simt-dev 0.3.0 → 0.3.1

package/docs/decisions/ADR-096-impact-names-who-a-change-reaches.md

@@ -0,0 +1,38 @@
+# ADR-096 — impact names who a change reaches
+
+Status: **accepted** · 2026-10-18 · filed as R23 (plan 0003)
+
+**Affects:** `src/index/impact.mjs`, `src/commands/impact.mjs`, `test/impact.test.mjs`
+
+## Context
+
+A change has a neighbourhood: the files that import it, the tests of that
+neighbourhood, the decisions and rules that govern the file, and the owner a
+CODEOWNERS line names. In a workspace the neighbourhood crosses a repository
+when another one references a contract this change touches. That is the check
+behind "the producer ships before the consumer".
+
+## Rulings
+
+1. **The argument is a tracked path, or the name of one export.** A private
+   symbol is not an export. Several files exporting the same name is a usage
+   error that names those files. A name that is neither a path nor an export
+   is a usage error. A tree that is not git is unsupported.
+2. **Importers are the non-test files that import the target, at any depth.**
+   The tests are the test files that import that closure. Both lists stop at
+   64. Past that, the report says it was truncated.
+3. **Governance is what `why` would name for the file, limited to decisions
+   and rules.** Owners are the last matching pattern in the first CODEOWNERS
+   file that exists. A pattern with no slash matches the file name in any
+   directory.
+4. **A cross-repo consumer is another repository whose text contains a
+   contract path this change touches.** A contract is an OpenAPI document or
+   a JSON Schema file. The path has to include a directory. No workspace
+   means no consumers, and that is not a failure. The scan stops at 64
+   references and 2000 files in a repository.
+
+## Consequences
+
+`simt impact` answers who is reached. `simt gate` still runs the tests.
+`simt why` still answers governance on its own, including skills, gates and
+lessons, which this report does not repeat.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "simt-dev",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Shared agent rules, skills and git hooks for a repository: one command adopts a repo, and every gate it declares is probed before it is written.",
   "license": "Apache-2.0",
   "author": "Said Elimam",

package/rules/core.md

@@ -60,7 +60,7 @@ commands belongs in this repository, not here.
 
 - No type-system escapes, no unawaited async work, no debug printing in application code.
 - 400 lines is a review trigger; 1000 lines is a hard ceiling. Generated files are exempt
-  when the hook names the generator. (ADR-005)
+  when the hook names the generator. (ADR-005) <!-- simt-check: max-file-lines -->
 - Never weaken CSP, CORS, auth, audit, cache or validation controls to silence a test, warning
   or alert.
 - Review verdicts are exactly three: `BLOCK`, `APPROVE WITH RESIDUAL RISK` (must list what was

package/src/argv.mjs

@@ -59,6 +59,21 @@ export const BOOL_FLAGS = new Set([
   // (plan 0003 R09). Off by default because a count is enough to act on; the per-line
   // detail is what an author needs, and a reader is not an author.
   'explain',
+  // check: the lock must match. Off by default because a repository that has not
+  // written one yet is not drift, and a gate that failed for the absence would be
+  // red on every repository this package already adopted.
+  'frozen',
+  // map: report gold-file recall@10 instead of rendering the ranking. Off by
+  // default because the ranking is the answer a task asked for, and the recall
+  // figure needs the hidden benchmark patches.
+  'recall',
+  // tests: also list files that only changed in the same commits as a test.
+  // Off by default because a shared commit is not a test.
+  'cochange',
+  // gate: read the working-tree diff instead of the paths named after the command.
+  // Off by default because a path is the change the caller named, and the diff
+  // is a different question.
+  'changed',
 ]);
 
 export const VALUE_FLAGS = new Set([
@@ -100,6 +115,9 @@ export const VALUE_FLAGS = new Set([
   // plan done: the test command that proves the slice. Plan 0003 R31.
   'test',
   'state',
+  // map: outline (paths), names (exported symbols) or signatures (the line).
+  // A boolean would not say which of the three the caller wanted.
+  'level',
 ]);
 
 /**

package/src/ci/workflow.mjs

@@ -148,6 +148,16 @@ function uses(action) {
   return `      - uses: ${repo}@${commit} # ${release}`;
 }
 
+/** This repository's own gate runs `npm test`, and two of those tests read
+ *  history. A consumer's gate does not, so its checkout stays shallow. */
+function checkoutFull() {
+  return `${uses('checkout')}
+        with:
+          # \`bench mine\` counts commits, and the Affects snapshot reads
+          # 4c27514. A depth-1 checkout fails both, and both run in \`npm test\`.
+          fetch-depth: 0`;
+}
+
 /** The YAML every copy shares, so the two cannot drift on triggers, permissions or
  *  concurrency. Only `name`, the runner and `steps` vary, and only because they have
  *  to. The own gate also varies the platforms and the Node versions, because this
@@ -246,7 +256,7 @@ export function renderWorkflow({ own = false, npm = true, version } = {}) {
     return `${header(true)}${skeleton(
       'simt-dev own gate',
       [
-        uses('checkout'),
+        checkoutFull(),
         setupNode('${{ matrix.node }}'),
         // The two checks `.githooks/pre-push` runs, named here rather than discovered,
         // because a reader of this file has to be able to answer "what stops a merge"

package/src/commands/bench.mjs

@@ -12,6 +12,7 @@ import { EXIT, emit, emitJson, fail, isJson, writeMode } from '../output/index.m
 import { DEFAULT_MINE_TARGET, mineTasks } from '../bench/mine.mjs';
 import { regradeRun, runBench } from '../bench/run.mjs';
 import { buildBenchReport } from '../bench/report.mjs';
+import { formatRecall, measureRecall } from '../index/map.mjs';
 import { ablateBench } from '../bench/ablate.mjs';
 import { runBenchProbes } from '../bench/probes.mjs';
 import { listFlag } from './skills.mjs';
@@ -223,6 +224,8 @@ export async function benchReportCommand(positional, flags) {
     );
   }
 
+  const mapRecall = await recallOrUnmeasured(root);
+
   if (isJson(flags)) {
     emitJson({
       ok: true,
@@ -232,14 +235,23 @@ export async function benchReportCommand(positional, flags) {
       runCount: report.runCount,
       arms: report.arms,
       comparison: report.comparison,
+      mapRecall,
     });
     return EXIT.OK;
   }
 
-  emit(report.markdown, { maxBytes: flags.maxBytes ?? 0 });
+  emit(`${report.markdown}\n\n### Map\n\n${formatRecall(mapRecall)}`, { maxBytes: flags.maxBytes ?? 0 });
   return EXIT.OK;
 }
 
+async function recallOrUnmeasured(root) {
+  try {
+    return await measureRecall(root);
+  } catch {
+    return { measured: false, reason: 'not run', tasks: 0, missing: 0, recall: null };
+  }
+}
+
 export async function benchAblateCommand(positional, flags) {
   const root = resolve(flags.root ?? positional[0] ?? process.cwd());
   const { dryRun, apply } = writeMode(flags);

package/src/commands/evidence.mjs

@@ -0,0 +1,96 @@
+// `simt evidence` — the proof block for this tree, and the commit-message check.
+//
+// The read answers "what has actually been run against what is on disk". The check
+// answers the other half: a message that says the tests passed, when nothing in the
+// ledger was run against this tree (ADR-087).
+
+import { readFile } from 'node:fs/promises';
+
+import { EXIT, emit, emitJson, fail, isJson } from '../output/index.mjs';
+import { readManifest } from '../projection/manifest.mjs';
+import { CLI, MANIFEST_FILE } from '../name.mjs';
+import { claimsVerification, evidenceMode, readLedger, treeId } from '../ledger/index.mjs';
+
+export async function evidenceCommand(args, flags) {
+  const root = flags.root ?? process.cwd();
+  if (args[0] === 'check') return checkClaim(root, args[1], flags);
+  if (args[0] !== undefined) {
+    return fail(`unknown evidence subcommand ${args[0]}`, EXIT.USAGE, `run: ${CLI} evidence`);
+  }
+  return showEvidence(root, flags);
+}
+
+async function showEvidence(root, flags) {
+  let tree;
+  try {
+    tree = await treeId(root);
+  } catch (error) {
+    return fail(
+      `could not name this tree (${error.message})`,
+      EXIT.UNSUPPORTED,
+      'run this inside a git repository',
+    );
+  }
+  const { entries, errors } = await readLedger(root);
+  const mine = entries.filter((e) => e.tree === tree);
+  const payload = { ok: errors.length === 0, command: 'evidence', root, tree, entries: mine, errors };
+  if (isJson(flags)) {
+    emitJson(payload, { pretty: flags.pretty === true, maxBytes: flags.maxBytes ?? 0 });
+    return errors.length === 0 ? EXIT.OK : EXIT.FAIL;
+  }
+  const lines = [`tree     ${tree}`];
+  if (mine.length === 0) lines.push('none     no run is recorded for this tree');
+  for (const e of mine) {
+    lines.push(`${e.exit === 0 ? 'pass' : 'fail'}     ${e.cmd}  exit ${e.exit}  ${e.summary}`);
+  }
+  for (const error of errors) lines.push(`error    ${error}`);
+  emit(lines.join('\n'), { maxBytes: flags.maxBytes ?? 0 });
+  return errors.length === 0 ? EXIT.OK : EXIT.FAIL;
+}
+
+async function checkClaim(root, file, flags) {
+  if (!file) return fail('evidence check needs the commit message file', EXIT.USAGE, `run: ${CLI} evidence check <file>`);
+  let message;
+  try {
+    message = await readFile(file, 'utf8');
+  } catch (error) {
+    return fail(`could not read ${file} (${error.message})`, EXIT.USAGE, `pass the path git gives commit-msg`);
+  }
+  const { manifest, error } = await readManifest(root);
+  if (error) return fail(`${MANIFEST_FILE}: ${error}`, EXIT.CONFIG, `fix ${MANIFEST_FILE} so it parses`);
+  const mode = evidenceMode(manifest);
+  if (mode === null) {
+    return fail(
+      `${MANIFEST_FILE} gates.evidence must be "warn" or "block"`,
+      EXIT.CONFIG,
+      `set gates.evidence to "warn" or "block", or remove it`,
+    );
+  }
+  const claim = claimsVerification(message);
+  if (!claim) {
+    const payload = { ok: true, command: 'evidence check', claim: false, mode };
+    if (isJson(flags)) emitJson(payload, { pretty: flags.pretty === true });
+    return EXIT.OK;
+  }
+  let tree;
+  try {
+    tree = await treeId(root);
+  } catch (error) {
+    return fail(`could not name this tree (${error.message})`, EXIT.UNSUPPORTED, 'run this inside a git repository');
+  }
+  const { entries } = await readLedger(root);
+  const supported = entries.some((e) => e.tree === tree && e.exit === 0);
+  const payload = { ok: supported || mode === 'warn', command: 'evidence check', claim: true, supported, mode, tree };
+  if (supported) {
+    if (isJson(flags)) emitJson(payload, { pretty: flags.pretty === true });
+    return EXIT.OK;
+  }
+  const detail = 'the message claims a run this tree does not have';
+  const remedy = `run the command, then commit, or take the claim out of the message`;
+  if (isJson(flags)) {
+    emitJson({ ...payload, detail, remedy }, { pretty: flags.pretty === true });
+    return mode === 'block' ? EXIT.FAIL : EXIT.OK;
+  }
+  emit(`${mode === 'block' ? 'BLOCKED' : 'WARNING'}  ${detail}\n         remedy: ${remedy}`, { maxBytes: flags.maxBytes ?? 0 });
+  return mode === 'block' ? EXIT.FAIL : EXIT.OK;
+}

package/src/commands/gate.mjs

@@ -0,0 +1,165 @@
+// `simt gate` runs the tests a change reaches (R16, ADR-094).
+//
+// Paths name the change. `--changed` reads the diff instead. The tests are the
+// ones that import a changed file, directly or through other files, and the
+// runner is the one the package already uses. Nothing else runs. A report
+// this tool knows how to read is compacted; the raw log is kept.
+
+import { execFile } from 'node:child_process';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { promisify } from 'node:util';
+
+import { EXIT, emit, emitJson, fail, isJson } from '../output/index.mjs';
+import { CLI } from '../name.mjs';
+import { detectTestRunner } from '../bench/mine.mjs';
+import { compactOutput } from '../index/compact.mjs';
+import { readImportEdges, selectTests } from '../index/gate.mjs';
+import { packageOf } from '../index/store.mjs';
+
+const exec = promisify(execFile);
+
+export async function gateCommand(args, flags) {
+  const root = flags.root ?? process.cwd();
+  const listed = await tracked(root);
+  if (listed.error) return listed.error;
+  let changed = args.filter(Boolean);
+  if (flags.changed === true) {
+    const diff = await changedFiles(root);
+    if (diff.error) return diff.error;
+    changed = [...new Set([...changed, ...diff.files])].sort();
+  }
+  if (changed.length === 0) {
+    if (flags.changed === true) {
+      if (isJson(flags)) {
+        emitJson({ ok: true, command: 'gate', root, selected: [], code: 0 }, { pretty: flags.pretty === true, maxBytes: flags.maxBytes ?? 0 });
+      } else {
+        emit('selected  0', { maxBytes: flags.maxBytes ?? 0 });
+      }
+      return EXIT.OK;
+    }
+    return fail(`nothing changed`, EXIT.USAGE, `pass a path, or ${CLI} gate --changed`);
+  }
+  const files = new Set(listed.files);
+  for (const file of changed) files.add(file);
+  const selected = selectTests(changed, await readImportEdges(root, files));
+  if (selected.length === 0) {
+    const payload = { ok: true, command: 'gate', root, selected, code: 0 };
+    if (isJson(flags)) {
+      emitJson(payload, { pretty: flags.pretty === true, maxBytes: flags.maxBytes ?? 0 });
+      return EXIT.OK;
+    }
+    emit('selected  0', { maxBytes: flags.maxBytes ?? 0 });
+    return EXIT.OK;
+  }
+  return runSelected(root, flags, selected);
+}
+
+async function runSelected(root, flags, selected) {
+  const cache = new Map();
+  const groups = new Map();
+  for (const file of selected) {
+    const pkg = await packageOf(root, file, cache);
+    const list = groups.get(pkg);
+    if (list) list.push(file);
+    else groups.set(pkg, [file]);
+  }
+  const runs = [];
+  let code = 0;
+  const text = [];
+  const rawParts = [];
+  for (const [pkg, files] of [...groups.entries()].sort((a, b) => cmp(a[0], b[0]))) {
+    const relative = files.map((file) => (pkg && file.startsWith(`${pkg}/`) ? file.slice(pkg.length + 1) : file));
+    const cwd = join(root, pkg);
+    const runner = await detectTestRunner(cwd, relative);
+    if (!runner) {
+      return fail(
+        `no runner for ${files.length} test${files.length === 1 ? '' : 's'} in ${pkg || 'this repository'}`,
+        EXIT.UNSUPPORTED,
+        'declare a package manifest the test runner can see',
+      );
+    }
+    const built = runner.buildExec(cwd);
+    text.push(`selected  ${files.length}`, ...files, '', runner.displayCmd);
+    // A parent `node --test` puts NODE_TEST_CONTEXT in the environment. Left
+    // there, the child reports to that parent and exits 0 whether or not it failed.
+    const env = { ...process.env };
+    for (const key of Object.keys(env)) {
+      if (key.startsWith('NODE_TEST')) delete env[key];
+    }
+    const result = await exec(built.cmd, built.args, { cwd, env, maxBuffer: 32 << 20 }).then(
+      (out) => ({ code: 0, stdout: out.stdout, stderr: out.stderr }),
+      (error) => ({
+        code: typeof error.code === 'number' ? error.code : 1,
+        stdout: error.stdout ?? '',
+        stderr: error.stderr ?? '',
+      }),
+    );
+    if (result.code !== 0) code = result.code;
+    const stdout = String(result.stdout ?? '');
+    const stderr = String(result.stderr ?? '');
+    const body = stderr ? `${stdout}\n${stderr}` : stdout;
+    rawParts.push(body);
+    const compact = compactOutput(body);
+    runs.push({ package: pkg, command: runner.displayCmd, code: result.code, stdout, stderr });
+    text.push(compact ?? body);
+  }
+  const raw = await writeRaw(root, rawParts.join('\n'));
+  if (raw) text.push('', `raw  ${raw}`);
+  const payload = { ok: code === 0, command: 'gate', root, selected, code, raw, runs };
+  if (isJson(flags)) {
+    emitJson(payload, { pretty: flags.pretty === true, maxBytes: flags.maxBytes ?? 0 });
+    return code === 0 ? EXIT.OK : EXIT.FAIL;
+  }
+  emit(text.filter((line) => line !== undefined).join('\n'), { maxBytes: flags.maxBytes ?? 0 });
+  return code === 0 ? EXIT.OK : EXIT.FAIL;
+}
+
+async function writeRaw(root, body) {
+  try {
+    const dir = join(root, '.simt-dev', 'gate');
+    await mkdir(dir, { recursive: true });
+    const name = `gate-${Date.now()}.log`;
+    await writeFile(join(dir, name), body);
+    return `.simt-dev/gate/${name}`;
+  } catch {
+    return '';
+  }
+}
+
+async function tracked(root) {
+  try {
+    const { stdout } = await exec('git', ['ls-files'], { cwd: root, maxBuffer: 16 << 20 });
+    return { files: stdout.split('\n').filter(Boolean) };
+  } catch (error) {
+    return {
+      error: fail(
+        `could not read the change (${error.message})`,
+        EXIT.UNSUPPORTED,
+        'run this inside a git repository',
+      ),
+    };
+  }
+}
+
+async function changedFiles(root) {
+  try {
+    const { stdout } = await exec('git', ['diff', '--name-only', 'HEAD'], { cwd: root, maxBuffer: 8 << 20 });
+    const untracked = await exec('git', ['ls-files', '--others', '--exclude-standard'], { cwd: root, maxBuffer: 8 << 20 });
+    return { files: [...new Set([...stdout.split('\n'), ...untracked.stdout.split('\n')].filter(Boolean))].sort() };
+  } catch (error) {
+    return {
+      error: fail(
+        `could not read the diff (${error.message})`,
+        EXIT.UNSUPPORTED,
+        'run this inside a git repository that has a commit',
+      ),
+    };
+  }
+}
+
+function cmp(a, b) {
+  if (a < b) return -1;
+  if (a > b) return 1;
+  return 0;
+}

package/src/commands/help.mjs

@@ -61,6 +61,35 @@ ${CLI} ci                     simt-dev's own .github files: create or refresh th
 ${CLI} compare                org-wide matrix across every sibling repo
                            (read-only; exits non-zero on defects, not on
                            repos that have not adopted yet)
+${CLI} index                   rebuild the local file index from git blob hashes
+${CLI} why [path]            what governs a file: a decision whose Affects line names
+                           it, a rule whose scope matches it, a skill, a gate
+                           or a lesson. With no path, the Affects tokens this
+                           tree cannot resolve (UNRESOLVED-AFFECTS)
+${CLI} tests [path]          the tests that exercise a file: an import, the conventional
+                           source beside the test, or a coverage record that
+                           names both (--cochange adds files that only share
+                           commits, and only those)
+${CLI} gate [path...]        the tests a change reaches, and only those
+                           (--changed reads the diff instead of the paths)
+${CLI} impact <file|symbol>  who a change reaches: importers, their tests,
+                           what governs it, and a contract another repository references
+${CLI} map [--task "<text>"] [--level outline|names|signatures]
+                           the files this task is most likely to touch, within
+                           --budget bytes (default 2048; 0 is unlimited). outline
+                           is paths, names adds exports, signatures adds the line.
+                           --recall reports gold-file recall@10 on mined tasks
+${CLI} evidence                the runs recorded against the tree on disk
+${CLI} evidence check <file>   a commit message that claims a run this tree does not
+                           have: a warning, or a block when gates.evidence is "block"
+${CLI} shared plan            what a workspace's repeated rules cost to carry
+                           once: the shared set, its bytes, and every path that would be written
+                           (read-only; touches nothing, not even your home directory)
+${CLI} shared install [--yes] carry those rules once per reader, at user level,
+                           and declare the delta in each repo's manifest (dry-run unless
+                           --yes; copies land in files the vendors' own docs name, and a reader
+                           with no such file gets the block printed to paste; ${CLI} doctor
+                           reports a copy that is missing or stale)
 ${CLI} tokens [--repos]       what a reader loads at session start, in bytes
                            (read-only; exits 0 whatever it finds, because a
                            measurement is not a verdict; --repos measures every
@@ -110,6 +139,8 @@ const FLAGS = `--json                 structured output (compact; one document,
 --dry-run               report what would change, change nothing
 --yes                   assume yes; required in automation, never prompts
 --check                 report drift and write nothing (sync, ci)
+--frozen                check: the lock must match this projection; an output
+                        change no input change explains fails the gate
 --explain               sync: name each line dropped as already inferable, with
                         the fact behind it
 --all                   ignore a cap: every ruling of a record, or the skills budget

package/src/commands/hooks.mjs

@@ -19,7 +19,7 @@ import { promisify } from 'node:util';
 
 import { EXIT, emit, emitJson, fail, isJson, note, writeMode } from '../output/index.mjs';
 import { MANIFEST, readManifest } from '../projection/manifest.mjs';
-import { EVENTS, HOOKS_DIR, HOOKS_PATH_KEY, fileFor, renderChainedShim, renderShim } from '../hooks/shim.mjs';
+import { EVENTS, HOOKS_DIR, HOOKS_PATH_KEY, SHIM_MARKER, fileFor, renderChainedShim, renderEvidenceShim, renderShim } from '../hooks/shim.mjs';
 import { GATE_KEY, gateCount, readHooksPath, readHooksState, wantsShim } from '../compare/hooksstate.mjs';
 import { GATES } from '../hooks/gates.mjs';
 import { knownGates } from '../hooks/resolve.mjs';
@@ -222,11 +222,29 @@ async function installHooks(root, flags) {
     (i) => i.present && i.ours && !wanted.includes(i.event) && !chained.some((c) => c.event === i.event),
   );
 
+  // The claim check is not one of EVENTS. Those shims do not forward git's
+  // arguments, and commit-msg's only argument is the message. It is installed
+  // when the repository sets gates.evidence, and removed when that setting goes,
+  // because a shim that stays after the setting left still replaces git's own hook.
+  const evidenceDeclared = manifest?.gates?.evidence === 'warn' || manifest?.gates?.evidence === 'block';
+  const evidenceFile = fileFor('commit-msg');
+  const evidenceExisting = await readIfExists(join(root, evidenceFile));
+  const evidenceSource = evidenceDeclared ? renderEvidenceShim({ npm, version }) : null;
+  const evidenceOurs = evidenceExisting !== null && evidenceExisting.includes(SHIM_MARKER);
+  if (!evidenceDeclared && evidenceOurs) obsolete.push({ event: 'commit-msg' });
+  // A foreign commit-msg would otherwise be chained onto the same path. The chain
+  // is written after this shim, so it would replace the claim check and the check
+  // would never run. The repository's hook stays on disk and the note says it stopped.
+  if (evidenceDeclared) {
+    const at = chained.findIndex((c) => c.event === 'commit-msg');
+    if (at !== -1) chained.splice(at, 1);
+  }
+
   // Nothing to write and nothing to take away is the only refusal. It sits after
   // `obsolete` because a repository whose last gate just left the manifest has
   // something to take away, and blocking that one left no way out except undoing
   // the change by hand - see the note on `obsolete`.
-  if (wanted.length === 0 && obsolete.length === 0) {
+  if (wanted.length === 0 && obsolete.length === 0 && !evidenceDeclared) {
     if (isJson(flags)) {
       emitJson({ ok: false, command: 'hooks install', root, nothingToEnforce: true, filesWritten: false });
       return EXIT.FAIL;
@@ -276,10 +294,20 @@ async function installHooks(root, flags) {
       // Named in the plan because the reader approving this write is about to lose a
       // file, and "REMOVED pre-push" does not say why - which is the difference between
       // agreeing with it and discovering later that a gate had been dropped by accident.
-      note: `no gate for ${h.event} in ${MANIFEST_FILE}; the shim enforced nothing`,
+      note:
+        h.event === 'commit-msg'
+          ? `gates.evidence is unset, so the claim check stopped`
+          : `no gate for ${h.event} in ${MANIFEST_FILE}; the shim enforced nothing`,
+    });
+  }
+  if (evidenceSource) {
+    plan.push({
+      file: evidenceFile,
+      action: evidenceExisting === evidenceSource ? 'unchanged' : evidenceExisting === null ? 'created' : 'updated',
+      note: 'commit-msg checks a verification claim against the ledger',
     });
   }
-  const routed = wanted.length > 0 || chained.length > 0;
+  const routed = wanted.length > 0 || chained.length > 0 || evidenceDeclared;
 
   // The routing this install leaves behind, which is not always `wants`. A repository
   // that removed its last gate has no shims to route to, and leaving `core.hooksPath`
@@ -362,6 +390,12 @@ async function installHooks(root, flags) {
   for (const h of obsolete) {
     await rm(join(root, fileFor(h.event)));
   }
+  // After the chain loop, so a chained commit-msg cannot replace the claim check.
+  if (evidenceSource) {
+    const path = join(root, evidenceFile);
+    await writeFile(path, evidenceSource);
+    await chmod(path, 0o755);
+  }
 
   // `core.hooksPath` tells git to read ONE directory for EVERY event, so leaving it
   // pointing at a directory of no shims stops the repository's own hooks - the ones in
@@ -385,6 +419,10 @@ async function installHooks(root, flags) {
       notes.push(
         `chained ${f.event}: ${fileFor(f.event)} runs ${f.path} (${f.bytes} bytes), so it keeps running`,
       );
+    } else if (f.event === 'commit-msg' && evidenceDeclared) {
+      notes.push(
+        `stopped running commit-msg at ${f.path} (${f.bytes} bytes); the claim check replaced it, and the file is still on disk, untouched`,
+      );
     } else if (leftRunning.some((c) => c.event === f.event)) {
       // A third case, and the one that was misreported: a hook this tool could not chain
       // because the shim would have had to run itself. Nothing overwrote it, so it still
@@ -403,7 +441,9 @@ async function installHooks(root, flags) {
   }
   for (const h of obsolete) {
     notes.push(
-      `removed ${fileFor(h.event)}: ${MANIFEST_FILE} declares no ${h.event} gate, so the shim enforced nothing and still replaced git's own hook`,
+      h.event === 'commit-msg'
+        ? `removed ${fileFor(h.event)}: ${MANIFEST_FILE} no longer sets gates.evidence, so the claim check stopped replacing git's own commit-msg`
+        : `removed ${fileFor(h.event)}: ${MANIFEST_FILE} declares no ${h.event} gate, so the shim enforced nothing and still replaced git's own hook`,
     );
   }
   if (leaves === null && current !== null) {