@journeykit/canon 0.35.0 → 0.36.0

package/dist/skills/reference/role-orchestrator.md

@@ -4,7 +4,7 @@ You run the loop across agents and move the subject. You write no brief,
 code or review yourself. Declare the role with `CANON_ROLE=orchestrator` (or
 `--as orchestrator`); your `canon status` also lists the human's steps. The
 human's acts (`brief approve`, `policy approve`, `divergence accept`) refuse
-every agent role, you included (`HUMAN_ONLY`), unless you record the answer the
+every agent role, you included (`ACTOR_DENIED`), unless you record the answer the
 human gave you in the conversation with `--relayed-via <tool>` (below). You never
 run them without that answer, and never remove or unset your role (`env -u CANON_ROLE`,
 dropping `--as`) to get past the refusal.
@@ -18,7 +18,7 @@ in your ids. Use only the options on a line; never guess one. Ask `canon schema
 <command> --json` only for a leaf this block does not list, or after a `USAGE` refusal.
 
 <!-- canon:generated commands-orchestrator begin -->
-Every leaf takes `--as <ROLE>` and `--json`; `--repo <DIR>` too, except `completion`, `regime show`, `schema`, `selftest`, `skills show`. `--input <JSON|FILE|->` runs a leaf from one JSON document (an array is a batch) and is only on the lines ending `[--input]`. Its document keys are the option names in camelCase, singular even when the option repeats (the value is then an array), and `operands` holds the operands. `--fields <FIELDS>` is a comma list of the paths `canon schema <COMMAND> --json` declares under `outputs[].fields.paths`; a path is the record's own key, spelled as the answer spells it.
+Every leaf takes `--as <ROLE>` and `--json`; `--repo <DIR>` too, except `completion`, `regime show`, `schema`, `selftest`, `skills show`. `--input <JSON|FILE|->` runs a leaf from one JSON document (an array is a batch) and is only on the lines ending `[--input]`. Its document keys are the option names in camelCase, singular even when the option repeats (the value is then an array; none is the key left out, `[]` is refused), and `operands` holds the operands. `--fields <FIELDS>` is a comma list of the paths `canon schema <COMMAND> --json` declares under `outputs[].fields.paths`; a path is the record's own key, spelled as the answer spells it.
 A `usage:` line shows the syntax and is not itself a command to run (the runnable example under it is): `<X>` is a value, `[x]` optional, `a | b` a choice, `(a | b)` exactly one is required, `[--x <V>]*` may repeat, `<X>+` is one or more, `[--a --b <V>]` go together. An option that is not on the line does not exist: it is refused (`USAGE`).
 
 ```text
@@ -37,8 +37,8 @@ canon adapter validate --response adapter-response.json --json
 ```
 ```text
 # Move the local artifact blobs to an object-store tier, verify them, and remove the local copies
-usage: canon artifacts move --tier <TIER> [--commit --plan-digest <DIGEST>] [--input]
-# a bare run previews and prints planDigest; `--commit --plan-digest <DIGEST>` with that digest acts
+usage: canon artifacts move --tier <TIER> [--commit --plan-digest <PLAN_DIGEST>] [--input]
+# a bare run previews and prints planDigest; `--commit --plan-digest <PLAN_DIGEST>` with that digest acts
 ```
 ```bash
 canon artifacts move --tier cold --json
@@ -220,16 +220,16 @@ canon inventory sync --json
 ```
 ```text
 # Move superseded versions of every record out of the ledger into the archive
-usage: canon ledger compact [--commit --plan-digest <DIGEST>] [--input]
-# a bare run previews and prints planDigest; `--commit --plan-digest <DIGEST>` with that digest acts
+usage: canon ledger compact [--commit --plan-digest <PLAN_DIGEST>] [--input]
+# a bare run previews and prints planDigest; `--commit --plan-digest <PLAN_DIGEST>` with that digest acts
 ```
 ```bash
 canon ledger compact --json
 ```
 ```text
 # Bring a repo from an earlier canon up to date
-usage: canon migrate [--commit --plan-digest <DIGEST>] [--revert | --relayed-via <NAME>] [--backup <DIR> (with --revert)] [--actor <ACTOR_ID> (with --relayed-via)] [--approver <NAME> (with --relayed-via)] [--note <TEXT> (with --relayed-via)] [--input]
-# a bare run previews and prints planDigest; `--commit --plan-digest <DIGEST>` with that digest acts
+usage: canon migrate [--commit --plan-digest <PLAN_DIGEST>] [--revert | --relayed-via <NAME>] [--backup <DIR> (with --revert)] [--actor <ACTOR_ID> (with --relayed-via)] [--approver <NAME> (with --relayed-via)] [--note <TEXT> (with --relayed-via)] [--input]
+# a bare run previews and prints planDigest; `--commit --plan-digest <PLAN_DIGEST>` with that digest acts
 ```
 ```bash
 canon migrate --json
@@ -264,8 +264,8 @@ canon prompt show reviewer@v1 --json
 ```
 ```text
 # Remove allowlisted records older than a cutoff
-usage: canon purge --kind <session|run|event|trajectory> --before <TIMESTAMP> [--commit --plan-digest <DIGEST>] [--input]
-# a bare run previews and prints planDigest; `--commit --plan-digest <DIGEST>` with that digest acts
+usage: canon purge --kind <session|run|event|trajectory> --before <TIMESTAMP> [--commit --plan-digest <PLAN_DIGEST>] [--input]
+# a bare run previews and prints planDigest; `--commit --plan-digest <PLAN_DIGEST>` with that digest acts
 ```
 ```bash
 canon purge --kind session --before 2020-01-01T00:00:00Z --json
@@ -314,7 +314,7 @@ canon retrieve --for-role reviewer --domain dev --limit 20 --json
 ```
 ```text
 # Describe canon's own commands
-usage: canon schema [<PATH>]* [--errors | --error <CODE> | --warning <CODE> | --warnings]
+usage: canon schema [<PATH>]* [--schemas | --error <CODE> | --errors | --warning <CODE> | --warnings]
 ```
 ```bash
 canon schema evidence add --json
@@ -426,8 +426,8 @@ canon subject unadopt demo --change add-login --json
 ```
 ```text
 # Apply canon.yaml aging rules, moving old records to their destination tier
-usage: canon tier age [--commit --plan-digest <DIGEST>] [--input]
-# a bare run previews and prints planDigest; `--commit --plan-digest <DIGEST>` with that digest acts
+usage: canon tier age [--commit --plan-digest <PLAN_DIGEST>] [--input]
+# a bare run previews and prints planDigest; `--commit --plan-digest <PLAN_DIGEST>` with that digest acts
 ```
 ```bash
 canon tier age --json
@@ -527,16 +527,16 @@ Approve or fill the form. On their approval record it: `canon brief approve
 <ask|AskUserQuestion|chat> --actor <your actor id> --digest <slug>=<the digest
 shown>` (several slugs take one answer, each with its own `--digest`; nothing is written
 if one is refused). The record says you recorded it, with your role, actor and
-tool. `RELAY_DIGEST_MISMATCH` means the brief changed after they saw it: show it
+tool. `RELAY_DIGEST_STALE` means the brief changed after they saw it: show it
 again. When `canon.yaml` has `approval: { relay: deny }` the call is refused
-(`HUMAN_ONLY`, naming the key): report the human's own call and wait for them to
+(`ACTOR_DENIED`, naming the key): report the human's own call and wait for them to
 run it. Removing or unsetting your declared role (`env -u CANON_ROLE`,
 dropping `--as`) to get past a refusal is the same act under another label.
 `canon skills show role-planner` has the full procedure. Do not start the
 implementer before `canon brief show <slug>` reports `state: approved`.
 Never approve it yourself and never edit the policy to pass the gate. A
 policy that no longer matches the approval fails closed
-(`POLICY_CHANGED_SINCE_APPROVAL`, or `POLICY_APPROVAL_UNREADABLE`): the ship
+(`POLICY_APPROVAL_STALE`, or `POLICY_APPROVAL_CORRUPT`): the ship
 guard and the reopen refuse, and `--override-reason` does not waive it. Run
 `canon policy show`, then show the policy to the human, ask them to re-approve
 and record their explicit answer (`canon policy approve --approver <their name>
@@ -576,7 +576,7 @@ its preview, never from an old digest.
 
 | The thought | The reality |
 |---|---|
-| "Edit the policy so the gate passes." | A changed policy fails closed (`POLICY_CHANGED_SINCE_APPROVAL`); ask the human to re-approve or restore it from git. |
+| "Edit the policy so the gate passes." | A changed policy fails closed (`POLICY_APPROVAL_STALE`); ask the human to re-approve or restore it from git. |
 | "The reviewer can be me under another label." | The reviewer is a separate process with its own real session id (#39). |
 | "Approve the brief; the human said they are busy." | An answer they did not give is not recorded. Show the brief, ask, and record only an explicit approval with `--relayed-via`. |
 | "Override the refusal to ship." | Fix the gap the refusal names; `--override-reason` waives only the `require_review` gaps and the brief gap, is recorded on the subject, and is for the human's call, not a shortcut. |
@@ -591,7 +591,8 @@ directly (a transition is a state change, not a destructive act) and is not
 repeatable: a move to the state the subject is already in is refused
 (exit 2), so after a lost response read `subject show` before you retry.
 It refuses a move the policy does not allow (missing evidence or reviews,
-open blockers, an unapproved brief) with `SUBJECT_GATE_VIOLATION` and exit 1,
+open blockers, an unapproved brief) with exit 2 and the code of the condition
+(`SUBJECT_APPROVAL_REQUIRED` for a missing review, evidence or approval, `EVIDENCE_STALE`, `SUBJECT_INVALID` for the rest; several causes are `error.details[]`),
 the record unchanged; fix the gap rather than overriding. Move to `shipped`
 yourself once its guard passes, unless the brief says the human ships. A
 follow-up on a shipped subject goes back to `verifying` with `--reason`,
@@ -614,7 +615,7 @@ red. A bad `--to` fails with `error.field` `--to` and `error.expected`
 listing the states.
 
 **Done when:** `canon subject show demo` (the subject's id) reports the
-state you moved it to and `canon gate check` is clean; when the move exits 1,
+state you moved it to and `canon gate check` is clean; when the move exits 2,
 read the refusal in `error` of `canon subject move demo --to shipped --json`.
 
 ## Destructive commands preview first
@@ -629,7 +630,7 @@ digits, over the effects and what the plan read, so a file or record the plan
 read that changed since is `PLAN_STALE` too, and `meta.next[0]` is the preview
 to run again. A commit holds the repository write lock for its whole run:
 another command that writes waits for it, and one that waited 30 seconds
-answers `REPO_WRITE_BUSY` (exit 2, retryable): run it again. A document passed
+answers `REPO_LOCK_UNAVAILABLE` (exit 2, retryable): run it again. A document passed
 with `--input` never carries `--commit` or `--plan-digest`, and these five
 leaves take one object only (`INPUT_INVALID`).
 
@@ -675,7 +676,7 @@ canon skills install
    moves: commit first. In CI run it with full history (`fetch-depth: 0`).
 3. `canon skills install` refreshes the stub and the scripts for the selected
    harnesses; `canon skills check` reports a skill written by another canon
-   version (exit 1, `SKILLS_DRIFT`), `canon skills doctor` explains it.
+   version (exit 1, `SKILLS_CHECK_FAILED`), `canon skills doctor` explains it.
 
 Commit what it changes, except the backup: `.canon/migrate-backup/` is local and
 git-ignored, and `canon migrate --revert` needs it (keep it until you are sure).

package/dist/skills/reference/role-planner.md

@@ -6,7 +6,7 @@ brief the human answers once. You build nothing. Declare the role with
 then show your steps and count the rest under `waitingOn`. The approvals are
 the human's: `brief approve`, `policy approve`, `divergence accept` and the
 `migrate --commit` that re-binds `Approved:` lines refuse every agent role
-(`HUMAN_ONLY`, `retryable: false`) unless you record the answer the human gave
+(`ACTOR_DENIED`, `retryable: false`) unless you record the answer the human gave
 you in the conversation, with `--relayed-via <tool>` (step 4). Without a human's
 explicit answer you never run them, and you never remove or unset your role
 (`env -u CANON_ROLE`, dropping `--as`) to get past the refusal.
@@ -20,7 +20,7 @@ in your ids. Use only the options on a line; never guess one. Ask `canon schema
 <command> --json` only for a leaf this block does not list, or after a `USAGE` refusal.
 
 <!-- canon:generated commands-planner begin -->
-Every leaf takes `--as <ROLE>` and `--json`; `--repo <DIR>` too, except `completion`, `schema`, `skills show`. `--input <JSON|FILE|->` runs a leaf from one JSON document (an array is a batch) and is only on the lines ending `[--input]`. Its document keys are the option names in camelCase, singular even when the option repeats (the value is then an array), and `operands` holds the operands. `--fields <FIELDS>` is a comma list of the paths `canon schema <COMMAND> --json` declares under `outputs[].fields.paths`; a path is the record's own key, spelled as the answer spells it.
+Every leaf takes `--as <ROLE>` and `--json`; `--repo <DIR>` too, except `completion`, `schema`, `skills show`. `--input <JSON|FILE|->` runs a leaf from one JSON document (an array is a batch) and is only on the lines ending `[--input]`. Its document keys are the option names in camelCase, singular even when the option repeats (the value is then an array; none is the key left out, `[]` is refused), and `operands` holds the operands. `--fields <FIELDS>` is a comma list of the paths `canon schema <COMMAND> --json` declares under `outputs[].fields.paths`; a path is the record's own key, spelled as the answer spells it.
 A `usage:` line shows the syntax and is not itself a command to run (the runnable example under it is): `<X>` is a value, `[x]` optional, `a | b` a choice, `(a | b)` exactly one is required, `[--x <V>]*` may repeat, `<X>+` is one or more, `[--a --b <V>]` go together. An option that is not on the line does not exist: it is refused (`USAGE`).
 
 ```text
@@ -116,7 +116,7 @@ canon scenario new auth.login.02 --title "Sign out" --feature .canon/specs/kind=
 ```
 ```text
 # Describe canon's own commands
-usage: canon schema [<PATH>]* [--errors | --error <CODE> | --warning <CODE> | --warnings]
+usage: canon schema [<PATH>]* [--schemas | --error <CODE> | --errors | --warning <CODE> | --warnings]
 ```
 ```bash
 canon schema evidence add --json
@@ -183,7 +183,7 @@ lists N blockers`); then, while prose advisories remain, to the polish pass
 (`polish the brief in <path> (canon skills show brief-polish), then run canon
 brief check <slug>`, with the advisory count and the top rule
 ids); the human step comes after it. A policy that no longer matches its approval fails closed
-(`POLICY_CHANGED_SINCE_APPROVAL`): never edit it; the human re-approves.
+(`POLICY_APPROVAL_STALE`): never edit it; the human re-approves.
 
 ## Steps
 
@@ -286,9 +286,9 @@ ids); the human step comes after it. A policy that no longer matches its approva
    show` and the dashboard name it. Never approve in their name without their
    answer, never write the answer for them, and never edit the policy to make
    the gate pass. A digest that differs from the brief now
-   (`RELAY_DIGEST_MISMATCH`) means the brief changed after they saw it: show
+   (`RELAY_DIGEST_STALE`) means the brief changed after they saw it: show
    it again and ask again; nothing was written. Without `--relayed-via` the call is
-   `HUMAN_ONLY`; with it and no role declared, `USAGE`. When `canon.yaml`
+   `ACTOR_DENIED`; with it and no role declared, `USAGE`. When `canon.yaml`
    turns relaying off (`approval: { relay: deny }`), the refusal names that key:
    report the human's call (`canon brief approve add-login --approver <their
    name> --note "<their own words>"`) and wait for them to run it. Never
@@ -300,7 +300,7 @@ ids); the human step comes after it. A policy that no longer matches its approva
    evidence with its reason and tracking reference, the migrate plan), ask,
    count only an explicit approval, then record with the relay option.
    `canon brief show <slug>` then reports `state: approved`. A brief edited
-   after its approval is not approved (`BRIEF_CHANGED_SINCE_APPROVAL`): it
+   after its approval is not approved (`BRIEF_APPROVAL_STALE`): it
    needs a new answer, shown and asked again, and a new `brief approve`. A follow-up that
    adds or changes a step of the brief is a scope change and needs a new
    answer.

package/dist/skills/reference/role-reviewer.md

@@ -3,7 +3,7 @@
 You are the independent second look. Declare the role with
 `CANON_ROLE=reviewer` (or `--as reviewer`); `--role` on `review scenario`,
 `review change` and `finding add` then defaults to `reviewer`. The human's
-acts refuse you (`HUMAN_ONLY`): `brief approve`, `policy approve` and
+acts refuse you (`ACTOR_DENIED`): `brief approve`, `policy approve` and
 `divergence accept`, unless you record the answer the human gave you in the
 conversation with `--relayed-via <tool>` (the divergence acceptance below).
 Name what the human has to decide; never look for another flag that grants it.
@@ -19,7 +19,7 @@ in your ids. Use only the options on a line; never guess one. Ask `canon schema
 <command> --json` only for a leaf this block does not list, or after a `USAGE` refusal.
 
 <!-- canon:generated commands-reviewer begin -->
-Every leaf takes `--as <ROLE>` and `--json`; `--repo <DIR>` too, except `completion`, `schema`, `skills show`. `--input <JSON|FILE|->` runs a leaf from one JSON document (an array is a batch) and is only on the lines ending `[--input]`. Its document keys are the option names in camelCase, singular even when the option repeats (the value is then an array), and `operands` holds the operands. `--fields <FIELDS>` is a comma list of the paths `canon schema <COMMAND> --json` declares under `outputs[].fields.paths`; a path is the record's own key, spelled as the answer spells it.
+Every leaf takes `--as <ROLE>` and `--json`; `--repo <DIR>` too, except `completion`, `schema`, `skills show`. `--input <JSON|FILE|->` runs a leaf from one JSON document (an array is a batch) and is only on the lines ending `[--input]`. Its document keys are the option names in camelCase, singular even when the option repeats (the value is then an array; none is the key left out, `[]` is refused), and `operands` holds the operands. `--fields <FIELDS>` is a comma list of the paths `canon schema <COMMAND> --json` declares under `outputs[].fields.paths`; a path is the record's own key, spelled as the answer spells it.
 A `usage:` line shows the syntax and is not itself a command to run (the runnable example under it is): `<X>` is a value, `[x]` optional, `a | b` a choice, `(a | b)` exactly one is required, `[--x <V>]*` may repeat, `<X>+` is one or more, `[--a --b <V>]` go together. An option that is not on the line does not exist: it is refused (`USAGE`).
 
 ```text
@@ -143,7 +143,7 @@ canon review scenario auth.login.01 --actor alice --role reviewer --original-spe
 ```
 ```text
 # Describe canon's own commands
-usage: canon schema [<PATH>]* [--errors | --error <CODE> | --warning <CODE> | --warnings]
+usage: canon schema [<PATH>]* [--schemas | --error <CODE> | --errors | --warning <CODE> | --warnings]
 ```
 ```bash
 canon schema evidence add --json
@@ -288,7 +288,7 @@ sign.
 `divergence accept` is for a scenario whose honest evidence is `divergent`
 and whose gap is limited by something outside this change (an upstream
 limit, a platform bug) and is tracked there. It records a human's decision,
-so it refuses every agent role (`HUMAN_ONLY`), you included, unless it records
+so it refuses every agent role (`ACTOR_DENIED`), you included, unless it records
 the answer the human gave you. What you do: confirm the evidence really is
 divergent and the limit is outside this change, then put to the human the
 scenario ids, the reason, the tracking reference and an expiry when the limit
@@ -297,11 +297,11 @@ Ask with the harness question tool (`ask` in omp, `AskUserQuestion` in Claude
 Code, otherwise in the chat): accept the gap, or not. Only an explicit
 approval counts; a question or a condition is not one, and no answer records
 nothing. Then record it from a session that did not attest the evidence
-(`DIVERGENCE_ACCEPT_REFUSED` otherwise): `canon divergence accept <ids> --actor
+(`DIVERGENCE_DENIED` otherwise): `canon divergence accept <ids> --actor
 <your actor id> --reason "<why>" --tracking <ref> --approver <their name> --note
 "<their answer>" --relayed-via <tool>`; the record carries the relay, the
 approver and their answer. When `canon.yaml` has `approval: { relay: deny }` the
-call is refused (`HUMAN_ONLY`, naming the key) and the human runs it themselves.
+call is refused (`ACTOR_DENIED`, naming the key) and the human runs it themselves.
 You never unset your role to run it. Never suggest it to skip
 a fix the implementer can make in this change. The acceptance pins that
 evidence: new evidence for the scenario, or its expiry, ends it, and the
@@ -358,7 +358,7 @@ implementer owns. Your last write's `meta.next` names the next step.
 identical repeat is reported `unchanged` (`data.unchanged: true`, or the
 element's `status` in a batch), so after a timeout run the same command
 again. A different finding under an occupied round and seq is refused
-(`FINDING_SEQ_OCCUPIED`): take the next seq. `finding close` with the same
+(`FINDING_EXISTS`): take the next seq. `finding close` with the same
 disposition is a no-op too.
 
 ## Excuses that fail

package/man/canon-adapter-authorize.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-adapter-authorize 1  "authorize 0.35.0" 
+.TH canon-adapter-authorize 1  "authorize 0.36.0" 
 .SH NAME
 canon\-adapter\-authorize \- Authorize declared capabilities against repository policy (preflight only)
 .SH SYNOPSIS
@@ -41,4 +41,4 @@ Print help
 \fB\-V\fR, \fB\-\-version\fR
 Print version
 .SH VERSION
-v0.35.0
+v0.36.0

package/man/canon-adapter-validate.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-adapter-validate 1  "validate 0.35.0" 
+.TH canon-adapter-validate 1  "validate 0.36.0" 
 .SH NAME
 canon\-adapter\-validate \- Read and validate one provider\-neutral response envelope
 .SH SYNOPSIS
@@ -41,4 +41,4 @@ Print help
 \fB\-V\fR, \fB\-\-version\fR
 Print version
 .SH VERSION
-v0.35.0
+v0.36.0

package/man/canon-adapter.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-adapter 1  "adapter 0.35.0" 
+.TH canon-adapter 1  "adapter 0.36.0" 
 .SH NAME
 canon\-adapter \- Validate a provider\-neutral adapter response without executing a provider
 .SH SYNOPSIS
@@ -43,4 +43,4 @@ Examples:
   canon adapter validate \-\-response response.json
   canon adapter validate \-\-response response.json \-\-repo . \-\-json
 .SH VERSION
-v0.35.0
+v0.36.0

package/man/canon-artifacts-move.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-artifacts-move 1  "move 0.35.0" 
+.TH canon-artifacts-move 1  "move 0.36.0" 
 .SH NAME
 canon\-artifacts\-move \- Move the local artifact blobs to an object\-store tier, verify them, and remove the local copies
 .SH SYNOPSIS
@@ -30,10 +30,10 @@ orchestrator
 The tier to move to: the name of an `s3` tier in canon.yaml (for example `cold`)
 .TP
 \fB\-\-commit\fR
-Act on the previewed plan; needs \-\-plan\-digest
+Make the change; without it the command only previews.
 .TP
-\fB\-\-plan\-digest\fR \fI<DIGEST>\fR
-The `planDigest` the preview printed; the run acts only if the plan recomputed now has this digest
+\fB\-\-plan\-digest\fR \fI<PLAN_DIGEST>\fR
+The digest of the preview this commit carries out.
 .TP
 \fB\-\-repo\fR \fI<DIR>\fR
 The repo to act on (default: the nearest ancestor directory holding a canon.yaml)
@@ -52,7 +52,7 @@ Print version
 .SH EXTRA
 Examples:
   canon artifacts move \-\-tier cold
-  canon artifacts move \-\-tier cold \-\-commit \-\-plan\-digest <DIGEST>
+  canon artifacts move \-\-tier cold \-\-commit \-\-plan\-digest <PLAN_DIGEST>
 
 The bare run previews: it lists every upload and removal and prints a planDigest, and writes nothing. \-\-commit \-\-plan\-digest acts on exactly that plan (PLAN_STALE, exit 2, when it changed since).
 
@@ -60,4 +60,4 @@ The bare run previews: it lists every upload and removal and prints a planDigest
 
 Idempotent and resumable: a run stopped anywhere leaves a repo the gate still passes, and the next run finishes; a second run finds nothing to do. A blob whose bytes do not match its name is never moved. Moving back to local is refused; `\-\-tier local` on a local repo is a no\-op.
 .SH VERSION
-v0.35.0
+v0.36.0

package/man/canon-artifacts-store.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-artifacts-store 1  "store 0.35.0" 
+.TH canon-artifacts-store 1  "store 0.36.0" 
 .SH NAME
 canon\-artifacts\-store \- Store the bound files of existing evidence records and current reviews in the artifact store (.canon/artifacts/sha256/)
 .SH SYNOPSIS
@@ -51,4 +51,4 @@ For records written before canon stored bound bytes (0.11\-0.13), and for any ev
 
 Exit 0 when the pass ran (the gate decides whether an unstored file matters), 2 when the ledger cannot be read or a write fails.
 .SH VERSION
-v0.35.0
+v0.36.0

package/man/canon-artifacts-verify.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-artifacts-verify 1  "verify 0.35.0" 
+.TH canon-artifacts-verify 1  "verify 0.36.0" 
 .SH NAME
 canon\-artifacts\-verify \- Check that the artifact store holds every file the latest evidence and current reviews bind (\-\-full re\-hashes the stored bytes)
 .SH SYNOPSIS
@@ -45,4 +45,4 @@ Asks the store canon.yaml\*(Aqs `artifacts:` block selects (default: local, .can
 
 Exit 0 when every file is stored, 1 when one is missing or altered (data.problems names each), 2 when the store cannot be used or reached: an unreachable store is a refusal, never a pass.
 .SH VERSION
-v0.35.0
+v0.36.0

package/man/canon-artifacts.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-artifacts 1  "artifacts 0.35.0" 
+.TH canon-artifacts 1  "artifacts 0.36.0" 
 .SH NAME
 canon\-artifacts \- Check or move the evidence artifact store (local, or an object\-store tier)
 .SH SYNOPSIS
@@ -42,4 +42,4 @@ Store the bound files of existing evidence records and current reviews in the ar
 canon\-artifacts\-move(1)
 Move the local artifact blobs to an object\-store tier, verify them, and remove the local copies
 .SH VERSION
-v0.35.0
+v0.36.0

package/man/canon-brief-approve.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-brief-approve 1  "approve 0.35.0" 
+.TH canon-brief-approve 1  "approve 0.36.0" 
 .SH NAME
 canon\-brief\-approve \- Record the human\*(Aqs approval of the brief, bound to its text; refused while `brief check` has blockers
 .SH SYNOPSIS
@@ -64,11 +64,12 @@ Examples:
   canon brief approve add\-login add\-search fix\-sync \-\-approver Ana \-\-note \*(AqAll three, go.\*(Aq
 
 Several ids take one name, one answer and one timestamp. Every id is checked
-first; one refused id refuses the call (BRIEF_APPROVE_REFUSED) and nothing is
+first; one refused id refuses the call (the first refused id\*(Aqs code, with a
+detail for each) and nothing is
 written. Writes `Approved: <who> <when> — "<words>" (brief sha256:<digest>)` into the
 brief (the digest covers the brief without its `Approved:` lines) and records
 `canon policy approve` in the same call. Edit the brief afterwards and it reads as
-not approved (BRIEF_CHANGED_SINCE_APPROVAL) until a human answers again and this
+not approved (BRIEF_APPROVAL_STALE) until a human answers again and this
 runs again. Run it only from the human\*(Aqs answer, with their words as \-\-note.
 .SH VERSION
-v0.35.0
+v0.36.0

package/man/canon-brief-check.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-brief-check 1  "check 0.35.0" 
+.TH canon-brief-check 1  "check 0.36.0" 
 .SH NAME
 canon\-brief\-check \- Read the brief against the rules: blocker and advisory findings (exit 0 clean, 1 blockers, 2 refused)
 .SH SYNOPSIS
@@ -41,4 +41,4 @@ Print version
 [\fICHANGE_ID\fR]
 The change to read (default: the repo\*(Aqs only live change)
 .SH VERSION
-v0.35.0
+v0.36.0

package/man/canon-brief-show.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-brief-show 1  "show 0.35.0" 
+.TH canon-brief-show 1  "show 0.36.0" 
 .SH NAME
 canon\-brief\-show \- Show where the change stands and the next one to three steps; never edits
 .SH SYNOPSIS
@@ -50,4 +50,4 @@ Examples:
 
 The operand names the change; without it the repo\*(Aqs only live change is read.
 .SH VERSION
-v0.35.0
+v0.36.0

package/man/canon-brief.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-brief 1  "brief 0.35.0" 
+.TH canon-brief 1  "brief 0.36.0" 
 .SH NAME
 canon\-brief \- Check a change\*(Aqs brief (PRD format) and see the next steps; never edits
 .SH SYNOPSIS
@@ -61,4 +61,4 @@ gets one blocker, `brief.old\-format`: `canon migrate` rewrites it. A brief
 with fewer than two known headings (written before 0.19) checks as `brief.legacy`, an
 advisory. Without \-\-change, the repo\*(Aqs only live change is checked.
 .SH VERSION
-v0.35.0
+v0.36.0

package/man/canon-change-new.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-change-new 1  "new 0.35.0" 
+.TH canon-change-new 1  "new 0.36.0" 
 .SH NAME
 canon\-change\-new \- Write .canon/changes/<slug>/brief.md, import it, and adopt it into a subject
 .SH SYNOPSIS
@@ -63,4 +63,4 @@ Print version
 <\fICHANGE_ID\fR>
 The change\*(Aqs slug (its change_id)
 .SH VERSION
-v0.35.0
+v0.36.0

package/man/canon-change.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-change 1  "change 0.35.0" 
+.TH canon-change 1  "change 0.36.0" 
 .SH NAME
 canon\-change \- Write a plan change (.canon/changes/<slug>/brief.md) and adopt it into a subject
 .SH SYNOPSIS
@@ -39,4 +39,4 @@ Write .canon/changes/<slug>/brief.md, import it, and adopt it into a subject
 Examples:
   canon change new add\-login \-\-subject auth \-\-title \*(AqAdd login\*(Aq
 .SH VERSION
-v0.35.0
+v0.36.0

package/man/canon-completion.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-completion 1  "completion 0.35.0" 
+.TH canon-completion 1  "completion 0.36.0" 
 .SH NAME
 canon\-completion \- Write the shell completion script for canon (bash, zsh or fish)
 .SH SYNOPSIS
@@ -57,4 +57,4 @@ Examples:
 
 The script is generated from the command tree, so it completes exactly what the parser accepts. It needs no repo and no network.
 .SH VERSION
-v0.35.0
+v0.36.0

package/man/canon-context-pack-add.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-context-pack-add 1  "add 0.35.0" 
+.TH canon-context-pack-add 1  "add 0.36.0" 
 .SH NAME
 canon\-context\-pack\-add \- Create an immutable context pack from a repository\-local JSON manifest
 .SH SYNOPSIS
@@ -44,4 +44,4 @@ Print help
 \fB\-V\fR, \fB\-\-version\fR
 Print version
 .SH VERSION
-v0.35.0
+v0.36.0

package/man/canon-context-pack-show.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-context-pack-show 1  "show 0.35.0" 
+.TH canon-context-pack-show 1  "show 0.36.0" 
 .SH NAME
 canon\-context\-pack\-show \- Show a context pack after verifying its manifest and content objects
 .SH SYNOPSIS
@@ -41,4 +41,4 @@ Print version
 <\fIPACK_ID\fR>
 Context pack id (sha256:<64 hex digits>)
 .SH VERSION
-v0.35.0
+v0.36.0

package/man/canon-context-pack-verify.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-context-pack-verify 1  "verify 0.35.0" 
+.TH canon-context-pack-verify 1  "verify 0.36.0" 
 .SH NAME
 canon\-context\-pack\-verify \- Verify a context pack\*(Aqs manifest and immutable content objects
 .SH SYNOPSIS
@@ -41,4 +41,4 @@ Print version
 <\fIPACK_ID\fR>
 Context pack id (sha256:<64 hex digits>)
 .SH VERSION
-v0.35.0
+v0.36.0

package/man/canon-context-pack.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-context-pack 1  "context-pack 0.35.0" 
+.TH canon-context-pack 1  "context-pack 0.36.0" 
 .SH NAME
 canon\-context\-pack \- Create, inspect, and verify reproducible context packs
 .SH SYNOPSIS
@@ -47,4 +47,4 @@ Examples:
   canon context\-pack show sha256:<pack\-digest> \-\-repo . \-\-json
   canon context\-pack verify sha256:<pack\-digest>
 .SH VERSION
-v0.35.0
+v0.36.0

package/man/canon-context.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-context 1  "context 0.35.0" 
+.TH canon-context 1  "context 0.36.0" 
 .SH NAME
 canon\-context \- Show what you can author here: record kinds, fields, enums, policies
 .SH SYNOPSIS
@@ -41,4 +41,4 @@ Print help
 \fB\-V\fR, \fB\-\-version\fR
 Print version
 .SH VERSION
-v0.35.0
+v0.36.0

package/man/canon-dashboard.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-dashboard 1  "dashboard 0.35.0" 
+.TH canon-dashboard 1  "dashboard 0.36.0" 
 .SH NAME
 canon\-dashboard \- Serve the local status dashboard
 .SH SYNOPSIS
@@ -47,4 +47,4 @@ Print help
 \fB\-V\fR, \fB\-\-version\fR
 Print version
 .SH VERSION
-v0.35.0
+v0.36.0

package/man/canon-demo-init.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-demo-init 1  "init 0.35.0" 
+.TH canon-demo-init 1  "init 0.36.0" 
 .SH NAME
 canon\-demo\-init \- Scaffold the demo repo (gate starts RED)
 .SH SYNOPSIS
@@ -41,4 +41,4 @@ Print help
 \fB\-V\fR, \fB\-\-version\fR
 Print version
 .SH VERSION
-v0.35.0
+v0.36.0

package/man/canon-demo-review.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-demo-review 1  "review 0.35.0" 
+.TH canon-demo-review 1  "review 0.36.0" 
 .SH NAME
 canon\-demo\-review \- Record the missing reviewer evidence (gate turns GREEN)
 .SH SYNOPSIS
@@ -41,4 +41,4 @@ Print help
 \fB\-V\fR, \fB\-\-version\fR
 Print version
 .SH VERSION
-v0.35.0
+v0.36.0

package/man/canon-demo.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-demo 1  "demo 0.35.0" 
+.TH canon-demo 1  "demo 0.36.0" 
 .SH NAME
 canon\-demo \- Try the evidence loop end\-to\-end in a throwaway demo repo
 .SH SYNOPSIS
@@ -44,4 +44,4 @@ Examples:
   canon gate check   # RED
   canon demo review && canon gate check   # GREEN
 .SH VERSION
-v0.35.0
+v0.36.0