@erclx/canon 5.47.0 → 5.49.0

package/claude/skills/review-ui/SKILL.md

@@ -22,8 +22,8 @@ The checklist is its only statement of intent, so it tests the feature the way a
 
 A pass stops rather than repeat a verdict that already covers the head.
 
-- The newest UI verdict is `## UI review closed` at the current head: stop, `The UI review already covers <short-sha>.`
-- An open verdict at the head stops the same way, unless a `## Review response` or `## Post-review findings` comment is newer than it or the launch names an address
+- The newest UI verdict is `## UI review closed` at the current head and drove a box: stop, `The UI review already covers <short-sha>.`
+- An open verdict at the head stops the same way, unless a `## Review response` or `## Post-review findings` comment is newer, the launch names an address, or it drove no box, as `post.md` defines
 - The hosted preview was not built from the head: stop and post nothing, naming `built`, `tip`, and `canon pr preview <number> --json` for the dispatcher
 - Post, then run `canon pr lift <number>` on a close. Never merge or ready the PR by hand, and edit the evidence comment only through `canon pr tick`.
 - A push after a close owes a re-drive only when it changed a painted path, since the lift carries the close across the rest.
@@ -36,15 +36,7 @@ Record `<pass>` once, as the instant this pass starts, with `date -u +%Y%m%dT%H%
 
 ### When the verb is absent
 
-Every read here runs on REST, since `gh pr` runs on GraphQL and a cloud session's proxy refuses it. A target whose CLI predates the verb gets no record back, so read the pull request directly:
-
-```bash
-gh api "repos/{owner}/{repo}/pulls?head={owner}:$(git branch --show-current | jq -Rr @uri)&state=open" --jq '.[].number'
-gh api repos/{owner}/{repo}/pulls/<number> --jq .head.sha
-```
-
-- With no number named, take the open pull requests on the current branch, and stop when that prints anything but one number
-- A named number skips that lookup, since this checkout's branch need not be the pull request's
+A target whose CLI predates `canon pr head` gets no record back. Read `${CLAUDE_SKILL_DIR}/references/verb-absent.md` for the REST reads that stand in for it.
 
 ### Read the newest verdict and reply
 
@@ -96,9 +88,9 @@ When the hosted rung answers, read `${CLAUDE_SKILL_DIR}/references/hosted-previe
 
 ### Unverified and unanswered addresses
 
-The check covers the hosted address only. The local rung and a launch-named address have no deploy run to read, so say in the comment they were driven unverified.
+The check covers the hosted address only. The local rung and a launch-named address have no deploy run to read, so the post says they were driven unverified and names no loopback address, per `${CLAUDE_SKILL_DIR}/references/post.md`.
 
-An address that exists and does not answer differs from no address. When every rung fails to answer, skip the drive, record each box as not driven with the addresses tried and what each returned, and go to Step 7.
+An address that exists and does not answer differs from no address. When every rung fails to answer, skip the drive, record each box as not driven with the addresses tried and what each returned, and go to Step 7. No box was driven, so Step 7 posts it open.
 
 ## Step 4: open the browser
 
@@ -110,6 +102,7 @@ ${CLAUDE_SKILL_DIR}/scripts/pw.sh -s=<project>-<number> open <url>
 
 - Pass `--config=<path>` on `open` only when the launch names a CLI config path, which is how a machine's GPU recipe reaches the pass. Render in software otherwise.
 - Read the WebGL renderer once with an `eval` through the debug renderer extension and carry it into the comment, since a canvas page can paint differently in software
+- Before `open`, rebuild the drive copy and record the worktree's state per `${CLAUDE_SKILL_DIR}/references/drive-copy.md`
 
 ## Step 5: drive each box
 
@@ -147,7 +140,7 @@ A console error or an overflow is a finding. A probe result is a reading to conf
 
 ## Step 7: post
 
-Read `${CLAUDE_SKILL_DIR}/references/post.md` for the heading rule, the body shape, the marker every body ends on, and the post command. Each box lands in the section its verdict names, and the `link` its Step 5 push returned goes as given into that box's own entry.
+Run the worktree check in `${CLAUDE_SKILL_DIR}/references/drive-copy.md` first. Read `${CLAUDE_SKILL_DIR}/references/post.md` for the heading rule, the body shape, the marker every body ends on, and the post command. Each box lands in the section its verdict names, and the `link` its Step 5 push returned goes as given into that box's own entry.
 
 That file sends a pass closing under a prior `## UI review closed` at an older head on to `${CLAUDE_SKILL_DIR}/references/close-out.md`, which rewrites the standing close in place.
 

package/claude/skills/review-ui/references/close-out.md

@@ -20,7 +20,7 @@ gh api --paginate 'repos/{owner}/{repo}/pulls/<number>/reviews?per_page=100' --j
 
 ## Write the replacement
 
-Write the full body for this pass to the file `post.md` names, with the heading, the count line, and the Passed table regenerated from what this pass drove. Patching only the marker would leave a count line and an address naming the old head.
+Write the full body for this pass to the file `post.md` names, with the heading, the count line, and the Passed table regenerated from what this pass drove. Patching only the marker would leave a count line and an address naming the old head. A loopback address reads as a local preview here too, as on a first post.
 
 Add one line under the count line, reading the prior head off the standing verdict's marker and the commit count off the compare:
 

package/claude/skills/review-ui/references/drive-copy.md

@@ -0,0 +1,38 @@
+---
+title: Drive a throwaway copy
+description: Steps 4 and 7 of review-ui, which rebuild the copy a preview saves into before the browser opens and check the worker's worktree for a tracked change before the post
+---
+
+# Drive a throwaway copy
+
+Steps 4 and 7 of `review-ui`. A preview that saves what the pass drives would otherwise write the worker's tracked files, and a drag would land in a committed fixture.
+
+A project names the folders its preview writes in `canon/config/preview.json`. The worker starts its server reading a copy of them, and the pass rebuilds that copy at every head so the last pass's drags never reach this one.
+
+## Before the browser opens
+
+Rebuild the copy and record the worktree's state:
+
+```bash
+canon pr drive-copy <number> --baseline --json
+```
+
+Branch on `reason` rather than on the exit code.
+
+- `copied` means the address serves a throwaway copy rebuilt from the worker's worktree. Keep `copied` for the comment.
+- `no-config` means the project declares no preview writes, so drive as usual. The check below still runs.
+- `no-worktree` means no local worktree holds the branch, as for a cloud worker's. Drive, and say in the comment that the worktree check did not run.
+- Any other refusal stops the pass with nothing posted, naming the `reason` and `message` for the dispatcher, since a broken `canon/config/preview.json` would send the drives into the real folders
+
+## Before the post
+
+At the start of Step 7, with the browser closed since Step 6, read whether the drives changed anything git tracks in the worker's worktree:
+
+```bash
+canon pr drive-copy <number> --check --json
+```
+
+- `clean` continues with the post
+- `changed` stops the pass. Step 7 posts it open with every path in `paths` named, and Step 8 ticks nothing, since the boxes ran against a tree the drives rewrote.
+- Leave each changed path as it stands. The worktree is the worker's, so the pass reports a change and never reverts it.
+- A refusal, `no-worktree` and `no-baseline` among them, means the check did not run. Say so in the comment rather than reading it as clean.

package/claude/skills/review-ui/references/post.md

@@ -11,15 +11,25 @@ Step 7 of `review-ui`.
 
 The heading reports whether the branch owes anything, the way the code review's does.
 
-- `## UI review` when a box failed, the sweep found a console error or an overflow, or a box was not driven for a cause on the page, such as a target the snapshot does not hold.
+- `## UI review` when a box failed, the sweep found a console error or an overflow, the worktree check read `changed`, a box was not driven for a cause on the page, or the pass drove no box at all.
 - `## UI review closed` otherwise.
 
-A needs-eyes box leaves the review closed, and so does a box not driven for a cause off the page, such as an address that did not answer or a `(local only)` box on a hosted preview.
+A needs-eyes box leaves the review closed, and so does a box not driven for a cause off the page, such as an address that did not answer or a `(local only)` box on a hosted preview, as long as something else was driven.
 
 - Each is owed to the person who merges, and no commit can settle it, so opening the heading would hold the draft mark at every head
 - Name each such box in the count line's not-driven count and in its Not driven entry
 - Do not append the pull request number, which GitHub already renders
 
+### A pass that drove no box
+
+A pass with 0 failed, 0 need your eyes, 0 passed, and any box not driven looked at nothing, so it has not covered the head. It takes `## UI review` whatever the cause, including a checklist of only `(local only)` boxes on a hosted preview.
+
+- Put a line naming the cause directly under the count line, such as the addresses tried and what each returned, ahead of the address line, naming a loopback address as A loopback address says
+- The cure is a re-drive on an address that answers, which Step 1 of `review-ui` allows past this verdict
+- Message the controller with the cause and send the worker no `review-address`, since the verdict holds no box a fix worker could change
+- `canon pr lift` refuses a close of this shape as `ui-undriven`, so a violation holds the draft mark
+- A checklist with no box at all, which counts 0 not driven too, is an empty pass and takes the closed heading
+
 ## The body
 
 Write it to `.canon/tmp/pr/review-ui/body-<number>-<short-sha>.md` at the main worktree root, sent as a heredoc the way `session-worktree` states for a main-root write. Load the `write-human` skill for the prose and follow `${CLAUDE_SKILL_DIR}/../markdown-craft/references/markdown.md` for punctuation.
@@ -37,6 +47,10 @@ Driven at `<short-sha>` on <address>, rendered by <renderer>.
 
 ![box <n>](link)
 
+### Changed in the worktree
+
+- `<path>`
+
 ### Needs your eyes
 
 **<n>. <box> (taste)**
@@ -80,10 +94,19 @@ The post takes the length limits alone, with a box's reason under 350 characters
 
 The body opens on its count line, in that order, so the operator reads what they owe before anything else. The second line carries the address, the head, and the renderer, and says the address was driven unverified when it came from the local rung or the launch.
 
-- Drop each section holding no box, along with its heading. Order is fixed: Failed, Needs your eyes, Not driven, then the folded blocks.
+- Drop each section holding no box, along with its heading. The order is fixed as Failed, Changed in the worktree, Needs your eyes, Not driven, then the folded blocks.
 - A box takes exactly one section by its verdict, so a box that fails and also ends in `(taste)` appears once, under Failed
 - Quote page text in backticks as content, never as the pass's own words
 
+### A loopback address
+
+A loopback address has `localhost`, `127.0.0.1`, `0.0.0.0`, or `[::1]` as its host, with any port. It never appears in the post, so the second line reads ``Driven at `<short-sha>` on a local preview, unverified, rendered by <renderer>.`` instead.
+
+- The cause line of a pass that drove no box, and every Not driven entry, name a loopback address it tried as a local preview with its port, such as `a local preview on port 4211`
+- A hosted address posts as written, since it outlives the session, and the close drops it from the evidence comment
+- The evidence comment carries the local link while the pull request is open, for an operator on the same machine
+- `canon pr local --remove` masks a loopback address left on a review's `Driven at` line when the pull request closes
+
 ### A failed box
 
 A box in a section opens on its number and the box as written, in bold, with the reading beneath it in words. A failed box that rests on a read has no image.
@@ -92,6 +115,14 @@ A box in a section opens on its number and the box as written, in bold, with the
 - That link names the frame's path on the frames branch, which stays put while other pull requests' frames are dropped and carries this pass's stamp
 - A later pass therefore never changes the image
 
+### The drive copy and the worktree check
+
+The two `canon pr drive-copy` reads at the start of Steps 4 and 7 each leave a mark on the body, so the operator knows what the drives touched.
+
+- When Step 4 read `copied`, add `Drove a throwaway copy of <copied paths>.` as its own line directly under the address line, naming each path in backticks
+- When Step 7's check read `changed`, list every path from `paths` under Changed in the worktree, in backticks, with no reading beside it. The heading opens, and Step 8 ticks nothing.
+- When either read refused, add `Worktree check did not run, <reason>.` on a line of its own under the address line, so a skipped check never reads as a clean one
+
 ### A needs-eyes box
 
 A needs-eyes box shows its dark and light shots in a two-cell table ahead of anything else it carries, since the operator decides from them without opening the app. A box whose evidence holds one theme still renders both cells.
@@ -126,6 +157,8 @@ Driven at `<short-sha>` on <address>, rendered by <renderer>.
 </details>
 ```
 
+The count line is read by two verbs, `canon pr tick` for the passed count and `canon pr lift` for the driven test, so keep it exactly in the form `F failed · E need your eyes · P passed · N not driven`. A line that drifts reads as no counts, and both checks then stand down.
+
 The count line and the sections beneath it hold the same totals, and Step 10's printed line is the same four counts. A pass where every box needs eyes and nothing else is owed takes the closed heading.
 
 ## The marker

package/claude/skills/review-ui/references/tick.md

@@ -7,7 +7,7 @@ description: Step 8 of review-ui, which ticks each box that passed through canon
 
 Step 8 of `review-ui`. The verdict has posted, so the ticks and the verdict name the same `<head>`.
 
-Tick every box that took a `pass` verdict, whatever the heading, so a partly passed checklist shows its progress:
+Tick every box that took a `pass` verdict at this head, whatever the heading, so a partly passed checklist shows its progress. A re-drive ticks all of them again, including a box whose verdict did not change, since a new head clears the ticks stamped at an older one.
 
 ```bash
 canon pr tick <number> --boxes <n,...> --head <head> --json
@@ -17,9 +17,12 @@ Number the boxes off the `boxes` field Step 2 kept. Leave a box that failed, nee
 
 The verb refuses a taste box and a head that is no longer the remote tip, writing nothing in either case. Branch on the record's `reason`, which reads `ticked` on success.
 
+- `count-mismatch`: nothing was written. With `ticked` below `passed`, re-run once with every passed box. With it above, a box ticked earlier has failed, so report it on `Ticks:` for the operator.
 - `stale-head`: a push landed while this pass drove. Report it on the `Ticks:` line of Step 10 and never retry at the new tip, since the boxes were driven at the old one.
 - `body-refused`: the comment is ticked and the body is not. Retry the same call once, then report the partial result on the `Ticks:` line rather than claiming both.
 - Any other refusal: report the `reason` on the `Ticks:` line and tick nothing further.
 - A binary whose `canon pr` lacks `tick` predates the verb. Report that on the `Ticks:` line and tick nothing.
 
+The record's `countCheck` reads `matched` when the verdict's passed count agreed with the ticks, and `unchecked` when the verdict did not cover the head or carried no count line. Report an `unchecked` on the `Ticks:` line.
+
 The same call also writes the one UI pass line in the body's `## Testing`, such as `UI pass, 17 of 17 boxes passed at <sha>, 1 taste box left to the operator`, so the operator sees the result without opening the evidence comment. Never edit that line by hand.

package/claude/skills/review-ui/references/verb-absent.md

@@ -0,0 +1,18 @@
+---
+title: Resolve the pull request without the verb
+description: Step 1 of review-ui on a target whose CLI predates canon pr head, which reads the number and the head straight off the REST pulls endpoint
+---
+
+# Resolve the pull request without the verb
+
+Step 1 of `review-ui`, read when `canon pr head` returns no record.
+
+Every read here runs on REST, since `gh pr` runs on GraphQL and a cloud session's proxy refuses it. A target whose CLI predates the verb gets no record back, so read the pull request directly:
+
+```bash
+gh api "repos/{owner}/{repo}/pulls?head={owner}:$(git branch --show-current | jq -Rr @uri)&state=open" --jq '.[].number'
+gh api repos/{owner}/{repo}/pulls/<number> --jq .head.sha
+```
+
+- With no number named, take the open pull requests on the current branch, and stop when that prints anything but one number
+- A named number skips that lookup, since this checkout's branch need not be the pull request's

package/claude/skills/role-orchestrator/SKILL.md

@@ -38,10 +38,11 @@ No surface carries cross-version sequencing, so report none, since reasoning spa
 
 ## Runbooks on request
 
-A compaction is a moment this skill cannot detect, so the human asks for each side of it and this skill reads the matching runbook.
+The human asks for each side of a compaction, and this skill reads the runbook.
 
 - On a request to write the handoff, follow `${CLAUDE_SKILL_DIR}/references/orchestrator-handoff.md`. It sends the generic half to `canon:session-map` and adds decisions taken under delegated authority.
 - That map follows `${CLAUDE_SKILL_DIR}/../session-map/references/session.md`. Write nothing to the handoff that the board, a task file, or a groundwork folder already carries.
+- Hand launch: `${CLAUDE_SKILL_DIR}/references/orchestrator-hand-launch.md`
 - A lesson about how to work goes to the owning task's Findings, as a bold-labeled line per `${CLAUDE_SKILL_DIR}/../task-board/references/tasks.md`
 - On a request to resume after a compaction, read `${CLAUDE_SKILL_DIR}/references/orchestrator-resume.md`, which reads that file back with the board and the groundwork behind the live work
 
@@ -108,7 +109,7 @@ The handback runbook holds how the message is addressed and worded, what to do w
 
 ### Constraints from the tracks in flight
 
-A plan written here targets a tree several branches are changing, so it names each in-flight track's file set as a constraint, read from that track's Touches column. State for each set which of the two acts it forbids, per Constraints in `${CLAUDE_SKILL_DIR}/../plan-feature/references/plan.md`.
+A plan written here targets a tree several branches are changing, so it names each in-flight track's file set as a constraint, read from the plan its row links. State for each set which of the two acts it forbids, per Constraints in `${CLAUDE_SKILL_DIR}/../plan-feature/references/plan.md`.
 
 - A bare path list leaves the worker guessing, and can end up forbidding the repair of a citation the change broke
 - A shared path forbids an act only where the conflict check in `orchestrator-dispatch.md` holds the pair. Otherwise it names what the second branch to merge rebases over.

package/claude/skills/role-orchestrator/references/orchestrator-dispatch.md

@@ -125,7 +125,7 @@ No practitioner source serializes on a shared file. Each builds in parallel and
 Read `canon sessions list --json` for the branches in flight as well as the board, since a hand-launched track carries no row, and read the plan of any branch no row names.
 
 - `canon tasks validate` and `canon tasks plan-reach` report the paths two rows share, a candidate list for the five holds and the paths a dispatch names
-- A shared folder means a Touches cell claimed it bare, so narrow that cell rather than reading the folder as a sweep
+- A shared folder means a plan declared it bare, so narrow that plan's list rather than reading the folder as a sweep
 - A declared set predicts rather than bounds, since `canon:context-fold`, `canon:docs-sync`, and the drift stages write past every plan
 - Such a crossing changes what the second branch rebases over, not whether a row holds, and `canon tasks plan-reach` at `canon:git-ship` step 5 names it
 

package/claude/skills/role-orchestrator/references/orchestrator-hand-launch.md

@@ -0,0 +1,60 @@
+---
+title: Orchestrator hand launch
+description: The one lean prompts file the orchestrator writes when the operator launches sessions by hand, with its path, overwrite rule, shape, and a filled example
+---
+
+Run this when the operator launches sessions by hand rather than through `claude --bg`. The rules every launch shares stay in `orchestrator-launch.md`.
+
+# Hand launch
+
+When the operator launches sessions by hand, write every prompt to one file, `.canon/tmp/dispatch/prompts.md`, and overwrite it at each wave. It lists every row with a session not yet launched. A row launched from an older copy and again from a newer one would build twice, and the branch check in `orchestrator-dispatch.md` catches that.
+
+The operator opens the file, reads one lead line, and pastes one fence per session. The shape is fixed:
+
+- An H1, `# Dispatch prompts`, then one lead line carrying the measured head, the merge order, and the folder to open each session in
+- An H2 per task as `## <label>: <title>`, an H3 per role as `### Worker` or `### Reviewer`, a `Model: <model>.` line, and a `text` fence
+- In the fence, the command at position zero, then `Controller: <sessionId>`, then only context the plan does not carry, one line each
+
+Keep the command at position zero per `### Position zero` in `orchestrator-launch.md`, and carry only what `### What the brief may carry` there allows. Leave out the answer-slot default and anything else the plan states.
+
+The `Controller:` line replaces the background template's message clauses, which `role-worker` and `session-relay` already own. `auto-ship` Step 0 loads `role-worker`, so the fence needs nothing more.
+
+- A reviewer launched by hand takes the `### Reviewer` H3 under its row's H2, with the sibling facts `orchestrator-reviewer-launch.md` lists
+- Its `<number>` exists once the worker opened its pull request, so a later wave carries `### Reviewer` alone under the row, and the launched worker's H3 is gone
+
+The first wave carries the worker. The wave after its pull request opens carries the reviewer alone.
+
+````markdown
+# Dispatch prompts
+
+Head `<head>`. Merge `<label-a>` first, then `<label-b>`. Open each session in the repository root.
+
+## <label-b>: <title>
+
+### Worker
+
+Model: opus.
+
+```text
+/canon:auto-ship .canon/plans/feature-<slug>.md
+Controller: <sessionId>
+<branch-a> edits the section of <file> this plan leaves alone. Rebase over it when told.
+```
+````
+
+````markdown
+# Dispatch prompts
+
+Head `<head>`. Merge `<label-a>` first, then `<label-b>`. Open each session in the repository root.
+
+## <label-b>: <title>
+
+### Reviewer
+
+Model: opus.
+
+```text
+Run /canon:role-reviewer, then /canon:review-pr <number>
+Controller: <sessionId>
+```
+````

package/claude/skills/role-orchestrator/references/orchestrator-launch.md

@@ -12,6 +12,7 @@ Run this once `orchestrator-dispatch.md` has cleared a row, or from its planning
 - [Dispatch to address a review](#dispatch-to-address-a-review)
 - [Dispatch to plan a row](#dispatch-to-plan-a-row)
 - [Dispatch a talk session](#dispatch-a-talk-session)
+- [Hand launch](#hand-launch)
 - [Dispatch a reviewer](#dispatch-a-reviewer)
 
 ## Dispatch
@@ -156,6 +157,10 @@ Read the session's `sessionId` off the launch output, carry it in this session's
 
 The map exists only once the handoff writes it, so this session's own launches, read with the prior map, are what the first wind-down reads talk sessions from.
 
+## Hand launch
+
+Read `${CLAUDE_SKILL_DIR}/references/orchestrator-hand-launch.md` when the operator launches sessions by hand. It states the single prompts file at `.canon/tmp/dispatch/prompts.md`, the lean shape of each fence, and a filled example, while the background templates above keep their full controller paragraph.
+
 ## Dispatch a reviewer
 
 Read `${CLAUDE_SKILL_DIR}/references/orchestrator-reviewer-launch.md` when `orchestrator-review-dispatch.md` sends a pull request to a dispatched reviewer, for the code, cloud, and UI reviewer shapes.

package/claude/skills/role-orchestrator/references/orchestrator-parked.md

@@ -32,7 +32,7 @@ The blocker cell states what the row waits on, and each kind is tested different
 
 ### A hold behind a track in flight
 
-The validator tests the file the cell cites against the Touches column of every `## Run now` row. A track that merged since the row was parked is no longer in flight, whatever the sets still share.
+The validator tests the file the cell cites against the files every `## Run now` row's plans declare. A track that merged since the row was parked is no longer in flight, whatever the sets still share.
 
 - Re-test the cell under the conflict check in `orchestrator-dispatch.md` too, since a row parked on a shared file alone holds on nothing and moves up
 - A cell naming the file in prose rather than backticks cites nothing, so rewrite the hold in the board's spelling and the next run picks it up

package/claude/skills/role-orchestrator/references/orchestrator-poll.md

@@ -54,7 +54,7 @@ Poll GitHub for pull request movement by running `bun <POLL_SCRIPT>`, then act o
 - CONFLICT or STALE: send the session holding that branch the rebase handback in the canon:role-orchestrator skill's handback runbook, resolving it the way the handback rule below does. The branch owner rebases, not this session. The poll prints one of the two for a pull request, never both, so it earns one message. The canon pr lift verb refuses on either standing itself, since the green run tested a main that no longer exists, so nothing here lifts the mark.
 - OVERLAP: report the pair and the files, and settle their merge order now under the Parallelism rule of the canon:role-orchestrator skill. Dispatch nobody. The second to merge reads STALE or CONFLICT once the first lands, and the handback goes out then.
 - UNMATCHED: report it and stop. A comment posted under a heading outside the known set reaches nobody automatically, so a person decides whether to answer it by hand or the set needs a ninth heading.
-- UI-OPEN: report it and stop when the live UI reviewer holds the pull request, since that reviewer sends the canon:review-address dispatch itself. Otherwise dispatch it under the fallback rule below, the same as an open code pass.
+- UI-OPEN: a zero-driven pass goes to the live UI reviewer to drive again, or a new one. Any other: report and stop if that reviewer holds it, since it dispatches canon:review-address, else use the fallback rule below.
 - UI-CLOSED: report it. When the pull request is still a draft and its code review is closed too, run `canon pr lift <number> --json` and report the reason it returns. Each reviewer runs the verb on its own close, so this run is the fallback for a lift neither reviewer's run made, and the verb reads every gate itself.
 - A pull request a cloud reviewer holds, on every run whatever the script printed for it: run `canon pr review-state <number> --json`. The script reports nothing when a code review posts on an unchanged head, so this read is the only one that sees a cloud pass land. An open pass newer than the last dispatch earns the dispatch rule below. A closed pass at the head on a pull request still a draft earns `canon pr lift <number> --json`, reporting the reason it returns, since a cloud reviewer can neither message nor lift.
 - UI-STALE: the UI verdict trails the head. Message the live UI reviewer to drive the new head, or launch one, and lift no mark on it.

package/claude/skills/role-orchestrator/references/orchestrator-refill.md

@@ -21,11 +21,12 @@ The third trigger reaches a window the first two cannot. A session with three wo
    - A finding that changes a rule goes to the standard or rule that states it
    - One that changes another task goes to that task's Findings, and one that overturns a groundwork lean to that folder marked answered
 3. Archive what closed.
-   - A task whose outcomes are all `[x]` and whose pull request merged is archived by the `post-merge` hook through `canon tasks archive`, plans included
+   - A task whose outcomes are all `[x]`, or all `[x]` beside `Operator check:` lines, and whose pull request merged is archived by the `post-merge` hook through `canon tasks archive`, plans included
    - Run `task-complete` to archive one the hook left in place
    - A task whose outcomes are standing policy never closes, so hand it to a worker to encode the policy where it is enforced, then cut the outcomes with the reason and archive once that branch merges
    - Encoding it from this session would write a tracked file, which `## Boundaries` in the skill body forbids
-   - A merged task whose only open outcomes need the operator or another repository never archives, since `canon tasks archive` refuses `open-outcomes`. Strike each one on the task file as `- ~~<outcome>~~ <reason>`, with the reason on the same line, then archive. The task files are gitignored scratch, so this session may edit them.
+   - An outcome marked `- [ ] Operator check: <outcome>` never blocks the archive. The hook prints no record, so read the archived file's `Operator check:` lines into the report's `Operator checks:` line and leave them unticked.
+   - A merged task whose only open outcomes another repository owes, or that an operator owns and nobody marked, never archives, since `canon tasks archive` refuses `open-outcomes`. Strike each one on the task file as `- ~~<outcome>~~ <reason>`, with the reason on the same line, then archive. The task files are gitignored scratch, so this session may edit them.
    - Strike only an outcome the operator or another repository owes. An open outcome this repository owes stays on the board, and the task stays with it.
    - Send a struck outcome that another repository owes to that repository's orchestrator through `session-relay`, which resolves the address, and let the receiver file it with `task-board` on its own board. `task-board` here would file it on this board. Name it in the report for the operator when no such session is live.
    - List every struck outcome in the report's `Struck:` line, so the work is carried by a named owner rather than lost to the strike
@@ -45,6 +46,7 @@ The third trigger reaches a window the first two cannot. A session with three wo
 Findings placed: <finding> → <destination>
 Archived: <task>
 Struck: <outcome>, owed by <operator or repository>, <reason>
+Operator checks: <outcome>, left unticked on <task>
 Promoted: <task>, touches <surfaces>, parallel with <task>, sharing <paths or none>
 Serialized: <task> behind <task>, held on <dependency, contract, relocation, sweep, or reason>
 Backlogged: <task>, because <what stopped being near-term>

package/claude/skills/role-orchestrator/references/orchestrator-reviewer-launch.md

@@ -9,7 +9,7 @@ Run this once `orchestrator-review-dispatch.md` has sent a pull request to a dis
 
 `review-pr` is a single pass rather than a role, so a launch naming it alone reaches no `role-reviewer` and owes no message. Reach the role first on this launch, the way the planning shape in `orchestrator-launch.md` reaches `role-planner`. `orchestrator-review-dispatch.md` decides whether a pull request takes this shape at all.
 
-No branch and no worktree are entered here. The reviewer reads the pull request at the head `review-pr` resolves and writes the comment and its body file alone.
+No branch and no worktree are entered here. The reviewer reads the pull request at the head `review-pr` resolves and writes the comment and its body file alone. A reviewer the operator launches by hand takes the `### Reviewer` H3 that `orchestrator-hand-launch.md` states.
 
 ```bash
 claude --bg --model <model> -n "reviewer-<project>-<number>" "Run /canon:role-reviewer, then /canon:review-pr <number>. Your controller is the session whose sessionId is <dispatcher-id>. Resolve its current name from that id through canon sessions list --json, which carries sessionId per row, at the moment you send, and never resolve an addressee by name prefix. When the pass posts under ## Review, message the worker holding the branch to run review-address, carrying your own sessionId, and send it to the controller instead when no worker resolves. When it posts ## Review closed, run canon pr lift <number> --json and message the controller with the heading, the count line, and the reason the verb returned, unless that reason names the UI review as still open or missing. Message the controller again if you stop on a question."

package/claude/skills/role-planner/SKILL.md

@@ -39,7 +39,7 @@ Each item below is something a record needed and a launch string did not carry.
 - The task file, and its `## Findings` before deciding anything, since a row can carry its own disproof under a title still stating the original claim
 - The source files themselves, opened rather than summarized. Never a count quoted from the task file, which goes wrong or stale.
 - `CLAUDE.md` and the context entries the row touches, for the decision and the alternative it was taken against rather than for the decision alone
-- `.canon/tasks/priority.md` for the row's Touches column and its blocker. Read it for the shared-path lines and holds of the constraint block, never as a gate a plan must clear.
+- `.canon/tasks/priority.md` for the row's blocker and the plan each running row links. Read those plans for the constraint block's shared paths and holds, never as a gate a plan must clear.
 
 ### Reads for a feature plan alone
 

package/claude/skills/role-reviewer/SKILL.md

@@ -56,7 +56,7 @@ Nobody watches this pass, so the messages below are owed and nothing else. The w
 
 ### The address-review dispatch
 
-Send it to the worker holding the branch as `review-pr` Step 5 returns an open `## Review`, or as `review-ui` reports an open `## UI review`.
+Send it to the worker holding the branch as `review-pr` Step 5 returns an open `## Review`, or as `review-ui` reports an open `## UI review` that drove a box. A `## UI review` that drove no box goes to the controller with its cause instead, per `${CLAUDE_SKILL_DIR}/../review-ui/references/post.md`.
 
 - Carry the pull request number, the heading, that step's count line verbatim, and this session's own sessionId for the worker's reply
 - Resolve the worker with `canon sessions list --branch <branch> --json`, where `<branch>` is the pull request's head branch

package/claude/skills/role-worker/SKILL.md

@@ -50,6 +50,8 @@ A painted pull request needs a server in this worktree for `canon pr local` to f
 - Wait up to 60 seconds for the verb to read `ok`, then ship either way. A stack with no `dev` script gets no start, and `pr-evidence` reports `no-server`.
 - Never detach it with `nohup`, `setsid`, or `disown`, since the owning session is the stop. `canon worktrees reclaim` ends any listener left in a worktree it removes.
 
+Run `canon pr drive-copy --json` before starting `dev`. On `copied`, start it with `env` set to `copyRoot`, so the operator's address serves the copy. On `no-config`, start it as it is. On a refusal, start nothing and send the controller the `reason`, since a broken config would send drives into tracked folders.
+
 A hand-run `git-ship` or `git-pr` starts no server, since only a worker has a lifetime to own one.
 
 ### Building against a design reference
@@ -86,7 +88,7 @@ The controlling session cannot watch this one build, so the messages below are o
 
 ### The pull request announcement
 
-Announce the pull request as the ship chain's pull request step returns, carrying the number, the branch, and the task it closes. That transition is the one moment only this session knows, and the controller's review poll no longer starts on a dispatch.
+Announce the pull request as the ship chain's pull request step returns, carrying the number, the branch, the head sha, the CI state, the task it closes, and each departure from the plan. That transition is the one moment only this session knows, and the controller's review poll no longer starts on a dispatch.
 
 - Carry the reach in that message, being the paths this branch wrote that another live plan or `## Run now` row holds, and who holds each, which `canon tasks plan-reach` reports as `claimed`
 - Report each as a rebase the controller should order, never as a breach, since sharing a path is not a hold
@@ -123,7 +125,7 @@ A worker that improvised this read polled issue comments, never saw a UI close p
 
 ### Addressing
 
-Address the session the launch named, and the reviewer by its dispatch's sessionId, each as a `sessionId` rather than a name. `canon:session-relay` turns that id into an address and carries the send, falling back to a copyable block where no send tool exists.
+Address the session the launch named, and the reviewer by its dispatch's sessionId, each as a `sessionId` rather than a name. `canon:session-relay` turns that id into an address and carries the send, falling back to a copyable block where no send tool exists. A `Controller: <sessionId>` line names the controller.
 
 Ask the operator when the launch named nobody and a person is there, putting candidate rows through the structured question surface. The halt is the cheaper error, since a message sent to the wrong session reports success and is lost.
 

package/claude/skills/session-compact/references/handoff-note.md

@@ -39,7 +39,9 @@ Name what was not touched too. A session that changed no source says so, since a
 
 One bullet per decision, each naming what it beat. A decision with no rejected alternative reads as arbitrary and gets reopened by the next session that dislikes it.
 
-Where a decision rests on a measurement, give the number rather than the conclusion. `27 spacing values became 7` survives a reader disagreeing with it, where `the spacing was tidied` does not.
+- Keep each bullet under 200 characters, and give a decision needing more an H3 of its own and a short paragraph
+- The note holds to the six criteria under `### Structure` in `${CLAUDE_SKILL_DIR}/../plan-feature/references/plan.md`
+- Where a decision rests on a measurement, give the number rather than the conclusion. `27 spacing values became 7` survives a reader disagreeing with it, where `the spacing was tidied` does not.
 
 ### `## What is open`
 

package/claude/skills/session-map/references/session.md

@@ -66,7 +66,7 @@ Three sections form the core, in this order, and every session fills all three.
 - `## Mistakes worth not repeating`: what went wrong and the rule it yields
 - `## Standing cautions`: commands that lie, tools that measure the wrong tree, and anything unbacked
 
-Add a section only for content that fits none of the three and would otherwise be lost.
+Add a section only for content that fits none of the three and would otherwise be lost. Every section holds to the six criteria under `### Structure` in `${CLAUDE_SKILL_DIR}/../plan-feature/references/plan.md`.
 
 ## Writing one
 

package/claude/skills/task-board/references/board.md

@@ -91,9 +91,9 @@ A collision with running work blocks a task only where no merge settles it, bein
 
 ### The `Touches` cell
 
-A `Touches` cell is the first three paths of its plan's `**Files to touch:**` and a count of the rest, the union in line order for a sliced task. It states what the branch sets out to write, and a running branch outgrows it.
+A `Touches` cell counts its plans' declared files and names the two fullest folders, as in ``12 files under `src/tasks/`, `claude/skills/` ``. The linked plan holds the file list, which the overlap checks read.
 
-- `canon tasks plan-reach <plan>` reads the current reach off the branch's diff
+- `canon tasks plan-reach <plan>` reads the reach a running branch grew to
 - Change the plan's list to change the cell. A worker never edits this board.
 
 ### Cell width

package/claude/skills/task-board/references/tasks.md

@@ -83,7 +83,7 @@ Two headings, `## Outcomes` and `## Findings`. Outcomes are future and checkable
 
 - Add no third heading. Status stays inline on an outcome rather than becoming an "In progress" section.
 - Outcomes stay a checklist, since the board tools read them by their `- [ ]` line
-- Open each finding with a bold label naming its source and date, as in `- **planner, 2026-10-11:** <finding>`. Keep it to a few sentences, moving anything longer into the plan or groundwork folder.
+- Open each finding with a bold label naming its source and date, as in `- **planner, 2026-10-11:** <finding>`. Past 200 characters it becomes a paragraph, and the plan holds anything longer.
 
 ### Sizing outcomes
 
@@ -198,7 +198,7 @@ Session history and ordering both have homes off the task file.
 
 ## Archiving
 
-Never delete a task file. A shipped task moves to `.canon/tasks/archive/` under its own name through `canon tasks archive`, and the live index regenerates without it. What the verb does and refuses on is at `canon tasks archive --help`, and a flat `.claude/task-archive/` names an older binary rather than a second archive.
+Never delete a task file. A shipped task moves to `.canon/tasks/archive/` under its own name through `canon tasks archive`, and the live index regenerates without it. What the verb does and refuses on is at `canon tasks archive --help`.
 
 ### The plan and ready folder
 
@@ -209,4 +209,6 @@ Archiving a task archives its plan alongside it when the task is that plan's las
 
 ### Open outcomes
 
-A task with an open outcome stays on the board, and so does its plan. Close it, or cut an abandoned outcome by striking its body, as `- ~~<outcome>~~ <why>`, which reads as cut whatever its checkbox holds, so a task of cut outcomes still archives.
+A task with an open outcome stays on the board with its plan. Close it, or cut an abandoned one by striking its body, as `- ~~<outcome>~~ <why>`, which reads as cut.
+
+An operator-only check outside this repository takes `- [ ] Operator check: <outcome>`, written before the pull request opens. It closes unticked.

package/claude/skills/task-complete/SKILL.md

@@ -43,6 +43,7 @@ For each unchecked outcome, decide whether the diff shipped the behavior it name
 
 - Mark only outcomes already written on the board. Never infer a new task from the diff.
 - Match on the behavior an outcome describes, not on filenames or commit subjects. The path match above only narrowed which task files to open.
+- Never tick an outcome marked `Operator check:`, since a diff cannot prove a check only the operator can run.
 - Leave an outcome `[ ]` when the diff is ambiguous. An unmarked shipped outcome costs one manual edit, while a wrongly marked one hides work that never happened.
 - Do not touch task files the diff does not relate to.
 

package/claude/skills/task-complete/references/archive.md

@@ -56,7 +56,8 @@ An empty `plans` means the task cited no live plan, or a sibling still holds eve
 Each reason has one resolution, and none of them is to archive around it.
 
 - `open-outcomes`: the named outcomes are unmarked or genuinely open. Run `task-complete` when the work shipped unmarked, and leave the task on the board when the outcome is real.
-  - An outcome only the operator or another repository can close is the exception. The orchestrator's merge sweep strikes it with its reason and lists it in the report, per `${CLAUDE_SKILL_DIR}/../role-orchestrator/references/orchestrator-refill.md`, and the archive then runs. An outcome this repository owes is never struck for that.
+  - An outcome only the operator can check is marked `- [ ] Operator check: <outcome>` rather than struck, which the archive passes and the record lists under `operatorChecks`. The mark has to land before the pull request opens.
+  - Abandoned work, an outcome another repository owes, and an operator outcome nobody marked in time take the strike. The orchestrator's merge sweep strikes it with its reason and lists it in the report, per `${CLAUDE_SKILL_DIR}/../role-orchestrator/references/orchestrator-refill.md`, and the archive then runs. An outcome this repository owes is never struck for that.
 - `ambiguous`: two tasks name one pull request, the misfile `${CLAUDE_SKILL_DIR}/references/tasks.md` rules out. Resolve the citation by hand, since no sweep repairs it.
 - `earlier-slice`: the number is listed on the task but is not the last. Leave the task on the board, and its last slice's merge archives it.
 

package/docs/agents/migrate.md

@@ -18,13 +18,13 @@ kind: reference
 | `rule-layout`      | A flat installed-rule layout onto the `canon/`-wrapped one                                                                                  |
 | `scratch-evidence` | A folder a durable record cites out of `.tmp/`, with its citations                                                                          |
 | `record-layout`    | Review receipts, memory archives, feedback, renders, picks, and evidence into their current folders                                         |
-| `session-defaults` | The seeded session defaults into an existing `.claude/settings.json`: `Agent` and `Task` denied, auto memory off                            |
+| `session-defaults` | The seeded session defaults into an existing `.claude/settings.json`: `Agent`, `Task`, and both merge commands denied, auto memory off      |
 
 - `skill-names` takes no `--scope`, and skips the changelog, eval transcripts, and the pointer each renamed `draft-` skill leaves at its old name
 - `surface-roots` leaves `rules/`, `skills/`, `hooks/`, and `settings.json` where Claude Code reads them
 - `rule-layout` classifies each flat file against the stamp as clean, edited, or unclaimed. Clean and edited files move untouched, and an unclaimed name stays.
 - `record-layout` labels each evidence folder `(pick)` or `(evidence)` in the dry run
-- `session-defaults` adds a key only when absent. It never removes a deny entry or changes a set `autoMemoryEnabled`, and a missing settings file is nothing to do.
+- `session-defaults` adds a key only when absent, merge entries included, and each older project runs it once. `--write` restores a removed `Agent` or `Task` and never removes a deny entry.
 
 ## Output
 

package/docs/agents/records.md

@@ -57,5 +57,5 @@ Branch on `reason` in the `--json` record, not the exit code.
 ## See also
 
 - `canon records ordinal <kind> <slug> --claim`: reserve the next intake or groundwork ordinal
-- `canon records validate <kind> --help`: where a record folder disagrees with its standard
+- `canon records validate <kind> [record] --help`: where a record disagrees with its standard, plus a `structure` report that never sets the exit
 - `canon records stale --help`: when the requirements record was last reviewed

package/docs/target/migrations.md

@@ -150,9 +150,9 @@ The wireframes record is retired, and nothing deletes what a project holds.
 
 The toolkit no longer seeds `canon/ARCHITECTURE.md`, and a held file and its `CLAUDE.md` import stay. Move a trap a session would hit into that domain's `## Gotchas`, then delete the file and its `@canon/ARCHITECTURE.md` line.
 
-## Deny subagents and turn auto memory off, once
+## Deny subagents and merges, and turn auto memory off, once
 
-The seeded `.claude/settings.json` now denies the `Agent` and `Task` tools and sets `autoMemoryEnabled` to `false`. `canon claude sync` never rewrites a settings file you hold, so it warns while the file holds neither default. Removing the deny later to allow subagents draws no warning.
+The seeded `.claude/settings.json` now denies the `Agent` and `Task` tools and both merge commands, and sets `autoMemoryEnabled` to `false`. `canon claude sync` never rewrites a settings file you hold, so it warns while the file holds no default or lacks a merge entry. Removing `Agent` and `Task` later draws no warning.
 
 ```bash
 canon migrate session-defaults --json
@@ -161,6 +161,8 @@ canon migrate session-defaults --write --json
 
 The verb only adds a key that is absent. A person who wants auto memory back sets it in their own `.claude/settings.local.json`.
 
+The verb adds `Bash(canon pr merge:*)` and `Bash(gh pr merge:*)` so a session cannot merge. A project migrated before them runs `--write` once more, which also restores `Agent` and `Task` for a person who removed them to allow subagents, so remove them again after.
+
 ## Move the capture cases out of the harness, once
 
 A web project's `e2e/screenshot.ts` is a config, so sync overwrites it. It now loads `CASES` from a seeded `e2e/capture/cases.ts` that sync copies once and never overwrites. Cases edited in the old harness leave the working tree on the first sync and stay in git history.