docs(requirements): split canonical app shape rule

Split oversized canonical_authoring/001 into canonical app shape, ordinary-code escape hatches, and CSS ownership rows.

req: canonical_authoring/001

req: canonical_authoring/010

req: canonical_authoring/011

AGENTS.md

@@ -57,7 +57,7 @@ Keep it stable. Prefer pointers to canonical sources over copied structure, file
 - Use the same Workout command surface for tests, production build, and mobile release: `cargo run -p hemx-xtask -- workout test`, `cargo run -p hemx-xtask -- workout build`, `HEMX_WORKOUT_ORIGIN=https://workout.example.com cargo run -p hemx-xtask -- workout mobile-release`, and `HEMX_WORKOUT_ORIGIN=https://workout.example.com cargo run -p hemx-xtask -- workout mobile-verify`; Android/iOS SDKs, store submission targets, and signing remain external blockers, not repo-owned secrets. req: examples/006 req: examples/011
 - hemx core stays small: effects, typed ids, registries, and wire schema only.
 - Routing, auth, sessions, transport, transitions, sync, and storage belong in integration/user crates.
-- Public examples and beginner APIs should use generated resources and `IntoEffect`, not raw ids or runtime opcodes.
+- Public examples and beginner APIs should use templates plus Rust, generated resources, and `IntoEffect`, not raw ids, selectors, wire formats, or runtime opcodes. req: canonical_authoring/001 req: canonical_authoring/010
 - `examples/html_examples` is the copy-paste HTML pattern gallery for htmx-style examples; keep exact htmx URL slugs visible while translating behavior to boring `.heml`, generated resources, and server-owned Rust state. req: htmx_equivalents/001 req: htmx_equivalents/005 req: examples/007
 - Use `cargo run -p hemx-xtask -- app new PATH` for the generic page/form/keyed-row/notice starter, and `cargo run -p hemx-xtask -- app new --mobile PATH` for the phone-first starter with host capabilities, recovery truth, and release-kit commands. req: ceremony/005 req: ceremony/006
 - The public component-reuse explanation lives in `docs/recipes/reusable-partials.md`; do not grow a client component framework to explain partial composition.

REQUIREMENTS.md

@@ -50,7 +50,13 @@ client app state framework.
 ## canonical_authoring
 
 ### req: canonical/001
-001	The canonical app shape is templates plus Rust, not a frontend folder: `.heml` files declare `data-hemx-root`, `data-hemx-slot`, `data-hemx-handle`, `data-hemx-form`, `h-key`, optional pending/page/island facts, and handlers return generated UI commands. Ordinary app code avoids selectors, numeric ids, raw effects, wire formats, manual registries/form parsing, raw `SafeHtml`, and raw render calls. Plain CSS owns appearance. [north_star]
+001	The canonical app shape is templates plus Rust, not a frontend folder: `.heml` files declare roots, slots, handles, forms, keys, and optional pending/page/island facts; handlers return generated UI commands. [north_star]
+
+### req: canonical/010
+010	Ordinary app code avoids selectors, numeric ids, raw effects, wire formats, manual registries/form parsing, raw `SafeHtml`, and raw render calls. [north_star]
+
+### req: canonical/011
+011	Plain CSS owns appearance. [north_star]
 
 ### req: canonical/002
 002	Typed partial swaps are the primary UX, not an advanced feature: handlers change domain state in Rust, convert domain values into view values, render hemplate partials through generated helpers, and place them into generated targets. The real primitive is generated target + rendered partial + swap kind. [north_star]