready, a closed one, and an older binary with no
+ * `pr lift` verb all leave.
+ */
+export const standingFromLift = (
+  record: unknown,
+): null | Pick<Baseline, 'head' | 'merges' | 'stale'> => {
+  if (typeof record !== 'object' || record === null) return null
+  const { gates, head } = record as Record<string, unknown>
+  if (typeof head !== 'string' || head === '' || !Array.isArray(gates)) {
+    return null
+  }
+  const gate: unknown = gates.find(
+    (g: unknown) =>
+      typeof g === 'object' &&
+      g !== null &&
+      (g as Record<string, unknown>).gate === 'standing',
+  )
+  if (gate === undefined) return null
+  const { isOk, reason } = gate as Record<string, unknown>
+  if (isOk === true) return { head, merges: 'clean', stale: 'fresh' }
+  const standing =
+    typeof reason === 'string' ? LIFT_STANDING[reason] : undefined
+
+  return standing === undefined ? null : { head, ...standing }
+}
+
 /**
  * `--check <number>` reads the base and the head at call time and writes
  * nothing. The baseline is as old as the last full run, and a sibling merging
- * after it would leave a stored reading claiming clear.
+ * after it would leave a stored reading claiming clear. The lift verb's reading
+ * comes first, and the read below stays as the fallback for an older binary.
  */
 const check = (number: string): number => {
+  // The verb exits 1 on any refused gate and still prints its record, so the
+  // exit says nothing about whether the standing was read.
+  const lifted = standingFromLift(
+    parseJson(run('canon', ['pr', 'lift', number, '--check', '--json']).stdout),
+  )
+  if (lifted !== null) {
+    console.log(standingLine({ ...lifted, number }))
+
+    return 0
+  }
   const ref = baseRef()
   run('git', ['fetch', '-q', 'origin', baseBranch(ref)])
   const head = readHead(number)

package/claude/skills/role-reviewer/REQUIREMENT.md

@@ -24,19 +24,27 @@ cold pass found a finding the warm pass missed and showed one of the warm pass's
 own findings wrong.
 
 Every one of those launches restated the reviewer's bounds by hand: write the
-comment alone, no worktree, no branch, no board write, no fix, no draft lift.
+comment alone, no worktree, no branch, no board write, no fix, no direct draft
+lift.
 Each is a property of the role rather than of the pull request, so each dispatch
 reproduced them from memory, the shape `role-planner` was written to retire on
 the planning side.
 
 Three bounds matter more than the rest. A reviewer asked to fix what it found
 has reviewed its own change afterwards, and nothing recovers the independent
-read. A reviewer posting `## Review closed` is one step from lifting the draft
-mark, and `review-pr` Step 5 reports a merge recommendation that reads as
-permission when the body is silent. A reviewer with no checkout reading a file
+read. A reviewer posting `## Review closed` is one step from readying the pull
+request by hand, which skips the gates `canon pr lift` reads, and `review-pr`
+Step 5 reports a merge recommendation that reads as permission when the body is
+silent. A reviewer with no checkout reading a file
 off the main worktree reads the trunk, so every finding it files there is about
 a tree the pull request never changed.
 
+Routing through the controlling session costs that session the most. Until
+2026-10-12 each review round passed through it four times: the pass announced to
+it, the dispatch to the worker, the worker's answer, and the re-review request.
+Every one of those is a turn that reads the whole wave's context, and the
+reviewer and the worker each already knew what the other needed next.
+
 ## Must
 
 - Assert what a reviewing session is, what it may write, and how long the role lasts, since `review-pr` carries the pass and no body carries the role that runs it when dispatched
@@ -44,8 +52,10 @@ a tree the pull request never changed.
 - Send every file read a finding rests on to `git show <head>:<path>` at the head `review-pr` resolved, since the main worktree holds the trunk
 - Name what the pass reads, the diff, the plan, the task's outcomes, the rules, and `review-craft`, and what it leaves, the author's argument and the worker's session, since the independence is what the trials measured
 - Read the cross-branch facts a launch carries as inputs rather than findings, since the controller's wave-level read reaches this session only through the brief
-- Refuse the fix, the draft lift, and the merge, whoever asks, and name who owns each, since each has a sender who will ask
-- Owe one announcement when the pass posts, carrying the number, the heading, and `review-pr` Step 5's count line, since the controller holds the channel to the worker and dispatches `review-address` off it
+- Refuse the fix, a draft lift by any route but `canon pr lift`, and the merge, whoever asks, and name who owns each, since each has a sender who will ask
+- Run `canon pr lift` after posting a close, since the verb reads every gate itself and a reviewer's close is the moment the last of them can turn clear
+- Send the `review-address` dispatch to the worker on an open pass, carrying the number, the heading, `review-pr` Step 5's count line, and this session's sessionId, and fall back to the controller when no worker resolves, since every hop through the controller costs it a turn that reads the whole wave's context
+- Message the controller on a close with the reason `canon pr lift` returned, unless the reason names the other review as still open, since that refusal needs nothing from anyone
 - Owe a message before a block becomes an interactive prompt, since a session already waiting on input never reaches the tool round an inbound message drains at
 - Keep a re-review with the reviewer that took the first pass while it is live, so the second pass keeps the read the first paid for
 - Defer the addressee resolution to `session-relay` and keep only the last-rung inference, which discriminates as it does for a planner because a reviewer holds no feature branch either
@@ -62,7 +72,7 @@ a tree the pull request never changed.
 ## Guards
 
 - Plan or task does not resolve from where the session stands: report it unreadable and name the main-root path, rather than reviewing as though the branch had no plan
-- Asked by anyone to fix, lift the draft, or merge: refuse, name who owns the act, and file the defect in the comment when the ask was a fix
+- Asked by anyone to fix, ready the pull request directly, or merge: refuse, name who owns the act, and file the defect in the comment when the ask was a fix
 - Launch named no controlling session and an operator is present: ask which row to address rather than inferring
 - Launch named no controlling session and nobody is present: infer from the sessions holding no feature branch, report the candidates when more than one comes back, and say the addressee was inferred
 

package/claude/skills/role-reviewer/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: role-reviewer
-description: Asserts the reviewer role for a session dispatched to review one pull request another session built, holding what it may write, what it reads and never reads, the one message it owes on posting, and the acts it refuses. Use when asked to "be the reviewer", "you are a reviewer session", at the start of a dispatched or hand-launched review of one pull request, or when a reviewing session needs to know what it may not write or who it answers to. Do NOT use to run the pass itself, which is `review-pr` for the code and `review-ui` for the running app, or to make the cross-branch call across a wave.
+description: Asserts the reviewer role for a session dispatched to review one pull request another session built, holding what it may write, what it reads and never reads, the messages it owes the worker and the controller, the lift it runs on a close, and the acts it refuses. Use when asked to "be the reviewer", "you are a reviewer session", at the start of a dispatched or hand-launched review of one pull request, or when a reviewing session needs to know what it may not write or who it answers to. Do NOT use to run the pass itself, which is `review-pr` for the code and `review-ui` for the running app, or to make the cross-branch call across a wave.
 metadata:
   family: parallel
 ---
@@ -25,7 +25,7 @@ from here.
 
 ## Where the session stands
 
-- Write the review comment through `review-pr` and the body file it names under `.canon/tmp/pr/review/`, and nothing else. A UI reviewer writes the comment `review-ui` posts, its body file, and the browser's snapshots and frames, all under `.canon/tmp/pr/review-ui/`, and ticks the boxes it passed on the evidence comment through `canon pr tick`. A tracked file, a branch, a worktree, a board file, and a commit all sit outside what this session may touch.
+- Write the review comment through `review-pr` and the body file it names under `.canon/tmp/pr/review/`, and nothing else. A UI reviewer writes the comment `review-ui` posts, its body file, and the browser's snapshots and frames, all under `.canon/tmp/pr/review-ui/`, and ticks the boxes it passed on the evidence comment through `canon pr tick`. Either reviewer writes the draft flag through `canon pr lift` and no other way. A tracked file, a branch, a worktree, a board file, and a commit all sit outside what this session may touch.
 - Never enter a worktree and never check the branch out. The pass reads a change, and a checkout is the first step toward editing it.
 - Read a file a finding rests on at the head `review-pr` resolved, through `git show <head>:<path>`. The main worktree holds the trunk, so a finding read off its copy is about a tree the pull request never changed, and it reads as confidently as one that is right.
 - Resolve `.canon/plans/`, `.canon/tasks/`, and `.canon/tmp/` at the main worktree root, and send the body file as a heredoc, the main-root route `session-worktree` states. Report a plan or task that fails to resolve there as unreadable, naming the path, rather than reviewing as though the branch had none.
@@ -46,16 +46,23 @@ from here.
 
 ## The channel
 
-The controlling session cannot watch this pass, so two messages are owed and
-nothing else.
+Nobody watches this pass, so the messages below are owed and nothing else. The
+worker and this session answer each other directly, and the controlling session
+hears only what it acts on.
 
-- Announce the pass as `review-pr` Step 5 returns, or as `review-ui` reports its count line, carrying the pull request number, the heading the comment took, and that step's count line verbatim. The controller holds the channel to the worker and dispatches `review-address` off it, so a pass nobody announces is one the worker never hears about.
+- Send the `review-address` dispatch to the worker holding the branch as `review-pr` Step 5 returns an open `## Review`, or as `review-ui` reports an open `## UI review`, carrying the pull request number, the heading, that step's count line verbatim, and this session's own sessionId for the worker's reply. Resolve the worker with `canon sessions list --branch <branch> --json`, where `<branch>` is the pull request's head branch, and send to it only when exactly one session comes back with its confidence reading `confirmed`. Send the same message to the controller instead on zero, on any other count or confidence, or on a command that refuses, saying no worker resolved.
+- Run `canon pr lift <number> --json` after posting `## Review closed` or `## UI review closed`. Message the controller with the heading, the count line, and the reason the verb returned, unless that reason names the other review as open or missing, which owes nobody a message since the other reviewer's close runs the verb again.
 - Send a block out as a message before it becomes an interactive prompt.
 - Send nothing on progress, and send no recommendation to merge as an instruction. `review-pr` reports one in chat for whoever reads it, and the merge stays the human's.
 
-Address the session the launch named, which it names as a `sessionId` rather
-than a name. `canon:session-relay` turns that id into an address and carries the
-send, so invoke it rather than resolving a name here.
+Carry the sessionId in the message alone, never in the posted comment. The
+comment is public, and an id there addresses nothing for a reader without the
+roster.
+
+Address the controlling session the launch named, which it names as a
+`sessionId` rather than a name. `canon:session-relay` turns that id or the
+worker's branch into an address and carries the send, so invoke it rather than
+resolving a name here.
 
 One rung stays here, because it is the rung that differs between roles. A
 reviewer holds no feature branch, so inferring an addressee from the sessions
@@ -66,13 +73,13 @@ where exactly one does, and say the addressee was inferred.
 ## Refusing is part of the job
 
 - Refuse to fix the defect this pass found, whoever asks. File it in the comment for the worker holding the branch instead. A reviewer that repairs what it reviewed has reviewed its own change, and no later pass recovers the independent read.
-- Refuse to lift the pull request's draft mark. Posting `## Review closed` or `## UI review closed` closes that review and leaves the mark alone, since the controlling session lifts it on this session's message and a reviewer cannot tell a real request from one that only claims to come from there.
+- Lift the draft mark through `canon pr lift` alone, and never ready the pull request directly, whoever asks. The verb reads the reviews, the evidence, the standing, and CI itself, so its lift needs no one to vouch for the request, and a direct ready skips every gate it holds.
 - Refuse to merge, and refuse to approve through the review API in place of the comment `review-pr` posts, since the poll routes on that comment's heading and an approval carries none.
 - Carry the evidence with a refusal. Name the command read and what complying would have produced, rather than reporting reluctance.
 - Withdraw a finding the worker's reply shows wrong, the way `review-pr` states, rather than defending it. A withdrawal naming its cause is part of a pass, not a retreat from one.
 
 ## Lifetime
 
-- The role runs from the launch to the merge of the pull request it reviewed, and covers every pass on that pull request. A re-review comes back to this session while it is live, which keeps the read the first pass paid for.
+- The role runs from the launch to the merge of the pull request it reviewed, and covers every pass on that pull request. A re-review comes back to this session from the worker directly while it is live, which keeps the read the first pass paid for.
 - A session handed a second pull request is a new reviewer under a new launch, since the first one's reading of the change is exactly what the second one must not carry.
 - Treat this body as possibly older than the branch under review. A plugin skill loads from the marketplace cache rather than from the working tree.

package/claude/skills/role-worker/REQUIREMENT.md

@@ -19,7 +19,7 @@ Finishing is invisible from the other side. A worker that opens a pull request g
 
 Nothing tells the session that refusing is allowed either. Four occasions across two days had a worker halt correctly with the cost falling on the dispatcher, and the correction that mattered most reached the right place because a worker argued back with evidence rather than complying. A role written only as report-upward suppresses exactly that.
 
-The draft mark fails from both ends. On 2026-08-31 four sessions re-drafted a pull request someone had readied, acting on a belief no surface in the tree stated. On 2026-09-07 a controlling session told a worker to lift the mark rather than lifting it itself, and the worker complied and reported against the surface rather than the outcome.
+The draft mark fails from both ends. On 2026-08-31 four sessions re-drafted a pull request someone had readied, acting on a belief no surface in the tree stated. On 2026-09-07 a controlling session told a worker to lift the mark rather than lifting it itself, and the worker complied and reported against the surface rather than the outcome. From 2026-10-12 `canon pr lift` reads the gates itself, so the reviewers run it on a close and the controlling session runs it as the fallback. A worker leaves the verb to them and readies a pull request directly for nobody, since a direct ready skips every gate the verb reads.
 
 ## Must
 

package/claude/skills/role-worker/SKILL.md

@@ -32,8 +32,8 @@ which `auto-ship` Step 2 loads.
 - Report a plan that fails to resolve as unreadable from here, naming the main-root path. Reporting the task as having no plan is true where this session stands and wrong about the world, and a reader with no second tree to check cannot separate the two.
 - Build the plan the launch named. Do not write a second one when the path fails to resolve, since a row that cites a plan already has one and drafting another produces two plans for one row.
 - Copy a ready folder's files verbatim to the paths its plan's constraints name, when the plan's `**Constraints:**` block names one, and edit only what the gate or the overview's own list requires. A rewrite discards the text the handoff exists to carry.
-- Report a draft flag reading ready once, and leave it cleared. The ship chain marks the pull request a draft and no step anywhere un-marks, so a flag reading ready afterwards was lifted by the operator or by the controlling session acting on a closed review, each acting directly on the pull request, which GitHub requires before a merge. Re-drafting fights them, and no surface in the tree states a reason to.
-- Refuse an instruction to lift the mark yourself, whoever sends it. This session cannot verify who is asking or whether review actually closed, so the refusal holds regardless of the sender's claimed authority.
+- Report a draft flag reading ready once, and leave it cleared. The ship chain marks the pull request a draft, and only `canon pr lift` or the operator un-marks it, so a flag reading ready afterwards passed every gate the verb reads or was readied by a person, which GitHub requires before a merge. Re-drafting fights them, and no surface in the tree states a reason to.
+- Leave the lift to the reviewers, who run `canon pr lift` on posting their close, and to the controlling session as the fallback. Refuse an instruction to ready the pull request directly, whoever sends it, since a direct ready skips every gate the verb reads.
 - Rewrite a plan question's `- Suggested:` line as `overridden at execution to <pick>,` plus the measurement when this build decides against an unanswered one, leaving the `- Answer:` slot blank, and put the same deviation in one line under the open task's `## Findings`, per `${CLAUDE_SKILL_DIR}/../plan-feature/references/plan.md`.
 
 ## The board is read-only
@@ -51,13 +51,13 @@ owed and nothing else.
 - Announce the pull request as the ship chain's pull request step returns, carrying the number, the branch, and the task it closes. That transition is the one moment only this session knows, and the controller's review poll no longer starts on a dispatch because of it.
 - Carry the reach in that same message: the paths this branch wrote that another live plan or `## Run now` row holds, and who holds each, which `canon tasks plan-reach` reports as `claimed`. Report each as a rebase the controller should order, never as a breach, since sharing a path is not a hold. The gate cleared this branch against a prediction it has since outgrown, so the controller holds a reading of what this branch shares that stopped being true hours ago and nothing else tells it. Say the reach was unread rather than clear when the installed binary carries no such subcommand, and leave the undeclared list to the pull request.
 - Carry a row this build turned up in that same message, with its title, its origin, and the surface it would take. Send it as its own message only when the session will end before a pull request opens, since the row has no other way to reach the controller.
-- Announce when an address-review pass finishes, as `review-address` Step 8 returns, carrying what was addressed and the PR's new CI state. That transition is the other moment only this session knows, and it is what tells the controller to re-review rather than leaving it to poll for an answer nothing marks as landed.
+- Ask for the re-review when an address-review pass finishes, as `review-address` Step 8 returns, carrying what was addressed and the PR's new CI state. Send it to the reviewer whose sessionId the review dispatch carried, resolved from that id at the moment of sending, since a reviewer holds the trunk branch and no branch lookup finds it. Send it to the controller instead when the dispatch named no reviewer or the id resolves to no live session. That transition is the other moment only this session knows, and the message is what starts the re-review rather than a poll for an answer nothing marks as landed.
 - Send a block out as a message before it becomes an interactive prompt.
 - Send nothing on progress. A worker reporting progress rebuilds, on this side of the channel, the poll the announcement retired on the other.
 
-Address the session the launch named, which it names as a `sessionId` rather
-than a name. `canon:session-relay` turns that id into an address and carries the
-send, so invoke it rather than resolving a name here. It reads the roster at the
+Address the session the launch named, and the reviewer by the sessionId its
+dispatch carried, each as a `sessionId` rather than a name.
+`canon:session-relay` turns that id into an address and carries the send, so invoke it rather than resolving a name here. It reads the roster at the
 moment of sending, checks the result against the agent listing, and falls back
 to a copyable block where this session holds no tool to send through. The
 message owed stays in its own bullet above.

package/claude/skills/session-compact/references/handoff-note.md

@@ -5,7 +5,7 @@ description: What each section of a compact handoff carries, what stays out, and
 
 # Handoff note
 
-The shape `session-compact` writes. It lives here rather than in `standards/` because one skill reads it and a standard nothing else cites has no second reader to correct it.
+The shape `session-compact` writes. It lives in this skill's `references/` because one skill reads it, and a shape nothing else cites has no second reader to correct it.
 
 ## The test every line passes
 

package/claude/skills/target-setup/SKILL.md

@@ -33,7 +33,7 @@ rather than a step within it, so the full chain never runs it separately.
 
 ## Non-interactive path
 
-Every phase runs under `CANON_NON_INTERACTIVE=1` with no TTY. Two phases
+Every phase runs under `CANON_NON_INTERACTIVE=1` with no TTY. Three phases
 otherwise pause, and each takes an argument that answers its prompt ahead of
 time:
 
@@ -41,11 +41,15 @@ time:
   takes every candidate the scan found, and `--folders <a>,<b>` takes a named
   set. With neither, and with no TTY, the phase reports its candidates and stops
   rather than choosing for the operator.
+- `install` and `gov` confirm the proposed extras with the operator.
+  `--extras <a>,<b>` takes a named set and `--extras none` takes none. With
+  neither, and with nobody to answer, both take every proposal and list each in
+  the report rather than stopping.
 - `gov` stops on a detected technology with no matching rule. `--skip-gaps`
   proceeds with the matched layer and lists the gap in the report.
 
 Claude Code's tool permission dialog is the confirmation gate for everything
-else. Do not pause for a separate confirmation.
+else. Do not pause for a separate confirmation beyond the extras question.
 
 ## Scope
 
@@ -71,7 +75,8 @@ the `install` and `gov` phases share rather than each stating.
 
 ## Phase: install
 
-Run the chain in order, starting immediately after the preview. Run from the
+Run the chain in order, starting once the operator has confirmed the extras the
+preview proposed, per the detect reference. Run from the
 target project's current directory. Do not cd into the toolkit source tree. The
 `canon` CLI is global.
 
@@ -94,7 +99,7 @@ Step 2: `canon tooling sync <tooling-stack> --write` installs stack deps, script
 CANON_NON_INTERACTIVE=1 canon tooling sync <tooling-stack> <target> --write
 ```
 
-Monorepo with multiple language roots: run `canon init` once at the repo root so `base` (husky, prettier, cspell, commitlint, CI) lands single, then sync each subtree with `--skip base` so the shared layer is not re-dropped. Take the subtree commands from the per-root rows the preview printed rather than picking folders by hand. Detection found each root and its stack, and the two commands below show the shape.
+Monorepo with multiple language roots: run `canon init` once at the repo root so `base` (husky, prettier, commitlint, CI) lands single, then sync each subtree with `--skip base` so the shared layer is not re-dropped. Take the subtree commands from the per-root rows the preview printed rather than picking folders by hand. Detection found each root and its stack, and the two commands below show the shape.
 
 ```bash
 CANON_NON_INTERACTIVE=1 canon tooling sync vite-react ./frontend --skip base --write
@@ -103,7 +108,7 @@ CANON_NON_INTERACTIVE=1 canon tooling sync python ./backend --skip base --write
 
 Without `--skip base`, each subtree re-drops husky, and git honors only one `core.hooksPath`, so the extra hook dirs silently break. Each subtree keeps its own framework configs, and its own stack reference reads through `canon tooling reference <stack>`.
 
-A subtree sync withholds `.github/`, since GitHub reads workflows only at the repository root, and names each withheld file with the `working-directory` a root CI job needs. It also writes a nested `cspell.json` that registers the subtree's word lists. A subtree needs its own `bun init` before its scripts and dependencies land. The sync warns and skips them until then.
+A subtree sync withholds `.github/`, since GitHub reads workflows only at the repository root, and names each withheld file with the `working-directory` a root CI job needs. A subtree needs its own `bun init` before its scripts and dependencies land. The sync warns and skips them until then.
 
 Step 3: post-sync fixups. Golden configs arrive from sync, so no config generation is required. But a few items may need a one-time touch:
 
@@ -116,7 +121,8 @@ Do not generate ESLint, Vitest, or Playwright configs. They ship as golden files
 ## Phase: gov
 
 Governance rules and nothing else, for a project declining the tooling layer.
-Resolve exactly as the detect reference states, then run:
+Resolve exactly as the detect reference states, confirm the proposed extras
+there, then run:
 
 ```bash
 CANON_NON_INTERACTIVE=1 canon gov install <stack> --add <extras> <target>

package/claude/skills/target-setup/references/detect.md

@@ -77,10 +77,11 @@ already reach every subfolder. Tooling installs per folder. So resolve one
 governance stack for the whole repository and one tooling stack per language
 root.
 
-- **Stack:** pick the closest governance stack by matching the repository root's detected runtime or framework against stack names in the catalog. If the root matched nothing, `base` is the stack, including when subfolders matched, since no subfolder owns the repository and picking one by order would state a preference nobody gave. Mark it `fallback` in the preview only when no root matched anywhere.
+- **Stack:** pick the governance stack by matching the repository root's detected language against stack names in the catalog. Governance stacks are per language, so a framework never names one, and its rules arrive as extras. If the root matched nothing, `base` is the stack, including when subfolders matched, since no subfolder owns the repository and picking one by order would state a preference nobody gave. Mark it `fallback` in the preview only when no root matched anywhere.
 - **Tooling stack:** for each language root, pick the closest tooling stack from `canon tooling list --json` (e.g. `vite-react`, `astro`, `nextjs`). Distinct from the governance stack. Fall back to `base` for a root with no framework or language match, and carry that fallback into its preview row.
-- **Next.js:** map `next` in a root's `package.json` dependencies, or a `next.config.ts`/`.js`/`.mjs` file in that root, to the `nextjs` governance stack and the `nextjs` tooling stack. The dependency name does not match either stack name by itself.
-- **Extras:** identify technologies not already covered by the picked governance stack, across every language root. A subfolder that matched a governance stack of its own contributes that stack's rules, read from `canon gov list --json`, and every root contributes its language rule. For each technology, find a rule whose `description` or `paths` points at it and pass it via `--add`. Dedupe against the picked stack's own rules. Do not add a rule the stack already pulls in.
+- **Next.js:** map `next` in a root's `package.json` dependencies, or a `next.config.ts`/`.js`/`.mjs` file in that root, to the `node` governance stack and the `nextjs` tooling stack. The dependency name does not match the tooling stack name by itself, and the Next.js rule arrives as an extra.
+- **Extras:** run `canon gov detect <target> --stack <stack> --json` from the target and take its `proposals` array as the candidate extras. Each proposal names a `rule` and the `evidence` that matched it across every language root to depth two. The verb already leaves out every rule the picked stack resolves, so do not dedupe again, and do not match a rule's `description` or `paths` by hand.
+- **Subfolder language rules:** a language root below the repository root whose language the picked stack does not carry contributes its language rule by name, read from `canon gov list --json`. The verb proposes no language rule, since a stack reaches each one.
 - **Subfolder tooling:** a language root below the repository root takes its own `canon tooling sync <stack> <path> --skip base`, since `canon init` already lands `base` once at the root. Leave a root whose stack resolves to `base` out of the commands, since that sync would land nothing. A repository-root `package.json` hosting only formatters and hooks is that case, and it adds no row.
 - **Skip (`--skip`):** `wiki` installs by default. Add `--skip wiki` only when the user explicitly wants it left out.
 
@@ -110,9 +111,9 @@ toolkit repository, and option 2 hands the project-local file to `create-rule`.
 Before executing, output:
 
 - **Detected:** each technology with its evidence file, path included, so a subfolder marker reads as one
-- **Stack:** picked governance stack and resolved rule count. Mark it `fallback` when no detected runtime or framework matched a catalog name.
+- **Stack:** picked governance stack and resolved rule count. Mark it `fallback` when no detected language matched a catalog name.
 - **Tooling stack:** one row per language root, each carrying its path, its picked tooling stack, a `fallback` mark on the same test, and its own command. On the repository root's row, name what `base` lands: configs, seeds, and gitignore entries in every case, plus the JavaScript development dependencies, scripts, and hook activation wherever a `package.json` exists to carry them. A project outside that ecosystem runs none of the second group and keeps the first. Omit these rows entirely on the `gov` phase, which syncs no tooling.
-- **Extras:** each `--add` rule with a one-line reason, listed in full. A second matched stack reaches the install only through this list, since `canon init --stack` takes one stack, so a shortened list reads as that stack dropped.
+- **Extras:** each proposal with the evidence the verb returned, plus each subfolder language rule, listed in full as the list the operator confirms. A second matched stack reaches the install only through this list, since `canon init --stack` takes one stack, so a shortened list reads as that stack dropped.
 - **Skip:** any `--skip` entries with reason
 - **Target:** resolved target path
 - **Commands:** the full chain that will run
@@ -120,3 +121,19 @@ Before executing, output:
 A resolved name and a fallback read alike once written, so mark the fallback
 here rather than in the report. The preview is the last point before the first
 write, and the report runs after the files have landed.
+
+### Confirm the extras
+
+The extras are the one part of the preview the operator confirms before the
+install runs, since a proposal is evidence that a project might want a rule
+rather than proof that it does. Put the list through the structured question
+surface with three options: take every proposal, which is the recommended
+first option, take none, or name a subset, which the operator types as a
+comma-separated list. Pass what they kept to `--add` and drop the flag when
+they kept nothing.
+
+An `--extras` argument answers ahead of time and skips the question.
+`--extras <a>,<b>` takes the named rules, and `--extras none` takes none. With
+neither and no one to answer, take every proposal and list each in the report,
+since a proposed rule costs one file to delete and stopping would break every
+headless setup.

package/claude/skills/test-craft/REQUIREMENT.md

@@ -15,7 +15,7 @@ The failure is measured on a real target. A single-page portfolio site carried 2
 
 A stated rule is also one a session can talk itself out of. Each test in that suite sat where it did for a reason that sounded fine at the time, such as the end to end spec already being open or a pause quieting a run that flaked under load, and nothing in front of the session answered the reason.
 
-Moving the guidance into a path-scoped rule does not reach the session that needs it. A path-scoped rule loads when a session reads a matching file and not when it creates one, measured in three headless runs, so a rule scoped to test files is silent on the first test of every feature.
+Moving the guidance into a path-scoped rule does not reach the session that needs it. A path-scoped rule loads when a session reads or writes a matching file, and it is absent from the write that creates the first one, measured in three headless runs, so a rule scoped to test files is silent on the first test of every feature.
 
 ## Must
 
@@ -23,6 +23,7 @@ Moving the guidance into a path-scoped rule does not reach the session that need
 - Open every test with the question of which production change makes it fail and whether that change is a bug or a decision, since a test with no answer proves nothing
 - State the end to end budget in words: journeys and what only a real browser renders, never a state a component test reaches
 - Carry a final filter the session runs over its own tests, each item a shape it can check: mirror assertion, change detector, assertion on a mock, framework behavior, fixed pause, and the mutation check
+- Own the structure floors every test carries, being arrange, act, assert, one behavior per test, no branching or loops in a body, no testing of private functions or internal state, no coverage targets, nesting at most two levels deep, independent tests that clean up, factories for test data, every async call awaited, and no snapshot verification. The testing rule only points here, so a later trim keeps them.
 - Hold in the body what every test decision pays for, and defer each layer's specifics to a reference loaded only when a test at that layer is being written
 - Promise a middle layer for behavior a simulated DOM cannot render, naming the real-browser component runners, so a static site is not left choosing between a simulated DOM that computes no layout and a whole-site run
 - Repeat in the end to end reference the two floors a session writing its first spec never loads through the path-scoped rule, being the `scrollend` settle and motion reduced by default
@@ -34,7 +35,6 @@ Moving the guidance into a path-scoped rule does not reach the session that need
 
 - Name a framework or runner in the body. Runner specifics live in the references and in the language testing rules, so the body holds across stacks.
 - Carry a numeric mix across layers. A codebase-wide ratio is a target a session writing one test cannot act on.
-- Restate the structure floors the testing rule already carries, such as arrange, act, assert, one behavior per test, isolation, and no snapshots
 - Restate the settle, guard, and run-scope rules the end to end rules carry, beyond the two floors named above
 - Run the red, green, refactor procedure or decide its order, which `test-first` owns
 - Import an external skill's tone, such as a law stated as absolute, or an excuse row rebutting an objection no session has raised
@@ -49,7 +49,6 @@ Moving the guidance into a path-scoped rule does not reach the session that need
 
 - The red, green, refactor loop and the order it runs in: `test-first`, which loads this skill at its first step
 - Reproducing a failure with no known cause: `systematic-debugging`
-- Structure floors for every test: the core testing rule
 - Runner choice, file suffix, placement, and query conventions: the TypeScript and Python testing rules
 - Settle, guard, and run-scope rules inside an end to end file: the end to end reliability and test scope rules
 - Writing a UI change's visual checklist, and naming the behaviors it ships untested for this skill to place: `ui-checklist`

package/claude/skills/test-craft/SKILL.md

@@ -45,10 +45,23 @@ Size a test by what it touches rather than by what it covers. Pick the first row
 
 ## Keep test code readable over clever
 
-- Prefer a descriptive, repeated arrange over a shared helper a reader has to open. A test is read when it fails, by someone who did not write it.
-- Assert through the public surface a caller uses. A test reaching into internals breaks on every refactor and catches nothing a caller sees.
+- Prefer a descriptive, repeated arrange over a shared helper a reader has to open. A test is read when it fails, by someone who did not write it. Build test data through a factory or builder rather than an inline object literal repeated across tests.
+- Assert through the public surface a caller uses, never on a private function or internal state directly. A test reaching into internals breaks on every refactor and catches nothing a caller sees.
 - Prefer a real collaborator, then a fake, then a stub, and a mock last. A mock asserts how the code is built rather than what it does.
 
+## Hold the structure floors
+
+Every test carries these, at any layer and in any runner:
+
+- Structure each test as arrange, act, assert.
+- Verify one behavior per test.
+- Keep conditional logic and loops out of a test body. A table of cases is one test per row, never a branch inside one.
+- Set no coverage percentage as a target. Cover the behaviors and their edges.
+- Group related tests with the framework's nesting mechanism, and keep it to two levels deep.
+- Keep tests independent with no shared side effects. Clean up and restore state after each one.
+- Await every async operation. Never leave a promise fire-and-forget in a test.
+- Verify with assertions, never with a snapshot.
+
 ## Read the reference for the layer
 
 Read the one reference matching the layer the table picked, before writing the first test at it. Skip the other two.
@@ -92,6 +105,5 @@ Run the final filter over every test written this session, checking each line. A
 
 - The red, green, refactor procedure and its order: `test-first`, which loads this skill at its first step
 - Reproducing a failure with no known cause: `systematic-debugging`
-- Test structure floors such as arrange, act, assert, one behavior per test, isolation, and no snapshots: `010-testing`
 - Runner, file suffix, placement, and query conventions per language: `300-testing-ts`, `330-testing-py`, `335-testing-go`, and `336-testing-php`
 - Settle, guard, and run-scope rules inside an end to end file: `305-e2e-reliability` and `306-test-scope`

package/docs/agents/audits.md

@@ -85,7 +85,7 @@ It sits under the project root rather than beside the aggregator in `src/`. The
 
 ### What is kept out of it
 
-A gitignored record folder holds one machine's session scratch. Its counts describe somebody else's disk, so committing them writes a floor no other clone can reproduce and every contributor reads a regression against a number that was never about their tree. The board and five of the six record kinds are therefore reported on every run and recorded in none. `records-standards` is the exception, because that corpus is tracked.
+A gitignored record folder holds one machine's session scratch. Its counts describe somebody else's disk, so committing them writes a floor no other clone can reproduce and every contributor reads a regression against a number that was never about their tree. The board and every record kind are therefore reported on every run and recorded in none.
 
 An audit that did not report is left out rather than written as zero. Zero there records a clean corpus nobody measured, and the next run reads its real numbers as a regression against a floor that was never taken.
 

package/docs/agents/canvas.md

@@ -1,6 +1,6 @@
 ---
 title: Canvas
-description: The canvas server, its content format, and the verbs that list, arrange, select, edit, mark, and capture frames
+description: The canvas server, its content format, and the verbs that list, arrange, fit, select, edit, mark, and capture frames
 ---
 
 # Canvas
@@ -29,6 +29,10 @@ The write routes the shell posts to also refuse a request carrying an `Origin` o
 
 `frame resize <page> <name> --width <px> --height <px>` rewrites one frame's whole box in one write, and `--x` and `--y` move it at the same time. An omitted flag keeps the frame's current value. It refuses a width or height that is not a positive number as `invalid-size`, a position that is not a number as `invalid-position`, and a missing frame, a missing page, or a layout that does not parse as `frame move` does.
 
+`canvas arrange <page>` re-lays a page's frames. It keeps the rows they already sit in, where boxes whose vertical spans overlap share a row, orders each row left to right by `x`, places the boxes on the 80px frame gap from the page's leftmost edge, and stacks the rows on their tallest box plus the gap from the page's top edge. It also drops every layout entry whose frame file is gone. `--check` writes nothing. `--json` emits `{ ok, page, written, moved, dropped }`, where `moved` lists each frame with its `from` and `to` position and `dropped` lists the entries with no file. Sizes never change. Under `--check` it exits 2 when a frame would move or an entry would drop, and it refuses a missing page as `no-page` and a layout that does not parse as `malformed-layout`.
+
+`canvas fit <page>/<frame>` and `canvas fit <page>` set each frame's height to its content. The content is measured in the capture browser at the frame's box width, through the served address, after fonts and the load event settle, and the height is that measure rounded up with no margin. The write goes through the same writer as `frame resize`. `--check` writes nothing. `--json` emits `{ ok, written, frames }`, one row per frame carrying `height`, `fitted`, `wide`, `font`, `viewport`, `family`, and `owed`. `wide` is true when the content is wider than the box, which fit reports and never widens, since the width is the frame's declared render width. `font` is true when the first family of the body text is not one the served sheet declares a face for, being the toolkit faces `Geist Variable`, `Noto Sans Mono`, and the hand-drawn pair, plus any face the project declares, because a height fitted against a machine family may not hold in another browser. `viewport` is true when the frame's height depends on the viewport, as a height in `vh` does. The lowest element edge is read with the viewport at the box height and at twice it, and an edge that moved means the content measure is not the height a viewer draws, so its height is kept and nothing is written for it. Under `--check` it exits 2 when any row is owed, and it refuses as `no-page`, `no-frame`, `no-server`, or `capture-failed` the way `canvas capture` does. Rows below a frame that grew do not move, so run `canvas arrange` after a fit.
+
 The shell writes through the same writer when the operator drags a frame or one of its corner handles. Both take a lock file beside the layout, read it, merge their change, and replace it, so a drag released while a verb writes loses neither position. A writer that cannot get the lock within two seconds refuses with reason `busy`.
 
 `canvas selection --json` emits `{ ok, selection }` with the page, frame, file, box, and path of the frame the operator selected, or `selection: null` when nothing is selected or the selected frame has since been removed. Read it when the operator says "this one".

package/docs/agents/commands.md

@@ -19,7 +19,6 @@ One row per top-level command, in the order `canon --help` prints them. A domain
 | `canon migrate <verb>`      | Move a project off a retired name or layout, reporting the plan until `--write`            |
 | `canon targets <verb>`      | Report the projects this toolkit installed into                                            |
 | `canon gov <verb>`          | Install and sync governance rules, and audit the tree against them                         |
-| `canon standards <verb>`    | List, audit, or print a standard by name                                                   |
 | `canon tooling <verb>`      | Sync, diff, and verify tooling stacks                                                      |
 | `canon claude <verb>`       | Install the Claude workflow and audit both skill corpora                                   |
 | `canon wiki <verb>`         | Scaffold the wiki pages                                                                    |
@@ -61,7 +60,7 @@ A port already in use is the ordinary case rather than a refusal, so it walks fo
 
 A request naming a directory is redirected to its trailing-slash form rather than answered in place. A browser resolves a relative asset against the last slash of the URL it is on, so answering `/lesson` directly leaves the page asking for `/course.css` instead of `/lesson/course.css`, and it renders unstyled through the server that exists to prevent exactly that.
 
-Containment is tested after symlinks are followed rather than on the path as written, and the test sits immediately before the read rather than beside the request that produced it. Resolving a request lexically clears a link pointing outside the served root, and this repository is a live instance of that shape, since `claude/standards` is a link out of `claude/`. Position is what makes the property hold: a directory request appends its index after the request path has been checked, so a check placed earlier leaves that index untested. `--index` answers a directory holding no `index.html` with a listing read per request, where the default stays a 404. Every entry the listing names takes the same containment test a request for it would, so a link out of the root is absent rather than greyed, and dotfiles are hidden. With no `--entry` and no root `index.html`, the printed link is `/` and `entryExists` reads true. An `--entry` that escapes the root refuses with `no-entry` before a port is taken, because `url` is the field a caller hands to a reader.
+Containment is tested after symlinks are followed rather than on the path as written, and the test sits immediately before the read rather than beside the request that produced it. Resolving a request lexically clears a link pointing outside the served root, and a link out of the served root is the shape it guards against. Position is what makes the property hold: a directory request appends its index after the request path has been checked, so a check placed earlier leaves that index untested. `--index` answers a directory holding no `index.html` with a listing read per request, where the default stays a 404. Every entry the listing names takes the same containment test a request for it would, so a link out of the root is absent rather than greyed, and dotfiles are hidden. With no `--entry` and no root `index.html`, the printed link is `/` and `entryExists` reads true. An `--entry` that escapes the root refuses with `no-entry` before a port is taken, because `url` is the field a caller hands to a reader.
 
 `canon demo` is the second browser command and the one that ships, since its purpose is running in a target rather than regenerating what this repository commits. It needs a browser binary the package does not carry, installed once with `bunx playwright install chromium`.
 
@@ -84,7 +83,6 @@ Each domain exposes a consistent shape where applicable: `list`, `install`, `syn
 - `migrate`, in `migrate.md`: `rename`, `skill-names`, `records`, `surface-roots`, `record-tree`, `rule-layout`, `scratch-evidence`, `record-layout`
 - `targets`, in `targets.md`: `list`, `pulls`
 - `gov`, in `install-and-sync.md`: `list`, `install`, `sync`, `build`, `regen`, `test-order`, `counts`, `superseded`, `citations`, `restated`
-- `standards`, in `standards-audit.md`: `list`, `audit`, `<name>`
 - `tooling`, in `install-and-sync.md`: `list`, `sync`, `diff`, `reference`, `verify`, `inject`, `prune-gitignore`
 - `claude`, in `skills-audit.md`: `init`, `sync`, `setup`, `routing`, `plugin-update`, `seeds list`, `skills list`, `skills audit`, `skills drift`, `skills reach`, `skills rank`
 - `wiki`, in `scripting.md`: `init`
@@ -103,7 +101,7 @@ Each domain exposes a consistent shape where applicable: `list`, `install`, `syn
 - `sessions`, in `sessions.md`: `list`, `export`, `import`
 - `worktrees`, in `worktrees.md`: `list`, `reclaim`
 - `hooks`, in `hooks.md`: `post-merge`
-- `pr`, in `pr-reads.md`: `key-changes`, `head`, `checks`, `review-state`, `evidence`, `preview`, `local`, `frames`
+- `pr`, in `pr-reads.md`: `key-changes`, `head`, `checks`, `review-state`, `evidence`, `preview`, `local`, `frames`, `lift` (in `pr-lift.md`)
 - `audits`, in `audits.md`: `run`, `list`
 - `gate`, in `gate.md`: `run`
 - `secrets`, in `state-scoped-risk.md`: `scan`
@@ -130,7 +128,7 @@ Subcommands no other page describes:
 - A deck folder's `deck.json` and the faces it embeds, its per-slide `<body>` attributes, transitions and entrances, speaker notes, and charts are described in `slides.md`.
 - `canvas`, with its verbs, content format, and write routes, is described in `canvas.md`.
 - `labels apply <number>` adds the labels this branch earns to its open pull request, refusing a pull request whose head is not the current branch or that is not open, and never creating a label the remote lacks or removing one a person added (`--check` writes nothing and exits 2 when labels are owed, `--base`, `--json`).
-- `labels scan` fails a pull request or a posted review whose title, body, or review comment carries a phase label, a label a code span quotes, a gitignored record path, a session link, a banned character, a body heading outside the closed section list or a missing `## Summary` or `## Key changes`, a title word no dictionary holds, or a title breaking `claude/skills/git-pr/references/pr.md`'s format, casing, or length rule (`--event`, `--body-file`, `--json`).
+- `labels scan` fails a pull request or a posted review whose title, body, or review comment carries a phase label, a label a code span quotes, a gitignored record path, a session link, a banned character, a body heading outside the closed section list or a missing `## Summary` or `## Key changes`, or a title breaking `claude/skills/git-pr/references/pr.md`'s format, casing, or length rule (`--event`, `--body-file`, `--json`).
 
 ## Version skew
 

package/docs/agents/counts.md

@@ -22,11 +22,10 @@ Under `--json` the record holds stdout alone and the frame still renders on stde
 
 ## The catalogs it reads
 
-A closed set of five, each with a filesystem reader behind it rather than every list command this CLI ships:
+A closed set of four, each with a filesystem reader behind it rather than every list command this CLI ships:
 
 - `skills`: shipped plugin skills, a folder per `claude/skills/*/SKILL.md`
 - `rules`: authored governance rules, a file per `governance/rules/**/*.md`
-- `standards`: the authoring corpus at `standards/`
 - `commands`: top-level `canon` commands, read off `src/cli.ts`'s registration imports
 - `audits`: the registered set in `src/audits/catalog.ts`, this entry included
 
@@ -36,7 +35,7 @@ The set is closed rather than derived, so widening it is a deliberate change to
 
 A sentence has to carry an assertion verb (`loads`, `ships`, `carries`, `holds`, `counts`, `totals`, `documents`, `declares`, `installs`, `lists`, `contains`, `comprises`, `authors`), the quantifier `all`, or an article (`the`, `a`, `an`) immediately ahead of the number, which is immediately ahead of the catalog noun, with one optional qualifying word between the number and the noun (`sixty-one shipped skills`). The number reads either as digits or as a spelled-out cardinal through ninety-nine, since this corpus states a catalog size in words as often as in digits.
 
-Nothing stands between the trigger and the number, which is the rule an author writing a new count has to know. It separates `the toolkit authors 60 rules` and `took all 60 rules`, both read, from `a domain of 55 skills` and `denominator of sixty-one shipped skills`, neither of them read. A figure meant as a past state takes a date in the same sentence instead, which reads the sentence past whatever its shape.
+Nothing stands between the trigger and the number, which is the rule an author writing a new count has to know. It separates `the toolkit authors 49 rules` and `took all 49 rules`, both read, from `a domain of 55 skills` and `denominator of sixty-one shipped skills`, neither of them read. A figure meant as a past state takes a date in the same sentence instead, which reads the sentence past whatever its shape.
 
 ## How the trigger set grew
 
@@ -44,7 +43,7 @@ The verb gate is not the first design tried. A bare number next to a catalog nou
 
 The article half was added after a first review of the shipped design found a live miss: the development domain's gating-stages entry stated a stale audit total while the tree held 20, and the verb gate never reached it, since that sentence puts its verb after the noun rather than ahead of the number. Widening the trigger set to admit an article ahead of the number closed that gap.
 
-The quantifier `all` and the verb `authors` joined on the same evidence, two more live misses failing only the trigger test. Allowing words to stand between the trigger and the number was the other candidate, measured and declined: at widths of one, two, and three it reached 77, 104, and 132 sentences against a baseline of 65, missed `took all 60 rules` at every width, and reached `the toolkit authors 60 rules` only at a width admitting the indirect-noun shape below. The two words reach both at 75 sentences and no false positive.
+The quantifier `all` and the verb `authors` joined on the same evidence, two more live misses failing only the trigger test. Allowing words to stand between the trigger and the number was the other candidate, measured and declined: at widths of one, two, and three it reached 77, 104, and 132 sentences against a baseline of 65, missed `took all 49 rules` at every width, and reached `the toolkit authors 49 rules` only at a width admitting the indirect-noun shape below. The two words reach both at 75 sentences and no false positive.
 
 ## The plausibility filter
 
@@ -52,13 +51,13 @@ The verb gate alone still left four false positives standing: `carries two rules
 
 A stated figure is read only when it sits within a factor of two of the true count, in either direction. That bound is tuned against the run this sweep was written against rather than reasoned to from first principles, the way `restated.ts` tunes its own document-frequency ceiling, and it is a property of the scale every catalog here sits at (the tens) rather than a universal rule.
 
-The article gate is looser than the verb list and carries a real cost. Re-running against the tree once it widened caught the live miss above and also misread a passage in `canon/context/standards/destinations.md` naming a real subset, a standard outside the retired `standards/bundled/` fan-out, as a claim about the whole standards catalog. The qualifying adjective there fills the same optional-word slot `sixty-one shipped skills` needs to match at all, and no syntactic rule tells a qualifier that narrows a catalog from one that only restates it. The finding could not be closed by correcting a figure, since the sentence was true when the corpus held it, only unmarked as a past state, which is the class the date exclusion already reads past. Naming the moment, the same way a context entry dates its own figures, closed it with no change to the matcher.
+The article gate is looser than the verb list and carries a real cost. Re-running against the tree once it widened caught the live miss above and also misread a passage in the standards destinations entry, since retired, naming a real subset, a standard outside the retired bundled fan-out, as a claim about the whole standards catalog. The qualifying adjective there fills the same optional-word slot `sixty-one shipped skills` needs to match at all, and no syntactic rule tells a qualifier that narrows a catalog from one that only restates it. The finding could not be closed by correcting a figure, since the sentence was true when the corpus held it, only unmarked as a past state, which is the class the date exclusion already reads past. Naming the moment, the same way a context entry dates its own figures, closed it with no change to the matcher.
 
 ## What it does not measure
 
 A delta phrased as a transition (`from fourteen to fifteen`), a fraction (`thirteen of sixteen`), and a total reached through an indirect noun (`denominator of sixty-one shipped skills`) are all catalog-size claims this corpus carries, and none matches the trigger shape this reads. Each stays a known gap. The false-positive rate that gated closing them has a measurement behind it now, and what it showed is that the widening these three need is the one that costs a false positive rather than the one that does not.
 
-A second figure in a sentence whose first figure already matched is a fourth gap and a structural one, since one match is taken per catalog per sentence. `authors 60 rules under governance/rules/ and consumes 39 into .claude/rules/` is read for its 60 alone, which is correct here because the two figures name different populations, and a sentence stating one catalog twice would go unread the same way.
+A second figure in a sentence whose first figure already matched is a fourth gap and a structural one, since one match is taken per catalog per sentence. `authors 49 rules under governance/rules/ and consumes 31 into .claude/rules/` is read for its 49 alone, which is correct here because the two figures name different populations, and a sentence stating one catalog twice would go unread the same way.
 
 A calendar date (`2026-08-21`) or a backticked commit reference in the same sentence reads the whole sentence past, since that is how this corpus already marks a figure as a historical record rather than a live claim. The context entries carry a figure this way deliberately, and every one of them stays correct forever.