@journeykit/canon 0.38.0 → 0.39.0

package/dist/skills/SKILL.src.md

@@ -168,7 +168,13 @@ binds it, and, with `--keep-days N`, while any evidence or review of the last
 `N` days binds it; the bare run previews the blobs it deletes and why the rest
 stay, and `--commit --plan-digest` deletes. A deleted local blob stays in git
 history (shrinking that history is the repo owner's call, not the command's); a
-deleted object of an object-store tier is gone for good.
+deleted object of an object-store tier is gone for good. The preview and the
+commit also cover the stale temp files a killed blob write leaves in
+`.canon/artifacts/sha256` (`.tmp-<sha256>-<pid>-<nanos>`, a regular file
+modified over five minutes ago): the plan lists them in `data.staleTemps`, and
+`artifacts verify` only counts them (it deletes nothing and its exit does not
+change). A temp file is no finished blob, so deleting it changes no record; one
+that git already tracks must be taken out of the commit.
 
 ### Search and trace
 
@@ -338,7 +344,7 @@ preview helps elsewhere (`init`, `skills install`, `export`, `inventory sync`,
 `subject adopt`, …) `--dry-run` validates fully and writes nothing.
 
 ```bash
-canon purge --kind session --before 2026-01-01
+canon purge --kind run --before 2026-01-01
 ```
 
 ## Upgrading a repo from 0.27
@@ -441,7 +447,6 @@ current step needs.
 | `canon-gate` | Evidence, gates, task checkboxes, hooks. |
 | `canon-review` | Findings and reviews. |
 | `canon-artifact-ingest` | `canon ingest records`: artifacts into verdict trajectories. |
-| `canon-session-ingest` | `canon ingest sessions`: agent transcripts into session records. |
 | `canon-plan-import` | `canon ingest plans`: plan state into change and task records. |
 | `canon-storage` | Storage rungs, tiers, retention, export, purge. |
 | `canon-policy` | The policy and the CEL expressions behind it. |

package/dist/skills/reference/canon-artifact-ingest.md

@@ -71,8 +71,6 @@ promotion/demotion.
 
 ## What this skill does NOT cover
 
-- Session/cost ingestion (`canon ingest sessions`) — a different
-  pipeline; see the `canon-session-ingest` skill.
 - Strategy promotion/demotion mechanics — see the `canon-learn` skill;
   this skill only produces the verdict evidence promotion reads.
 - The `regime_key` grammar itself — see `canon-retrieve`, which derives

package/dist/skills/reference/canon-gate.md

@@ -24,7 +24,7 @@ Every violation carries one of these stable, grep-able strings:
 | `uncovered-cell` | Either a policy-required evidence cell (role × artifact) with no matching record, or — with `spec_coverage` enabled — a spec scenario that is unimplemented or mismatched, or a feature surface missing a `require_cases` case. The detail string distinguishes them. Coverage means "a test exists", not "a test passed": even a `Divergent` verdict satisfies the role-cell form. At `verifying → shipped`, a `Divergent` latest verdict is `uncovered-cell` unless a reviewer accepted it (see Accepted divergence below), and a chore's approval, like a blocker closed `fixed`, needs every evidenced scenario evidenced again afterwards (see Re-verification below). |
 | `unreviewed-promotion` | An artifact tagged `reviewed` has no matching ledger review record — or, with `spec_coverage.require_review` set, an in-scope scenario has no qualifying `Review`: none at all, only self-reviews, only stale reviews (the spec or evidence it pinned changed since), or only `indeterminate`/`unavailable` ones. Also, subject `policy`: the policy changed since its approval or its approval is unreadable (fails closed; see `canon-policy`). See `canon-review`. |
 | `trust-below-required` | Achieved trust level is below `policy.yaml`'s `trust_required` for its class — RELEASE-scoped only (`canon gate check --release`); never fires on an ordinary run. |
-| `stale-evidence` | A passing record degraded to stale: its declared surface changed since its `evidence_sha`, or HEAD moved past `staleness.max_commits_behind`. Only degrades an already-green record. Also: a file bound to a latest evidence record whose bytes are gone — no intact blob in `.canon/artifacts/sha256/` and no working-tree copy with the recorded digest — or a file bound to an in-effect review with no intact blob (see Bound evidence stays provable below). |
+| `stale-evidence` | A passing record degraded to stale: a path that changed since its `evidence_sha` matches its declared surface (`--surface-ref`, a path pattern read from the repository root; the detail names the declarations and paths that matched), or HEAD moved past `staleness.max_commits_behind`. Only degrades an already-green record. Also: a file bound to a latest evidence record whose bytes are gone — no intact blob in `.canon/artifacts/sha256/` and no working-tree copy with the recorded digest — or a file bound to an in-effect review with no intact blob (see Bound evidence stays provable below). |
 | `malformed-evidence` | A candidate record doesn't parse, is misfiled, or carries an unparseable interim tag. Malformed evidence is no evidence. |
 | `flagged` | The human-only `flagged` overlay is set — never green regardless of passing evidence. |
 | `unevidenced-flip` | `canon task done <task_id>` was asked to flip a checkbox with no matching, non-`Divergent` evidence record. |
@@ -628,7 +628,8 @@ downloads and re-hashes) and refuse, never pass, when it cannot be reached.
 store; it is the repo owner's decision. `canon artifacts prune` (a preview;
 `--commit --plan-digest` acts) deletes the blobs no record binds any more and
 leaves what `gate check` and `artifacts verify` read, so their answers do not
-change; it is the repo owner's decision too. See `canon-storage`.
+change (it also deletes the stale `.tmp-` files a killed blob write left, which
+`artifacts verify` counts without deleting); it is the repo owner's decision too. See `canon-storage`.
 
 `canon gate check` re-checks every file bound to a LATEST evidence record
 (the latest per task and per `(project_id, scenario_id)`):
@@ -698,6 +699,30 @@ binding. This is still attestation input, not proof of the changed paths;
 run/diff metadata is authoritative when available, and an unavailable
 binding is a gate violation rather than a clean result.
 
+A `--surface-ref` that is not `effect:...` is a path pattern read from the
+repository root with the glob of `code.exclude`: `*` and `?` do not cross
+`/`, `**` does, a directory matches everything below it, and a trailing `/`
+is dropped. `src/`, `src`, `src/**` and `src/*.rs` all go `stale-evidence`
+when `src/a.rs` changes; for `src/x/b.rs` the first three do and `src/*.rs`
+does not. A name with no `/` is the file at the root: `Cargo.toml` is
+the root manifest, not every crate's. A value identical to a changed path
+matches it, and `effect:` is never compared with paths. A value that
+matches no file of the work tree is recorded all the same, with a
+`SURFACE_REF_UNMATCHED` warning. The `paths` of a risk tier keep their
+older reading (`*` crosses `/`) until the next release that breaks
+compatibility.
+
+When git cannot read the base commit of a passing cell, `canon gate check`
+prints one `staleness_unresolvable` advisory and `canon status` one
+`STALENESS_UNRESOLVABLE` warning, with the same sentence: how many
+(subject, role) cells, how many for each reason (`base_missing`: the commit
+is not in this repository, as in a shallow clone or after `git gc
+--prune=now`; `base_not_ancestor`: it is not an ancestor of HEAD, as after
+a squash merge; `git_unavailable`: git did not answer), the first three
+subjects, and `git fetch --unshallow` in a shallow clone. Verdicts and the
+exit status do not change: a `base_missing` or `git_unavailable` cell adds
+nothing, a `base_not_ancestor` cell is judged from `<base>..HEAD`.
+
 Approval identity is separate from attestation text. An approval counts
 only when it carries a detached SSH signature (`ssh-keygen -Y sign -n
 canon-approval-v1` over `canon evidence approval-payload`'s bytes) that

package/dist/skills/reference/canon-report-dashboard.md

@@ -1,9 +1,9 @@
 # canon-report-dashboard
 
-canon's single status surface: `canon report build` renders TEN panels to
-markdown, `canon report snapshot` exports the same ten marts to
+canon's single status surface: `canon report build` renders NINE panels to
+markdown, `canon report snapshot` exports the same nine marts to
 Parquet, and `canon dashboard` serves a small zero-network web app that
-renders SEVEN of them from such a snapshot. Neither surface computes an
+renders SIX of them from such a snapshot. Neither surface computes an
 aggregate itself — both read canon's precomputed
 `crates/canon-store/sql/views.sql` marts, and each run reads the corpus
 ONCE (`crates/canon-report/src/query.rs`'s `PIN_CORPUS_SQL`), so no two
@@ -35,7 +35,7 @@ drift-checked.
 
 ## `canon report build [--repo <dir>]`
 
-Renders the current ten-panel report to `<repo>/.canon/REPORT.md`.
+Renders the current nine-panel report to `<repo>/.canon/REPORT.md`.
 `--repo` resolves through the nearest-`canon.yaml`-ancestor walk every
 subcommand uses — omit it (or pass `.`) to run from any subdirectory.
 
@@ -82,7 +82,7 @@ and commit the result.
 
 ## `canon report snapshot <dir>`
 
-Exports all ten views to `<dir>/<table>.parquet` plus a
+Exports all nine views to `<dir>/<table>.parquet` plus a
 `<dir>/manifest.json`. One explicit `COPY` per view — the exported
 columns are each view's own `SELECT` list, wider than the curated column
 subset the markdown tables render. `file` is always
@@ -98,7 +98,6 @@ existing consumer's order never moves:
   "source_digest": "...",
   "tables": [
     { "table": "mart_trust_matrix", "file": "mart_trust_matrix.parquet" },
-    { "table": "mart_session_costs", "file": "mart_session_costs.parquet" },
     { "table": "mart_role_memory", "file": "mart_role_memory.parquet" },
     { "table": "mart_flywheel_funnel", "file": "mart_flywheel_funnel.parquet" },
     { "table": "mart_review_burndown", "file": "mart_review_burndown.parquet" },
@@ -174,7 +173,7 @@ human's explicit answer, with `--relayed-via`. The page lists the approvals an
 agent recorded for the human under "Approved through an agent" (`relayed` in
 `GET /api/briefs`), with the role, actor and tool of each.
 
-The dashboard renders SEVEN panels — trust matrix, session costs, role
+The dashboard renders SIX panels — trust matrix, role
 memory, flywheel funnel, review burn-down, review rounds, review totals.
 **Scope status
 and subjects are exported to the snapshot but have no dashboard panel**;
@@ -186,7 +185,7 @@ The dashboard's freshness banner shows the snapshot's
 snapshot, not necessarily the live checkout" note — treat "matches
 `canon report`" as "matches the inputs that produced THIS snapshot".
 
-## Reading the ten panels
+## Reading the nine panels
 
 In `canon report`'s own render order. Each panel names the view that
 computes it; nothing here is derived a second time.
@@ -202,17 +201,6 @@ computes it; nothing here is derived a second time.
   version; `green` and `who` are read off one whole winner row, so they can
   never come from two different attestations.
 
-- **Session costs** (`mart_session_costs`) — token/cost per
-  `(session, client, role, workspace_label)`. Every `run`/`session`/
-  `token_usage` record is folded to its latest version first, so
-  a re-ingested corrected cost REPLACES the superseded figure instead of being summed with it.
-  `workspace_label` is NOT a repo identity: it is the last non-empty path
-  segment of the `token_usage` event's workspace key and nothing more, so it
-  SPLITS one repo whose worktrees sit in differently-named directories and
-  MERGES two different repos sharing a directory name. Two stronger fields
-  exist and this mart reads neither — the event's own `workspace_key`, and
-  `Session.project_key`, which `canon-cli` stamps to the main worktree's key.
-
 - **Role memory** (`mart_role_memory`) — per-`(role, regime_key)` strategy
   counts. `hit_rate` is NOT a retrieval hit rate: it is the fraction of that
   namespace's distilled strategies carrying no `demotion` flag, i.e.
@@ -355,25 +343,28 @@ computes it; nothing here is derived a second time.
   a row is one change's review history, and `findings` moves with how
   much reviewing happened rather than with the change.
 
-Two marts in `views.sql` are NOT report panels and are not exported by
-`--snapshot`: `mart_records_by_kind` and `mart_session_run_handoff`.
-Read them with DuckDB directly against `views.sql`.
+One mart in `views.sql` is NOT a report panel and is not exported by
+`--snapshot`: `mart_records_by_kind`. It counts records per stored kind, so
+rows of the retired `session`/`event` kinds that remain in a store still show
+there until `canon purge` deletes them. Read it with DuckDB directly against
+`views.sql`.
 
 - **Run observability** (`mart_run_observability`) — one row per folded
-  `run_id`, appended as the tenth report/snapshot table after the established
-  nine tables. It reports lifecycle identifiers/status/timestamps, latency
-  only when both timestamps exist, event and label counts, child-run count,
-  guidance count, lineage provider/model, and token/cost source totals. These
-  are bounded observations and proxies: event counts do not infer tool calls,
-  retries, or human interventions, and no field claims guidance caused an
-  outcome. `directive_event_count` and `guidance_count` are counts only;
-  directive and guidance text is never emitted. `*_unknown` columns explicitly
-  expose missing joins/coverage, including missing session/project/task/lineage,
-  end timestamps, event times, costs, and guidance. Workspace absolute paths
-  and verbatim directives/guidance are intentionally omitted. The adapter
-  contract is strict read-only validation; this panel does not execute
-  adapters or enforce provider sandbox capabilities. Privacy-safe omission of
-  paths and directive/guidance text is part of the current semantics.
+  `run_id`, the ninth and last report/snapshot table after the established
+  eight tables. It reports lifecycle identifiers/status/timestamps, latency
+  only when both timestamps exist, child-run count, guidance count, and
+  lineage provider/model, all read from the `Run` record alone. These are
+  bounded observations and proxies: no field claims guidance caused an
+  outcome. `guidance_count` is a count only; guidance text is never emitted.
+  `*_unknown` columns explicitly expose missing values, including missing
+  session/project/task/parent-run lineage, end timestamps, provider/model and
+  guidance; a `Run` stored without `project_key` reads `project_key_unknown`.
+  There are no cost, token or event columns: canon has no cost or token
+  report and no replacement for it. Workspace absolute paths and verbatim
+  guidance are intentionally omitted. The adapter contract is strict
+  read-only validation; this panel does not execute adapters or enforce
+  provider sandbox capabilities. Privacy-safe omission of paths and guidance
+  text is part of the current semantics.
 
 ## What this skill does NOT cover
 

package/dist/skills/reference/canon-storage.md

@@ -198,6 +198,26 @@ it is `ARTIFACTS_STORE_FAILED` (an object) or `WRITE_FAILED` (a local file); aft
 some, `ARTIFACTS_PRUNE_INCOMPLETE` names what was deleted, and a new preview
 lists what remains.
 
+A blob write stages `.canon/artifacts/sha256/.tmp-<sha256>-<pid>-<nanos>` and
+renames it when it is complete; a write killed in between (SIGKILL, a power
+cut) leaves the file, and nothing else removes it. `canon artifacts prune`
+counts the **stale** ones (a regular file of exactly that name shape, modified
+more than five minutes ago; a younger file may be a live write, and a link, a
+directory, a file stamped in the future or a name of another shape such as
+`.tmp-notes` is never touched) in `data.staleTemps` (`files`, `bytes` and the
+first names), apart from the blobs, and the commit deletes exactly the ones the
+plan lists. They are part of the plan digest, so a temp file added or removed
+since the preview is `PLAN_STALE`; the commit checks each again under the
+store lock and skips one that changed; a repo with only temp files and no blob
+to delete still gets the `--commit` command. `canon artifacts verify` takes no
+lock and deletes nothing: it prints one line with the count and bytes and
+`canon artifacts prune` when there are any, `data.staleTemps` always carries
+`files` and `bytes` (`unreadable` instead, never a zero, when the store
+directory cannot be read), and the exit follows the bound files alone. A temp
+file is no finished blob, so deleting it changes no record. One that was
+already committed is a tracked file: take it out of the commit (`git rm`, then
+commit); the preview's `staleTemps.gitNote` says so.
+
 ## What `canon report build` does and doesn't read
 
 canon exposes layered `stg_`/`int_`/`mart_` query views; `canon report build`
@@ -223,7 +243,11 @@ is the canonical data-lifecycle boundary: the bare run previews: it prints the r
 its `planDigest` and deletes nothing; `--commit --plan-digest <planDigest>` deletes only if
 the plan recomputed now has the same digest (`PLAN_STALE`, exit 2, when the
 data moved). The only purgeable kinds are
-`session`, `run`, `event`, and `trajectory`; the cutoff applies to every
+`run` and `trajectory`, plus the retired `session` and `event` (kept for this
+release only so stored rows can be deleted — delete them now, after the next
+release only direct database access remains; they read no routing, so they
+find rows in every configured tier even after `canon migrate` removes the
+`routing:`/`aging:` keys); the cutoff applies to every
 routed rung and every configured aging destination, including retained
 historical versions. For `trajectory`, the command also purges the
 operator-local Parquet learn store under `learn.root` in `canon.yaml`;

package/dist/skills/reference/role-implementer.md

@@ -156,7 +156,7 @@ canon inventory sync --json
 ```
 ```text
 # Read stored records across every storage tier
-usage: canon query --kind <change|task|scenario|session|run|event|handoff|review|divergence|trajectory|strategy_item|evidence|subject|finding> [--since <TIMESTAMP>] [--plugin <PLUGIN_ID> | --history] [--change <CHANGE_ID>] [--status <STATUS>] [--domain <NAME>] [--include-sensitive] [--limit <N> | --all] [--cursor <CURSOR>] [--fields <FIELDS>]
+usage: canon query --kind <change|task|scenario|run|handoff|review|divergence|trajectory|strategy_item|evidence|subject|finding> [--since <TIMESTAMP>] [--plugin <PLUGIN_ID> | --history] [--change <CHANGE_ID>] [--status <STATUS>] [--domain <NAME>] [--include-sensitive] [--limit <N> | --all] [--cursor <CURSOR>] [--fields <FIELDS>]
 ```
 ```bash
 canon query --kind evidence --json
@@ -184,7 +184,7 @@ canon schema evidence add --json
 ```
 ```text
 # Search records, brief sections and scenario text, with each hit's neighbors in the record graph
-usage: canon search <TEXT> [--kind <change|task|scenario|session|run|event|handoff|review|divergence|trajectory|strategy_item|evidence|subject|finding|brief>]* [--expand <N>] [--limit <N>]
+usage: canon search <TEXT> [--kind <change|task|scenario|run|handoff|review|divergence|trajectory|strategy_item|evidence|subject|finding|brief>]* [--expand <N>] [--limit <N>]
 ```
 ```bash
 canon search timeout --kind finding --json

package/dist/skills/reference/role-orchestrator.md

@@ -158,7 +158,7 @@ canon evidence approval-payload --scenario auth.login.01 --project root --approv
 ```
 ```text
 # Export a redacted retention manifest without deleting records
-usage: canon export --kind <change|task|scenario|session|run|event|handoff|review|divergence|trajectory|strategy_item|evidence|subject|finding> [--before <TIMESTAMP>] [--after <TIMESTAMP>] [--output <FILE>] [--include-sensitive] [--limit <N> | --all] [--cursor <CURSOR>] [--fields <FIELDS>] [--dry-run] [--input]
+usage: canon export --kind <change|task|scenario|run|handoff|review|divergence|trajectory|strategy_item|evidence|subject|finding> [--before <TIMESTAMP>] [--after <TIMESTAMP>] [--output <FILE>] [--include-sensitive] [--limit <N> | --all] [--cursor <CURSOR>] [--fields <FIELDS>] [--dry-run] [--input]
 ```
 ```bash
 canon export --kind evidence --output evidence.json --json
@@ -206,13 +206,6 @@ usage: canon ingest records [--watch] [--interval-secs <N>] [--dry-run] [--run <
 canon ingest records --json
 ```
 ```text
-# Import agent CLI session transcripts (omp/pi, Claude Code, Codex, Hermes)
-usage: canon ingest sessions [--watch] [--interval-secs <N>] [--home <DIR>] [--full] [--all-workspaces] [--dry-run] [--input]
-```
-```bash
-canon ingest sessions --json
-```
-```text
 # Set up canon in a repo (canon.yaml, a starter policy, the AGENTS.md block, a plans home)
 usage: canon init [--check] [--no-agents-md | --check] [--policy <light|standard|strict> | --check | --no-policy] [--harness <claude|codex|omp|pi> | --check | --no-harness]* [--language <TAG> | --check] [--dry-run | --check] [--input]
 ```
@@ -272,15 +265,15 @@ canon prompt show reviewer@v1 --json
 ```
 ```text
 # Remove allowlisted records older than a cutoff
-usage: canon purge --kind <session|run|event|trajectory> --before <TIMESTAMP> [--commit --plan-digest <PLAN_DIGEST>] [--input]
+usage: canon purge --kind <run|trajectory|session|event> --before <TIMESTAMP> [--commit --plan-digest <PLAN_DIGEST>] [--input]
 # a bare run previews and prints planDigest; `--commit --plan-digest <PLAN_DIGEST>` with that digest acts
 ```
 ```bash
-canon purge --kind session --before 2020-01-01T00:00:00Z --json
+canon purge --kind run --before 2020-01-01T00:00:00Z --json
 ```
 ```text
 # Read stored records across every storage tier
-usage: canon query --kind <change|task|scenario|session|run|event|handoff|review|divergence|trajectory|strategy_item|evidence|subject|finding> [--since <TIMESTAMP>] [--plugin <PLUGIN_ID> | --history] [--change <CHANGE_ID>] [--status <STATUS>] [--domain <NAME>] [--include-sensitive] [--limit <N> | --all] [--cursor <CURSOR>] [--fields <FIELDS>]
+usage: canon query --kind <change|task|scenario|run|handoff|review|divergence|trajectory|strategy_item|evidence|subject|finding> [--since <TIMESTAMP>] [--plugin <PLUGIN_ID> | --history] [--change <CHANGE_ID>] [--status <STATUS>] [--domain <NAME>] [--include-sensitive] [--limit <N> | --all] [--cursor <CURSOR>] [--fields <FIELDS>]
 ```
 ```bash
 canon query --kind evidence --json
@@ -329,14 +322,14 @@ canon schema evidence add --json
 ```
 ```text
 # Search records, brief sections and scenario text, with each hit's neighbors in the record graph
-usage: canon search <TEXT> [--kind <change|task|scenario|session|run|event|handoff|review|divergence|trajectory|strategy_item|evidence|subject|finding|brief>]* [--expand <N>] [--limit <N>]
+usage: canon search <TEXT> [--kind <change|task|scenario|run|handoff|review|divergence|trajectory|strategy_item|evidence|subject|finding|brief>]* [--expand <N>] [--limit <N>]
 ```
 ```bash
 canon search timeout --kind finding --json
 ```
 ```text
 # Run canon's built-in fixture self-tests
-usage: canon selftest [--suite <trust-spine-gate|tiered-storage|typed-authoring-vocabulary|policy-expressions|format-authority|session-ingest|canon-context|artifact-ingest|spec-ledger-selftest|plugin-overlays|plan-import>]
+usage: canon selftest [--suite <trust-spine-gate|tiered-storage|typed-authoring-vocabulary|policy-expressions|format-authority|canon-context|artifact-ingest|spec-ledger-selftest|plugin-overlays|plan-import>]
 ```
 ```bash
 canon selftest --suite trust-spine-gate --json
@@ -650,8 +643,10 @@ canon ledger compact
 
 `canon artifacts move --tier <tier>` moves the local artifact store to an
 object store and removes the local blobs, `canon artifacts prune` deletes the
-blobs no record binds any more (a deleted local blob stays in git history; a
-deleted object of a tier is gone for good), and `purge` deletes records. They
+blobs no record binds any more and the stale `.tmp-` files a killed write left
+in the store (a deleted local blob stays in git history; a deleted object of a
+tier is gone for good; `canon artifacts verify` only counts the temp files), and
+`purge` deletes records. They
 are the repo owner's decisions, not steps of the loop: run the preview, give
 the human the effects, and run the commit only on their answer. If the repo is
 large, the store is slow or the human has not asked for it, do not run it.

package/dist/skills/reference/role-planner.md

@@ -95,7 +95,7 @@ canon gate check --json
 ```
 ```text
 # Read stored records across every storage tier
-usage: canon query --kind <change|task|scenario|session|run|event|handoff|review|divergence|trajectory|strategy_item|evidence|subject|finding> [--since <TIMESTAMP>] [--plugin <PLUGIN_ID> | --history] [--change <CHANGE_ID>] [--status <STATUS>] [--domain <NAME>] [--include-sensitive] [--limit <N> | --all] [--cursor <CURSOR>] [--fields <FIELDS>]
+usage: canon query --kind <change|task|scenario|run|handoff|review|divergence|trajectory|strategy_item|evidence|subject|finding> [--since <TIMESTAMP>] [--plugin <PLUGIN_ID> | --history] [--change <CHANGE_ID>] [--status <STATUS>] [--domain <NAME>] [--include-sensitive] [--limit <N> | --all] [--cursor <CURSOR>] [--fields <FIELDS>]
 ```
 ```bash
 canon query --kind evidence --json
@@ -123,7 +123,7 @@ canon schema evidence add --json
 ```
 ```text
 # Search records, brief sections and scenario text, with each hit's neighbors in the record graph
-usage: canon search <TEXT> [--kind <change|task|scenario|session|run|event|handoff|review|divergence|trajectory|strategy_item|evidence|subject|finding|brief>]* [--expand <N>] [--limit <N>]
+usage: canon search <TEXT> [--kind <change|task|scenario|run|handoff|review|divergence|trajectory|strategy_item|evidence|subject|finding|brief>]* [--expand <N>] [--limit <N>]
 ```
 ```bash
 canon search timeout --kind finding --json

package/dist/skills/reference/role-reviewer.md

@@ -115,7 +115,7 @@ canon gate check --json
 ```
 ```text
 # Read stored records across every storage tier
-usage: canon query --kind <change|task|scenario|session|run|event|handoff|review|divergence|trajectory|strategy_item|evidence|subject|finding> [--since <TIMESTAMP>] [--plugin <PLUGIN_ID> | --history] [--change <CHANGE_ID>] [--status <STATUS>] [--domain <NAME>] [--include-sensitive] [--limit <N> | --all] [--cursor <CURSOR>] [--fields <FIELDS>]
+usage: canon query --kind <change|task|scenario|run|handoff|review|divergence|trajectory|strategy_item|evidence|subject|finding> [--since <TIMESTAMP>] [--plugin <PLUGIN_ID> | --history] [--change <CHANGE_ID>] [--status <STATUS>] [--domain <NAME>] [--include-sensitive] [--limit <N> | --all] [--cursor <CURSOR>] [--fields <FIELDS>]
 ```
 ```bash
 canon query --kind evidence --json
@@ -150,7 +150,7 @@ canon schema evidence add --json
 ```
 ```text
 # Search records, brief sections and scenario text, with each hit's neighbors in the record graph
-usage: canon search <TEXT> [--kind <change|task|scenario|session|run|event|handoff|review|divergence|trajectory|strategy_item|evidence|subject|finding|brief>]* [--expand <N>] [--limit <N>]
+usage: canon search <TEXT> [--kind <change|task|scenario|run|handoff|review|divergence|trajectory|strategy_item|evidence|subject|finding|brief>]* [--expand <N>] [--limit <N>]
 ```
 ```bash
 canon search timeout --kind finding --json

package/man/canon-adapter-authorize.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-adapter-authorize 1  "authorize 0.38.0" 
+.TH canon-adapter-authorize 1  "authorize 0.39.0" 
 .SH NAME
 canon\-adapter\-authorize \- Authorize declared capabilities against repository policy (preflight only)
 .SH SYNOPSIS
@@ -41,4 +41,4 @@ Print help
 \fB\-V\fR, \fB\-\-version\fR
 Print version
 .SH VERSION
-v0.38.0
+v0.39.0

package/man/canon-adapter-validate.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-adapter-validate 1  "validate 0.38.0" 
+.TH canon-adapter-validate 1  "validate 0.39.0" 
 .SH NAME
 canon\-adapter\-validate \- Read and validate one provider\-neutral response envelope
 .SH SYNOPSIS
@@ -41,4 +41,4 @@ Print help
 \fB\-V\fR, \fB\-\-version\fR
 Print version
 .SH VERSION
-v0.38.0
+v0.39.0

package/man/canon-adapter.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-adapter 1  "adapter 0.38.0" 
+.TH canon-adapter 1  "adapter 0.39.0" 
 .SH NAME
 canon\-adapter \- Validate a provider\-neutral adapter response without executing a provider
 .SH SYNOPSIS
@@ -43,4 +43,4 @@ Examples:
   canon adapter validate \-\-response response.json
   canon adapter validate \-\-response response.json \-\-repo . \-\-json
 .SH VERSION
-v0.38.0
+v0.39.0

package/man/canon-artifacts-move.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-artifacts-move 1  "move 0.38.0" 
+.TH canon-artifacts-move 1  "move 0.39.0" 
 .SH NAME
 canon\-artifacts\-move \- Move the local artifact blobs to an object\-store tier, verify them, and remove the local copies
 .SH SYNOPSIS
@@ -60,4 +60,4 @@ The bare run previews: it lists every upload and removal and prints a planDigest
 
 Idempotent and resumable: a run stopped anywhere leaves a repo the gate still passes, and the next run finishes; a second run finds nothing to do. A blob whose bytes do not match its name is never moved. Moving back to local is refused; `\-\-tier local` on a local repo is a no\-op.
 .SH VERSION
-v0.38.0
+v0.39.0

package/man/canon-artifacts-prune.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-artifacts-prune 1  "prune 0.38.0" 
+.TH canon-artifacts-prune 1  "prune 0.39.0" 
 .SH NAME
 canon\-artifacts\-prune \- Delete the artifact blobs no record binds any more (the bare run previews; \-\-commit \-\-plan\-digest deletes)
 .SH SYNOPSIS
@@ -70,6 +70,8 @@ The bare run previews: it says how many blobs and bytes go and stay, why each ke
 
 A deleted local blob leaves the working tree, so commit the removal with the ledger; it stays in git history, and shrinking that history is the repo owner\*(Aqs call, not this command\*(Aqs. A deleted object of a tier cannot be undone: the tier keeps no other copy. A delete that fails stops the run (ARTIFACTS_PRUNE_INCOMPLETE says what was deleted); a new preview lists what remains.
 
+It also deletes the stale temp files a killed blob write left in .canon/artifacts/sha256 (`.tmp\-<sha256>\-<pid>\-<nanos>`, a regular file modified over five minutes ago; a younger file, a link, a directory or any other name stays): the preview lists them in data.staleTemps, the plan digest covers them, and the commit checks each again under the store lock. A temp file is no finished blob, so deleting it changes no record; one git already tracks must be taken out of the commit. `canon artifacts verify` only counts them.
+
 Exit 0 for a preview or a commit, 1 when a delete failed, 2 when the plan is stale or the records or the store cannot be read.
 .SH VERSION
-v0.38.0
+v0.39.0

package/man/canon-artifacts-store.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-artifacts-store 1  "store 0.38.0" 
+.TH canon-artifacts-store 1  "store 0.39.0" 
 .SH NAME
 canon\-artifacts\-store \- Store the bound files of existing evidence records and current reviews in the artifact store (.canon/artifacts/sha256/)
 .SH SYNOPSIS
@@ -51,4 +51,4 @@ For records written before canon stored bound bytes (0.11\-0.13), and for any ev
 
 Exit 0 when the pass ran (the gate decides whether an unstored file matters), 2 when the ledger cannot be read or a write fails.
 .SH VERSION
-v0.38.0
+v0.39.0

package/man/canon-artifacts-verify.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-artifacts-verify 1  "verify 0.38.0" 
+.TH canon-artifacts-verify 1  "verify 0.39.0" 
 .SH NAME
 canon\-artifacts\-verify \- Check that the artifact store holds every file the latest evidence and current reviews bind (\-\-full re\-hashes the stored bytes)
 .SH SYNOPSIS
@@ -44,5 +44,7 @@ Print version
 Asks the store canon.yaml\*(Aqs `artifacts:` block selects (default: local, .canon/artifacts/sha256) about each bound file, the way `canon gate check` does. For an object store that is one HEAD per distinct digest plus the size and sha256 metadata written at upload; \-\-full downloads each blob and re\-hashes it.
 
 Exit 0 when every file is stored, 1 when one is missing or altered (data.problems names each), 2 when the store cannot be used or reached: an unreachable store is a refusal, never a pass.
+
+It also counts the stale temp files a killed blob write left in .canon/artifacts/sha256 (`.tmp\-<sha256>\-<pid>\-<nanos>`, modified over five minutes ago): data.staleTemps has their files and bytes (unreadable, never 0, when the directory cannot be read) and a line names `canon artifacts prune`, which deletes them. verify deletes nothing, and a temp file never changes the exit.
 .SH VERSION
-v0.38.0
+v0.39.0

package/man/canon-artifacts.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-artifacts 1  "artifacts 0.38.0" 
+.TH canon-artifacts 1  "artifacts 0.39.0" 
 .SH NAME
 canon\-artifacts \- Check or move the evidence artifact store (local, or an object\-store tier)
 .SH SYNOPSIS
@@ -45,4 +45,4 @@ Move the local artifact blobs to an object\-store tier, verify them, and remove
 canon\-artifacts\-prune(1)
 Delete the artifact blobs no record binds any more (the bare run previews; \-\-commit \-\-plan\-digest deletes)
 .SH VERSION
-v0.38.0
+v0.39.0

package/man/canon-brief-approve.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-brief-approve 1  "approve 0.38.0" 
+.TH canon-brief-approve 1  "approve 0.39.0" 
 .SH NAME
 canon\-brief\-approve \- Record the human\*(Aqs approval of the brief, bound to its text; refused while `brief check` has blockers
 .SH SYNOPSIS
@@ -74,4 +74,4 @@ chore whose approval saw the code tree that is still the current one asks for no
 not approved (BRIEF_APPROVAL_STALE) until a human answers again and this
 runs again. Run it only from the human\*(Aqs answer, with their words as \-\-note.
 .SH VERSION
-v0.38.0
+v0.39.0

package/man/canon-brief-check.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-brief-check 1  "check 0.38.0" 
+.TH canon-brief-check 1  "check 0.39.0" 
 .SH NAME
 canon\-brief\-check \- Read the brief against the rules: blocker and advisory findings (exit 0 clean, 1 blockers, 2 refused)
 .SH SYNOPSIS
@@ -41,4 +41,4 @@ Print version
 [\fICHANGE_ID\fR]
 The change to read (default: the repo\*(Aqs only live change)
 .SH VERSION
-v0.38.0
+v0.39.0

package/man/canon-brief-show.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-brief-show 1  "show 0.38.0" 
+.TH canon-brief-show 1  "show 0.39.0" 
 .SH NAME
 canon\-brief\-show \- Show where the change stands and the next one to three steps; never edits
 .SH SYNOPSIS
@@ -50,4 +50,4 @@ Examples:
 
 The operand names the change; without it the repo\*(Aqs only live change is read.
 .SH VERSION
-v0.38.0
+v0.39.0

package/man/canon-brief.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-brief 1  "brief 0.38.0" 
+.TH canon-brief 1  "brief 0.39.0" 
 .SH NAME
 canon\-brief \- Check a change\*(Aqs brief (PRD format) and see the next steps; never edits
 .SH SYNOPSIS
@@ -61,4 +61,4 @@ gets one blocker, `brief.old\-format`: `canon migrate` rewrites it. A brief
 with fewer than two known headings (written before 0.19) checks as `brief.legacy`, an
 advisory. Without \-\-change, the repo\*(Aqs only live change is checked.
 .SH VERSION
-v0.38.0
+v0.39.0

package/man/canon-change-new.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-change-new 1  "new 0.38.0" 
+.TH canon-change-new 1  "new 0.39.0" 
 .SH NAME
 canon\-change\-new \- Write .canon/changes/<slug>/brief.md, import it, and adopt it into a subject
 .SH SYNOPSIS
@@ -63,4 +63,4 @@ Print version
 <\fICHANGE_ID\fR>
 The change\*(Aqs slug (its change_id)
 .SH VERSION
-v0.38.0
+v0.39.0

package/man/canon-change.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-change 1  "change 0.38.0" 
+.TH canon-change 1  "change 0.39.0" 
 .SH NAME
 canon\-change \- Write a plan change (.canon/changes/<slug>/brief.md) and adopt it into a subject
 .SH SYNOPSIS
@@ -39,4 +39,4 @@ Write .canon/changes/<slug>/brief.md, import it, and adopt it into a subject
 Examples:
   canon change new add\-login \-\-subject auth \-\-title \*(AqAdd login\*(Aq
 .SH VERSION
-v0.38.0
+v0.39.0

package/man/canon-completion.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-completion 1  "completion 0.38.0" 
+.TH canon-completion 1  "completion 0.39.0" 
 .SH NAME
 canon\-completion \- Write the shell completion script for canon (bash, zsh or fish)
 .SH SYNOPSIS
@@ -57,4 +57,4 @@ Examples:
 
 The script is generated from the command tree, so it completes exactly what the parser accepts. It needs no repo and no network.
 .SH VERSION
-v0.38.0
+v0.39.0

package/man/canon-context-pack-add.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH canon-context-pack-add 1  "add 0.38.0" 
+.TH canon-context-pack-add 1  "add 0.39.0" 
 .SH NAME
 canon\-context\-pack\-add \- Create an immutable context pack from a repository\-local JSON manifest
 .SH SYNOPSIS
@@ -44,4 +44,4 @@ Print help
 \fB\-V\fR, \fB\-\-version\fR
 Print version
 .SH VERSION
-v0.38.0
+v0.39.0