@erclx/canon 5.4.0 → 5.6.0

package/docs/agents/context-audit-checks.md

@@ -65,7 +65,7 @@ Fenced blocks are excluded, which keeps a pinned version in an install command f
 
 ## The architecture record
 
-Four findings read `canon/ARCHITECTURE.md` rather than a folder: an entry cap and a length ceiling, each gating only where the record states it for itself, a claim coverage report, and a word count. What each reads and why the last two gate nothing are in `architecture-record.md`.
+Five findings read `canon/ARCHITECTURE.md` rather than a folder: an entry cap, a revisit sentence closing each decision, and a length ceiling, each gating only where the record states it for itself, a claim coverage report, and a word count. What each reads and why the last two gate nothing are in `architecture-record.md`.
 
 ## Wireframe states
 

package/docs/agents/context-audit.md

@@ -5,7 +5,7 @@ description: Running the audit, its flags and folder scope, the exit codes, the
 
 # Context audit
 
-`canon context audit [path]` reports the structural state of the folders following the index-plus-entry contract, meaning a generated `index.md` beside entries carrying frontmatter, and it measures `canon/ARCHITECTURE.md` beside them. It reads and reports. Fixing what it finds is separate work. What each finding means is in `context-audit-checks.md`, and what the architecture record's four findings mean is in `architecture-record.md`.
+`canon context audit [path]` reports the structural state of the folders following the index-plus-entry contract, meaning a generated `index.md` beside entries carrying frontmatter, and it measures `canon/ARCHITECTURE.md` beside them. It reads and reports. Fixing what it finds is separate work. What each finding means is in `context-audit-checks.md`, and what the architecture record's five findings mean is in `architecture-record.md`.
 
 Findings stated over every markdown file rather than over a context entry are measured by `canon markdown audit`, described in `markdown-audit.md`. That command resolves no folder, so it reaches trees this one refuses.
 
@@ -37,9 +37,9 @@ A run where no requested name resolves refuses, whichever list it read. Naming t
 
 ## Exit codes
 
-Exit codes are `0` for a clean run, `1` for a refusal, and `2` for a gating finding. An unresolved citation gates under every mode. An architecture record that states its own line allowances gates when it is past the ceiling those derive, on any run that measures it, which is every mode except `--citations-only`. A record that states an entry cap gates the same way when it holds more decisions than the cap, and a record stating neither limit is reported and never gated.
+Exit codes are `0` for a clean run, `1` for a refusal, and `2` for a gating finding. An unresolved citation gates under every mode. An architecture record that states its own line allowances gates when it is past the ceiling those derive, on any run that measures it, which is every mode except `--citations-only`. A record that states an entry cap gates the same way when it holds more decisions than the cap, and one stating that every decision closes with a revisit sentence gates when a decision lacks it. A record stating none of the three is reported and never gated.
 
-`bun run check` in the toolkit repository reads both limits through its own Architecture record stage rather than through this verb, since the verb's only gating stage there runs `--citations-only` and never opens the record.
+`bun run check` in the toolkit repository reads all three of the record's rules through its own Architecture record stage rather than through this verb, since the verb's only gating stage there runs `--citations-only` and never opens the record.
 
 Entry length, reference form, table, provenance, the record's claim classification, and every word figure print and return `0` under every mode, because each is a judgment or a weight read alongside one, and failing a push on either would make the check something to route around.
 

package/docs/agents/index.md

@@ -8,7 +8,7 @@ category: Agent surface
 
 CLI catalog and invocation rules for agents, split by command domain. Start with overview.
 
-- [Architecture record](architecture-record.md): The four findings canon context audit reads off the architecture record, being the entry cap and length gates the record states for itself, the claim coverage report, and the word counts
+- [Architecture record](architecture-record.md): The five findings canon context audit reads off the architecture record, being the entry cap, revisit sentence, and length gates the record states for itself, the claim coverage report, and the word counts
 - [Audits](audits.md): Running every health check as one set, what the single verdict means, the exit code each outcome takes, the retained baseline and the delta it reports, and which corpora are kept out of the record
 - [Capture](capture.md): Rendering HTML sources to PNG, what the command asserts about fonts, and why the selector has no default
 - [Census](census.md): Tracked-plus-untracked file count, a breakdown by extension, and a line total that skips whatever reads as binary
@@ -50,7 +50,7 @@ CLI catalog and invocation rules for agents, split by command domain. Start with
 - [Scripting](scripting.md): The runtime catalogs that replace hardcoded names, what each carries, and a headless invocation per domain
 - [Sessions transfer](sessions-transfer.md): Moving a session to another machine, the export bundle and its manifest, placing it with import, the refusal reasons, and what a resume on the target depends on
 - [Sessions](sessions.md): Resolving live peer sessions to the worktree and branch each holds, reading which row is the caller, the liveness confidence field, what each session surface can see, and where moving a session to another machine is described
-- [Skill audit](skills-audit.md): Measuring both skill corpora against standards/skill.md, the checks it reads, the requirement gate that is the only failing one, and the drift verb that names bodies rewritten since a ref
+- [Skill audit](skills-audit.md): Measuring both skill corpora against the skill standards, the checks it reads, the requirement gate that is the only failing one, and the drift verb that names bodies rewritten since a ref
 - [Citation reach](skills-reach.md): Reporting the skill bodies that cite a path no target project receives, which corpus the verb reads, the ownership key that decides what counts, the one-word qualifier that marks a citation as decided, and why the verb reports instead of gating
 - [Standard success criteria](standards-audit.md): Reading the corpus against the success-criterion gate, the two headings it accepts, why the check scopes to arrival rather than the whole corpus, and the exit codes it sets
 - [State-scoped risk](state-scoped-risk.md): Reading committed state rather than an arriving change, the shipped-tree corpus the secret scan reads, what it keys on and how a deliberate value is exempted, the advisory check and its network failure mode, and why one gates while the other reports
@@ -61,6 +61,6 @@ CLI catalog and invocation rules for agents, split by command domain. Start with
 - [Tasks validate](tasks-validate.md): Validating the board against the tree, the seven checks, the untested, claims, and unplaced arrays, the exit codes, and the refusal reasons
 - [Tasks](tasks.md): Claiming the next phase label, recording a pull request number and closing an outcome, listing each task's readiness, and where archiving, the plan verbs, and board validation are described
 - [Teach authoring](teach-authoring.md): Resolving what the next lesson needs before it is written, rendering a lesson body's blocks to HTML, and rewriting the root listing, a contents page, and each lesson's chrome and quiz stepper from its marker regions
-- [Teach](teach.md): Listing learning workspaces with what their records schedule next, opening one with its required files, recording sources and glossary terms, where the lesson authoring verbs are described, the refusal reasons, and why every write here runs through a verb
+- [Teach](teach.md): Listing learning workspaces with what their records schedule next, opening one with its required files, recording sources and glossary terms, viewing one with its chrome refreshed, where the lesson authoring verbs are described, the refusal reasons, and why every write here runs through a verb
 - [Test order](test-order.md): Reading where an implementation reached history ahead of its test, how a pair is decided, the three verdicts, the coverage the pairing cannot reach, and why the check reports rather than gates
 - [Worktrees](worktrees.md): Reporting which worktrees are reclaimable, removing the ones that are, the record a hook reads back, why the reading keys on the pull request rather than on git ancestry, the refusals it names, and the two removal shapes

package/docs/agents/skills-audit.md

@@ -1,11 +1,11 @@
 ---
 title: Skill audit
-description: Measuring both skill corpora against standards/skill.md, the checks it reads, the requirement gate that is the only failing one, and the drift verb that names bodies rewritten since a ref
+description: Measuring both skill corpora against the skill standards, the checks it reads, the requirement gate that is the only failing one, and the drift verb that names bodies rewritten since a ref
 ---
 
 # Skill audit
 
-`canon claude skills audit [path]` reports both skill corpora against the rules `standards/skill.md` and `standards/skill-requirement.md` state mechanically. It reads and reports. Fixing what it finds is separate work.
+`canon claude skills audit [path]` reports both skill corpora against the rules `standards/skill.md`, `standards/skill-requirement.md`, and `standards/skill-practice.md` state mechanically. It reads and reports. Fixing what it finds is separate work.
 
 ```bash
 canon claude skills audit
@@ -36,6 +36,7 @@ Each check traces to a line in the standard.
 - Folder name in kebab-case
 - Each `REQUIREMENT.md` declaring `Gap` and `Must`, matched at any heading level
 - No ISO date in `SKILL.md` or any file under `references/`, reported as `datedProvenance` in the JSON record's `findings`
+- Each listed practice skill closing with `## Excuses and rebuttals`, `## Red flags`, and `## Before handing over`, and carrying `references/adopted.md`, reported as `practiceShape`
 
 A body whose frontmatter does not parse reports as declaring neither field rather than ending the run, so one malformed file cannot hide the corpus behind it. A key present with an empty value reads as absent, since a blank `name` would otherwise report as a name disagreeing with every folder. A folder carrying no requirement is reported once under presence rather than counted again for the sections it therefore lacks.
 
@@ -43,6 +44,8 @@ The date check reads prose alone. A date inside a fence or a code span is exampl
 
 Each finding names the file and the line, such as `claude/skills/<name>/references/<file>.md  line 12: <date>`. A date after "measured" or "verified" reports like any other, unlike the context audit, because a skill body states the rule a session follows today rather than a reading of the tree.
 
+The practice check reads only the skills the audit lists, which the JSON record carries as `checkpoints.practiceSkills`. The list names folders under the toolkit's shipped `claude/skills/` corpus alone, so a project's own skill is never read as a practice skill and a same-named folder under `.claude/skills/` produces no finding. Where `claude/skills/` resolves, a listed folder it does not hold reports as a missing skill, so a renamed or misspelled entry cannot pass unread. Each closing section matches only as an exact H2 outside a fence, so an H3 or a heading carrying more words reports as missing.
+
 ## What it leaves alone
 
 The report names its own blind spots on every run, including the run where everything passed. Whether each `Must` traces to a stated gap is the rule in the requirement standard worth the most and no parser reads it. Whether a gap states an observed failure rather than an intent, and whether a description routes, are the same kind of judgment. The 150-line body checkpoint is the one mechanical rule still absent here, and adding it would print a count rather than a defect, since the standard makes it a prompt to look with nothing enforcing it.
@@ -53,7 +56,7 @@ A check with no rule behind it prints an opinion as a defect, which is where the
 
 ## Exit codes
 
-Exit codes are `0` for a clean run, `1` for a refusal, and `2` for a skill folder carrying no `REQUIREMENT.md`. Only presence sets a failing code. Name, description, folder, requirement-section, and dated-provenance findings print and return `0`, because each is a judgment a reader settles and failing a push on one would make the check something to route around.
+Exit codes are `0` for a clean run, `1` for a refusal, and `2` for a skill folder carrying no `REQUIREMENT.md`. Only presence sets a failing code. Name, description, folder, requirement-section, dated-provenance, and practice shape findings print and return `0`, because each is a judgment a reader settles and failing a push on one would make the check something to route around. In the toolkit, two `bun run check` stages read the same report in-process and fail a push on dated provenance and on practice shape, since its own corpus is held at zero on both.
 
 ## The requirement gate
 

package/docs/agents/teach-authoring.md

@@ -30,7 +30,7 @@ It reports three things. `lesson` is the numbered path the lesson takes, derived
 
 A lesson written against this record carries its chrome as four empty marker pairs rather than hand-composed markup: `canon:teach:style`, `canon:teach:header`, `canon:teach:footnav`, and `canon:teach:scripts`. `canon teach nav`, below, fills them from what the workspace holds on disk.
 
-`canon teach stylesheet <topic>` writes the pair every lesson in the workspace renders through, seeded from the design source so a workspace renders in the system every other surface does. The two halves are written on different terms. `assets/base.css` holds the generated design layer and is rewritten on every run, which is the only way a change to the shared chrome reaches a workspace that already exists. `assets/course.css` is the half a workspace owns, so it refuses to overwrite, reporting `written` as false where the workspace already carries one, and `--force` takes the seed back over it. Each workspace used to carry a hand-authored palette, which is how the course styling forked once per workspace, so a lesson adds its own rules under the seed and reaches a value through its custom property rather than restating the hex.
+`canon teach stylesheet <topic>` writes the pair every lesson in the workspace renders through, seeded from the design source so a workspace renders in the system every other surface does. The two halves are written on different terms. `assets/base.css` holds the generated design layer and is rewritten on every run, so a change to the shared chrome reaches a workspace that already exists. `canon teach nav` and `canon teach up` rewrite it too. `assets/course.css` is the half a workspace owns, so it refuses to overwrite, reporting `written` as false where the workspace already carries one, and `--force` takes the seed back over it. Each workspace used to carry a hand-authored palette, which is how the course styling forked once per workspace, so a lesson adds its own rules under the seed and reaches a value through its custom property rather than restating the hex.
 
 Each `quiz` entry carries `order`, the authored option indices in presentation order where index `0` is the correct answer, and `answer`, the one-based position that answer lands in. Both travel together because a caller deriving the position itself is a caller that can derive it wrongly.
 
@@ -50,7 +50,7 @@ echo '[{"type":"heading","level":1,"text":"Compass bearings"}]' | canon teach re
 
 It reads a JSON array of blocks from stdin, each a `heading`, `paragraph`, `list`, `refs`, `code`, or `raw` block, and reports `{ ok: true, html }` on `--json` or the bare rendered HTML on stdout otherwise. Content none of the components can express takes a `raw` block, carrying its own HTML verbatim and unescaped, which is the shape the quiz and the teach-back block travel in.
 
-A `code` block carries `text` and an optional `lang`, a highlight.js name or alias. The source is highlighted at render time into `hljs-*` class spans the workspace stylesheet colors in both themes, so the page carries no script. A `lang` the renderer does not register renders as plain escaped code, and one that does not match `^[a-z0-9+#-]+$` is refused. A workspace seeded before the syntax colors existed shows the spans uncolored until `canon teach stylesheet <topic>` rewrites its base stylesheet.
+A `code` block carries `text` and an optional `lang`, a highlight.js name or alias. The source is highlighted at render time into `hljs-*` class spans the workspace stylesheet colors in both themes, so the page carries no script. A `lang` the renderer does not register renders as plain escaped code, and one that does not match `^[a-z0-9+#-]+$` is refused. A workspace seeded before the syntax colors existed shows the spans uncolored until `canon teach nav`, `canon teach up`, or `canon teach stylesheet <topic>` rewrites its base stylesheet.
 
 ```json
 [{ "type": "code", "lang": "ts", "text": "const a: number = 1" }]
@@ -97,7 +97,7 @@ It also deletes two links a session used to write by hand into a lesson's `<head
 
 A workspace carrying no `course.css` gets its stylesheet pair seeded first, so the contents page it links is never unstyled, and an existing `course.css` is never overwritten. The `style` region links `assets/base.css` ahead of an embedded copy of `course.css`, so the workspace's own rules still win the cascade. The embedded copy drops the seed's `@import` line, which resolved against the lesson's own folder and never loaded anything, and the link is what reaches the base sheet in its place. A workspace with no `assets/base.css`, one holding a hand-authored `course.css` from before the seed, gets no link rather than one pointing at a missing file.
 
-That seeding fires on the absent file alone, so a workspace already holding a `course.css` has neither half rewritten here. A change to the shared chrome therefore takes `canon teach stylesheet <topic>` per workspace, which rewrites `assets/base.css`, and every lesson picks it up through its link with no run of this verb. Running this one alone leaves every lesson on the `base.css` the workspace already holds, and nothing reports it. Only an edit to a workspace's own `course.css` needs this verb, since that half is embedded.
+Every run also rewrites `assets/base.css` wherever the workspace already holds one, so a change to the shared chrome reaches an existing workspace through this verb as well as through `canon teach stylesheet <topic>`. `course.css` is still never rewritten. A legacy workspace holding only a `course.css` is not handed a `base.css`, since its lessons were written without the link. `canon teach up` runs this pass before serving, which is the route that keeps a viewed workspace current.
 
 A lesson missing one of the four marker pairs is refused by name rather than rewritten, and every other lesson in the run still rewrites. The record's `skipped` list carries the refused files and which marker each is missing.
 

package/docs/agents/teach.md

@@ -1,6 +1,6 @@
 ---
 title: Teach
-description: Listing learning workspaces with what their records schedule next, opening one with its required files, recording sources and glossary terms, where the lesson authoring verbs are described, the refusal reasons, and why every write here runs through a verb
+description: Listing learning workspaces with what their records schedule next, opening one with its required files, recording sources and glossary terms, viewing one with its chrome refreshed, where the lesson authoring verbs are described, the refusal reasons, and why every write here runs through a verb
 ---
 
 # Teach
@@ -116,15 +116,19 @@ The entry lands as the standard's shape, leading with the term as a bolded span.
 
 ## Opening a workspace
 
-No `canon teach` verb serves the workspace. `canon serve` does, taking the teach root as its directory and the workspace contents page as its entry:
+`canon teach up` runs the `nav` pass and then serves the teach root, so the page a reader opens carries the chrome the installed CLI generates:
 
 ```bash
-canon serve .canon/teach --entry 03-fde-system-design/index.html --json
+canon teach up 03-fde-system-design --json
 ```
 
-`canon teach list <topic>` ends its human output with this line for that workspace, with the teach folder written relative to the cwd, or absolute when it sits outside it, since `canon serve` resolves its directory against the cwd while the list verb reads the main worktree root. The JSON record carries no such field.
+The link opens the named workspace's contents page, or the root listing when no topic is named. The verb serves the teach folder at its absolute path, so a run from a linked worktree still reaches the main worktree root. `--port` sets the first port tried and `--root` the teach root, as on every other verb. It runs until interrupted, so a session starts it in the background and reads the record off stdout.
 
-It stays general rather than becoming `canon teach serve`, because nothing about serving a directory is specific to a learning workspace, and the same verb carries a slide render and a design preview.
+The JSON record is one line carrying the `nav` fields, then `served`, the absolute folder, and the server's `host`, `port`, `entry`, `url`, and `entryExists`. A lesson `nav` skips lands in `skipped` and the server still starts, since a partial refresh is still worth viewing. A `nav` refusal starts no server.
+
+Viewing writes. Every page and generated stylesheet `nav` owns is rewritten first, which on a committed fixture shows as a diff. To serve without rewriting anything, `canon teach list <topic>` ends its human output with a `canon serve` line for that workspace, with the teach folder written relative to the cwd, or absolute when it sits outside it. The JSON record of `list` carries no such field.
+
+`canon serve` itself stays general, since nothing about serving a directory is specific to a learning workspace and the same verb carries a slide render and a design preview. What `up` adds in front of it is the refresh, which is teach-specific, and it serves through the same server rather than a second one.
 
 Read `url` off the record rather than building one from the port that was asked for. The verb walks forward past a port already in use, which is routine when a second workspace is already open, and the port it took is the one thing a composed URL gets wrong.
 
@@ -142,4 +146,6 @@ Read `url` off the record rather than building one from the port that was asked
 | `defined`      | A term already carries a glossary entry                         |
 | `bad-input`    | The command line is malformed, before any folder is read        |
 
+`up` also passes through the refusals `canon serve` raises once `nav` has run, `no-port` when every port in reach is taken and `bind-failed` for any other bind error, such as a privileged port, in the same record shape with the server's detail as `message`.
+
 A `bad-input` refusal reports the working directory as its root rather than the resolved one, since the command line is rejected before the root is worth resolving. `lesson` raises it for a slug that is not kebab-case, for a quiz carrying no question, and for a question carrying fewer than two options, since a question with one option has nothing to confuse the right answer with.

package/docs/workflow/skill-map.md

@@ -125,8 +125,7 @@ This page is the corpus the coverage claim is measured against: every name `cano
 | `canon:draft-wiki`        | For a brand-new wiki reference page on a subject owned outside the project, drafted against `standards/wiki.md`   |
 | `canon:draft-figure`      | For a hand-drawn figure inside an existing doc, drafted against `standards/figures.md` in Mermaid or freehand SVG |
 | `canon:draft-readme`      | For a project's `README.md`, drafted against `standards/readme.md`                                                |
-| `canon:bash-script`       | For an interactive, human-facing shell tool                                                                       |
-| `canon:bash-cli-script`   | For a non-interactive automation, CI, or pipeline script                                                          |
+| `canon:bash-cli-script`   | For a small non-interactive shell wrapper, stopping at 100 lines in favor of TypeScript on Bun                    |
 | `canon:ci-workflow`       | For a GitHub Actions workflow file                                                                                |
 | `canon:draft-slides`      | For a deck, drafted as `.claude/SLIDES.md` and rendered to PowerPoint                                             |
 | `canon:draft-screencast`  | For a recording script with beats and defaults already seeded                                                     |

package/governance/rules/lang/120-bash.md

@@ -1,5 +1,5 @@
 ---
-description: Route bash script authoring to the interactive or non-interactive skill, and name the lint gate
+description: Route bash script authoring to the wrapper skill, and name the lint gate
 paths:
   - '**/*.sh'
 ---
@@ -8,10 +8,9 @@ paths:
 
 ## Skill routing
 
-- Use `canon:bash-script` for an interactive or human-facing script: prompts, a visual timeline UI, framed terminal output.
-- Use `canon:bash-cli-script` for a non-interactive script: automation, CI, cron, a pipeline helper, or anything run by an agent rather than watched by a person.
-- Load the matched skill's own reference templates rather than hand-rolling interactivity or logging patterns outside them.
-- Report it rather than proceeding silently when the matched skill does not resolve. Both ship with the plugin and this rule ships with the CLI, so a project that installed governance alone does not have them.
+- Use `canon:bash-cli-script` before writing a script, and follow its guards on what a shell script may be.
+- Load the skill's own reference template rather than hand-rolling logging patterns outside it.
+- Report it rather than proceeding silently when the skill does not resolve. It ships with the plugin and this rule ships with the CLI, so a project that installed governance alone does not have it.
 
 ## Lint gate
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@erclx/canon",
   "type": "module",
-  "version": "5.4.0",
+  "version": "5.6.0",
   "description": "Infrastructure and quality tooling for developer workflows",
   "license": "MIT",
   "bin": {

package/src/audits/catalog.ts

@@ -140,7 +140,7 @@ function allOf(
 }
 
 /**
- * Reads the architecture record's three measures, or nothing when the project
+ * Reads the architecture record's measures, or nothing when the project
  * carries no record.
  *
  * Three states rather than two, matching what the verb publishes. The key
@@ -172,8 +172,11 @@ function architectureCounts(
   const entryCap =
     typeof record.entryCap === 'number' ? record.entryCap : undefined
 
+  const revisitRequired = record.revisitRequired === true
+
   let unverifiable = 0
   let unchecked = 0
+  let lackingRevisit = 0
   for (const raw of decisions) {
     const entry = asObject(raw)
     const claim = entry?.claim
@@ -182,6 +185,7 @@ function architectureCounts(
 
     if (claim === 'neither') unverifiable += 1
     else if (checks === 0) unchecked += 1
+    if (revisitRequired && entry?.revisit !== true) lackingRevisit += 1
   }
 
   return {
@@ -195,6 +199,8 @@ function architectureCounts(
     ...(entryCap !== undefined && {
       recordOverCount: decisions.length > entryCap ? 1 : 0,
     }),
+    // Absent on a record stating no revisit clause, for the same reason.
+    ...(revisitRequired && { recordMissingRevisit: lackingRevisit }),
     recordUnverifiable: unverifiable,
     recordUnchecked: unchecked,
   }

package/src/claude/cases/authoring.ts

@@ -5,11 +5,6 @@ import type { SkillCase } from '@/claude/skills-rank'
  * skills that revise rather than generate.
  */
 export const AUTHORING_CASES: readonly SkillCase[] = [
-  {
-    prompt:
-      'I need a shell tool with prompts and a nice terminal UI for people to run by hand.',
-    expect: 'bash-script',
-  },
   {
     prompt:
       'Wire up a GitHub Actions pipeline with parallel jobs for this repo.',

package/src/claude/skills-audit.ts

@@ -12,16 +12,40 @@ export const DESCRIPTION_LIMIT = 1024
 /** The two headings the requirement template declares, matched at any level. */
 export const REQUIREMENT_SECTIONS: readonly string[] = ['Gap', 'Must']
 
+/** The one tree that ships to a target, and the only one the practice list names. */
+export const SHIPPED_CORPUS = join('claude', 'skills')
+
 /**
  * Both trees the standard governs. `claude/skills/` ships to a target and
  * `.claude/skills/` stays here, and every rule measured below applies to each,
  * so a corpus reading one of them reports a pass over half the subject.
  */
 export const CORPORA: readonly string[] = [
-  join('claude', 'skills'),
+  SHIPPED_CORPUS,
   join('.claude', 'skills'),
 ]
 
+/**
+ * The practice skills `standards/skill-practice.md` describes, keyed by corpus-relative
+ * folder rather than by name, so a target's own `.claude/skills/` folder that
+ * shares a name is never swept in. The list lives here rather than in a skill's
+ * frontmatter because a skill declaring its own kind could exempt itself.
+ */
+export const PRACTICE_SKILLS: readonly string[] = [
+  join(SHIPPED_CORPUS, 'codebase-layout'),
+  join(SHIPPED_CORPUS, 'test-craft'),
+]
+
+/** The closing H2s a practice skill carries, matched exactly outside fences. */
+export const PRACTICE_SECTIONS: readonly string[] = [
+  'Excuses and rebuttals',
+  'Red flags',
+  'Before handing over',
+]
+
+/** The source ledger every practice skill carries beside its body. */
+export const PRACTICE_LEDGER = join('references', 'adopted.md')
+
 /**
  * The one reason this audit refuses. A project carrying neither corpus is the
  * ordinary state of a target that has not adopted either skills convention,
@@ -34,6 +58,8 @@ const KEBAB_CASE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/
 
 const HEADING = /^#{1,6}\s+(.+?)\s*$/
 
+const SECTION = /^##\s+(.+?)\s*$/
+
 /**
  * An ISO date, read as provenance wherever a reader is told it. The context
  * audit's detector clears a date after "measured" or "verified", and a skill
@@ -69,6 +95,7 @@ export interface SkillsAudit {
   readonly longDescription: readonly SkillFinding[]
   readonly requirementSections: readonly SkillFinding[]
   readonly datedProvenance: readonly SkillFinding[]
+  readonly practiceShape: readonly SkillFinding[]
 }
 
 interface SkillSource {
@@ -79,6 +106,9 @@ interface SkillSource {
   readonly description: string | undefined
   /** Undefined when the folder carries no `REQUIREMENT.md` at all. */
   readonly requirementHeadings: readonly string[] | undefined
+  /** Every H2 in `SKILL.md` outside a fence, for the practice shape. */
+  readonly sections: readonly string[]
+  readonly hasLedger: boolean
   /**
    * `SKILL.md` and every reference below the folder, keyed by the path a
    * finding names. `REQUIREMENT.md` and `EVAL.md` are left out, since the
@@ -134,6 +164,13 @@ export async function auditSkills(root: string): Promise<SkillsAudit> {
     datedProvenance: sources.flatMap((source) =>
       source.bodies.flatMap(dateFindings),
     ),
+    practiceShape: [
+      ...missingPracticeSkills(
+        present.some((corpus) => corpus.rel === SHIPPED_CORPUS),
+        sources,
+      ),
+      ...sources.flatMap(practiceFindings),
+    ],
   }
 }
 
@@ -190,6 +227,11 @@ async function readSkill(
     description: declared(readField(fields, 'description')),
     requirementHeadings:
       requirement === undefined ? undefined : headings(requirement),
+    sections: bodyLines(body)
+      .filter((line) => !line.fenced)
+      .map((line) => SECTION.exec(line.text)?.[1])
+      .filter((text): text is string => text !== undefined),
+    hasLedger: existsSync(join(skillDir, PRACTICE_LEDGER)),
     bodies: [
       { rel: join(skillRel, 'SKILL.md'), text: body },
       ...references.map((path, index) => ({
@@ -252,6 +294,44 @@ function sectionFindings(source: SkillSource): SkillFinding[] {
   ]
 }
 
+/**
+ * A listed folder the shipped corpus does not hold, such as a renamed skill or
+ * a misspelled append, would otherwise read as a pass. Silent where the
+ * shipped corpus is absent, since a target carries none of the listed skills.
+ */
+function missingPracticeSkills(
+  hasShippedCorpus: boolean,
+  sources: readonly SkillSource[],
+): SkillFinding[] {
+  if (!hasShippedCorpus) return []
+  const found = new Set(sources.map((source) => source.rel))
+  return PRACTICE_SKILLS.filter((rel) => !found.has(rel)).map((rel) => ({
+    rel,
+    detail: 'missing skill: no folder under the shipped corpus',
+  }))
+}
+
+/**
+ * Matches each section as an exact H2, so a heading carrying trailing text or
+ * sitting at another level reads as missing rather than as a near match the
+ * standard never names.
+ */
+function practiceFindings(source: SkillSource): SkillFinding[] {
+  if (!PRACTICE_SKILLS.includes(source.rel)) return []
+
+  const sections = PRACTICE_SECTIONS.filter(
+    (section) => !source.sections.includes(section),
+  ).map((section) => ({
+    rel: source.rel,
+    detail: `missing section: ${section}`,
+  }))
+  const ledger = source.hasLedger
+    ? []
+    : [{ rel: source.rel, detail: `missing ledger: ${PRACTICE_LEDGER}` }]
+
+  return [...sections, ...ledger]
+}
+
 /**
  * A date inside a fence or a code span is example data a reader is shown, such
  * as a sample frontmatter block, so only prose outside both is read.

package/src/commands/claude.ts

@@ -26,7 +26,11 @@ import {
   auditSkills,
   CORPORA,
   DESCRIPTION_LIMIT,
+  PRACTICE_LEDGER,
+  PRACTICE_SECTIONS,
+  PRACTICE_SKILLS,
   REQUIREMENT_SECTIONS,
+  SHIPPED_CORPUS,
   type SkillFinding,
   type SkillsAudit,
   type SkillsAuditRefusal,
@@ -1398,6 +1402,7 @@ async function runSkillsAudit(
     reportFolder(report)
     reportRequirementShape(report)
     reportProvenance(report)
+    reportPracticeShape(report)
     reportUnmeasured()
     outro()
   }
@@ -1420,11 +1425,14 @@ async function runSkillsAudit(
           folderName: report.folderName,
           requirementSections: report.requirementSections,
           datedProvenance: report.datedProvenance,
+          practiceShape: report.practiceShape,
         },
         checkpoints: {
           descriptionLimit: DESCRIPTION_LIMIT,
           requirementSections: REQUIREMENT_SECTIONS,
           corpora: CORPORA,
+          practiceSkills: PRACTICE_SKILLS,
+          practiceSections: PRACTICE_SECTIONS,
         },
       })}\n`,
     )
@@ -1615,6 +1623,31 @@ function reportProvenance(report: SkillsAudit): void {
   reportFindings(report.datedProvenance)
 }
 
+/**
+ * Reports without failing the run for the reason provenance does. The list
+ * names shipped folders alone, which the step says so a target reading a pass
+ * knows its own skills were never in scope.
+ */
+function reportPracticeShape(report: SkillsAudit): void {
+  logStep('Practice shape')
+  logInfo(
+    `A listed practice skill closes with ${PRACTICE_SECTIONS.map((section) => `## ${section}`).join(', ')}, and carries ${PRACTICE_LEDGER}.`,
+  )
+  logInfo(
+    `The list is kept here and names ${plural(PRACTICE_SKILLS.length, 'shipped skill')}, so a skill outside ${SHIPPED_CORPUS} is never read.`,
+  )
+
+  if (report.practiceShape.length === 0) {
+    logInfo('Every listed practice skill carries its shape.')
+    return
+  }
+
+  logWarn(
+    `${plural(report.practiceShape.length, 'missing part')} across the listed practice skills`,
+  )
+  reportFindings(report.practiceShape)
+}
+
 /**
  * Stated on every run, including the run where everything above passed. A
  * report that lists only what it measured reads as a verdict on the standard

package/src/commands/context.ts

@@ -25,6 +25,7 @@ import {
   isOverCount,
   isOverLength,
   measureArchitecture,
+  missingRevisit,
   testableCount,
 } from '@/context/architecture'
 import { auditCitations, type CitationReport } from '@/context/citations'
@@ -122,8 +123,10 @@ export function register(program: Command): void {
         'states its own line allowances gates when it is past the ceiling',
         'those derive, on any run except --citations-only, which never',
         'measures it. A record stating an entry cap gates the same way when',
-        'it holds more decisions than the cap. A record stating neither is',
-        'reported and never gated. --gate widens the gate to the other two',
+        'it holds more decisions than the cap, and a record stating that',
+        'every decision closes with a revisit sentence gates when one lacks',
+        'it. A record stating none of the three is reported and never',
+        'gated. --gate widens the gate to the other two',
         'findings that are facts rather than judgments: a missing required',
         'section and index drift. A context entry requires Overview and',
         'Layout, and a wireframe requires Regions, States, Copy, and Not on',
@@ -739,6 +742,8 @@ async function runAudit(
     unresolvedCitations: citations.unresolved.length,
     recordOverLength: record !== undefined && isOverLength(record),
     recordOverCount: record !== undefined && isOverCount(record),
+    recordMissingRevisit:
+      record !== undefined && missingRevisit(record).length > 0,
     sections,
     drift,
     wireframes,
@@ -1194,6 +1199,24 @@ function reportRecord(
     )
   }
 
+  const revisited = report.decisions.filter((entry) => entry.revisit).length
+  const lackingRevisit = missingRevisit(report)
+  if (!report.revisitRequired) {
+    logInfo(
+      `${revisited} of ${plural(decisions, 'decision')} close with a revisit sentence, and the record states no revisit clause, so this is reported and never gated.`,
+    )
+  } else if (lackingRevisit.length > 0) {
+    for (const heading of lackingRevisit) {
+      logError(
+        `"${heading}" carries no sentence opening "Revisit when", which the record requires of every decision.`,
+      )
+    }
+  } else {
+    logInfo(
+      `Every one of ${plural(decisions, 'decision')} closes with the revisit sentence the record requires.`,
+    )
+  }
+
   if (decisions === 0) {
     logWarn('The record declares no decision, so nothing was classified.')
     return

package/src/commands/serve.ts

@@ -1,7 +1,6 @@
 import type { Command } from 'commander'
-import { relative } from 'node:path'
-import { DEFAULT_PORT, type ServeOutcome, startServer } from '@/serve/static'
-import { intro, logError, logInfo, logStep, logWarn, outro } from '@/ui'
+import { parsePort, report, waitForInterrupt } from '@/serve/report'
+import { DEFAULT_PORT, startServer } from '@/serve/static'
 
 const DEFAULT_DIR = '.'
 
@@ -78,92 +77,3 @@ async function runServe(
   await waitForInterrupt(outcome.stop)
   return 0
 }
-
-/**
- * The relative path where it stays inside the working directory, and the
- * absolute one where it climbs out. A run from a linked worktree serving the
- * main root reports `../../teach`, which names the directory without giving a
- * reader anything they can open.
- */
-function displayPath(root: string): string {
-  const near = relative(process.cwd(), root)
-  if (near === '') return '.'
-  return near.startsWith('..') ? root : near
-}
-
-/**
- * Undefined for a value that is not a port, distinct from an absent flag,
- * which takes the default. A `Number` of a typo is `NaN`, and passing that on
- * asks the runtime to bind a port nobody named.
- */
-function parsePort(raw: string | undefined): number | undefined {
-  if (raw === undefined) return DEFAULT_PORT
-  const value = Number(raw)
-  if (!Number.isInteger(value) || value < 0 || value > 65535) return undefined
-  return value
-}
-
-function report(outcome: ServeOutcome, emitJson: boolean): number {
-  if (!outcome.ok) {
-    if (emitJson) {
-      process.stdout.write(
-        `${JSON.stringify({ ok: false, reason: outcome.reason, detail: outcome.detail })}\n`,
-      )
-      return 1
-    }
-    intro('canon serve')
-    logError(outcome.detail)
-    outro()
-    return 1
-  }
-
-  if (emitJson) {
-    process.stdout.write(
-      `${JSON.stringify({
-        ok: true,
-        root: outcome.root,
-        host: outcome.host,
-        port: outcome.port,
-        entry: outcome.entry,
-        url: outcome.url,
-        entryExists: outcome.entryExists,
-      })}\n`,
-    )
-    return 0
-  }
-
-  intro('canon serve')
-  logStep('Serving')
-  logInfo(displayPath(outcome.root))
-  logStep('Open')
-  logInfo(outcome.url)
-
-  if (!outcome.entryExists) {
-    logStep('No entry page')
-    logWarn(
-      `${outcome.entry} is not in that directory, so the link opens a 404`,
-    )
-  }
-
-  logStep('Stop')
-  logInfo('Ctrl-C')
-  return 0
-}
-
-/**
- * Resolves when the process is asked to stop. The frame is closed here rather
- * than in the reporter, because the run is the serving rather than the start,
- * and closing at start would print the frame's end while the server ran on.
- */
-function waitForInterrupt(stop: () => Promise<void>): Promise<void> {
-  return new Promise((settle) => {
-    const finish = () => {
-      void stop().then(() => {
-        outro()
-        settle()
-      })
-    }
-    process.once('SIGINT', finish)
-    process.once('SIGTERM', finish)
-  })
-}