simt-dev 0.2.1 → 0.3.0

package/src/commands/sync.mjs

@@ -16,8 +16,8 @@
 //     three `.mdc` rules would let a reader believe a repo is fully current when
 //     only the file they happened to open is.
 
-import { mkdir, readFile, symlink, unlink, writeFile } from 'node:fs/promises';
-import { dirname, join } from 'node:path';
+import { mkdir, readFile, stat, symlink, unlink, writeFile } from 'node:fs/promises';
+import { dirname, join, resolve, sep } from 'node:path';
 import { EXIT, emit, emitJson, fail, isJson, note, writeMode } from '../output/index.mjs';
 import { plan, checkTargets, checkTarget, provenanceDigest, loadRules, select, pointerTargets, pointerState } from '../projection/project.mjs';
 import { fingerprint } from '../resolve/fingerprint.mjs';
@@ -27,6 +27,7 @@ import { surfacesLine } from '../projection/surfaces.mjs';
 import { CLI } from '../name.mjs';
 import { MANIFEST_FILE, MANIFEST_LEGACY } from '../name.mjs';
 import { assertVersionPin, packageVersion } from '../package-version.mjs';
+import { resolvePacks } from '../packs.mjs';
 
 /** Findings `sync` reports and does not fail on.
  *
@@ -48,7 +49,7 @@ import { assertVersionPin, packageVersion } from '../package-version.mjs';
  *  people learn to ignore. A *foreign* one — a real file or a real directory where the
  *  pointer belongs — is reported loudly with what is in the way, because that one is a
  *  decision somebody has to make. */
-export const SYNC_NON_BLOCKING = new Set(['pointer-unread', 'orphaned']);
+export const SYNC_NON_BLOCKING = new Set(['pointer-unread', 'orphaned', 'pack-unpinned', 'budget']);
 
 /**
  * Findings `check` reports and does not fail on.
@@ -68,7 +69,20 @@ export const SYNC_NON_BLOCKING = new Set(['pointer-unread', 'orphaned']);
  *
  *  `orphaned` stays non-blocking in both. Nothing can satisfy it, in either command.
  */
-export const CHECK_NON_BLOCKING = new Set(['orphaned']);
+// `pack-unpinned` is here and `pack-digest-mismatch` is not, which is the whole
+// judgement. An unpinned pack still renders its rules correctly; what is missing
+// is the record of which bytes were declared, and failing a gate over a field the
+// tool does not require would fail every repository that vendored a pack and
+// pinned it later. A pack whose bytes do not match its pin renders a region
+// nobody can account for, so that one blocks.
+//
+// `budget` is here for the opposite reason, and it is a ruling rather than a patch
+// (ADR-072). An over-budget finding says the projection is bigger than this repository
+// said it would be, and the remedy is a decision about which rules to narrow — not a
+// missing file. Nothing is cut: the projection is still in full mode, so a gate that
+// failed here would be failing a repository for exceeding a ceiling it set itself,
+// with no way to fix it except lowering the number it wrote down.
+export const CHECK_NON_BLOCKING = new Set(['orphaned', 'pack-unpinned', 'budget']);
 
 export async function syncCommand(positional, flags) {
   const root = flags.root ?? positional[0] ?? process.cwd();
@@ -399,8 +413,43 @@ async function formatterIgnoresManifest(root) {
     .some((line) => line !== '' && !line.startsWith('#') && (line === MANIFEST_FILE || line === MANIFEST_LEGACY));
 }
 
-export async function checkCommand(positional, flags) {
-  const root = flags.root ?? positional[0] ?? process.cwd();
+/**
+ * `gates.cwd` entries that do not resolve to a directory inside the repository.
+ *
+ * Reported here, not only where the gate runs: the dispatcher fails closed on the same
+ * condition, so a reader finds out on their next commit — after writing a commit, which
+ * is the wrong order. The finding names the gate and the path, and says which of the two
+ * things is wrong, because "no such directory" and "outside the repository" are repaired
+ * by different edits.
+ *
+ * @returns {Promise<{file: string, status: string, gate: string, detail: string, remedy: string}[]>}
+ */
+async function gateCwdFindings(root, manifest) {
+  const cwds = manifest?.gates?.cwd;
+  if (!cwds || typeof cwds !== 'object' || Array.isArray(cwds)) return [];
+  const declared = [...(manifest?.gates?.preCommit ?? []), ...(manifest?.gates?.prePush ?? [])];
+  const findings = [];
+  for (const name of Object.keys(cwds).sort()) {
+    if (!declared.includes(name)) continue;
+    const dir = String(cwds[name]);
+    const resolved = resolve(root, dir);
+    const inside = resolved === root || resolved.startsWith(`${root}${sep}`);
+    const isDir = inside && ((await stat(resolved).catch(() => null))?.isDirectory() ?? false);
+    if (isDir) continue;
+    findings.push({
+      file: MANIFEST_FILE,
+      status: inside ? 'gate-cwd-missing' : 'gate-cwd-outside',
+      gate: name,
+      detail: inside
+        ? `gates.cwd["${name}"] is ${dir}, which is not a directory in this repository`
+        : `gates.cwd["${name}"] is ${dir}, which resolves outside the repository`,
+      remedy: `point gates.cwd["${name}"] at a directory in this repository, or remove it to run the gate at the root`,
+    });
+  }
+  return findings;
+}
+
+export async function checkCommand(positional, flags) {  const root = flags.root ?? positional[0] ?? process.cwd();
   const findings = await checkTargets(root, flags);
   const rules = await loadRules(root);
 
@@ -431,6 +480,13 @@ export async function checkCommand(positional, flags) {
       findings.push({ file: MANIFEST_FILE, status: 'version-mismatch', detail: mismatch, remedy: `run: ${CLI} upgrade --yes` });
     }
     findings.push(...unrunnableGates(manifest, await readCapability(root)));
+    findings.push(...(await gateCwdFindings(root, manifest)));
+    // A pack the repository declares but cannot produce is reported here rather
+    // than when a rule happens to be missing, because that is the failure mode
+    // this guards: the region still renders, it renders SHORT, and `check` would
+    // pass. A reader whose rules were quietly halved is worse off than one whose
+    // gate is red, so this is a blocking finding, not a note.
+    findings.push(...(await resolvePacks(root)).findings);
     // A manifest a formatter has rewritten is not wrong, and not editable-away by
     // hand either: the next `init` puts simt-dev's own bytes back and the formatter
     // takes them away again. Reporting it here is what stops that being a surprise

package/src/commands/tokens.mjs

@@ -0,0 +1,169 @@
+// simt-dev tokens - what a reader loads, counted.
+//
+// Review 0002 S38 put the estate's always-on context at 90 KB per turn, 72% of it a
+// paragraph an earlier root had already loaded, and could only say so by reading seven
+// repositories by hand. This command is that reading, and it is the figure plan 0003's
+// later slices are measured against: the context budget (S38 P7), the kernel split
+// (R07) and the workspace dedupe (R11) all need a number that moves when the
+// projection moves, or they are opinions.
+//
+// Three decisions keep the figure honest:
+//
+//   1. It is a READ. No write, no git object, no lock - the same ruling `compare`
+//      follows. An agent running this to orient itself must not be able to change what
+//      the next run will measure.
+//   2. It exits 0. A measurement is not a verdict: a repository over budget is a fact
+//      about the repository, and a command that went red for it would train people to
+//      ignore the number it exists to print. The only failure is being pointed at a
+//      directory that holds no repository to measure.
+//   3. It counts bytes and calls the tokens an approximation every time it prints one.
+//      See src/measure/context.mjs for what that costs and why.
+
+import { resolve } from 'node:path';
+
+import { EXIT, emit, emitJson, fail, isJson } from '../output/index.mjs';
+import { CLI } from '../name.mjs';
+import { discover } from '../compare/discover.mjs';
+import { targetRoot } from '../workspace.mjs';
+import {
+  ALWAYS_ON_BUDGET_BYTES,
+  BYTES_PER_TOKEN,
+  annotate,
+  measureRoot,
+  mcpTools,
+  totals,
+} from '../measure/context.mjs';
+import { measureSession } from '../measure/session.mjs';
+
+/** `1234567`, never `1,234,567`. `toLocaleString` output depends on the locale, and
+ *  this command exists so two machines produce two numbers a pull request can diff. */
+function plain(n) {
+  return String(n);
+}
+
+function files(n) {
+  return n === 1 ? '1 file' : `${plain(n)} files`;
+}
+
+export async function tokensCommand(positional, flags) {
+  if (flags.session !== undefined) {
+    const session = await measureSession(flags.session);
+    if (!session.ok) {
+      return fail(session.error, EXIT.CONFIG, session.remedy);
+    }
+    if (isJson(flags)) {
+      emitJson({
+        ok: true,
+        command: 'tokens',
+        mode: 'session',
+        session: session.path,
+        bytesPerToken: BYTES_PER_TOKEN,
+        rules: session.rules,
+        fileReads: session.fileReads,
+        toolOutput: session.toolOutput,
+        total: session.total,
+      });
+      return EXIT.OK;
+    }
+    const lines = [
+      `tokens   ${session.path}  (session)`,
+      `rules       ${plain(session.rules.bytes)} B  ~${plain(session.rules.tokens)} tokens  (${plain(session.rules.share)}%)`,
+      `file reads  ${plain(session.fileReads.bytes)} B  ~${plain(session.fileReads.tokens)} tokens  (${plain(session.fileReads.share)}%)`,
+      `tool output ${plain(session.toolOutput.bytes)} B  ~${plain(session.toolOutput.tokens)} tokens  (${plain(session.toolOutput.share)}%)`,
+      `total       ${plain(session.total.bytes)} B  ~${plain(session.total.tokens)} tokens`,
+    ];
+    emit(lines.join('\n'), { maxBytes: flags.maxBytes ?? 0 });
+    return EXIT.OK;
+  }
+
+  // `targetRoot` owns the precedence, so `tokens`, `compare` and `upgrade` cannot
+  // disagree about which directory was named (ADR-014).
+  const target = await targetRoot(flags, positional);
+  const root = resolve(target.root);
+
+  const found = await discover(root);
+  if (flags.repos) {
+    if (found.error) {
+      return fail(`${root}: ${found.error}`, EXIT.CONFIG, 'pass --root <path>');
+    }
+    if (found.repos.length === 0) {
+      return fail(
+        `${root} contains no git repositories`,
+        EXIT.CONFIG,
+        `point --root at the directory holding the repositories, or at one repository without --repos`,
+      );
+    }
+    // `discover` sorts, and the order decides which root owns a shared paragraph. A
+    // second sort here would move duplicate bytes between roots and make the workspace
+    // figure irreproducible.
+  } else if (found.shape === 'workspace') {
+    return fail(
+      `${root} holds repositories rather than being one`,
+      EXIT.CONFIG,
+      `measure one with: ${CLI} tokens --root <path>, or every repository under it with: ${CLI} tokens --repos --root ${root}`,
+    );
+  }
+  const roots = flags.repos ? found.repos : [root];
+
+  const rows = [];
+  for (const path of roots) rows.push(await measureRoot(path));
+  annotate(rows);
+
+  const summary = totals(rows);
+  const mcp = mcpTools();
+
+  if (isJson(flags)) {
+    emitJson({
+      ok: true,
+      command: 'tokens',
+      root,
+      mode: flags.repos ? 'repositories' : 'repository',
+      source: target.source,
+      budget: { bytes: ALWAYS_ON_BUDGET_BYTES, bytesPerToken: BYTES_PER_TOKEN },
+      mcp,
+      roots: rows.map(({ documents, ...row }) => row),
+      totals: summary,
+    });
+    return EXIT.OK;
+  }
+
+  const lines = [];
+  if (flags.repos) {
+    lines.push(`tokens   ${root}  ${plain(summary.roots)} repositories  (${target.source})`);
+    for (const row of rows) {
+      const budget = row.budget.over ? `  over budget by ${plain(row.budget.overBy)} B` : '';
+      lines.push(
+        `${row.name}  generated ${plain(row.generatedBytes)} B  duplicate ${plain(row.redundancy.duplicateBytes)} B  unique ${plain(row.redundancy.uniqueBytes)} B${budget}`,
+      );
+      for (const finding of row.findings) lines.push(`note     ${row.name}: ${finding}`);
+    }
+    const share =
+      summary.generatedBytes === 0 ? 0 : Math.round((summary.duplicateBytes / summary.generatedBytes) * 100);
+    lines.push(
+      `totals   generated ${plain(summary.generatedBytes)} B  duplicate ${plain(summary.duplicateBytes)} B (${plain(share)}% of generated)  unique ${plain(summary.uniqueBytes)} B  repeat ${plain(summary.repeatBytes)} B  ~${plain(summary.tokens)} tokens`,
+    );
+  } else {
+    const row = rows[0];
+    lines.push(`tokens   ${row.path}`);
+    lines.push(`state    ${row.adoption}  surfaces ${row.surfaces.length === 0 ? '(AGENTS.md only)' : row.surfaces.join(', ')}`);
+    for (const channel of row.channels) {
+      lines.push(
+        `${channel.channel.padEnd(9)}${files(channel.files)}  ${plain(channel.generatedBytes)} B generated  ${plain(channel.readerBytes)} B read`,
+      );
+    }
+    const verdict = row.budget.over ? `over by ${plain(row.budget.overBy)} B` : 'within budget';
+    lines.push(
+      `always-on ${plain(row.generatedBytes)} B generated  ~${plain(row.generatedTokens)} tokens  budget ${plain(row.budget.bytes)} B  ${verdict}`,
+    );
+    lines.push(
+      `redundant ${plain(row.redundancy.duplicateBytes)} B repeats an earlier repository  ${plain(row.redundancy.repeatBytes)} B repeats an earlier document here  ${plain(row.redundancy.uniqueBytes)} B unique of ${plain(row.redundancy.blockBytes)} B counted in blocks`,
+    );
+    for (const finding of row.findings) lines.push(`note     ${finding}`);
+  }
+  lines.push(
+    `mcp      tools/list ${plain(mcp.bytes)} B of ${plain(mcp.tools)} tools  (the same for every repository, so it is not in any total)`,
+  );
+
+  emit(lines.join('\n'), { maxBytes: flags.maxBytes ?? 0 });
+  return EXIT.OK;
+}

package/src/compare/row.mjs

@@ -19,6 +19,7 @@
 import { checkTargets, PRIMARY_TARGET } from '../projection/project.mjs';
 import { manifestDrift, readManifest } from '../projection/manifest.mjs';
 import { loadRules, select } from '../projection/rules.mjs';
+import { resolvePacks } from '../packs.mjs';
 import { knownGates } from '../hooks/resolve.mjs';
 import { fingerprint } from '../resolve/fingerprint.mjs';
 import { readHooksState, wantsShim } from './hooksstate.mjs';
@@ -34,6 +35,10 @@ import { MANIFEST_FILE } from '../name.mjs';
  * @property {string[]} stack
  * @property {string[]} facts
  * @property {string[]} profiles  profile ids that would be selected
+ * @property {{path: string, profiles: string[], status: string, detail: string|null}[]} packages
+ *   one nested region per workspace package, sorted by path
+ * @property {{path: string, profiles: string[], status: string, detail: string|null}[]} packageProblems
+ *   the nested regions that are not `current`; empty for an unadopted repository
  * @property {string|null} pinnedSha
  * @property {string|null} recordedSha
  * @property {'current'|'drift'|'unmanaged'|'absent'|'malformed'} region
@@ -42,6 +47,8 @@ import { MANIFEST_FILE } from '../name.mjs';
  * @property {boolean} hooksComplete every event installed, executable, not stale
  * @property {string[]} gatesDeclared
  * @property {string[]} gateProblems
+* @property {{name: string, source: string|null, version: string|null, digest: string|null, ok: boolean}[]} packs
+*   the shared rule sets this repo declares, with the digest it has pinned for each
  * @property {string[]} problems     everything wrong, one line each; drives the exit code
  * @property {string[]} notes        worth knowing, but not wrong; does NOT drive the exit code
  */
@@ -55,8 +62,19 @@ import { MANIFEST_FILE } from '../name.mjs';
  * @param {{expectedSha: string, gates: Set<string>}} context
  * @returns {Promise<RepoRow>}
  */
-export async function buildRow(path, context) {
-  const name = path.split('/').filter(Boolean).pop() ?? path;
+/**
+ * A nested-region finding in the row's own vocabulary.
+ *
+ * `checkTargets` speaks in `file` because a finding is printed with the path it names;
+ * a row field is read by key, and a reader looking for `packages[].path` should not
+ * have to know that the finding underneath calls the same thing `file`. One mapper, so
+ * the two arrays cannot drift into different shapes.
+ */
+function packageEntry(f) {
+  return { path: f.file, profiles: f.profiles ?? [], status: f.status, detail: f.detail ?? null };
+}
+
+export async function buildRow(path, context) {  const name = path.split('/').filter(Boolean).pop() ?? path;
   const problems = [];
   const notes = [];
 
@@ -84,6 +102,12 @@ export async function buildRow(path, context) {
   // state a rule written to four surfaces can drift into.
   const region = findings.find((f) => f.file === PRIMARY_TARGET) ?? { status: 'absent' };
   const ruleFindings = findings.filter((f) => f.surface !== undefined);
+  // A nested region is identified by its path, not by a field: `checkTargets` builds
+  // those findings from `checkRegion`, which knows nothing about monorepos, and the
+  // one thing this row needs from them is "which file, what state".
+  const packageFindings = findings
+    .filter((f) => f.file !== undefined && f.file.endsWith(`/${PRIMARY_TARGET}`))
+    .sort((a, b) => (a.file < b.file ? -1 : 1));
   const pointers = findings.filter((f) => f.status?.startsWith('pointer'));
 
   // Adoption is settled BEFORE any problem is collected. Every gate below asks
@@ -105,6 +129,13 @@ export async function buildRow(path, context) {
   // prose above it was still true.
   const { selected: chosen } = select(await loadRules(path), fp.stack ?? [], fp.facts ?? []);
 
+  // The packs this repo shares with its siblings, with the digest it has pinned.
+  // A dashboard that reported `current: 14` while half their rules lived in a
+  // directory that was not there described an estate nobody had. The digest is
+  // the per-repo answer to "which bytes were these", which is what P4 asks for and
+  // what a reviewer comparing two repositories actually wants to see.
+  const { packs, findings: packFindings } = await resolvePacks(path);
+
   const row = {
     name,
     path,
@@ -119,6 +150,12 @@ export async function buildRow(path, context) {
     region: region.status,
     regionDetail: region.detail ?? null,
     surfaces: manifest.manifest?.surfaces ?? null,
+    // One entry per nested region, for the same reason `ruleFiles` is its own object:
+    // a monorepo can have a current root region and one stale package region, and a
+    // single `region` field cannot say which. Sorted by path, because `checkTargets`
+    // returns findings in the order the detector found packages and a dashboard that
+    // reorders rows between runs is a dashboard nobody diffs.
+    packages: packageFindings.map(packageEntry),
     ruleFiles: {
       total: ruleFindings.filter((f) => f.status !== 'orphaned').length,
       current: ruleFindings.filter((f) => f.status === 'current').length,
@@ -130,6 +167,19 @@ export async function buildRow(path, context) {
       orphaned: ruleFindings.filter((f) => f.status === 'orphaned').map((f) => f.file),
     },
     pointers: pointers.map((p) => ({ file: p.file, state: p.status })),
+    // A nested region that is not `current` is a problem for the same reason a stale
+    // rule file is: `check` exits 1 on it, and a row that reported the repository as
+    // current anyway is ADR-045's defect one level down. Gated on adoption, like every
+    // other gate here — an unadopted repo has no root region and therefore no nested
+    // findings to report, which is not a second defect for the same missing adoption.
+    packageProblems: adoption === 'adopted' ? packageFindings.filter((f) => f.status !== 'current').map(packageEntry) : [],
+    packs: packs.map((p) => ({
+      name: p.name,
+      source: p.source,
+      version: p.version,
+      digest: p.declared || null,
+      ok: p.ok,
+    })),
     hooksRouted: hooks.routed,
     hooksComplete: hooks.complete,
     gatesDeclared: declaredGates(manifest.manifest),
@@ -163,6 +213,22 @@ export async function buildRow(path, context) {
     problems.push(`${MANIFEST_FILE} ${manifest.error}`);
   }
 
+  // Stale nested regions, named by path, with the remedy the finding already carries.
+  // A monorepo with four packages and one drifted region must not report `current`.
+  for (const f of row.packageProblems) {
+    problems.push(`${f.path}: ${f.detail ?? 'the package region is not current'}; run: ${CLI} sync --yes`);
+  }
+
+  // `pack-unpinned` is a note here for the same reason it is non-blocking in
+  // `check`: the rules render, and only the record of which bytes they were is
+  // absent. A missing or mismatched pack is a problem, because that row would
+  // otherwise report a repository `current` while projecting fewer rules than the
+  // manifest declares - the defect ADR-045 was about, reached a different way.
+  for (const f of packFindings) {
+    if (f.status === 'pack-unpinned') notes.push(`${f.file}: ${f.detail}; ${f.remedy}`);
+    else problems.push(`${f.file}: ${f.detail}; ${f.remedy}`);
+  }
+
   // A generated field of the manifest is stale, and `check` refuses on it. This row
   // said the repository was `current` anyway, in all fourteen adopted repositories at
   // once, so a dashboard that reported `current: 14, problems: 0` was describing a
@@ -318,6 +384,11 @@ export function summarise(rows, extra = {}) {
     malformed: count((r) => r.region === 'malformed'),
     hooksRouted: count((r) => r.hooksRouted),
     staleRuleFiles: rows.reduce((n, r) => n + (r.ruleFiles?.stale?.length ?? 0), 0),
+    // Counted here and not derived from `withProblems`: one monorepo with three drifted
+    // packages is one repository with three findings, and a reader asking "how much is
+    // stale" wants 3, not 1. `withProblems` still counts the repository once.
+    stalePackages: rows.reduce((n, r) => n + (r.packageProblems?.length ?? 0), 0),
+    packageRegions: rows.reduce((n, r) => n + (r.packages?.length ?? 0), 0),
     withProblems: count((r) => r.problems.length > 0),
     withOwnHooks: count((r) => (r.foreignHooks ?? []).length > 0),
     shas: [...shas.entries()].sort((a, b) => (a[0] === '(none)' ? 1 : b[0] === '(none)' ? -1 : b[1] - a[1])),

package/src/decisions/index.mjs

@@ -20,6 +20,7 @@ import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { MANIFEST_FILE } from '../name.mjs';
 import { CLI } from '../name.mjs';
+import { PREFIX_ARGUING, TOOL_WORDS } from '../toolwords.mjs';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 export const DECISIONS_DIR = resolve(HERE, '..', '..', 'docs', 'decisions');
@@ -240,7 +241,7 @@ export async function loadDecisions({ all = false } = {}) {
         (m) => `ADR-${m[1]}`,
       ),
       partial,
-      summary: summarise(text, partial, { all }),
+      summary: summarise(text, partial, { all, file }),
       bytes: Buffer.byteLength(text),
     });
   }
@@ -288,7 +289,7 @@ export function byId(decisions) {
  *   answer "why is this here"; the reader who needs the rest asks.
  * @returns {{ruled: string[], rulingNumbers: (number|null)[], rulingCount: number, rejected: string[], writtenAgainst: string[]}}
  */
-function summarise(text, partial = [], { all = false } = {}) {
+function summarise(text, partial = [], { all = false, file = null } = {}) {
   // A section ends at the next `## ` — but not at one inside a fenced code block.
 // ADR-007's entire ruling is a document skeleton in a fence whose headings are `##`,
 // so the old lookahead ended the section at the first line of the ruling itself. It
@@ -446,7 +447,15 @@ const section = (name) => {
     // Named rather than stripped. A record that cites this org's repositories is still
     // the record; silently deleting the citation would hide which decisions were made in
     // response to what, and would mangle sentences mid-clause.
-    writtenAgainst: [...new Set(text.match(ESTATE) ?? [])].sort(),
+    //
+    // What is named is a repository, and the shape was wrong about that: every
+    // `simt-<word>` that was not `simt-dev` was reported as one, so the tool's own
+    // `simt-priority` was listed as a surveyed repository and the record that settled the
+    // kernel read as if it had been decided by looking at some other repository (ADR-080).
+    // A record whose subject is the prefix is arguing rather than citing, so it names none.
+    writtenAgainst: PREFIX_ARGUING.has(file)
+      ? []
+      : [...new Set((text.match(ESTATE) ?? []).filter((name) => !TOOL_WORDS.has(name)))].sort(),
   };
 }
 
@@ -458,6 +467,10 @@ const section = (name) => {
  * The skill registry's `source.repo` values are asserted to match this (S14); a name
  * the registry adds that is not `simt-*` has to be added here or that assertion fails.
  *
+ * The shape is not the whole answer, and treating it as one is what ADR-080 settles: a
+ * `simt-` name this tool owns is not a repository, and neither reader can tell that from
+ * the shape. `src/toolwords.mjs` is the list both of them share.
+ *
  * Not global: callers reuse it with `exec`, and a `/g` flag would remember `lastIndex`.
  */
 /**
@@ -486,7 +499,12 @@ export const ESTATE_NAME =
 
 /** Replace estate repository names with a phrase a reader who does not have them can use. */
 export function redactEstate(text) {
-  return text.replace(new RegExp(ESTATE_NAME.source, 'g'), 'a repository');
+  return String(text ?? '').replace(new RegExp(ESTATE_NAME.source, 'g'), (name) =>
+    // The tool's own names are left where they are. Redacting them turned a ruling about
+    // `simt-priority` into a sentence about `a repository`, which is how a reader learned
+    // that the record had surveyed something and not what it said (ADR-080).
+    TOOL_WORDS.has(name) ? name : 'a repository',
+  );
 }
 
 /**
@@ -506,7 +524,7 @@ export function redactEstate(text) {
  * Only a real verb follows, which is what keeps `simt-dev.json`, `simt-dev-check.yml` and
  * `simt-dev's` untouched - those are the project's artefacts and the project keeps its name.
  */
-const VERB = '(?:init|doctor|check|sync|upgrade|ci|compare|hooks|mcp|rules|skills|graph|--[a-z-]+)';
+const VERB = '(?:init|doctor|check|sync|upgrade|ci|compare|hooks|mcp|rules|skills|graph|tokens|harness|bench|--[a-z-]+)';
 
 function redactCommand(text) {
   return String(text ?? '').replace(new RegExp(`\\bsimt-dev (?=${VERB})\\b`, 'g'), `${CLI} `);