@erclx/canon 5.41.0 → 5.43.0

package/claude/skills/video-craft/references/adopted.md

@@ -11,25 +11,45 @@ Each number in the body traces to a source here, read through the `search-craft`
 
 Field: subtitling and captioning. Authorities: broadcasters' and streamers' published subtitle guidelines, and the captioning program that sets educational practice.
 
-**On screen for 5/6 of a second to 7 seconds, two lines, 42 characters a line.** Netflix's [Timed Text Style Guide: General Requirements](https://partnerhelp.netflixstudios.com/hc/en-us/articles/215758617-Timed-Text-Style-Guide-General-Requirements) states a minimum of 5/6 of a second (20 frames at 24 fps) and a maximum of 7 seconds per event, and its [English (USA) guide](https://partnerhelp.netflixstudios.com/hc/en-us/articles/217350977-English-USA-Timed-Text-Style-Guide) states 42 characters a line and two lines at most.
+| Rule                                       | Source                                                                                                                                                                                                     |
+| ------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| On screen for 5/6 of a second to 7 seconds | Netflix's [Timed Text Style Guide: General Requirements](https://partnerhelp.netflixstudios.com/hc/en-us/articles/215758617-Timed-Text-Style-Guide-General-Requirements), a minimum of 20 frames at 24 fps |
+| Two lines, 42 characters a line            | Netflix's [English (USA) guide](https://partnerhelp.netflixstudios.com/hc/en-us/articles/217350977-English-USA-Timed-Text-Style-Guide)                                                                     |
+| 20 characters per second, 17 for children  | The same English (USA) guide, adult and children's programs respectively                                                                                                                                   |
+| Never over what the frame is about         | The DCMP [Captioning Tip Sheet](https://dcmp.org/learn/225-captioning-tip-sheet): "Placement must not interfere with existing visuals/graphics."                                                           |
 
-**20 characters per second, 17 for children.** The same English (USA) guide, adult and children's programs respectively.
+### Start on the first frame of the action
 
-**Start on the first frame of the action.** Netflix's [Subtitle Timing Guidelines](https://partnerhelp.netflixstudios.com/hc/en-us/articles/360051554394-Timed-Text-Style-Guide-Subtitle-Timing-Guidelines) put a subtitle's in-time on the first frame of its audio. A software video's caption names an action rather than a line of speech, so the body keys the in-time on the action's first frame.
+Netflix's [Subtitle Timing Guidelines](https://partnerhelp.netflixstudios.com/hc/en-us/articles/360051554394-Timed-Text-Style-Guide-Subtitle-Timing-Guidelines) put a subtitle's in-time on the first frame of its audio. A software video's caption names an action rather than a line of speech, so the body keys the in-time on the action's first frame.
 
-**Never over what the frame is about.** The DCMP [Captioning Tip Sheet](https://dcmp.org/learn/225-captioning-tip-sheet): "Placement must not interfere with existing visuals/graphics."
+### Captions name what the frame shows
 
-**Captions name what the frame shows.** No source states this for a software video. It is the operator's read of an unguided render whose caption narrated the whole flow, kept because the timing rules above already assume a caption tied to one moment.
+No source states this for a software video. It is the operator's read of an unguided render whose caption narrated the whole flow, kept because the timing rules above already assume a caption tied to one moment.
 
 ## Zoom
 
 Fields: interface motion design, and screen recording practice. Authorities: design systems that publish motion specs, and the reference documentation of a screen recording tool.
 
-**A push onto an action no faster than HyperFrames' floor, never past 1 second.** HyperFrames' `viewport-change` rule states a zoom of 1.0 to 2.0 seconds and gives its reason beside the value: "under 0.8s teleports, over 2.5s drags". The body keeps that floor by pointing at the rule rather than restating it. The 1 second ceiling has two grounds. Measured: an unguided render pushed in over 2.2 seconds and a second over 1.4 seconds, and the operator judged both slow, so the range's lower half already reads slow on a push onto a click. Published: Material Design 3's [easing and duration tokens](https://m3.material.io/styles/motion/easing-and-duration/tokens-specs) end their scale at 1000 ms, the top of the extra-long band they reserve for ambient transitions, so no input-driven transition in that system runs longer.
+### A push onto an action stays under 1 second
 
-**Zoom on a click.** Screen Studio's [auto zoom guide](https://screen.studio/guide/auto-zoom) keys its zoom on click positions and zooms nowhere a click did not occur.
+The floor is HyperFrames'. Its `viewport-change` rule states a zoom of 1.0 to 2.0 seconds with the reason beside it, "under 0.8s teleports, over 2.5s drags", and the body points at the rule rather than restating it.
 
-**Conflict, and the pick.** HyperFrames' range and the measured renders disagree on the push onto an action, and the body takes the overlap: HyperFrames' teleport floor below, and 1 second above, which sits inside HyperFrames' range at its fast end. HyperFrames' full range stays with an ambient reveal, which matches Material's own split between input-driven and ambient motion. A tighter band was considered and declined. Material puts large expressive transitions at 450 to 600 ms, and Nielsen Norman Group's [animation duration article](https://www.nngroup.com/articles/animation-duration/) calls 400 ms "very slow", but both write for an interface a user waits on, which a video viewer is not, and that band sits below HyperFrames' stated teleport floor with nothing measured to show it reads right. Narrow the band once a composed demo is compared against the unguided renders.
+- Measured: an unguided render pushed in over 2.2 seconds and a second over 1.4 seconds, and the operator judged both slow, so the range's lower half already reads slow on a push onto a click
+- Published: Material Design 3's [easing and duration tokens](https://m3.material.io/styles/motion/easing-and-duration/tokens-specs) end at 1000 ms, the top of a band reserved for ambient transitions, so no input-driven transition there runs longer
+
+### Zoom on a click
+
+Screen Studio's [auto zoom guide](https://screen.studio/guide/auto-zoom) keys its zoom on click positions and zooms nowhere a click did not occur.
+
+### Conflict, and the pick
+
+HyperFrames' range and the measured renders disagree on the push onto an action. The body takes the overlap, HyperFrames' teleport floor below and 1 second above, which sits inside HyperFrames' range at its fast end.
+
+- HyperFrames' full range stays with an ambient reveal, matching Material's own split between input-driven and ambient motion
+- A tighter band was declined. Material puts large expressive transitions at 450 to 600 ms, and Nielsen Norman Group's [animation duration article](https://www.nngroup.com/articles/animation-duration/) calls 400 ms "very slow".
+- Both write for an interface a user waits on, which a video viewer is not, and that band sits below HyperFrames' teleport floor with nothing measured to show it reads right
+
+Narrow the band once a composed demo is compared against the unguided renders.
 
 ## Pointer
 
@@ -39,28 +59,52 @@ The two pointer rules in the body carry no number. One pointer on a frame and a
 
 Fields: web accessibility, and audio post-production. Authorities: the W3C's accessibility guidelines, and the audio engineering society's streaming recommendation.
 
-**Music at least 20 dB under the voice.** WCAG 2.1 [Success Criterion 1.4.7](https://www.w3.org/WAI/WCAG21/Understanding/low-or-no-background-audio.html): "The background sounds are at least 20 decibels lower than the foreground speech content, with the exception of occasional sounds that last for only one or two seconds."
+### Music at least 20 dB under the voice
+
+WCAG 2.1 [Success Criterion 1.4.7](https://www.w3.org/WAI/WCAG21/Understanding/low-or-no-background-audio.html) is the source, reading "The background sounds are at least 20 decibels lower than the foreground speech content, with the exception of occasional sounds that last for only one or two seconds."
+
+HyperFrames' `media-use` sets its narrated bed at a volume of 0.12, about 18 dB under a voice at full scale. The body takes WCAG's 20 dB, since it is the published floor and the bed default sits 2 dB short of it.
+
+### Overall loudness is delegated
 
-**Conflict, and the pick.** HyperFrames' `media-use` sets its narrated bed at a volume of 0.12, about 18 dB under a voice at full scale. The body takes WCAG's 20 dB, since it is the published floor and the bed default sits 2 dB short of it.
+The AES [TD1008](https://aes.org/wp-content/uploads/2024/01/20210924_TD1008_v3.13.pdf) streaming recommendation normalizes speech to -18 LUFS with a true peak no higher than -1 dBTP. `media-use` ships -14 and -16 LUFS targets for social and podcast delivery.
 
-**Overall loudness is delegated.** The AES [TD1008](https://aes.org/wp-content/uploads/2024/01/20210924_TD1008_v3.13.pdf) streaming recommendation normalizes speech to -18 LUFS with a true peak no higher than -1 dBTP, while `media-use` ships -14 and -16 LUFS targets for social and podcast delivery. The body states no overall target, since the right one depends on where the video is published and `media-use` owns that operation.
+The body states no overall target, since the right one depends on where the video is published and `media-use` owns that operation.
 
 ## Voiceover
 
 Field: captioning, for the reading ceiling a voiceover's captions inherit. Authority: the captioning program's presentation rate guidance.
 
-**At or under 160 words a minute when captioned.** The DCMP [Captioning Key: Presentation Rate](https://dcmp.org/learn/601-captioning-key---presentation-rate) caps upper-level captions at 160 words a minute. `hyperframes-creative`'s narration reference states 2.5 words a second, 150 a minute, which sits under the ceiling, so the two do not conflict. An open search of voiceover practitioners put explainers at 140 to 160 words a minute, which agrees.
+### At or under 160 words a minute when captioned
 
-Narration has no standards body for pace, and the scoped search found none, so the body sets only the ceiling captions impose and points at HyperFrames for the pace itself.
+The DCMP [Captioning Key: Presentation Rate](https://dcmp.org/learn/601-captioning-key---presentation-rate) caps upper-level captions at 160 words a minute.
+
+- `hyperframes-creative`'s narration reference states 2.5 words a second, 150 a minute, under the ceiling, so the two do not conflict
+- An open search of voiceover practitioners put explainers at 140 to 160 words a minute, which agrees
+- Narration has no standards body for pace, and the scoped search found none, so the body sets only the ceiling and points at HyperFrames for pace
 
 ## Declined
 
-**Restating HyperFrames' motion rules.** Ease variety, anchoring, click timing, the scale and dwell of a zoom, and title-safe margins are stated in HyperFrames' own skills, which update on their own cadence. A copy here goes stale on theirs.
+Each item below stays out of the body for the reason given.
+
+### Restating HyperFrames' motion rules
+
+Ease variety, anchoring, click timing, the scale and dwell of a zoom, and title-safe margins are stated in HyperFrames' own skills, which update on their own cadence. A copy here goes stale on theirs.
+
+### A loudness target in the body
+
+See Audio above.
+
+### Pointer smoothing and hiding at rest
+
+Screen Studio's [cursor guide](https://screen.studio/guide/cursor) smooths the pointer and hides it when idle, and its [guide to disabling smooth movement](https://screen.studio/guide/disable-smooth-mouse-movement) turns smoothing off for a dropdown menu.
+
+Both are recorder settings. A take is composed with its pointer baked into the frames, so a session composing from it cannot change either, and they belong to whatever records the take.
 
-**A loudness target in the body.** See Audio above.
+### Zoom out before a cut, and a sound effect only on a meaningful click
 
-**Pointer smoothing and hiding at rest.** Screen Studio's [cursor guide](https://screen.studio/guide/cursor) smooths the pointer and hides it when idle, and its [guide to disabling smooth movement](https://screen.studio/guide/disable-smooth-mouse-movement) turns smoothing off for a dropdown menu. Declined because both are recorder settings. A take is composed with its pointer already baked into the frames, so a session composing from it cannot change either. They belong to whatever records the take.
+Neither has a source, and no operator read stands behind either, so both stay out until one does.
 
-**Zoom out before a cut, and a sound effect only on a click that changes something.** Neither has a source, and no operator read stands behind either, so both stay out until one does.
+### Vertical 9:16 framing
 
-**Vertical 9:16 framing.** Every video measured when this skill was written was landscape. Add it when a project asks for vertical video, with its safe areas sourced from the platform's own creator documentation.
+Every video measured when this skill was written was landscape. Add it when a project asks for vertical video, with its safe areas sourced from the platform's own creator documentation.

package/claude/skills/write-human/references/adopted.md

@@ -11,23 +11,34 @@ Neither was imported wholesale, and one measurement settles why. Read this befor
 
 ## What was adopted
 
-Roughly half the pattern catalog had no counterpart in this corpus, and six of those patterns are now in `machine-tells.md`: rule-of-three, synonym cycling, false ranges, inline-header lists, adverb propping, and passive voice with an unnamed actor. Each is a shape rather than a token, which is what kept it out of a ban list that matches words.
+Roughly half the pattern catalog had no counterpart in this corpus. Six of those patterns are now in `machine-tells.md`, each a shape rather than a token, which kept it out of a ban list that matches words.
+
+- Rule-of-three, synonym cycling, and false ranges
+- Inline-header lists, adverb propping, and passive voice with an unnamed actor
+
+### The density layer
 
 The density layer had no counterpart at all and is now `density.md`. Its useful half is the split between what a compression pass may cut and what it may not, since a terse register already instructs a session to cut and names nothing that has to survive.
 
-The ambiguity rules travel with that layer for the same reason. Compression is what creates the ambiguity, so a rule about pronouns and modifiers belongs beside the rule that shortened the sentence.
+The ambiguity rules travel with that layer. Compression creates the ambiguity, so a rule about pronouns and modifiers belongs beside the rule that shortened the sentence.
 
 ## What was declined
 
-- **The ban on abstract metaphor nouns.** The nouns it names are load-bearing terms in this corpus rather than decoration, and the count below is what decides it.
-- **Document mode as a selector.** The source has the writer pick a mode before drafting. In this corpus a document's shape is already fixed by the standard governing its type, so a mode selector adds a second authority over one question and the two will disagree.
-- **A voice register per surface.** One baseline covers every surface. A surface needing a warmer register states its own voice and claims the yield, which lifts voice alone and leaves the bans, the rhythm rules, and the tells in force.
+- **The ban on abstract metaphor nouns.** The nouns it names are load-bearing terms in this corpus rather than decoration, and the count below decides it.
+- **Document mode as a selector.** In this corpus the standard governing a document's type already fixes its shape, so a mode picked before drafting adds a second authority over one question.
+- **A voice register per surface.** One baseline covers every surface. A surface needing a warmer register states its own voice and claims the yield, which lifts voice alone.
+
+### The count behind the first
 
-The first of those three rests on a count. The source names `surface` among the nouns it bans, and tracked markdown in the authoring repository used `surface` 593 times, `harness` 95, `scaffolding` 17, and `primitive` 4. Adopting the item either rewrites established vocabulary across the corpus or is ignored in silence, and a reader arriving later cannot tell which happened.
+The source names `surface` among the nouns it bans. Tracked markdown in the authoring repository used `surface` 593 times, `harness` 95, `scaffolding` 17, and `primitive` 4.
+
+Adopting the item either rewrites established vocabulary across the corpus or is ignored in silence, and a reader arriving later cannot tell which happened.
 
 ## What moved in from the markdown standard
 
-The marketing words and vague qualifiers under `## Voice` were a gated word set in the markdown standard until the audit narrowed to characters. A word ban catches the token and misses the habit behind it, so a writer swaps `robust` for a synonym and the claim stays unproven. The list now lives here as guidance a reader applies, and this body is its one copy, since no command reads it and a second copy would drift with nothing comparing the two.
+The marketing words and vague qualifiers under `## Voice` were a gated word set in the markdown standard until the audit narrowed to characters. A word ban catches the token and misses the habit, so a writer swaps `robust` for a synonym and the claim stays unproven.
+
+The list now lives here as guidance a reader applies. This body is its one copy, since no command reads it and a second copy would drift with nothing comparing the two.
 
 ## Where this diverges
 
@@ -37,4 +48,6 @@ The source material also prefers shorter sentences without bound. This skill mea
 
 ## The industry-guide record
 
-The cadence rules and the bans they pair with trace to three industry style guides, being Google's developer documentation style guide, Microsoft's writing style guide, and Apple's style guide. The authoring toolkit keeps the per-rule attributions and the dates each guide was read, and no install carries that record, so this file is the position a target reads.
+The cadence rules and the bans they pair with trace to three industry style guides, being Google's developer documentation style guide, Microsoft's writing style guide, and Apple's style guide.
+
+The authoring toolkit keeps the per-rule attributions and the dates each guide was read. No install carries that record, so this file is the position a target reads.

package/docs/agents/audits.md

@@ -83,6 +83,7 @@ The placement entry runs pinned to `--backend off`, so its tally stays comparabl
 | `secrets`            | `canon secrets scan`                | Credential-shaped values in the shipped tree                                       | Gates          |
 | `labels`             | `canon labels audit`                | Changed paths no row of the label map reaches                                      | Reports        |
 | `restated`           | `canon gov restated`                | Instructions `CLAUDE.md` states that a second surface states too                   | Reports        |
+| `rules`              | `canon gov audit`                   | Rules past a shape limit, and here outside-practice rules short of a source ledger | Reports        |
 | `counts`             | `canon gov counts`                  | Sentences stating a closed catalog's size that disagree with the tree              | Reports        |
 | `census`             | `canon census`                      | File count, extension breakdown, and line total                                    | Reports        |
 | `deps`               | `canon deps audit`                  | Advisories against the resolved dependencies                                       | Reports        |

package/docs/agents/migrate.md

@@ -18,11 +18,13 @@ kind: reference
 | `rule-layout`      | A flat installed-rule layout onto the `canon/`-wrapped one                                                                                  |
 | `scratch-evidence` | A folder a durable record cites out of `.tmp/`, with its citations                                                                          |
 | `record-layout`    | Review receipts, memory archives, feedback, renders, picks, and evidence into their current folders                                         |
+| `session-defaults` | The seeded session defaults into an existing `.claude/settings.json`: `Agent` and `Task` denied, auto memory off                            |
 
 - `skill-names` takes no `--scope` and skips the changelog and eval transcripts
 - `surface-roots` leaves `rules/`, `skills/`, `hooks/`, and `settings.json` where Claude Code reads them
 - `rule-layout` classifies each flat file against the stamp as clean, edited, or unclaimed. Clean and edited files move untouched, and an unclaimed name stays.
 - `record-layout` labels each evidence folder `(pick)` or `(evidence)` in the dry run
+- `session-defaults` adds a key only when absent. It never removes a deny entry or changes a set `autoMemoryEnabled`, and a missing settings file is nothing to do.
 
 ## Output
 
@@ -43,14 +45,15 @@ Three markers keep an old spelling on a line. Each also covers the nearest non-b
 
 ## Refusals
 
-| Verb               | Refuses when                                                                        |
-| ------------------ | ----------------------------------------------------------------------------------- |
-| `records`          | The project does not ignore `.canon/`. Run `canon tooling sync --write` first.      |
-| `records`          | A record folder already exists at the destination                                   |
-| `surface-roots`    | Any destination already exists under `canon/`, refusing the whole plan              |
-| `scratch-evidence` | A destination is occupied                                                           |
-| `record-layout`    | A destination already exists, each move refused on its own                          |
-| `rule-layout`      | A destination holds different bytes. Neither file is touched and other moves apply. |
+| Verb               | Refuses when                                                                          |
+| ------------------ | ------------------------------------------------------------------------------------- |
+| `records`          | The project does not ignore `.canon/`. Run `canon tooling sync --write` first.        |
+| `records`          | A record folder already exists at the destination                                     |
+| `surface-roots`    | Any destination already exists under `canon/`, refusing the whole plan                |
+| `scratch-evidence` | A destination is occupied                                                             |
+| `record-layout`    | A destination already exists, each move refused on its own                            |
+| `rule-layout`      | A destination holds different bytes. Neither file is touched and other moves apply.   |
+| `session-defaults` | The settings file is not valid JSON, or `permissions` or its `deny` has another shape |
 
 A `rule-layout` destination holding the same bytes marks a duplicate, which `--write` deletes.
 

package/docs/target/migrations.md

@@ -136,3 +136,14 @@ The wireframes record is retired, and nothing deletes what a project holds.
 ## Move decisions out of a held architecture record, once
 
 The toolkit no longer seeds `canon/ARCHITECTURE.md`, and a held file and its `CLAUDE.md` import stay. Move a trap a session would hit into that domain's `## Gotchas`, then delete the file and its `@canon/ARCHITECTURE.md` line.
+
+## Deny subagents and turn auto memory off, once
+
+The seeded `.claude/settings.json` now denies the `Agent` and `Task` tools and sets `autoMemoryEnabled` to `false`. `canon claude sync` never rewrites a settings file you hold, so it warns while the file holds neither default. Removing the deny later to allow subagents draws no warning.
+
+```bash
+canon migrate session-defaults --json
+canon migrate session-defaults --write --json
+```
+
+The verb only adds a key that is absent. A person who wants auto memory back sets it in their own `.claude/settings.local.json`.

package/docs/workflow/parallel-features.md

@@ -11,7 +11,7 @@ Run independent features in parallel, one git worktree and one Claude Code sessi
 ## One worktree per feature
 
 - Invoke `canon:plan-feature` in each session. Plans land at `.canon/plans/feature-<slug>.md` at the main root.
-- `ui-checklist` writes a per-branch handoff at `tmp/handoff/ui-checklist/<slug>.md`, which `git-pr` posts and removes. The slug is the branch name minus its leading type segment.
+- `ui-checklist` writes a per-branch handoff at `tmp/handoff/ui-checklist/<slug>.md`, which `pr-evidence` posts and removes. The slug is the branch name minus its leading type segment.
 - Ship each worktree with `canon:git-ship`, or `canon:auto-ship` for a draft pull request
 - Only the operator or the controlling session readies a draft
 

package/docs/workflow/skill-map.md

@@ -78,6 +78,7 @@ Groups run in the order a project meets them. Every name `canon claude skills li
 | `canon:review-ui`      | Beside code review, to drive the checklist    |
 | `canon:review-address` | As the worker, to fix posted findings         |
 | `canon:git-followup`   | A small edit on a branch with an open PR      |
+| `canon:pr-evidence`    | A new head needs its screenshots re-posted    |
 | `canon:git-split`      | A branch carries unrelated commits            |
 | `canon:git-issue`      | Something belongs on the tracker              |
 | `canon:git-worktree`   | After a merge, to reclaim worktrees           |

package/governance/detect.toml

@@ -200,3 +200,7 @@ files = ["index.html", "*/index.html"]
 ["canvas"]
 deps = []
 files = [".canon/canvas"]
+
+["design-reference"]
+deps = []
+files = ["canon/design"]

package/governance/rules/canon/context.md

@@ -8,6 +8,7 @@ paths:
 
 ## Context entries
 
-- Load the `canon:context-fold` skill before a hand edit under `canon/context/`. It carries the entry shape and the content rules for a domain entry. Report it rather than proceeding silently when the skill does not resolve.
+- Load the `canon:context-fold` skill before a hand edit under `canon/context/`, since it carries the entry shape and the content rules for a domain entry.
+- Report it rather than proceeding silently when `canon:context-fold` does not resolve.
 - Before non-trivial work in a domain, read its `canon/context/<domain>/` entry. Use `canon/context/index.md` to find it.
 - Leave the entry conforming when work in its domain changes what it describes.

package/governance/rules/canon/plan.md

@@ -1,5 +1,5 @@
 ---
-description: Route edits under .canon/plans/ to the plan-feature skill for the plan's sections, the answer contract, and its lifecycle
+description: Route edits under .canon/plans/ to the plan-feature skill, and keep the five hand-edit floors a plan breaks silently
 paths:
   - '.canon/plans/**'
 ---
@@ -8,11 +8,9 @@ paths:
 
 ## Plan files
 
-- Load the `canon:plan-feature` skill before a hand edit under `.canon/plans/`. It carries the filename and slug, the required sections, and the suggested-and-answer contract for a feature plan. Report it rather than proceeding silently when the skill does not resolve.
+- Load the `canon:plan-feature` skill before a hand edit under `.canon/plans/`, whose references own its shape and lifecycle. Report it rather than proceeding silently when it does not resolve.
 - Never fill an `- Answer:` slot on behalf of the person who owns it. A blank slot accepts the suggestion at execution time.
-- Never ship a question without a `- Suggested:` line. Write `- Suggested: needs your call, <why>` where the answer turns on preference.
-- Rewrite the `- Suggested:` line as `overridden at execution to <pick>,` plus the measurement when execution deviates from an unanswered question, leaving the slot blank. Put the same deviation in one line under the open task's `## Findings`.
+- Rewrite an unanswered question's `- Suggested:` line as `overridden at execution to <pick>,` plus the measurement when execution deviates, leaving the slot blank.
 - Fetch the source a decision rests on and quote the passage under `**Sources:**`, or mark the entry `unverified`. Never cite an outside source from recall.
 - Move a shipped plan to `.canon/plans/archive/`. Never delete one.
 - Amend a plan in place when a decision changes. Do not append a second passage narrating the change.
-- Follow the lifecycle the `canon:plan-feature` skill carries for when a plan is written, how it is amended, and its move to the archive.

package/governance/rules/canon/scratch.md

@@ -6,4 +6,6 @@ description: Write temporary files to the scratch folder structure
 
 ## Temporary files
 
-- Write temporary files to `.canon/tmp/<slug>/<file>.md` at the current worktree's root, a nested folder with a kebab-slug tied to the topic rather than a flat `<slug>-<file>.md`. The slug must not take one of the five reserved names `runs`, `hooks`, `handoff`, `pr`, and `render`. A skill that resolves a write at the main root instead states so in its own body.
+- Write temporary files to `.canon/tmp/<slug>/<file>.md` at the current worktree's root, with a kebab-slug tied to the topic rather than a flat `<slug>-<file>.md`.
+- Never take one of the reserved slugs `runs`, `hooks`, `handoff`, `pr`, and `render`.
+- Write scratch at the main root instead only when a skill's own body says so.

package/governance/rules/canon/task-scope.md

@@ -8,4 +8,5 @@ description: Scope, size, and link a task file correctly
 
 - Only create a task for work that spans multiple sessions or has real dependencies. Handle small edits immediately without a task entry.
 - Do not add tasks retroactively for work already completed. Completed work is visible in git.
-- When a task needs execution detail beyond its own file, write a plan in `.canon/plans/` in the same session as the task and link to it from the task's intro paragraph. The session that executes the plan later inherits reasoning context it would otherwise have to re-derive.
+- Write a plan in `.canon/plans/` when a task needs execution detail beyond its own file, and link it from the task's intro paragraph.
+- Write that plan in the same session as the task, since the executing session would otherwise re-derive the reasoning behind it.

package/governance/rules/canon/tasks.md

@@ -8,7 +8,8 @@ paths:
 
 ## Task files
 
-- Load the `canon:task-board` skill before a hand edit under `.canon/tasks/`. It carries the folder layout, filename convention, file format, origin lines, and archiving for a task file. Report it rather than proceeding silently when the skill does not resolve.
+- Load the `canon:task-board` skill before a hand edit under `.canon/tasks/`, since it carries the layout, filenames, format, origin lines, and archiving of a task file.
+- Report it rather than proceeding silently when `canon:task-board` does not resolve.
 - Follow the board shape the `canon:task-board` skill carries for `priority.md` and `backlog.md`, their readiness groups, and row order.
 - Never hand-edit `.canon/tasks/index.md`. A hook regenerates it from sibling frontmatter.
 - Follow the decline shape the `canon:task-board` skill carries for a task decided against.

package/governance/rules/canon/worktrees.md

@@ -10,5 +10,8 @@ description: Enter a linked worktree for implementation, resolve shared session
 
 ## Shared session scratch
 
-- Shared session scratch (`.canon/plans/`, `.canon/review/`, `.canon/tasks/`) lives at the main worktree root, not inside a linked worktree. From a linked worktree, resolve these paths against the main root via `git worktree list --porcelain | grep -m 1 '^worktree ' | cut -d' ' -f2-`. Fall back to `pwd` if not a git repo.
-- From a linked worktree, or from a background session that entered none, `Edit` and `Write` refuse a main-root path and redirect to a worktree copy no later session reads. Never take that redirect. Route the write the way the `session-worktree` skill states, and report it rather than proceeding silently when that skill does not resolve. It ships with the plugin and this rule ships with the CLI, so a project that installed governance alone does not have it.
+- Resolve shared session scratch (`.canon/plans/`, `.canon/review/`, `.canon/tasks/`) at the main worktree root, never inside a linked worktree.
+- Read the main root from `git worktree list --porcelain | grep -m 1 '^worktree ' | cut -d' ' -f2-`, and fall back to `pwd` outside a git repo.
+- Never take the worktree copy `Edit` and `Write` redirect a main-root path to, since no later session reads it. Revisit when Edit and Write stop redirecting a main-root path from a linked worktree.
+- Route a main-root write from a linked worktree, or from a background session that entered none, the way the `session-worktree` skill states.
+- Report it rather than proceeding silently when `session-worktree` does not resolve, as in a project that installed governance without the plugin.

package/governance/rules/claude/output.md

@@ -7,10 +7,13 @@ description: Report file paths correctly for the reading surface and group them
 ## Reporting paths
 
 - After creating or modifying a file, include its path on its own line so the reader can open it. Do not paraphrase paths into prose ("the seeds folder", "your CLAUDE.md").
-- Emit a path in the form the surface's own instructions give, such as a markdown link where the harness asks for one, and bare where it gives none. A terminal makes a bare path clickable through its own path detection, and link markup defeats that.
-- That form governs a path emitted in a response. A path written into a markdown file follows the markdown standard instead, which your toolkit resolves by name, and which backticks a file reference and never repeats it as a link label.
-- In a linked worktree (under `.claude/worktrees/<name>/`), emit the absolute path, since the editor is rooted at the main project root and a path relative to the worktree resolves nowhere there. Prefer the form a `PostToolUse` hook hands back after a write where one is installed.
+- Emit a path in the form the surface's own instructions give, such as a markdown link where the harness asks for one, and bare where it gives none.
+- Never add link markup where the surface gives no form, since a terminal makes a bare path clickable through its own path detection and the markup defeats it.
+- Backtick a path written into a markdown file and never repeat it as a link label, per the markdown standard. The response form above governs a response alone.
+- Emit the absolute path from a linked worktree (under `.claude/worktrees/<name>/`), since the editor is rooted at the main root, where a worktree-relative path resolves nowhere.
+- Prefer the form a `PostToolUse` hook hands back after a write where one is installed.
 
 ## Grouping multiple files
 
-- When the response covers multiple files, group paths under headers: `**Created:**`, `**Modified:**`, `**Deleted:**`. Every path under them takes that form, not the first alone. For single-file changes, the path on its own line is enough.
+- Group paths under `**Created:**`, `**Modified:**`, and `**Deleted:**` headers when the response covers multiple files, with every path under them in that form.
+- Put a single-file change's path on its own line, with no header.

package/governance/rules/claude/skill.md

@@ -11,7 +11,9 @@ paths:
 
 ## Skill files
 
-- Load the `canon:create-skill` skill before a hand edit to a `SKILL.md` or a `REQUIREMENT.md`. It carries the skill structure, the requirement shape, and the path rules for a skill body. Report it rather than proceeding silently when the skill does not resolve. It ships with the plugin and this rule ships with the CLI, so a project that installed governance alone does not have it.
-- Confirm `canon:create-skill`'s two creation-time questions are answered before a new `SKILL.md` lands, whether drafted by hand, by another skill, or by `canon:create-skill` itself. Carry the third question into the sibling `REQUIREMENT.md`'s `Must not` section as a review criterion rather than a gate.
-- Re-read a skill body this session edited before invoking that skill again in the same session.
-- Do not read a resolved file path in a held body as evidence the body is current.
+- Load the `canon:create-skill` skill before a hand edit to a `SKILL.md` or a `REQUIREMENT.md`, since it carries the skill structure, the requirement shape, and the path rules.
+- Report it rather than proceeding silently when `canon:create-skill` does not resolve, as in a project that installed governance without the plugin.
+- Confirm `canon:create-skill`'s two creation-time questions are answered before a new `SKILL.md` lands, whoever drafted it, `canon:create-skill` included.
+- Carry its third question into the sibling `REQUIREMENT.md`'s `Must not` section as a review criterion rather than a gate.
+- Re-read a skill body this session edited before invoking that skill again in the same session. Revisit when Claude Code reloads a skill body edited after the session first invoked it.
+- Do not read a resolved file path in a held body as evidence the body is current. Revisit when Claude Code marks a held skill body stale once its source changes.

package/governance/rules/tooling/ci-workflow.md

@@ -1,55 +1,22 @@
 ---
-description: Enforce GitHub Actions job naming, granularity, dependency wiring, and bun pinning
+description: Keep GitHub Actions commit-back steps and token scopes safe, and route workflow authoring to the ci-workflow skill
 paths:
   - '.github/workflows/**'
 ---
 
 # CI workflow standards
 
-## Triggers and pinning
-
-- Include `workflow_dispatch` alongside the primary trigger on every workflow.
-- Pin every action to a major version tag. Never `@latest` or `@main`.
-- Run every job on `ubuntu-latest`.
-
-## Job naming
-
-- Name every job as an emoji followed by a title, such as `🛡️ Checks`, `🧪 Unit Tests`, `📦 Build Check`, `🎭 E2E Tests`, or `🚀 Deploy`.
-
-## Job granularity
-
-- Fold static analysis, unit tests, and build into one job while the gate runs under two minutes end to end.
-- Split them into parallel jobs once a run log puts the gate past two minutes.
-- Give E2E, release, and deploy a job each from the start.
-
-## Job dependencies
-
-- Use `needs` for a data dependency, where a job consumes another job's artifact, or for a job whose cost is prohibitive against the gate in front of it. Leave every other job unwired so it runs in parallel.
-- Gate E2E on the job that uploads the build artifact.
-- Gate release and deploy on E2E.
-- Emit a deploy, publish, or release job with a placeholder step and name what the caller fills in. Never guess a deploy command.
-
-## Artifacts
-
-- Upload an artifact on `if: failure()` alone, with `retention-days: 7`.
-
-## Bun stack
+## Authority
 
-- Use `oven-sh/setup-bun@v2` with `bun-version: latest`.
-- Install with `bun install --frozen-lockfile`.
-- Key the Playwright browser cache on the Playwright version string, never a static key.
+- Load the `canon:ci-workflow` skill for triggers, pinning, job shape, artifacts, and the Bun stack. Report it rather than proceeding silently when the skill does not resolve.
 
 ## Commit-back
 
-- Commit a refreshed file back to the pull request branch only when the branch's own change moved it. Report the diff without committing when something outside the branch can move it, such as a count read at build time or a font that renders differently per machine, since that commit lands on a branch that never asked for it.
+- Commit a refreshed file back to the pull request branch only when that branch's change moved it. Report the diff when an outside input can move it, such as a build-time count or a font.
 - Commit only what a deterministic step regenerates from source, and run the diff check before the commit step so an unchanged capture pushes nothing.
 - Skip a pull request from a fork with `github.event.pull_request.head.repo.full_name == github.repository`, since the default token cannot push to a fork's branch.
-- Set the concurrency group on the ref so a newer push cancels the run committing onto a stale head.
-- Set `HUSKY: 0` on the commit step when the runner lacks a tool a hook shells out to.
 - Never commit back to the trunk. A commit with no pull request and no reviewer needs an operator's decision, not a workflow's.
-- Leave `workflow_dispatch` off a commit-back workflow. A manual run has no branch to commit onto, so the trigger would pass and do nothing.
-- Fail a template's first step while a path list still holds its placeholder, so an unfinished install fails loudly rather than never firing.
 
-## Authority
+## Token scopes
 
-- Load the `canon:ci-workflow` skill for the workflow template and the per-project adaptation. Report it rather than proceeding silently when the skill does not resolve.
+- In a workflow with more than one job, add a write scope to the job that needs it, never to the workflow-level block, so every other job keeps the read-only token.

package/governance/rules/ui/design-reference.md

@@ -0,0 +1,37 @@
+---
+description: Build UI against the tracked design references under canon/design, and show each reference beside its build in the pull request
+paths:
+  - 'canon/design/**'
+  - '**/*.tsx'
+  - '**/*.jsx'
+  - '**/*.vue'
+  - '**/*.svelte'
+  - '**/*.astro'
+  - '**/*.html'
+  - '**/*.css'
+  - '**/*.scss'
+---
+
+# Design reference standards
+
+## Where the design lives
+
+- Build UI against `canon/design/`, never against the canvas directly.
+- Land a picked or changed canvas design in `canon/design/` through the project's design sync, as its own pull request, before any feature builds against it.
+- Never copy, edit, or delete a reference file under `canon/design/` by hand.
+- Add a new surface's row to the index in `canon/design/` before running the sync, and remove it only in the change that removes the surface.
+
+## Building against a reference
+
+- Open each reference image and its frame HTML, light and dark, before changing the surface they show.
+- Match the reference closely or identically, taking sizes, spacing, and colors from the frame HTML.
+
+## Showing the comparison
+
+- Put each changed surface's reference image beside its built capture, light and dark, in the pull request description.
+- Name each place the build departs from its reference, with its reason, in the pull request description.
+- Report an unexplained departure from a reference as a review finding.
+
+## Naming
+
+- Give each app part one plain kebab-case folder under `canon/design/`, and name each file `<name>-dark` or `<name>-light`.

package/governance/rules/writing/markdown.md

@@ -9,7 +9,8 @@ paths:
 ## Format
 
 - Never write an em dash or a semicolon. `canon markdown audit` reads the full ban list from the package.
-- Load the `canon:markdown-craft` skill before a substantial markdown edit for headings, paragraph and list structure, code spans, the date form, punctuation, emphasis, file references, American spelling, and frontmatter wording. Report it rather than proceeding silently when the skill does not resolve.
+- Load the `canon:markdown-craft` skill before a substantial markdown edit, for headings, structure, code spans, dates, punctuation, emphasis, file references, spelling, and frontmatter.
+- Report it rather than proceeding silently when `canon:markdown-craft` does not resolve.
 - Run `canon markdown audit <path>` after the edit, and rewrite the sentence carrying a hit rather than swapping the token for a near-synonym.
 
 ## Voice

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@erclx/canon",
   "type": "module",
-  "version": "5.41.0",
+  "version": "5.43.0",
   "description": "Runs your agent's work and keeps its code good, on one setup for every repo.",
   "license": "MIT",
   "bin": {
@@ -55,7 +55,7 @@
     "execa": "^9.5.2",
     "highlight.js": "^11.12.0",
     "jszip": "^3.10.1",
-    "playwright-core": "1.59.1",
+    "playwright-core": "1.64.1",
     "pptxgenjs": "^4.0.1",
     "preact": "^11.0.0"
   },
@@ -64,7 +64,7 @@
     "@astrojs/react": "^5.0.4",
     "@commitlint/cli": "^20.4.1",
     "@commitlint/config-conventional": "^20.4.1",
-    "@playwright/test": "1.59.1",
+    "@playwright/test": "1.64.1",
     "@tailwindcss/vite": "^4.2.4",
     "@testing-library/jest-dom": "^6.9.1",
     "@types/bun": "^1.2.10",
@@ -73,11 +73,11 @@
     "happy-dom": "^20.14.5",
     "husky": "^9.1.7",
     "micromatch": "^4.0.8",
-    "oxfmt": "0.72.0",
-    "oxlint": "1.87.0",
+    "oxfmt": "0.73.0",
+    "oxlint": "1.88.0",
     "prettier": "^3.8.1",
     "prettier-plugin-astro": "^0.14.1",
-    "prettier-plugin-tailwindcss": "^0.7.2",
+    "prettier-plugin-tailwindcss": "^0.8.1",
     "typescript": "^5.9.3",
     "vitest": "^4.1.5"
   }