@erclx/canon 5.76.0 → 5.78.0

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # Changelog
 
+## [5.78.0](https://github.com/erclx/canon/compare/v5.77.0...v5.78.0) (2026-11-04)
+
+
+### Features
+
+* **capture:** owe a case for every added or altered rendered state ([#2876](https://github.com/erclx/canon/issues/2876)) ([e13daa2](https://github.com/erclx/canon/commit/e13daa25182da60b0654725326fd14d07f56c69d))
+* **gate:** keep long pages, stylesheets, and scripts out of strings ([#2883](https://github.com/erclx/canon/issues/2883)) ([44ca538](https://github.com/erclx/canon/commit/44ca538cbcb982bc10b0964807e8ea319df5dc17))
+* **orchestrate:** check painted pull requests for proof before review ([#2877](https://github.com/erclx/canon/issues/2877)) ([403a80d](https://github.com/erclx/canon/commit/403a80dd0ada3913f4bb7dac1336fc483b53c6e1))
+* **pr:** bind the UI review only on a drivable checklist box ([#2880](https://github.com/erclx/canon/issues/2880)) ([3027274](https://github.com/erclx/canon/commit/3027274a1d97ec0c8016157f7278fc8ff30b4916))
+* **pr:** refuse a lift on a painted path with no capture or waiver ([#2873](https://github.com/erclx/canon/issues/2873)) ([c05036e](https://github.com/erclx/canon/commit/c05036e2929572cd680a9ddc62e4d7e408b55b3a))
+* **take:** align screencast moves to frames and calibrate the lag ([#2882](https://github.com/erclx/canon/issues/2882)) ([5f274b8](https://github.com/erclx/canon/commit/5f274b877a84496831f3db19917b0127aca3ad94))
+* **take:** pace each press and time every zoom to a glide ([#2875](https://github.com/erclx/canon/issues/2875)) ([6319458](https://github.com/erclx/canon/commit/63194586f6e8e0a5566df872a5fbe4197ef7c09a))
+* **ui-film:** add the film craft a launch film reshoot needed ([#2878](https://github.com/erclx/canon/issues/2878)) ([94ac7fc](https://github.com/erclx/canon/commit/94ac7fc2b8e6a3cdf2da67d13dc7d76fb850bc1d))
+
+
+### Bug Fixes
+
+* **take:** clear the cap timers so the command exits with filming ([#2879](https://github.com/erclx/canon/issues/2879)) ([8fefa21](https://github.com/erclx/canon/commit/8fefa21dbf357ab32c688a4dcc2e1c688c25cab2))
+* **take:** encode the reel lossless so a fade leaves no ghost ([#2881](https://github.com/erclx/canon/issues/2881)) ([5cede29](https://github.com/erclx/canon/commit/5cede2913953c3dd041f2fe505565a036c0bb15b))
+
+## [5.77.0](https://github.com/erclx/canon/compare/v5.76.0...v5.77.0) (2026-10-31)
+
+
+### Features
+
+* **targets:** keep only real projects in the target index ([#2867](https://github.com/erclx/canon/issues/2867)) ([340cbff](https://github.com/erclx/canon/commit/340cbff8edda3987af6d4933aa27391e07b312a2))
+* **tooling:** bound and retry the shipped playwright installs ([#2865](https://github.com/erclx/canon/issues/2865)) ([842d5f9](https://github.com/erclx/canon/commit/842d5f957602136d8bbbdfba524fbba1340df76a))
+
+
+### Bug Fixes
+
+* **tooling:** turn off the card toolbar and narrow the exclusion check ([#2864](https://github.com/erclx/canon/issues/2864)) ([188c1e9](https://github.com/erclx/canon/commit/188c1e950c83cd00ad22e07c43d5232bf01e6ad8))
+
 ## [5.76.0](https://github.com/erclx/canon/compare/v5.75.0...v5.76.0) (2026-10-31)
 
 

package/claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "canon",
   "description": "Runs your agent's work and keeps its code good, on one setup for every repo.",
-  "version": "5.76.0",
+  "version": "5.78.0",
   "author": {
     "name": "Eric Le",
     "url": "https://github.com/erclx"

package/claude/skills/auto-ship/references/ui-checklist.md

@@ -14,10 +14,18 @@ The chain continues to Step 6 here in every run, dispatched or hand-run, since t
 Count two things in `.canon/tmp/handoff/ui-checklist/<slug>.md` at the main worktree root:
 
 - `<N>`, the `- [ ]` lines
-- `<M>`, how many of those end in `(taste)`
+- `<M>`, how many of those carry `(taste)` among their trailing markers
 
 Hold both until the Output block. `pr-evidence` removes the file once it posts the evidence comment, so a count taken after Step 6 reads nothing.
 
+## Owed fixture states
+
+Settle each state the checklist names before Step 6, since a box the driver cannot reach opens the UI review.
+
+- Add the state to the drive fixture for each box ending in `(needs fixture)`, then drop the marker from the box
+- Confirm every state the checklist names has a capture case, per the `canon:ui-craft` capture reference, and add the missing ones
+- A project with no `canon/config/app-drive.toml` takes the setup inline on the box instead of a fixture file
+
 ## Reading the counts into the closing block
 
 The Output block's second line takes both counts. When every box is a taste box, `<N>` and `<M>` match and the boxes are owed to the operator alone, so say the operator and drop the UI reviewer clause.

package/claude/skills/ci-workflow/REQUIREMENT.md

@@ -9,12 +9,18 @@ description: Scope boundary for pipeline structure against job contents, and the
 
 Without this skill, a session chains jobs with `needs` to express reading order rather than a data dependency, so the pipeline costs the sum of its jobs. The same session splits a one-minute gate into parallel jobs, each repaying checkout, install, and toolchain setup, so the gate gets slower while reporting no earlier.
 
-The rest surface as flakes. A moving action ref changes under the project, a static cache key serves a stale toolchain, artifacts never expire, a broad default token grants unneeded writes, and a missing manual trigger leaves a run reproducible only by pushing a commit. A Linux-only pin also flags a supported macOS job as a departure.
+The rest surface as flakes or stalls:
+
+- A moving action ref changes under the project, and a static cache key serves a stale toolchain
+- Artifacts never expire, and a broad default token grants unneeded writes
+- A missing manual trigger leaves a run reproducible only by pushing a commit
+- A Linux-only pin flags a supported macOS job as a departure
+- A Playwright install calling apt directly hangs on a stalled mirror and, with no step bound, holds the runner until the six-hour job default
 
 ## Must
 
 - A job is gated only on a data dependency or a cost that justifies the wait, and checks sharing setup stay in one job until a run log puts the gate past roughly two minutes
-- Every action is pinned to a tag that cannot cross a major version, and every cache is keyed on the version of what it caches
+- Every action is pinned to a tag that cannot cross a major version, every cache is keyed on the version of what it caches, and every Playwright install is bounded and retried
 - Every workflow carries a manual trigger beside its primary one, except one that commits back
 - The token defaults to read-only, with a write scope granted only on the job that needs it, and artifact upload is bounded to failures and expires
 - A job runs on Linux unless the project states a platform for a layer that differs by platform

package/claude/skills/ci-workflow/SKILL.md

@@ -60,6 +60,8 @@ Linux stays the default. A job leaves it only for a layer whose result differs b
 - Use `oven-sh/setup-bun@v2` with `bun-version: latest`.
 - Install with `bun install --frozen-lockfile`.
 - Cache Playwright browsers keyed on the Playwright version string, never a static key.
+- Bound each Playwright install step, 10 minutes on the system packages and 5 on the browser. A stalled apt mirror hangs rather than fails, and an unbounded job waits out the six-hour default.
+- Install the system packages through a script that kills and retries a stalled attempt, never a direct `install-deps` or `--with-deps`, since a bound alone turns the hang red.
 
 ## Commit-back
 
@@ -106,3 +108,4 @@ Before responding, also verify:
 Before responding, also verify:
 
 - No `run:` step passes five lines or carries more than one exit-or-output guard, a loop, a trap, or a function. A step that does calls a script, with its inputs as arguments or `env`.
+- Every Playwright install step carries `timeout-minutes`, and the system packages install through a retried script.

package/claude/skills/code-craft/REQUIREMENT.md

@@ -16,7 +16,7 @@ Agents fail there in recorded ways. They copy where reuse belonged, spread one c
 - Open with the change test, naming the change most likely to come next and counting what it would touch before choosing a shape
 - State depth as rules a session can act on, covering a unit's interface being simpler than its work, inlined pass-throughs, and splitting by the decision hidden
 - State each tension as when one side wins, such as one place for knowledge against coupling two things that only look alike
-- State hidden inputs: pass in the clock, environment, and randomness, and keep business rules free of transport and storage code
+- State what a unit keeps out of itself, being the clock, environment, and randomness, transport and storage code in a business rule, and a long page, stylesheet, or script held in a string
 - Close with the agent failure modes as checks on the session's own diff, with excuses, red flags, a checklist, and the external sources adopted and declined with the reason for each
 
 ## Must not

package/claude/skills/code-craft/SKILL.md

@@ -55,6 +55,13 @@ A pattern earns its indirection only when the problem it solves is present now.
 - Keep business rules free of transport and storage code, so a rule can be read and tested without a request or a database.
 - Skip ports and adapters for an application that only reads and writes records. The layers cost more than the change they protect against.
 
+## Give another language its own file
+
+- Put a page, a stylesheet, or a script past five lines in its own file with its language's extension. A string reaches no formatter or linter, and the next session copies it from its neighbor.
+- Put a script that branches in its own file at any length, since a branch is logic no test reads as its own input.
+- Keep a template that interpolates data in code, since it is code generating output. Count only its static lines, so one interpolation cannot exempt a long page.
+- Keep a short string inline when it is the input under test, so a reader sees it beside the assertion that reads it.
+
 ## Check your own diff
 
 Agents fail at writing time in recorded ways. Read the diff for each before calling it done.

package/claude/skills/code-craft/references/adopted.md

@@ -67,6 +67,14 @@ Martin Fowler, [Beck Design Rules](https://martinfowler.com/bliki/BeckDesignRule
 
 Martin Fowler, Inversion of Control Containers and the Dependency Injection pattern, hands a component what it depends on rather than letting it find it. Adopted as the hidden-inputs rule for the clock, the environment, randomness, and globals, without any container.
 
+## Adopted for embedded languages
+
+### Inline resource
+
+Gerard Meszaros, xUnit Test Patterns, names putting a file's contents into a string in the test as Inline Resource and recommends it over the Mystery Guest a separate file creates. The same page warns that a large resource signals an Eager Test.
+
+Adopted as both sides of the embedded-file rule. A short input under test stays inline, and a long page, stylesheet, or script leaves for its own file. The five-line threshold mirrors the limit the `ci-workflow` skill sets on an inline `run:` step, so one number covers both.
+
 ## Adopted for agent failure modes
 
 Birgitta Böckeler, The role of developer skills in agentic coding, 2025, and How far can we push AI autonomy in code generation?, 2025.

package/claude/skills/pr-evidence/SKILL.md

@@ -52,7 +52,12 @@ The no-local-preview and no-reel lines also land on the evidence comment, throug
 
 ### The uncaptured line
 
-Collect `📸 <N> painted paths changed with no evidence capture. Recapture and push.` when the evidence record lists `uncaptured` paths, with `<N>` its count. The line never stops the run, since no step here can take a capture, and the review raises the same paths as a finding until a recapture lands.
+Collect `📸 <N> painted paths changed with no evidence capture. Recapture and push.` when the evidence record lists `uncaptured` paths, with `<N>` its count. It never stops the run. No step here can take a capture, so the gap reaches the thread and the lift by other routes:
+
+- The evidence call writes an `**Uncaptured:**` line naming each path on the marked comment, posting it even on a head with no other news
+- The line drops on the first render after a capture lands or a reel filmed at the head renders beside it
+- `canon pr lift` refuses `painted-uncaptured` until a capture, a reel at the head, or a waiver in the newest review pass covers every listed path
+- A worker never writes the waiver, since a review is the one surface a worker never posts
 
 ### The no-local-preview line
 

package/claude/skills/pr-evidence/references/evidence.md

@@ -150,6 +150,7 @@ rmdir <main-root>/.canon/tmp/handoff/ui-checklist 2>/dev/null || true
 
 - The `rmdir` is a no-op while another branch's pending checklist sits in the folder, so this step never deletes a handoff not its own
 - `git-followup` re-runs `canon pr evidence` with no `--checklist`, and the verb carries the checklist forward out of the comment it edits
+- Drop a carried checklist with `canon pr evidence <number> --no-checklist --json` and post its `ok` body, never a hand edit, which the next render undoes
 - A tick survives a render at the head its stamp names and is cleared by one at a newer head, so the next UI pass earns it again
 
 ## Post the preview address

package/claude/skills/pr-evidence/references/reel.md

@@ -36,7 +36,7 @@ Film where motion is the claim. Filter the boxes first, then spend the three bea
 
 A box is filmable when it asks the reviewer to click, fill, or scroll something and its result is a visible change.
 
-- Skip a box ending in `(taste)`, since no driver judges it
+- Skip a box whose trailing markers hold `(taste)`, in any order, since no driver judges it
 - Skip a box that asks only to look at a state the page opens on, since a screenshot already shows it
 - Skip a negative box, one asserting that something does not happen, such as "no drop line draws", since footage of nothing shows nothing
 
@@ -80,6 +80,14 @@ Branch on the record's `reason`, never on the exit code.
 | `over-cap`         | Drop `beat` and each beat after it, then film once more. Skip as `over-cap` if `beat` is first or it refuses again                                                                                                                                                 |
 | Any other value    | Skip under that `reason`, such as `target-missing` with its `beat`                                                                                                                                                                                                 |
 
+### A skip for a state the fixture lacks
+
+A skip whose cause is a state the drive fixture lacks, such as `target-missing` on a control only that state renders, is work the building session owes.
+
+- Film a beat from a box carrying `(needs fixture)` only if the state answers, and otherwise skip it as owed
+- Report the owed skip on the evidence comment's `--reel-skip` line and in the closing report, naming the state, the selector, or the setup step the beat needed
+- Never report it as a plain skip, since the next pull request meets the same fixture and skips again
+
 ## Check each still
 
 Open each beat's `still.jpg`, the closing frame the record names in its `still` field, and confirm it shows the state the beat's box describes. This check replaces the operator's approval, so it runs on every reel.

package/claude/skills/review-craft/references/ui.md

@@ -36,12 +36,24 @@ canon pr evidence <number> --check --json
 
 Read the record's `uncaptured` field, never the exit code.
 
-- It lists paths: the project keeps captures and this change skipped them. File a finding against the pull request naming each path.
+- It lists paths: the project keeps captures and this change skipped them. File a should-fix naming each path, since `canon pr lift` refuses `painted-uncaptured` until each one is covered.
 - An empty list beside a changed `evidence/` image means the capture exists and the comment fails to show it. File that as a finding too.
 - An empty list with no changed `evidence/` image means the painting file sits outside the painted set, such as a token file. Raise a question naming the path.
 - It is absent: the base keeps no capture, or its tree went unread. Raise a question with no severity, since a project with no capture harness would otherwise take the flag on every styling change.
 - The record refuses: it decides nothing, so take the tree test under the last section instead
 
+### Waiving a capture
+
+A worker may state why a listed path needs no capture, such as a change to keyboard focus order that no reachable state shows. Accept the exemption only when the diff bears it out, and leave the should-fix standing otherwise.
+
+- Write the waiver line in this pass's body, in the form `${CLAUDE_SKILL_DIR}/../review-pr/references/post.md` gives, one line per path
+- Keep it outside any code fence, since the lift skips a fenced line as a quoted sample
+- Copy the path from the record, since the lift matches it only as `uncaptured` spells it
+- Write the reason after the colon, since a line with none waives nothing
+- Restate it in every later pass, a close-out included, since the lift reads only the newest marked pass of each family and never a reply
+
+### A recapture of the design
+
 A recapture under `canon/design/` redraws the accepted design rather than the built app, so it never stands in for an evidence capture. The verb leaves those paths out of `uncaptured`, and a pass clears a painted change on the evidence comment alone, however many design references beside it were redrawn.
 
 Stop reading this reference once the flag is raised, since there is nothing to open. Otherwise continue with the comment in hand.

package/claude/skills/review-pr/references/body-variants.md

@@ -63,6 +63,8 @@ A pass carrying nothing at all takes `## Review closed` and a short body, with t
 - A prior finding this pass withdrew leaves the count, and its line names the fact that settled it rather than a fix, per the withdrawal rule below
 - A closing remark that fits no prior finding, such as a ticked Testing box, takes one line of its own after them
 
+Each capture waiver this pass still accepts takes its `- **Waived capture:**` line last, unfenced. The lift reads waivers from the newest pass alone, so a close-out that drops one withdraws it.
+
 ### Only minors
 
 A pass carrying only minors is an ordinary finding-carrying pass, so it takes the open heading and the full shape, since neither short line reports the minors. A pass carrying only Testing questions or only an unanswered reviewer request takes the same route. Keep whichever scope sentence the pass owes on the summary line:

package/claude/skills/review-pr/references/close-out.md

@@ -19,6 +19,8 @@ gh api --paginate 'repos/{owner}/{repo}/pulls/<number>/reviews?per_page=100' --j
 
 Write the replacement body to `<body-file>`, the name `post.md` already derived at the top of Step 4. Keep the heading and the footer, and name what this pass covered on the scope line in place of what the old one covered.
 
+Carry every `- **Waived capture:**` line the standing close-out holds into the replacement when this pass still accepts it. The lift reads waivers from the newest pass alone, so a rewrite that drops one withdraws it and the lift refuses `painted-uncaptured` again.
+
 - Derive that name the same way whichever path reached here, since the guard reads `<prior-heading>` alone and a repeated head resolves the third segment as usual
 - The folder then gains a record of every covered head rather than losing the one the standing comment named
 

package/claude/skills/review-pr/references/post.md

@@ -65,6 +65,7 @@ X critical, Y should-fix, Z minor. Reviewed against project docs and the board.
   - Fix: the change
 - **minor** ([lines 30-34](<repo-url>/blob/<headRefOid>/path/to/file.ext#L30-L34)): what breaks, in one sentence.
   - Fix: the change
+- **Waived capture:** `src/client/board/overlay.tsx`: keyboard focus order only, no visible change in any reachable state
 
 <details>
 <summary>Review focus, N checked</summary>

package/claude/skills/review-ui/REQUIREMENT.md

@@ -16,6 +16,7 @@ A model asked to drive a checklist also drifts. It judges a taste box the operat
 - Every checklist box is driven in the running app and gets one verdict, pass or fail with the value quoted, needs eyes for a taste box, or not driven with the reason
 - The checklist and address come from the evidence record rather than the diff, and only a build of the head the verdict names is driven
 - An unreachable address reports not driven rather than fail, a box no commit can settle leaves the review closed, and a pass that drove no box never reads as closed
+  - A box not driven for a state the drive fixture lacks is the exception, since the building session can add that state, so it opens the review. A state no fixture file can hold stays closed.
 - The review posts as its own pull request review under `## UI review` while anything is owed and `## UI review closed` once nothing is, ending on a marker naming the head it drove
 - The pass drives a pinned browser under its own named session and sweeps only console errors, overflow, and the focus, details, and axe probes, opening on an axe finding the CLI marks as gating
 

package/claude/skills/review-ui/SKILL.md

@@ -84,7 +84,7 @@ Take the first rung that answers, testing each with `curl -s -o /dev/null -w '%{
 2. The `local` address off the record.
 3. An address the launch names.
 
-When the hosted rung answers, read `${CLAUDE_SKILL_DIR}/references/hosted-preview.md` to check it was built from the head before driving. A pass on the local rung or a launch-named address skips it.
+When the hosted rung answers, read `${CLAUDE_SKILL_DIR}/references/hosted-preview.md` to check it was built from the head before driving. A pass on the local rung or a launch-named address skips that check, and every rung then takes the config's `access` per `## The access join` in `${CLAUDE_SKILL_DIR}/references/driving.md`.
 
 ### Unverified and unanswered addresses
 
@@ -112,7 +112,7 @@ Read `${CLAUDE_SKILL_DIR}/references/driving.md` on reaching this step for how a
 - Make each box its own item on the session's task list, and tick it as its verdict lands. Skip it on a host that offers no list tool.
 - Give every box exactly one verdict, in checklist order, since skipping a box silently reads the same as passing it
 - Drive a box the pass could not place on a route or a width from the opened address at 1440 wide, and name the guess in the verdict
-- Never judge a box ending in `(taste)`. Drive to the state, capture both themes, and mark it needs eyes.
+- Never judge a box whose trailing markers hold `(taste)`, in any order. Drive to the state, capture both themes, and mark it needs eyes.
 - Drive a ticked box the same as an unchecked one, at any head, since a tick is a claim this pass exists to check
 
 ### Push a frame

package/claude/skills/review-ui/references/driving.md

@@ -1,25 +1,36 @@
 ---
 title: Drive each box
-description: Step 5 of review-ui, which maps a checklist line to browser calls, reads each value off the page, and gives the box one of four verdicts with the evidence that verdict carries
+description: The access join Step 3 of review-ui makes, then Step 5, which maps a checklist line to browser calls, reads each value off the page, and gives the box one of four verdicts with the evidence that verdict carries
 ---
 
 # Drive each box
 
 Step 5 of `review-ui`. The browser is open at the address Step 3 picked, under the session Step 4 named. Every call below goes through `canon browser -s=<project>-<number>`, shortened here to `pw`.
 
+## The access join
+
+Step 3 reads this section once a rung answers. Read `access` from `canon/config/app-drive.toml` at the main worktree root, since a page needing a write link, a signed-in route, or a demo token shows its start state only behind it. An absent file or key opens the rung as it stands.
+
+- Join a value starting with `/` to the rung, and take a full address as it stands. Step 4 opens the joined address alone.
+- Every later route joins to the bare rung, never the joined address, since an `access` holding a query would swallow the path
+- Test the rung bare in Step 3, so the `curl` spends no single-use link before the drive
+- Take no `access` value from the launch brief, since the config is the one source
+- Never print the joined address in a post, a frame, or a message, since `access` may carry a token. Name the rung and say the config's `access` was joined.
+
 ## Reading a line
 
 A box written to the drivable format reads:
 
 ```plaintext
-- [ ] <route>[, <width>]: <verb> <target> → <expected result>[ (taste)][ (local only)]
+- [ ] <route>[, <width>]: <verb> <target> → <expected result>[ (taste)][ (local only)][ (needs fixture)]
 ```
 
-- **Route.** A path goes through `pw goto <address><path>`. A control name, or "from the page the app opens on", is reached by clicking from the opened address.
+- **Route.** A path goes through `pw goto <rung><path>`, the rung before the access join. A control name, or "from the page the app opens on", is reached by clicking from the opened address.
 - **Width.** `pw resize <width> 900` before acting. A box naming no width is driven at 1440.
 - **Verb.** The action the driver performs: `click`, `fill`, `press`, `hover`, a scroll through `eval` of `scrollIntoView`, or a resize.
 - **`(taste)`.** The result is a judgment of look or feel. Capture, never judge.
 - **`(local only)`.** The state needs something a hosted preview cannot reach. On a hosted address the box is not driven, naming the marker as the reason.
+- **`(needs fixture)`.** The drive fixture lacks the state. Drive the box if the state now answers, and otherwise it is not driven for a cause on the branch, as the verdicts below state.
 
 A box written before that format may carry no route, no width, and a verb such as "read" or "look at". Drive it anyway: take the opened address as the route and 1440 as the width, turn the verb into the nearest action, and name each guess in the verdict's evidence.
 
@@ -51,13 +62,30 @@ Each box takes exactly one, keyed here by the state it answers.
   - The evidence is the value read, quoted, such as `scrollWidth 436 against clientWidth 320`.
 - **pass or fail, frame.** The result has a stated criterion only an image settles.
   - The evidence is the matching evidence stem or the pushed frame's link, inline under the failed box's heading, and what the frame shows, in words.
-- **needs eyes.** The box ends in `(taste)`.
+- **needs eyes.** The box's trailing markers hold `(taste)`, in any order.
   - The evidence is the dark and the light shot as a pair, each the matching evidence stem or a pushed frame's link, and what the frames showed, with nothing about whether it looks right.
 - **not driven.** The state could not be reached.
   - The evidence is the reason, such as an unreachable address, a `(local only)` box on a hosted preview, or a target the snapshot does not hold.
 
 A fail names what was expected beside what was read. A not driven never reads as a fail, since it says the pass could not look rather than that the page is wrong. Its reason says whether the cause sits on the page or off it, since only a cause on the page opens the heading Step 7 picks.
 
+### A state the fixture lacks
+
+A box the pass could not drive because the drive fixture holds no such state is a cause on the branch, never a skip. The building session owes the state, and no other session can add it.
+
+- Name the cause as a missing fixture state, with the state to add and the selector or setup step the box needs
+- Count it as not driven, and never as a fail, since the page may be right
+- An address that did not answer stays a cause off the branch, and a `(local only)` box on a hosted address does too
+- A state no fixture file can hold is the exit, such as one a project with no `canon/config/app-drive.toml` cannot reach inline. Name it a cause off the branch, so the review stays closed.
+
+### A refused address
+
+A permission rule or a classifier that denies the call opening or driving an address leaves the box not driven, for a cause off the branch. Name the refusal as the host worded it and the call it denied.
+
+- Never retry through another route, being a second address, a different browser call, or a direct fetch, since the refusal is a decision about this pass rather than a fault to work around
+- A refused opening call drives no box, so the pass posts open with the refusal as its cause line, per `${CLAUDE_SKILL_DIR}/references/post.md`
+- Name the address by its rung and never print the joined `access`, which may carry a token
+
 ### Which image a verdict carries
 
 A pass or fail resting on a frame carries one image at most, and never one the worker's evidence already shows. A needs-eyes box carries the pair, dark and light, since a taste call is made by comparing them.

package/claude/skills/review-ui/references/post.md

@@ -11,7 +11,10 @@ Step 7 of `review-ui`.
 
 The heading reports whether the branch owes anything, the way the code review's does.
 
-- `## UI review` when a box failed, the sweep raised a finding Step 6 names, the worktree check read `changed`, a box was not driven for a cause on the page, or the pass drove no box at all.
+- `## UI review` when a box failed, the sweep raised a finding Step 6 names, the worktree check read `changed`, a box was not driven for a cause the branch holds, or the pass drove no box at all.
+
+A missing fixture state opens the heading because a commit settles it, being the state the building session adds. That pass reaches `review-address` like a failed box, with the state to add named in the box's Not driven entry. A state no fixture file can hold, which `driving.md` names, is a cause off the branch and leaves the review closed.
+
 - `## UI review closed` otherwise.
 
 A needs-eyes box leaves the review closed, and so does a box not driven for a cause off the page, such as an address that did not answer or a `(local only)` box on a hosted preview, as long as something else was driven.
@@ -95,7 +98,7 @@ The post takes the length limits alone, with a box's reason under 350 characters
 The body opens on its count line, in that order, so the operator reads what they owe before anything else. The second line carries the address, the head, and the renderer, and says the address was driven unverified when it came from the local rung or the launch.
 
 - Drop each section holding no box, along with its heading. The order is fixed as Failed, Changed in the worktree, Needs your eyes, Not driven, then the folded blocks.
-- A box takes exactly one section by its verdict, so a box that fails and also ends in `(taste)` appears once, under Failed
+- A box takes exactly one section by its verdict, so a box that fails and also carries `(taste)` appears once, under Failed
 - Quote page text in backticks as content, never as the pass's own words
 
 ### A loopback address
@@ -104,6 +107,7 @@ A loopback address has `localhost`, `127.0.0.1`, `0.0.0.0`, or `[::1]` as its ho
 
 - The cause line of a pass that drove no box, and every Not driven entry, name a loopback address it tried as a local preview with its port, such as `a local preview on port 4211`
 - A hosted address posts as written, since it outlives the session, and the close drops it from the evidence comment
+- `<address>` is always the rung before the access join, followed by `behind the config's access` when one was joined, per `## The access join` in `${CLAUDE_SKILL_DIR}/references/driving.md`
 - The evidence comment carries the local link while the pull request is open, for an operator on the same machine
 - `canon pr local --remove` masks a loopback address left on a review's `Driven at` line when the pull request closes
 

package/claude/skills/role-orchestrator/SKILL.md

@@ -101,9 +101,9 @@ Learning that a PR moved is the mechanical half. Read `${CLAUDE_SKILL_DIR}/refer
 A pass posting anything owed reaches the session holding the branch from the reviewer directly, and the re-review request goes straight back to that reviewer, per `role-reviewer` and `role-worker`. Read `${CLAUDE_SKILL_DIR}/references/orchestrator-handback.md` on reaching this step.
 
 - This session sends either leg only where a cloud reviewer posted the pass or one side reports the other unreachable
-- Each reviewer runs `canon pr lift` on its close. The verb lifts the draft once both reviews read closed at the head, the evidence settled, the head current, and CI passed.
+- Each reviewer's close runs `canon pr lift`, lifting the draft once both reviews close at the head, the evidence settles, the head is fresh, and CI passes
 - Run it yourself when a close message reports a refusal other than the other review being open, or when a cloud reviewer's close posts, per Boundaries below
-- Then the human merges. After each merge, tell each trailing worker whose files the merged diff touches to run `review-address`, which rebases it where needed.
+- Then the human merges from a line naming its proof, per `${CLAUDE_SKILL_DIR}/references/orchestrator-output.md`. Tell each trailing worker the merged diff touches to run `review-address`.
 
 The handback runbook holds how the message is addressed and worded, what to do when no live session holds the branch, and where a worker's reply goes.
 

package/claude/skills/role-orchestrator/references/orchestrator-output.md

@@ -1,6 +1,6 @@
 ---
 title: Orchestrator output formats
-description: The invocation block with its four sections, the three-slot shape every later report opens with, and the rule against a shape for a correction
+description: The invocation block with its four sections, the three-slot shape every later report opens with, the proof a merge line names, and the rule against a shape for a correction
 ---
 
 Read this on invocation, before reporting the state of play, and again before any later report.
@@ -70,4 +70,27 @@ Keep the detail below the block and keep it skippable. A decision reached at the
   - A rename leaves the launch name matching nothing, so read the current name off `canon sessions list --json` when the line is written
   - `claude rm` takes the id alone, so that line carries the id
 
+## The merge line
+
+A pull request recommended for merge names the proof its evidence comment carries, beside the merge command, since a lift's `ok` says the gates held and nothing about what anyone could look at.
+
+```plaintext
+PR #<n> <title>  proof: <screenshots|reel|screenshots and reel|waived|none>
+  → canon pr merge <n>
+```
+
+Read the slot off `canon pr evidence <number> --json` at the moment the line is written, branching on the record rather than the exit code.
+
+- `screenshots` when the record carries `states`, and `reel` when it carries `reel`
+- `waived` when neither is carried and `canon pr lift <number> --check --json` names every listed path under `waived`, quoting no token from the reason
+- `none` otherwise, and a pull request with no painted path takes no slot at all
+
+### An unproven painted pull request
+
+A painted pull request whose slot reads `none` is unproven. Report it as unproven, never as ready, whatever the lift returned, and put the missing proof to the operator as a decision.
+
+- Painted means the record carries a `checklist`, or the check record lists `uncaptured` paths
+- A project whose base keeps no captures reads `uncaptured` absent, so a checklist with no stills and no reel is still unproven there
+- Send the branch's session back to run `pr-evidence` under the proof check in `orchestrator-review-dispatch.md`, rather than recommending the merge
+
 Write no shape for a correction. A correction is a sentence, and a format for admitting error invites ceremony where plainness is the whole value.

package/claude/skills/role-orchestrator/references/orchestrator-poll.md

@@ -47,8 +47,9 @@ bun <POLL_SCRIPT> --wait 1200
 Act on what the poll printed when it exited, then start it again.
 
 - A release pull request, whatever state follows it: report it and stop. Its sweep carries no findings, so no pass is owed. Test this before any rule below, since a release pull request is reported OPENED like any other and would otherwise match that rule first.
+- MOVED, before the rule below: run the review dispatch runbook's proof check on the new head. A head first carrying an uncaptured path, or owing evidence, goes back to its worker and holds the re-review. One first carrying a `drivable` box with no UI reviewer launched takes one now.
 - MOVED or RESPONSE on a pull request already reviewed: when a live local reviewer holds it, report it and stop, since the worker asks that reviewer for the re-review directly. When none does, which a cloud reviewer always leaves, launch a fresh reviewer under the review dispatch runbook of the canon:role-orchestrator skill. Never run the canon:review-pr skill here. Re-reviews read prior..head and gain nothing from waiting.
-- OPENED, or a pull request with no prior review pass: launch its reviewer under the review dispatch runbook of the canon:role-orchestrator skill, and its UI reviewer beside it when the evidence record carries a checklist. Never run the first pass here. A draft counts, since every pull request here opens as one and skipping drafts skips everything.
+- OPENED, or a pull request with no prior review pass: once that runbook's proof check reads proof, launch its reviewer under the review dispatch runbook of the canon:role-orchestrator skill, and its UI reviewer beside it when the evidence record counts a `drivable` box. Never run the first pass here. A draft counts, since every pull request here opens as one and skipping drafts skips everything.
 - SEEN: report it and stop. A pass already covers that head, whether it arrived out of band or before the poll first saw the pull request, so no review follows.
 - STALLED: read the last pass and report what it carried. The pass has sat open for hours with nothing following it, so a worker mid-task is already ruled out and the dispatch either never went out or the session holding it is gone. Confirm and re-send it under the dispatch rule below, whatever grades the pass carried. Do not re-run a review to correct the heading, since a pass on an unchanged head with no response behind it stops by design.
 - CONFLICT or STALE: send the session holding that branch the rebase handback in the canon:role-orchestrator skill's handback runbook, resolving it the way the handback rule below does. The branch owner rebases, not this session. The poll prints one of the two for a pull request, never both, so it earns one message. The canon pr lift verb refuses on either standing itself, since the green run tested a main that no longer exists, so nothing here lifts the mark.
@@ -80,7 +81,7 @@ The eight headings the script knows are written by `review-pr`, `review-address`
 - The reply family matches by a filter in `poll.ts`, so a project posting it under different headings edits that
 - The review and UI families match inside `canon pr review-state`, which the script and `review-pr` both read, so renaming one changes the verb
 - The `UI-` states report the newest UI pass on its transition, and `UI-STALE` fires beside the `MOVED` of a push that left its marker behind
-- A first sighting reports no `UI-` state at no cost to the mark, since `canon pr lift` reads the UI review itself and holds the mark on a `canon pr evidence` checklist until a UI close names the head
+- A first sighting reports no `UI-` state at no cost to the mark, since `canon pr lift` reads the UI review itself and holds the mark on a drivable checklist until a UI close names the head
 
 ### UNMATCHED and RESPONSE
 

package/claude/skills/role-orchestrator/references/orchestrator-review-dispatch.md

@@ -1,10 +1,39 @@
 ---
 title: Orchestrator review dispatch runbook
-description: Which pull requests take a reviewer dispatched under role-reviewer, the model it runs on, when a UI reviewer goes beside it, when small pull requests share one reviewer pair, and how the cross-branch pass per wave reaches each brief
+description: The painted-proof check every pull request clears before a reviewer launches, which pull requests take a reviewer dispatched under role-reviewer, the model it runs on, when a UI reviewer goes beside it, when small pull requests share one reviewer pair, and how the cross-branch pass per wave reaches each brief
 ---
 
 Run this on every first pass, from `### The review dispatch` in the skill body. Review splits by what each side can see rather than by pass number. A dispatched reviewer holds one pull request and reads it deeper than this session can while holding a wave, and this session holds the wave and reads what no single pull request shows.
 
+## Proof before any reviewer
+
+A painted pull request missing proof goes back to its worker before any reviewer launches. Read it on every first pass, ahead of every launch below, and on every `MOVED` the poll routes here:
+
+```bash
+canon pr evidence <number> --check --json
+```
+
+Branch on the record's fields rather than on the exit code, and never derive the painted set from `gh pr diff` against a test written here, since the verb already reads it.
+
+| Record                         | Route                                                                                      |
+| ------------------------------ | ------------------------------------------------------------------------------------------ |
+| `uncaptured` lists paths       | Send it back for a capture and `pr-evidence`, naming each path as the record spells it     |
+| `owed` holds `evidence`        | Send it back to run `pr-evidence`, since an evidence image changed and no comment shows it |
+| `settled`, `uncaptured` empty  | Proof stands, so launch the reviewers below                                                |
+| `uncaptured` absent            | The base keeps no captures, so route on `owed` alone and never send it back for a capture  |
+| A refusal, such as `gh-failed` | Report the `reason`, launch the reviewers, and name the check unread in each brief         |
+
+`owed` holding only `preview` is the ship chain's deploy wait rather than missing proof, so it holds no reviewer.
+
+### Sending it back
+
+Message the session holding the branch, resolved the way `## Sending the handback` in `orchestrator-handback.md` resolves it, with the paths and the skill to run. Hold both reviewers until a re-read reads proof, since a code review on a head about to gain captures runs twice.
+
+- A worker reporting that no capture can be taken, such as a state no fixture reaches, releases the hold, so launch the reviewers
+- Carry the uncaptured paths as a fact in the code reviewer's brief then, since only a review pass may write the waiver `canon pr lift` reads
+- Re-read the check on the worker's reply or the next `MOVED`, never on a timer
+- A refusal never reads as proof. `canon pr lift` reads the same record and holds the mark on its own gate, so a launch past an unread check costs no merge.
+
 ## Every pull request takes a reviewer
 
 Dispatch every pull request's review to a reviewer under `role-reviewer`, first pass included, whatever its size or its paths. A release pull request is the one exception, since its sweep carries no findings and owes no pass.
@@ -16,9 +45,11 @@ Dispatch every pull request's review to a reviewer under `role-reviewer`, first
 
 ## The UI reviewer
 
-A pull request whose evidence record carries a checklist takes a second reviewer, a UI reviewer under `review-ui`, dispatched beside the code reviewer so the two passes run at once. Read the record with `canon pr evidence <number> --json` and branch on its `checklist` field rather than on the exit code.
+A pull request whose evidence record counts a drivable box takes a second reviewer, a UI reviewer under `review-ui`, dispatched beside the code reviewer so the two passes run at once. Read the record with `canon pr evidence <number> --json` and branch on `drivable` above zero rather than on the exit code.
 
 - A record carrying no checklist dispatches no UI reviewer, since the pass would stop on arrival
+- A record whose `drivable` reads zero, every box being `(taste)`, dispatches none either, while a `checklist` with no readable `drivable` dispatches one, as the lift binds on it
+- A pull request that gains a drivable box in review takes its UI reviewer then, on the `MOVED` that brought it, since a first pass that read none launched nobody
 - The UI reviewer reads no diff and never hears the code verdict, so neither brief carries the other's result
 - Each posts its own family and runs `canon pr lift` on its close, and the verb lifts the draft mark only once both read closed at the head
 
@@ -38,7 +69,7 @@ A pull request failing any condition takes its own reviewer pair, as above. A ro
 
 ### One pair per batch
 
-Launch one code reviewer for the whole batch, and one UI reviewer beside it when any batched evidence record carries a checklist. `orchestrator-reviewer-launch.md` carries both batch shapes.
+Launch one code reviewer for the whole batch, and one UI reviewer beside it when any batched evidence record carries a `drivable` count above zero. `orchestrator-reviewer-launch.md` carries both batch shapes.
 
 - Each pull request still takes its own pass, its own verdict comment, and its own `canon pr lift`, since the poll routes on each comment's heading
 - Never ask for one summary comment across the set, since a second comment is a second verdict the poll cannot route
@@ -64,7 +95,7 @@ A pull request whose Testing section names a billed run waits on the operator's
 
 ## Launching the reviewer
 
-Take the reviewer shape in `orchestrator-reviewer-launch.md`, or its UI reviewer shape for a pull request carrying a checklist.
+Take the reviewer shape in `orchestrator-reviewer-launch.md`, or its UI reviewer shape for a pull request whose `drivable` count is above zero.
 
 - Check `canon sessions list --json` first for a live `reviewer-<project>-` or `reviewer-ui-<project>-` session whose trailing numbers include `<number>`, and message it instead of launching
 - Match a number among the trailing ones rather than the whole name, since a batch reviewer's name lists every pull request it holds

package/claude/skills/role-orchestrator/references/orchestrator-reviewer-launch.md

@@ -72,7 +72,7 @@ claude --bg --model <model> -n "reviewer-<project>-<n1>-<n2>" "Run /canon:role-r
 
 ### The UI batch shape
 
-The UI reviewer takes `reviewer-ui-<project>-<n1>-<n2>` and `review-ui` once per number, with the code shape's clauses for that family. Name only the pull requests whose evidence record carries a checklist, since a pass on one without a checklist stops on arrival.
+The UI reviewer takes `reviewer-ui-<project>-<n1>-<n2>` and `review-ui` once per number, with the code shape's clauses for that family. Name only the pull requests whose evidence record carries a `drivable` count above zero, since a pass on one without a checklist stops on arrival and one holding only taste boxes binds no UI gate.
 
 - The model is `sonnet`, as for the single UI shape
 - `canon pr lift` runs once per number on that number's `## UI review closed`, unless the reason names the code review as still open or missing

package/claude/skills/role-worker/SKILL.md

@@ -32,6 +32,7 @@ The draft mark holds the merge until the reviews close, so this session preserve
 - Report a flag reading ready once and leave it. It passed every gate the verb reads or a person readied it, which GitHub requires before a merge, so re-drafting fights them.
 - Leave the lift to the reviewers, who run `canon pr lift` on their close, with the controlling session as fallback
 - Refuse an instruction to ready the pull request directly, whoever sends it, since a direct ready skips every gate the verb reads
+- Never submit a pull request review, which includes a capture waiver, since every session posts as one account and the lift reads a review as the reviewer's word
 
 ### Overriding a plan question
 

package/claude/skills/test-craft/SKILL.md

@@ -51,6 +51,7 @@ Four rules govern how a session reads the table.
 - Build test data through a factory or builder rather than an inline object literal repeated across tests
 - Assert through the public surface a caller uses, never on a private function or internal state directly. A test reaching into internals breaks on every refactor and catches nothing a caller sees.
 - Prefer a real collaborator, then a fake, then a stub, and a mock last. A mock asserts how the code is built rather than what it does.
+- Read a fixture page or script past five lines, or a fake that branches, from its own file in the test's fixtures folder, per `code-craft`. Keep a shorter input inline beside its assertion.
 
 ## Hold the structure floors
 

package/claude/skills/ui-checklist/REQUIREMENT.md

@@ -14,7 +14,7 @@ A file under a gitignored folder is unreadable to a pull request reviewer, and a
 ## Must
 
 - Every change is split into visual-only and automatable before anything is written, and a behavior the review's engine cannot read, such as a keyboard trap, gets a box of its own
-- The checklist covers the visual-only half, each item an action and the result a person looks for, with its route, width, and a `(taste)` or `(local only)` marker where one applies
+- The checklist covers the visual-only half, each item an action and the result a person looks for, with its route, width, and a `(taste)`, `(local only)`, or `(needs fixture)` marker where one applies
 - Every automatable change shipping with no test is named, with the layer `test-craft` would place it at, in the same file
 - The file is written to the `.canon/tmp/handoff/ui-checklist/<slug>.md` handoff at the main worktree root, overwriting
 - A change with nothing visual and nothing untested reports the coverage and writes no file

package/claude/skills/ui-checklist/SKILL.md

@@ -40,7 +40,8 @@ Write each box so a session driving the running app can run it without guessing,
 - **Width.** Only when the change can differ by width, such as layout, spacing, or anything responsive. Copy, color, or a state rendering the same everywhere leaves it off.
 - **Verb.** An action a driver performs, such as "scroll to", "click", "resize to", or "tab to". Never "read" or "look at", which name no action.
 - **Taste.** End the line with `(taste)` when the result is a judgment of look or feel. A driver reports such a box as needing a person's eyes rather than passing it.
-- **Setup.** State inline any setup the page does not open in. End the line with `(local only)` when a hosted preview cannot reach that state, such as a stopped service or a seeded record.
+- **Setup.** State inline the setup the page does not open in and the fixture state it needs. End with `(local only)` when a hosted preview cannot reach it, such as a stopped service.
+- **Fixture.** End with `(needs fixture)` when the drive fixture lacks the state. The builder adds it, or with no `canon/config/app-drive.toml` writes the setup inline and drops the marker.
 
 When the plan cites `canon/design/<surface>/` under `**Design references:**`, name the reference as the comparison on each box for that surface, such as "→ matches `canon/design/<surface>/` in light and dark". The reviewer then judges the build against the accepted design instead of against taste.