@erclx/canon 5.36.0 → 5.37.0

package/claude/skills/test-craft/SKILL.md

@@ -57,6 +57,11 @@ Every test carries these, at any layer and in any runner:
 - Verify one behavior per test.
 - Keep conditional logic and loops out of a test body. A table of cases is one test per row, never a branch inside one.
 - Set no coverage percentage as a target. Cover the behaviors and their edges.
+
+### Isolation and assertions
+
+Every test carries these too:
+
 - Group related tests with the framework's nesting mechanism, and keep it to two levels deep.
 - Keep tests independent with no shared side effects. Clean up and restore state after each one.
 - Await every async operation. Never leave a promise fire-and-forget in a test.

package/claude/skills/video-craft/SKILL.md

@@ -60,6 +60,9 @@ The guidance covers landscape 16:9 video. Vertical 9:16 framing is not covered y
 - Every move in the composition shares one duration.
 - A caption is centered on screen and covers the element the step acts on.
 - A caption names a step the frame is not showing.
+
+### Timing and checks
+
 - The zoom's start time was added up by hand while a timeline file sits beside the take.
 - Two pointers appear on one frame.
 - A checker finding was dismissed and no frame was opened.
@@ -77,6 +80,9 @@ The guidance covers landscape 16:9 video. Vertical 9:16 framing is not covered y
 - Easing, speed variety, anchoring, click timing, and every other general motion rule: `hyperframes-animation` and `hyperframes-creative`
 - Title-safe margins and timeline layout: `hyperframes-studio`
 - The carve that sits music under a voice: `hyperframes-audio`
+
+### Media, capture, and reading
+
 - Fetching or generating music, effects, voice, and imagery: `media-use`
 - Recording the take and writing its timeline: `record-screencast` through `canon demo run`
 - Reading a render frame by frame: `read-frames`

package/claude/skills/write-human/SKILL.md

@@ -24,9 +24,15 @@ The banned characters sit in `${CLAUDE_SKILL_DIR}/../markdown-craft/references/m
 - Write for a developer who is scanning rather than studying. Every sentence has to land on first read.
 - Use active voice, and present tense unless past or future is factually correct.
 - Name the actor in a sentence that has one. Passive voice with an unnamed actor hides who acts and reads as evasion.
+
+### Word choice
+
 - Prefer direct verbs and plain words. Write `use` over `utilize`, `help` over `facilitate`, `is` over `serves as`.
 - Drop marketing words: `seamless`, `robust`, `powerful`, `revolutionary`, `enhanced`, `allows`, and `leverage`. Each claims a quality without showing it, so state what the thing does and let the reader judge it.
 - Drop vague qualifiers: `simply`, `just`, `easily`, `quickly`, `very`, and `really`. Cut the word where the sentence stands without it, and give the measurement where the degree matters.
+
+### Stance and density
+
 - Be direct on an established fact. Hedge on a genuinely uncertain claim and say which it is.
 - Assume developer-level knowledge. Skip the explanation the reader already carries.
 - Front-load the key information in a paragraph, and give every sentence something the reader did not have.
@@ -38,6 +44,9 @@ Uniform cadence is the tell that survives the cleanest ban scan. Measure it rath
 - Read the paragraph as one block. Uniformity is audible and close to invisible line by line.
 - Compare the longest and shortest sentence in a paragraph. Within roughly five words of each other means the paragraph has one cadence and needs a short sentence or a long one added.
 - Count the opening word of each sentence. Two alike is coincidence and three is a pattern to break.
+
+### Variety
+
 - Vary the grammatical shape of the opening, not the word alone. Three sentences opening on three different subjects still share one shape.
 - Never buy variety with a fragment. A verbless clause standing as a sentence trades one uniformity for another and is the failure these rules exist against.
 - Use a substantive connective where the flow needs one, and never add a word for rhythm alone.

package/docs/agents/capture.md

@@ -46,6 +46,8 @@ Each source renders at `deviceScaleFactor` 2 with a transparent background, and
 
 What is asserted is the font. The command reads the first family of each rendered element holding text inside the captured element, and fails when the browser did not resolve one of them, because a fallback face rewraps the block and silently changes the output. A generic keyword as the first family, such as `monospace` or `system-ui`, also fails with its own reason, since it resolves to a different font on each machine, though a quoted `"monospace"` is a family name and goes through the probe. An element holding no text skips the check, since there is nothing to rewrap. Sources therefore name a real font rather than relying on `monospace`. A source that cannot render reports its own line and exits 1 without dropping the rest of the batch.
 
+The user agent sets `monospace` on `pre`, `code`, `kbd`, and `samp` and does not inherit the `body` font into them, so each needs its own `font-family`.
+
 A run refuses before it reads anything else when `--selector` is absent, naming the flag and pointing at `--help`. Ordering it first is what keeps the message about the invocation: the source defaults to `assets`, so checking that first would answer `assets not found` from whatever directory the caller happened to be in and say nothing about the flag that was actually missing. That source default is a deliberate choice rather than one inherited from some general convention: a missing folder still refuses loud, naming the argument, once the flag check passes, where the selector's dropped default cropped the wrong region in silence.
 
 The browser binary installs separately from the package. A first run does `bunx playwright install chromium` once, and a run that cannot launch one reports the engine's own remediation inside the frame and exits 1 rather than escaping as a stack trace.

package/docs/agents/commands.md

@@ -82,64 +82,64 @@ query = "button, a[href], input, select, textarea, [tabindex]"
 
 Each domain exposes a consistent shape where applicable: `list`, `install`, `sync`, `create`. The page named beside a domain carries its flags, records, and refusals, and `canon <domain> --help --all` prints every subcommand's flags.
 
-- `migrate`, in `migrate.md`: `rename`, `skill-names`, `records`, `surface-roots`, `record-tree`, `rule-layout`, `scratch-evidence`, `record-layout`
-- `targets`, in `targets.md`: `list`, `pulls`
-- `gov`, in `install-and-sync.md`: `list`, `install`, `sync`, `build`, `regen`, `detect` (in `gov-detect.md`), `test-order`, `counts`, `superseded`, `citations`, `restated`
-- `tooling`, in `install-and-sync.md`: `list`, `sync`, `diff`, `reference`, `verify`, `inject`, `prune-gitignore`
-- `claude`, in `skills-audit.md`: `init`, `sync`, `setup`, `routing`, `plugin-update`, `seeds list`, `skills list`, `skills audit`, `skills drift`, `skills reach`, `skills rank`
-- `wiki`, in `scripting.md`: `init`
-- `indexes`, in `indexes.md`: `regen`, `list`
-- `docs`, in `docs.md`: `list`, `<topic>`
-- `design`, in `install-and-sync.md` for `install`, `sync`, and `fonts`, and below for the rest: `render`, `regen`, `css`, `install`, `sync`, `fonts`
-- `slides`, described below: `render`, `list`
-- `demo`, in `demo.md`: `compile`, `run`, `frames`
-- `inventory`, described above: `run`
-- `teach`, in `teach.md`: `list`, `up`, `open`, `resource`, `glossary`, `lesson`, `stylesheet`, `nav`, `render`
-- `canvas`, described below: `serve`, `list`, `page add`, `page rename`, `frame add`, `frame move`, `frame resize`, `fit`, `arrange`, `selection`, `edit`, `editing`, `capture`
-- `sandbox`, in `sandbox.md`: `run`, `equivalence`, `reset`, `clean`, `check`, `coverage`
-- `tasks`, in `tasks.md`: `next-label`, `archive`, `decline`, `plan-citations`, `plan-answers`, `plan-branch`, `plan-reach`, `plan-link`, `pull-request`, `outcome`, `list`, `validate`
-- `intake`, in `intake.md`: `list`, `answer`
-- `records`, in `records.md`: `validate`, `ordinal`, `size`, `stale`, `prune-tmp`, `push`, `pull`
-- `sessions`, in `sessions.md`: `list`, `export`, `import`
-- `worktrees`, in `worktrees.md`: `list`, `reclaim`, `repair-bare-flag` (hidden)
-- `hooks`, in `hooks.md`: `post-merge`
-- `pr`, in `pr-reads.md`: `key-changes`, `head`, `checks`, `review-state`, `evidence`, `preview`, `local`, `frames`, `lift` (in `pr-lift.md`), `tick` (in `pr-tick.md`)
-- `upstream`, in `upstream.md`: `fetch`, `catalog`, `due`, `advance`
-- `audits`, in `audits.md`: `run`, `list`
-- `gate`, in `gate.md`: `run`
-- `secrets`, in `state-scoped-risk.md`: `scan`
-- `deps`, in `state-scoped-risk.md`: `audit`
-- `labels`, in `label-coverage.md`: `audit`, `apply`, `scan`
-- `comments`, in `comments.md`: `scan`
-- `context`, in `context-audit.md`: `audit`, `classify diff`, `classify sweep`, `classifier show`, `classifier set`
-- `markdown`, in `markdown-audit.md`: `audit`
+- **`migrate`**, in `migrate.md`: `rename`, `skill-names`, `records`, `surface-roots`, `record-tree`, `rule-layout`, `scratch-evidence`, `record-layout`
+- **`targets`**, in `targets.md`: `list`, `pulls`
+- **`gov`**, in `install-and-sync.md`: `list`, `install`, `sync`, `build`, `regen`, `detect` (in `gov-detect.md`), `test-order`, `counts`, `superseded`, `citations`, `restated`
+- **`tooling`**, in `install-and-sync.md`: `list`, `sync`, `diff`, `reference`, `verify`, `inject`, `prune-gitignore`
+- **`claude`**, in `skills-audit.md`: `init`, `sync`, `setup`, `routing`, `plugin-update`, `seeds list`, `skills list`, `skills audit`, `skills drift`, `skills reach`, `skills rank`
+- **`wiki`**, in `scripting.md`: `init`
+- **`indexes`**, in `indexes.md`: `regen`, `list`
+- **`docs`**, in `docs.md`: `list`, `<topic>`
+- **`design`**, in `install-and-sync.md` for `install`, `sync`, and `fonts`, and below for the rest: `render`, `regen`, `css`, `install`, `sync`, `fonts`
+- **`slides`**, described below: `render`, `list`
+- **`demo`**, in `demo.md`: `compile`, `run`, `frames`
+- **`inventory`**, described above: `run`
+- **`teach`**, in `teach.md`: `list`, `up`, `open`, `resource`, `glossary`, `lesson`, `stylesheet`, `nav`, `render`
+- **`canvas`**, described below: `serve`, `list`, `page add`, `page rename`, `frame add`, `frame move`, `frame resize`, `fit`, `arrange`, `selection`, `edit`, `editing`, `capture`
+- **`sandbox`**, in `sandbox.md`: `run`, `equivalence`, `reset`, `clean`, `check`, `coverage`
+- **`tasks`**, in `tasks.md`: `next-label`, `archive`, `decline`, `plan-citations`, `plan-answers`, `plan-branch`, `plan-reach`, `plan-link`, `pull-request`, `outcome`, `list`, `validate`
+- **`intake`**, in `intake.md`: `list`, `answer`
+- **`records`**, in `records.md`: `validate`, `ordinal`, `size`, `stale`, `prune-tmp`, `push`, `pull`
+- **`sessions`**, in `sessions.md`: `list`, `export`, `import`
+- **`worktrees`**, in `worktrees.md`: `list`, `reclaim`, `repair-bare-flag` (hidden)
+- **`hooks`**, in `hooks.md`: `post-merge`
+- **`pr`**, in `pr-reads.md`: `key-changes`, `head`, `checks`, `review-state`, `evidence`, `preview`, `local`, `frames`, `lift` (in `pr-lift.md`), `tick` (in `pr-tick.md`)
+- **`upstream`**, in `upstream.md`: `fetch`, `catalog`, `due`, `advance`
+- **`audits`**, in `audits.md`: `run`, `list`
+- **`gate`**, in `gate.md`: `run`
+- **`secrets`**, in `state-scoped-risk.md`: `scan`
+- **`deps`**, in `state-scoped-risk.md`: `audit`
+- **`labels`**, in `label-coverage.md`: `audit`, `apply`, `scan`
+- **`comments`**, in `comments.md`: `scan`
+- **`context`**, in `context-audit.md`: `audit`, `classify diff`, `classify sweep`, `classifier show`, `classifier set`
+- **`markdown`**, in `markdown-audit.md`: `audit`
 
 Common patterns:
 
-- `list --json` → machine-readable catalog on stdout.
-- `install <name> <path>` → install a specific entry into a target project.
-- `sync <path>` → reapply all installed entries in a target project.
-- `create [name]` → scaffold a new authoring entry in this repo.
+- **`list --json`** → machine-readable catalog on stdout.
+- **`install <name> <path>`** → install a specific entry into a target project.
+- **`sync <path>`** → reapply all installed entries in a target project.
+- **`create [name]`** → scaffold a new authoring entry in this repo.
 
 Subcommands no other page describes:
 
-- `claude plugin-update` matches the installed marketplace plugin against `claude/.claude-plugin/plugin.json`'s own name and runs `claude plugin update` on it, reading the version back off `claude plugin list --json`, since the update call reports none of its own (`--json`).
-- `claude skills rank` scores either skill corpus's descriptions against a case corpus by TF-IDF cosine similarity, reporting rank-one and top-three (`--cases <path>`).
-- `design regen` rewrites this repository's `canon/DESIGN.md` from `src/design/tokens.ts` and `src/design/base.css` from `src/design/neutral.ts`. `design css` emits the tokens and components as CSS on stdout, with `--no-components` for properties alone, and `design render` declares each vendored face the typography table names under `--embed-fonts`.
-- `slides list --json` emits one row per deck under `.canon/slides/`, carrying `name`, `title`, `slides`, and `path`.
-- `slides render [deck]` takes a deck name or a folder, defaulting to the only deck, and lays out each `.html` file in filename order in Chromium at 1280 by 720 and rebuilds it as editable shapes. Each element drawn as a picture prints one `✗` line on stderr naming the slide, the selector, and the properties that forced it. A link left out, being a `#slide-N` past the deck's end or any target that is neither that nor an absolute URL, prints one too, and the exit stays 0.
-- A deck folder's `deck.json` and the faces it embeds, its per-slide `<body>` attributes, transitions and entrances, speaker notes, and charts are described in `slides.md`.
-- `canvas`, with its verbs, content format, and write routes, is described in `canvas.md`.
-- `labels apply <number>` adds the labels this branch earns to its open pull request, refusing a pull request whose head is not the current branch or that is not open, and never creating a label the remote lacks or removing one a person added (`--check` writes nothing and exits 2 when labels are owed, `--base`, `--json`).
-- `labels scan` fails a pull request or a posted review whose title, body, or review comment carries a phase label, a label a code span quotes, a gitignored record path, a session link, a banned character, a body heading outside the closed section list or a missing `## Summary` or `## Key changes`, or a title breaking `claude/skills/git-pr/references/pr.md`'s format, casing, or length rule (`--event`, `--body-file`, `--json`).
+- **`claude plugin-update`** matches the installed marketplace plugin against `claude/.claude-plugin/plugin.json`'s own name and runs `claude plugin update` on it, reading the version back off `claude plugin list --json`, since the update call reports none of its own (`--json`).
+- **`claude skills rank`** scores either skill corpus's descriptions against a case corpus by TF-IDF cosine similarity, reporting rank-one and top-three (`--cases <path>`).
+- **`design regen`** rewrites this repository's `canon/DESIGN.md` from `src/design/tokens.ts` and `src/design/base.css` from `src/design/neutral.ts`. `design css` emits the tokens and components as CSS on stdout, with `--no-components` for properties alone, and `design render` declares each vendored face the typography table names under `--embed-fonts`.
+- **`slides list --json`** emits one row per deck under `.canon/slides/`, carrying `name`, `title`, `slides`, and `path`.
+- **`slides render [deck]`** takes a deck name or a folder, defaulting to the only deck, and lays out each `.html` file in filename order in Chromium at 1280 by 720 and rebuilds it as editable shapes. Each element drawn as a picture prints one `✗` line on stderr naming the slide, the selector, and the properties that forced it. A link left out, being a `#slide-N` past the deck's end or any target that is neither that nor an absolute URL, prints one too, and the exit stays 0.
+- **`slides.md`** describes a deck folder's `deck.json` and the faces it embeds, its per-slide `<body>` attributes, transitions and entrances, speaker notes, and charts.
+- **`canvas`**, with its verbs, content format, and write routes, is described in `canvas.md`.
+- **`labels apply <number>`** adds the labels this branch earns to its open pull request, refusing a pull request whose head is not the current branch or that is not open, and never creating a label the remote lacks or removing one a person added (`--check` writes nothing and exits 2 when labels are owed, `--base`, `--json`).
+- **`labels scan`** fails a pull request or a posted review whose title, body, or review comment carries a phase label, a label a code span quotes, a gitignored record path, a session link, a banned character, a body heading outside the closed section list or a missing `## Summary` or `## Key changes`, or a title breaking `claude/skills/git-pr/references/pr.md`'s format, casing, or length rule (`--event`, `--body-file`, `--json`).
 
 ## Version skew
 
-`canon sync --check` and `canon claude skills drift` are the two moments a target
-already stops to reconcile with the toolkit, so each reports the installed
-version against the newest published one. No other command performs the lookup,
-which keeps a registry round trip out of the catalog reads an agent runs in a
-loop.
+`canon sync --check` and `canon claude skills drift` are the two moments a
+target already stops to reconcile with the toolkit, so each reports the
+installed version against the newest published one. No other command performs
+the lookup, which keeps a registry round trip out of the catalog reads an agent
+runs in a loop.
 
 The report carries three states and never changes an exit code. `behind` names
 `canon upgrade` as the remedy, `current` says so, and `unknown` carries the
@@ -147,8 +147,8 @@ reason the registry could not be reached. Branch on the `skew.state` field in
 the JSON record rather than on the exit, since an offline machine has to read as
 unmeasured rather than as a failing check.
 
-`canon upgrade --json` carries one further state, `pending`, that the skew report
-does not: the working directory's checkout holds a release npm does not serve
-yet, so there is nothing to install. The record names it in `checkout` beside
-`latest`, exits 0, and its `message` starts `CLI stays at`. Outside a canon
-checkout it never reads `pending`.
+`canon upgrade --json` carries one further state, `pending`, that the skew
+report does not: the working directory's checkout holds a release npm does not
+serve yet, so there is nothing to install. The record names it in `checkout`
+beside `latest`, exits 0, and its `message` starts `CLI stays at`. Outside a
+canon checkout it never reads `pending`.

package/docs/agents/context-audit-checks.md

@@ -17,6 +17,12 @@ It reports rather than gates by default, the closer call because a missing secti
 
 `--gate` promotes the finding to a failing exit code, which the seed stage runs and no other caller does. That mode needs an answer to the sanctioned omission above, so a file declaring `stub: true` in its frontmatter is dropped before the check and reported nowhere. Both are described in `context-audit.md`.
 
+### The closed set
+
+The same section also reports an H2 outside the folder's closed set. A context entry allows `Overview`, `Layout`, `Decisions`, and `Gotchas` and no other H2, so a topic of the domain's own sits one level down as an H3. The finding is per entry rather than per folder, since an extra heading is a fact about the file carrying it. Fenced blocks are skipped, a stub seed is skipped, and only H2 is read, so where an H3 sits is not audited. It gates under `--gate` alone, like a missing section.
+
+The record carries it as a top-level `extraSections` array of `{ rel, headings }`, and the set itself as `checkpoints.allowedSectionsByFolder`, keyed on the folder name the way `requiredSectionsByFolder` is. Both are additive.
+
 ## Reference form
 
 The reference-form check reports an entry naming a sibling entry by bare filename where `claude/skills/context-fold/references/context.md` asks for the path it sits at. A bare name resolves against whichever folder its reader is already in, so a domain that splits into subfolders strands every inbound reference and the break surfaces nowhere. A path is checkable, which is what makes the form rule worth measuring at all: once a reference spells its path, the citation gate resolves it and a split that moves the file fails the push.

package/docs/agents/context-audit.md

@@ -18,12 +18,12 @@ canon context audit --folder docs
 canon context audit tooling/base/seeds --gate
 ```
 
-| Option             | Behavior                                                             |
-| ------------------ | -------------------------------------------------------------------- |
-| `--json`           | Add a machine-readable record on stdout, keeping the frame           |
-| `--folder <list>`  | Comma-separated folder names (default: the three below)              |
-| `--citations-only` | Run the gating citation check alone, printing nothing when it passes |
-| `--gate`           | Fail on a missing required section or index drift as well            |
+| Option             | Behavior                                                                  |
+| ------------------ | ------------------------------------------------------------------------- |
+| `--json`           | Add a machine-readable record on stdout, keeping the frame                |
+| `--folder <list>`  | Comma-separated folder names (default: the three below)                   |
+| `--citations-only` | Run the gating citation check alone, printing nothing when it passes      |
+| `--gate`           | Fail on a missing required section, an off-set H2, or index drift as well |
 
 `--citations-only` and `--gate` refuse together. The first runs the citation check alone, so the two findings the second adds are never measured, and a run honoring both would exit clean on a file short a required section.
 
@@ -39,11 +39,11 @@ A run where no requested name resolves refuses, whichever list it read. Naming t
 
 Exit codes are `0` for a clean run, `1` for a refusal, and `2` for a gating finding. An unresolved citation gates under every mode. A requirements record stating a word cap gates past it, on any run that measures it, which is every mode except `--citations-only`. A record stating none is reported and never gated.
 
-`bun run check` in the toolkit repository reads every one of these rules through its own Canonical records stage rather than through this verb, since the verb's only gating stage there runs `--citations-only` and never opens either record.
+`bun run check` in the toolkit repository reads every one of these rules through its own Canonical records stage as well as through this verb, whose gating stage there runs `--gate`.
 
 Entry length, reference form, table, provenance, the record's claim classification, and every word figure no record caps print and return `0` under every mode, because each is a judgment or a weight read alongside one, and failing a push on either would make the check something to route around.
 
-Required-section and index findings sit between the two. Both are answerable from the file rather than weighed, so `--gate` promotes them to failing codes while a bare run leaves them advisory. The toolkit runs the bare form against itself and the widened form against the seed tree, described below.
+Required-section, off-set H2, and index findings sit between the two. Both are answerable from the file rather than weighed, so `--gate` promotes them to failing codes while a bare run leaves them advisory. The toolkit runs the bare form against itself and the widened form against the seed tree, described below.
 
 ## The seed gate
 

package/docs/agents/context-classify.md

@@ -31,6 +31,8 @@ The regex layer always runs. It is free, needs nothing installed, and catches na
 
 The local Ollama layer runs only when configured, through `canon context classifier`. When it runs, its call is one chunk or section per request, never batched: the groundwork measurement behind this verb found that batching 16 hunks into one call returned KEEP for every one of them. Thinking is always off, since it was measured to catch nothing thinking-off missed while running roughly five times slower and, in sweep mode, losing three real flags by reasoning past them.
 
+Sweep mode reads decision rationale as current. A reason naming why an alternative was left out, what an earlier approach got wrong, what a measurement caught, or what a past run cost is KEEP even told in the past tense. Only a superseded figure kept beside its replacement, a "now" or "no longer" marking a change, branch or PR narration, or rounds of candidates is REWRITE.
+
 A finding carries both layers' readings when the model ran. The `verdict` field takes the model's reading when it ran and parsed, and falls back to the regex reading otherwise, since the model catches shapes the regex layer cannot reach structurally. `decidedBy` names which one won.
 
 A configured-but-unreachable backend warns on stderr and falls back to the regex layer alone. The run still exits clean: the record's `modelLayer` field names why the model layer did not run (`off`, `skipped-no-model`, `skipped-unreachable`, or `ran`), so a clean regex-only report never reads as a clean model pass.

package/docs/agents/drift-surfaces.md

@@ -101,7 +101,7 @@ rule on the far side of a window a later sync moved past it. The per-file
 rule the chain lists reaches both surfaces the same way.
 
 A target stamped before governance recorded a chain falls back to the older
-band-inference read below. The measurement there anchors on governance's own
+rule-folder-inference read below. The measurement there anchors on governance's own
 stamp rather than on the oldest anchor across domains, since rules are
 domain-scoped and a shared anchor would let another domain's sync move the
 revision rules are measured from. A target carrying no chain and no governance anchor
@@ -124,16 +124,16 @@ their own language and testing rules, and every other rule is opt-in, so an
 unfiltered list would tell a base consumer about rules it can never receive and
 train the reader to skip the section.
 
-The filter accepts a band on either of two grounds. A folder holding a rule the
+The filter accepts a rule folder on either of two grounds. A folder holding a rule the
 base stack resolves to is entitled to every target, read through the stack file so
-a rule added to base later needs no code change. Every other band is read off the folders the
+a rule added to base later needs no code change. Every other rule folder is read off the folders the
 target already carries, which is the fallback's only evidence of what a target
-was entitled to before it recorded a chain. One band can be reached by more than
+was entitled to before it recorded a chain. One rule folder can be reached by more than
 one stack, so the test over-reports inside a folder the target holds, which
 costs a line where under-reporting would cost the section its point.
 
 A rule the target already holds is dropped by name. That is what keeps a rule the
-toolkit moved between band folders out of the list, since a rename reaches this
+toolkit moved between rule folders out of the list, since a rename reaches this
 read as an addition and only the name tells the two apart.
 
 This closes the dangling-citation case as a side effect rather than checking for

package/docs/agents/gate.md

@@ -9,16 +9,15 @@ description: Running the gate this repository verifies a branch with, what the s
 
 ```bash
 canon gate run
-canon gate run --all --no-write
+canon gate run --all
 canon gate run --json
 ```
 
-| Option       | Behavior                                                                      |
-| ------------ | ----------------------------------------------------------------------------- |
-| `--all`      | Run every stage instead of scoping shell, types, and tests to the changed set |
-| `--no-write` | Check formatting instead of applying it, which is what a merge gate wants     |
-| `--nested`   | Suppress the outer frame when a calling script has already opened one         |
-| `--json`     | Add a machine-readable record on stdout                                       |
+| Option     | Behavior                                                                      |
+| ---------- | ----------------------------------------------------------------------------- |
+| `--all`    | Run every stage instead of scoping shell, types, and tests to the changed set |
+| `--nested` | Suppress the outer frame when a calling script has already opened one         |
+| `--json`   | Add a machine-readable record on stdout                                       |
 
 ## What the command owns and what it runs
 

package/docs/agents/index.md

@@ -30,7 +30,7 @@ CLI catalog and invocation rules for agents, split by command domain. Start with
 - [Intake](intake.md): Reading intake folder counts and items, the three read states an item can be in, landing a batch of selections in one cluster, the refusal reasons, and why a call is scoped to one file
 - [Key changes bijection](key-changes.md): Comparing the files a pull request body's Key changes names against its own diff, the two directions and the split inside each that decides what is worth raising, the span rules the extractor was measured into, and the three refusals that separate a clean pass from a read that produced nothing
 - [Label coverage](label-coverage.md): Reading a changed set against the pull request label map, the two tables it matches, how a gap is separated from a decision, and why an absent map is an answer
-- [Markdown audit weight](markdown-audit-weight.md): The structural half of the markdown audit, being bullet and paragraph weight, run depth, the two cadence numbers, and the length ceiling, with the samples behind each checkpoint and why none of them gates
+- [Markdown audit weight](markdown-audit-weight.md): The structural half of the markdown audit, being bullet and paragraph weight, bullet stacks, run depth, the two cadence numbers, and the length ceiling, with the samples behind each checkpoint and why none of them gates
 - [Markdown audit](markdown-audit.md): Running the audit over any markdown path, where its bans and checkpoints are read from, what each check reports, and why the ban half gates while the structural half reports
 - [Migrate](migrate.md): What each canon migrate verb moves and rewrites, what it refuses, the markers that keep an old spelling, and the idempotence check a second run gives
 - [Output shape](output-shape.md): Two framed shapes every command renders into, how JSON and --names modes keep stdout clean, and the exit discipline that lets piped output drain

package/docs/agents/install-and-sync.md

@@ -84,7 +84,7 @@ postdates a rule joining its stack still see that rule: the report reads the
 target's current entitlement against its current tree rather than diffing
 from an anchor a later sync could advance past the rule's own commit. A
 target whose install predates the recorded chain falls back to the same
-band-inference `newRules` uses in `canon sync --check`.
+rule-folder-inference `newRules` uses in `canon sync --check`.
 
 ## Tooling diff and sync
 
@@ -137,7 +137,7 @@ since a target has no rule source of its own that ships nowhere.
 It takes `--root <path>` and defaults to the toolkit root, prints nothing on success, and
 reports the reason on stderr with exit 1 when the record names a stack or rule
 that does not resolve. The Consumed copies stage of `bun run check` calls it and
-asserts both the generated band and the consumed copy are committed.
+asserts both the generated rule folders and the consumed copy are committed.
 
 ## Whole-project sync
 

package/docs/agents/markdown-audit-weight.md

@@ -1,13 +1,13 @@
 ---
 title: Markdown audit weight
-description: The structural half of the markdown audit, being bullet and paragraph weight, run depth, the two cadence numbers, and the length ceiling, with the samples behind each checkpoint and why none of them gates
+description: The structural half of the markdown audit, being bullet and paragraph weight, bullet stacks, run depth, the two cadence numbers, and the length ceiling, with the samples behind each checkpoint and why none of them gates
 ---
 
 # Markdown audit weight
 
 ## Bullets, paragraphs, and depth
 
-Bullet weight and depth are the checks that moved off `canon context audit`, carrying what they measured at the time. A top-level bullet reports past roughly 400 characters with continuation lines folded in and nested items left out. A run reports past roughly 40 rendered lines, measured at 80 columns, where a heading breaks one and so does a bold section marker taking the whole line at column zero, either ending in a colon, or holding one whole code span at any width, or running to 20 characters or fewer, skipping fenced blocks and exempting a flat peer list averaging under 130 characters a bullet and a run that is entirely table rows. Each file reports its longest run alone, so a second run past the checkpoint in the same file is never named.
+Bullet weight and depth are the checks that moved off `canon context audit`, carrying what they measured at the time. A top-level bullet reports past roughly 250 characters with continuation lines folded in and nested items left out. A run reports past roughly 40 rendered lines, measured at 80 columns, where a heading breaks one and so does a bold section marker taking the whole line at column zero, either ending in a colon, or holding one whole code span at any width, or running to 20 characters or fewer, skipping fenced blocks and exempting a flat peer list averaging under 130 characters a bullet and a run that is entirely table rows. Each file reports its longest run alone, so a second run past the checkpoint in the same file is never named.
 
 Every weight and depth measure counts the text a reader is shown. A link reduces to its anchor text and an autolink drops whole, since no reader is shown either destination. A backticked path stays counted, which is where these measures part from the ban scan `markdown-audit.md` describes: that one blanks a code span so a standard quoting its own banned character does not report itself, and discounting the same span here would under-report a paragraph carrying several. One file holds both span sets and each answers its own question.
 
@@ -17,7 +17,7 @@ The paragraph check measures both halves of one rule. `markdown.md` caps a parag
 
 A sentence boundary closes on terminal punctuation ahead of a capital or a code span. The capital is what keeps a version pin and a decimal from each reading as two sentences, and the code span is admitted beside it because a command name opening a sentence carries no capital to find.
 
-The paragraph weight sits at 700 and the bullet weight at 400. Both shipped at 400, because the paragraph number was borrowed from the bullet rule when the two checks landed together, and each has since been read against a sample of its own. They are separate checkpoints in the standard and separate patterns in the parser, so a read that moves one leaves the other where it is.
+The paragraph weight sits at 700 and the bullet weight at 250. Both shipped at 400, and the bullet number moved to 250 so the audit's warning and the `paragraph-growth` gate stage, which fails a bullet a branch adds or grows past it in a context entry, read one number. The paragraph number was borrowed from the bullet rule when the two checks landed together, and each has since been read against a sample of its own. They are separate checkpoints in the standard and separate patterns in the parser, so a read that moves one leaves the other where it is.
 
 ### The sample behind the paragraph number
 
@@ -46,6 +46,14 @@ That re-sample ran once the scan stopped counting link syntax as prose. Findings
 
 A bullet, a heading, a table row, a blockquote, a blank line, and a fence each end a paragraph, so a heavy bullet is reported by the bullet check alone and never counted twice.
 
+## Bullet stacks
+
+A run of consecutive top-level bullets reports past 5. A blank line, an indented continuation, and a nested item do not break the run, and a paragraph, a heading, or any other column-zero line does. A fenced line is skipped without breaking it. The count is of items rather than weight, so it catches a catalog of short bullets the 250-character checkpoint above passes.
+
+Two shapes are exempt. A run whose every item opens with a bold label or a link names its own subject per item and reads as a table of entries, and a numbered list states an order, so numbered items never count. `CHANGELOG.md` is exempt by name. Governance rules and `REQUIREMENT.md` sit outside the gate stage's scope rather than being exempted here, since a rule is one imperative per bullet.
+
+The audit reports a stack and never fails on one. The `bullet-stacks` stage in `canon gate run` fails the push, for the reason the length ceiling does: the audit also runs on plans and groundwork records kept out of version control.
+
 ## Cadence
 
 Uniform cadence is the failure a ban list cannot express. A ban set states negatives, and fragments, verbless clauses, and sentences that all run one length are each the absence of something, so no word added to a ban list reaches any of them. The shape layer already measured a bullet, a paragraph, and a run, and stopped one level above where that failure lives.

package/docs/agents/markdown-audit.md

@@ -67,11 +67,11 @@ The heading-case measure reports a heading or a frontmatter `title` with a capit
 
 ### Weight, cadence, and length
 
-Bullet and paragraph weight, run depth, the two cadence numbers, and the document length ceiling are each a judgment a reader settles rather than a fact a scan settles. What each measures, the samples behind its checkpoint, and why none of them gates are in `markdown-audit-weight.md`.
+Bullet and paragraph weight, bullet stacks, run depth, the two cadence numbers, and the document length ceiling are each a judgment a reader settles rather than a fact a scan settles. What each measures, the samples behind its checkpoint, and why none of them gates are in `markdown-audit-weight.md`.
 
 ## Exit codes
 
-Exit codes are `0` for a completed run with no gating finding, `1` for a refusal, `2` for a ban hit or a dead relative link, and `3` for a shipped ban set that arrived empty. A banned character and a relative link resolving to nothing on disk each fail the run, both facts a scan settles rather than a reader judging. Bullet, paragraph, and depth weight are judgments a reader settles, and cadence is a distribution whose healthy range moves with the surface, so all four report under every code. Length reports the same way, since the audit also runs on a plan kept out of version control, and the Document ceiling stage in `canon gate run` owns that verdict instead.
+Exit codes are `0` for a completed run with no gating finding, `1` for a refusal, `2` for a ban hit or a dead relative link, and `3` for a shipped ban set that arrived empty. A banned character and a relative link resolving to nothing on disk each fail the run, both facts a scan settles rather than a reader judging. Bullet, paragraph, and depth weight are judgments a reader settles, and cadence is a distribution whose healthy range moves with the surface, so all four report under every code. A bullet stack, a run of more than 5 plain bullets, reports the same way, and the `bullet-stacks` stage in `canon gate run` owns its verdict. Length reports the same way, since the audit also runs on a plan kept out of version control, and the Document ceiling stage in `canon gate run` owns that verdict instead.
 
 `3` is separate from `1` because the two want different responses from a caller. A refusal means no corpus was built, and the `Markdown bans` stage in `canon gate run` is right to report it as unmeasured rather than as a pass. An empty set means the corpus was walked and nothing was looked for, so that stage fails the push on `3` rather than skipping.
 

package/docs/agents/pr-frames.md

@@ -8,7 +8,7 @@ description: How canon pr frames pushes a UI review frame to a never-merged bran
 `canon pr frames` gives a review comment an image it can embed. `review-ui`
 drives a pull request's checklist and captures a frame per box, and a frame
 on the reviewer's disk resolves for nobody else. The verb pushes one frame to
-the `canon-frames` branch and returns a link to its path there.
+the `canon/frames` branch and returns a link to its path there.
 
 ```bash
 canon pr frames 1341 --add frames/3.png --box 3 --head <sha> --pass 20261002T154450Z --json
@@ -19,7 +19,7 @@ canon pr frames --prune 30 --json
 
 ## What it writes
 
-The verb writes `refs/heads/canon-frames` and no other ref. Every call goes
+An add writes `refs/heads/canon/frames` and no other ref. Every call goes
 through the GitHub git data API, being blobs, trees, commits, and that one ref,
 so nothing is checked out, no worktree is entered, and neither `main` nor any
 branch a pull request holds is touched. The branch never merges.
@@ -36,7 +36,7 @@ box therefore writes a new file rather than replacing the image an earlier
 comment shows, which matters when a preview is minted again at one head.
 
 `link` uses the same `blob/<ref>/<path>?raw=true` form as the evidence comment,
-naming the `canon-frames` branch rather than a commit. Every drop rewrites the
+naming the `canon/frames` branch rather than a commit. Every drop rewrites the
 branch, and a link pinned to a commit would stop resolving for every other pull
 request's frames once GitHub collects the commit it names. A path link lives
 exactly as long as its file, so it survives every rewrite that drops another
@@ -97,6 +97,20 @@ than that many days ago, in a single rewrite. It keeps one still open, one
 reopened after closing, one closed exactly the given days ago, and one whose
 state could not be read, listing that last kind under `unread`.
 
+## The legacy branch
+
+Frames lived on `canon-frames` before the rename to `canon/frames`. An add
+never writes it. `--drop` and `--prune` also run against it after the
+current branch, remove only, and delete it once empty. `--prune` drains it
+as its pull requests expire, and `--drop` clears one pull request at once.
+The record carries `legacy: true` when that
+pass changed the ref, and its `removed` list folds both branches in, naming
+a pull request once. A missing or unreadable legacy ref never fails a run
+the current branch finished.
+
+A link minted before the rename points at `blob/canon-frames/...` and keeps
+resolving until its pull request has been closed 30 days or `--drop` runs.
+
 This repository runs `--prune 30` daily from
 `.github/workflows/pr-frames-cleanup.yml`. A frame's file stays on the branch
 until its own pull request has been closed for 30 days, so a link in a review

package/docs/agents/sessions-transfer.md

@@ -67,12 +67,14 @@ The transcript and side folder land under `projects/<encoding>/`, where the enco
 
 Exit codes: `0` the session was placed, `1` refused. The refusal carries one of these reasons:
 
-- `not-a-bundle`: the file is no gzip tarball, carries no manifest at format `1`, or names a path outside its own session, such as one climbing out with `..` or an absolute one
-- `other-repository`: the local `origin` differs from the one the bundle recorded
-- `exists`: the target transcript or side folder is already there, or any other project folder already holds a transcript for the id, which `--resume <id>` could reach first
-- `live-here`: the id is live in the local roster, so a second copy would fork it
-- `write-failed`: a write failed partway for a reason other than a copy appearing, such as a bundle carrying a file where it also needs a folder
-- `no-archive`: the running Bun predates `Bun.Archive`
+| Reason             | Meaning                                                                                                                                                           |
+| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `not-a-bundle`     | the file is no gzip tarball, carries no manifest at format `1`, or names a path outside its own session, such as one climbing out with `..` or an absolute one    |
+| `other-repository` | the local `origin` differs from the one the bundle recorded                                                                                                       |
+| `exists`           | the target transcript or side folder is already there, or any other project folder already holds a transcript for the id, which `--resume <id>` could reach first |
+| `live-here`        | the id is live in the local roster, so a second copy would fork it                                                                                                |
+| `write-failed`     | a write failed partway for a reason other than a copy appearing, such as a bundle carrying a file where it also needs a folder                                    |
+| `no-archive`       | the running Bun predates `Bun.Archive`                                                                                                                            |
 
 A write that fails partway removes every file this run placed and every folder it created before refusing, so a retry of the same bundle does not refuse on its own leftovers. Any path it could not remove is named in the message. A copy that appears between the existence check and the write refuses as `exists` on the same terms.
 

package/docs/agents/skills-audit.md

@@ -28,14 +28,22 @@ The audit reads the directory it is pointed at, defaulting to the cwd. `canon cl
 
 Each check traces to a line in the standard.
 
-- `REQUIREMENT.md` present in every skill folder
+### Folder and frontmatter
+
 - Frontmatter `name` matching the folder name
 - Frontmatter `description` present
 - `description` under 1024 characters
 - No `README.md` inside a skill folder
 - Folder name in kebab-case
+
+### Requirement and content
+
+- `REQUIREMENT.md` present in every skill folder
 - Each `REQUIREMENT.md` declaring `Gap` and `Must`, matched at any heading level
 - No ISO date in `SKILL.md` or any file under `references/`, reported as `datedProvenance` in the JSON record's `findings`
+
+### Practice, references, and family
+
 - Each listed practice skill closing with `## Excuses and rebuttals`, `## Red flags`, and `## Before handing over`, and each skill on the wider ledger list carrying `references/adopted.md`, reported together as `practiceShape`
 - Each file under `references/` running over 100 lines opening with a `## Contents` H2, reported as `referenceContents`
 - Each skill under `claude/skills/` declaring a `metadata.family` that names a key in `checkpoints.families`, reported as `family`

package/docs/target/scenarios.md

@@ -52,4 +52,4 @@ A sync whose target sits below the git root knows it is writing into a subfolder
 
 - It withholds `.github/`, since GitHub reads workflows only at the repository root, and names each withheld file. Run the subtree from a job in the root workflow instead, with `working-directory` set to the subtree path the sync prints, such as `working-directory: frontend`.
 - It installs no dependencies and adds no scripts to a subtree without a `package.json`. It names what it skipped and ends on `run 'bun init' in <path>, then sync again`.
-- The subtree carries no `check` script, since that lives in the root's base layer, so run `bun scripts/verify.ts` there. It skips the format phases a subtree does not declare, since the root runs them, and still fails on a missing lint, typecheck, or test script, the phases its stack's `scripts/verify.json` requires.
+- The subtree carries no `check` script, since that lives in the root's base layer, so run `bun scripts/verify.ts` there. It skips the format phase a subtree does not declare, since the root runs them, and still fails on a missing lint, typecheck, or test script, the phases its stack's `scripts/verify.json` requires.

package/docs/target/standards-moved.md

@@ -10,23 +10,25 @@ category: Agent surface
 
 Each standard now lives at `references/<name>.md` in the skill that owns it. Load that skill and read the reference it names:
 
-- `task-board`: `board`, `tasks`, `tasks-decline`
-- `context-fold`: `context`
-- `canvas-board`: `canvas`, `design`
-- `docs-sync`: `docs`, `readme`
-- `draft-figure`: `figures`, `mermaid`
-- `create-rule`: `rule`
-- `create-skill`: `skill`, `skill-paths`, `skill-practice`, `skill-requirement`
-- `git-branch`: `branch`, `slug`
-- `git-commit`: `commit`, `versioning`
-- `git-pr`: `pr`, `publish`
-- `markdown-craft`: `markdown`
-- `teach-workspace`: `glossary`, `teach`
-- `plan-groundwork`: `groundwork`, `groundwork-spikes`
-- `plan-intake`: `intake`
-- `plan-feature`: `plan`, `plan-lifecycle`
-- `draft-ready`: `ready`
-- `draft-doc`: `requirements`, `wiki`
-- `session-map`: `session`
+| Skill             | Standards                                                     |
+| ----------------- | ------------------------------------------------------------- |
+| `task-board`      | `board`, `tasks`, `tasks-decline`                             |
+| `context-fold`    | `context`                                                     |
+| `canvas-board`    | `canvas`, `design`                                            |
+| `docs-sync`       | `docs`, `readme`                                              |
+| `draft-figure`    | `figures`, `mermaid`                                          |
+| `create-rule`     | `rule`                                                        |
+| `create-skill`    | `skill`, `skill-paths`, `skill-practice`, `skill-requirement` |
+| `git-branch`      | `branch`, `slug`                                              |
+| `git-commit`      | `commit`, `versioning`                                        |
+| `git-pr`          | `pr`, `publish`                                               |
+| `markdown-craft`  | `markdown`                                                    |
+| `teach-workspace` | `glossary`, `teach`                                           |
+| `plan-groundwork` | `groundwork`, `groundwork-spikes`                             |
+| `plan-intake`     | `intake`                                                      |
+| `plan-feature`    | `plan`, `plan-lifecycle`                                      |
+| `draft-ready`     | `ready`                                                       |
+| `draft-doc`       | `requirements`, `wiki`                                        |
+| `session-map`     | `session`                                                     |
 
 One name moved under a new filename. `standard`, the shape of a standard itself, became `skill-reference.md` in `create-skill`, since the toolkit no longer ships a standards folder to hold one.

package/docs/workflow/ai-workflow.md

@@ -52,6 +52,9 @@ Work in Claude Code directly. It reads `CLAUDE.md` automatically and has full fi
 - When the input is a pile of findings rather than one feature, invoke `canon:plan-intake` first. It files the dump into `.canon/intake/<nn>-<slug>/`, one item per finding carrying a problem measured against the tree, a proposed fix, and a verdict, then names which items are plan-ready, which need measuring, and which are already settled.
 - When the backlog has grown past what anyone rereads, invoke `canon:backlog-triage`. It files one item per backlog row into an intake folder, suggesting decline, archive, keep, or promote and leaning toward decline, and once `canon:plan-intake-answer` has taken your answers, a second run applies the approved verdicts through the task verbs.
 - When the current state is unmeasured and more than one approach is live, invoke `canon:plan-groundwork` first. It opens a track folder under `.canon/groundwork/<nn>-<slug>/` and ends in a decision, which may be to do nothing. Skip it when the approach is already settled.
+
+Then plan and build:
+
 - Invoke `canon:plan-feature` to scan for code-level conflicts and ambiguities, confirm approach before proceeding
 - Implement the feature, then Claude Code runs the commands defined in `CLAUDE.md`, fixes failures, and iterates until all pass
 - For UI changes, invoke `canon:ui-checklist` to write what a reviewer has to look at and name any behavior shipping without a test