simt-dev 0.6.2 → 0.6.3

package/src/commands/agenthook.mjs

@@ -22,8 +22,10 @@
 // tool call. Failures of this command exit 1, which a harness reports as a failed hook,
 // and that is the right blast radius for a hook that is broken rather than refusing.
 
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { mkdir, readFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
+import { commitJournal, journaledWriteFile } from '../journal.mjs';
+import { diffField, emitDiffs, readBefore } from '../diff.mjs';
 
 import { EXIT, emit, emitJson, fail, isJson, note, writeMode } from '../output/index.mjs';
 import { CLI } from '../name.mjs';
@@ -185,6 +187,17 @@ async function installHooks(root, flags) {
 
   const refused = plan.filter((p) => p.error);
 
+  // The `--diff` pairs, read before anything is written so the before side is
+  // true in preview and in apply alike (R50).
+  const diffs =
+    flags.diff === true
+      ? await Promise.all(
+        plan
+          .filter((p) => p.action !== 'unchanged')
+          .map(async (p) => ({ path: p.path, before: await readBefore(join(root, p.path)), after: p.text })),
+      )
+      : [];
+
   if (!mode.apply) {
     if (isJson(flags)) {
       emitJson({
@@ -195,6 +208,7 @@ async function installHooks(root, flags) {
         plan: plan.map(({ text, ...rest }) => rest),
         notWritten: others,
         filesWritten: false,
+        ...diffField(diffs, flags),
       });
       return refused.length > 0 ? EXIT.FAIL : EXIT.OK;
     }
@@ -207,10 +221,12 @@ async function installHooks(root, flags) {
         '',
         refused.length > 0
           ? `REFUSED  ${refused.length} config file(s) could not be read; nothing written`
-          : `PLAN     nothing written; apply with: ${CLI} agent-hooks install --yes`,
+          :        `PLAN     nothing written; apply with: ${CLI} agent-hooks install --yes`,
       ].join('\n'),
       { maxBytes: flags.maxBytes ?? 0 },
     );
+    // After the report: the report says what, the diff shows it (R50).
+    emitDiffs(diffs, flags);
     return refused.length > 0 ? EXIT.FAIL : EXIT.OK;
   }
 
@@ -221,12 +237,15 @@ async function installHooks(root, flags) {
     return fail(`refused to write ${refused.map((p) => `${p.path} (${p.error})`).join('; ')}`, EXIT.FAIL);
   }
 
+  // Journaled so `undo` restores this run (R49).
+  const journal = [];
   const written = [];
   for (const p of plan.filter((x) => x.action !== 'unchanged')) {
     await mkdir(join(root, dirname(p.path)), { recursive: true });
-    await writeFile(join(root, p.path), p.text);
+    await journaledWriteFile(root, journal, join(root, p.path), p.text);
     written.push(p);
   }
+  await commitJournal(root, 'agent-hooks install', journal);
 
   const notes = [];
   for (const p of written) {
@@ -245,6 +264,7 @@ async function installHooks(root, flags) {
       written: written.map((p) => p.path),
       filesWritten: true,
       notes,
+      ...diffField(diffs, flags),
     });
     return EXIT.OK;
   }
@@ -259,6 +279,8 @@ async function installHooks(root, flags) {
     ].join('\n'),
     { maxBytes: flags.maxBytes ?? 0 },
   );
+  // After the report: the report says what, the diff shows it (R50).
+  emitDiffs(diffs, flags);
   for (const o of others) note(`note     ${o.id}: not written - ${o.note}`);
   for (const n of notes) note(`note     ${n}`);
   note(`note     never committed or pushed (ADR-001); review, then commit yourself`);

package/src/commands/ci.mjs

@@ -18,8 +18,10 @@
 // commands owns which file would be learning about ownership twice to learn nothing
 // new, and the next .github file would arrive with a third command to remember.
 
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { mkdir, readFile } from 'node:fs/promises';
 import { dirname } from 'node:path';
+import { commitJournal, journaledWriteFile } from '../journal.mjs';
+import { diffField, emitDiffs, readBefore } from '../diff.mjs';
 
 import { EXIT, emit, emitJson, isJson, note, writeMode } from '../output/index.mjs';
 import { planWorkflow, renderWorkflow, WORKFLOW_FILE } from '../ci/workflow.mjs';
@@ -121,18 +123,37 @@ export async function ciCommand(positional, flags) {
     return EXIT.FAIL;
   }
 
+  // The `--diff` pairs, read before anything is written so the before side is
+  // true in preview and in apply alike (R50).
+  const renders = new Map(targets().map(({ key, render }) => [key, render]));
+  const diffs =
+    flags.diff === true
+      ? await Promise.all(
+        plans
+          .filter((p) => p.action !== 'unchanged')
+          .map(async (p) => ({ path: p.file, before: await readBefore(p.path), after: renders.get(p.key)(p) })),
+      )
+      : [];
+
   if (isJson(flags)) {
-    emitJson({ ok: true, command: 'ci', root, files: todo.map(publicPlan), written: false, dryRun: !mode.apply }, {});
+    emitJson(
+      { ok: true, command: 'ci', root, files: todo.map(publicPlan), written: false, dryRun: !mode.apply, ...diffField(diffs, flags) },
+      {},
+    );
   } else {
     emit(lines.join('\n'));
   }
 
   if (!mode.apply) {
+    // After the report: the report says what, the diff shows it (R50).
+    emitDiffs(diffs, flags);
     note('');
     note(mode.dryRun ? 'dry-run  nothing written' : `dry-run  nothing written; apply with: ${CLI} ci --yes`);
     return EXIT.OK;
   }
 
+  // Journaled so `undo` restores this run (R49).
+  const journal = [];
   for (const { key, plan, render } of targets()) {
     const p = plans.find((x) => x.key === key);
     if (p.action === 'unchanged') continue;
@@ -140,9 +161,10 @@ export async function ciCommand(positional, flags) {
     // The renderer takes the plan because detection-driven content is a function of
     // this repo's facts: a dependabot config rendered without them would watch
     // nothing, which is the same silent-nothing the detection ruling exists to stop.
-    await writeFile(p.path, render(p));
+    await journaledWriteFile(root, journal, p.path, render(p));
     note(`wrote    ${p.file} (${p.action}; the template and this copy now agree)`);
   }
+  await commitJournal(root, 'ci', journal);
   if (isJson(flags)) {
     emitJson(
       {
@@ -151,10 +173,13 @@ export async function ciCommand(positional, flags) {
         root,
         files: plans.map((p) => ({ file: p.file, action: p.action, bytes: p.bytes })),
         written: true,
+        ...diffField(diffs, flags),
       },
       {},
     );
   }
+  // After the report: the report says what, the diff shows it (R50).
+  emitDiffs(diffs, flags);
   return EXIT.OK;
 }
 

package/src/commands/completions.mjs

@@ -0,0 +1,27 @@
+// `simt completions <shell>` — print a completion script (plan 0003 R51).
+//
+// The script goes to stdout and nothing else does, because the install is a
+// redirect: `source <(simt completions bash)`, or the zsh file dropped onto
+// `$fpath`. A report line above it would be a report line in the user's shell
+// config.
+
+import { EXIT, emit, emitJson, fail, isJson } from '../output/index.mjs';
+import { SHELLS, renderCompletions } from '../completions.mjs';
+
+export async function completionsCommand(args, flags, commands) {
+  const shell = args[0];
+  if (shell === undefined) {
+    return fail('completions needs a shell', EXIT.USAGE, `one of: ${SHELLS.join(', ')}`);
+  }
+  if (!SHELLS.includes(shell)) {
+    return fail(`unknown shell \`${shell}\``, EXIT.USAGE, `one of: ${SHELLS.join(', ')}`);
+  }
+
+  const script = renderCompletions(shell, commands);
+  if (isJson(flags)) {
+    emitJson({ ok: true, command: 'completions', shell, script });
+    return EXIT.OK;
+  }
+  emit(script, { maxBytes: flags.maxBytes ?? 0 });
+  return EXIT.OK;
+}

package/src/commands/decide.mjs

@@ -7,6 +7,8 @@ import { EXIT, emit, emitJson, fail, isJson, note, writeMode } from '../output/i
 import { CLI } from '../name.mjs';
 import { DECISIONS_DIR } from '../decisions/index.mjs';
 import { lintDecisions, scaffoldDecision } from '../memory/decide.mjs';
+import { commitJournal } from '../journal.mjs';
+import { diffField, emitDiffs } from '../diff.mjs';
 import { parsePathList } from '../argv.mjs';
 
 export async function decideCommand(args, flags) {
@@ -49,12 +51,17 @@ export async function decideCommand(args, flags) {
   const parsedPaths = parsePathList(flags.paths);
   const explicitPaths = flags.paths !== undefined ? parsedPaths : undefined;
 
+  // Journaled so `undo` restores the scaffold (R49); committed only when the
+  // run actually wrote, which commitJournal already guarantees.
+  const journal = [];
   const res = await scaffoldDecision(root, {
     title,
     affects: explicitPaths,
     supersedes: flags.supersedes,
     write: mode.apply,
+    journal: mode.apply ? journal : undefined,
   });
+  if (mode.apply && res.ok) await commitJournal(root, 'decide', journal);
 
   if (!res.ok) {
     return fail(
@@ -70,6 +77,10 @@ export async function decideCommand(args, flags) {
     note('dry-run  no files written');
   }
 
+  // A scaffold always creates: the number is free by construction, so the
+  // before side is empty and the pair is the whole file (R50).
+  const diffs = flags.diff === true ? [{ path: res.relPath, before: null, after: res.text }] : [];
+
   if (isJson(flags)) {
     emitJson({
       ok: true,
@@ -84,10 +95,10 @@ export async function decideCommand(args, flags) {
       supersedes: res.supersedes,
       written: res.written,
       dryRun: !mode.apply,
+      ...diffField(diffs, flags),
     });
     return EXIT.OK;
   }
-
   const supersedesLabel =
     res.supersedes.length > 0
       ? res.supersedes
@@ -112,5 +123,7 @@ export async function decideCommand(args, flags) {
   ];
 
   emit(lines.join('\n'), { maxBytes: flags.maxBytes ?? 0 });
+  // After the report: the report says what, the diff shows it (R50).
+  emitDiffs(diffs, flags);
   return EXIT.OK;
 }

package/src/commands/doctor.mjs

@@ -0,0 +1,367 @@
+// `simt doctor [--fix] [--yes] [--json]`
+//
+// Step 3 of the implementation sequence: classify a repo from marker files alone.
+// Deliberately shipped early — it needs no registry, no rules and no projection,
+// and it makes the tool useful before any content exists.
+//
+// Plan 0003 R47 adds the findings table and `--fix`. Every finding carries its
+// remedy and whether that remedy is flagged safe, and `--fix` applies only the
+// safe ones while listing the rest with the reason each needs a human:
+//
+//   - safe means local, idempotent and journaled (the R49 journal is the undo).
+//     `sync`'s manifest repair, a hooks install over routing this tool already
+//     owns, and the journal's own .gitignore entry all qualify.
+//   - safe is necessary but not sufficient: the fix must also be a REPAIR, not
+//     an ADOPTION. `init` on a manifest-less repo is local, idempotent and
+//     journaled, and still flagged unsafe — adopting a repo chooses its rules,
+//     regions and CI, and the preview of that choice is what the operator must
+//     read before approving it. So is taking over hooks git did not route here:
+//     the bytes are journaled but the decision belongs to a human.
+//
+// Unsafe findings are never applied, under any flag combination. `--fix` without
+// `--yes` previews: it names what it would apply and lists the rest.
+
+import { join } from 'node:path';
+import { EXIT, emit, emitJson, fail, isJson, note, writeMode } from '../output/index.mjs';
+import { CLI, MANIFEST_FILE } from '../name.mjs';
+import { fingerprint } from '../resolve/fingerprint.mjs';
+import { resolveWorkspace } from '../workspace.mjs';
+import { sharedWarning } from './shared.mjs';
+import { diffField, emitDiffs, readBefore } from '../diff.mjs';
+import { manifestPath, readManifest, writeManifest } from '../projection/manifest.mjs';
+import { planManifestRepair } from './sync.mjs';
+import { provenanceDigest } from '../projection/project.mjs';
+import { applyHooksInstall, plannedDiffs, planHooksInstall } from './hooks.mjs';
+import { fileFor } from '../hooks/shim.mjs';
+import { commitJournal, ignoreJournal, journalHygiene, journalIgnoreNext } from '../journal.mjs';
+
+/**
+ * One config-health finding: what is wrong, how to fix it, and whether
+ * `doctor --fix` may apply that fix on its own.
+ *
+ * `apply`, when present, performs the repair into the caller's journal. Only
+ * findings with `safe: true` carry one; an unsafe finding is a report and a
+ * manual remedy, never a function waiting for a flag.
+ */
+// `withDiffs` previews the safe fixes as `--diff` pairs (plan 0003 R50). Read at
+// finding creation, before any fix is applied, so the before side is true in
+// preview and in apply alike. Only safe findings carry pairs: an unsafe finding
+// is never applied, so there is no write to preview.
+async function collectFindings(root, { result, ws, shared, withDiffs = false }) {
+  const findings = [];
+  if (result.error) {
+    // Nothing else can be asked: classification failed, so every check built on
+    // it would be a guess. The run fails upstream; this entry is for the JSON.
+    findings.push({
+      id: 'fingerprint',
+      severity: 'error',
+      detail: result.error,
+      remedy: null,
+      why: null,
+      safe: false,
+    });
+    return findings;
+  }
+
+  const { manifest, exists, error: manifestError } = await readManifest(root);
+  if (manifestError !== null) {
+    // An unreadable manifest is a hand-edit, not a repair: re-rendering it
+    // would destroy whatever the other tool was saying.
+    findings.push({
+      id: 'manifest-unreadable',
+      severity: 'warning',
+      detail: `${MANIFEST_FILE}: ${manifestError}`,
+      remedy: `fix ${MANIFEST_FILE} by hand, or restore it from version control`,
+      why: 'only a human knows which bytes were intended',
+      safe: false,
+    });
+  } else if (!exists) {
+    // A repair restores intended state; an adoption chooses it. See the module
+    // header: `init` qualifies mechanically and is still listed, not applied.
+    findings.push({
+      id: 'manifest-absent',
+      severity: 'warning',
+      detail: `no ${MANIFEST_FILE}; this repository was never adopted`,
+      remedy: `run: ${CLI} init --root ${root} --yes`,
+      why: 'adoption chooses the rules; a fix only restores them',
+      safe: false,
+    });
+  } else {
+    const sha = await provenanceDigest();
+    const repair = await planManifestRepair(root, result.stack, sha);    if (repair !== null) {
+        const staleBefore = withDiffs ? await readBefore(await manifestPath(root)) : null;
+        findings.push({
+          id: 'manifest-stale',
+          severity: 'warning',
+          detail: `generated field(s) ${repair.stale.join(', ')} do not match what this simt-dev writes`,
+          remedy: `run: ${CLI} sync --root ${root} --yes`,
+          why: null,
+          safe: true,
+          diffs: withDiffs ? [{ path: MANIFEST_FILE, before: staleBefore, after: repair.text }] : [],
+          apply: async (rt, journal) => {
+            await writeManifest(rt, repair.manifest, journal);
+          },
+        });
+      }
+
+    const planned = await planHooksInstall(root, { manifest, exists });
+    if (planned.takeover) {
+      const foreign = planned.state.foreign
+        .map((f) => `${f.event} runs ${f.path} (${f.bytes} bytes)`)
+        .join('; ');
+      findings.push({
+        id: 'hooks-takeover',
+        severity: 'warning',
+        detail:
+          foreign !== ''
+            ? `git runs hooks this tool did not write: ${foreign}`
+            : `git routes hooks at ${planned.current}, not at the hooks directory`,
+        remedy: `inspect the existing hooks, then run: ${CLI} hooks install --root ${root} --yes`,
+        why: 'replacing live hooks needs a human who read them first',
+        safe: false,
+      });
+    } else {
+      const bits = [...planned.state.problems];
+      for (const h of planned.obsolete) {
+        bits.push(`${fileFor(h.event)} enforces nothing and is still routed; reinstall removes it`);
+      }
+      const evidenceMismatch =
+        planned.evidenceDeclared && planned.evidenceSource !== planned.evidenceExisting;
+      if (evidenceMismatch) bits.push('commit-msg claim check differs from this simt-dev; reinstall refreshes it');
+      if (bits.length > 0) {
+        const hooksPairs = withDiffs ? await plannedDiffs(root, planned) : [];
+        findings.push({
+          id: 'hooks-incomplete',
+          severity: 'warning',
+          detail: bits.join('; '),
+          remedy: `run: ${CLI} hooks install --root ${root} --yes`,
+          why: null,
+          safe: true,
+          diffs: hooksPairs,
+          apply: async (rt, journal) => {
+            await applyHooksInstall(rt, planned, journal);
+          },
+        });
+      }
+    }
+
+    const hygiene = await journalHygiene(root);
+    if (!hygiene.ignored) {
+      const ignoreBefore = withDiffs ? await readBefore(join(root, '.gitignore')) : null;
+      const ignoreAfter = withDiffs ? journalIgnoreNext(ignoreBefore ?? '') : null;
+      findings.push({
+        id: 'journal-unignored',
+        severity: 'warning',
+        detail: `${hygiene.sets.length} journal set(s) on disk, but .gitignore does not ignore them; the next commit would share local undo state`,
+        remedy: 'ignore the journal directory (what --fix applies)',
+        why: null,
+        safe: true,
+        diffs: ignoreAfter === null ? [] : [{ path: '.gitignore', before: ignoreBefore, after: ignoreAfter }],
+        apply: async (rt, journal) => {
+          await ignoreJournal(rt, journal);
+        },
+      });
+    }
+  }
+
+  if (shared.declared && shared.state !== 'current') {
+    // The copy lives outside the repository (a reader's home directory), which
+    // R49 deliberately leaves unjournaled: `undo` must never reach past the
+    // repo root, so a fix with no undo path is listed, never applied.
+    findings.push({
+      id: 'shared-copy',
+      severity: 'warning',
+      detail: shared.detail,
+      remedy: shared.state === 'absent' || shared.state === 'stale' ? `run: ${CLI} shared install --yes` : null,
+      why: 'the copy lives outside this repository, past what undo can restore',
+      safe: false,
+    });
+  }
+
+  if (ws.error) {
+    findings.push({
+      id: 'workspace-config',
+      severity: 'error',
+      detail: `workspace config ${ws.detail}: ${ws.error}`,
+      remedy: 'fix the JSON, or remove the file',
+      why: 'only a human knows which workspace was intended',
+      safe: false,
+    });
+  }
+  return findings;
+}
+
+async function applySafeFixes(root, findings) {
+  const journal = [];
+  const fixed = [];
+  const failed = [];
+  for (const finding of findings) {
+    if (!finding.safe) continue;
+    try {
+      await finding.apply(root, journal);
+      finding.fixed = true;
+      fixed.push(finding.id);
+    } catch (error) {
+      failed.push({ id: finding.id, error: error.message ?? String(error) });
+    }
+  }
+  if (fixed.length > 0) await commitJournal(root, 'doctor --fix', journal);
+  return { applied: true, fixed, failed };
+}
+
+function findingLines(findings, { fixMode, applying }) {
+  return findings.flatMap((finding) => {
+    const head = `finding  ${finding.id}  ${finding.detail}`;
+    if (finding.fixed === true) return [head, `         fixed  ${finding.remedy ?? 'applied'}`];
+    if (finding.remedy === null) return [head, '         manual: no command repairs this; read the detail above'];
+    if (!finding.safe) {
+      return [head, `         remedy: ${finding.remedy}`, `         manual: not applied by --fix (${finding.why})`];
+    }
+    if (!fixMode) return [head, `         remedy: ${finding.remedy}`, '         safe: apply with --fix --yes'];
+    if (!applying) return [head, `         remedy: ${finding.remedy}`, '         would fix; re-run with --yes to apply'];
+    return [head, `         remedy: ${finding.remedy}`];
+  });
+}
+
+// --- core: the config health both the CLI and the MCP `doctor` tool answer from (Q15)
+//
+// The MCP tool returned the fingerprint alone: stack, facts and manifest, and none
+// of the findings the command reports. The command below renders these facts for
+// terminals; the tool returns them as JSON. The CLI keeps its field names; the
+// tool adopts them.
+//
+// See the module header: classification first, because everything else is a guess without it.
+export async function diagnose(root, args = {}) {
+  const result = await fingerprint(root);
+  // Which source answered the workspace question, and where it looked. A tool
+  // that silently fell back to the wrong directory would make every downstream
+  // answer confidently wrong, so the answer is reported rather than inferred
+  // (ADR-014).
+  const ws = await resolveWorkspace(args);
+  // The shared file this repository hands rules to (ADR-084). Asked here and nowhere else
+  // because it is the one thing about a repository that is true of the reader's machine
+  // rather than of the tree: `check` must not read `$HOME`, so `doctor` is the only command
+  // that can notice a region that dropped rules into a file nobody has. Reported, never
+  // blocking — the region is correct either way, and what is wrong is the reader's machine.
+  const shared = await sharedWarning(root, result.manifest ?? null, args);
+
+  const withDiffs = args.fix === true && args.diff === true;
+  const findings = await collectFindings(root, { result, ws, shared, withDiffs });
+  // Under `--json` the document is the whole report, so it has to carry both
+  // failures the text path reports AND the workspace answer the text prints.
+  const failure = result.error
+    ? { error: `${root}: ${result.error}`, remedy: null }
+    : ws.error
+      ? {
+          error: `workspace config ${ws.detail}: ${ws.error}`,
+          remedy: 'fix the JSON, or remove the file',
+        }
+      : null;
+  const code = failure ? EXIT.CONFIG : EXIT.OK;
+  return { result, ws, shared, findings, failure, code };
+}
+
+/** The findings as JSON-safe data: drops the `apply` closures only `--fix` uses. */
+export function serialisedFindings(findings) {
+  return findings.map(({ id, severity, detail, remedy, why, safe, fixed }) => ({
+    id,
+    severity,
+    detail,
+    remedy,
+    // Null for safe findings: there is no human needed to explain.
+    why: why ?? null,
+    safe,
+    fixed: fixed === true,
+  }));
+}
+
+export async function runDoctor(positional, flags) {
+  const root = flags.root ?? positional[0] ?? process.cwd();
+  const { result, ws, shared, findings, failure, code: diagnosisCode } = await diagnose(root, flags);
+
+  const fixMode = flags.fix === true;
+  const mode = writeMode(flags);
+  let fix = { requested: fixMode, applied: false, fixed: [], failed: [] };
+  if (fixMode && mode.apply) {
+    fix = { requested: true, ...(await applySafeFixes(root, findings)) };
+  }
+  const failedFix = fix.failed.length > 0;
+
+  // A scripted consumer has only this document to go on, so `ok` is derived from
+  // the exit code rather than written as a constant (S10). A failed fix is a
+  // failure of this run on top of the diagnosis.
+  const code = failedFix ? EXIT.FAIL : diagnosisCode;
+
+  // The findings travel in both modes: a script reads the array, a terminal
+  // reads the lines, and neither may learn about a different set of problems.
+  const serialised = serialisedFindings(findings);
+
+  if (isJson(flags)) {
+    emitJson({
+      ok: code === EXIT.OK,
+      command: 'doctor',
+      root,
+      ...result,
+      // The workspace answer is a fact about which directory the tool would
+      // act on next (ADR-014). It is printed in the text report; leaving it
+      // out of the JSON meant a machine-readable caller could not see it at
+      // all, which is the one-question-two-answers defect again.
+      workspace: {
+        root: ws.root ?? null,
+        source: ws.source,
+        detail: ws.detail,
+        error: ws.error ?? null,
+      },
+      shared,
+      findings: serialised,
+      fix,
+      ...diffField(fixMode && flags.diff === true ? findings.flatMap((f) => f.diffs ?? []) : [], flags),
+      ...(failure ?? {}),
+    });
+    return code;
+  }
+  if (result.error) {
+    return fail(`${root}: ${result.error}`, EXIT.CONFIG);
+  }
+  emit(
+    [
+      `root     ${root}`,
+      `stack    ${result.stack.length > 0 ? result.stack.join(', ') : '(undetected)'}`,
+      `evidence ${result.evidence.length > 0 ? result.evidence.join(' ') : '(none)'}`,
+      // Facts are what a profile selects on when it wants to survive the
+      // framework being replaced, so they are reported with the path that proved
+      // each one rather than as a bare list (ADR-013).
+      `facts    ${
+        result.facts.length > 0
+          ? result.facts.map((f) => `${f}(${result.factEvidence[f] ?? '?'})`).join(' ')
+          : '(none)'
+      }`,
+      `manifest ${result.manifest ? (result.manifest.error ?? result.manifest.id ?? 'present') : '(absent)'}`,
+      `workspace ${ws.root ?? '(none)'}  (${ws.source}: ${ws.detail})`,
+      // Printed only when this repository declares shared rules to a workspace copy: a line in
+      // every `doctor` is a line in every reader's terminal, and the reader who has
+      // nothing to install is not served by one (ADR-084).
+      ...(shared.declared ? [`shared    ${shared.state}  ${shared.detail}`] : []),
+      ...findingLines(findings, { fixMode, applying: mode.apply }),
+    ].join('\n'),
+    { maxBytes: flags.maxBytes ?? 0 },
+  );
+  // After the report: the report says what, the diff shows it (R50). Only the
+  // fix plan is diffed, so without --fix there is nothing to show.
+  if (fixMode && flags.diff === true) emitDiffs(findings.flatMap((f) => f.diffs ?? []), flags);
+  if (failedFix) {
+    return fail(
+      `doctor --fix applied ${fix.fixed.length} remedie(s) and ${fix.failed.length} failed: ${fix.failed.map((f) => `${f.id} (${f.error})`).join('; ')}`,
+      EXIT.FAIL,
+    );
+  }
+  // An unconfigured workspace is a fact, not a failure: a single repo with no
+  // workspace around it is a normal, supported case. A config file that EXISTS and
+  // does not parse is a real mistake, and that does fail - with the parse error,
+  // because naming the file without saying what is wrong with it sends the reader
+  // to the file and gives them nothing to look for.
+  if (ws.error) {
+    return fail(`workspace config ${ws.detail}: ${ws.error}`, EXIT.CONFIG, 'fix the JSON, or remove the file');
+  }
+  return EXIT.OK;
+}

package/src/commands/explain.mjs

@@ -0,0 +1,52 @@
+// simt explain <CODE> [--json]
+//
+// The last mile of the contract work is a reader: every status `simt check`
+// can emit gets a plain-language entry — what it means, why the gate reports
+// it, how to fix it, and a concrete trigger — either as text or as the same
+// JSON envelope every command answers in. The lookup is case-insensitive and
+// folds the `-`/`_` split, so DRIFT, Drift and drift are one question; an
+// unknown code is a usage error that lists the known codes rather than a guess.
+
+import { EXIT, emit, emitJson, fail, isJson } from '../output/index.mjs';
+import { EXPLAIN_CODES } from '../explain.mjs';
+
+export const EXPLAIN_ALIASES = { drifted: 'drift' };
+
+function fold(raw) {
+  const folded = String(raw ?? '').toLowerCase().replace(/_/g, '-');
+  return EXPLAIN_ALIASES[folded] ?? folded;
+}
+
+export function listExplainCodes() {
+  return Object.keys(EXPLAIN_CODES).sort();
+}
+
+export async function explainCommand(positional, flags) {
+  const raw = positional[0];
+  if (!raw) {
+    return fail(
+      'explain needs a code',
+      EXIT.USAGE,
+      `one of: ${listExplainCodes().join(', ')}`,
+    );
+  }
+  const code = fold(raw);
+  const row = EXPLAIN_CODES[code];
+  if (!row) {
+    return fail(
+      `unknown finding code \`${raw}\``,
+      EXIT.USAGE,
+      `one of: ${listExplainCodes().join(', ')}`,
+    );
+  }
+
+  if (isJson(flags)) {
+    emitJson({ ok: true, command: 'explain', code, ...row });
+    return EXIT.OK;
+  }
+  emit(
+    [`code     ${code}`, '', row.what, '', `Why: ${row.why}`, '', `Fix: ${row.fix}`, '', `Example: ${row.example}`].join('\n'),
+    { maxBytes: flags.maxBytes ?? 0 },
+  );
+  return EXIT.OK;
+}