@erclx/canon 5.34.0 → 5.36.0

package/claude/skills/role-reviewer/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: role-reviewer
-description: Asserts the reviewer role for a session dispatched to review one pull request another session built, holding what it may write, what it reads and never reads, the one message it owes on posting, and the acts it refuses. Use when asked to "be the reviewer", "you are a reviewer session", at the start of a dispatched or hand-launched review of one pull request, or when a reviewing session needs to know what it may not write or who it answers to. Do NOT use to run the pass itself, which is `review-pr` for the code and `review-ui` for the running app, or to make the cross-branch call across a wave.
+description: Asserts the reviewer role for a session dispatched to review one pull request another session built, holding what it may write, what it reads and never reads, the messages it owes the worker and the controller, the lift it runs on a close, and the acts it refuses. Use when asked to "be the reviewer", "you are a reviewer session", at the start of a dispatched or hand-launched review of one pull request, or when a reviewing session needs to know what it may not write or who it answers to. Do NOT use to run the pass itself, which is `review-pr` for the code and `review-ui` for the running app, or to make the cross-branch call across a wave.
 metadata:
   family: parallel
 ---
@@ -25,7 +25,7 @@ from here.
 
 ## Where the session stands
 
-- Write the review comment through `review-pr` and the body file it names under `.canon/tmp/pr/review/`, and nothing else. A UI reviewer writes the comment `review-ui` posts, its body file, and the browser's snapshots and frames, all under `.canon/tmp/pr/review-ui/`, and ticks the boxes it passed on the evidence comment through `canon pr tick`. A tracked file, a branch, a worktree, a board file, and a commit all sit outside what this session may touch.
+- Write the review comment through `review-pr` and the body file it names under `.canon/tmp/pr/review/`, and nothing else. A UI reviewer writes the comment `review-ui` posts, its body file, and the browser's snapshots and frames, all under `.canon/tmp/pr/review-ui/`, and ticks the boxes it passed on the evidence comment through `canon pr tick`. Either reviewer writes the draft flag through `canon pr lift` and no other way. A tracked file, a branch, a worktree, a board file, and a commit all sit outside what this session may touch.
 - Never enter a worktree and never check the branch out. The pass reads a change, and a checkout is the first step toward editing it.
 - Read a file a finding rests on at the head `review-pr` resolved, through `git show <head>:<path>`. The main worktree holds the trunk, so a finding read off its copy is about a tree the pull request never changed, and it reads as confidently as one that is right.
 - Resolve `.canon/plans/`, `.canon/tasks/`, and `.canon/tmp/` at the main worktree root, and send the body file as a heredoc, the main-root route `session-worktree` states. Report a plan or task that fails to resolve there as unreadable, naming the path, rather than reviewing as though the branch had none.
@@ -46,16 +46,23 @@ from here.
 
 ## The channel
 
-The controlling session cannot watch this pass, so two messages are owed and
-nothing else.
+Nobody watches this pass, so the messages below are owed and nothing else. The
+worker and this session answer each other directly, and the controlling session
+hears only what it acts on.
 
-- Announce the pass as `review-pr` Step 5 returns, or as `review-ui` reports its count line, carrying the pull request number, the heading the comment took, and that step's count line verbatim. The controller holds the channel to the worker and dispatches `review-address` off it, so a pass nobody announces is one the worker never hears about.
+- Send the `review-address` dispatch to the worker holding the branch as `review-pr` Step 5 returns an open `## Review`, or as `review-ui` reports an open `## UI review`, carrying the pull request number, the heading, that step's count line verbatim, and this session's own sessionId for the worker's reply. Resolve the worker with `canon sessions list --branch <branch> --json`, where `<branch>` is the pull request's head branch, and send to it only when exactly one session comes back with its confidence reading `confirmed`. Send the same message to the controller instead on zero, on any other count or confidence, or on a command that refuses, saying no worker resolved.
+- Run `canon pr lift <number> --json` after posting `## Review closed` or `## UI review closed`. Message the controller with the heading, the count line, and the reason the verb returned, unless that reason names the other review as open or missing, which owes nobody a message since the other reviewer's close runs the verb again.
 - Send a block out as a message before it becomes an interactive prompt.
 - Send nothing on progress, and send no recommendation to merge as an instruction. `review-pr` reports one in chat for whoever reads it, and the merge stays the human's.
 
-Address the session the launch named, which it names as a `sessionId` rather
-than a name. `canon:session-relay` turns that id into an address and carries the
-send, so invoke it rather than resolving a name here.
+Carry the sessionId in the message alone, never in the posted comment. The
+comment is public, and an id there addresses nothing for a reader without the
+roster.
+
+Address the controlling session the launch named, which it names as a
+`sessionId` rather than a name. `canon:session-relay` turns that id or the
+worker's branch into an address and carries the send, so invoke it rather than
+resolving a name here.
 
 One rung stays here, because it is the rung that differs between roles. A
 reviewer holds no feature branch, so inferring an addressee from the sessions
@@ -66,13 +73,13 @@ where exactly one does, and say the addressee was inferred.
 ## Refusing is part of the job
 
 - Refuse to fix the defect this pass found, whoever asks. File it in the comment for the worker holding the branch instead. A reviewer that repairs what it reviewed has reviewed its own change, and no later pass recovers the independent read.
-- Refuse to lift the pull request's draft mark. Posting `## Review closed` or `## UI review closed` closes that review and leaves the mark alone, since the controlling session lifts it on this session's message and a reviewer cannot tell a real request from one that only claims to come from there.
+- Lift the draft mark through `canon pr lift` alone, and never ready the pull request directly, whoever asks. The verb reads the reviews, the evidence, the standing, and CI itself, so its lift needs no one to vouch for the request, and a direct ready skips every gate it holds.
 - Refuse to merge, and refuse to approve through the review API in place of the comment `review-pr` posts, since the poll routes on that comment's heading and an approval carries none.
 - Carry the evidence with a refusal. Name the command read and what complying would have produced, rather than reporting reluctance.
 - Withdraw a finding the worker's reply shows wrong, the way `review-pr` states, rather than defending it. A withdrawal naming its cause is part of a pass, not a retreat from one.
 
 ## Lifetime
 
-- The role runs from the launch to the merge of the pull request it reviewed, and covers every pass on that pull request. A re-review comes back to this session while it is live, which keeps the read the first pass paid for.
+- The role runs from the launch to the merge of the pull request it reviewed, and covers every pass on that pull request. A re-review comes back to this session from the worker directly while it is live, which keeps the read the first pass paid for.
 - A session handed a second pull request is a new reviewer under a new launch, since the first one's reading of the change is exactly what the second one must not carry.
 - Treat this body as possibly older than the branch under review. A plugin skill loads from the marketplace cache rather than from the working tree.

package/claude/skills/role-worker/REQUIREMENT.md

@@ -19,7 +19,7 @@ Finishing is invisible from the other side. A worker that opens a pull request g
 
 Nothing tells the session that refusing is allowed either. Four occasions across two days had a worker halt correctly with the cost falling on the dispatcher, and the correction that mattered most reached the right place because a worker argued back with evidence rather than complying. A role written only as report-upward suppresses exactly that.
 
-The draft mark fails from both ends. On 2026-08-31 four sessions re-drafted a pull request someone had readied, acting on a belief no surface in the tree stated. On 2026-09-07 a controlling session told a worker to lift the mark rather than lifting it itself, and the worker complied and reported against the surface rather than the outcome.
+The draft mark fails from both ends. On 2026-08-31 four sessions re-drafted a pull request someone had readied, acting on a belief no surface in the tree stated. On 2026-09-07 a controlling session told a worker to lift the mark rather than lifting it itself, and the worker complied and reported against the surface rather than the outcome. From 2026-10-12 `canon pr lift` reads the gates itself, so the reviewers run it on a close and the controlling session runs it as the fallback. A worker leaves the verb to them and readies a pull request directly for nobody, since a direct ready skips every gate the verb reads.
 
 ## Must
 

package/claude/skills/role-worker/SKILL.md

@@ -32,8 +32,8 @@ which `auto-ship` Step 2 loads.
 - Report a plan that fails to resolve as unreadable from here, naming the main-root path. Reporting the task as having no plan is true where this session stands and wrong about the world, and a reader with no second tree to check cannot separate the two.
 - Build the plan the launch named. Do not write a second one when the path fails to resolve, since a row that cites a plan already has one and drafting another produces two plans for one row.
 - Copy a ready folder's files verbatim to the paths its plan's constraints name, when the plan's `**Constraints:**` block names one, and edit only what the gate or the overview's own list requires. A rewrite discards the text the handoff exists to carry.
-- Report a draft flag reading ready once, and leave it cleared. The ship chain marks the pull request a draft and no step anywhere un-marks, so a flag reading ready afterwards was lifted by the operator or by the controlling session acting on a closed review, each acting directly on the pull request, which GitHub requires before a merge. Re-drafting fights them, and no surface in the tree states a reason to.
-- Refuse an instruction to lift the mark yourself, whoever sends it. This session cannot verify who is asking or whether review actually closed, so the refusal holds regardless of the sender's claimed authority.
+- Report a draft flag reading ready once, and leave it cleared. The ship chain marks the pull request a draft, and only `canon pr lift` or the operator un-marks it, so a flag reading ready afterwards passed every gate the verb reads or was readied by a person, which GitHub requires before a merge. Re-drafting fights them, and no surface in the tree states a reason to.
+- Leave the lift to the reviewers, who run `canon pr lift` on posting their close, and to the controlling session as the fallback. Refuse an instruction to ready the pull request directly, whoever sends it, since a direct ready skips every gate the verb reads.
 - Rewrite a plan question's `- Suggested:` line as `overridden at execution to <pick>,` plus the measurement when this build decides against an unanswered one, leaving the `- Answer:` slot blank, and put the same deviation in one line under the open task's `## Findings`, per `${CLAUDE_SKILL_DIR}/../plan-feature/references/plan.md`.
 
 ## The board is read-only
@@ -51,13 +51,13 @@ owed and nothing else.
 - Announce the pull request as the ship chain's pull request step returns, carrying the number, the branch, and the task it closes. That transition is the one moment only this session knows, and the controller's review poll no longer starts on a dispatch because of it.
 - Carry the reach in that same message: the paths this branch wrote that another live plan or `## Run now` row holds, and who holds each, which `canon tasks plan-reach` reports as `claimed`. Report each as a rebase the controller should order, never as a breach, since sharing a path is not a hold. The gate cleared this branch against a prediction it has since outgrown, so the controller holds a reading of what this branch shares that stopped being true hours ago and nothing else tells it. Say the reach was unread rather than clear when the installed binary carries no such subcommand, and leave the undeclared list to the pull request.
 - Carry a row this build turned up in that same message, with its title, its origin, and the surface it would take. Send it as its own message only when the session will end before a pull request opens, since the row has no other way to reach the controller.
-- Announce when an address-review pass finishes, as `review-address` Step 8 returns, carrying what was addressed and the PR's new CI state. That transition is the other moment only this session knows, and it is what tells the controller to re-review rather than leaving it to poll for an answer nothing marks as landed.
+- Ask for the re-review when an address-review pass finishes, as `review-address` Step 8 returns, carrying what was addressed and the PR's new CI state. Send it to the reviewer whose sessionId the review dispatch carried, resolved from that id at the moment of sending, since a reviewer holds the trunk branch and no branch lookup finds it. Send it to the controller instead when the dispatch named no reviewer or the id resolves to no live session. That transition is the other moment only this session knows, and the message is what starts the re-review rather than a poll for an answer nothing marks as landed.
 - Send a block out as a message before it becomes an interactive prompt.
 - Send nothing on progress. A worker reporting progress rebuilds, on this side of the channel, the poll the announcement retired on the other.
 
-Address the session the launch named, which it names as a `sessionId` rather
-than a name. `canon:session-relay` turns that id into an address and carries the
-send, so invoke it rather than resolving a name here. It reads the roster at the
+Address the session the launch named, and the reviewer by the sessionId its
+dispatch carried, each as a `sessionId` rather than a name.
+`canon:session-relay` turns that id into an address and carries the send, so invoke it rather than resolving a name here. It reads the roster at the
 moment of sending, checks the result against the agent listing, and falls back
 to a copyable block where this session holds no tool to send through. The
 message owed stays in its own bullet above.

package/claude/skills/session-compact/references/handoff-note.md

@@ -5,7 +5,7 @@ description: What each section of a compact handoff carries, what stays out, and
 
 # Handoff note
 
-The shape `session-compact` writes. It lives here rather than in `standards/` because one skill reads it and a standard nothing else cites has no second reader to correct it.
+The shape `session-compact` writes. It lives in this skill's `references/` because one skill reads it, and a shape nothing else cites has no second reader to correct it.
 
 ## The test every line passes
 

package/claude/skills/target-setup/SKILL.md

@@ -99,7 +99,7 @@ Step 2: `canon tooling sync <tooling-stack> --write` installs stack deps, script
 CANON_NON_INTERACTIVE=1 canon tooling sync <tooling-stack> <target> --write
 ```
 
-Monorepo with multiple language roots: run `canon init` once at the repo root so `base` (husky, prettier, cspell, commitlint, CI) lands single, then sync each subtree with `--skip base` so the shared layer is not re-dropped. Take the subtree commands from the per-root rows the preview printed rather than picking folders by hand. Detection found each root and its stack, and the two commands below show the shape.
+Monorepo with multiple language roots: run `canon init` once at the repo root so `base` (husky, prettier, commitlint, CI) lands single, then sync each subtree with `--skip base` so the shared layer is not re-dropped. Take the subtree commands from the per-root rows the preview printed rather than picking folders by hand. Detection found each root and its stack, and the two commands below show the shape.
 
 ```bash
 CANON_NON_INTERACTIVE=1 canon tooling sync vite-react ./frontend --skip base --write
@@ -108,7 +108,7 @@ CANON_NON_INTERACTIVE=1 canon tooling sync python ./backend --skip base --write
 
 Without `--skip base`, each subtree re-drops husky, and git honors only one `core.hooksPath`, so the extra hook dirs silently break. Each subtree keeps its own framework configs, and its own stack reference reads through `canon tooling reference <stack>`.
 
-A subtree sync withholds `.github/`, since GitHub reads workflows only at the repository root, and names each withheld file with the `working-directory` a root CI job needs. It also writes a nested `cspell.json` that registers the subtree's word lists. A subtree needs its own `bun init` before its scripts and dependencies land. The sync warns and skips them until then.
+A subtree sync withholds `.github/`, since GitHub reads workflows only at the repository root, and names each withheld file with the `working-directory` a root CI job needs. A subtree needs its own `bun init` before its scripts and dependencies land. The sync warns and skips them until then.
 
 Step 3: post-sync fixups. Golden configs arrive from sync, so no config generation is required. But a few items may need a one-time touch:
 

package/claude/skills/target-setup/references/detect.md

@@ -77,9 +77,9 @@ already reach every subfolder. Tooling installs per folder. So resolve one
 governance stack for the whole repository and one tooling stack per language
 root.
 
-- **Stack:** pick the closest governance stack by matching the repository root's detected runtime or framework against stack names in the catalog. If the root matched nothing, `base` is the stack, including when subfolders matched, since no subfolder owns the repository and picking one by order would state a preference nobody gave. Mark it `fallback` in the preview only when no root matched anywhere.
+- **Stack:** pick the governance stack by matching the repository root's detected language against stack names in the catalog. Governance stacks are per language, so a framework never names one, and its rules arrive as extras. If the root matched nothing, `base` is the stack, including when subfolders matched, since no subfolder owns the repository and picking one by order would state a preference nobody gave. Mark it `fallback` in the preview only when no root matched anywhere.
 - **Tooling stack:** for each language root, pick the closest tooling stack from `canon tooling list --json` (e.g. `vite-react`, `astro`, `nextjs`). Distinct from the governance stack. Fall back to `base` for a root with no framework or language match, and carry that fallback into its preview row.
-- **Next.js:** map `next` in a root's `package.json` dependencies, or a `next.config.ts`/`.js`/`.mjs` file in that root, to the `nextjs` governance stack and the `nextjs` tooling stack. The dependency name does not match either stack name by itself.
+- **Next.js:** map `next` in a root's `package.json` dependencies, or a `next.config.ts`/`.js`/`.mjs` file in that root, to the `node` governance stack and the `nextjs` tooling stack. The dependency name does not match the tooling stack name by itself, and the Next.js rule arrives as an extra.
 - **Extras:** run `canon gov detect <target> --stack <stack> --json` from the target and take its `proposals` array as the candidate extras. Each proposal names a `rule` and the `evidence` that matched it across every language root to depth two. The verb already leaves out every rule the picked stack resolves, so do not dedupe again, and do not match a rule's `description` or `paths` by hand.
 - **Subfolder language rules:** a language root below the repository root whose language the picked stack does not carry contributes its language rule by name, read from `canon gov list --json`. The verb proposes no language rule, since a stack reaches each one.
 - **Subfolder tooling:** a language root below the repository root takes its own `canon tooling sync <stack> <path> --skip base`, since `canon init` already lands `base` once at the root. Leave a root whose stack resolves to `base` out of the commands, since that sync would land nothing. A repository-root `package.json` hosting only formatters and hooks is that case, and it adds no row.
@@ -111,7 +111,7 @@ toolkit repository, and option 2 hands the project-local file to `create-rule`.
 Before executing, output:
 
 - **Detected:** each technology with its evidence file, path included, so a subfolder marker reads as one
-- **Stack:** picked governance stack and resolved rule count. Mark it `fallback` when no detected runtime or framework matched a catalog name.
+- **Stack:** picked governance stack and resolved rule count. Mark it `fallback` when no detected language matched a catalog name.
 - **Tooling stack:** one row per language root, each carrying its path, its picked tooling stack, a `fallback` mark on the same test, and its own command. On the repository root's row, name what `base` lands: configs, seeds, and gitignore entries in every case, plus the JavaScript development dependencies, scripts, and hook activation wherever a `package.json` exists to carry them. A project outside that ecosystem runs none of the second group and keeps the first. Omit these rows entirely on the `gov` phase, which syncs no tooling.
 - **Extras:** each proposal with the evidence the verb returned, plus each subfolder language rule, listed in full as the list the operator confirms. A second matched stack reaches the install only through this list, since `canon init --stack` takes one stack, so a shortened list reads as that stack dropped.
 - **Skip:** any `--skip` entries with reason

package/claude/skills/test-craft/SKILL.md

@@ -105,5 +105,5 @@ Run the final filter over every test written this session, checking each line. A
 
 - The red, green, refactor procedure and its order: `test-first`, which loads this skill at its first step
 - Reproducing a failure with no known cause: `systematic-debugging`
-- Runner, file suffix, placement, and query conventions per language: `300-testing-ts`, `330-testing-py`, `335-testing-go`, and `336-testing-php`
-- Settle, guard, and run-scope rules inside an end to end file: `305-e2e-reliability` and `306-test-scope`
+- Runner, file suffix, placement, and query conventions per language: `testing-ts`, `testing-py`, `testing-go`, and `testing-php`
+- Settle, guard, and run-scope rules inside an end to end file: `e2e-reliability` and `test-scope`

package/claude/skills/ux-audit/REQUIREMENT.md

@@ -37,4 +37,4 @@ The pass slides into fixing what it finds, and then the audit and the change lan
 - Feature planning, which `plan-feature` owns
 - Verifying one specific change, which `ui-checklist` owns
 - Defining the intent it audits against, which the design document owns
-- Measuring what a running interface costs to paint, block, or shift, which `ux-measure` owns. Contrast stays here rather than going with it, being computable from two color values this skill already reads off the token table.
+- Measuring what a running interface costs to paint, block, or shift, which `ux-measure` owns. Contrast stays here rather than going with it, being computable from two color values this skill already reads off the stylesheet's custom properties.

package/claude/skills/ux-audit/SKILL.md

@@ -10,14 +10,14 @@ metadata:
 ## Guards
 
 - If no UI files exist in the project (no JSX, TSX, Vue, Svelte, or HTML under `src/`), stop: `❌ No UI surfaces found to audit.`
-- If the request asks what the interface costs to paint, block, or shift at runtime, run nothing and name `ux-measure`. This skill reads source and reaches no number a browser produces. Contrast is the exception and stays here, since it is computable from the two color values already in the token table.
+- If the request asks what the interface costs to paint, block, or shift at runtime, run nothing and name `ux-measure`. This skill reads source and reaches no number a browser produces. Contrast is the exception and stays here, since it is computable from two color values in the stylesheet's custom properties, which the design document's lead names.
 
 ## Step 1: read context
 
 Read these in parallel from the project root, skipping any that do not exist:
 
 - `CLAUDE.md`: project type and conventions
-- `canon/DESIGN.md`: visual intent, tokens, typography, spacing rules
+- `canon/DESIGN.md`: visual intent, typography, and spacing rules, plus the stylesheet its lead names for the values
 - `canon/REQUIREMENTS.md`: feature scope and non-goals
 - A committed capture beside the surface's own source, when the project has one. A rendered surface reads differently composed than it reads written, and a capture is the only artifact here that shows the composed result rather than the markup. Absent one, note that this audit reads source only, and keep going. This is a stated fallback, not a stop: a project with no capture yet, or a capture mid-rebuild, still gets a source-only audit rather than losing the skill entirely.
 

package/claude/skills/ux-measure/REQUIREMENT.md

@@ -43,7 +43,7 @@ A session that does start one picks a runner on the spot. The reading then comes
 ## Out of scope
 
 - Judging the interface against stated intent, which `ux-audit` owns
-- Contrast, which is computable from two color values in the token table `ux-audit` already reads. A contrast failure from a color computed at runtime stays invisible to that reader, and the cost is accepted rather than overlooked.
+- Contrast, which is computable from two color values in the stylesheet `ux-audit` already reads. A contrast failure from a color computed at runtime stays invisible to that reader, and the cost is accepted rather than overlooked.
 - Network waterfall, bundle size, and accessibility, which no version of this measures
 - Writing behavioral tests against the interface, which `test-first` and `test-craft` own
 - Fixing what the reading found

package/claude/skills/write-human/references/machine-tells.md

@@ -21,6 +21,7 @@ Work top down. The first three account for most of what a reader calls machine-w
 - [Question as transition](#question-as-transition)
 - [Escalating parallel clauses](#escalating-parallel-clauses)
 - [Empty superlative frames](#empty-superlative-frames)
+- [A colon or comma where the dash was](#a-colon-or-comma-where-the-dash-was)
 
 ## Rule of three
 
@@ -118,3 +119,14 @@ Fix by writing the two claims as two sentences, or by cutting the one that repea
 `one of the most important`, `a critical piece of`, `at the heart of`. The frame ranks a thing against a set the sentence never names.
 
 Fix by stating what the thing does. A ranking survives only where the set is named and the position is measured.
+
+## A colon or comma where the dash was
+
+An agent told to remove an em dash swaps in a colon or a comma and leaves the sentence as it was. The join is the same and so is the pause the dash made, which is the habit the ban was written against.
+
+```markdown
+Bad: The hook fires on every edit: it reads the record the verb wrote.
+Good: The hook fires on every edit and reads the record the verb wrote.
+```
+
+Fix by splitting the sentence in two, or by cutting the clause that only restates the first. A colon after a label or before a list is not this tell.

package/docs/agents/audits.md

@@ -85,7 +85,7 @@ It sits under the project root rather than beside the aggregator in `src/`. The
 
 ### What is kept out of it
 
-A gitignored record folder holds one machine's session scratch. Its counts describe somebody else's disk, so committing them writes a floor no other clone can reproduce and every contributor reads a regression against a number that was never about their tree. The board and five of the six record kinds are therefore reported on every run and recorded in none. `records-standards` is the exception, because that corpus is tracked.
+A gitignored record folder holds one machine's session scratch. Its counts describe somebody else's disk, so committing them writes a floor no other clone can reproduce and every contributor reads a regression against a number that was never about their tree. The board and every record kind are therefore reported on every run and recorded in none.
 
 An audit that did not report is left out rather than written as zero. Zero there records a clean corpus nobody measured, and the next run reads its real numbers as a regression against a floor that was never taken.
 

package/docs/agents/commands.md

@@ -5,7 +5,9 @@ description: Every top-level command with its purpose, each domain's subcommands
 
 # Command catalog
 
-Full help: `canon <command> --help`. Bare `canon --help` lists every top-level command under five headings, Project, Domains, Author and render, Session and ship, and Repo reports, with descriptions cut at 80 columns. Piped into another command, the block prints without its frame glyphs and carries the same text. Behavior notes for the install and sync verbs live in `install-and-sync.md`.
+Bare `canon --help` lists every top-level command under five headings, Project, Domains, Author and render, Session and ship, and Repo reports, with descriptions cut at 80 columns. A pipe gets the same text without the frame glyphs. Behavior notes for the install and sync verbs live in `install-and-sync.md`.
+
+`canon <command> --help` lists subcommands, and `canon <command> <subcommand> --help` a leaf's flags, exit codes, and examples. `canon <command> --help --all` prints both. An unknown subcommand exits 1 under a group taking no operand.
 
 ## Project-level
 
@@ -19,7 +21,6 @@ One row per top-level command, in the order `canon --help` prints them. A domain
 | `canon migrate <verb>`      | Move a project off a retired name or layout, reporting the plan until `--write`            |
 | `canon targets <verb>`      | Report the projects this toolkit installed into                                            |
 | `canon gov <verb>`          | Install and sync governance rules, and audit the tree against them                         |
-| `canon standards <verb>`    | List, audit, or print a standard by name                                                   |
 | `canon tooling <verb>`      | Sync, diff, and verify tooling stacks                                                      |
 | `canon claude <verb>`       | Install the Claude workflow and audit both skill corpora                                   |
 | `canon wiki <verb>`         | Scaffold the wiki pages                                                                    |
@@ -61,7 +62,7 @@ A port already in use is the ordinary case rather than a refusal, so it walks fo
 
 A request naming a directory is redirected to its trailing-slash form rather than answered in place. A browser resolves a relative asset against the last slash of the URL it is on, so answering `/lesson` directly leaves the page asking for `/course.css` instead of `/lesson/course.css`, and it renders unstyled through the server that exists to prevent exactly that.
 
-Containment is tested after symlinks are followed rather than on the path as written, and the test sits immediately before the read rather than beside the request that produced it. Resolving a request lexically clears a link pointing outside the served root, and this repository is a live instance of that shape, since `claude/standards` is a link out of `claude/`. Position is what makes the property hold: a directory request appends its index after the request path has been checked, so a check placed earlier leaves that index untested. `--index` answers a directory holding no `index.html` with a listing read per request, where the default stays a 404. Every entry the listing names takes the same containment test a request for it would, so a link out of the root is absent rather than greyed, and dotfiles are hidden. With no `--entry` and no root `index.html`, the printed link is `/` and `entryExists` reads true. An `--entry` that escapes the root refuses with `no-entry` before a port is taken, because `url` is the field a caller hands to a reader.
+Containment is tested after symlinks are followed rather than on the path as written, and the test sits immediately before the read rather than beside the request that produced it. Resolving a request lexically clears a link pointing outside the served root, and a link out of the served root is the shape it guards against. Position is what makes the property hold: a directory request appends its index after the request path has been checked, so a check placed earlier leaves that index untested. `--index` answers a directory holding no `index.html` with a listing read per request, where the default stays a 404. Every entry the listing names takes the same containment test a request for it would, so a link out of the root is absent rather than greyed, and dotfiles are hidden. With no `--entry` and no root `index.html`, the printed link is `/` and `entryExists` reads true. An `--entry` that escapes the root refuses with `no-entry` before a port is taken, because `url` is the field a caller hands to a reader.
 
 `canon demo` is the second browser command and the one that ships, since its purpose is running in a target rather than regenerating what this repository commits. It needs a browser binary the package does not carry, installed once with `bunx playwright install chromium`.
 
@@ -79,12 +80,11 @@ query = "button, a[href], input, select, textarea, [tabindex]"
 
 ## Domain commands
 
-Each domain exposes a consistent shape where applicable: `list`, `install`, `sync`, `create`. The page named beside a domain carries its flags, records, and refusals, and `canon <domain> --help` lists the flags of any subcommand.
+Each domain exposes a consistent shape where applicable: `list`, `install`, `sync`, `create`. The page named beside a domain carries its flags, records, and refusals, and `canon <domain> --help --all` prints every subcommand's flags.
 
 - `migrate`, in `migrate.md`: `rename`, `skill-names`, `records`, `surface-roots`, `record-tree`, `rule-layout`, `scratch-evidence`, `record-layout`
 - `targets`, in `targets.md`: `list`, `pulls`
-- `gov`, in `install-and-sync.md`: `list`, `install`, `sync`, `build`, `regen`, `test-order`, `counts`, `superseded`, `citations`, `restated`
-- `standards`, in `standards-audit.md`: `list`, `audit`, `<name>`
+- `gov`, in `install-and-sync.md`: `list`, `install`, `sync`, `build`, `regen`, `detect` (in `gov-detect.md`), `test-order`, `counts`, `superseded`, `citations`, `restated`
 - `tooling`, in `install-and-sync.md`: `list`, `sync`, `diff`, `reference`, `verify`, `inject`, `prune-gitignore`
 - `claude`, in `skills-audit.md`: `init`, `sync`, `setup`, `routing`, `plugin-update`, `seeds list`, `skills list`, `skills audit`, `skills drift`, `skills reach`, `skills rank`
 - `wiki`, in `scripting.md`: `init`
@@ -94,16 +94,17 @@ Each domain exposes a consistent shape where applicable: `list`, `install`, `syn
 - `slides`, described below: `render`, `list`
 - `demo`, in `demo.md`: `compile`, `run`, `frames`
 - `inventory`, described above: `run`
-- `teach`, in `teach.md`: `list`, `open`, `resource`, `glossary`, `lesson`, `stylesheet`, `nav`, `render`
-- `canvas`, described below: `serve`, `list`, `page add`, `page rename`, `frame add`, `frame move`, `frame resize`, `selection`, `edit`, `editing`, `capture`
-- `sandbox`, in `sandbox.md`: `reset`, `clean`, `check`, `coverage`
+- `teach`, in `teach.md`: `list`, `up`, `open`, `resource`, `glossary`, `lesson`, `stylesheet`, `nav`, `render`
+- `canvas`, described below: `serve`, `list`, `page add`, `page rename`, `frame add`, `frame move`, `frame resize`, `fit`, `arrange`, `selection`, `edit`, `editing`, `capture`
+- `sandbox`, in `sandbox.md`: `run`, `equivalence`, `reset`, `clean`, `check`, `coverage`
 - `tasks`, in `tasks.md`: `next-label`, `archive`, `decline`, `plan-citations`, `plan-answers`, `plan-branch`, `plan-reach`, `plan-link`, `pull-request`, `outcome`, `list`, `validate`
 - `intake`, in `intake.md`: `list`, `answer`
-- `records`, in `records.md`: `validate`, `migrate`, `ordinal`, `size`, `stale`, `prune-tmp`, `push`, `pull`
+- `records`, in `records.md`: `validate`, `ordinal`, `size`, `stale`, `prune-tmp`, `push`, `pull`
 - `sessions`, in `sessions.md`: `list`, `export`, `import`
-- `worktrees`, in `worktrees.md`: `list`, `reclaim`
+- `worktrees`, in `worktrees.md`: `list`, `reclaim`, `repair-bare-flag` (hidden)
 - `hooks`, in `hooks.md`: `post-merge`
-- `pr`, in `pr-reads.md`: `key-changes`, `head`, `checks`, `review-state`, `evidence`, `preview`, `local`, `frames`, `lift` (in `pr-lift.md`)
+- `pr`, in `pr-reads.md`: `key-changes`, `head`, `checks`, `review-state`, `evidence`, `preview`, `local`, `frames`, `lift` (in `pr-lift.md`), `tick` (in `pr-tick.md`)
+- `upstream`, in `upstream.md`: `fetch`, `catalog`, `due`, `advance`
 - `audits`, in `audits.md`: `run`, `list`
 - `gate`, in `gate.md`: `run`
 - `secrets`, in `state-scoped-risk.md`: `scan`
@@ -130,7 +131,7 @@ Subcommands no other page describes:
 - A deck folder's `deck.json` and the faces it embeds, its per-slide `<body>` attributes, transitions and entrances, speaker notes, and charts are described in `slides.md`.
 - `canvas`, with its verbs, content format, and write routes, is described in `canvas.md`.
 - `labels apply <number>` adds the labels this branch earns to its open pull request, refusing a pull request whose head is not the current branch or that is not open, and never creating a label the remote lacks or removing one a person added (`--check` writes nothing and exits 2 when labels are owed, `--base`, `--json`).
-- `labels scan` fails a pull request or a posted review whose title, body, or review comment carries a phase label, a label a code span quotes, a gitignored record path, a session link, a banned character, a body heading outside the closed section list or a missing `## Summary` or `## Key changes`, a title word no dictionary holds, or a title breaking `claude/skills/git-pr/references/pr.md`'s format, casing, or length rule (`--event`, `--body-file`, `--json`).
+- `labels scan` fails a pull request or a posted review whose title, body, or review comment carries a phase label, a label a code span quotes, a gitignored record path, a session link, a banned character, a body heading outside the closed section list or a missing `## Summary` or `## Key changes`, or a title breaking `claude/skills/git-pr/references/pr.md`'s format, casing, or length rule (`--event`, `--body-file`, `--json`).
 
 ## Version skew
 

package/docs/agents/comments.md

@@ -29,6 +29,6 @@ This works only because density is a pure function of a tree. Which author or se
 
 ## Degradation sweep
 
-The degradation sweep reads its vocabulary from whichever rule publishes a `## Degradation vocabulary` heading, preferring `.claude/rules/` over `governance/rules/`, so one definition serves the toolkit and every target. Discovery anchors on the heading rather than a filename, because a renumbered rule would otherwise empty the vocabulary while the sweep still reported clean. With no such rule the sweep reports **skipped** rather than zero hits, since finding nothing and looking for nothing mean opposite things.
+The degradation sweep reads its vocabulary from whichever rule publishes a `## Degradation vocabulary` heading, preferring `.claude/rules/` over `governance/rules/`, so one definition serves the toolkit and every target. Discovery anchors on the heading rather than a filename, because a renamed rule would otherwise empty the vocabulary while the sweep still reported clean. With no such rule the sweep reports **skipped** rather than zero hits, since finding nothing and looking for nothing mean opposite things.
 
 `090-code-comments` is the rule that publishes the list, and it ships on the `base` stack. A project that installs or syncs governance for the first time after that rule landed gets a sweep that previously reported skipped, so hits appear where the command used to stay quiet. Edit the backticked terms in the installed copy to change what that project sweeps for. The sweep matches comment text, so a comment naming a term as an example is a hit, and a hit is a prompt to read the line rather than a verdict on it.

package/docs/agents/counts.md

@@ -22,11 +22,10 @@ Under `--json` the record holds stdout alone and the frame still renders on stde
 
 ## The catalogs it reads
 
-A closed set of five, each with a filesystem reader behind it rather than every list command this CLI ships:
+A closed set of four, each with a filesystem reader behind it rather than every list command this CLI ships:
 
 - `skills`: shipped plugin skills, a folder per `claude/skills/*/SKILL.md`
 - `rules`: authored governance rules, a file per `governance/rules/**/*.md`
-- `standards`: the authoring corpus at `standards/`
 - `commands`: top-level `canon` commands, read off `src/cli.ts`'s registration imports
 - `audits`: the registered set in `src/audits/catalog.ts`, this entry included
 
@@ -36,7 +35,7 @@ The set is closed rather than derived, so widening it is a deliberate change to
 
 A sentence has to carry an assertion verb (`loads`, `ships`, `carries`, `holds`, `counts`, `totals`, `documents`, `declares`, `installs`, `lists`, `contains`, `comprises`, `authors`), the quantifier `all`, or an article (`the`, `a`, `an`) immediately ahead of the number, which is immediately ahead of the catalog noun, with one optional qualifying word between the number and the noun (`sixty-one shipped skills`). The number reads either as digits or as a spelled-out cardinal through ninety-nine, since this corpus states a catalog size in words as often as in digits.
 
-Nothing stands between the trigger and the number, which is the rule an author writing a new count has to know. It separates `the toolkit authors 60 rules` and `took all 60 rules`, both read, from `a domain of 55 skills` and `denominator of sixty-one shipped skills`, neither of them read. A figure meant as a past state takes a date in the same sentence instead, which reads the sentence past whatever its shape.
+Nothing stands between the trigger and the number, which is the rule an author writing a new count has to know. It separates `the toolkit authors 49 rules` and `took all 49 rules`, both read, from `a domain of 55 skills` and `denominator of sixty-one shipped skills`, neither of them read. A figure meant as a past state takes a date in the same sentence instead, which reads the sentence past whatever its shape.
 
 ## How the trigger set grew
 
@@ -44,7 +43,7 @@ The verb gate is not the first design tried. A bare number next to a catalog nou
 
 The article half was added after a first review of the shipped design found a live miss: the development domain's gating-stages entry stated a stale audit total while the tree held 20, and the verb gate never reached it, since that sentence puts its verb after the noun rather than ahead of the number. Widening the trigger set to admit an article ahead of the number closed that gap.
 
-The quantifier `all` and the verb `authors` joined on the same evidence, two more live misses failing only the trigger test. Allowing words to stand between the trigger and the number was the other candidate, measured and declined: at widths of one, two, and three it reached 77, 104, and 132 sentences against a baseline of 65, missed `took all 60 rules` at every width, and reached `the toolkit authors 60 rules` only at a width admitting the indirect-noun shape below. The two words reach both at 75 sentences and no false positive.
+The quantifier `all` and the verb `authors` joined on the same evidence, two more live misses failing only the trigger test. Allowing words to stand between the trigger and the number was the other candidate, measured and declined: at widths of one, two, and three it reached 77, 104, and 132 sentences against a baseline of 65, missed `took all 49 rules` at every width, and reached `the toolkit authors 49 rules` only at a width admitting the indirect-noun shape below. The two words reach both at 75 sentences and no false positive.
 
 ## The plausibility filter
 
@@ -52,13 +51,13 @@ The verb gate alone still left four false positives standing: `carries two rules
 
 A stated figure is read only when it sits within a factor of two of the true count, in either direction. That bound is tuned against the run this sweep was written against rather than reasoned to from first principles, the way `restated.ts` tunes its own document-frequency ceiling, and it is a property of the scale every catalog here sits at (the tens) rather than a universal rule.
 
-The article gate is looser than the verb list and carries a real cost. Re-running against the tree once it widened caught the live miss above and also misread a passage in `canon/context/standards/destinations.md` naming a real subset, a standard outside the retired `standards/bundled/` fan-out, as a claim about the whole standards catalog. The qualifying adjective there fills the same optional-word slot `sixty-one shipped skills` needs to match at all, and no syntactic rule tells a qualifier that narrows a catalog from one that only restates it. The finding could not be closed by correcting a figure, since the sentence was true when the corpus held it, only unmarked as a past state, which is the class the date exclusion already reads past. Naming the moment, the same way a context entry dates its own figures, closed it with no change to the matcher.
+The article gate is looser than the verb list and carries a real cost. Re-running against the tree once it widened caught the live miss above and also misread a passage in the standards destinations entry, since retired, naming a real subset, a standard outside the retired bundled fan-out, as a claim about the whole standards catalog. The qualifying adjective there fills the same optional-word slot `sixty-one shipped skills` needs to match at all, and no syntactic rule tells a qualifier that narrows a catalog from one that only restates it. The finding could not be closed by correcting a figure, since the sentence was true when the corpus held it, only unmarked as a past state, which is the class the date exclusion already reads past. Naming the moment, the same way a context entry dates its own figures, closed it with no change to the matcher.
 
 ## What it does not measure
 
 A delta phrased as a transition (`from fourteen to fifteen`), a fraction (`thirteen of sixteen`), and a total reached through an indirect noun (`denominator of sixty-one shipped skills`) are all catalog-size claims this corpus carries, and none matches the trigger shape this reads. Each stays a known gap. The false-positive rate that gated closing them has a measurement behind it now, and what it showed is that the widening these three need is the one that costs a false positive rather than the one that does not.
 
-A second figure in a sentence whose first figure already matched is a fourth gap and a structural one, since one match is taken per catalog per sentence. `authors 60 rules under governance/rules/ and consumes 39 into .claude/rules/` is read for its 60 alone, which is correct here because the two figures name different populations, and a sentence stating one catalog twice would go unread the same way.
+A second figure in a sentence whose first figure already matched is a fourth gap and a structural one, since one match is taken per catalog per sentence. `authors 49 rules under governance/rules/ and consumes 31 into .claude/rules/` is read for its 49 alone, which is correct here because the two figures name different populations, and a sentence stating one catalog twice would go unread the same way.
 
 A calendar date (`2026-08-21`) or a backticked commit reference in the same sentence reads the whole sentence past, since that is how this corpus already marks a figure as a historical record rather than a live claim. The context entries carry a figure this way deliberately, and every one of them stays correct forever.
 

package/docs/agents/drift-surfaces.md

@@ -50,23 +50,19 @@ seed tree rather than from a fixed set of filenames, so a folder added later is
 covered without a code change. Only an exact stem matches, which leaves a
 suffixed variant such as `TASKS-ARCHIVE.md` unreported.
 
-No skill splits the file. The standard governing `replacedBy` is the one the
-`appliesTo` the standards catalog declares, and `canon standards <name>` reads
-its destination shape, so the split is the project's own to make.
+No skill splits the file. The destination's shape lives in the skill that owns
+it, so the split is the project's own to make.
 
 `unmigrated` names a domain sitting at the root layout an older toolkit installed
 to, with nothing at the path the current one reads. It carries `rootPath`,
-`installPath`, and a file count. Without it a project holding `standards/` at its
+`installPath`, and a file count. Without it a project holding an older layout at its
 root reports zero entries for that domain and reads as clean, which is the most
 misleading state the report can produce.
 
-The field currently names no domain. Standards and snippets are the two the
-toolkit ever installed at a project root. Standards closed its install channel
-and snippets retired outright, so a project still holding a root `standards/`
-folder is carrying its own authoring surface rather than an unfinished install.
-Nothing proposes moving it, and no command relocates the content. Move it
-yourself. A leftover `snippets/` folder reports under the reverse walk instead,
-where `docs/target/sync.md` says what to do with it.
+The field currently names no domain. Snippets was the one the toolkit ever
+installed at a project root, and it retired outright. A leftover `snippets/`
+folder reports under the reverse walk instead, where `docs/target/sync.md` says
+what to do with it.
 
 `unmovedSurfaces` names a tracked surface the target still holds at its `.claude/`
 spelling with nothing at the `canon/` one, such as `.claude/REQUIREMENTS.md` or
@@ -123,14 +119,14 @@ that is not a full clone as unmeasured rather than clean. This gap does not
 reach the chain-based read above, since it consults no anchor at all.
 
 In the fallback, entitlement is filtered, because a stack does not receive
-every rule. The base stack takes four folders whole, the code stacks add `code`, and
-every other stack extends them with individually named rules, so an unfiltered
-list would tell a base consumer about rules it can never receive and train the
-reader to skip the section.
-
-The filter accepts a band on either of two grounds. A folder the base stack takes
-whole is entitled to every target, read from the stack file so a folder added to
-base later needs no code change. Every other band is read off the folders the
+every rule. The base stack names ten rules, the language stacks add `code` and
+their own language and testing rules, and every other rule is opt-in, so an
+unfiltered list would tell a base consumer about rules it can never receive and
+train the reader to skip the section.
+
+The filter accepts a band on either of two grounds. A folder holding a rule the
+base stack resolves to is entitled to every target, read through the stack file so
+a rule added to base later needs no code change. Every other band is read off the folders the
 target already carries, which is the fallback's only evidence of what a target
 was entitled to before it recorded a chain. One band can be reached by more than
 one stack, so the test over-reports inside a folder the target holds, which

package/docs/agents/gov-detect.md

@@ -31,7 +31,7 @@ Both reads stop at depth two, which reaches a service folder and a workspace pac
   "stack": "node",
   "proposals": [
     {
-      "rule": "200-react",
+      "rule": "react",
       "evidence": [{ "kind": "dep", "match": "react", "path": "package.json" }]
     }
   ]

package/docs/agents/index.md

@@ -45,11 +45,11 @@ CLI catalog and invocation rules for agents, split by command domain. Start with
 - [The pull request checklist tick](pr-tick.md): How canon pr tick marks the checklist boxes a UI pass drove, the stamp that names the commit each passed at, why a render at a newer head clears a tick, the refusal reasons it names, and why a taste box is never ticked
 - [Records push](records-push.md): Backing the record folders to a private remote and restoring them, which folders the payload carries, the one-time setup, the refusal reasons, and the hook that runs the push
 - [Records stale](records-stale.md): Counting the releases since the requirements record was last reviewed, where the review date is read from, and the exit codes and refusals
-- [Records validate](records-validate.md): Validating the session records and the standards corpus, the per-kind checks, which root each kind defaults to, the exit codes, and the refusal reasons
+- [Records validate](records-validate.md): Validating the session records, the per-kind checks, which root they default to, the exit codes, and the refusal reasons
 - [Records](records.md): The two roots a record folder resolves at, claiming the ordinal intake and groundwork share, reading each folder's size and growth, pruning stale scratch, and where validation, the canonical review count, and the private-remote backup are described
 - [Restated instructions](restated.md): Counting the instructions the always-loaded file and every path-scoped rule share with the seed, the skill bodies, and each other, how a match is decided, the three classes, which surface a later edit starts from, and why the sweep reports rather than gates
 - [Routing report](routing.md): Reading per CLAUDE.md section how many bullets name a path, what counts as naming one, when a rule counts as covering it, the two refusals, and why the verb reports rather than gates
-- [Rule citations](rule-citations.md): Resolving every path a governance rule cites and every frontmatter glob the internal corpus declares, the three forms a citation is written in, the shapes that look like citations and are not, the two classes where an absent path is correct, why the glob half reads one corpus, and why this one gates
+- [Rule citations](rule-citations.md): Resolving every path a governance rule cites and every frontmatter glob the internal corpus declares, the one form a citation is written in, the shapes that look like citations and are not, the two classes where an absent path is correct, why the glob half reads one corpus, and why this one gates
 - [Sandbox](sandbox.md): Scenario routing, the expectation scoring surface, and the coverage census over scenarios and skills
 - [Scripting](scripting.md): The runtime catalogs that replace hardcoded names, what each carries, and a headless invocation per domain
 - [Sessions transfer](sessions-transfer.md): Moving a session to another machine, the export bundle and its manifest, placing it with import, the refusal reasons, and what a resume on the target depends on
@@ -57,7 +57,6 @@ CLI catalog and invocation rules for agents, split by command domain. Start with
 - [Skill audit](skills-audit.md): Measuring both skill corpora against the skill standards, the checks it reads, the requirement gate that is the only failing one, and the drift verb that names bodies rewritten since a ref
 - [Citation reach](skills-reach.md): Reporting the skill bodies that cite a path no target project receives, which corpus the verb reads, the ownership key that decides what counts, the one-word qualifier that marks a citation as decided, and why the verb reports instead of gating
 - [Slides](slides.md): Where a deck folder lives and what it holds, what it declares for the whole deck in deck.json, the faces it embeds, what each slide declares on its own body, transitions and entrances, the master built from the project's tokens, speaker notes, charts, and what each refusal reports
-- [Standard success criteria](standards-audit.md): Reading the corpus against the success-criterion gate, the two headings it accepts, why the check scopes to arrival rather than the whole corpus, and the exit codes it sets
 - [State-scoped risk](state-scoped-risk.md): Reading committed state rather than an arriving change, the shipped-tree corpus the secret scan reads, what it keys on and how a deliberate value is exempted, the advisory check and its network failure mode, and why one gates while the other reports
 - [Superseded values](superseded.md): Reading where the tree still asserts a value a changed convention no longer produces, why the sweep keys on the value rather than the file, the family stem behind a templated citation, the exemption marker, the blind spots it cannot reach, and why it reports rather than gates
 - [Targets](targets.md): The projects this toolkit installed into, the record the install writes against the sweep that backs it, what bounds each answer, and the cross-target pull request read

package/docs/agents/install-and-sync.md

@@ -19,7 +19,7 @@ removes a stale `.claude/GOV.md` from the retired build. Use
 
 Everything under `.claude/rules/canon/` belongs to the toolkit, so a rule
 there that the toolkit no longer ships is deleted on sync, edited or not. That
-is how a retired rule stops loading in a target. A renamed or renumbered rule
+is how a retired rule stops loading in a target. A renamed rule
 the toolkit declares in `governance/renames.toml` moves instead: the sync
 installs the rule under its new name and deletes the old file, whether or not
 the target's stamp records a stack. Local edits to the old file are not
@@ -27,16 +27,16 @@ carried, and the sync says so. The sync lists each change by path before it
 applies, and the target's git diff is the record afterwards. `canon sync
 --check` lists the same file as `retired` or `renamed` before any sync runs.
 
-A rule that only routed a path to a standard ships under that standard's name,
-but the tasks, plan, context, and skill rules are hand-written at `canon/` and
-`claude/skill.md`. A held copy of each syncs in place, and the groundwork,
-intake, session, design, readme, and rule copies are deleted as retired. The
-markdown rule is hand-written at `writing/markdown.md`, and a target holding
-`standards/markdown.md` keeps it there as `800-prose` retires.
+A rule that only routed a path to a standard now names the skill that owns
+the guidance. The tasks, plan, context, and skill rules are hand-written at
+`canon/` and `claude/skill.md`. A held copy of each syncs in place, and the
+groundwork, intake, session, design, readme, and rule copies are deleted as
+retired. The markdown rule is hand-written at `writing/markdown.md` and names
+the `markdown-craft` skill, and `800-prose` retires.
 
-A project's own rules belong under `.claude/rules/project/`, where
-`canon standards rule` reserves `900-999` for them, and a rule placed under
-`canon/` instead is lost on the next sync.
+A project's own rules belong under `.claude/rules/project/`, where a slug
+the toolkit also ships collides with nothing, and a rule placed under `canon/`
+instead is lost on the next sync.
 
 A sync never deletes a rule that a newer canon release installed. The stamp
 records the newest release that synced governance, and an older binary holds
@@ -86,12 +86,6 @@ from an anchor a later sync could advance past the rule's own commit. A
 target whose install predates the recorded chain falls back to the same
 band-inference `newRules` uses in `canon sync --check`.
 
-There is no `canon standards sync` and no `canon standards install`. The corpus
-installs into no project, so the domain has nothing in a target to reconcile.
-`canon standards <name>` prints one, resolving `standards/` at the working root
-and then the corpus inside the package, and `canon standards list --json` carries
-the catalog, each entry labeled by the root it was read from.
-
 ## Tooling diff and sync
 
 `canon tooling diff <stack> [target]` is the read-only comparison, and a session asking what differs reaches for it by default. It writes nothing and exits 1 when anything differs and 0 when nothing does, so it gates CI. `--json` adds the scan record on stdout with `ok: true`, and the frame goes to stderr. A refusal such as an unknown stack, an excluded stack, or a toolkit-root target still exits 1 and answers `{ ok: false, reason, message }`, so a caller branches on the record and reads a typo'd stack name as a refusal rather than as drift.
@@ -129,23 +123,6 @@ Claude Code loads both copies of an edited rule at session start. Run `canon
 migrate rule-layout` first to move a target off the flat layout, which reports
 what it would move and applies it under `--write`.
 
-## Standards resolution
-
-`canon standards <name>` writes the document to stdout and the root it answered
-from to stderr, so a caller capturing with `$(...)` receives the document alone.
-A name resolves with or without its `.md` extension, and one that matches no
-standard exits 1 after listing the catalog on stderr.
-
-Two roots answer, in order: `standards/` at the working directory, then the
-corpus inside the package. A project that authors standards of its own uses the
-first, and this repository's own authoring root is the same path. `.claude/standards/`
-is not among them, and no repository writes one any more. A copy an older
-toolkit installed into a target resolves nothing.
-
-There is no citation closure to compute, since nothing is copied. A standard
-that hands a concern to a sibling names it in `Does not govern:` and a reader
-runs the verb again for that name.
-
 ## Governance regen
 
 `canon gov regen` is the one governance verb that runs against the toolkit root,
@@ -258,7 +235,6 @@ still prompts. `--skip` takes `wiki`, `governance`, and `records`, and warns
 without aborting on any other value. Records has nothing to run non-interactively,
 since the private backup repository does not exist yet at scaffold time, so its
 step only prints the one-time setup reminder and `--skip records` silences it.
-There is no `--standards`, since no run writes that corpus into the target.
 
 ## Unguarded tooling primitives