simt-dev 0.2.1 → 0.3.0

package/docs/decisions/ADR-073-a-kernel-is-a-smaller-projection-the-repository-asks-for.md

@@ -0,0 +1,92 @@
+# ADR-073 — A kernel is a smaller projection the repository asks for, not one it is given
+
+Status: **accepted** · 2026-10-14 · filed as S38 (R07)
+**Affects:** `src/projection/manifest.mjs`, `src/projection/rules.mjs`, `src/measure/context.mjs`,
+`rules/core.md`, `rules/stacks/*.md`, `test/kernel.test.mjs`
+
+## Context
+
+S38 asked for a number — generated always-on bytes per turn — and this repository built the
+meter (ADR-064) and the budget line to measure it against (ADR-072). What the meter then
+made unavoidable is that the budget cannot be met by measuring more carefully. A python
+repository projects 11,305 always-on bytes: the shared core, the python profile, and the
+process rules. A kernel keeps the first of those and defers the other two, and the same
+repository projects 9,551. Sixteen percent, for a declaration.
+
+Plan 0003 R07 describes this as packing kernel lines by priority class, and R08's accept
+criterion — the budget is never exceeded — is only reachable once something is packed. So
+this is the piece R08 waits on.
+
+What R07 does not say is which lines are the kernel, and that question is not rhetorical.
+Classifying a rule is a claim about what a reader loses by not having it: a rule that says
+never force-push is not equivalent to a rule that says prefer descriptive commit subjects,
+and only one of those can be the one thing loaded when nothing matches. The classification
+lives in the rule's own frontmatter, because the judgement belongs beside the text it
+describes and not in a table that would have to be kept in step with 20 files.
+
+## Rulings
+
+1. **The mode is a repository declaration, beside the budget, not inside `projection`.**
+   `mode` is written only when the repository declared it, for exactly the reason ADR-072
+   gave for `budget`: `projection` is a generated key, `upgrade` replaces it wholesale, and
+   a mode that reset itself on upgrade would reset the reader's context size without anyone
+   asking.
+
+2. **Absent means `full`, and `full` stays the default.** Nobody has measured that a kernel
+   is not worse at getting a task done; plan 0003 R02 is that measurement and it has not
+   been run. Shipping a default that quietly withholds rules from every repository on the
+   strength of an unrun study is the same defect as a rule nobody can find.
+
+3. **A rule declares its class in its own frontmatter, and the vocabulary is closed.**
+   `simt-priority: hard | command | convention | style`, ordered as a kernel packs them.
+   An unrecognised value is a defect reported by `graph lint` and `check`, in the order the
+   other frontmatter checks run, rather than a class nobody happened to use.
+
+4. **A rule that states no class is deferred in kernel mode.** An unstated class is not a
+   hard constraint, and the asymmetry decides it: wrongly keeping a line defeats the mode
+   the repository asked for, while wrongly dropping one costs a convention or a style, which
+   `rules show <id>` returns on demand.
+
+5. **The kernel is the two classes a reader loses least from.** `hard` and `command` are
+   what a repository must not do wrong; `convention` and `style` are guidance that is
+   valuable in context and worthless out of it. The shipped content is classified to match:
+   `core.md` is `hard`, and the 19 stack profiles are `convention`.
+
+6. **Everything deferred is named in the region, with the command that shows it.** The
+   region gains a `## Deferred rules` section listing each omitted rule, its class and
+   `rules show <id>`, sorted by class then rule id. A rule left out and named nowhere is a
+   rule the reader cannot find, which is indistinguishable from a rule that was never
+   written — the same defect S50's scoped pointers exist to prevent, in the other
+   direction.
+
+7. **The order is deterministic and is the only thing that determines it.** Class, then
+   rule id. Two machines that project the same repository produce byte-identical regions,
+   which is R08's second half and this repository's standing rule.
+
+8. **A kernel over the budget is a different finding from a full projection over it.** The
+   budget finding takes the mode and says so: in `full`, nothing was cut and the advice is
+   to raise the number or switch to kernel; in `kernel`, the projection is already as small
+   as this mode makes it, so the advice is to raise the number or move rules out of the
+   hard and command classes. Conflating the two would leave a reader believing a trimmed
+   projection was waiting to be trimmed.
+
+## Consequences
+
+A repository that declares `mode: kernel` gets the shared core plus the hard and command
+rules, and a list of everything else with the command to fetch it. The meter's own reading
+drops by about a sixth on a python repository, and the budget finding now distinguishes the
+two reasons a projection can be over its line.
+
+What is not here: the measurement that would justify making `kernel` the default, and the
+workspace-level dedupe R11 proposes. Both are named in the tracker's remaining note for this
+row. This ruling is what makes them measurable rather than what concludes them.
+
+## Rejected
+
+- **Making `kernel` the default.** It withholds guidance from every repository on the
+  strength of a study that has not been run.
+- **A central table of classes rather than frontmatter.** A table beside 20 rule files is a
+  thing to keep in step with them, and the judgement it records belongs next to the text.
+- **Silently deferring, or deferring with a count.** A reader told "12 rules deferred" has
+  to guess which ones apply to the file in front of them; the names are the part that
+  answers.

package/docs/decisions/ADR-074-a-rule-and-a-decision-are-readable-by-uri.md

@@ -0,0 +1,99 @@
+# ADR-074 — A rule and a decision are addressable, so they are readable by URI
+
+Status: **accepted** · 2026-10-14 · filed as S43
+**Affects:** `src/mcp/resources.mjs`, `src/mcp/server.mjs`, `test/mcp.test.mjs`
+
+## Context
+
+Review 0002 filed that the MCP server is two protocol revisions behind and returns text
+only. ADR-068 closed the revision half and every tool now declares an output schema and
+annotations. What remained was the other half of the finding: the server has no
+**resources**, so the two things this tool is actually authoritative about — the rules it
+projects and the decisions it settles — are reachable only through a tool call with an
+argument in it.
+
+That matters for a client that wants to browse rather than query. A tool call asks a
+question and gets an answer; a resource is something a client can list, show in a picker,
+attach to a context window and re-read on demand. The CLI already answers both by id
+(`rules show`, `rules why`); what was missing was the addressable form.
+
+So the specification was fetched and read for both revisions rather than recalled, and it
+turned out the two disagree in a way that decides an observable behaviour: **a missing
+resource is `-32602` (Invalid Params) in 2026-07-28 and `-32002` (Resource not found) in
+2025-06-18.** 2026-07-28 keeps `-32002` only as something a *client* should still accept.
+Both revisions forbid an empty `contents` array for a resource that does not exist, because
+empty is ambiguous — it reads as "here is a resource with no body".
+
+Both revisions also require the capability to be declared, and both permit the empty
+object for a server with no subscriptions and no change notifications. The newer one adds
+`ttlMs` and `cacheScope` to resource results, which is why a resource list is cacheable on
+the newest revision and is a bare list on the two older ones — the same rule ADR-068
+already applies to tools.
+
+## Rulings
+
+1. **Two collections and no others: the rules and the decisions.**
+   `simt://rules/{id}` and `simt://decisions/{adr}`. A resource set that grew with the
+   registry would be a second index to keep honest, and the registry is workspace data
+   (ADR-061) — the package ships none of it, so a client browsing this server in one
+   repository and another would see different sets anyway.
+
+2. **The capability is declared unconditionally, as an empty object.** Every rule and every
+   decision record ships with the package, so there is always something to read; and
+   `{}` is the documented way to say "no subscriptions, no change notifications", which
+   are the two things this server has no way to honour. The previous code gated the
+   capability on a property hung on the tools array that nothing ever set — a promise a
+   client waits on forever, only quieter.
+
+3. **A missing resource is an error, and the code is the revision's own.** `-32602` from
+   2026-07-28, `-32002` from the two older revisions, and never an empty `contents`. A
+   client that reads a URI and gets silence cannot tell a bug from an empty rule, and the
+   two revisions disagree about which code that silence should wear.
+
+4. **Every listed resource carries the bytes it will cost.** `size` is in the specification
+   and it is the one number a client cannot get without reading: an agent assembling a
+   context window needs to know what a resource costs before it spends it. This is the
+   same argument as `simt tokens`, arriving at a different surface.
+
+5. **The frontmatter is rebuilt, unprefixed, and the body's own heading is not repeated.**
+   A rule on disk opens with frontmatter this tool's namespace owns (`simt-`); a resource
+   is read by a client that knows nothing about that namespace, so the identity is
+   reconstructed under plain keys. The loader no longer carries the H1, so the title lives
+   in the frontmatter rather than being re-added by hand in two places.
+
+6. **A decision body is redacted on the way out.** `redactInternalPaths(redactEstate(...))`,
+   the same pass the CLI applies. A resource is readable by anyone holding the connection,
+   which is a wider audience than the repository the CLI is aimed at, and a record whose
+   argument names an estate repository should not travel further just because it became
+   addressable.
+
+7. **Every URI is validated, and a rules id cannot contain a slash.** Custom schemes are
+   allowed, which is precisely why the server checks: a URI naming another scheme, a
+   `..` segment, an empty id or a nested path is refused with the same revision-correct
+   error as one that simply does not exist. A refusal that is distinguishable from a miss
+   is a way to probe the filesystem.
+
+## Consequences
+
+`resources/list` answers 97 entries in this checkout — 20 rules, the process rules, and 73
+decision records — and a client can attach any of them without a tool call. The templates
+list publishes the two shapes, so a client can build the URI for an id it has not listed
+yet.
+
+What this does not do: subscribe to a rule changing, because there is no stream to
+subscribe to and the capability says so. That is a feature, not an omission — a client
+that believes it is subscribed to a projection that only changes on `sync` would be
+waiting for an event this tool will never emit.
+
+## Rejected
+
+- **Serving resources only through tool calls.** That is what the server already did, and
+  the finding is that a client cannot browse what it can only ask about.
+- **An empty `contents` array for a URI that does not exist.** Both revisions treat it as
+  ambiguous, and ambiguity here is what makes a client retry forever.
+- **Exposing the registry as resources too.** It is workspace data and this package ships
+  none of it (ADR-061); a resource list that differed per repository would be the
+  same definition-of-one-thing-twice defect, one layer up.
+- **One error code for all three revisions.** `-32602` on the older two would be a code
+  that revision never defined, and `-32002` on the newest would be advice to clients
+  rather than the specification's own answer.

package/docs/decisions/ADR-075-nothing-leaves-the-machine.md

@@ -0,0 +1,56 @@
+# ADR-075 — Nothing leaves the machine: no telemetry, local transcripts, loopback models by default
+
+Status: **accepted** · 2026-10-14 · filed as D7 (R06)
+**Affects:** `src/measure/session.mjs`, `src/measure/context.mjs`, `src/commands/tokens.mjs`, `src/argv.mjs`, `test/tokens.test.mjs`
+
+## Context
+
+The context meter (`simt tokens`) now goes beyond static repository files to inspect
+recorded agent transcripts (`simt tokens --session <path>`), and later slices in the
+research programme connect optional local model servers for embeddings, distillation and
+pre-review critique.
+
+Session transcripts are among the most sensitive files on a developer's machine: they hold
+every file an agent read, every command output it saw, uncommitted diffs, environment
+diagnostics and prompts written in the middle of debugging. A tool that fetched remote
+session URLs, phoned home usage metrics, or defaulted model calls to a hosted endpoint
+would turn a local measurement command into an exfiltration surface.
+
+## Rulings
+
+1. **No command emits telemetry, analytics or background network traffic.** Every command
+   operates over the local filesystem and stdio alone unless the user explicitly invokes a
+   documented network flag in a later adapter.
+
+2. **`simt tokens --session <path>` accepts local filesystem paths only and refuses URLs.**
+   Any argument carrying a URI scheme (`http://`, `https://`, `ws://`, `ssh://` or any
+   `<scheme>://`) is rejected at argument validation with a configuration exit code and a
+   remedy naming a local file path, before any socket or filesystem read is attempted.
+
+3. **Session attribution is computed deterministically in process with zero dependencies.**
+   Transcript JSON and JSONL records from Claude Code and Codex are split into `rules`
+   (system instructions, inline instruction blocks, and reads of instruction, rule or skill
+   files), `fileReads` (reads of repository source and config files) and `toolOutput`
+   (command and tool execution results) by inspecting the local file alone.
+
+4. **Future local-model adapters default to loopback (`127.0.0.1` / `localhost`) and refuse
+   remote hosts unless explicitly overridden.** When no local model is configured in
+   `simt-dev.json`, no socket is opened at all.
+
+## Consequences
+
+`simt tokens --session <path>` can be run safely on production incident transcripts and
+private repositories because the parser cannot open a network connection. And coupling the
+static meter to the harness loader table (`R14`) means `simt tokens` now counts what each
+reader actually loads at session start — flat `.agents/rules/` scans for Antigravity,
+`alwaysApply: true` for Cursor, `@path` imports for Claude Code, and root-to-cwd chain
+caps for Codex — without leaving the machine.
+
+## Rejected
+
+- **Fetching remote session URLs or cloud share links in `simt tokens --session`.** Convenience
+  for a shared link is also an outbound request from a tool whose contract is that it
+  only reads local state.
+- **Anonymous opt-out telemetry for context budget numbers.** Even aggregate byte counts
+  reveal repository names, adoption state and working hours, and an opt-out flag still
+  ships a network client in the default path.

package/docs/decisions/ADR-076-a-change-to-what-agents-read-is-measured.md

@@ -0,0 +1,70 @@
+# ADR-076 — A change to what agents read is measured before it ships, or labelled unmeasured in its record
+
+Status: **accepted** · 2026-10-15 · filed as D1 (R01)
+**Affects:** `src/bench/mine.mjs`, `src/commands/bench.mjs`, `src/commands/index.mjs`, `src/commands/help.mjs`, `test/bench.test.mjs`
+
+## Context
+
+Every rule and profile projected by this package enters an agent's context window on every
+turn, yet nothing in the repository could say whether a paragraph improved resolution,
+increased token cost, or did neither. Controlled studies on repository context files show
+that unmeasured instructions routinely raise inference cost by 20% or more without moving
+task resolution when they repeat facts the repository already proves.
+
+Without a repository-native task suite and a rule requiring evidence, changes to projected
+context are judged by how plausible the prose sounds to a reviewer rather than by what an
+agent does with it. And a task suite whose verification tests sit inside the agent's
+worktree is trivial to game: an agent can read or weaken the test it is being graded by.
+
+## Rulings
+
+1. **A change to projected context is measured against the benchmark suite before it ships,
+   or its decision record states `unmeasured` and why.** Context changes include core
+   rules, stack profiles, process rules, kernel compilation, command cards and brief
+   assembly. When a slice cannot be run through the benchmark (for example, before the
+   runner is wired or when a rule governs an external release gate), the decision record
+   must carry the explicit label `unmeasured` rather than implying an empirical win.
+
+2. **Benchmark tasks are mined deterministically from non-merge git history.** `simt bench mine`
+   walks non-merge commits with a parent, selects commits that modify both test paths and
+   implementation paths, splits each commit into `test.patch` (test files) and `gold.patch`
+   (implementation files), and assigns the deterministic identifier `t-<shortSha>-01`.
+
+3. **Every mined task is validated twice in an isolated worktree before acceptance.** At
+   the parent commit `BASE`:
+   - `BASE` plus `test.patch` must fail (`RED`) on two consecutive runs with the same
+     failing and passing test identifiers;
+   - `BASE` plus `test.patch` plus `gold.patch` must pass (`GOLD`) on two consecutive runs
+     with zero failing tests and the same passing test identifiers;
+   - any commit whose test outcome differs between the two runs is discarded as flaky.
+
+4. **Test identifiers are extracted from runner-native machine output, never from human
+   console summaries.** The miner parses TAP (`node --test --test-reporter=tap`), Vitest
+   JSON (`--reporter=json`), JUnit XML (Gradle, Maven and `pytest --junitxml`) and Go JSON
+   event streams (`go test -json`) to record exact `f2p` (`FAIL_TO_PASS`) and `p2p`
+   (`PASS_TO_PASS`) test identifiers.
+
+5. **Hidden test patches live in a verifier vault outside every worktree.** Task metadata
+   is written to the adopting repository's benchmark task directory so the suite
+   membership is versioned and reviewable, while `test.patch` and `gold.patch` are written
+   to the user's cache vault (`~/.cache/simt-dev/vault/<repo-id>/<id>/`, or the platform
+   cache equivalent) so an agent running inside a task workspace cannot inspect the
+   verifier test diff or the oracle fix.
+
+## Consequences
+
+`simt bench mine --yes` mines a deterministic, flake-filtered task suite from a
+repository's own commits without network access or model calls. Re-running the miner over
+the same commit history produces byte-identical task JSON files and vault patches.
+
+## Rejected
+
+- **Keeping `test.patch` inside the repository's committed task directory.** An agent
+  evaluated in a checkout of the repository could read the hidden test expectations or the
+  oracle patch directly from disk.
+- **Accepting any commit that touches a test file without running `RED` and `GOLD` twice.**
+  Refactors, formatting commits and flaky tests touch test files without failing on `BASE`,
+  producing tasks where a no-op agent scores 100% or a valid fix fails at random.
+- **Scraping human-formatted test summaries with regular expressions.** Console summaries
+  vary by locale, terminal width and runner version, and do not name individual
+  `FAIL_TO_PASS` test cases needed to grade partial regressions.

package/docs/decisions/ADR-077-the-command-card-leads-the-region-and-reads-committed-evidence.md

@@ -0,0 +1,91 @@
+# ADR-077 — The command card leads the region, and is derived from committed evidence only
+
+Status: **accepted** · 2026-10-16 · filed as R10 (plan 0003)
+**Affects:** `src/kernel/card.mjs`, `src/projection/rules.mjs`, `rules/core.md` (indirectly, as
+the region's first bytes), `test/card.test.mjs`
+
+## Context
+
+Plan 0003 R10 asks for the highest-value, non-inferable bytes: the exact commands for *this*
+repository, at the top of the region, in a block of at most 600 B, "derived from gates and
+runner detection alone, so it needs no index". A reader who has the rules has the same rules
+every other repository has; what they cannot infer is that *their* tests run under
+`./gradlew :app:testDebugUnitTest` and not `npm test`.
+
+Two things the plan leaves open, and both are the kind an implementer gets wrong once:
+
+1. **Which modes carry the card.** R07's kernel is a smaller projection a repository asks
+   for (ADR-073), and R10 says "at the top of the kernel". Read literally, the card would
+   appear only for the repositories that opted into kernel mode — that is, only for the
+   readers who already measured that they can do without guidance. The reader who kept
+   `full` is the one who has the commands nowhere.
+
+2. **What evidence the card may read.** "Runner detection" has two possible meanings here.
+   `readCapability` answers "can this machine run it" by probing PATH and `node_modules`,
+   and that answer is machine-specific. But the projected region is required to be
+   byte-identical on two machines (plan 0003 P4 and R13): the whole reason the tool has no
+   model and no network is that a pull request can meaningfully diff a projection. A card
+   that named whichever linter happened to be installed would differ between a laptop and
+   CI for no reason a diff could explain, and `check` would flake on a clean tree.
+
+## Rulings
+
+1. **The card leads the region in both modes.** `full` and `kernel` differ in which *rules*
+   are packed (ADR-073 ruling 5); neither withholds the commands. The card is bytes the
+   reader most needs and the rules never carry, so it is above even the core, and it is not
+   a rule the kernel can defer.
+
+2. **It is derived from committed evidence only.** Three sources, in precedence order: the
+   manifest's declared `gates.commands`, the repository's own `package.json` scripts, and
+   the marker facts that name its ecosystem. It never reads PATH or `node_modules`.
+   Runnability is a property of the machine; a command is a property of the repository, and
+   only the second belongs in bytes that leave it.
+
+3. **The ecosystem table is the single source, and the gate list cannot disagree with it.**
+   The fallback for a marker that has no declared command is the same `ECOSYSTEMS` table
+   `manifest.mjs` seeds gates from. Two tables would eventually name two different test
+   commands for one repository, which is the drift this tool exists to remove. Python is the
+   one ecosystem the table does not seed, because its runner varies (uv, poetry, tox, nox); the
+   card still names the command a committed lockfile proves — `uv run -m pytest`, never
+   `uv run pytest`, because the uv profile is explicit that the console entrypoint can run a
+   different copy of the package than the one under test.
+
+4. **A template is labelled as a template, per path kind.** The focused-test entries carry
+   `{file}`, `{pkg}`, `{Test}` and `{class}` placeholders and are labelled by the kind of
+   path they apply to, so a reader never pastes a brace into a shell. Which test a given
+   `{file}` maps to is R24's refinement, not R10's.
+
+5. **The ceiling is 600 B, enforced by dropping whole lines, never silently.** Lines drop in
+   a stated order — `format`, `typecheck`, `lint`, `build`, then focused templates from the
+   last — and `test` is never among them, because a card that dropped the test command would
+   have dropped the command it exists to carry. Every drop is named in the projection notes;
+   a card that lost a command in silence is a card the reader cannot tell is incomplete.
+
+6. **It is computed in `desiredRegion`, the one place the region is computed.** `plan` and
+   `checkTarget` therefore cannot hold two opinions about the same card, which is the same
+   property that keeps a clean tree from reporting drift (the comment on `desiredRegion`).
+
+## Consequences
+
+Every adopted repository's region gains the card on the next `sync`, in both modes. That is
+the point of the slice: the bytes were absent everywhere, and the ones added are the ones a
+reader can act on. The card is derived, so it moves only when the repository's own commands
+move — a new `package.json` script, a declared command, or a marker file appearing.
+
+What is not here: which test a `{file}` should be mapped to (R24), the inferability filter
+that would drop a card line the repository already states (R09), and the cost measurement
+that would say whether the card earns its bytes (R02, R27). This ruling is what makes those
+measurable rather than what concludes them.
+
+## Rejected
+
+- **Kernel mode only.** It withholds the card from the readers who kept the larger
+  projection, which is all of them until R02 has run.
+- **Probing PATH or `node_modules`** so the card shows only commands that will run here. The
+  answer would not survive a second machine, and the region is required to.
+- **Writing the commands as rule text.** The commands are data about one repository; a rule
+  is the same in every repository, and a rule that stated one repository's test command would
+  be wrong in every other.
+- **Letting the card grow past 600 B, or trimming it silently.** An unbounded card is a
+  second copy of the rules, and a silently short one is a reader who trusts a card that is
+  missing a command.

package/docs/decisions/ADR-078-a-line-the-repository-already-proves-does-not-ship.md

@@ -0,0 +1,117 @@
+# ADR-078 — A line the repository already proves does not ship, and the author says so
+
+Status: **accepted** · 2026-10-16 · filed as R09 (plan 0003)
+**Affects:** `src/kernel/inferability.mjs`, `src/projection/rules.mjs`, `src/kernel/card.mjs`
+(the verb vocabulary), `src/argv.mjs`, `src/commands/help.mjs`, `test/inferability.test.mjs`,
+`test/shipped.test.mjs` (the estate-name guard's allowlist of the tool's own words)
+
+## Context
+
+Plan 0003 R09 asks for an inferability filter: a rule line may declare
+`simt-inferable-when: <fact expression>`, and when the repository already proves the
+expression the line is dropped — "use `./gradlew`" when the wrapper is the only runner and
+the card names it, "use pnpm" when only `pnpm-lock.yaml` exists. The basis is that content
+the repository already states does not help its reader.
+
+ADR-077 built the card that names this repository's commands and left R09 open as the filter
+"that would drop a card line the repository already states". What the plan leaves open is
+the part that decides whether the mechanism is usable or a trap:
+
+1. **Who may drop a line.** An inferability filter that guesses is a filter that deletes
+   rules a reader needed. "The repository has a `.editorconfig`, so the indentation rule is
+   inferable" is exactly the reasoning that is right most of the time and silent when it is
+   wrong.
+
+2. **What evidence may be read.** The same choice ADR-077 ruling 2 had to make, and the same
+   answer applies: the projected region is required to be byte-identical on two machines
+   (plan 0003 P4, R13), so evidence read off the machine cannot decide what leaves.
+
+3. **What a removal costs the author.** A line that leaves a projection with no trace is the
+   mistake ADR-073 rejected for deferred rules. But a `## Dropped` section would spend region
+   bytes on lines the reader is being told not to read, which is the opposite of the slice's
+   purpose.
+
+## Rulings
+
+1. **A line leaves only when its author says it may.** The mechanism is opt-in per block, by
+   a marker the rule author writes — `<!-- simt-inferable-when: <expression> -->`. Nothing is
+   dropped by inference alone. The tool checks a claim; it does not make one.
+
+2. **The unit is the blank-line-delimited block, and the marker never reaches the region.**
+   A wrapped bullet is marked once and leaves whole, rather than leaving half a sentence
+   behind. The comment is stripped from the region whether or not the line is dropped:
+   `simt-` vocabulary is for the rule's author, not for its reader.
+
+3. **The expression is a conjunction of positive terms over a closed vocabulary.** A term is
+   a fact or stack tag in `KNOWN_TAGS`, a `card:<verb>` for one of the card's five verbs, or
+   a `gate:<name>` the repository declares. There is no negation: every reason a line is
+   redundant is a positive proof the repository offers, and a grammar for a case nobody has
+   is a grammar nobody can be taught. A term outside the vocabulary is a defect, reported
+   through the same field as a broken frontmatter key, so `check` and `rules list` need no
+   second path to a broken rule.
+
+4. **The proofs are committed bytes only.** The repository's own facts and stack, the gates
+   its manifest declares, and the verbs its card names. Never PATH and never `node_modules`,
+   for the reason ADR-077 ruling 2 already settled: a proof read off the machine would make
+   the region differ between a laptop and CI for no reason a diff could explain.
+
+5. **The filter is about the repository's evidence, not about the mode.** It runs in both
+   `full` and `kernel`, for the same reason the card does (ADR-077 ruling 1): inferability is
+   a property of what the repository commits, and inferability of the mode would withhold the
+   saving from every reader who kept the larger projection.
+
+6. **Never silent, and never a heading.** By default a removal is reported as one count in
+   the projection notes, with the command that names each one: `--explain` prints every
+   removal and the evidence behind it. A count is enough to act on; the per-line detail is
+   what an author needs, and a reader is not an author.
+
+7. **The vocabulary has one definition.** `card.mjs` exports the five verbs the card can
+   name, and the filter validates `card:<verb>` against that same list. A copy of the list in
+   the filter would let the card name a verb the filter called unknown.
+
+## Consequences
+
+The region of a repository whose rules carry no marker does not move a byte: the filter
+returns the body by identity when there is nothing marked, so this ruling cannot drift a
+repository that did not ask for it. Where a marker is written — in a repository's own
+`.simt-dev/profiles`, or in a pack — the marked line leaves the region on the next `sync`,
+and `sync --explain` names it and the evidence.
+
+**What has not landed: no shipped rule carries a marker.** `rules/stacks/go.md` states
+"`go build ./...`, `go test ./...` are the entrypoints; `go vet ./...` runs with them" and
+`rules/stacks/uv.md` states "`uv run -m pytest`; **never** `uv run pytest`" — both duplicate a
+card line, and neither is *wholly* inferable, because each also carries a reason the card does
+not state. Dropping them would lose the reason. Marking shipped rule text is therefore a
+content pass with its own blast radius (a change to shipped rule text changes every repository
+at once), not a step of this slice; the mechanism ships first so that pass can be measured.
+
+A marker stays visible in `simt rules show <id>`, which prints the rule's own text. That is
+deliberate: it is the author's annotation, and it is the reason a line they can see in the
+file is absent from the region. It is not region text, and it never reaches one.
+
+`--explain` is a `sync` flag and not a `check` flag, because `sync` is the command that prints
+projection notes and the preview a reader reads before writing. The JSON payload of `sync`
+does not carry notes, so this adds no contract.
+
+One visible oddity, stated because the reader will meet it: `simt rules why ADR-078` prints
+`simt-inferable-when` as a repository this record surveyed, because the decisions reader
+treats every `simt-` word outside its allowlist as one. That is a defect in the reader rather
+than in this ruling — ADR-073 carries the identical one for `simt-priority` — and it is not
+fixed here.
+
+## Rejected
+
+- **Dropping a line the tool judges inferable without a marker.** It is the failure the slice
+  exists to avoid: a rule deleted by a heuristic with no way for the author to see the
+  heuristic was wrong.
+- **A marker on every physical line.** A wrapped bullet is one sentence across two lines;
+  marking lines would let a removal leave half of one behind.
+- **Negation, parentheses or disjunction in the expression.** No shipped reason for a removal
+  is negative, and a grammar with a case nobody uses is a grammar nobody can be taught.
+- **Letting the filter run in `kernel` mode only.** It would withhold a saving from the
+  readers who kept the larger projection, which is all of them until R02 has run.
+- **A `## Dropped` section in the region.** It spends bytes on lines the reader is told not
+  to read, and it moves the rule set for a reason that is not about the reader.
+- **Marking shipped rules now.** No shipped line is wholly inferable, so it would delete
+  rationales to save bytes that the card already saves, and it would change every
+  repository's region in a slice about a mechanism.