simt-dev 0.6.3 → 0.7.1

package/docs/decisions/ADR-110-the-lock-file-follows-the-manifest-name-and-the-old-name-is-read-until-the-next-write.md

@@ -0,0 +1,43 @@
+---
+simt-affects: ["src/name.mjs", "src/projection/lock.mjs", "src/kernel/variants.mjs", "src/commands/sync.mjs", "src/commands/help.mjs", "src/bench/variants.mjs", "test/lock.test.mjs", "test/variants.test.mjs"]
+simt-supersedes: [{ adr: "ADR-086", ruling: 3, kind: "superseded" }]
+---
+
+# ADR-110 — the lock is `simt.lock.json`, and the old name is read until the next write
+
+Status: **accepted** · 2026-10-30 · supersedes ADR-086 ruling 3's file name
+
+## Context
+
+The lock followed the command's old name: `simt-dev.lock.json`. The command
+is `simt`, the manifest is `simt.json`, and the lock was the one remaining
+file that still carried the pre-rename spelling.
+
+A rename cannot be a bare move. A lock written by a pre-rename run may hold
+`variants` winners that nothing else records — the bench evidence for a
+locked rule text — so a reader that only knows the new name would silently
+unlock those decisions.
+
+## Ruling
+
+1. **The lock is `simt.lock.json`.** The old name is a read-only fallback:
+   a reader tries the new name first and falls back to the old one, and a
+   write always lands under the new name, which is how a legacy lock
+   migrates. The fallback is for absence, not for damage: a permission
+   failure on the new name does not fall back, and a file that exists but
+   does not parse is reported, not repaired by an older file. This is the
+   same read-both/write-new pattern as the manifest rename (ADR-056).
+2. **The name lives in one place.** `src/name.mjs` owns both names, the way
+   it owns the manifest's. The kernel and the projection each carried a
+   private copy — the kernel cannot import the projection, because the
+   projection imports the kernel — and two constants for one file is how a
+   rename ships half-done.
+
+## Consequences
+
+- A repository whose lock predates the rename keeps its locked variant
+  winners: `simt check --frozen` and the projection read them from the old
+  file, and the next `simt sync --yes` or `simt bench variants --yes` writes
+  them back under the new name.
+- ADR-086's ruling 3 stands for what the lock records — an input digest and
+  an output digest; the file name it named is superseded.

package/docs/decisions/ADR-111-the-tool-ships-one-agent-rendered-per-harness-and-installs-it-with-init-and-a-command.md

@@ -0,0 +1,75 @@
+---
+simt-affects: ["agents/simt-agent.md", "src/agents/render.mjs", "src/commands/agent.mjs", "src/commands/init.mjs", "src/projection/loaders.mjs", "src/toolwords.mjs", "test/agents.test.mjs"]
+simt-supersedes: []
+---
+
+# ADR-111 — the tool ships one agent, rendered per harness, and installs it with init and a command
+
+Status: **accepted** · 2026-10-30
+
+## Context
+
+The rules this tool projects tell an agent *what* to obey; nothing told it
+*how to act* through the tool. The plan for that was two agents — a planner
+and a builder — but the two jobs are one job in practice: read the tracker,
+take the next slice, build it, test it, commit it. Two files that both say
+"run the simt commands" are two copies of the same logic, and the second copy
+is where the next divergence grows.
+
+Six harnesses read a subagent and no two agree on the file. Five write a
+markdown file with YAML frontmatter and a body that becomes the system
+prompt; Codex writes a TOML file whose `developer_instructions` holds the
+same body. The path, the extension, the frontmatter keys and the document
+shape are all different, and none of them is the same fact.
+
+A hooks entry is a config key the tool merges into a file it does not own.
+An agent is a file the tool owns whole: there is nothing to merge, and the
+only question is whether the bytes on disk are the bytes the tool would write
+now.
+
+## Ruling
+
+1. **The tool ships one agent, `Simt-Agent`.** Its body is the system prompt
+   and it encodes how to act with simt-dev across the whole slice lifecycle —
+   orient (`simt brief`, `simt why`), plan (`simt plan status`, `simt plan
+   next`), build (`simt slice start`, the focused test, `simt slice finish`,
+   `simt plan done`) and the boundaries that hold everywhere. Planning and
+   building are one agent because they are one job.
+2. **The source of truth is one file, `agents/simt-agent.md`.** Neutral
+   frontmatter (`name`, `description`) plus a harness-agnostic body. The
+   renderer strips that frontmatter and re-emits the keys each harness
+   documents, so the body — the part that says how to act — is written once
+   and cannot drift between harnesses. The `simt-agent` stem is a name this
+   tool owns, and it is derived into the tool-word set from the module that
+   owns it, the way the other prefixed names are.
+3. **An agent is a file the tool owns whole, so the install is a byte
+   comparison.** `rendered` produces the text and reports `created`,
+   `unchanged` or `updated`. There is no parse that can fail and no partial
+   state, which is what makes the command shorter than `agent-hooks install`.
+4. **It is installed per harness, and the readers it does not write are
+   named.** Six harnesses document an agents file and receive one; the two
+   that document none are reported `NO FILE` with the reason, the way
+   ADR-079 ruling 11 requires. `--harness <id>` narrows the install to one
+   reader and names the skipped ones (ADR-107), and `status` reports
+   present, absent, drift, and the readers with no file.
+5. **It is written by `simt init` and by a separate `simt agents install`.**
+   `init` plans the agent files with the rest of the adoption and writes them
+   in the apply path, journaled the same way, so `undo` restores them with the
+   rest. The separate command exists for a repository that is already adopted
+   and wants only the agent, and for a narrowed install. Both call the same
+   `planAgents` and `writeAgentPlan`, so a dry run and a run describe the same
+   set of files.
+
+## Consequences
+
+- A repository that is adopted and later upgrades the tool's agent body runs
+  `simt agents install --yes` (or re-runs `init`) and the files come back
+  `updated` with the new body; the frontmatter each harness documents is
+  re-emitted from the same source, so it cannot drift.
+- The agent body names only commands a consumer repository runs — `simt
+  brief`, `simt why`, `simt plan`, `simt slice` — so every byte in it is
+  actionable in the receiving repository, the rule this repository exists to
+  enforce.
+- `agents/` is published with the package: the tool reads its own agent body
+  from the installed copy, and a tarball without it would install cleanly and
+  then fail on the one command that writes the agent.

package/docs/decisions/ADR-112-the-registry-is-what-simt-dev-ships-and-a-repo-owns-its-own-skills.md

@@ -0,0 +1,81 @@
+---
+simt-affects: ["graph/skills.graph.json", "src/resolve/local.mjs", "src/commands/skills.mjs", "src/projection/disclosure.mjs", "src/resolve/body.mjs"]
+simt-supersedes: [{ adr: "ADR-009", ruling: 4 }]
+---
+
+# ADR-112 — the registry is what simt-dev ships, and a repo owns its own skills
+
+Status: **accepted** · 2026-10-31 · filed as S4 (plan 0005) · supersedes ADR-009 ruling 4
+
+## Context
+
+ADR-009 settled the layout: a skill is `<name>/SKILL.md` with mandatory `name`
+and `description` frontmatter, and body size and reference count are declared in
+`graph/skills.graph.json`, "so the registry stays the single source of truth for
+resolution metadata". The layout half of that ruling was about one estate's
+thirty-nine skills, and the metadata half assumed the estate was the universe: a
+skill not in the graph is a skill that does not exist.
+
+Plan 0005 broke that assumption in two slices. S2 removed the thirty-one
+repo-specific entries from the graph, leaving the eight skills this tool ships —
+`simt-commands` and seven vendored stack skills. A graph that describes one
+estate and is read by everyone was ADR-061's finding; a graph that is one
+estate's whole skill population is a stronger claim ADR-061 did not make, and S2
+made it false. S3 then gave the repo's own skill directories standing in the
+resolver: `skills find`, `brief`, `show` and `why` answer for a skill the
+registry never declared, synthesising its node from the file — name and summary
+from frontmatter, size from the file, body from the path (commit 7d44071).
+
+A reader of ADR-009 acting on the metadata sentence concludes that a skill absent
+from the graph has no resolution metadata, and therefore cannot resolve. That
+conclusion is now false in every repo that keeps its own skills, and a record
+that says what the tool no longer believes is the failure this directory exists
+to prevent.
+
+## Ruling
+
+1. **The graph is a catalogue of what simt-dev ships, not the sole home of
+   skills.** Membership in `graph/skills.graph.json` is a statement about the
+   package, not about existence. A skill a repository installed in its own skill
+   directories exists and resolves with no entry in the graph.
+2. **A repo's skill directories are a first-class source of resolution.**
+   Presence is the eligibility signal — a skill the repo installed is about the
+   repo, and the stack it belongs to is the stack the repo has. Frontmatter
+   supplies the name and the summary; the file supplies the body and the size.
+   This is the mechanism S3 shipped; the ruling records it so the reader learns
+   what the tool believes without reading the plan.
+3. **Where a name is in both, the registry entry is canonical.** The graph entry
+   and the local file are one skill — the file is the installed copy of what the
+   graph declares — and keeping both would rank one skill twice. The graph wins
+   the dedupe; the local node is dropped, not merged.
+
+## Consequences
+
+- ADR-009's layout ruling stands and is load-bearing: discovery reads `name` and
+  `description` from frontmatter, so a local skill without them is invisible,
+  which is the defect class ADR-009 exists to prevent. What moves is the metadata
+  sentence: a local skill's resolution metadata is synthesised from the
+  filesystem, not read from the graph, so the graph is no longer the single
+  source of truth for it.
+- `skills find`, `brief`, `show` and `why` answer for names the registry never
+  declared. The NOT SELECTED block no longer points a reader at a `skills show
+  <name>` that 404s for a name the graph does not carry.
+- Nothing in the shipped bytes changes. ADR-061 stands as written: the registry
+  is workspace data, the package ships none of it, and a command that finds no
+  registry says so. This record settles the half ADR-061 left open — who is
+  allowed to have skills the catalogue does not name — without touching its
+  rulings.
+- `skills index` keeps reporting the catalogue only: it is the tier-0 view of
+  what this tool ships, and local skills surface where a repo is the context,
+  which is `find` and `brief`.
+
+## Rejected
+
+- **Rewrite ADR-009 in place.** The supersession rule this directory opens with
+  is a new record and an edited status line, never a rewritten ruling. ADR-009's
+  audit data — the forty-six frontmatter tallies that found the flat file — is
+  evidence its own ruling relies on, the same shape that kept ADR-011 standing
+  when ADR-012 reversed it.
+- **Annotate ADR-009 without a record.** The supersession is a claim about what
+  the tool believes, and a claim without a record is a ruling nobody can cite.
+  The annotation points at ADR-112; ADR-112 carries the argument.

package/docs/decisions/ADR-113-a-pre-push-that-carries-only-documentation-skips-the-test-gate-and-says-so.md

@@ -0,0 +1,87 @@
+---
+simt-affects: ["src/hooks/dispatcher.mjs", "src/commands/hooks.mjs", "simt.json", "test/hooks.test.mjs"]
+simt-supersedes: []
+---
+
+# ADR-113 — a pre-push that carries only documentation skips the test gate, and says so
+
+Status: **accepted** · 2026-10-31
+
+## Context
+
+The shared dispatcher runs a repository's declared pre-push gates on every push.
+For this repository that is the full test suite — fifteen hundred tests, minutes
+of wall clock — and the push it guards is frequently the one shape of push the
+suite adds nothing to: a release commit (version, changelog, manifest pin), a
+tag, a documentation edit. The suite runs there for the same reason it runs
+anywhere, which is the correct reason in general and a tax in this case.
+
+The dispatcher's standing commitments shape what the fix may be. It fails
+closed, never fail open: a gate that cannot run is a failure, not a skip. It
+never weakens a control to make a hook pass, and a control is downgraded only
+from the manifest, where a reviewer sees it. And it reports what did not run,
+so "passed" can never be mistaken for "only some of it passed". A skip that is
+invisible is a weakened control the reader did not approve; a skip that is
+guessed at is a fail-open.
+
+git answers both problems: it feeds the pre-push hook a ref list on stdin —
+one line per ref being pushed, with the local and remote shas — so the push
+can be diffed against exactly what the remote already has, and the manifest is
+already the declared home of gate configuration.
+
+## Ruling
+
+1. **The `test` gate is the only gate a push can skip, and only on evidence.**
+   Before running its gates, the dispatcher classifies the push from the ref
+   list git fed on stdin. The `test` gate is skipped when, and only when, every
+   ref being pushed is one of: a branch whose diff against the remote is at
+   most a declared number of commits and touches only declared paths; a tag
+   whose commit is confirmed already delivered; or a deletion. Every other gate
+   runs unconditionally: they are cheap and repo-specific, and a skip the
+   classifier does not own is a skip it did not earn.
+2. **The skip is opt-in per repository, and absence runs the suite.** The
+   classification is declared in the manifest as `gates.prePushSkipTest` with
+   `maxCommits` and `paths`. A repository without the key runs the full suite
+   on every push; a key with missing or mis-shaped fields does the same. The
+   control is downgraded from the manifest where a reviewer sees it, and a
+   downgrade the manifest cannot state precisely is one it did not make.
+3. **Every uncertainty fails closed to the full suite, and a skip is reported.**
+   An unreadable ref list, a new branch (no remote sha to diff against), a tag
+   whose commit cannot be confirmed already delivered, a commit count above the
+   ceiling, a file outside the declared paths, or a git error each run the suite.
+   When the skip does fire, the report prints the gate as `SKIPPED` with the
+   reason — the commit count, file count, and tag count that earned it — so the
+   reader sees the suite was not run and why.
+
+## Consequences
+
+- A push of one or two documentation or release commits no longer pays for the
+  full suite in this repository, whose manifest declares a ceiling of two
+  commits over markdown, `docs/`, `package.json` and `simt.json` — the shape
+  of a release commit.
+- The file list is a tree diff over `remote..local`, so a force push is judged
+  on the trees it replaces, not on the commits it adds.
+- A release tag rides along in the skip. In the release flow a tag names commits
+  already delivered (and tested) by a branch push, so the classifier accepts it
+  only when the commit it points to is reachable from a remote-tracking ref, or
+  is among the commits the same push is delivering on a branch. A tag on a
+  commit no pushed ref contains runs the suite: the gate does not assume a tag
+  is harmless, it verifies the commit behind it.
+- The classification reads the repository's git state, so it runs on the real
+  root; the disposable worktree at HEAD is for the gates, and a push that
+  earns the skip does not need one.
+- Nothing in this ruling widens to other events. Pre-commit has no ref list to
+  classify and keeps running its gates on every commit.
+
+## Rejected
+
+- **Skip by file extension in the hook, with no manifest declaration.** The
+  hook would then own a policy no reviewer can read in a diff, which is the
+  exact failure the manifest requirement exists to prevent — and a reader of
+  another repository could not tell whether its suite had run.
+- **Skip when the push is small, whatever it touches.** A two-line change to a
+  gate definition is a code change the suite exists to catch, and a size
+  threshold without a path rule cannot tell it from a two-line doc edit.
+- **Make the skip silent.** The dispatcher's report is its contract: a gate
+  that did not run is named with its disposition and its reason, or the reader
+  cannot distinguish "passed" from "never ran".

package/docs/decisions/ADR-114-the-bench-pairs-at-the-task-level-a-missing-cost-is-not-zero-and-an-unasked-cross-group-compare-is-refused.md

@@ -0,0 +1,74 @@
+---
+simt-affects: ["src/bench/report.mjs", "src/bench/run.mjs", "src/bench/ablate.mjs", "src/bench/variants.mjs", "src/advice/advice.mjs", "src/commands/bench.mjs", "test/bench.test.mjs"]
+simt-supersedes: []
+---
+
+# ADR-114 — the bench pairs at the task level, a missing cost is not zero, and an unasked cross-group compare is refused
+
+Status: **accepted** · 2026-10-31
+
+## Context
+
+Review 0003 (Q46) verified three failures in the bench statistics and read a fourth
+in the code:
+
+- One task with ten reps produced `pairedRuns 10, mcnemar p 0.00195` — the run-level
+  pairing treated reps of a task as independent tasks, inflating significance by an
+  order of magnitude.
+- A claude run with usage but no prices table reported `C $0.0000 | CPI $0.0000` — a
+  missing cost read as a zero cost, the cheapest outcome measurable.
+- `gold` and `noop` harness runs of the same arm name pooled into one 50 % row — the
+  harness that produced each run was invisible.
+- Ablation tested ~N sections at α 0.05 each with no multiplicity correction, and the
+  bootstrap CPI confidence intervals silently dropped the resamples whose cost was
+  undefined.
+
+Plan 0004 §1 fixes the shape of the answer: repeats of a task are not independent
+tasks; the cost per verified outcome is undefined when none resolve, never zero; and
+non-inferiority is judged by a one-sided 95 % lower bound of ΔR above −2 percentage
+points, with inconclusive evidence reported when the interval is too wide to decide.
+
+## Ruling
+
+1. **Pairing is at the task level only.** `compareArms` collapses each arm to
+   task means and pairs on shared tasks. The exact two-sided sign test on task-mean R
+   replaces McNemar (the sign of a task-mean difference does not assume the 0/1
+   contingency McNemar requires); the Wilcoxon signed-rank test runs on task-mean C.
+   `pairedRuns` survives as a descriptive count (Σ min reps) and is never used in a
+   statistic.
+2. **An unknown cost is null, never zero.** `computeRunCost` returns `{ usd, source }`
+   with `source` ∈ `priced | reported | missing`; `usd` is null when no prices table
+   applies and the harness reported no cost. A task's C is null if any rep's cost is
+   missing, an arm's C likewise, and the arm's C confidence interval is null rather
+   than narrowed to the resamples that happened to price out. `CPI` is total cost
+   divided by resolved outcomes and is null when the cost is incomplete or nothing
+   resolved — never zero, never a favourable finite score.
+3. **A report row is a (harness, model, arm, experiment) group.** Pooling across
+   harnesses is gone. A `--compare` whose arm name matches more than one group is
+   refused as ambiguous, and a compare that crosses harness, model or experiment is
+   refused unless the caller passes `crossGroup` (CLI `--cross-group`).
+4. **Multiplicity is controlled with Holm step-down.** The family is the set of
+   comparisons tested in one run — the ablation sections, and per slot the
+   variant-versus-baseline comparisons — and the adjusted p-values feed the canary
+   escalation decision.
+5. **The verdict is a non-inferiority verdict.** With `n < 5` paired tasks the
+   verdict is `insufficient-tasks` — the smallest two-sided sign-test p-value at
+   n = 4 is 0.125, so fewer tasks cannot reject at α = 0.05 and the sample is said
+   to be too small, not that the p-value was high. Otherwise: `non-inferior` when
+   the one-sided 95 % lower bound of ΔR is above −2 pp, `inferior` when the two-sided
+   bound is entirely below 0, `inconclusive` when the interval is too wide to decide.
+6. **v1 records keep reading.** A numeric `costUsd` is a reported cost; a null one is
+   missing. No migration, no new schema version.
+
+## Consequences
+
+- `mcnemarTest` stays exported and is exercised by its unit test; `compareArms` no
+  longer returns an `mcnemar` key, so its only live caller inside the tool is the
+  sign test.
+- `simt bench report` markdown gains Harness and Model columns, a `Sign` row, and
+  non-inferiority and verdict lines; the `--cross-group` flag exists only to override
+  refusal.
+- `simt bench ablate` and `simt bench variants` escalate on Holm-adjusted p-values,
+  and a section entry carries `rTest` instead of `mcnemar`.
+- Advice skips un-costed runs when grounding a cost floor, and variant ranking treats
+  an unknown cost as worst — it cannot be ranked cheaper than anything.

package/docs/decisions/ADR-115-the-index-stamps-its-schema-version-migrates-older-databases-in-place-and-serves-newer-ones-from-a-sidecar.md

@@ -0,0 +1,69 @@
+---
+simt-affects: ["src/index/persist.mjs", "src/index/store.mjs", "src/commands/map.mjs", "test/index.test.mjs", "test/map.test.mjs"]
+simt-supersedes: []
+---
+
+# ADR-115 — the index stamps its schema version, migrates older databases in place, serves newer ones from a sidecar, and names a corrupt index
+
+Status: **accepted** · 2026-10-31 · filed as review 0003 Q44
+
+## Context
+
+Review 0003 (Q44) verified three failures in the local index's persistence:
+
+- The database carried no schema version a reader trusted. A newer simt
+  silently rewrote a database an older simt had written, and two pinned
+  versions rewrote one file past each other — the ADR-059 flip-flop.
+- The FTS tables, whose tokenizer lives in their definition, were
+  recreated by a per-write wipe (`ensureFtsSchema`) whenever the stored DDL
+  drifted: a migration that ran on every build, unnamed and unobservable.
+- Every read failure answered `[]`. "Locked", "no such column" and "corrupt"
+  all looked like a cold index, so a damaged database read back as an empty
+  one and the command quoted the emptiness as the repository's shape.
+
+Plan 0004 §1 fixes the shape of the answer: the index declares the version it
+was written at; a version change is a named, ordered migration; a file this
+version does not own is not opened for write; and a read failure is named, not
+silenced.
+
+## Ruling
+
+1. **The version is stamped on every write.** `PRAGMA user_version` carries
+   the schema version in the sqlite database; the meta `schema` row is kept
+   as the fallback for databases written before the stamp existed, and as the
+   version carrier in the jsonl backend, whose lines carry no pragma.
+2. **Migrations are an ordered list, and the 3 → 4 step is the FTS
+   recreation.** Each step is idempotent and runs in list order; a database
+   older than the current version is opened in place and upgraded on the next
+   write. A database at a version past the last step is not opened for write
+   at all — opening it would demote the stamp.
+3. **A file a newer version owns stays with its owner.** This version reads
+   and writes a sidecar named after itself, `index.v<SCHEMA_V>.sqlite` (and
+   `.jsonl`); the canonical file is untouched. A sidecar that has not been
+   built yet is cold, not broken. `indexFileFor` is the single owner of the
+   sidecar name, shared by readers and writers.
+4. **A read returns `{ rows, error }`, and a failure is named.** `INDEX_BUSY`
+   is a retryable write contention; `INDEX_CORRUPT` is a file that cannot be
+   read as a database. The store's read wrappers attach the error to the row
+   array, so callers that iterate are untouched and callers that report can
+   tell a broken index from an empty one. `loadGraph` answers `broken`
+   alongside `cold` and `stale`: `cold` is "nothing here", `broken` is
+   "something is here and the read failed".
+5. **A corrupt canonical file is rebuilt in place by the next build.** The
+   index is a cache of git blobs (ADR-089): a damaged file is named on read
+   and replaced on write, and the rebuildability that makes the file
+   disposable is what makes in-place replacement safe.
+
+## Consequences
+
+- `ensureFtsSchema` and its per-write wipe are gone; the FTS tables converge
+  through the named migration, which runs once per upgrade, not per build.
+- `migrateDb` stays module-private: it is called by the writer, and the
+  dead-code gate reads an export as a promise to a caller this package does
+  not have.
+- `reindex`'s `force = version !== SCHEMA_V` remains sound: an older database
+  is fully rewritten and then migrated in place; a newer one is left alone
+  and the build goes to the sidecar.
+- `simt repoindex`, `simt init` and `simt map` output paths are unchanged;
+  `SQLITE_FILE` and `JSONL_FILE` keep their names, and the sidecar is the
+  only new file this ruling introduces.

package/docs/decisions/ADR-116-rust-support-reaches-the-example-path-the-indent-and-the-bench-runner.md

@@ -0,0 +1,100 @@
+---
+simt-affects: ["rules/mdc/test-gate.mdc", "src/projection/baselines.mjs", "src/bench/mine.mjs", "src/compare/learn.mjs", "test/bench.test.mjs", "test/mdc.test.mjs", "test/baselines.test.mjs", "test/compare.test.mjs"]
+simt-supersedes: []
+---
+
+# ADR-116 — Rust support reaches the example path, the indent and the bench runner
+
+Status: **accepted** · 2026-10-31
+
+## Context
+
+ADR-062 made Rust a first-class adoption: `has-cargo-toml` selects the `rust` profile,
+`simt init` seeds `cargo fmt --check`, `cargo clippy -- -D warnings` and `cargo test`
+when `cargo` is on PATH, and dependabot watches `Cargo.toml`. Much of the rest of the
+tool already knew the ecosystem — the index extracts Rust `use` edges and records `.rs`
+files, `simt secrets` reads `Cargo.lock`, the monorepo reader reads `[workspace] members`
+from `Cargo.toml`, and the card resolves `cargo build` and a focused `cargo test {name}`.
+
+Three places a Rust repository reads or runs did not know it:
+
+- `rules/mdc/test-gate.mdc` substitutes one example test path, and only Go had a
+  per-signal default. A Rust repository was handed `path/to/the.changed.test.ts` — an
+  instruction that names a file its test gate can never run.
+- The shared `.editorconfig` assigns four spaces to Python, Java and Kotlin, and left
+  `.rs` at the default two. Rust's own formatter writes four, so the shared baseline
+  contradicted `cargo fmt` in every Rust repository that adopted it.
+- `detectTestRunner` knew package.json, vitest, Go, Python, Gradle and Maven. A Cargo
+  repository fell through to no runner, so `simt bench mine` could not grade a Rust
+  patch and `simt gate` could not select its tests.
+
+The gate classifier had the same blind spot in its heuristic fallback: a declared
+`cargo test` was classified through the declared command, but a command read from a
+repository that had not declared it was not recognised as a test gate.
+
+## Ruling
+
+1. **A Rust repository is shown a Rust test path.** `exampleTestPath` gains
+   `default-has-cargo-toml: tests/the_changed.rs`. Rust's test paths are Cargo
+   integration tests in `tests/`; inline `#[cfg(test)]` modules live in the source file
+   and have no separate path to name. The signal is the detection fact, not a new stack
+   tag, so ADR-013 and ADR-062 still hold.
+2. **`.rs` is four spaces in the shared editorconfig.** It joins the
+   `[*.{py,pyi,java,kt,kts,rs}]` section with `indent_size = 4`, matching rustfmt.
+3. **The bench runs Cargo the way Cargo can be run.** A `tests/<stem>.rs` file is a
+   test target, so a patch touching only integration tests selects one `--test <stem>`
+   per file (`cargo test --test api`). A patch touching a source file means inline unit
+   tests, which have no file argument, so the crate's whole test binary runs
+   (`cargo test`). No changed files also runs the crate. The prompt command, the
+   executed command and the parser come from the same branch, so a preview cannot name
+   a narrower command than the one that ran.
+4. **Cargo's text output is parsed by its result lines.** `parseCargoTestOutput` accepts
+   only lines of the form `test <name> ... ok|FAILED|ignored`. `ignored` is neither a
+   pass nor a failure. `test result:` summaries and compile output are not tests. The
+   parser is shared by `simt bench mine`, `simt bench grade` and `simt gate`, which all
+   go through `detectTestRunner`.
+5. **`cargo test` is classified as a test gate.** The fallback in
+   `classifyGateCommand` recognises it alongside `npm test`, `node --test`, `pytest` and
+   `go test`, with ADR-003's focused-default ruling.
+
+This record does not supersede ADR-062 (what a fresh Rust adoption seeds) or ADR-092
+(which test edges count). It closes the three reader-facing gaps those records left
+open.
+
+## Consequences
+
+- A Rust repository's projected `test-gate` names `tests/the_changed.rs`; no TypeScript
+  or Go example path leaks into it. The signal is `has-cargo-toml`, so a mixed
+  repository with both `package.json` and `Cargo.toml` is shown the Rust example.
+- Every repository that adopts `.editorconfig` now writes `.rs` at four spaces. A
+  repository that deliberately wants another indent still overrides it below the
+  region, which is what last-match-wins is for.
+- `simt gate <path>` on a Rust repository selects `cargo test --test <target>` for an
+  integration test and `cargo test` for a source file. The bench can mine and grade
+  Rust tasks with the same evidence discipline as the other ecosystems.
+- The parser has no JSON dependency: `cargo test --format json` is nightly-only, and
+  this package has zero runtime dependencies and must not require a nightly toolchain
+  to read a test result.
+- Acceptance: the Rust render of `test-gate` names only `tests/the_changed.rs`; the
+  editorconfig section for `.rs` states four spaces; a Cargo runner is detected for
+  both `tests/*.rs` and `src/*.rs`; libtest output yields passed and failed names and
+  drops ignored tests.
+
+## Rejected
+
+- **A `rust` stack tag.** Rust is detected by `has-cargo-toml`; adding a tag would give
+  one ecosystem two identities and break the fact/tag separation ADR-013 relies on.
+- **Seeding `typecheck: cargo check`.** ADR-062 rules the seeded Rust gates to format,
+  lint and test. Adding a gate changes what a fresh adoption declares, and that is a
+  separate decision with its own acceptance tests, not a silent part of this one.
+- **A conventional `tests/foo.rs` → `src/foo.rs` edge.** A Cargo integration test is a
+  separate crate and need not mirror a source file. ADR-092 permits a conventional edge
+  only when the convention is real; guessing one would manufacture test coverage that
+  does not exist.
+- **A Rust toolchain pin check.** The Rust profile requires a pin only where the
+  repository commits one. `src/toolchain.mjs` is deliberately Node-specific; extending
+  it to read `rust-toolchain.toml` or `rust-version` is a new belief and needs its own
+  record.
+- **Adding `.rs` to `FORMATTABLE`.** That set is the staged-file list for Prettier.
+  Rust formatting is a declared command gate (`cargo fmt --check`), and handing `.rs`
+  to Prettier would format it with the wrong tool.

package/docs/decisions/ADR-117-the-darwin-release-builds-on-supported-macos-15-runners-and-a-re-run-is-idempotent.md

@@ -0,0 +1,81 @@
+---
+simt-affects: [".github/workflows/publish.yml", "test/binary.test.mjs"]
+simt-supersedes: [{ adr: "ADR-099", ruling: 1, kind: "superseded" }]
+---
+
+# ADR-117 — the darwin release builds on supported macOS 15 runners, and a re-run is idempotent
+
+Status: **accepted** · 2026-10-31 · supersedes ADR-099 ruling 1
+
+## Context
+
+The v0.7.0 release run `41215349142` reached the first binary release: the npm stage
+succeeded, the release record was created, and `linux-x64` built. Both darwin jobs failed
+in the same place — `macos-14`, the runner ADR-099 ruling 1 named, is deprecated, and
+GitHub was running scheduled brownouts of that image ahead of its retirement.
+
+The old matrix also used one label for two architectures. GitHub's runner-images table
+now names `macos-14` as arm64 and `macos-14-large` as Intel, so "both targets on
+`macos-14`" was not the native-runner arrangement ADR-099 claimed. The replacement has
+to name the arm64 and Intel images explicitly.
+
+The same run exposed a second release-path defect. `publish-npm` decided whether to skip
+by asking the registry whether the version was published. A staged version is not
+published, so re-running the workflow after every other job succeeded would try to stage
+the same version again and fail on the duplicate. "Re-run all jobs" is the normal way to
+recover a partially failed release, and it must not turn a completed stage into a red
+job.
+
+## Ruling
+
+1. **Darwin targets build on the supported native macOS 15 images.**
+   `darwin-arm64` runs on `macos-15` and `darwin-x64` runs on `macos-15-intel`;
+   `linux-x64` stays on `ubuntu-latest`. These are the standard, non-deprecated labels
+   for the two architectures, not the larger-runner variants. ADR-099's per-host
+   determinism and upload-integrity claims are unchanged; only the label that provides
+   the native host moves.
+
+2. **A re-run is idempotent for a stage that already succeeded.**
+   `publish-npm` checks the npm staging queue as well as the registry. A version that is
+   published *or* already staged sets `SKIP=true`, so the tests, the wheel check and
+   `npm stage publish` are not repeated. The staging check runs after npm 11 is
+   available, because `npm stage list` is the command that makes the queue visible. A
+   failed stage list is not treated as proof of absence: the job attempts the stage and
+   fails loudly rather than silently skipping a release that does not exist.
+
+   The release record, asset upload and formula mirror were already idempotent —
+   `create-release` edits an existing release, `gh release upload --clobber` replaces
+   assets, and `sync-formula` exits when the mirror already names the served bytes.
+   They stay that way. A re-run does not skip a build on the grounds that an asset with
+   the same name exists: the tag can have moved, and the asset must be built from the
+   tree the tag now names.
+
+## Consequences
+
+- A darwin failure is recovered on a runner GitHub supports, and the arm64 and Intel
+  assets are produced on the architectures they claim.
+- "Re-run all jobs" after a successful stage is green: the stage job says the version is
+  already staged, the release record is refreshed in place, and the formula is compared
+  rather than overwritten.
+- "Re-run failed jobs" remains the narrower recovery: it rebuilds only the targets that
+  failed, which is the path the v0.7.0 run needed.
+- ADR-099 ruling 1 is superseded. Its ruling 2 (upload integrity) and ruling 3 (the
+  formula mirrors served bytes) still govern the release.
+- `test/binary.test.mjs` reads the committed workflow and asserts the two darwin labels,
+  so a future edit that returns to a deprecated or wrong-architecture runner fails the
+  suite instead of a release.
+
+## Rejected
+
+- **`macos-latest` for arm64.** It moves with GitHub's newest stable image. A release
+  builder should change when this repository decides to change it, not when a label
+  migrates.
+- **`macos-26`.** It is newer than the release needs, and no run has proven the pinned
+  Node base and `codesign` pipeline on it. Moving to it is a separate reviewed change.
+- **`macos-14-large`.** It is the Intel half of a deprecated image, so it inherits the
+  brownout that caused this failure.
+- **Skipping a build because the asset name already exists.** The tag this workflow runs
+  for can be moved, and an asset left from an earlier tree would then be served as the
+  new tag's binary. Rebuilding and clobbering keeps the bytes tied to the tagged tree.
+- **Detecting a prior stage through the registry alone.** A stage is deliberately not
+  public, so the registry cannot answer whether it exists.