@erclx/canon 5.35.0 → 5.37.0

package/claude/skills/teach-workspace/references/lesson-build.md

@@ -14,6 +14,9 @@ Mechanics rather than judgment. `lesson-craft.md` covers what a lesson should be
 - `{"type":"heading","level":1|2,"text":"<text>"}`: an `<h1>` or `<h2>`.
 - `{"type":"paragraph","text":"<text>","lede":true,"cites":[1]}`: a `<p>`, marked `lede` for the dek that opens the lesson. `cites` adds a footnote marker per reference number after the text, and a lede takes none.
 - `{"type":"list","items":["<text>", ...],"ordered":true}`: a `<ul>` or, with `ordered`, an `<ol>`.
+
+### Reference, code, and raw blocks
+
 - `{"type":"refs","items":[{"title":"<name>","url":"<https URL>","note":"<text>"}, ...]}`: the lesson's one reference list, numbered from 1 in item order. `url` and `note` are optional, and a `url` must be http or https.
 - `{"type":"code","lang":"ts","text":"<source>"}`: a code sample, highlighted at render time with no script. `lang` is optional and takes a highlight.js name or alias. One the renderer does not register renders as plain escaped code.
 - `{"type":"raw","html":"<markup>"}`: the escape hatch, passed through unescaped.

package/claude/skills/teach-workspace/references/lesson-craft.md

@@ -84,6 +84,9 @@ The quiz shape is a contract rather than a convention. `canon teach nav` splices
 - Give every option in one question the same `name`, and a different `name` per question. Options sharing a name across two questions let one answer clear another.
 - Mark the correct option with `data-a="1"` and leave the others without the attribute
 - Carry `data-k` on the `label`, since the workspace stylesheet renders the key letter from it
+
+#### Structure and the legacy button
+
 - Keep `.fb` the last child of its `.q`. The stepper reveals it as a direct child, and a feedback block nested deeper stays hidden.
 - Put the option text in a `<span>` inside the label rather than bare beside the input, so the workspace can lay the two out
 - Never write a `<button class="opt">` in a new lesson. That is the shape written before the stepper, and it is kept working by an injected script the presence of a button is what still triggers.

package/claude/skills/teach-workspace/references/teach.md

@@ -32,14 +32,14 @@ Governs a learning workspace under `.canon/teach/<nn>-<topic>/`: folder layout,
 
 Does not govern:
 
-- The frontmatter, entry shape, and ordering of the glossary the workspace holds: the `teach-workspace` skill, which carries that reference
-- What a lesson teaches, how it sequences difficulty, and what makes one worth returning to, which belong to the surface driving the workspace
-- Where a durable page goes once it leaves the workspace, which belongs to the routing test the destination surface states
-- One question measured in depth before anyone can plan against it: `groundwork.md`
-- A dump of many findings filed by domain, each carrying its own verdict: `intake.md`
-- Voice, rhythm, and sentence construction: the `write-human` skill
-- Headings, punctuation, word choice, and file references: `markdown.md`
-- When a workspace opens at all, and the procedure that runs one, which belong to the surface driving it
+- **the `teach-workspace` skill**: the frontmatter, entry shape, and ordering of the glossary the workspace holds, which that skill's reference carries
+- **the surface driving the workspace**: what a lesson teaches, how it sequences difficulty, and what makes one worth returning to
+- **the routing test the destination surface states**: where a durable page goes once it leaves the workspace
+- **`groundwork.md`**: one question measured in depth before anyone can plan against it
+- **`intake.md`**: A dump of many findings filed by domain, each carrying its own verdict
+- **the `write-human` skill**: voice, rhythm, and sentence construction
+- **`markdown.md`**: headings, punctuation, word choice, and file references
+- **the surface driving it**: when a workspace opens at all, and the procedure that runs one
 
 ## What a working workspace looks like
 

package/claude/skills/test-craft/SKILL.md

@@ -57,6 +57,11 @@ Every test carries these, at any layer and in any runner:
 - Verify one behavior per test.
 - Keep conditional logic and loops out of a test body. A table of cases is one test per row, never a branch inside one.
 - Set no coverage percentage as a target. Cover the behaviors and their edges.
+
+### Isolation and assertions
+
+Every test carries these too:
+
 - Group related tests with the framework's nesting mechanism, and keep it to two levels deep.
 - Keep tests independent with no shared side effects. Clean up and restore state after each one.
 - Await every async operation. Never leave a promise fire-and-forget in a test.
@@ -105,5 +110,5 @@ Run the final filter over every test written this session, checking each line. A
 
 - The red, green, refactor procedure and its order: `test-first`, which loads this skill at its first step
 - Reproducing a failure with no known cause: `systematic-debugging`
-- Runner, file suffix, placement, and query conventions per language: `300-testing-ts`, `330-testing-py`, `335-testing-go`, and `336-testing-php`
-- Settle, guard, and run-scope rules inside an end to end file: `305-e2e-reliability` and `306-test-scope`
+- Runner, file suffix, placement, and query conventions per language: `testing-ts`, `testing-py`, `testing-go`, and `testing-php`
+- Settle, guard, and run-scope rules inside an end to end file: `e2e-reliability` and `test-scope`

package/claude/skills/ux-audit/REQUIREMENT.md

@@ -37,4 +37,4 @@ The pass slides into fixing what it finds, and then the audit and the change lan
 - Feature planning, which `plan-feature` owns
 - Verifying one specific change, which `ui-checklist` owns
 - Defining the intent it audits against, which the design document owns
-- Measuring what a running interface costs to paint, block, or shift, which `ux-measure` owns. Contrast stays here rather than going with it, being computable from two color values this skill already reads off the token table.
+- Measuring what a running interface costs to paint, block, or shift, which `ux-measure` owns. Contrast stays here rather than going with it, being computable from two color values this skill already reads off the stylesheet's custom properties.

package/claude/skills/ux-audit/SKILL.md

@@ -10,14 +10,14 @@ metadata:
 ## Guards
 
 - If no UI files exist in the project (no JSX, TSX, Vue, Svelte, or HTML under `src/`), stop: `❌ No UI surfaces found to audit.`
-- If the request asks what the interface costs to paint, block, or shift at runtime, run nothing and name `ux-measure`. This skill reads source and reaches no number a browser produces. Contrast is the exception and stays here, since it is computable from the two color values already in the token table.
+- If the request asks what the interface costs to paint, block, or shift at runtime, run nothing and name `ux-measure`. This skill reads source and reaches no number a browser produces. Contrast is the exception and stays here, since it is computable from two color values in the stylesheet's custom properties, which the design document's lead names.
 
 ## Step 1: read context
 
 Read these in parallel from the project root, skipping any that do not exist:
 
 - `CLAUDE.md`: project type and conventions
-- `canon/DESIGN.md`: visual intent, tokens, typography, spacing rules
+- `canon/DESIGN.md`: visual intent, typography, and spacing rules, plus the stylesheet its lead names for the values
 - `canon/REQUIREMENTS.md`: feature scope and non-goals
 - A committed capture beside the surface's own source, when the project has one. A rendered surface reads differently composed than it reads written, and a capture is the only artifact here that shows the composed result rather than the markup. Absent one, note that this audit reads source only, and keep going. This is a stated fallback, not a stop: a project with no capture yet, or a capture mid-rebuild, still gets a source-only audit rather than losing the skill entirely.
 

package/claude/skills/ux-measure/REQUIREMENT.md

@@ -43,7 +43,7 @@ A session that does start one picks a runner on the spot. The reading then comes
 ## Out of scope
 
 - Judging the interface against stated intent, which `ux-audit` owns
-- Contrast, which is computable from two color values in the token table `ux-audit` already reads. A contrast failure from a color computed at runtime stays invisible to that reader, and the cost is accepted rather than overlooked.
+- Contrast, which is computable from two color values in the stylesheet `ux-audit` already reads. A contrast failure from a color computed at runtime stays invisible to that reader, and the cost is accepted rather than overlooked.
 - Network waterfall, bundle size, and accessibility, which no version of this measures
 - Writing behavioral tests against the interface, which `test-first` and `test-craft` own
 - Fixing what the reading found

package/claude/skills/video-craft/SKILL.md

@@ -60,6 +60,9 @@ The guidance covers landscape 16:9 video. Vertical 9:16 framing is not covered y
 - Every move in the composition shares one duration.
 - A caption is centered on screen and covers the element the step acts on.
 - A caption names a step the frame is not showing.
+
+### Timing and checks
+
 - The zoom's start time was added up by hand while a timeline file sits beside the take.
 - Two pointers appear on one frame.
 - A checker finding was dismissed and no frame was opened.
@@ -77,6 +80,9 @@ The guidance covers landscape 16:9 video. Vertical 9:16 framing is not covered y
 - Easing, speed variety, anchoring, click timing, and every other general motion rule: `hyperframes-animation` and `hyperframes-creative`
 - Title-safe margins and timeline layout: `hyperframes-studio`
 - The carve that sits music under a voice: `hyperframes-audio`
+
+### Media, capture, and reading
+
 - Fetching or generating music, effects, voice, and imagery: `media-use`
 - Recording the take and writing its timeline: `record-screencast` through `canon demo run`
 - Reading a render frame by frame: `read-frames`

package/claude/skills/write-human/SKILL.md

@@ -24,9 +24,15 @@ The banned characters sit in `${CLAUDE_SKILL_DIR}/../markdown-craft/references/m
 - Write for a developer who is scanning rather than studying. Every sentence has to land on first read.
 - Use active voice, and present tense unless past or future is factually correct.
 - Name the actor in a sentence that has one. Passive voice with an unnamed actor hides who acts and reads as evasion.
+
+### Word choice
+
 - Prefer direct verbs and plain words. Write `use` over `utilize`, `help` over `facilitate`, `is` over `serves as`.
 - Drop marketing words: `seamless`, `robust`, `powerful`, `revolutionary`, `enhanced`, `allows`, and `leverage`. Each claims a quality without showing it, so state what the thing does and let the reader judge it.
 - Drop vague qualifiers: `simply`, `just`, `easily`, `quickly`, `very`, and `really`. Cut the word where the sentence stands without it, and give the measurement where the degree matters.
+
+### Stance and density
+
 - Be direct on an established fact. Hedge on a genuinely uncertain claim and say which it is.
 - Assume developer-level knowledge. Skip the explanation the reader already carries.
 - Front-load the key information in a paragraph, and give every sentence something the reader did not have.
@@ -38,6 +44,9 @@ Uniform cadence is the tell that survives the cleanest ban scan. Measure it rath
 - Read the paragraph as one block. Uniformity is audible and close to invisible line by line.
 - Compare the longest and shortest sentence in a paragraph. Within roughly five words of each other means the paragraph has one cadence and needs a short sentence or a long one added.
 - Count the opening word of each sentence. Two alike is coincidence and three is a pattern to break.
+
+### Variety
+
 - Vary the grammatical shape of the opening, not the word alone. Three sentences opening on three different subjects still share one shape.
 - Never buy variety with a fragment. A verbless clause standing as a sentence trades one uniformity for another and is the failure these rules exist against.
 - Use a substantive connective where the flow needs one, and never add a word for rhythm alone.

package/claude/skills/write-human/references/machine-tells.md

@@ -21,6 +21,7 @@ Work top down. The first three account for most of what a reader calls machine-w
 - [Question as transition](#question-as-transition)
 - [Escalating parallel clauses](#escalating-parallel-clauses)
 - [Empty superlative frames](#empty-superlative-frames)
+- [A colon or comma where the dash was](#a-colon-or-comma-where-the-dash-was)
 
 ## Rule of three
 
@@ -118,3 +119,14 @@ Fix by writing the two claims as two sentences, or by cutting the one that repea
 `one of the most important`, `a critical piece of`, `at the heart of`. The frame ranks a thing against a set the sentence never names.
 
 Fix by stating what the thing does. A ranking survives only where the set is named and the position is measured.
+
+## A colon or comma where the dash was
+
+An agent told to remove an em dash swaps in a colon or a comma and leaves the sentence as it was. The join is the same and so is the pause the dash made, which is the habit the ban was written against.
+
+```markdown
+Bad: The hook fires on every edit: it reads the record the verb wrote.
+Good: The hook fires on every edit and reads the record the verb wrote.
+```
+
+Fix by splitting the sentence in two, or by cutting the clause that only restates the first. A colon after a label or before a list is not this tell.

package/docs/agents/capture.md

@@ -46,6 +46,8 @@ Each source renders at `deviceScaleFactor` 2 with a transparent background, and
 
 What is asserted is the font. The command reads the first family of each rendered element holding text inside the captured element, and fails when the browser did not resolve one of them, because a fallback face rewraps the block and silently changes the output. A generic keyword as the first family, such as `monospace` or `system-ui`, also fails with its own reason, since it resolves to a different font on each machine, though a quoted `"monospace"` is a family name and goes through the probe. An element holding no text skips the check, since there is nothing to rewrap. Sources therefore name a real font rather than relying on `monospace`. A source that cannot render reports its own line and exits 1 without dropping the rest of the batch.
 
+The user agent sets `monospace` on `pre`, `code`, `kbd`, and `samp` and does not inherit the `body` font into them, so each needs its own `font-family`.
+
 A run refuses before it reads anything else when `--selector` is absent, naming the flag and pointing at `--help`. Ordering it first is what keeps the message about the invocation: the source defaults to `assets`, so checking that first would answer `assets not found` from whatever directory the caller happened to be in and say nothing about the flag that was actually missing. That source default is a deliberate choice rather than one inherited from some general convention: a missing folder still refuses loud, naming the argument, once the flag check passes, where the selector's dropped default cropped the wrong region in silence.
 
 The browser binary installs separately from the package. A first run does `bunx playwright install chromium` once, and a run that cannot launch one reports the engine's own remediation inside the frame and exits 1 rather than escaping as a stack trace.

package/docs/agents/commands.md

@@ -5,7 +5,9 @@ description: Every top-level command with its purpose, each domain's subcommands
 
 # Command catalog
 
-Full help: `canon <command> --help`. Bare `canon --help` lists every top-level command under five headings, Project, Domains, Author and render, Session and ship, and Repo reports, with descriptions cut at 80 columns. Piped into another command, the block prints without its frame glyphs and carries the same text. Behavior notes for the install and sync verbs live in `install-and-sync.md`.
+Bare `canon --help` lists every top-level command under five headings, Project, Domains, Author and render, Session and ship, and Repo reports, with descriptions cut at 80 columns. A pipe gets the same text without the frame glyphs. Behavior notes for the install and sync verbs live in `install-and-sync.md`.
+
+`canon <command> --help` lists subcommands, and `canon <command> <subcommand> --help` a leaf's flags, exit codes, and examples. `canon <command> --help --all` prints both. An unknown subcommand exits 1 under a group taking no operand.
 
 ## Project-level
 
@@ -78,65 +80,66 @@ query = "button, a[href], input, select, textarea, [tabindex]"
 
 ## Domain commands
 
-Each domain exposes a consistent shape where applicable: `list`, `install`, `sync`, `create`. The page named beside a domain carries its flags, records, and refusals, and `canon <domain> --help` lists the flags of any subcommand.
-
-- `migrate`, in `migrate.md`: `rename`, `skill-names`, `records`, `surface-roots`, `record-tree`, `rule-layout`, `scratch-evidence`, `record-layout`
-- `targets`, in `targets.md`: `list`, `pulls`
-- `gov`, in `install-and-sync.md`: `list`, `install`, `sync`, `build`, `regen`, `test-order`, `counts`, `superseded`, `citations`, `restated`
-- `tooling`, in `install-and-sync.md`: `list`, `sync`, `diff`, `reference`, `verify`, `inject`, `prune-gitignore`
-- `claude`, in `skills-audit.md`: `init`, `sync`, `setup`, `routing`, `plugin-update`, `seeds list`, `skills list`, `skills audit`, `skills drift`, `skills reach`, `skills rank`
-- `wiki`, in `scripting.md`: `init`
-- `indexes`, in `indexes.md`: `regen`, `list`
-- `docs`, in `docs.md`: `list`, `<topic>`
-- `design`, in `install-and-sync.md` for `install`, `sync`, and `fonts`, and below for the rest: `render`, `regen`, `css`, `install`, `sync`, `fonts`
-- `slides`, described below: `render`, `list`
-- `demo`, in `demo.md`: `compile`, `run`, `frames`
-- `inventory`, described above: `run`
-- `teach`, in `teach.md`: `list`, `open`, `resource`, `glossary`, `lesson`, `stylesheet`, `nav`, `render`
-- `canvas`, described below: `serve`, `list`, `page add`, `page rename`, `frame add`, `frame move`, `frame resize`, `selection`, `edit`, `editing`, `capture`
-- `sandbox`, in `sandbox.md`: `reset`, `clean`, `check`, `coverage`
-- `tasks`, in `tasks.md`: `next-label`, `archive`, `decline`, `plan-citations`, `plan-answers`, `plan-branch`, `plan-reach`, `plan-link`, `pull-request`, `outcome`, `list`, `validate`
-- `intake`, in `intake.md`: `list`, `answer`
-- `records`, in `records.md`: `validate`, `migrate`, `ordinal`, `size`, `stale`, `prune-tmp`, `push`, `pull`
-- `sessions`, in `sessions.md`: `list`, `export`, `import`
-- `worktrees`, in `worktrees.md`: `list`, `reclaim`
-- `hooks`, in `hooks.md`: `post-merge`
-- `pr`, in `pr-reads.md`: `key-changes`, `head`, `checks`, `review-state`, `evidence`, `preview`, `local`, `frames`, `lift` (in `pr-lift.md`)
-- `audits`, in `audits.md`: `run`, `list`
-- `gate`, in `gate.md`: `run`
-- `secrets`, in `state-scoped-risk.md`: `scan`
-- `deps`, in `state-scoped-risk.md`: `audit`
-- `labels`, in `label-coverage.md`: `audit`, `apply`, `scan`
-- `comments`, in `comments.md`: `scan`
-- `context`, in `context-audit.md`: `audit`, `classify diff`, `classify sweep`, `classifier show`, `classifier set`
-- `markdown`, in `markdown-audit.md`: `audit`
+Each domain exposes a consistent shape where applicable: `list`, `install`, `sync`, `create`. The page named beside a domain carries its flags, records, and refusals, and `canon <domain> --help --all` prints every subcommand's flags.
+
+- **`migrate`**, in `migrate.md`: `rename`, `skill-names`, `records`, `surface-roots`, `record-tree`, `rule-layout`, `scratch-evidence`, `record-layout`
+- **`targets`**, in `targets.md`: `list`, `pulls`
+- **`gov`**, in `install-and-sync.md`: `list`, `install`, `sync`, `build`, `regen`, `detect` (in `gov-detect.md`), `test-order`, `counts`, `superseded`, `citations`, `restated`
+- **`tooling`**, in `install-and-sync.md`: `list`, `sync`, `diff`, `reference`, `verify`, `inject`, `prune-gitignore`
+- **`claude`**, in `skills-audit.md`: `init`, `sync`, `setup`, `routing`, `plugin-update`, `seeds list`, `skills list`, `skills audit`, `skills drift`, `skills reach`, `skills rank`
+- **`wiki`**, in `scripting.md`: `init`
+- **`indexes`**, in `indexes.md`: `regen`, `list`
+- **`docs`**, in `docs.md`: `list`, `<topic>`
+- **`design`**, in `install-and-sync.md` for `install`, `sync`, and `fonts`, and below for the rest: `render`, `regen`, `css`, `install`, `sync`, `fonts`
+- **`slides`**, described below: `render`, `list`
+- **`demo`**, in `demo.md`: `compile`, `run`, `frames`
+- **`inventory`**, described above: `run`
+- **`teach`**, in `teach.md`: `list`, `up`, `open`, `resource`, `glossary`, `lesson`, `stylesheet`, `nav`, `render`
+- **`canvas`**, described below: `serve`, `list`, `page add`, `page rename`, `frame add`, `frame move`, `frame resize`, `fit`, `arrange`, `selection`, `edit`, `editing`, `capture`
+- **`sandbox`**, in `sandbox.md`: `run`, `equivalence`, `reset`, `clean`, `check`, `coverage`
+- **`tasks`**, in `tasks.md`: `next-label`, `archive`, `decline`, `plan-citations`, `plan-answers`, `plan-branch`, `plan-reach`, `plan-link`, `pull-request`, `outcome`, `list`, `validate`
+- **`intake`**, in `intake.md`: `list`, `answer`
+- **`records`**, in `records.md`: `validate`, `ordinal`, `size`, `stale`, `prune-tmp`, `push`, `pull`
+- **`sessions`**, in `sessions.md`: `list`, `export`, `import`
+- **`worktrees`**, in `worktrees.md`: `list`, `reclaim`, `repair-bare-flag` (hidden)
+- **`hooks`**, in `hooks.md`: `post-merge`
+- **`pr`**, in `pr-reads.md`: `key-changes`, `head`, `checks`, `review-state`, `evidence`, `preview`, `local`, `frames`, `lift` (in `pr-lift.md`), `tick` (in `pr-tick.md`)
+- **`upstream`**, in `upstream.md`: `fetch`, `catalog`, `due`, `advance`
+- **`audits`**, in `audits.md`: `run`, `list`
+- **`gate`**, in `gate.md`: `run`
+- **`secrets`**, in `state-scoped-risk.md`: `scan`
+- **`deps`**, in `state-scoped-risk.md`: `audit`
+- **`labels`**, in `label-coverage.md`: `audit`, `apply`, `scan`
+- **`comments`**, in `comments.md`: `scan`
+- **`context`**, in `context-audit.md`: `audit`, `classify diff`, `classify sweep`, `classifier show`, `classifier set`
+- **`markdown`**, in `markdown-audit.md`: `audit`
 
 Common patterns:
 
-- `list --json` → machine-readable catalog on stdout.
-- `install <name> <path>` → install a specific entry into a target project.
-- `sync <path>` → reapply all installed entries in a target project.
-- `create [name]` → scaffold a new authoring entry in this repo.
+- **`list --json`** → machine-readable catalog on stdout.
+- **`install <name> <path>`** → install a specific entry into a target project.
+- **`sync <path>`** → reapply all installed entries in a target project.
+- **`create [name]`** → scaffold a new authoring entry in this repo.
 
 Subcommands no other page describes:
 
-- `claude plugin-update` matches the installed marketplace plugin against `claude/.claude-plugin/plugin.json`'s own name and runs `claude plugin update` on it, reading the version back off `claude plugin list --json`, since the update call reports none of its own (`--json`).
-- `claude skills rank` scores either skill corpus's descriptions against a case corpus by TF-IDF cosine similarity, reporting rank-one and top-three (`--cases <path>`).
-- `design regen` rewrites this repository's `canon/DESIGN.md` from `src/design/tokens.ts` and `src/design/base.css` from `src/design/neutral.ts`. `design css` emits the tokens and components as CSS on stdout, with `--no-components` for properties alone, and `design render` declares each vendored face the typography table names under `--embed-fonts`.
-- `slides list --json` emits one row per deck under `.canon/slides/`, carrying `name`, `title`, `slides`, and `path`.
-- `slides render [deck]` takes a deck name or a folder, defaulting to the only deck, and lays out each `.html` file in filename order in Chromium at 1280 by 720 and rebuilds it as editable shapes. Each element drawn as a picture prints one `✗` line on stderr naming the slide, the selector, and the properties that forced it. A link left out, being a `#slide-N` past the deck's end or any target that is neither that nor an absolute URL, prints one too, and the exit stays 0.
-- A deck folder's `deck.json` and the faces it embeds, its per-slide `<body>` attributes, transitions and entrances, speaker notes, and charts are described in `slides.md`.
-- `canvas`, with its verbs, content format, and write routes, is described in `canvas.md`.
-- `labels apply <number>` adds the labels this branch earns to its open pull request, refusing a pull request whose head is not the current branch or that is not open, and never creating a label the remote lacks or removing one a person added (`--check` writes nothing and exits 2 when labels are owed, `--base`, `--json`).
-- `labels scan` fails a pull request or a posted review whose title, body, or review comment carries a phase label, a label a code span quotes, a gitignored record path, a session link, a banned character, a body heading outside the closed section list or a missing `## Summary` or `## Key changes`, or a title breaking `claude/skills/git-pr/references/pr.md`'s format, casing, or length rule (`--event`, `--body-file`, `--json`).
+- **`claude plugin-update`** matches the installed marketplace plugin against `claude/.claude-plugin/plugin.json`'s own name and runs `claude plugin update` on it, reading the version back off `claude plugin list --json`, since the update call reports none of its own (`--json`).
+- **`claude skills rank`** scores either skill corpus's descriptions against a case corpus by TF-IDF cosine similarity, reporting rank-one and top-three (`--cases <path>`).
+- **`design regen`** rewrites this repository's `canon/DESIGN.md` from `src/design/tokens.ts` and `src/design/base.css` from `src/design/neutral.ts`. `design css` emits the tokens and components as CSS on stdout, with `--no-components` for properties alone, and `design render` declares each vendored face the typography table names under `--embed-fonts`.
+- **`slides list --json`** emits one row per deck under `.canon/slides/`, carrying `name`, `title`, `slides`, and `path`.
+- **`slides render [deck]`** takes a deck name or a folder, defaulting to the only deck, and lays out each `.html` file in filename order in Chromium at 1280 by 720 and rebuilds it as editable shapes. Each element drawn as a picture prints one `✗` line on stderr naming the slide, the selector, and the properties that forced it. A link left out, being a `#slide-N` past the deck's end or any target that is neither that nor an absolute URL, prints one too, and the exit stays 0.
+- **`slides.md`** describes a deck folder's `deck.json` and the faces it embeds, its per-slide `<body>` attributes, transitions and entrances, speaker notes, and charts.
+- **`canvas`**, with its verbs, content format, and write routes, is described in `canvas.md`.
+- **`labels apply <number>`** adds the labels this branch earns to its open pull request, refusing a pull request whose head is not the current branch or that is not open, and never creating a label the remote lacks or removing one a person added (`--check` writes nothing and exits 2 when labels are owed, `--base`, `--json`).
+- **`labels scan`** fails a pull request or a posted review whose title, body, or review comment carries a phase label, a label a code span quotes, a gitignored record path, a session link, a banned character, a body heading outside the closed section list or a missing `## Summary` or `## Key changes`, or a title breaking `claude/skills/git-pr/references/pr.md`'s format, casing, or length rule (`--event`, `--body-file`, `--json`).
 
 ## Version skew
 
-`canon sync --check` and `canon claude skills drift` are the two moments a target
-already stops to reconcile with the toolkit, so each reports the installed
-version against the newest published one. No other command performs the lookup,
-which keeps a registry round trip out of the catalog reads an agent runs in a
-loop.
+`canon sync --check` and `canon claude skills drift` are the two moments a
+target already stops to reconcile with the toolkit, so each reports the
+installed version against the newest published one. No other command performs
+the lookup, which keeps a registry round trip out of the catalog reads an agent
+runs in a loop.
 
 The report carries three states and never changes an exit code. `behind` names
 `canon upgrade` as the remedy, `current` says so, and `unknown` carries the
@@ -144,8 +147,8 @@ reason the registry could not be reached. Branch on the `skew.state` field in
 the JSON record rather than on the exit, since an offline machine has to read as
 unmeasured rather than as a failing check.
 
-`canon upgrade --json` carries one further state, `pending`, that the skew report
-does not: the working directory's checkout holds a release npm does not serve
-yet, so there is nothing to install. The record names it in `checkout` beside
-`latest`, exits 0, and its `message` starts `CLI stays at`. Outside a canon
-checkout it never reads `pending`.
+`canon upgrade --json` carries one further state, `pending`, that the skew
+report does not: the working directory's checkout holds a release npm does not
+serve yet, so there is nothing to install. The record names it in `checkout`
+beside `latest`, exits 0, and its `message` starts `CLI stays at`. Outside a
+canon checkout it never reads `pending`.

package/docs/agents/comments.md

@@ -29,6 +29,6 @@ This works only because density is a pure function of a tree. Which author or se
 
 ## Degradation sweep
 
-The degradation sweep reads its vocabulary from whichever rule publishes a `## Degradation vocabulary` heading, preferring `.claude/rules/` over `governance/rules/`, so one definition serves the toolkit and every target. Discovery anchors on the heading rather than a filename, because a renumbered rule would otherwise empty the vocabulary while the sweep still reported clean. With no such rule the sweep reports **skipped** rather than zero hits, since finding nothing and looking for nothing mean opposite things.
+The degradation sweep reads its vocabulary from whichever rule publishes a `## Degradation vocabulary` heading, preferring `.claude/rules/` over `governance/rules/`, so one definition serves the toolkit and every target. Discovery anchors on the heading rather than a filename, because a renamed rule would otherwise empty the vocabulary while the sweep still reported clean. With no such rule the sweep reports **skipped** rather than zero hits, since finding nothing and looking for nothing mean opposite things.
 
 `090-code-comments` is the rule that publishes the list, and it ships on the `base` stack. A project that installs or syncs governance for the first time after that rule landed gets a sweep that previously reported skipped, so hits appear where the command used to stay quiet. Edit the backticked terms in the installed copy to change what that project sweeps for. The sweep matches comment text, so a comment naming a term as an example is a hit, and a hit is a prompt to read the line rather than a verdict on it.

package/docs/agents/context-audit-checks.md

@@ -17,6 +17,12 @@ It reports rather than gates by default, the closer call because a missing secti
 
 `--gate` promotes the finding to a failing exit code, which the seed stage runs and no other caller does. That mode needs an answer to the sanctioned omission above, so a file declaring `stub: true` in its frontmatter is dropped before the check and reported nowhere. Both are described in `context-audit.md`.
 
+### The closed set
+
+The same section also reports an H2 outside the folder's closed set. A context entry allows `Overview`, `Layout`, `Decisions`, and `Gotchas` and no other H2, so a topic of the domain's own sits one level down as an H3. The finding is per entry rather than per folder, since an extra heading is a fact about the file carrying it. Fenced blocks are skipped, a stub seed is skipped, and only H2 is read, so where an H3 sits is not audited. It gates under `--gate` alone, like a missing section.
+
+The record carries it as a top-level `extraSections` array of `{ rel, headings }`, and the set itself as `checkpoints.allowedSectionsByFolder`, keyed on the folder name the way `requiredSectionsByFolder` is. Both are additive.
+
 ## Reference form
 
 The reference-form check reports an entry naming a sibling entry by bare filename where `claude/skills/context-fold/references/context.md` asks for the path it sits at. A bare name resolves against whichever folder its reader is already in, so a domain that splits into subfolders strands every inbound reference and the break surfaces nowhere. A path is checkable, which is what makes the form rule worth measuring at all: once a reference spells its path, the citation gate resolves it and a split that moves the file fails the push.

package/docs/agents/context-audit.md

@@ -18,12 +18,12 @@ canon context audit --folder docs
 canon context audit tooling/base/seeds --gate
 ```
 
-| Option             | Behavior                                                             |
-| ------------------ | -------------------------------------------------------------------- |
-| `--json`           | Add a machine-readable record on stdout, keeping the frame           |
-| `--folder <list>`  | Comma-separated folder names (default: the three below)              |
-| `--citations-only` | Run the gating citation check alone, printing nothing when it passes |
-| `--gate`           | Fail on a missing required section or index drift as well            |
+| Option             | Behavior                                                                  |
+| ------------------ | ------------------------------------------------------------------------- |
+| `--json`           | Add a machine-readable record on stdout, keeping the frame                |
+| `--folder <list>`  | Comma-separated folder names (default: the three below)                   |
+| `--citations-only` | Run the gating citation check alone, printing nothing when it passes      |
+| `--gate`           | Fail on a missing required section, an off-set H2, or index drift as well |
 
 `--citations-only` and `--gate` refuse together. The first runs the citation check alone, so the two findings the second adds are never measured, and a run honoring both would exit clean on a file short a required section.
 
@@ -39,11 +39,11 @@ A run where no requested name resolves refuses, whichever list it read. Naming t
 
 Exit codes are `0` for a clean run, `1` for a refusal, and `2` for a gating finding. An unresolved citation gates under every mode. A requirements record stating a word cap gates past it, on any run that measures it, which is every mode except `--citations-only`. A record stating none is reported and never gated.
 
-`bun run check` in the toolkit repository reads every one of these rules through its own Canonical records stage rather than through this verb, since the verb's only gating stage there runs `--citations-only` and never opens either record.
+`bun run check` in the toolkit repository reads every one of these rules through its own Canonical records stage as well as through this verb, whose gating stage there runs `--gate`.
 
 Entry length, reference form, table, provenance, the record's claim classification, and every word figure no record caps print and return `0` under every mode, because each is a judgment or a weight read alongside one, and failing a push on either would make the check something to route around.
 
-Required-section and index findings sit between the two. Both are answerable from the file rather than weighed, so `--gate` promotes them to failing codes while a bare run leaves them advisory. The toolkit runs the bare form against itself and the widened form against the seed tree, described below.
+Required-section, off-set H2, and index findings sit between the two. Both are answerable from the file rather than weighed, so `--gate` promotes them to failing codes while a bare run leaves them advisory. The toolkit runs the bare form against itself and the widened form against the seed tree, described below.
 
 ## The seed gate
 

package/docs/agents/context-classify.md

@@ -31,6 +31,8 @@ The regex layer always runs. It is free, needs nothing installed, and catches na
 
 The local Ollama layer runs only when configured, through `canon context classifier`. When it runs, its call is one chunk or section per request, never batched: the groundwork measurement behind this verb found that batching 16 hunks into one call returned KEEP for every one of them. Thinking is always off, since it was measured to catch nothing thinking-off missed while running roughly five times slower and, in sweep mode, losing three real flags by reasoning past them.
 
+Sweep mode reads decision rationale as current. A reason naming why an alternative was left out, what an earlier approach got wrong, what a measurement caught, or what a past run cost is KEEP even told in the past tense. Only a superseded figure kept beside its replacement, a "now" or "no longer" marking a change, branch or PR narration, or rounds of candidates is REWRITE.
+
 A finding carries both layers' readings when the model ran. The `verdict` field takes the model's reading when it ran and parsed, and falls back to the regex reading otherwise, since the model catches shapes the regex layer cannot reach structurally. `decidedBy` names which one won.
 
 A configured-but-unreachable backend warns on stderr and falls back to the regex layer alone. The run still exits clean: the record's `modelLayer` field names why the model layer did not run (`off`, `skipped-no-model`, `skipped-unreachable`, or `ran`), so a clean regex-only report never reads as a clean model pass.

package/docs/agents/drift-surfaces.md

@@ -101,7 +101,7 @@ rule on the far side of a window a later sync moved past it. The per-file
 rule the chain lists reaches both surfaces the same way.
 
 A target stamped before governance recorded a chain falls back to the older
-band-inference read below. The measurement there anchors on governance's own
+rule-folder-inference read below. The measurement there anchors on governance's own
 stamp rather than on the oldest anchor across domains, since rules are
 domain-scoped and a shared anchor would let another domain's sync move the
 revision rules are measured from. A target carrying no chain and no governance anchor
@@ -124,16 +124,16 @@ their own language and testing rules, and every other rule is opt-in, so an
 unfiltered list would tell a base consumer about rules it can never receive and
 train the reader to skip the section.
 
-The filter accepts a band on either of two grounds. A folder holding a rule the
+The filter accepts a rule folder on either of two grounds. A folder holding a rule the
 base stack resolves to is entitled to every target, read through the stack file so
-a rule added to base later needs no code change. Every other band is read off the folders the
+a rule added to base later needs no code change. Every other rule folder is read off the folders the
 target already carries, which is the fallback's only evidence of what a target
-was entitled to before it recorded a chain. One band can be reached by more than
+was entitled to before it recorded a chain. One rule folder can be reached by more than
 one stack, so the test over-reports inside a folder the target holds, which
 costs a line where under-reporting would cost the section its point.
 
 A rule the target already holds is dropped by name. That is what keeps a rule the
-toolkit moved between band folders out of the list, since a rename reaches this
+toolkit moved between rule folders out of the list, since a rename reaches this
 read as an addition and only the name tells the two apart.
 
 This closes the dangling-citation case as a side effect rather than checking for

package/docs/agents/gate.md

@@ -9,16 +9,15 @@ description: Running the gate this repository verifies a branch with, what the s
 
 ```bash
 canon gate run
-canon gate run --all --no-write
+canon gate run --all
 canon gate run --json
 ```
 
-| Option       | Behavior                                                                      |
-| ------------ | ----------------------------------------------------------------------------- |
-| `--all`      | Run every stage instead of scoping shell, types, and tests to the changed set |
-| `--no-write` | Check formatting instead of applying it, which is what a merge gate wants     |
-| `--nested`   | Suppress the outer frame when a calling script has already opened one         |
-| `--json`     | Add a machine-readable record on stdout                                       |
+| Option     | Behavior                                                                      |
+| ---------- | ----------------------------------------------------------------------------- |
+| `--all`    | Run every stage instead of scoping shell, types, and tests to the changed set |
+| `--nested` | Suppress the outer frame when a calling script has already opened one         |
+| `--json`   | Add a machine-readable record on stdout                                       |
 
 ## What the command owns and what it runs
 

package/docs/agents/gov-detect.md

@@ -31,7 +31,7 @@ Both reads stop at depth two, which reaches a service folder and a workspace pac
   "stack": "node",
   "proposals": [
     {
-      "rule": "200-react",
+      "rule": "react",
       "evidence": [{ "kind": "dep", "match": "react", "path": "package.json" }]
     }
   ]

package/docs/agents/index.md

@@ -30,7 +30,7 @@ CLI catalog and invocation rules for agents, split by command domain. Start with
 - [Intake](intake.md): Reading intake folder counts and items, the three read states an item can be in, landing a batch of selections in one cluster, the refusal reasons, and why a call is scoped to one file
 - [Key changes bijection](key-changes.md): Comparing the files a pull request body's Key changes names against its own diff, the two directions and the split inside each that decides what is worth raising, the span rules the extractor was measured into, and the three refusals that separate a clean pass from a read that produced nothing
 - [Label coverage](label-coverage.md): Reading a changed set against the pull request label map, the two tables it matches, how a gap is separated from a decision, and why an absent map is an answer
-- [Markdown audit weight](markdown-audit-weight.md): The structural half of the markdown audit, being bullet and paragraph weight, run depth, the two cadence numbers, and the length ceiling, with the samples behind each checkpoint and why none of them gates
+- [Markdown audit weight](markdown-audit-weight.md): The structural half of the markdown audit, being bullet and paragraph weight, bullet stacks, run depth, the two cadence numbers, and the length ceiling, with the samples behind each checkpoint and why none of them gates
 - [Markdown audit](markdown-audit.md): Running the audit over any markdown path, where its bans and checkpoints are read from, what each check reports, and why the ban half gates while the structural half reports
 - [Migrate](migrate.md): What each canon migrate verb moves and rewrites, what it refuses, the markers that keep an old spelling, and the idempotence check a second run gives
 - [Output shape](output-shape.md): Two framed shapes every command renders into, how JSON and --names modes keep stdout clean, and the exit discipline that lets piped output drain
@@ -49,7 +49,7 @@ CLI catalog and invocation rules for agents, split by command domain. Start with
 - [Records](records.md): The two roots a record folder resolves at, claiming the ordinal intake and groundwork share, reading each folder's size and growth, pruning stale scratch, and where validation, the canonical review count, and the private-remote backup are described
 - [Restated instructions](restated.md): Counting the instructions the always-loaded file and every path-scoped rule share with the seed, the skill bodies, and each other, how a match is decided, the three classes, which surface a later edit starts from, and why the sweep reports rather than gates
 - [Routing report](routing.md): Reading per CLAUDE.md section how many bullets name a path, what counts as naming one, when a rule counts as covering it, the two refusals, and why the verb reports rather than gates
-- [Rule citations](rule-citations.md): Resolving every path a governance rule cites and every frontmatter glob the internal corpus declares, the two forms a citation is written in, the shapes that look like citations and are not, the two classes where an absent path is correct, why the glob half reads one corpus, and why this one gates
+- [Rule citations](rule-citations.md): Resolving every path a governance rule cites and every frontmatter glob the internal corpus declares, the one form a citation is written in, the shapes that look like citations and are not, the two classes where an absent path is correct, why the glob half reads one corpus, and why this one gates
 - [Sandbox](sandbox.md): Scenario routing, the expectation scoring surface, and the coverage census over scenarios and skills
 - [Scripting](scripting.md): The runtime catalogs that replace hardcoded names, what each carries, and a headless invocation per domain
 - [Sessions transfer](sessions-transfer.md): Moving a session to another machine, the export bundle and its manifest, placing it with import, the refusal reasons, and what a resume on the target depends on

package/docs/agents/install-and-sync.md

@@ -19,7 +19,7 @@ removes a stale `.claude/GOV.md` from the retired build. Use
 
 Everything under `.claude/rules/canon/` belongs to the toolkit, so a rule
 there that the toolkit no longer ships is deleted on sync, edited or not. That
-is how a retired rule stops loading in a target. A renamed or renumbered rule
+is how a retired rule stops loading in a target. A renamed rule
 the toolkit declares in `governance/renames.toml` moves instead: the sync
 installs the rule under its new name and deletes the old file, whether or not
 the target's stamp records a stack. Local edits to the old file are not
@@ -34,9 +34,9 @@ groundwork, intake, session, design, readme, and rule copies are deleted as
 retired. The markdown rule is hand-written at `writing/markdown.md` and names
 the `markdown-craft` skill, and `800-prose` retires.
 
-A project's own rules belong under `.claude/rules/project/`, where
-the `create-rule` skill's reference reserves `900-999` for them, and a rule placed under
-`canon/` instead is lost on the next sync.
+A project's own rules belong under `.claude/rules/project/`, where a slug
+the toolkit also ships collides with nothing, and a rule placed under `canon/`
+instead is lost on the next sync.
 
 A sync never deletes a rule that a newer canon release installed. The stamp
 records the newest release that synced governance, and an older binary holds
@@ -84,7 +84,7 @@ postdates a rule joining its stack still see that rule: the report reads the
 target's current entitlement against its current tree rather than diffing
 from an anchor a later sync could advance past the rule's own commit. A
 target whose install predates the recorded chain falls back to the same
-band-inference `newRules` uses in `canon sync --check`.
+rule-folder-inference `newRules` uses in `canon sync --check`.
 
 ## Tooling diff and sync
 
@@ -137,7 +137,7 @@ since a target has no rule source of its own that ships nowhere.
 It takes `--root <path>` and defaults to the toolkit root, prints nothing on success, and
 reports the reason on stderr with exit 1 when the record names a stack or rule
 that does not resolve. The Consumed copies stage of `bun run check` calls it and
-asserts both the generated band and the consumed copy are committed.
+asserts both the generated rule folders and the consumed copy are committed.
 
 ## Whole-project sync
 

package/docs/agents/markdown-audit-weight.md

@@ -1,13 +1,13 @@
 ---
 title: Markdown audit weight
-description: The structural half of the markdown audit, being bullet and paragraph weight, run depth, the two cadence numbers, and the length ceiling, with the samples behind each checkpoint and why none of them gates
+description: The structural half of the markdown audit, being bullet and paragraph weight, bullet stacks, run depth, the two cadence numbers, and the length ceiling, with the samples behind each checkpoint and why none of them gates
 ---
 
 # Markdown audit weight
 
 ## Bullets, paragraphs, and depth
 
-Bullet weight and depth are the checks that moved off `canon context audit`, carrying what they measured at the time. A top-level bullet reports past roughly 400 characters with continuation lines folded in and nested items left out. A run reports past roughly 40 rendered lines, measured at 80 columns, where a heading breaks one and so does a bold section marker taking the whole line at column zero, either ending in a colon, or holding one whole code span at any width, or running to 20 characters or fewer, skipping fenced blocks and exempting a flat peer list averaging under 130 characters a bullet and a run that is entirely table rows. Each file reports its longest run alone, so a second run past the checkpoint in the same file is never named.
+Bullet weight and depth are the checks that moved off `canon context audit`, carrying what they measured at the time. A top-level bullet reports past roughly 250 characters with continuation lines folded in and nested items left out. A run reports past roughly 40 rendered lines, measured at 80 columns, where a heading breaks one and so does a bold section marker taking the whole line at column zero, either ending in a colon, or holding one whole code span at any width, or running to 20 characters or fewer, skipping fenced blocks and exempting a flat peer list averaging under 130 characters a bullet and a run that is entirely table rows. Each file reports its longest run alone, so a second run past the checkpoint in the same file is never named.
 
 Every weight and depth measure counts the text a reader is shown. A link reduces to its anchor text and an autolink drops whole, since no reader is shown either destination. A backticked path stays counted, which is where these measures part from the ban scan `markdown-audit.md` describes: that one blanks a code span so a standard quoting its own banned character does not report itself, and discounting the same span here would under-report a paragraph carrying several. One file holds both span sets and each answers its own question.
 
@@ -17,7 +17,7 @@ The paragraph check measures both halves of one rule. `markdown.md` caps a parag
 
 A sentence boundary closes on terminal punctuation ahead of a capital or a code span. The capital is what keeps a version pin and a decimal from each reading as two sentences, and the code span is admitted beside it because a command name opening a sentence carries no capital to find.
 
-The paragraph weight sits at 700 and the bullet weight at 400. Both shipped at 400, because the paragraph number was borrowed from the bullet rule when the two checks landed together, and each has since been read against a sample of its own. They are separate checkpoints in the standard and separate patterns in the parser, so a read that moves one leaves the other where it is.
+The paragraph weight sits at 700 and the bullet weight at 250. Both shipped at 400, and the bullet number moved to 250 so the audit's warning and the `paragraph-growth` gate stage, which fails a bullet a branch adds or grows past it in a context entry, read one number. The paragraph number was borrowed from the bullet rule when the two checks landed together, and each has since been read against a sample of its own. They are separate checkpoints in the standard and separate patterns in the parser, so a read that moves one leaves the other where it is.
 
 ### The sample behind the paragraph number
 
@@ -46,6 +46,14 @@ That re-sample ran once the scan stopped counting link syntax as prose. Findings
 
 A bullet, a heading, a table row, a blockquote, a blank line, and a fence each end a paragraph, so a heavy bullet is reported by the bullet check alone and never counted twice.
 
+## Bullet stacks
+
+A run of consecutive top-level bullets reports past 5. A blank line, an indented continuation, and a nested item do not break the run, and a paragraph, a heading, or any other column-zero line does. A fenced line is skipped without breaking it. The count is of items rather than weight, so it catches a catalog of short bullets the 250-character checkpoint above passes.
+
+Two shapes are exempt. A run whose every item opens with a bold label or a link names its own subject per item and reads as a table of entries, and a numbered list states an order, so numbered items never count. `CHANGELOG.md` is exempt by name. Governance rules and `REQUIREMENT.md` sit outside the gate stage's scope rather than being exempted here, since a rule is one imperative per bullet.
+
+The audit reports a stack and never fails on one. The `bullet-stacks` stage in `canon gate run` fails the push, for the reason the length ceiling does: the audit also runs on plans and groundwork records kept out of version control.
+
 ## Cadence
 
 Uniform cadence is the failure a ban list cannot express. A ban set states negatives, and fragments, verbless clauses, and sentences that all run one length are each the absence of something, so no word added to a ban list reaches any of them. The shape layer already measured a bullet, a paragraph, and a run, and stopped one level above where that failure lives.