@erclx/canon 5.53.0 → 5.55.0

package/src/design/regen.ts

@@ -1,42 +1,20 @@
 import { mkdirSync, writeFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
-import { buildDesignCss } from '@/design/css'
 import { renderDesignDocument } from '@/design/document'
-import { NEUTRAL_TOKENS } from '@/design/neutral'
 
 /**
- * The two artifacts the token sources produce, written by `canon design regen`
- * and asserted for drift by the `design` stage of `bun run check`. The
- * document renders from `TOKENS` and the stylesheet from `NEUTRAL_TOKENS`.
- *
- * The document is what a person reads and the stylesheet is what a target
- * installs, and neither is edited by hand. That is the cost the operator took
- * on when the tokens moved into a module: two artifacts where the record used
- * to be one, and a regen step that has to run or both go stale silently. The
- * gate stage is what keeps silently out of it.
+ * The record the token module renders, written by `canon design regen` and
+ * asserted for drift by the `design` stage of `bun run check`. It is never
+ * edited by hand. That is the cost the operator took on when the tokens moved
+ * into a module: a regen step that has to run or the record goes stale
+ * silently. The gate stage is what keeps silently out of it.
  */
 
 /** The rendered record, at the path `claude/skills/design-record/references/design.md` fixes for it. */
 export const DESIGN_DOCUMENT = join('canon', 'DESIGN.md')
 
-/**
- * The base stylesheet a target installs. It sits inside `src/` because that is
- * the folder the published package ships, and beside the module that writes it
- * because a generated file kept away from its generator is one nobody thinks to
- * regenerate.
- */
-export const DESIGN_BASE_CSS = join('src', 'design', 'base.css')
-
-const BASE_BANNER = [
-  'Generated by `canon design regen` from src/design/neutral.ts. Do not edit.',
-  'This is the base half of a design install. A target overrides a value in',
-  '.claude/design/project/, which the three-way merge leaves alone, so this',
-  'file changes freely and nothing a project wrote lives in it.',
-].join('\n   ')
-
 export interface RegenResult {
   readonly documentPath: string
-  readonly cssPath: string
 }
 
 function write(root: string, rel: string, body: string): string {
@@ -49,10 +27,5 @@ function write(root: string, rel: string, body: string): string {
 export function regenDesign(root: string): RegenResult {
   return {
     documentPath: write(root, DESIGN_DOCUMENT, renderDesignDocument()),
-    cssPath: write(
-      root,
-      DESIGN_BASE_CSS,
-      buildDesignCss(NEUTRAL_TOKENS, { banner: BASE_BANNER }),
-    ),
   }
 }

package/src/design/render.ts

@@ -259,7 +259,7 @@ ${previewChrome()}
 </head>
 <body>
 <h1>Design tokens</h1>
-<p class="note">Generated from <code>canon/DESIGN.md</code> by <code>canon design render</code>. Token preview only, not a screen mock.</p>${summary}
+<p class="note">Generated from <code>canon/DESIGN.md</code> by <code>bun run web:previews</code>. Token preview only, not a screen mock.</p>${summary}
 ${sections.join('\n')}
 </body>
 </html>

package/src/design/tokens.ts

@@ -84,8 +84,9 @@ const MONO = 'Noto Sans Mono, DejaVu Sans Mono, monospace'
  * The proportional stack every role but `code` declares. Geist is the face the
  * visual-direction track set throughout, embedded through `FONT_FACES`.
  *
- * The stack stops at two names and a generic because `src/design/base.css` is
- * written by `canon design regen` and formatted by prettier, and a declaration
+ * The stack stops at two names and a generic because
+ * `web/src/styles/tokens.css` is written by `bun run web:tokens` and formatted
+ * by oxfmt, and a declaration
  * past 80 columns is wrapped by the second and flattened by the first. Every
  * emitted line stays inside the width so the two writers never disagree.
  */

package/src/gate/sequencer.ts

@@ -525,7 +525,7 @@ async function spawn(
     cwd,
     reject: false,
     all: true,
-    env: { ...gitEnv(), CANON_NON_INTERACTIVE: '1', ...env },
+    env: { ...gitEnv(), ...env },
     extendEnv: false,
   })
 

package/src/gate/stages.ts

@@ -119,12 +119,6 @@ const TESTS_SCOPE = new RegExp(
   ].join('|'),
 )
 
-const script = (name: string, failure: string): Check => ({
-  kind: 'command',
-  argv: ['bash', `scripts/core/${name}`],
-  failure,
-})
-
 /**
  * Every stage the gate runs, in the order it runs them.
  *
@@ -212,10 +206,10 @@ export const STAGES: readonly Stage[] = [
   },
   {
     // `canon/DESIGN.md`, the web stylesheet, and the tab icon are written
-    // from `src/design/tokens.ts`, the base stylesheet from
-    // `src/design/neutral.ts`, and none is edited by hand. Four artifacts
-    // from two token sources is the cost of the token move, and a render step that has to run is only safe while something fails
-    // when it did not, which is this. The record and the worked example are
+    // from `src/design/tokens.ts`, and none is edited by hand. Three
+    // artifacts from one token source is the cost of the token move, and a
+    // render step that has to run is only safe while something fails when it
+    // did not, which is this. The record and the worked example are
     // then counted against the prose budget, which the drift asserts cannot
     // see since a regenerated paragraph agrees with its source.
     id: 'design',
@@ -232,12 +226,6 @@ export const STAGES: readonly Stage[] = [
         failure:
           'The design record drifted from the token source. Run bun run check and commit canon/DESIGN.md.',
       },
-      {
-        kind: 'drift',
-        pathspec: 'src/design/base.css',
-        failure:
-          'The base stylesheet drifted from the token source. Run bun run check and commit src/design/base.css.',
-      },
       {
         kind: 'command',
         argv: ['bun', 'run', 'web:tokens'],
@@ -536,10 +524,6 @@ export const STAGES: readonly Stage[] = [
         argv: ['bun', 'run', 'check:shell'],
         failure: 'Shell check failed',
       },
-      script(
-        'check-color-source.sh',
-        'A color escape is defined outside scripts/lib/ui.sh.',
-      ),
     ],
     success: 'Shell check passed',
   },

package/src/gov/audit.ts

@@ -45,13 +45,8 @@ export const RULE_GATED_FOLDERS: readonly string[] = [
 /**
  * Rule files in a gated folder whose findings `--gate` still passes, one path
  * each and never a folder, so a new rule beside one is gated the day it lands.
- *
- * `ui/canvas.md` carries a shape finding and no ledger, and v149.2 removes the
- * rule, so this entry goes with it.
  */
-export const RULE_GATE_EXEMPT: readonly string[] = [
-  join('governance', 'rules', 'ui', 'canvas.md'),
-]
+export const RULE_GATE_EXEMPT: readonly string[] = []
 
 /** The folders whose rules claim outside practice, so each carries a ledger. */
 export const PRACTICE_FOLDERS: readonly string[] = [

package/src/hooks/post-merge.ts

@@ -359,11 +359,8 @@ export async function runPostMerge(input: PostMergeInput): Promise<void> {
   }
 
   if (!isSkipped('CANON_SKIP_UPGRADE')) {
-    await step(
-      input,
-      at([...STEP_VERBS.upgrade, '--json'], { CANON_NON_INTERACTIVE: '1' }),
-      (result, fields) =>
-        moveLines(result, fields, '⬆️  ', 'CLI not upgraded', []),
+    await step(input, at([...STEP_VERBS.upgrade, '--json']), (result, fields) =>
+      moveLines(result, fields, '⬆️  ', 'CLI not upgraded', []),
     )
   }
 

package/src/markdown/scope.ts

@@ -136,9 +136,6 @@ export const GATED_PATHS: readonly string[] = [
   'claude/skills/canon-feedback/REQUIREMENT.md',
   'claude/skills/canon-feedback/SKILL.md',
   'claude/skills/canon-feedback/references/template.md',
-  'claude/skills/canvas-board/REQUIREMENT.md',
-  'claude/skills/canvas-board/SKILL.md',
-  'claude/skills/canvas-board/references/canvas.md',
   'claude/skills/ci-workflow/REQUIREMENT.md',
   'claude/skills/ci-workflow/SKILL.md',
   'claude/skills/ci-workflow/references/workflows.md',
@@ -203,6 +200,7 @@ export const GATED_PATHS: readonly string[] = [
   'claude/skills/document-repair/references/batches.md',
   'claude/skills/pick-by-eye/REQUIREMENT.md',
   'claude/skills/pick-by-eye/SKILL.md',
+  'claude/skills/pick-by-eye/references/board.md',
   'claude/skills/pick-by-eye/references/live-arms.md',
   'claude/skills/write-doc/REQUIREMENT.md',
   'claude/skills/write-doc/SKILL.md',
@@ -375,6 +373,7 @@ export const GATED_PATHS: readonly string[] = [
   'claude/skills/task-complete/references/unusable-baseline.md',
   'claude/skills/teach-craft/REQUIREMENT.md',
   'claude/skills/teach-craft/SKILL.md',
+  'claude/skills/teach-craft/references/adopted.md',
   'claude/skills/teach-craft/references/lesson-craft.md',
   'claude/skills/teach-craft/references/pedagogy.md',
   'claude/skills/test-craft/REQUIREMENT.md',
@@ -399,7 +398,6 @@ export const GATED_PATHS: readonly string[] = [
   'claude/skills/write-human/references/machine-tells.md',
   'claude/skills/youtube-transcripts/REQUIREMENT.md',
   'claude/skills/youtube-transcripts/SKILL.md',
-  '.claude/skills/internal-canvas/REQUIREMENT.md',
   '.claude/skills/internal-claude/REQUIREMENT.md',
   '.claude/skills/internal-docs/REQUIREMENT.md',
   '.claude/skills/internal-governance/REQUIREMENT.md',

package/src/process/harness.ts

@@ -90,8 +90,7 @@ export function snapshotStateDir(): string {
  *
  * A git hook exports `GIT_DIR`, which would resolve a fixture's git-aware
  * reads against this checkout instead of the temporary directory a case
- * builds, so every spawn drops the `GIT_` prefix before adding the headless
- * flag every case needs to avoid a picker blocking on stdin.
+ * builds, so every spawn drops the `GIT_` prefix.
  *
  * `CANON_STATE_DIR` and `CANON_SANDBOX_DIR` get the same treatment as `GIT_DIR`,
  * each pointed at a folder under the case's own `cwd` rather than dropped,
@@ -99,7 +98,8 @@ export function snapshotStateDir(): string {
  * `HOME` to this machine's real `~/.local/state/canon`. `stateDir()` and
  * `sandboxTree()` resolve the same three ways and share that parent, so both
  * overrides move together. A case explicitly passing its own value through
- * `options.env` still wins, matching `CANON_NON_INTERACTIVE` below.
+ * `options.env` still wins. The child's stdin is a pipe rather than a
+ * terminal, so every case runs headless.
  *
  * The `stateDir()` snapshot before and after the spawn is what actually
  * catches an escape past that redirection, since a default can be wrong in a
@@ -125,7 +125,6 @@ export function runCli(
     timeout: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
     env: {
       ...inherited,
-      CANON_NON_INTERACTIVE: '1',
       CANON_STATE_DIR: join(options.cwd, '.canon-state'),
       CANON_SANDBOX_DIR: join(options.cwd, '.canon-state', 'sandbox'),
       ...options.env,

package/src/sandbox/equivalence.ts

@@ -517,7 +517,6 @@ function provisionEnv(
 ): NodeJS.ProcessEnv {
   const env: NodeJS.ProcessEnv = {
     ...process.env,
-    CANON_NON_INTERACTIVE: '1',
     CANON_SANDBOX_DIR: dir,
     CANON_SANDBOX_RUN_ID: PINNED_RUN_ID,
     CLAUDE_CONFIG_DIR: configDirFor(dir),

package/src/sandbox/provision.ts

@@ -27,7 +27,7 @@ import {
   logStep,
   logWarn,
   outro,
-  palette,
+  outroSuccess,
   select,
 } from '@/cli/ui'
 
@@ -99,9 +99,7 @@ function readGit(cwd: string, args: string[]): string | undefined {
 }
 
 function finish(message: string): void {
-  const { GREEN, NC } = palette(process.stderr)
-  outro()
-  process.stderr.write(`\n${GREEN}${message}${NC}\n`)
+  outroSuccess(message)
 }
 
 function stageAnchorTree(
@@ -210,7 +208,7 @@ function install(
   env: NodeJS.ProcessEnv,
 ): void {
   const result = spawnSync('bun', [join(root, 'src', 'cli.ts'), ...args], {
-    env: { ...env, CANON_NON_INTERACTIVE: '1' },
+    env,
     encoding: 'utf8',
     stdio: ['ignore', 'ignore', 'pipe'],
   })
@@ -432,10 +430,7 @@ async function provisionScenario(
   baseEnv: NodeJS.ProcessEnv,
 ): Promise<void> {
   const env: NodeJS.ProcessEnv = { ...baseEnv }
-  if (scenario.arm !== undefined) {
-    env.SANDBOX_SCENARIO = scenario.arm
-    env.CANON_NON_INTERACTIVE = '1'
-  }
+  if (scenario.arm !== undefined) env.SANDBOX_SCENARIO = scenario.arm
 
   const sandboxDir = join(root, 'sandbox')
   const declared = declareScenario(root, scenario, env)
@@ -475,14 +470,14 @@ async function provisionScenario(
   must(commitScenarioChanges(sandbox, isSkipAutoCommit, env))
   tagBaseline(sandbox, env)
 
-  finish('✓ Sandbox Ready')
+  finish('Sandbox Ready')
 }
 
 function cleanSandbox(sandbox: string): void {
   logStep('Removing sandbox')
   rmSync(sandbox, { recursive: true, force: true })
   logRemove(sandbox)
-  finish('✓ Sandbox clean')
+  finish('Sandbox clean')
 }
 
 function isAtBaseline(sandbox: string): boolean {
@@ -520,7 +515,7 @@ async function resetSandbox(sandbox: string): Promise<void> {
 
   if (isAtBaseline(sandbox)) {
     logInfo('At baseline')
-    finish('✓ Sandbox at baseline')
+    finish('Sandbox at baseline')
     return
   }
 
@@ -556,7 +551,7 @@ async function resetSandbox(sandbox: string): Promise<void> {
     must(run('git', ['checkout-index', '-a', '-f'], quiet))
   }
   logInfo('Sandbox reset to baseline')
-  finish('✓ Sandbox reset complete')
+  finish('Sandbox reset complete')
 }
 
 /**

package/src/sandbox/scenario.ts

@@ -13,6 +13,7 @@ import {
 import { createRequire } from 'node:module'
 import { dirname, join, relative } from 'node:path'
 import {
+  isNonInteractive,
   logError,
   logInfo,
   logStep,
@@ -580,8 +581,9 @@ export function createStageContext(options: ContextOptions): StageContext {
 }
 
 /**
- * Picks the arm: a routed name first,
- * echoed on the frame, then the first arm for a headless caller, then a prompt.
+ * Picks the arm: a routed name first, echoed on the frame, then a prompt. A
+ * headless caller naming no arm is refused rather than handed the first one,
+ * since a verdict on an arm nobody chose reads as a verdict on the scenario.
  */
 async function routeArm(
   names: readonly string[],
@@ -600,17 +602,9 @@ async function routeArm(
   const routed = env.SANDBOX_SCENARIO ?? ''
   if (routed !== '') return echo(routed)
 
-  // Read off the scenario's environment rather than this process's, as
-  // `is_non_interactive` read the shell it ran in.
-  const isHeadless =
-    env.CANON_NON_INTERACTIVE === '1' ||
-    // canon-keep-retired
-    env.AITK_NON_INTERACTIVE === '1'
-  if (isHeadless) return echo(names[0] ?? DEFAULT_ARM_NAME)
-
-  if (!process.stdin.isTTY) {
+  if (isNonInteractive()) {
     logError(
-      `${prompt} requires a TTY. Pass an argument or set CANON_NON_INTERACTIVE=1.`,
+      `${prompt} requires a TTY. Pass the arm as the scenario argument, one of: ${names.join(', ')}.`,
     )
     throw new ScenarioStop(1, 'exited')
   }

package/src/shipped/references.ts

@@ -15,8 +15,7 @@ import { isMarked } from '@/sweep/exempt-marker'
  * number resolves.
  *
  * That is also what keeps the check a prose pattern rather than a parser.
- * `src/design/base.css` and `src/design/tokens.ts` carry sixteen values shaped
- * `#191512`, which no width or boundary rule separates from a pull request
+ * `src/design/tokens.ts` carries twenty values shaped `#191512`, which no width or boundary rule separates from a pull request
  * number, so telling them apart would need the line's syntactic position.
  */
 export const SHIPPED_CORPORA = [

package/src/sync/check.ts

@@ -2,7 +2,6 @@ import { existsSync } from 'node:fs'
 import { basename, join, sep } from 'node:path'
 import { execa } from 'execa'
 import { gitEnv } from '@/git/env'
-import { createDesignAdapter, DESIGN_INSTALL_DIR } from '@/design/adapter'
 import { createGovAdapter } from '@/gov/adapter'
 import { successorResolver } from '@/gov/renames'
 import { lookupRules } from '@/gov/install'
@@ -46,17 +45,11 @@ import { readSkew, type SkewReport } from '@/version/skew'
  * being one of these, because `src/tooling/` never calls `planSync`, so the
  * three lookups below have no entry to offer it. Standards and snippets left
  * the list with their install channels: nothing writes either corpus into a
- * target, so there is no installed copy to attribute.
- *
- * Design joins as a scanned domain rather than a stamp-only one because its
- * base file is attributed the same way a rule is, and its install marker is
- * what keeps it off a target that never asked for it: a project with no
- * `.claude/design/` is never scanned, so design values arrive on an install
- * rather than on the next sync.
+ * target, so there is no installed copy to attribute. Design left with its
+ * install verb for the same reason.
  */
 export const SCANNED_DOMAINS = [
   'governance',
-  'design',
 ] as const satisfies readonly StampDomain[]
 
 export type ScannedDomain = (typeof SCANNED_DOMAINS)[number]
@@ -68,17 +61,14 @@ export type ScannedDomain = (typeof SCANNED_DOMAINS)[number]
  */
 const SYNCED_SOURCES: Record<ScannedDomain, string> = {
   governance: 'governance/rules/',
-  design: 'src/design/',
 }
 
 const ADAPTERS: Record<ScannedDomain, (root: string) => SyncAdapter> = {
   governance: createGovAdapter,
-  design: createDesignAdapter,
 }
 
 const INSTALL_MARKERS: Record<ScannedDomain, readonly string[]> = {
   governance: ['.claude', 'rules', 'canon'],
-  design: DESIGN_INSTALL_DIR.split(sep),
 }
 
 export interface StateCounts {
@@ -215,33 +205,18 @@ export interface CheckReport {
   readonly skew: SkewReport
 }
 
-/**
- * Scanned domains a target takes deliberately rather than by being managed.
- *
- * An absent one is a choice, so it is never reported as unstamped. Governance
- * wants the opposite reading, since a managed target without it has yet to
- * install what every project is expected to carry, and naming it is the only
- * place that shows up.
- */
-export const OPT_IN_DOMAINS: readonly ScannedDomain[] = ['design']
-
 /**
  * Scanned domains this target should have stamped and has not, which is the
  * one line a domain nobody installed ever appears on.
  *
  * An unmigrated domain is excluded because the relocation is its remedy rather
- * than a sync, and an opt-in domain the target does not hold is excluded
- * because there is nothing there to stamp and the sync it would name refuses.
+ * than a sync.
  */
 export function uncoveredDomains(report: CheckReport): ScannedDomain[] {
   const unmigrated = new Set(report.unmigrated.map((entry) => entry.domain))
-  const installed = new Set(report.domains.map((entry) => entry.domain))
 
   return SCANNED_DOMAINS.filter(
-    (domain) =>
-      !report.covers.includes(domain) &&
-      !unmigrated.has(domain) &&
-      (!OPT_IN_DOMAINS.includes(domain) || installed.has(domain)),
+    (domain) => !report.covers.includes(domain) && !unmigrated.has(domain),
   )
 }
 

package/src/sync/engine.ts

@@ -26,7 +26,7 @@ import {
   logStep,
   logWarn,
   outro,
-  palette,
+  outroSuccess,
   select,
 } from '@/cli/ui'
 import { compareVersions, parseVersion } from '@/version/compare'
@@ -436,7 +436,6 @@ export async function runDomainSync(
   }
 
   const plan = planSync(adapter, resolved)
-  const { GREEN, GREY, NC } = palette(process.stderr)
 
   if (
     !existsSync(adapter.installedRoot(resolved)) &&
@@ -453,8 +452,7 @@ export async function runDomainSync(
   if (count === 0) {
     await adapter.onComplete?.(resolved)
     await recordStamp(adapter, resolved, new Date())
-    outro()
-    process.stderr.write(`${GREEN}✓ Everything up to date${NC}\n`)
+    outroSuccess('Everything up to date')
     return 0
   }
 
@@ -489,10 +487,7 @@ export async function runDomainSync(
   await adapter.onComplete?.(resolved)
   await recordStamp(adapter, resolved, new Date())
 
-  outro()
-  process.stderr.write(
-    `${GREEN}✓ Sync complete${NC} ${GREY}(${count} ${adapter.unit})${NC}\n`,
-  )
+  outroSuccess('Sync complete', `(${count} ${adapter.unit})`)
   return 0
 }
 

package/src/sync/stamp.ts

@@ -10,17 +10,17 @@ import { compareVersions, parseVersion } from '@/version/compare'
 import { readInstalled } from '@/version/installed'
 
 /**
- * Domains the stamp can record. Governance and design both attribute file by
- * file through the sync engine. Tooling runs its own inject and manifest
- * machinery, so it records the stack chain it resolved instead and carries no
- * file hashes.
+ * Domains the stamp can record. Governance attributes file by file through
+ * the sync engine. Tooling runs its own inject and manifest machinery, so it
+ * records the stack chain it resolved instead and carries no file hashes.
  *
  * A stamp written before the standards or snippets install channel closed
- * still carries a `standards` or `snippets` record. `isStamp` ignores the key
+ * still carries a `standards` or `snippets` record, and one written before the
+ * design install retired carries a `design` record. `isStamp` ignores the key
  * and `sortDomains` drops it on the next write, so the target loses a domain
  * nothing can refresh rather than losing the whole file.
  */
-export const STAMP_DOMAINS = ['governance', 'design', 'tooling'] as const
+export const STAMP_DOMAINS = ['governance', 'tooling'] as const
 
 export type StampDomain = (typeof STAMP_DOMAINS)[number]
 

package/src/sync/target.ts

@@ -1,9 +1,8 @@
 import { existsSync } from 'node:fs'
 import { join } from 'node:path'
-import { DESIGN_INSTALL_DIR } from '@/design/adapter'
 import { isDirectory } from '@/targets/validate'
 
-export const SYNC_DOMAINS = ['governance', 'design', 'claude'] as const
+export const SYNC_DOMAINS = ['governance', 'claude'] as const
 
 export type SyncDomain = (typeof SYNC_DOMAINS)[number]
 
@@ -14,7 +13,6 @@ export interface DomainState {
 
 const DOMAIN_MARKERS: Record<SyncDomain, string> = {
   governance: join('.claude', 'rules'),
-  design: DESIGN_INSTALL_DIR,
   claude: '.claude',
 }
 
@@ -26,7 +24,6 @@ const DOMAIN_MARKERS: Record<SyncDomain, string> = {
  */
 const DOMAIN_PATHS: Record<SyncDomain, readonly string[]> = {
   governance: ['.claude/rules/', '.claude/GOV.md'],
-  design: ['.claude/design/'],
   claude: ['.gitignore'],
 }
 

package/src/sync/workflow.ts

@@ -19,7 +19,7 @@ import {
   logStep,
   logWarn,
   outro,
-  palette,
+  outroSuccess,
   pipeOutput,
   select,
 } from '@/cli/ui'
@@ -75,7 +75,7 @@ export async function collectChanges(git: GitRunner): Promise<DomainChange[]> {
  *
  * This is the only toolkit code that writes to a git remote, which is why a
  * headless run refuses it outright. `select_option` resolved to its first
- * option under `CANON_NON_INTERACTIVE=1`, and the first option here was
+ * option with no terminal to answer it, and the first option here was
  * `Commit and open PR` whenever `gh` was installed, so an agent following the
  * documented non-interactive path pushed a branch and opened a pull request on
  * someone's repository without being asked.
@@ -193,8 +193,6 @@ function promptChoice(canOpenPullRequest: boolean): Promise<WorkflowChoice> {
 }
 
 function succeed(message: string): number {
-  const { GREEN, NC } = palette(process.stderr)
-  outro()
-  process.stderr.write(`\n${GREEN}✓ ${message}${NC}\n`)
+  outroSuccess(message)
   return 0
 }

package/src/tooling/verify-stack.ts

@@ -124,7 +124,7 @@ async function run({
   await phase(state, 'Sync', () =>
     execa('bun', [cli, 'tooling', 'sync', stack, '.', '--write'], {
       ...captured(state.dir),
-      env: { CI: '1', CANON_NON_INTERACTIVE: '1' },
+      env: { CI: '1' },
     }),
   )
 

package/tooling/base/configs/.husky/post-merge

@@ -27,20 +27,16 @@ if ! command -v canon >/dev/null 2>&1; then
   exit 0
 fi
 
-# A global binary older than the verb cannot run it, and the verb carries the
-# only step that would update it, so reinstall here and probe again. The probe
-# reads the verb's own usage line rather than the exit, since an older binary
-# answers an unknown command's `--help` with its root help and exits zero.
+# A global binary older than the verb cannot run it, and its owner upgrades it
+# by hand. The probe reads the verb's own usage line rather than the exit,
+# since an older binary answers an unknown command's `--help` with its root
+# help and exits zero.
 has_verb() {
   canon hooks post-merge --help 2>/dev/null | grep -q '^Usage: canon hooks post-merge'
 }
 
-if ! has_verb; then
-  if [ -z "$CANON_SKIP_UPGRADE" ]; then
-    CANON_NON_INTERACTIVE=1 canon upgrade >/dev/null 2>&1 || true
-  fi
-fi
-
 if has_verb; then
   canon hooks post-merge --root "$root" || true
+else
+  echo 'canon is too old to run the post-merge hook. Run `canon upgrade`.' >&2
 fi

package/tooling/claude/reference.md

@@ -16,7 +16,7 @@ The claude stack installs the Claude Code workflow into a project through `canon
 
 - `.canon/tasks/` holds one file per task plus a generated `index.md`, local scratch only, with `archive/` holding the tasks that shipped
 - `.canon/plans/` holds execution detail for multi-step tasks, and `canon tasks archive` moves a `feature-*.md` plan into `archive/` when the `post-merge` hook archives its task
-- `.canon/review/` holds one subfolder per producer, with `design/` for `canon design render`
+- `.canon/review/` holds the reports a review or measurement skill writes, such as `ux-measure-<slug>.md`
 - `.canon/tmp/` is ephemeral scratch, safe to delete without loss
 - `.claude/worktrees/` is where `EnterWorktree` creates a linked worktree, which is why it stays under `.claude/`
 

package/tooling/claude/seeds/canon/DESIGN.md

@@ -1,6 +1,6 @@
 # Design
 
-Authoring guidance: the design standard. Values live in `<your stylesheet>`, such as `src/styles/tokens.css` or a Tailwind `@theme` block. A project with none writes them under `.claude/design/project/`, beside the installed base stylesheet.
+Authoring guidance: the design standard. Values live in `<your stylesheet>`, such as `src/styles/tokens.css` or a Tailwind `@theme` block. A project with none writes a stylesheet of its own and names it here.
 
 ## Overview