@erclx/canon 5.64.0 → 5.65.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [5.65.0](https://github.com/erclx/canon/compare/v5.64.0...v5.65.0) (2026-10-25)
+
+
+### Features
+
+* **sandbox:** fail the consumer replay when a snapshot read drifts ([#2709](https://github.com/erclx/canon/issues/2709)) ([68dc0b7](https://github.com/erclx/canon/commit/68dc0b7b55634ac9f7affca6da92cb523ed61754))
+* **sandbox:** replay consumer snapshots through sync in the gate ([#2703](https://github.com/erclx/canon/issues/2703)) ([3fd2934](https://github.com/erclx/canon/commit/3fd2934779b7f242a66ea273b3c53f79802e6494))
+* **skills:** ledger the review and teach craft sources ([#2702](https://github.com/erclx/canon/issues/2702)) ([877b660](https://github.com/erclx/canon/commit/877b66007e7e28c46c6de63d5a891083c19df6c1))
+* **skills:** source every test-craft and codebase-layout bullet ([#2704](https://github.com/erclx/canon/issues/2704)) ([44a23e9](https://github.com/erclx/canon/commit/44a23e936c62cab229a49f82a8775933e540460e))
+
 ## [5.64.0](https://github.com/erclx/canon/compare/v5.63.0...v5.64.0) (2026-10-24)
 
 

package/claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "canon",
   "description": "Runs your agent's work and keeps its code good, on one setup for every repo.",
-  "version": "5.64.0",
+  "version": "5.65.0",
   "author": {
     "name": "Eric Le",
     "url": "https://github.com/erclx"

package/claude/skills/test-craft/references/e2e.md

@@ -31,7 +31,7 @@ An element counts as stable once it "has maintained the same bounding box for at
 
 - Run with motion reduced unless the test asserts motion, and opt back in per test with `page.emulateMedia({ reducedMotion: 'no-preference' })`.
 - Set it once in the config's `use` block as `contextOptions: { reducedMotion: 'reduce' }`, since the option defaults to `'no-preference'` ([BrowserContext options](https://playwright.dev/docs/api/class-browser#browser-new-context)).
-- A top-level `use.reducedMotion` reaches no page and type-checks nowhere, so a spec asserting the media query is what catches it
+- From Playwright 1.50 a top-level `use: { reducedMotion: 'reduce' }` works too ([TestOptions](https://playwright.dev/docs/api/class-testoptions)). Before 1.50 it is no test option, so a spec asserting the media query catches it
 
 A site honoring the reduced preference then has nothing to wait out in any test that does not opt back in.
 

package/governance/ledger/skills/codebase-layout/SKILL.md

@@ -0,0 +1,64 @@
+---
+title: Codebase layout skill ledger
+description: Sources for claude/skills/codebase-layout/SKILL.md, one row per bullet in its concern groups
+---
+
+# Codebase layout skill ledger
+
+The field is source organization. Robert Martin carries cohesion and folder naming, Kent C. Dodds and Robin Wieruch carry colocation and promotion, bulletproof-react carries the import direction, and the Go blog carries file and package naming. The closing sections and `## What this delegates` restate these rules or route, so they take no table.
+
+No outside source takes a side on when a plan states a path, so the rows for stating a reason, naming a new folder, and reading a reference are house choices naming the misplacement each prevents.
+
+## Read the project's strategy first
+
+| Bullet                                | Source                                                                                                                                                                                                          | Read       |
+| ------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| Name the project's layout first       | [React, File Structure](https://legacy.reactjs.org/docs/faq-structure.html): "React doesn’t have opinions on how you put files into folders", so the project's own layout is the only one a new file can follow | 2026-10-24 |
+| Keep to that strategy                 | [Next.js, Project structure](https://nextjs.org/docs/app/getting-started/project-structure): "choose a strategy that works for you and your team and be consistent across the project"                          | 2026-10-24 |
+| A strategy change is its own decision | House choice: a strategy changed as a side effect of placing one file leaves two strategies in the tree, and every later reader guesses which one a file follows                                                | 2026-10-24 |
+
+## Group what changes together
+
+| Bullet                              | Source                                                                                                                                                                                                                                                     | Read       |
+| ----------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| One folder per reason to change     | [Martin, The Single Responsibility Principle](https://blog.cleancoder.com/uncle-bob/2014/05/08/SingleReponsibilityPrinciple.html): "Gather together the things that change for the same reasons. Separate those things that change for different reasons." | 2026-10-24 |
+| Name a folder for what it holds     | [Martin, Screaming Architecture](https://blog.cleancoder.com/uncle-bob/2011/09/30/Screaming-Architecture.html): "Your architectures should tell readers about the system, not about the frameworks you used in your system."                               | 2026-10-24 |
+| No bare `utils` or `helpers` bucket | [Gerrand, Package names](https://go.dev/blog/package-names): "Packages named util , common , or misc provide clients with no sense of what the package contains."                                                                                          | 2026-10-24 |
+
+## Name a file for what it covers inside its folder
+
+| Bullet                                 | Source                                                                                                                                                                                                                    | Read       |
+| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| The stem never repeats the folder      | [Gerrand, Package names](https://go.dev/blog/package-names): "Since client code uses the package name as a prefix when referring to the package contents, the names for those contents need not repeat the package name." | 2026-10-24 |
+| Drop the prefix and retarget on a move | House choice: a file moved into a subfolder that keeps its old prefix says its folder twice, and a citation left on the old path resolves nowhere                                                                         | 2026-10-24 |
+| The stem runs to the first dot         | House choice: reading the stem past a suffix lets `checkout/checkout.test.ts` pass a check that `checkout/checkout.md` fails, though both repeat their folder                                                             | 2026-10-24 |
+
+## Split before the file lands
+
+| Bullet                                 | Source                                                                                                                                                                                                                                                                                                                     | Read       |
+| -------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| Split on a second role, before landing | [Martin, The Single Responsibility Principle](https://blog.cleancoder.com/uncle-bob/2014/05/08/SingleReponsibilityPrinciple.html): "Separate those things that change for different reasons." Splitting before the file lands is a House choice: the split costs a handful of paths then and 98 later, as the body records | 2026-10-24 |
+| Ten files is a prompt, not a gate      | House choice: no source gives a reliable ceiling, and a count fails a large folder of one role that reads fine flat while passing a small one mixing two                                                                                                                                                                   | 2026-10-24 |
+| A new role gets a named folder         | House choice: a role whose first file lands beside its nearest neighbor leaves the folder holding two roles, and the next file copies the first                                                                                                                                                                            | 2026-10-24 |
+
+## Place a file with its consumer
+
+| Bullet                         | Source                                                                                                                                                                                                                                             | Read       |
+| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| Colocate with the one consumer | [Dodds, Colocation](https://kentcdodds.com/blog/colocation): "Place code as close to where it's relevant as possible"                                                                                                                              | 2026-10-24 |
+| Promote on the second consumer | [Wieruch, React Folder Structure](https://www.robinwieruch.de/react-folder-structure/): "if exactly one feature uses a util, it lives inside that feature", and "once two or more features need it, it moves up to the shared layer"               | 2026-10-24 |
+| Imports flow one way           | [bulletproof-react, Project Structure](https://github.com/alan2207/bulletproof-react/blob/master/docs/project-structure.md): "the code should flow in one direction, from shared parts of the code to the application (shared -> features -> app)" | 2026-10-24 |
+
+## State the reason on every new path
+
+| Bullet                                | Source                                                                                                                                                                | Read       |
+| ------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| A one-clause reason per new path      | House choice: a worker copies the path a plan gives it, so a path with no stated reason lands beside its nearest neighbor and the plan's placement call is never made | 2026-10-24 |
+| Name a new folder where it is created | House choice: a folder the plan leaves implied is inferred by the worker, who drops the file in the nearest existing folder instead                                   | 2026-10-24 |
+
+## Read the reference for the category
+
+| Bullet                     | Source                                                                                                                                                                        | Read       |
+| -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| Interface source reference | House choice: an interface file placed without `frontend.md` lands in the shared `components/` or `lib/` folder whatever its consumer, the flat growth that reference records | 2026-10-24 |
+| Test file reference        | House choice: a test helper placed without `tests.md` lands beside the specs it serves, so the end to end folder stops holding one role                                       | 2026-10-24 |

package/governance/ledger/skills/codebase-layout/frontend.md

@@ -0,0 +1,62 @@
+---
+title: Frontend layout reference ledger
+description: Sources for claude/skills/codebase-layout/references/frontend.md, one row per bullet
+---
+
+# Frontend layout reference ledger
+
+The field is interface source organization. bulletproof-react carries feature folders and the import direction, Robin Wieruch carries the levels and the promotion rule, and the Next.js docs carry routing. Each row cites the bullet's own inline link where the reference carries one.
+
+The worked failure reports what one project's folders did, so its rows are house choices naming the failure the incident shows rather than outside citations.
+
+## Feature folders against shared UI
+
+| Bullet                                  | Source                                                                                                                                                                                                                                                  | Read       |
+| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| One feature's code under its folder     | [bulletproof-react, Project Structure](https://github.com/alan2207/bulletproof-react/blob/master/docs/project-structure.md): "organize most of the code within the features folder", and "Only include the ones that are necessary for the feature."    | 2026-10-24 |
+| Shared `components/` for two features   | [bulletproof-react, Project Structure](https://github.com/alan2207/bulletproof-react/blob/master/docs/project-structure.md): `components` holds "shared components used across the entire application"                                                  | 2026-10-24 |
+| One feature's component is feature code | [Wieruch, React Folder Structure](https://www.robinwieruch.de/react-folder-structure/): feature components "are often only used once in a React project", while generic UI components "are used by more than one component"                             | 2026-10-24 |
+| No feature imports another              | [bulletproof-react, Project Structure](https://github.com/alan2207/bulletproof-react/blob/master/docs/project-structure.md): "It might not be a good idea to import across the features. Instead, compose different features at the application level." | 2026-10-24 |
+| Enforce the flow with an import lint    | [bulletproof-react, Project Structure](https://github.com/alan2207/bulletproof-react/blob/master/docs/project-structure.md): "To forbid cross-feature imports, you can use ESLint", through `import/no-restricted-paths`                                | 2026-10-24 |
+
+## Grow in levels
+
+| Bullet                          | Source                                                                                                                                                                                                                                                    | Read       |
+| ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| Start flat                      | [React, File Structure](https://legacy.reactjs.org/docs/faq-structure.html): "If you feel completely stuck, start by keeping all files in a single folder. Eventually it will grow large enough that you will want to separate some files from the rest." | 2026-10-24 |
+| The next level on a named event | [Wieruch, React Folder Structure](https://www.robinwieruch.de/react-folder-structure/): "The day the customer feature needs it too, it moves up to the top-level hooks/ folder."                                                                          | 2026-10-24 |
+| One level per change            | House choice: a plan that jumps from flat to a full feature tree rewrites every import in the project in one diff no review can follow                                                                                                                    | 2026-10-24 |
+
+## Routes
+
+| Bullet                                    | Source                                                                                                                                                                                                                                      | Read       |
+| ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| The router's own conventions first        | [Next.js, Project structure](https://nextjs.org/docs/app/getting-started/project-structure): the page gives "an overview of all the folder and file conventions in Next.js, and recommendations for organizing your project"                | 2026-10-24 |
+| An unopinionated framework leaves it open | [Next.js, Project structure](https://nextjs.org/docs/app/getting-started/project-structure): "Next.js is unopinionated about how you organize and colocate your project files."                                                             | 2026-10-24 |
+| One strategy, kept consistent             | [Next.js, Project structure](https://nextjs.org/docs/app/getting-started/project-structure): "choose a strategy that works for you and your team and be consistent across the project"                                                      | 2026-10-24 |
+| A route's component in a private folder   | [Next.js, Project structure](https://nextjs.org/docs/app/getting-started/project-structure): private folders "colocate non-routable files", as `app/blog/_components/Post.tsx` is marked "Not routable" and a "safe place for UI utilities" | 2026-10-24 |
+| `components` and `lib` are placeholders   | [Next.js, Project structure](https://nextjs.org/docs/app/getting-started/project-structure): "we're using components and lib folders as generalized placeholders, their naming has no special framework significance"                       | 2026-10-24 |
+
+## Hooks and helpers
+
+| Bullet                                  | Source                                                                                                                                                                                             | Read       |
+| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| One feature's hook inside it            | [Wieruch, React Folder Structure](https://www.robinwieruch.de/react-folder-structure/): "A hook that only the project feature uses lives inside features/project/hooks/ ."                         | 2026-10-24 |
+| Promote on the second feature           | [Wieruch, React Folder Structure](https://www.robinwieruch.de/react-folder-structure/): "once two or more features need it, it moves up to the shared layer"                                       | 2026-10-24 |
+| Split a shared `lib/` holding two roles | [Martin, The Single Responsibility Principle](https://blog.cleancoder.com/uncle-bob/2014/05/08/SingleReponsibilityPrinciple.html): "Separate those things that change for different reasons."      | 2026-10-24 |
+| A helper named for what it does         | [Gerrand, Package names](https://go.dev/blog/package-names): "Avoid meaningless package names. Packages named util , common , or misc provide clients with no sense of what the package contains." | 2026-10-24 |
+
+## Fixtures and sample data
+
+| Bullet                            | Source                                                                                                                                                      | Read       |
+| --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| Fixtures beside their feature     | [Dodds, Colocation](https://kentcdodds.com/blog/colocation): "Things that change together should be located as close as reasonable."                        | 2026-10-24 |
+| Promote a fixture on two features | House choice: a fixture moved to shared code for one feature's tests drifts from that feature, and the next change to it lands far from the tests it breaks | 2026-10-24 |
+
+## A worked failure
+
+| Bullet                                        | Source                                                                                                                                                               | Read       |
+| --------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| The rules said split, and nobody applied them | House choice: a rule loaded beside a plan that names every file as a sibling of the last loses to the plan, so placement has to be decided where the path is written | 2026-10-24 |
+| The split touched 98 files                    | House choice: a split put off until a folder overflows touches every import of every file in it, and a folder left without a placement rule grows flat again         | 2026-10-24 |
+| A named subfolder at the twelfth file         | House choice: the cost of placement grows with the folder, so the cheapest split is the one a plan names when the second role's first file arrives                   | 2026-10-24 |

package/governance/ledger/skills/codebase-layout/tests.md

@@ -0,0 +1,26 @@
+---
+title: Test layout reference ledger
+description: Sources for claude/skills/codebase-layout/references/tests.md, one row per bullet
+---
+
+# Test layout reference ledger
+
+The field is test file organization. Kent C. Dodds carries colocating a test with its module, and Playwright's fixtures and page object docs carry the split between specs and support. The reference's worked failure is prose rather than bullets, so it takes no table.
+
+## Unit and component tests
+
+| Bullet                                | Source                                                                                                                                                                                                                                      | Read       |
+| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| A test beside its module              | [Dodds, Colocation](https://kentcdodds.com/blog/colocation): "we should co-locate our tests files with the file or group of files they are testing"                                                                                         | 2026-10-24 |
+| The test moves with the module        | [Dodds, Colocation](https://kentcdodds.com/blog/colocation): with a mirrored tree, "We'd move or delete a src/ file without updating the corresponding" file beside it, and "All the pitfalls described above apply here as well" for tests | 2026-10-24 |
+| A one-file factory stays in that file | [Wieruch, React Folder Structure](https://www.robinwieruch.de/react-folder-structure/): "if exactly one feature uses a util, it lives inside that feature", and "once two or more features need it, it moves up to the shared layer"        | 2026-10-24 |
+
+## End to end tests
+
+| Bullet                                  | Source                                                                                                                                                                                                                                               | Read       |
+| --------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| Only specs in the runner's folder       | House choice: support code among the specs gives a new spec no single place to find its setup, and the next helper lands beside the others                                                                                                           | 2026-10-24 |
+| One merged fixtures module              | [Playwright, Fixtures](https://playwright.dev/docs/test-fixtures): an extended test "can be used in multiple test files, and each of them will get the fixtures", and `mergeTests` combines "test fixtures from multiple files or modules"           | 2026-10-24 |
+| Each page object its own module         | [Playwright, Fixtures](https://playwright.dev/docs/test-fixtures) imports each page object from its own module, as `TodoPage` from `./todo-page`, and [page object models](https://playwright.dev/docs/pom) capture "element selectors in one place" | 2026-10-24 |
+| Support in its own folder, named by use | House choice: a single `helpers` file every spec imports grows into a bucket naming no role, the fault the body's naming rule forbids for any folder                                                                                                 | 2026-10-24 |
+| Group specs by journey once they mix    | House choice: specs for two journeys in one folder hold two roles, so a reader finds a journey's specs only by opening each file                                                                                                                     | 2026-10-24 |

package/governance/ledger/skills/review-craft/SKILL.md

@@ -0,0 +1,61 @@
+---
+title: Review craft skill ledger
+description: Sources for claude/skills/review-craft/SKILL.md, one row per bullet or ordered step in its concern groups
+---
+
+# Review craft skill ledger
+
+The field is code review. Google's reviewer guide carries the axes, Parnas, Ousterhout, and Beck as Fowler records him carry the design walk, and the skills pinned at `addyosmani/agent-skills@2686b620` carry the bar, performance, and scope checks.
+
+Steps 4, 5, and 8 of the walk have no source in the skill's `adopted.md`, so their rows cite Fowler's FlagArgument with Refactoring Guru's Message Chains, Martin's Single Responsibility Principle post, and Cockburn's Hexagonal Architecture.
+
+The proof ladder and the evidence bar are this toolkit's own, so their rows name the failure each prevents. Closing sections and `## What this delegates` restate these rules or route, so they take no table.
+
+Parnas's paper refused a read at its ACM DOI, `10.1145/361598.361623`, so the rows quote an open copy of the same paper.
+
+## Open with the one fact the change's safety rests on
+
+| Bullet         | Source                                                                                                                        | Read       |
+| -------------- | ----------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| Asserted       | House choice: a risky claim taken on the description's word merges unproven, since nothing marks it as the weakest proof      | 2026-10-24 |
+| Pointed at     | House choice: a claim naming its test reads as proven when nobody opened the test, so naming the code is its own lower rung   | 2026-10-24 |
+| Walked through | House choice: reasoning that traces the path still misses the input it never imagined, so it ranks below a test that runs     | 2026-10-24 |
+| Tested         | House choice: a claim with no failing test regresses silently on the next change, so a test in the diff outranks any argument | 2026-10-24 |
+| Reproduced     | House choice: a test can pass on a stubbed path, so a recorded run of the real thing is the one rung above it                 | 2026-10-24 |
+
+## Read the axes in this order
+
+| Bullet                                    | Source                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | Read       |
+| ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| Design and scope                          | [Google, What to look for in a code review](https://google.github.io/eng-practices/review/reviewer/looking-for.html): "The most important thing to cover in a review is the overall design of the CL", and "Reviewers should be especially vigilant about over-engineering"                                                                                                                                                                                                                   | 2026-10-24 |
+| Correctness and edge cases                | [Google, What to look for in a code review](https://google.github.io/eng-practices/review/reviewer/looking-for.html): "you should still be thinking about edge cases, looking for concurrency problems, trying to think like a user"                                                                                                                                                                                                                                                          | 2026-10-24 |
+| What breaks outside the diff              | [Google, What to look for in a code review](https://google.github.io/eng-practices/review/reviewer/looking-for.html): "Sometimes you have to look at the whole file to be sure that the change actually makes sense", and a change that "deletes or deprecates code" asks "whether the documentation should also be deleted"                                                                                                                                                                  | 2026-10-24 |
+| Tests                                     | [Google, What to look for in a code review](https://google.github.io/eng-practices/review/reviewer/looking-for.html): "Will the tests actually fail when the code is broken?"                                                                                                                                                                                                                                                                                                                 | 2026-10-24 |
+| Guard the bar                             | [agent-skills, constraint-driven-development](https://github.com/addyosmani/agent-skills/blob/2686b620fc1fed2e8f60c704839c766b8594c6b6/skills/constraint-driven-development/SKILL.md): it watches the diff for a weakened bar, being "new @ts-ignore or eslint-disable suppressions, skipped or deleted tests, assertions stripped out, unimplemented stubs, thresholds edited down"                                                                                                          | 2026-10-24 |
+| Performance                               | [agent-skills, code-review-and-quality](https://github.com/addyosmani/agent-skills/blob/2686b620fc1fed2e8f60c704839c766b8594c6b6/skills/code-review-and-quality/SKILL.md): "Any N+1 query patterns?", "Any unbounded loops or unconstrained data fetching?", "Any missing pagination on list endpoints?"                                                                                                                                                                                      | 2026-10-24 |
+| Security                                  | [agent-skills, security-and-hardening](https://github.com/addyosmani/agent-skills/blob/2686b620fc1fed2e8f60c704839c766b8594c6b6/skills/security-and-hardening/SKILL.md): "Where does untrusted data cross into your system?", asked before any control is checked                                                                                                                                                                                                                             | 2026-10-24 |
+| Rendered output                           | [Google, What to look for in a code review](https://google.github.io/eng-practices/review/reviewer/looking-for.html): a UI change is when checking behavior matters most, since "It's hard to understand how some changes will impact a user when you're just reading the code"                                                                                                                                                                                                               | 2026-10-24 |
+| Developer experience and operations       | [Google, What to look for in a code review](https://google.github.io/eng-practices/review/reviewer/looking-for.html): "If a CL changes how users build, test, interact with, or release code, check to see that it also updates associated documentation"                                                                                                                                                                                                                                     | 2026-10-24 |
+| Executable prose                          | House choice: a skill body or rule is run by a model with no reviewer in the loop, so a race, an unstated precondition, or a contradiction between two steps ships as a bug that no test of the code catches                                                                                                                                                                                                                                                                                  | 2026-10-24 |
+| Name the next change and count its reach  | [Parnas, On the Criteria To Be Used in Decomposing Systems into Modules](https://www.win.tue.nl/~wstomv/edu/2ip30/references/criteria_for_modularization.pdf): "one begins with a list of difficult design decisions or design decisions which are likely to change"                                                                                                                                                                                                                          | 2026-10-24 |
+| State what each unit hides                | [Ousterhout and Martin, A Philosophy of Software Design vs Clean Code](https://github.com/johnousterhout/aposd-vs-clean-code): "I call these interfaces 'shallow': they don't help much in terms of reducing what the programmer needs to know"                                                                                                                                                                                                                                               | 2026-10-24 |
+| Each rule or constant in one place        | [Fowler, BeckDesignRules](https://martinfowler.com/bliki/BeckDesignRules.html): Beck's rules include "No duplication", and the code "Has no duplicated logic"                                                                                                                                                                                                                                                                                                                                 | 2026-10-24 |
+| Flag parameters, chains, and global state | [Fowler, FlagArgument](https://martinfowler.com/bliki/FlagArgument.html): "A flag argument is a kind of function argument that tells the function to carry out a different operation depending on its value", and [Refactoring Guru, Message Chains](https://refactoring.guru/smells/message-chains): "the client is dependent on navigation along the class structure". House choice for global state: a read or write of it couples every caller to an order nothing in the signature shows | 2026-10-24 |
+| One reason to change per file             | [Martin, The Single Responsibility Principle](https://blog.cleancoder.com/uncle-bob/2014/05/08/SingleReponsibilityPrinciple.html): "Gather together the things that change for the same reasons. Separate those things that change for different reasons."                                                                                                                                                                                                                                    | 2026-10-24 |
+| List the hidden inputs                    | House choice: code reading the clock, the environment, the filesystem, or a random source runs differently in a test than in use, so its tests flake or fake the input and its reuse breaks on the next machine                                                                                                                                                                                                                                                                               | 2026-10-24 |
+| Match each pattern to a problem today     | [Fowler, BeckDesignRules](https://martinfowler.com/bliki/BeckDesignRules.html): the last rule, "Fewest elements", so the code "Has the fewest possible classes and methods"                                                                                                                                                                                                                                                                                                                   | 2026-10-24 |
+| Domain rules apart from data in and out   | [Cockburn, Hexagonal Architecture](https://alistair.cockburn.us/hexagonal-architecture/): an application "developed and tested in isolation from its eventual run-time devices and databases"                                                                                                                                                                                                                                                                                                 | 2026-10-24 |
+| Names, literals, dropped errors, effects  | [Google, What to look for in a code review](https://google.github.io/eng-practices/review/reviewer/looking-for.html): "Did the developer pick good names for everything?"                                                                                                                                                                                                                                                                                                                     | 2026-10-24 |
+| Name the split of two concerns            | [Google, Small CLs](https://google.github.io/eng-practices/review/developer/small-cls.html): "the right size for a CL is one self-contained change", one that "addresses just one thing"                                                                                                                                                                                                                                                                                                      | 2026-10-24 |
+| Count concepts before and after           | [agent-skills, code-review-and-quality](https://github.com/addyosmani/agent-skills/blob/2686b620fc1fed2e8f60c704839c766b8594c6b6/skills/code-review-and-quality/SKILL.md): "Does this refactor reduce complexity or just relocate it? Count the concepts a reader must hold to follow the change."                                                                                                                                                                                            | 2026-10-24 |
+| Say why removed code existed              | [agent-skills, code-simplification](https://github.com/addyosmani/agent-skills/blob/2686b620fc1fed2e8f60c704839c766b8594c6b6/skills/code-simplification/SKILL.md): "Before changing or removing anything, understand why it exists", and "Check git blame"                                                                                                                                                                                                                                    | 2026-10-24 |
+
+## Hold every finding to the evidence bar
+
+| Bullet                            | Source                                                                                                                                                                                                                              | Read       |
+| --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| Confirm against the reviewed head | [Google, What to look for in a code review](https://google.github.io/eng-practices/review/reviewer/looking-for.html): "Usually the code review tool will only show you a few lines of code around the parts that are being changed" | 2026-10-24 |
+| Quote the rule cited              | House choice: a finding citing a rule by name alone sends the author to find it first, and a paraphrase drifts from what the rule says                                                                                              | 2026-10-24 |
+| Name the input that breaks        | House choice: a finding with no failing input cannot be reproduced or refuted, so the author either guesses at a fix or dismisses a real bug                                                                                        | 2026-10-24 |
+| Drop what a gate already owns     | House choice: a review restating a linter or a type error reports it with less certainty than the gate, and the noise buries the findings only a reader can make                                                                    | 2026-10-24 |
+| Drop what rests on unread state   | House choice: a finding about state the reviewer never opened is a guess posted as a fact, and the author spends a round disproving it                                                                                              | 2026-10-24 |

package/governance/ledger/skills/review-craft/security.md

@@ -0,0 +1,34 @@
+---
+title: Review craft security ledger
+description: Sources for claude/skills/review-craft/references/security.md, one row per bullet
+---
+
+# Review craft security ledger
+
+The field is application security review. MITRE's CWE entries name each weakness, ShellCheck carries the shell fixes, npm's own docs and Snyk's lockfile write-up carry the supply chain, and Anthropic's security review action pinned at `anthropics/claude-code-security-review@0c6a49f1` carries the exclusions.
+
+The threat model section and the classes stated as prose carry no bullet, so they take no row.
+
+## Classes to check
+
+| Bullet                               | Source                                                                                                                                                                                                                                                                        | Read       |
+| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| The paths into a shell               | [CWE-78, OS Command Injection](https://cwe.mitre.org/data/definitions/78.html): "The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements"    | 2026-10-24 |
+| Quoting at the call site             | [ShellCheck, SC2086](https://github.com/koalaman/shellcheck/wiki/SC2086): "Double quote to prevent globbing and word splitting."                                                                                                                                              | 2026-10-24 |
+| An empty value collapsing to a root  | [ShellCheck, SC2115](https://github.com/koalaman/shellcheck/wiki/SC2115): "Use `\"${var:?}\"` to ensure this never expands to `/*`", against `rm -rf "$STEAMROOT/"*`                                                                                                          | 2026-10-24 |
+| A glob or symlink carrying it out    | [CWE-59, Link Following](https://cwe.mitre.org/data/definitions/59.html): "does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource"                                                                               | 2026-10-24 |
+| No check one level below a root      | [agent-skills, security-and-hardening](https://github.com/addyosmani/agent-skills/blob/2686b620fc1fed2e8f60c704839c766b8594c6b6/skills/security-and-hardening/SKILL.md): the resolved target "sits under an allowlisted root", and "it is at least one level below that root" | 2026-10-24 |
+| No read of what is there             | [agent-skills, security-and-hardening](https://github.com/addyosmani/agent-skills/blob/2686b620fc1fed2e8f60c704839c766b8594c6b6/skills/security-and-hardening/SKILL.md): the target "carries ownership evidence read before the operation"                                    | 2026-10-24 |
+| Name the class whose fix applies     | House choice: one bug filed under two classes gets two fixes or neither, so the finding names the class whose fix the author applies                                                                                                                                          | 2026-10-24 |
+| Unpinned one-shot package execution  | [npm, npx](https://docs.npmjs.com/cli/v10/commands/npx): a package "not present in the local project dependencies" is installed to the npm cache and run, so an unpinned name runs whatever the registry serves                                                               | 2026-10-24 |
+| A new dependency's install scripts   | [npm, scripts](https://docs.npmjs.com/cli/v10/using-npm/scripts): its life cycle order runs `preinstall`, `install`, and `postinstall` on `npm install`                                                                                                                       | 2026-10-24 |
+| A lockfile changing with no manifest | [Snyk, Why npm lockfiles can be a security blindspot](https://snyk.io/blog/why-npm-lockfiles-can-be-a-security-blindspot-for-injecting-malicious-modules/): an install "will consult the lockfile as the primary source of truth for package versions and their sources"      | 2026-10-24 |
+
+## Excluded
+
+| Bullet                                   | Source                                                                                                                                                                                                                                                                                  | Read       |
+| ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| Denial of service and exhaustion         | [Anthropic, claude-code-security-review prompts](https://github.com/anthropics/claude-code-security-review/blob/0c6a49f1fa56a1d472575da86a94dbc1edb78eda/claudecode/prompts.py): "Denial of Service (DOS) vulnerabilities or resource exhaustion attacks", and "Rate limiting concerns" | 2026-10-24 |
+| Generic input validation                 | [Anthropic, claude-code-security-review prompts](https://github.com/anthropics/claude-code-security-review/blob/0c6a49f1fa56a1d472575da86a94dbc1edb78eda/claudecode/prompts.py): "If there isn't a proven problem from a lack of input validation, don't report it."                    | 2026-10-24 |
+| Open redirects                           | [Anthropic, claude-code-security-review findings filter](https://github.com/anthropics/claude-code-security-review/blob/0c6a49f1fa56a1d472575da86a94dbc1edb78eda/claudecode/findings_filter.py): drops a finding as "Open redirect vulnerability (not high impact)"                     | 2026-10-24 |
+| A theoretical attack needing access held | [Anthropic, claude-code-security-review prompts](https://github.com/anthropics/claude-code-security-review/blob/0c6a49f1fa56a1d472575da86a94dbc1edb78eda/claudecode/prompts.py): "Skip theoretical issues, style concerns, or low-impact findings"                                      | 2026-10-24 |

package/governance/ledger/skills/teach-craft/SKILL.md

@@ -0,0 +1,33 @@
+---
+title: Teach craft skill ledger
+description: Sources for claude/skills/teach-craft/SKILL.md, one row per bullet in its concern groups
+---
+
+# Teach craft skill ledger
+
+The field is learning science, and the papers are the ones `adopted.md` opened through PubMed. Each row links the abstract page and quotes only what that abstract carries. The house choices stand where `adopted.md` lists a rule as house judgment, and each row names the failure the rule prevents.
+
+The closing sections and `## What this delegates` restate these rules or route, so they take no table.
+
+## References
+
+| Bullet            | Source                                                                                                                         | Read       |
+| ----------------- | ------------------------------------------------------------------------------------------------------------------------------ | ---------- |
+| `pedagogy.md`     | House choice: a session picking the next topic from the body alone skips the spacing ladder and the placement rules it carries | 2026-10-24 |
+| `lesson-craft.md` | House choice: a quiz written without the construction rules leaks its answer through option length or slot                     | 2026-10-24 |
+
+## Before teaching
+
+| Bullet                                | Source                                                                                                                                                                  | Read       |
+| ------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| Ask what the learner already knows    | House choice: a lesson pitched from an assumed floor either repeats what the learner holds or skips what they lack                                                      | 2026-10-24 |
+| Read the subject from sources         | House choice: a claim taught from recall is confident where it is wrong, and a learner has no way to audit it                                                           | 2026-10-24 |
+| Open a returning learner on retrieval | [Roediger and Karpicke 2006, Test-enhanced learning](https://pubmed.ncbi.nlm.nih.gov/16507066/): "prior testing produced substantially greater retention than studying" | 2026-10-24 |
+
+## While teaching
+
+| Bullet                            | Source                                                                                                                                                                                                                                                                                                                                                                                                                      | Read       |
+| --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| Place each step just past unaided | House choice: a step inside what the learner can already do is review, and one far past it leaves the support doing the whole task                                                                                                                                                                                                                                                                                          | 2026-10-24 |
+| Carry a quiz and a teach-back     | [Pashler et al. 2007, IES practice guide](https://ies.ed.gov/ncee/wwc/Docs/PracticeGuide/20072004.pdf): "Use quizzing with active retrieval of information at all phases of the learning process", and [Nestojko et al. 2014, Expecting to teach](https://pubmed.ncbi.nlm.nih.gov/24845756/) backs the teach-back: "Participants expecting to teach produced more complete and better organized free recall of the passage" | 2026-10-24 |
+| Record the wrong answer itself    | House choice: a score tells the next session that the learner missed and not what they believe, so it places them from a count rather than the misconception                                                                                                                                                                                                                                                                | 2026-10-24 |

package/governance/ledger/skills/teach-craft/lesson-craft.md

@@ -0,0 +1,47 @@
+---
+title: Teach craft lesson craft ledger
+description: Sources for claude/skills/teach-craft/references/lesson-craft.md, one row per bullet
+---
+
+# Teach craft lesson craft ledger
+
+The reference names Butler and Roediger 2008 for feedback, Kornell, Hays and Bjork 2009 for its timing, and Nestojko et al. 2014 for the teach-back. Each row links the PubMed abstract `adopted.md` opened and quotes only that abstract.
+
+Restraint and what makes a lesson worth returning to are editorial calls about a page, so their rows are house choices naming the failure each prevents. `## Contents` takes no table.
+
+## Restraint
+
+| Bullet                                   | Source                                                                                                                       | Read       |
+| ---------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| Cut decoration carrying nothing          | House choice: an ornament competes with the material for the learner's attention and teaches nothing in return               | 2026-10-24 |
+| One accent color, for the action         | House choice: a second accent splits what the eye goes to first, so the thing the learner acts on stops standing out         | 2026-10-24 |
+| No animation the learner did not trigger | House choice: motion the learner did not start pulls the eye off the line they are reading                                   | 2026-10-24 |
+| Whitespace over rules and boxes          | House choice: rules and boxes add marks the reader has to skip, and stacked boxes read as nesting the material does not have | 2026-10-24 |
+
+## Quiz design
+
+| Bullet                                 | Source                                                                                                                                                                                                                                  | Read       |
+| -------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| Every option the same length           | House choice: a longer option reads as the considered one, so a learner picks it by length and the quiz measures test-taking                                                                                                            | 2026-10-24 |
+| Rotate the correct slot by number      | House choice: an author varying the slot by judgment settles on the first one, and a learner who notices answers by position                                                                                                            | 2026-10-24 |
+| Each wrong option a held misconception | House choice: an option nobody believes removes itself, so a four-option question shrinks to fewer and passes a guess                                                                                                                   | 2026-10-24 |
+| One feedback block per question        | [Butler and Roediger 2008, Feedback and multiple-choice testing](https://pubmed.ncbi.nlm.nih.gov/18491500/): "The selection of lures can lead students to acquire false knowledge", and feedback "reduced the proportion of intrusions" | 2026-10-24 |
+| Feedback after the attempt             | [Kornell, Hays and Bjork 2009, Unsuccessful retrieval attempts enhance subsequent learning](https://pubmed.ncbi.nlm.nih.gov/19586265/): "participants attempted to answer the question before being shown the answer"                   | 2026-10-24 |
+
+## Teach back
+
+| Bullet                                  | Source                                                                                                                                                                                          | Read       |
+| --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| Explain to a named audience             | [Nestojko et al. 2014, Expecting to teach](https://pubmed.ncbi.nlm.nih.gov/24845756/): "Participants expecting to teach produced more complete and better organized free recall of the passage" | 2026-10-24 |
+| Ask about what the lesson was for       | House choice: a teach-back on a detail beside the point tests attention, so the learner passes it without holding the material                                                                  | 2026-10-24 |
+| A hidden self-check of what to cover    | House choice: a learner alone cannot grade their own explanation, and a check shown beside the ask leaks what to say                                                                            | 2026-10-24 |
+| The self-check as coverage, not a model | House choice: a model answer is read instead of produced, which turns the teach-back back into reading                                                                                          | 2026-10-24 |
+
+## What makes a lesson worth returning to
+
+| Bullet                            | Source                                                                                                                            | Read       |
+| --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| The worked example is complete    | House choice: a fragment forces a returning reader to rebuild the rest from memory, which is the work they came back to avoid     | 2026-10-24 |
+| The lesson states what it assumes | House choice: a reader who cannot tell whether they hold the prerequisites reads on and fails at a step they were never ready for | 2026-10-24 |
+| The hard part is named as hard    | House choice: material flattened to one difficulty gives a returning reader nothing to navigate by, so they reread all of it      | 2026-10-24 |
+| Nothing depends on the session    | House choice: a lesson pointing at what was discussed loses its meaning once that conversation is gone, often within a week       | 2026-10-24 |

package/governance/ledger/skills/teach-craft/pedagogy.md

@@ -0,0 +1,77 @@
+---
+title: Teach craft pedagogy ledger
+description: Sources for claude/skills/teach-craft/references/pedagogy.md, one row per bullet or ordered step
+---
+
+# Teach craft pedagogy ledger
+
+The field is learning science. Each paper row links the PubMed abstract `adopted.md` opened and quotes only that abstract, and the IES practice guide rows quote the guide's PDF.
+
+The reference labels the rest as house judgment, being the ladder, production over selection, the zone of proximal development, and the sourcing rules, so those rows name the failure each prevents. `## Contents` takes no table.
+
+## Fluency is not storage strength
+
+| Bullet                                  | Source                                                                                                                                                                                                                | Read       |
+| --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| Confidence is evidence about the lesson | [Roediger and Karpicke 2006, Test-enhanced learning](https://pubmed.ncbi.nlm.nih.gov/16507066/): testing won "even though repeated studying increased students' confidence in their ability to remember the material" | 2026-10-24 |
+| Advance on an unaided retrieval         | [Roediger and Karpicke 2006, Test-enhanced learning](https://pubmed.ncbi.nlm.nih.gov/16507066/): "When the final test was given after 5 min, repeated studying improved recall relative to repeated testing"          | 2026-10-24 |
+
+## Retrieval practice
+
+| Bullet                                      | Source                                                                                                                                                                                                     | Read       |
+| ------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| Ask before telling                          | [Kornell, Hays and Bjork 2009, Unsuccessful retrieval attempts](https://pubmed.ncbi.nlm.nih.gov/19586265/): "participants attempted to answer the question before being shown the answer"                  | 2026-10-24 |
+| Production over selection                   | House choice: a learner picking from four options can pass on recognition alone, so the lesson reports a retrieval the learner cannot do unprompted                                                        | 2026-10-24 |
+| Let the attempt fail before correcting      | [Kornell, Hays and Bjork 2009, Unsuccessful retrieval attempts](https://pubmed.ncbi.nlm.nih.gov/19586265/): "Unsuccessful retrieval attempts enhanced learning with both types of materials"               | 2026-10-24 |
+| No cue in the question                      | House choice: a question restating the material can be answered by reading it, so it measures reading and reports memory                                                                                   | 2026-10-24 |
+| Which rules rest on Kornell, Hays and Bjork | [Kornell, Hays and Bjork 2009, Unsuccessful retrieval attempts](https://pubmed.ncbi.nlm.nih.gov/19586265/): the read-only condition it beat is one where "the question and answer were presented together" | 2026-10-24 |
+| A teach-back block in every lesson          | [Nestojko et al. 2014, Expecting to teach](https://pubmed.ncbi.nlm.nih.gov/24845756/): "Participants expecting to teach produced more complete and better organized free recall of the passage"            | 2026-10-24 |
+| Name the explanation's audience             | [Nestojko et al. 2014, Expecting to teach](https://pubmed.ncbi.nlm.nih.gov/24845756/): the gain came to "Participants expecting to teach", against "participants expecting a test"                         | 2026-10-24 |
+| Record what the explanation left out        | House choice: a missed production filed apart from a missed selection splits one placement input, so the next session places the learner from half of it                                                   | 2026-10-24 |
+
+## Spacing
+
+| Bullet                                    | Source                                                                                                                                                                                               | Read       |
+| ----------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| Revisit once forgetting has begun         | [Pashler et al. 2007, IES practice guide](https://ies.ed.gov/ncee/wwc/Docs/PracticeGuide/20072004.pdf): key content seen on two occasions "separated by a period of several weeks to several months" | 2026-10-24 |
+| Widen the gap on a hit, shorten on a miss | House choice: a fixed gap keeps reviewing what the learner holds and leaves what they keep missing to fade between sessions                                                                          | 2026-10-24 |
+| Name the revisit in the record            | House choice: a next session with no schedule in the record picks its revisit by guess, and the spacing the ladder sets is lost                                                                      | 2026-10-24 |
+| Apply the ladder as written               | House choice: an author told to widen a gap by judgment settles on whatever feels right, so two sessions space one topic differently                                                                 | 2026-10-24 |
+
+## Interleaving
+
+| Bullet                                      | Source                                                                                                                                                                                                                     | Read       |
+| ------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| Mix topics once each has a foothold         | House choice, extending Kornell and Bjork's exemplars to topics: a session finishing one topic before the next never makes the learner work out which approach a problem calls for                                         | 2026-10-24 |
+| Keep a mixed set close enough to tell apart | [Kornell and Bjork 2008, Learning concepts and categories](https://pubmed.ncbi.nlm.nih.gov/18578849/): a given artist's paintings "presented consecutively (massed) or interleaved with other artists' paintings (spaced)" | 2026-10-24 |
+| Never interleave an unseen topic            | House choice: telling two things apart needs something on each side, so mixing in a topic never taught leaves the learner guessing rather than discriminating                                                              | 2026-10-24 |
+
+## The zone of proximal development
+
+| Bullet                                            | Source                                                                                                                                                            | Read       |
+| ------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| Compute the band from the records                 | House choice: a band taken from the subject's own order teaches the next chapter whatever the learner got wrong last time                                         | 2026-10-24 |
+| Target the first thing not done unaided           | House choice: a target picked past the first miss builds on a step the learner cannot yet do, so the support carries the task                                     | 2026-10-24 |
+| Withdraw support on success, restore it on a miss | House choice: support left in place after a success carries a task the learner can now do alone, and repeating the lesson on a miss restarts what was nearly held | 2026-10-24 |
+| Ask where the records show nothing                | House choice: a guessed starting point misses in both directions, either reviewing what is held or skipping what is not                                           | 2026-10-24 |
+
+## Where difficulty helps and where it hurts
+
+| Bullet                                   | Source                                                                                                                                                                                                                                           | Read       |
+| ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------- |
+| New material in its clearest form        | [Pashler et al. 2007, IES practice guide](https://ies.ed.gov/ncee/wwc/Docs/PracticeGuide/20072004.pdf): students "learn more by alternating between studying examples of worked-out problem solutions and solving similar problems on their own" | 2026-10-24 |
+| Add difficulty once practicing           | [Kornell, Hays and Bjork 2009, Unsuccessful retrieval attempts](https://pubmed.ncbi.nlm.nih.gov/19586265/): "Unsuccessful retrieval attempts enhanced learning with both types of materials"                                                     | 2026-10-24 |
+| A hard explanation is not a hard problem | House choice: a confusing explanation adds load the learner spends decoding the teacher, so the difficulty teaches nothing about the material                                                                                                    | 2026-10-24 |
+
+## Sourcing
+
+| Bullet                                   | Source                                                                                                                                                  | Read       |
+| ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
+| Read the subject from sources first      | House choice: parametric recall is confident where it is wrong, and a learner cannot audit a claim nobody read                                          | 2026-10-24 |
+| Mark a claim resting on recall           | House choice: an unmarked recalled claim reads with the authority of a sourced one, so the learner trusts the part most likely to be wrong              | 2026-10-24 |
+| A source not opened is a lead            | House choice: a citation to a page nobody read can say the opposite of the claim, and the link makes the claim look checked                             | 2026-10-24 |
+| The highest rung covering the claim      | House choice: a claim resting on a tutorial when the owner's docs cover it inherits the tutorial's errors and its age                                   | 2026-10-24 |
+| No personal or employer proof            | House choice: one project or one employer's practice stands for a general rule only by accident, so a lesson built on it teaches a local habit as a law | 2026-10-24 |
+| Owner documentation or specification     | House choice: the owner's own docs track the current version, so a claim read anywhere lower drifts the first time the subject changes                  | 2026-10-24 |
+| A canonical work                         | House choice: a subject nobody owns has no docs to rank first, so the standard text or primary paper is the most checked source left                    | 2026-10-24 |
+| Other material, recorded with its reason | House choice: a third-rung source recorded without why no higher rung covers the claim cannot be rechecked when a better source appears                 | 2026-10-24 |