simt-dev 0.1.1 → 0.2.1

package/docs/decisions/ADR-018-an-unset-hooks-path-is-not-an-absent-hook.md

@@ -6,14 +6,14 @@ Affects: `simt-dev hooks install`, `simt-dev hooks status`, `simt-dev compare`,
 
 ## Context
 
-Phase 4 began by piloting `simt-dev init` on `simt-space`. The dry run was
+Phase 4 began by piloting `simt-dev init` on `repo-15`. The dry run was
 unremarkable. The defect appeared when I read what `hooks install` would actually
 do to that repository, which is something I had not done in any of the earlier
 phases.
 
-`simt-space` has a hand-written `.git/hooks/pre-commit` — 4088 bytes, with prose
+`repo-15` has a hand-written `.git/hooks/pre-commit` — 4088 bytes, with prose
 explaining why it deliberately does not run tests. `core.hooksPath` is unset.
-`simt-dev hooks status --root ../simt-space --json` reported:
+`simt-dev hooks status --root ../repo-15 --json` reported:
 
 ```json
 { "hooksPath": null, "installed": [{ "event": "pre-commit", "present": false }],
@@ -64,7 +64,7 @@ question, which is why fixing the shared one changed nothing visible.
 1. **Ask git where hooks are, never infer it from whether config exists.**
    `resolveHooksDir(root)` implements the two rules directly: `core.hooksPath`
    when set (a relative value resolves against the top of the working tree, which
-   is what makes `simt-app`'s `hooks` work), otherwise `<git-common-dir>/hooks`.
+   is what makes `repo-05`'s `hooks` work), otherwise `<git-common-dir>/hooks`.
 
    `git rev-parse --git-path hooks` is the obvious shortcut and is unusable. It
    returns `.git/hooks` in a normal repository, `hooks` in a linked worktree, and
@@ -103,7 +103,7 @@ question, which is why fixing the shared one changed nothing visible.
 7. **A foreign hook for an event this tool does not gate is chained, not stopped.**
    `core.hooksPath` does not scope this tool to the events it cares about and leave
    the rest to git; git reads *every* hook from the named directory and from nowhere
-   else. So the moment routing lands, `simt-app`'s `post-checkout`, `post-commit`
+   else. So the moment routing lands, `repo-05`'s `post-checkout`, `post-commit`
    and `post-merge` — events this tool gates nothing about — stop running. Nothing
    fails, nothing is logged, and the hook is still on disk looking intact: the
    failure is indistinguishable from the hook having passed. Ruling 3's refusal
@@ -128,9 +128,9 @@ question, which is why fixing the shared one changed nothing visible.
    anything the author sees.
 
    "Does this tool gate it" is a fact about the manifest, not about the event vocabulary,
-   and reading it the second way cost `simt-app` its `pre-push`. That hook is git-lfs.
+   and reading it the second way cost `repo-05` its `pre-push`. That hook is git-lfs.
    `pre-push` is an event this tool gates *in general*, so a vocabulary check displaced it
-   — and because `simt-app` declares no `pre-push` gate there is no shim for that event
+   — and because `repo-05` declares no `pre-push` gate there is no shim for that event
    either, so git would have found no `pre-push` hook at all. LFS objects would have
    stopped being uploaded, with nothing to notice it: the same silent failure this ruling
    exists to prevent, reached by fixing the wrong half of it. The test asks the manifest.
@@ -154,8 +154,8 @@ a list that rots, so one test now asserts the two agree and another asserts ever
 row carries `notes` and `foreignHooks` even when empty.
 
 Measured across the estate after the fix, six repositories run hooks simt-dev did
-not write — `simt-space` (4088 B), `simt-app` (four hooks), `simt-social` (two),
-`simt-social-api` (two), `simt-landing` (one), and the `.wt-wear-redesign`
+not write — `repo-15` (4088 B), `repo-05` (four hooks), `repo-14` (two),
+`repo-11` (two), `repo-10` (one), and the `.wt-wear-redesign`
 worktree (five, including the `git-lfs` `pre-push`). Every one of them would have
 been silently taken over.
 

package/docs/decisions/ADR-019-a-declared-command-is-the-runner.md

@@ -8,21 +8,21 @@ Affects: `simt-dev init`, `simt-dev check`, `simt-dev hooks status`, `simt-dev h
 ## Context
 
 ADR-017 made `simt-dev init` declare only gates a repository can actually run, and it shipped
-green because the first adopter — `simt-social-media` — is a Node repository whose scripts
+green because the first adopter — `repo-13` — is a Node repository whose scripts
 and binaries are exactly what the filter understood. It was verified by running that
 repository's own tests.
 
-`simt-app`, the third pilot, is a Gradle repository. It has **no `package.json` at all**. The
+`repo-05`, the third pilot, is a Gradle repository. It has **no `package.json` at all**. The
 dry run dropped all five proposed gates, and the remedy for each one was an instruction the
 reader cannot follow. The output as it stood, before this record was written:
 
 ```
-$ simt-dev init --root ../simt-app
+$ simt-dev init --root ../repo-05
   dropped   gate test: no "test" script in package.json
             remedy: add a "test" script to package.json, then re-run: simt-dev init --yes
 ```
 
-Ruling 4 changes both lines. `simt-app` will never have a `package.json`. "Install prettier as
+Ruling 4 changes both lines. `repo-05` will never have a `package.json`. "Install prettier as
 a dev dependency" is equally impossible. The filter was right about the facts and wrong about
 what followed from them, and the reader's only honest reaction to that remedy is to stop
 trusting the next one.
@@ -72,13 +72,40 @@ One manifest. Three answers. The one I would have shipped if I had only run `che
    every file (`ENOTDIR`) and classified every Gradle repository in the estate as having no
    runner at all — a wrong answer from an evidence reader, which is worse than no answer
    because the caller cannot tell them apart.
+8. **A declared command is a shell command line, not an argv.** *(S17, 2026-10-12)*
+
+   It was split on whitespace and handed to `execFile` as an argv. That made a declaration
+   a repository would plausibly write run the wrong thing rather than fail: a flag whose
+   value contains a space became two arguments, and the quotes in a compound line were
+   passed to the program as literal characters. There was no way to express a quoted
+   argument at all, and nothing said so.
+
+   So `gates.commands[name]` is one line, run through `sh -c`, and everything the
+   repository wrote in it survives — quotes, pipes, `&&`, a path with a space. This is the
+   same line the repository would type into its own shell, which is the only definition of
+   "what this repository means by that" that does not require a parser here.
+
+   **The trust boundary is the repository, and it is not a sandbox.** The line comes from
+   the repository's own manifest, which it can read and change, and it runs on its author's
+   own machine when that author commits. `sh -c` adds no privilege: the same person who
+   wrote the line could run it. What `sh -c` must not do is apply to anything this tool
+   resolved itself — a formatter path out of `node_modules/.bin` stays an argv, because
+   handing it to a shell would change who decided its arguments for no gain. The two
+   sources are separate branches in the dispatcher rather than a flag, so the distinction
+   cannot be forgotten by a caller that does not know it exists.
+
+   **Consequence for a repository that relied on the split.** A declaration with no quotes
+   behaves identically, because whitespace-splitting a shell word that needed no quoting
+   is the same thing the shell does. Every use of `gates.commands` in this estate declares
+   a bare path and is unaffected; the change only makes declarations *possible* that were
+   previously impossible rather than making any of them wrong.
 
 ## Consequences
 
-- `simt-app` declares `i18n-completeness: scripts/check_string_translations.sh` on
+- `repo-05` declares `i18n-completeness: scripts/check_string_translations.sh` on
   pre-commit — the gate its own hand-written pre-commit hook already runs — and
   `test: ./gradlew check` on pre-push.
-- The `simt-social-media` and `simt-space` manifests are unaffected: they declare no commands.
+- The `repo-13` and `repo-15` manifests are unaffected: they declare no commands.
 - A Node repository that wants to override a gate now can, without abandoning the gate name it
   shares with every other repository. `gates.commands.format` is a supported thing to write.
 - `readCapability` reads one more file per invocation, and it reads it in a `try` that cannot
@@ -104,7 +131,7 @@ One manifest. Three answers. The one I would have shipped if I had only run `che
 
 ## Evidence
 
-`simt-app` is the first adopter with a non-npm runner and the first to declare a command for a
+`repo-05` is the first adopter with a non-npm runner and the first to declare a command for a
 gate that is not of kind `command`. Every earlier adopter was a Node repository, which is why
 ADR-017's own verification passed. The estate's three runners — npm, Gradle and Python — were
 all in the repository set the whole time; only the pilot order had not reached them.

package/docs/decisions/ADR-023-the-gate-ships-as-a-file-the-repo-owns.md

@@ -14,7 +14,7 @@ the machine of whoever remembers to run it, and a hook is a developer's machine.
 review is somebody else's, and every merge is a machine nobody gated.
 
 The plan called this "a reusable workflow", and named
-`QuazarMedia/simt-dev/.github/workflows/sync-check.yml` as a file "referenced by every
+`the organisation/simt-dev/.github/workflows/sync-check.yml` as a file "referenced by every
 consumer". Nothing in this repository had a `.github/` at all. There were three ways to
 close the gap, and they differ in who the resulting file belongs to:
 
@@ -93,7 +93,7 @@ rules once told readers to edit a source tree they did not have.
 
 ## Rejected
 
-- **`uses: QuazarMedia/simt-dev/.github/workflows/sync-check.yml@main`.** Rejected under
+- **`uses: the organisation/simt-dev/.github/workflows/sync-check.yml@main`.** Rejected under
   ruling 1: it is the plan's own suggestion, and it points every reader at bytes they do
   not have. Worth recording that the plan wrote it, because the next person to read §6
   will find it there.

package/docs/decisions/ADR-027-the-one-gitattributes-line-that-is-neither-dangerous-nor-empty.md

@@ -19,8 +19,8 @@ empty", and deferred it to a record of its own.
 
 The estate confirms the first half and not the conclusion. Thirteen of sixteen repositories
 have no `.gitattributes` at all. The three that do disagree about almost everything:
-`simt-app` declares only LFS filters for `.tif` and `.zip`; `simt-garmin` declares line
-endings plus ConnectIQ binary markers; `simt-social-api` declares exactly one whitespace
+`repo-05` declares only LFS filters for `.tif` and `.zip`; `repo-07` declares line
+endings plus ConnectIQ binary markers; `repo-11` declares exactly one whitespace
 suppression for hash-locked vendored content. There is no divergence here of the kind a
 baseline fixes by being consistent. There is a file missing.
 
@@ -48,7 +48,7 @@ to be the line ruling 7 sent this file to make.
    because nothing in the pattern says those are binary. `text=auto` is a detection: git
    sniffs each path and applies normalisation only to files it concludes are text. This is
    the most common way a repository corrupts its own binaries, and it is invisible until
-   someone diffs an image. `simt-garmin` had independently arrived at `text=auto eol=lf` on
+   someone diffs an image. `repo-07` had independently arrived at `text=auto eol=lf` on
    its first line, which is the strongest available evidence that the estate would pick the
    cautious form if asked — this ruling does not ask, it supplies.
 
@@ -96,8 +96,8 @@ what any file is". A future baseline for a per-stack attribute would have to arr
 different row with its own record, which is what §3.2's keep-it-local rule asks for anyway.
 
 The repositories with an existing `.gitattributes` are the interesting case and they are not
-in conflict: `simt-app`'s LFS filters, `simt-garmin`'s binary markers and
-`simt-social-api`'s whitespace suppression all stay beneath the region and all keep winning,
+in conflict: `repo-05`'s LFS filters, `repo-07`'s binary markers and
+`repo-11`'s whitespace suppression all stay beneath the region and all keep winning,
 because git takes the last match. No repository loses a line it wrote.
 
 This repository adopts neither baseline for itself, and the reason is the same one that keeps

package/docs/decisions/ADR-028-a-base-file-is-a-floor-so-the-disagreement-it-cannot-repair-becomes-a-check.md

@@ -10,7 +10,7 @@ a copied byte range. Settles the `tsconfig.base.json` item of §3.1 row 5 and ro
 ## Context
 
 Row 5 promised eight baselines and named two problems among them that are not about a file
-being missing: simt-goto's seven absent strictness flags, and `moduleResolution` spelled
+being missing: repo-08's seven absent strictness flags, and `moduleResolution` spelled
 inconsistently across the workspace. ADR-025 ruled `tsconfig.base.json` out of the region
 mechanism because JSON has no comments, and its consequences promised that "the next fix is
 three more JSON files and therefore a different mechanism". ADR-026 supplied that mechanism
@@ -95,7 +95,7 @@ one an external document uses.
 
 A TypeScript repository now gets twelve flags it did not have, and one of them — the floor
 arriving through `extends` — is a behaviour change that can surface real type errors in
-`simt-goto`, which is the point of the record and also the reason adoption is one commit
+`repo-08`, which is the point of the record and also the reason adoption is one commit
 with a `tsc` run rather than a silent upgrade. A base file is a floor, and a repository
 that had not been standing on one is the case where raising it finds something.
 

package/docs/decisions/ADR-029-the-pins-a-repository-declares-are-its-own.md

@@ -104,7 +104,7 @@ nobody has been asked, and it is the record to read next for either.
 
 - **A shipped `.nvmrc` or an `engines` value in a shared baseline.** Rejected as
   unrulable: the value is per-repository and the tool can only guess it. Shipping `22` would
-  break `simt-social`, which pins 24.
+  break `repo-14`, which pins 24.
 - **Reporting cross-repository node divergence as a finding.** Rejected by the Context. The
   plan's premise was wrong and the correction is recorded here so it is not re-derived from
   the plan text.

package/docs/decisions/ADR-030-what-a-plan-does-not-ship-is-a-decision-with-a-record.md

@@ -56,7 +56,7 @@ correcting at all.
    detectable by reading the file. Corrected in the row.
 
 5. **Two of the four configurations are plain JavaScript with no TypeScript in them,**
-   `simt-api` and `simt-blog`. A "shared 6-rule ESLint block" cannot describe all four,
+   `repo-04` and `repo-06`. A "shared 6-rule ESLint block" cannot describe all four,
    because two of them have no rules to share — they differ in `ignores` and per-file
    `globals`, which are per-repository facts about paths.
 
@@ -67,7 +67,7 @@ correcting at all.
    may make on its own.
 
 7. **The fix for the two conflicts is one dependency each,** and it is not a shared block.
-   Installing `eslint-config-prettier` in `simt-social` and `simt-social-api` and spreading
+   Installing `eslint-config-prettier` in `repo-14` and `repo-11` and spreading
    it last in the config array resolves both. That is a command per repository, run by the
    repositories, and simt-dev has no business writing it.
 

package/docs/decisions/ADR-031-the-suite-stages-the-environment-it-needs.md

@@ -16,9 +16,9 @@ landed. Not intermittently: 22 of 543 tests failed on runs `37476671363` through
 Three separate causes, none of them recent:
 
 1. **`test/install.test.mjs:17` read the estate off the author's disk.**
-   `const WORKSPACE = resolve(HERE, '..', '..')` is `/Users/said.elimam/code/simt`, and the
-   install tests copied skill bodies out of it — `simt-social-api/.agents/skills/d1-safe-change`,
-   and `singleRepoClone()` out of `simt-social`. On a runner the checkout is
+   `const WORKSPACE = resolve(HERE, '..', '..')` is `/home/developer/code/simt`, and the
+   install tests copied skill bodies out of it — `repo-11/.agents/skills/d1-safe-change`,
+   and `singleRepoClone()` out of `repo-14`. On a runner the checkout is
    `/home/runner/work/simt-dev/simt-dev`, so `../..` is `/home/runner/work/simt-dev`,
    which contains this repository and nothing else. The bodies were not there,
    `skills install` exited 3, and nineteen tests asserted on a refusal they never asked for.

package/docs/decisions/ADR-033-three-plan-rows-closed-by-decision-not-by-authoring.md

@@ -25,7 +25,7 @@ Phase 6 asked to "collapse the 7 drifted Social skill twins to canonical + stub"
 answers the row directly. All three resolvers select `role === 'canonical'` and nothing else —
 `src/commands/skills.mjs` twice, `src/commands/skillsinstall.mjs:291`, `src/mcp/tools.mjs:192` — so
 a copy declared `duplicate` or `variant` is never installed. The one pair that genuinely had to be
-collapsed, `add-country-galaxy`, is already a stub in `simt-social` pointing at the API repo.
+collapsed, `add-country-galaxy`, is already a stub in `repo-14` pointing at the API repo.
 
 Phase 7 asked for a sweep of hardcoded absolute paths. The sweep found 17 tracked files. Six were
 fixed. The two Android `local.properties` files were not, and were nearly fixed by reflex.
@@ -47,7 +47,7 @@ fixed. The two Android `local.properties` files were not, and were nearly fixed
    because resolution never read those bytes. Phase 6's twin collapse is therefore closed as
    already answered, at `a9983c8`.
 
-3. **`local.properties` stays tracked.** Both `simt-app` and `wakt-app` commit it, and both
+3. **`local.properties` stays tracked.** Both `repo-05` and `repo-03` commit it, and both
    `.gitignore` files have the conventional `# local.properties` line commented out at lines 22 and
    24 — a deliberate override of Android's own convention, not an oversight. Untracking them would
    be a house-style change made while closing a plan, and a build machine that checks out without
@@ -74,8 +74,8 @@ unmade decision is not a gap to fill by invention.
 
 **Collapsing `graphify` and `parallel-feature-team`.** Both are declared `duplicate` with matching
 byte counts, so they look like the obvious candidates. `graphify` is `vendored: true` — an
-84 534-byte, ten-file, version-pinned tool present in both Social repos on purpose. Deleting
-simt-social's copy would leave nothing to detect the loss, because resolution only ever read the
+84 534-byte, ten-file, version-pinned tool present in both one repository on purpose. Deleting
+repo-14's copy would leave nothing to detect the loss, because resolution only ever read the
 canonical copy.
 
 **Untracking `local.properties`.** An Android SDK path is machine state, and two repos chose to

package/docs/decisions/ADR-041-the-suite-installs-the-package-in-order-to-test-it.md

@@ -21,7 +21,7 @@ Two facts about this repository make that gap harder to notice than it looks. `t
 reach outside the checkout (ADR-031), and this package has no dependencies (ADR-012). Together
 those mean the suite has no installed copy of itself to test, and the natural workaround —
 borrowing a formatter from a neighbouring checkout — is the one ADR-031 rules out. Prettier 3.8.1
-is sitting in `../simt-blog/node_modules/.bin` and is not available here.
+is sitting in `../repo-06/node_modules/.bin` and is not available here.
 
 ## Ruling
 
@@ -87,6 +87,6 @@ node, git and a POSIX shell; npm is in the same class. A conditional skip conver
 into an unverified one, which is the failure this file was written to stop.
 
 **Copying Prettier out of a sibling checkout.** It exists, it works, and ADR-031 rules it out for
-the same reason it rules out reading skill bodies from `../simt-social`: a suite that passes on
+the same reason it rules out reading skill bodies from `../repo-14`: a suite that passes on
 the author's machine and fails on a runner with only this checkout is evidence about the author's
 directory.

package/docs/decisions/ADR-045-a-dashboard-that-counts-a-defect.md

@@ -16,13 +16,13 @@ Measured over the 16 repositories at `~/code/simt`:
 ```
 staleRuleFiles: 17
 repos naming stale rule files in problems: 0
-simt-app problems:
+repo-05 problems:
   "the generated region was hand-edited; restore it with: simt-dev sync --yes"
   "core.hooksPath is \"hooks\", not the shared dispatcher; run: simt-dev hooks install --yes"
 ```
 
-Five adopted repositories have stale rule files — `simt-app`, `simt-blog` and `simt-social` at 0
-of 3 current, `simt-social-api` and `simt-social-media` at 0 of 4 — and not one of them said so in
+Five adopted repositories have stale rule files — `repo-05`, `repo-06` and `repo-14` at 0
+of 3 current, `repo-11` and `repo-13` at 0 of 4 — and not one of them said so in
 its problems list. The summary already said `staleRuleFiles: 17`, because `summarise` has always
 counted them. So the dashboard was reporting a count of a defect it refused to call a defect.
 

package/docs/decisions/ADR-046-one-rule-one-copy.md

@@ -14,11 +14,11 @@ Review 0001 §S12, marked P1 and "decision". Measured across the estate before a
 the five repositories selecting `opencode,cursor`:
 
 ```
-simt-app           folded=3  .mdc=3  0/3 current
-simt-blog          folded=3  .mdc=3  0/3 current
-simt-social        folded=3  .mdc=3  0/3 current
-simt-social-api    folded=4  .mdc=4  0/4 current
-simt-social-media  folded=4  .mdc=4  0/4 current
+repo-05           folded=3  .mdc=3  0/3 current
+repo-06          folded=3  .mdc=3  0/3 current
+repo-14        folded=3  .mdc=3  0/3 current
+repo-11    folded=4  .mdc=4  0/4 current
+repo-13  folded=4  .mdc=4  0/4 current
 ```
 
 Seventeen generated rule files. Every one of them byte-identical to the section already folded into

package/docs/decisions/ADR-047-a-profile-selects-on-what-a-repository-runs-on.md

@@ -50,7 +50,7 @@ other `react-native`, and neither receives both.
 **Two.** The Android and uv facts name a path at an unknown depth, which the two existing kinds
 (`file`, `dir`) cannot express. A third kind, `glob`, walks at most `GLOB_DEPTH` directory levels
 below the root. The bound is a convention, not a preference: the Android Gradle Plugin puts a
-module's manifest at `<module>/src/main/AndroidManifest.xml`, and simt-app's sits at
+module's manifest at `<module>/src/main/AndroidManifest.xml`, and repo-05's sits at
 `app/src/main/AndroidManifest.xml`. A shallower bound makes `has-android-manifest` the shape S07
 found — a fact no repository could have. A deeper one is a scan rather than a probe, and
 ADR-013's promise is that adding an ecosystem is data, so a fact must not cost a search.
@@ -78,11 +78,11 @@ repository loses coverage:
 
 | Repo | Before | After |
 | --- | --- | --- |
-| `app-ui`, `simt-app`, `wakt-app` | `core, jvm-android` | `core, android, jvm` |
-| `bunnyland-server` | `container, core, python` | `container, core, python, uv` |
+| `repo-01`, `repo-05`, `repo-03` | `core, jvm-android` | `core, android, jvm` |
+| `repo-02` | `container, core, python` | `container, core, python, uv` |
 
 The three Android repositories gain the profile whose body they actually needed and keep the JVM
-build rules; `simt-app` gaining `android` was the row's acceptance criterion. `bunnyland-server`
+build rules; `repo-05` gaining `android` was the row's acceptance criterion. `repo-02`
 carries a committed `uv.lock`, so its gain is the defect repaired, not a new selection.
 
 The rename is breaking in one narrow way: the id `jvm-android` no longer exists. A consumer that

package/docs/decisions/ADR-048-a-baseline-carries-only-keys-a-reader-honours.md

@@ -63,11 +63,11 @@ it.
 
 | Repository | Prettier config | States `singleQuote` | Adopting `quote_type = single` |
 | --- | --- | --- | --- |
-| `simt-api` | `.prettierrc` | `true` | no change |
-| `simt-blog` | `.prettierrc.json` | `true` | no change |
-| `simt-space` | `.prettierrc.json` | `true` | no change |
-| `simt-social-api` | `.prettierrc.json` | absent | **every source file reformatted** |
-| `simt-social` | `.prettierrc.json` | absent | **every source file reformatted** |
+| `repo-04` | `.prettierrc` | `true` | no change |
+| `repo-06` | `.prettierrc.json` | `true` | no change |
+| `repo-15` | `.prettierrc.json` | `true` | no change |
+| `repo-11` | `.prettierrc.json` | absent | **every source file reformatted** |
+| `repo-14` | `.prettierrc.json` | absent | **every source file reformatted** |
 
 Two repositories would have every source file rewritten on the day they adopted the
 tool, in a commit whose message says it adopted a rules projection. The measurement is

package/docs/decisions/ADR-057-an-identity-is-per-developer-and-a-repository-does-not-own-it.md

@@ -0,0 +1,115 @@
+# An identity is per-developer, and a repository does not own it
+
+Status: **accepted** · 2026-10-11
+
+Affects: `simt init`, `src/identity.mjs`, `test/identity.test.mjs`
+
+## Context
+
+Two repositories in the estate carried a `git.config` file in their tracked files.
+It holds a name and an email address:
+
+```ini
+[user]
+	name = <one developer's name>
+	email = <that developer's email address>
+```
+
+Both had a local `include.path` pointing at it, and both worked. Both were also
+wrong in ways that had nothing to do with each other.
+
+**It was a tracked file.** A repository has more than one person in it. Committed,
+one developer's name and email is published to every other developer and to
+everybody who can read the repository. This repository's own release review had
+already said so, in the table of findings, as: *"`git.config` tracked at the root
+with a personal name and email — Identity file in a public tree, read by nothing
+— Remove it from the tree."* The finding was recorded and the file stayed.
+
+**It pointed somewhere else.** Both `include.path` values named
+`../../simt-dev/git.config` — another repository's identity file, resolved through
+the git directory rather than the working tree. Including the git config's own
+file from a relative path three directories up means one repository's commits
+depend on a sibling checkout existing at an expected path, which fails the moment
+anybody clones without it. It went unnoticed because every developer here has a
+global identity configured, so the include resolved to the same person the
+include would have skipped to, and the file it never read was the reason nothing
+broke.
+
+The interesting part is that these are opposite mistakes with the same root.
+`git.config` is not the repository's to own, and treating it as the repository's
+produced both: a file that should have been ignored got committed, and an
+`include` that should have named the repository's own file named a stranger's.
+
+## Ruling
+
+1. **`simt init` writes `git.config` when the repository has none.** It is planned
+   like everything else `init` writes, so it appears in the same preview that lists
+   the rest, and its source is named on the line — writing somebody's name is a
+   statement about a person and the plan says where the name came from.
+
+2. **An existing `git.config` is left exactly as it is.** Not updated, not merged,
+   not reformatted. It may have been written by a person, by an older version of
+   this tool, or by hand years ago, and none of those are this tool's to
+   second-guess.
+
+3. **The identity is derived, in this order, and the first answer wins:**
+   the repository's **last commit author**, then the identity **git would use on
+   this machine anyway**, then nothing.
+
+   Last commit first because it is a fact rather than a default: it is who has
+   actually been working here. It is read from `git log`, not from
+   `git config user.email`, because at that moment the configured value is what the
+   file is about to be derived from, and the step would be circular.
+
+   The second is `--get` rather than `--global`, so it resolves through git's own
+   precedence and returns what a commit would have used had this file never
+   existed. That is the fallback's whole point: it must not be a second opinion
+   about what identity means.
+
+4. **When nothing is available, no file is written.** A placeholder is an identity
+   git would use on the next commit, and an adopting command is the last thing that
+   should invent one. The refusal is printed with its reason rather than swallowed.
+
+5. **Only the keys that were found are written.** A partial identity is written as a
+   partial identity, for the same reason.
+
+6. **`init` adds `git.config` to `.gitignore`** when it creates one, and points
+   `include.path` at `../git.config` — the repository's own file.
+
+   `--replace-all`, not `--add`: a value naming *another* repository's identity file
+   is not an addition to keep, it is a link to break.
+
+   A repository that already *tracks* `git.config` is not untracked by `init`.
+   Removing a tracked file is not something an adopting command should do silently,
+   and doing it would be a change to that repository's history rather than to its
+   working tree.
+
+## Consequences
+
+`src/identity.mjs` is new and is the single answer to "whose identity is this, and
+may we write it". `init` plans it, writes it, gitignores it and repoints the
+include; the four refusals are asserted in `test/identity.test.mjs` rather than
+described, because each of them is the correct answer rather than a failure to try
+harder.
+
+One test scrubs `HOME` and `GIT_CONFIG_GLOBAL` before asserting the "nothing
+anywhere" case. That is not tidiness: a developer with a global `user.email` — which
+is most of them — makes the identity resolvable, so without scrubbing the test
+would pass for the wrong reason on that machine and nowhere else. ADR-031 is about
+a result depending on the author's environment; this test would have been the next
+instance of it.
+
+## Rejected
+
+- **Write `git.config` into the tracked tree, as a shared record of who works
+  here.** This is what the two repositories did, and it is a publication of a
+  person's email address with a commit attached.
+- **Take the identity from the OS (the login name, the home directory).** It
+  produces `<login-name>@example.com` and similar: an identity nobody configured,
+  used for authorship. Ruling 4's refusal covers it.
+- **Overwrite an existing `git.config` when it differs from the derived one.**
+  Difference is not error. A file that has been there for years and disagrees with
+  the last commit author is a decision somebody made.
+- **Fix the `include` only when it is wrong.** The include is only written when it
+  is missing or does not name this repository's own file. Rewriting it when it is
+  already correct would be a no-op that reads as a change.