@erclx/canon 5.42.0 → 5.44.0

package/src/tasks/record.ts

@@ -16,6 +16,7 @@ import {
   readPullRequest,
   tasksDir,
 } from '@/tasks/archive'
+import { checkWaiting, type LinkPromotion, promoteOnLink } from '@/tasks/board'
 
 /**
  * Lines a task carries above its outcomes naming where the work came from. The
@@ -79,6 +80,8 @@ export interface PlanRecorded {
   readonly action: LineAction
   /** The target the line named before a correction. Undefined unless it differed. */
   readonly replaced: string | undefined
+  /** Whether the link moved the task's row out of `## Needs a plan`. */
+  readonly board: LinkPromotion
 }
 
 export type PlanOutcome = PlanRecorded | RecordRefused
@@ -472,7 +475,13 @@ export async function recordPlan(
   stem: string,
   reference: string,
   add = false,
+  waiting?: string,
 ): Promise<PlanOutcome> {
+  if (waiting !== undefined) {
+    const bad = checkWaiting(waiting)
+    if (bad) return refuse('bad-input', bad.message, bad.detail)
+  }
+
   const opened = await openTask(root, { kind: 'stem', stem })
   if ('ok' in opened) return opened
 
@@ -500,7 +509,17 @@ export async function recordPlan(
   const { text, action, replaced } = written
   if (action !== 'unchanged') await writeFile(path, text)
 
-  return { ok: true, stem: opened.stem, path, plan: target, action, replaced }
+  const board = await promoteOnLink(root, opened.stem, { waiting })
+
+  return {
+    ok: true,
+    stem: opened.stem,
+    path,
+    plan: target,
+    action,
+    replaced,
+    board,
+  }
 }
 
 /**

package/src/tasks/validate.ts

@@ -12,6 +12,12 @@ import {
   resolveLivePlan,
   tasksDir,
 } from '@/tasks/archive'
+import {
+  deriveCells,
+  GROUP_COLUMNS,
+  renderedLength,
+  WAITING_LIMIT,
+} from '@/tasks/board'
 import { gitTrunkReader, type TrunkReader } from '@/tasks/trunk'
 
 const ORDERING_FILE = 'priority.md'
@@ -50,6 +56,9 @@ export const FINDING_KINDS = [
   'row-misordered',
   'row-unranked',
   'touches-unstated',
+  'touches-stale',
+  'columns-mismatched',
+  'cell-long',
   'blocker-settled',
   'blocker-unresolved',
   'blocker-declined',
@@ -145,6 +154,8 @@ export interface BoardRow {
   readonly plan: string | undefined
   /** Absent when the group fixes no `Touches` column, empty when it read none. */
   readonly touches: readonly string[] | undefined
+  /** The `Touches` cell as written, which the stale check compares against the derivation. */
+  readonly touchesText: string | undefined
   /** Absent when the group fixes no `Waiting on` column, which is `## Run now`. */
   readonly waiting: string | undefined
   /** The ordinal phrase a `Waiting on` cell states about its own position, undefined when the cell carries none. */
@@ -271,8 +282,8 @@ function splitCells(line: string): string[] {
   return line
     .trim()
     .replace(/^\|/, '')
-    .replace(/\|$/, '')
-    .split('|')
+    .replace(/(?<!\\)\|$/, '')
+    .split(/(?<!\\)\|/)
     .map((cell) => cell.trim())
 }
 
@@ -288,6 +299,21 @@ function isGroup(heading: string): heading is BoardGroup {
   return (BOARD_GROUPS as readonly string[]).includes(heading)
 }
 
+/**
+ * Whether a header is the set of columns its group owns. Order is left to the
+ * reader, which resolves every column by name, so only a missing or a foreign
+ * column is a finding.
+ */
+function ownsColumns(group: BoardGroup, header: readonly string[]): boolean {
+  const owned = GROUP_COLUMNS[group].map((column) => column.toLowerCase())
+  const named = header.map((cell) => cell.toLowerCase())
+
+  return (
+    named.length === owned.length &&
+    owned.every((column) => named.includes(column))
+  )
+}
+
 const ORDINAL_WORDS = [
   'first',
   'second',
@@ -460,6 +486,14 @@ export function readBoard(text: string): {
       }
 
       header = cells
+      if (!ownsColumns(group, cells)) {
+        findings.push({
+          kind: 'columns-mismatched',
+          group,
+          subject: line.trim(),
+          message: `is not the ${GROUP_COLUMNS[group].join(', ')} header ${group} owns.`,
+        })
+      }
       continue
     }
 
@@ -489,6 +523,7 @@ export function readBoard(text: string): {
       stem: target ? stemOf(target) : undefined,
       plan,
       touches: touchesAt >= 0 ? readPaths(cells[touchesAt] ?? '') : undefined,
+      touchesText: touchesAt >= 0 ? (cells[touchesAt] ?? '') : undefined,
       waiting,
       ordinal: waiting ? readOrdinal(waiting) : undefined,
       ranked: waiting ? readRank(waiting) : false,
@@ -1125,6 +1160,83 @@ function citedStem(cell: string): string | undefined {
   return target ? stemOf(target) : undefined
 }
 
+/** The task stems in each folder a bare label can resolve through, live first. */
+interface LabelFolders {
+  readonly live: readonly string[]
+  readonly archived: readonly string[]
+  readonly declined: readonly string[]
+}
+
+type LabelCitation =
+  | { readonly kind: 'stems'; readonly stems: readonly string[] }
+  | { readonly kind: 'ambiguous'; readonly label: string }
+
+/**
+ * Reads every bare `vNNN.N` phase label a `Waiting on` cell names outside a
+ * link, each resolved to the one task it labels. The live folder answers first,
+ * since a live task and a declined one can share a label and the live one is
+ * what the row waits on. Two matches in the folder that answers leave the row
+ * untested rather than guessing between them, and a label no folder holds is
+ * read as prose rather than as a broken pointer, since a version number in a
+ * sentence is not always a citation.
+ */
+function bareLabels(cell: string, folders: LabelFolders): LabelCitation {
+  const prose = cell.replace(/\[[^\]]*\]\([^)]*\)/g, ' ')
+  const stems: string[] = []
+
+  for (const match of prose.matchAll(/\bv\d+\.\d+\b/g)) {
+    const prefix = `${match[0]}-`
+    for (const folder of [folders.live, folders.archived, folders.declined]) {
+      const hits = folder.filter((stem) => stem.startsWith(prefix))
+      if (hits.length > 1) return { kind: 'ambiguous', label: match[0] }
+      if (hits.length === 1) {
+        if (!stems.includes(hits[0])) stems.push(hits[0])
+        break
+      }
+    }
+  }
+
+  return { kind: 'stems', stems }
+}
+
+/**
+ * Tests every task a cell cites by bare label, and reports the row only when
+ * none of them is still open. A cell naming settled history beside its live
+ * blocker would otherwise read as settled on the history alone.
+ */
+async function checkCitedTasks(
+  group: BoardGroup,
+  subject: string,
+  stems: readonly string[],
+  root: string,
+  trunk: TrunkReader,
+): Promise<CitedResult> {
+  const results = await Promise.all(
+    stems.map((stem) => checkCitedTask(group, subject, stem, root, trunk)),
+  )
+  const open = results.some(
+    (result) => result.findings.length === 0 && result.untested.length === 0,
+  )
+  if (open) return nothing()
+
+  return {
+    findings: results.flatMap((result) => result.findings),
+    untested: results.flatMap((result) => result.untested),
+  }
+}
+
+async function readLabelFolders(root: string): Promise<LabelFolders> {
+  const read = async (dir: string): Promise<string[]> =>
+    existsSync(dir) ? listTaskStems(dir) : []
+  const [live, archived, declined] = await Promise.all([
+    read(tasksDir(root)),
+    read(archiveDir(root)),
+    read(declinedDir(root)),
+  ])
+
+  return { live, archived, declined }
+}
+
 /** What one blocker citation produced, since a row can be neither settled nor open. */
 interface CitedResult {
   readonly findings: readonly Finding[]
@@ -1288,17 +1400,29 @@ async function checkParked(
   const findings: Finding[] = []
   const untested: Untested[] = []
   const running = rows.filter((row) => row.group === 'Run now')
+  const folders = await readLabelFolders(root)
 
   for (const row of rows) {
     if (row.group === 'Run now') continue
 
     const subject = row.stem ?? row.label
     const cell = row.waiting ?? ''
-    const cited = citedStem(cell)
+    const linked = citedStem(cell)
+    const bare = linked ? undefined : bareLabels(cell, folders)
+    const cited = linked ? [linked] : bare?.kind === 'stems' ? bare.stems : []
     const contested = readPaths(cell)
 
-    if (cited) {
-      const result = await checkCitedTask(
+    if (bare?.kind === 'ambiguous') {
+      untested.push({
+        group: row.group,
+        subject,
+        message: `waits on ${bare.label}, which labels more than one task, so the blocker is not read.`,
+      })
+      continue
+    }
+
+    if (cited.length > 0) {
+      const result = await checkCitedTasks(
         row.group,
         subject,
         cited,
@@ -1324,7 +1448,7 @@ async function checkParked(
       })
     }
 
-    if (!cited && contested.length === 0) {
+    if (cited.length === 0 && contested.length === 0) {
       untested.push({
         group: row.group,
         subject,
@@ -1337,6 +1461,79 @@ async function checkParked(
   return { findings, untested }
 }
 
+/**
+ * Reports a `Waiting on` cell rendering past the cap. A verb refuses to write
+ * one, so a cell this long is a hand edit, which is why it moves the exit code.
+ */
+function checkCellWidth(rows: readonly BoardRow[]): Finding[] {
+  return rows.flatMap((row) => {
+    const width = row.waiting ? renderedLength(row.waiting) : 0
+    if (width <= WAITING_LIMIT) return []
+
+    return [
+      {
+        kind: 'cell-long' as const,
+        group: row.group,
+        subject: subjectOf(row),
+        message: `carries a Waiting on cell rendering ${width} characters, past the ${WAITING_LIMIT} a board cell holds.`,
+      },
+    ]
+  })
+}
+
+/**
+ * Reports a `Touches` cell that differs from what the task's plans derive. A
+ * verb writes the derivation on every call, so a difference is a hand edit or a
+ * plan that changed since the last write. An empty derivation is left alone,
+ * since a row with no live plan or no declared file is `plan-absent`,
+ * `plan-unresolved`, or `touches-unstated` to report, not stale.
+ */
+async function checkStaleTouches(
+  rows: readonly BoardRow[],
+  root: string,
+): Promise<Finding[]> {
+  const found = await Promise.all(
+    rows.map(async (row): Promise<Finding | undefined> => {
+      if (row.touchesText === undefined || !row.stem) return undefined
+
+      const { touches } = await deriveCells(root, {
+        stem: row.stem,
+        label: row.label,
+      })
+      if (touches === '' || touches === row.touchesText) return undefined
+
+      return {
+        kind: 'touches-stale',
+        group: row.group,
+        subject: row.stem,
+        message: `states ${row.touchesText || 'no file'}, and its plan derives ${touches}. A board verb rewrites the cell.`,
+      }
+    }),
+  )
+
+  return found.filter((finding): finding is Finding => finding !== undefined)
+}
+
+/**
+ * The claims a group name makes about a row, being a stated plan and file set
+ * under `## Run now`, a live plan under `## Up next`, and none under
+ * `## Needs a plan`. The board verbs read these same findings off the board
+ * they are about to write, so a placement and a validation cannot disagree on
+ * what a group allows.
+ */
+export async function groupRuleFindings(
+  rows: readonly BoardRow[],
+  root: string,
+): Promise<Finding[]> {
+  const dir = tasksDir(root)
+
+  return [
+    ...checkPlans(rows, dir, root),
+    ...(await checkGroupClaims(rows, dir, root)),
+    ...checkTouches(rows),
+  ]
+}
+
 function refuse(reason: ValidateRefusal, message: string): ValidateRefused {
   return { ok: false, reason, message }
 }
@@ -1397,10 +1594,10 @@ export async function validateBoard(
   const findings = [
     ...shapeFindings,
     ...checkMapping(rows, backlog, dir),
-    ...checkPlans(rows, dir, root),
+    ...(await groupRuleFindings(rows, root)),
     ...(await checkPlanAgreement(rows, dir, root)),
-    ...(await checkGroupClaims(rows, dir, root)),
-    ...checkTouches(rows),
+    ...(await checkStaleTouches(rows, root)),
+    ...checkCellWidth(rows),
     ...checkOrdering(rows),
     ...parked.findings,
   ]

package/src/tooling/stamp.ts

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs'
 import { join } from 'node:path'
-import { writeChainStamp } from '@/sync/stamp'
-import { isWholeStack, type Manifest } from '@/tooling/manifest'
+import { readStamp, stampedChain, writeChainStamp } from '@/sync/stamp'
+import { isWholeStack, loadManifest, type Manifest } from '@/tooling/manifest'
 import { readPackage } from '@/tooling/package'
 
 /**
@@ -17,7 +17,9 @@ export function isWorkspaceRoot(target: string): boolean {
 }
 
 /**
- * Records the chain an install resolved, and returns whether it wrote one. A
+ * Records the chain an install resolved, and returns the names it wrote, or
+ * nothing when it wrote none. The names are the merged list, which can carry
+ * stacks an earlier sync recorded. A
  * workspace root is the single refusal: one chain recorded there would be a
  * guess at what its packages hold, and the report reading tooling as unmeasured
  * is the true answer rather than a clean one.
@@ -27,16 +29,58 @@ export async function recordToolingChain(
   target: string,
   chain: readonly Manifest[],
   now: Date,
-): Promise<boolean> {
-  if (isWorkspaceRoot(target)) return false
-
-  await writeChainStamp(
-    target,
-    { domain: 'tooling', toolkitRoot },
-    recordedStacks(chain),
-    now,
+): Promise<string[] | undefined> {
+  if (isWorkspaceRoot(target)) return undefined
+
+  const merged = mergeAddOns(
+    toolkitRoot,
+    stampedChain(readStamp(target), 'tooling'),
+    chain,
   )
-  return true
+  await writeChainStamp(target, { domain: 'tooling', toolkitRoot }, merged, now)
+  return merged
+}
+
+/**
+ * An add-on stands alone beside a core chain, so syncing one must not displace
+ * the chain it layers onto. Base extends nothing and still heads a core chain.
+ */
+export function isAddOn(manifest: Manifest | undefined): boolean {
+  return (
+    manifest !== undefined &&
+    manifest.parent === undefined &&
+    manifest.name !== 'base'
+  )
+}
+
+/**
+ * Merges what this sync resolved into what an earlier one recorded. The core
+ * chain is the one just synced, or the recorded one when only add-ons synced.
+ * Add-ons accumulate after it, so a later stackless report measures them all.
+ */
+function mergeAddOns(
+  toolkitRoot: string,
+  recorded: readonly string[],
+  chain: readonly Manifest[],
+): string[] {
+  const synced = chain.filter(isWholeStack)
+  const syncedCore = synced.filter((m) => !isAddOn(m)).map((m) => m.name)
+  const syncedAddOns = synced.filter(isAddOn).map((m) => m.name)
+
+  const recordedManifests = recorded.map((name) => ({
+    name,
+    manifest: loadManifest(toolkitRoot, name),
+  }))
+  const recordedCore = recordedManifests
+    .filter(({ manifest }) => !isAddOn(manifest))
+    .map(({ name }) => name)
+  const recordedAddOns = recordedManifests
+    .filter(({ manifest }) => isAddOn(manifest))
+    .map(({ name }) => name)
+
+  const core = syncedCore.length > 0 ? syncedCore : recordedCore
+  const addOns = [...new Set([...recordedAddOns, ...syncedAddOns])]
+  return [...core, ...addOns]
 }
 
 /**

package/src/worktrees/stop.ts

@@ -0,0 +1,92 @@
+import { realpath } from 'node:fs/promises'
+import { belongsTo } from '@/listeners/belongs'
+import type { ListenerReader } from '@/listeners/machine'
+
+/** What a stop took, or would take on a dry run, from one worktree. */
+export interface StoppedServer {
+  readonly path: string
+  readonly pids: readonly number[]
+  readonly ports: readonly number[]
+}
+
+/**
+ * `unread` is a machine with no way to list sockets, which a reader must tell
+ * apart from `read` with nothing stopped, since the first says nothing about
+ * what is still listening.
+ */
+export type StopReport =
+  | { readonly kind: 'read'; readonly stopped: readonly StoppedServer[] }
+  | { readonly kind: 'unread' }
+
+export interface StopOptions {
+  readonly reader: ListenerReader
+  /** Sends SIGTERM and says whether it landed, so a pid that already exited is not counted. */
+  readonly kill?: (pid: number) => boolean
+  readonly dryRun: boolean
+}
+
+function sigterm(pid: number): boolean {
+  try {
+    process.kill(pid, 'SIGTERM')
+    return true
+  } catch {
+    return false
+  }
+}
+
+/** A process cwd reads back resolved, so a path held through a symlink has to be too. */
+async function resolved(path: string): Promise<string> {
+  return realpath(path).catch(() => path)
+}
+
+/**
+ * Stops every server listening from inside one of the worktrees about to be
+ * removed, so none outlives the directory it serves. Each path is tested by the
+ * nesting rule `canon pr local` uses, so a listener in the main checkout or in
+ * a sibling under `.claude/worktrees/` is never signaled. The cwd is read
+ * against the given paths and never against `process.cwd()`, which a run from
+ * inside another worktree would otherwise make the only match.
+ */
+export async function stopListeners(
+  paths: readonly string[],
+  opts: StopOptions,
+): Promise<StopReport> {
+  const listeners = await opts.reader.listListeners()
+  if (listeners === undefined) return { kind: 'unread' }
+
+  const kill = opts.kill ?? sigterm
+  const roots = await Promise.all(paths.map(resolved))
+  const cwdByPid = new Map<number, string | undefined>()
+  const stopped: StoppedServer[] = []
+
+  for (const [index, root] of roots.entries()) {
+    const pids = new Set<number>()
+    const ports = new Set<number>()
+    for (const { pid, port } of listeners) {
+      if (!cwdByPid.has(pid)) cwdByPid.set(pid, await opts.reader.cwdOf(pid))
+      const cwd = cwdByPid.get(pid)
+      if (cwd === undefined || !belongsTo(cwd, root)) continue
+      pids.add(pid)
+      ports.add(port)
+    }
+
+    const landed = [...pids]
+      .sort((a, b) => a - b)
+      .filter((pid) => opts.dryRun || kill(pid))
+    if (landed.length === 0) continue
+    const landedSet = new Set(landed)
+    stopped.push({
+      path: paths[index] ?? root,
+      pids: landed,
+      ports: [
+        ...new Set(
+          listeners
+            .filter(({ pid, port }) => landedSet.has(pid) && ports.has(port))
+            .map(({ port }) => port),
+        ),
+      ].sort((a, b) => a - b),
+    })
+  }
+
+  return { kind: 'read', stopped }
+}

package/tooling/astro/configs/card-src/pages/og-card.astro

@@ -7,7 +7,7 @@
  * an edit to one string here and a re-capture, not another pass through the
  * pick loop with an operator in it.
  *
- * `canon:draft-identity` writes the picked composition into the `.card`
+ * `canon:design-identity` writes the picked composition into the `.card`
  * element below and leaves everything around it alone. What ships is a working
  * placeholder, so the route serves before any pick has been taken.
  *

package/tooling/astro/reference.md

@@ -91,9 +91,9 @@ In `canon/context/development/ci.md`, the Typecheck row asserts `` `astro check`
 
 ## Social card route
 
-The social card is a route the project keeps rather than a page a render writes and deletes. Re-rendering it after a rename is an edit to one string and a re-capture, not another pass through the `draft-identity` pick loop.
+The social card is a route the project keeps rather than a page a render writes and deletes. Re-rendering it after a rename is an edit to one string and a re-capture, not another pass through the `design-identity` pick loop.
 
-`canon:draft-identity` writes the picked composition into the route and captures it through the server below.
+`canon:design-identity` writes the picked composition into the route and captures it through the server below.
 
 ### What ships
 

package/tooling/base/configs/.github/workflows/phase-label-gate.yml

@@ -11,14 +11,18 @@ on:
     types: [submitted, edited]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   phase-label-gate:
     name: 🏷️ Phase Label Gate
     runs-on: ubuntu-latest
-    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.base.ref == 'main'
+    # Dependabot bodies carry upstream release notes that read as phase labels
+    if: github.event.pull_request.user.login != 'dependabot[bot]' && (github.event_name == 'workflow_dispatch' || github.event.pull_request.base.ref == 'main')
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2

package/tooling/base/configs/commitlint.config.js

@@ -22,38 +22,18 @@ const subjectFirstWordCase = (parsed) => {
   ]
 }
 
-const CO_AUTHOR_TRAILER = /^co-authored-by:/i
-const CLAUDE_OR_ANTHROPIC = /\b(claude|anthropic)\b/i
-
-// Reads raw rather than footer, since the parser files a lone trailer under
-// body and leaves footer null.
-const noClaudeCoAuthor = (parsed) => {
-  const offending = (parsed.raw ?? '')
-    .split('\n')
-    .find(
-      (line) => CO_AUTHOR_TRAILER.test(line) && CLAUDE_OR_ANTHROPIC.test(line),
-    )
-
-  return [
-    offending === undefined,
-    `remove the co-author trailer crediting Claude or Anthropic: ${offending}`,
-  ]
-}
-
 const config = {
   extends: ['@commitlint/config-conventional'],
   plugins: [
     {
       rules: {
         'subject-first-word-case': subjectFirstWordCase,
-        'no-claude-co-author': noClaudeCoAuthor,
       },
     },
   ],
   rules: {
     'subject-case': [0],
     'subject-first-word-case': [2, 'always'],
-    'no-claude-co-author': [2, 'always'],
     'header-max-length': [2, 'always', 72],
     'scope-case': [2, 'always', 'lower-case'],
     'subject-full-stop': [2, 'never', '.'],

package/tooling/base/reference.md

@@ -17,7 +17,7 @@ Two configs fix how output looks and how commits read.
 - `.oxfmtrc.json` sets `semi: false`, `singleQuote: true`, `printWidth: 80`, and `sortPackageJson: false`, keeping the output Prettier wrote.
 - The `astro` stack repeats those options in its own copy, so copy a change here into it.
 - `commitlint.config.js` is an ESM default export extending `@commitlint/config-conventional`. It sets `header-max-length: 72`, `scope-case: lower-case`, and `subject-full-stop: never`.
-- Its `subject-case` rule is off, and a local `no-claude-co-author` rule refuses a `Co-authored-by` trailer that names Claude or Anthropic.
+- Its `subject-case` rule is off.
 - `.husky/` holds `pre-commit`, `commit-msg`, `pre-push`, `post-merge`, and `post-rewrite`.
 
 ### Verify runner

package/tooling/base/seeds/.github/workflows/verify.yml

@@ -6,13 +6,16 @@ on:
       - main
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   static-checks:
     name: 🛡️ Static Checks
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2

package/tooling/claude/reference.md

@@ -57,11 +57,11 @@ The `# Claude` group holds three entries, being `.canon/`, `.claude/worktrees/`,
 
 ## CLI
 
-| Command              | What it does                                                                                                                    |
-| -------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
-| `canon claude init`  | Seeds `.claude/` workflow docs, updates `.gitignore`                                                                            |
-| `canon claude sync`  | Reconciles `.gitignore` against the manifest. Reports seeded file status.                                                       |
-| `canon claude setup` | Installs user-level config to `~/.claude/` once per machine: statusline, attribution, and the permissions allow and deny lists. |
+| Command              | What it does                                                                                                                                                                     |
+| -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `canon claude init`  | Seeds `.claude/` workflow docs, updates `.gitignore`                                                                                                                             |
+| `canon claude sync`  | Reconciles `.gitignore` against the manifest. Reports seeded file status.                                                                                                        |
+| `canon claude setup` | Installs user-level config to `~/.claude/` once per machine: statusline and the permissions allow and deny lists, and removes the empty attribution pair an earlier setup wrote. |
 
 ## CLAUDE.md
 
@@ -85,11 +85,17 @@ The seed at `tooling/claude/seeds/.claude/settings.json` ships hooks that pair w
 - A PostToolUse hook pairs with `standards-audit.sh`.
 - Project settings layer over user settings, so a project file carries only what is project-specific.
 
+### Session defaults
+
+The seed also sets two defaults every session in the target runs under.
+
+- `permissions.deny` holds `Agent` and `Task`, so no session spawns a subagent. Parallel work runs as separate background sessions instead.
+- `autoMemoryEnabled` is `false`. A person turns it back on for themselves in `settings.local.json`.
+- `canon migrate session-defaults` adds both to a target seeded before them, since sync never rewrites an existing settings file.
+
 ### User template
 
 The template at `tooling/claude/user/settings.template.json` is installed once per machine by `canon claude setup`.
 
-- It sets `attribution.commit` and `attribution.pr` to empty strings to suppress co-author tags.
 - It allows `Bash(bun run *)` under `permissions.allow`.
 - Its `permissions.deny` holds `Read(**/.env)` and `Read(**/.env.*)`, blocking accidental secret exposure across any project.
-- The deprecated `includeCoAuthoredBy` key is not used.