simt-dev 0.2.0__py3-none-any.whl

simt_dev/vendored/bin/simt-dev.mjs

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+// simt-dev - developer and agent tooling for the SIMT ecosystem.
+//
+// POSIX only (ADR-012). package.json declares os: [darwin, linux], so npm refuses
+// the install elsewhere rather than letting a hook fail obscurely.
+
+import { dispatch } from '../src/commands/index.mjs';
+import { EXIT, fail } from '../src/output/index.mjs';
+import { parse } from '../src/argv.mjs';
+
+try {
+  const argv = process.argv.slice(2);
+  const parsed = parse(argv);
+  if (!parsed.ok) {
+    process.exit(parsed.code);
+  }
+  const { flags, positional } = parsed.value;
+
+  // No arguments at all is a usage error, not a silent help dump: an agent that
+  // ran the wrong thing should be told so rather than handed 40 lines of prose.
+  if (positional.length === 0 && !flags.help && !flags.version) {
+    process.exit(fail('no command given', EXIT.USAGE));
+  }
+
+  process.exit((await dispatch(argv)) ?? EXIT.OK);
+} catch (error) {
+  process.exit(fail(error?.message ?? String(error), EXIT.FAIL));
+}

simt_dev/vendored/docs/decisions/ADR-001-push-requires-approval.md

@@ -0,0 +1,42 @@
+# ADR-001 — Push requires explicit approval
+
+Status: **accepted** · 2026-10-05 · affects all repos
+
+## Context
+
+The repos state a commit/push policy. They disagree on whether an agent may push.
+
+- A repo outside this estate: "always create a focused Git commit… skip the commit only
+  when the user explicitly asks not to commit." Silent on push.
+- `repo-07/AGENTS.md` DoD #8: "**Committed and pushed** with a conventional message."
+- `repo-14` and `repo-11`: "create a non-interactive Conventional Commit. Report
+  the commit SHA; **do not push**."
+- `repo-04`, `repo-13`: silent.
+
+The Social pair justify it: a push to the production branch triggers Cloudflare Workers Builds,
+so "an approved push is therefore a production deployment action, not only source publication."
+`repo-07` has no such coupling, and its rule asks for an autonomous push.
+
+## Ruling
+
+Commit locally, report the SHA, **push only on explicit user approval**.
+
+When a repo's push triggers a deployment, a migration, or any remote mutation, say so before
+asking for approval — do not treat approval for the push as approval for the deploy.
+
+`repo-07` DoD #8 changes to "committed with a conventional message; pushed on approval."
+This is the single outlier, and the 4:1 majority is also the safe direction.
+
+## Consequences
+
+- An agent that finishes a task ends at a reported SHA. Pushes become a separate, explicit step.
+- `simt-dev init` and `upgrade` propose changes and never push, including for simt-dev itself.
+- Repos whose CI deploys on push must state that consequence in their own AGENTS.md, which is
+  where the Social pair's rule already lives.
+
+## Rejected
+
+- **Autonomous push (garmin's current rule).** Removes the only checkpoint between "the agent
+  thinks it is done" and "production changed".
+- **Push on completion, as a commit-always contributor loop implies.** Same objection; its
+  PR step does not require an agent to open the PR unattended.

simt_dev/vendored/docs/decisions/ADR-002-refactor-blast-radius.md

@@ -0,0 +1,45 @@
+# ADR-002 — Blast radius bounds refactoring; a third copy is a defect
+
+Status: **accepted** · 2026-10-05 · affects all repos
+
+## Context
+
+Two repos state opposite philosophies, and both are reasonable in isolation.
+
+- `repo-14` / `repo-11`: "When a second real use or a near-duplicate already
+  exists, refactor the existing code to extract the shared part… A third copy of the same
+  logic is a defect, and so is an abstraction invented for a single caller."
+- A repo outside this estate: "Match existing style, naming, and test layout. **Do not
+  refactor neighboring code unless the requested change requires it.** Do not add speculative
+  flexibility, configuration, or abstractions."
+
+Neither can be an org rule as written. The Social rule mandates proactive refactoring;
+the other forbids it.
+
+## Ruling
+
+Both survive, split by scope:
+
+- **Outside the current change's blast radius** — do not refactor. Unrelated code is not
+  collateral.
+- **Inside the blast radius** — a second real use extracts, and the extraction is *finished*:
+  no orphaned imports, exports, styles, messages, files, feature flags or compatibility
+  aliases remain anywhere in the affected dependency graph.
+- **A third copy of the same logic is a defect.** So is an abstraction invented for a single
+  caller.
+
+## Consequences
+
+- "Do not refactor neighbours" survives verbatim as a reviewer's objection to drive-by changes.
+- "A third copy is a defect" survives verbatim as a reviewer's objection to copy-paste.
+- Refactor completion becomes a checkable state, not an intention: the reviewer greps for
+  orphans rather than trusting the claim.
+- The "no speculative flexibility" half is restated as the single-caller half of this
+  ruling rather than as a blanket ban.
+
+## Rejected
+
+- **Social's rule verbatim.** Sanctions unrelated refactors, which is how a 10-line fix turns
+  into a 400-line diff nobody can review.
+- **The opposite rule verbatim.** Sanctions the third copy, which is how a codebase grows four
+  subtly different implementations of the same validation.

simt_dev/vendored/docs/decisions/ADR-003-test-breadth.md

@@ -0,0 +1,46 @@
+# ADR-003 — Focused tests are the default; a full suite needs a named trigger
+
+Status: **accepted** · 2026-10-05 · affects all repos
+
+## Context
+
+- `repo-14` / `repo-11`: "Focused tests are the default gate, and full suites are
+  the exception… **absent a named trigger, running a full suite is a defect, not diligence.**"
+- A repo outside this estate: `fail_under = 100` plus a full-suite script as the pre-push
+  default, and a contributor loop that says "run the full gate locally (lint + tests +
+  coverage)."
+- `repo-07`: reframes the axis entirely as a layer-conditional 5a–5m matrix.
+- `repo-13`: no policy — it just lists `npm run test:unit && npm run test:e2e`.
+
+The Social pair make a full suite a sin. media presents it as unremarkable. The hard-gate
+repo makes it mandatory. These cannot all be org rules as stated.
+
+## Ruling
+
+Focused tests are the default gate. Running a full suite is legitimate **only** against a
+named trigger:
+
+1. Phase exit.
+2. Release gate.
+3. Behaviour that crosses a system boundary.
+4. A repo-declared numeric gate (see ADR-006 for where that number lives).
+5. Explicit user or caller instruction.
+6. Pre-push on a protected branch, in a repo that declares this trigger in `simt-dev.json`.
+
+Re-running a full suite as a progress meter is a defect. Repos outside this estate already
+say exactly this ("do not run the full gate repeatedly as a progress meter"); the principle is
+adopted as canonical.
+
+## Consequences
+
+- Each repo's `simt-dev.json` declares which of the six triggers are active for it. A repo
+  with a declared numeric gate activates 4 and 6; one repository activate 1, 2 and 3.
+- A reviewer can ask "which trigger?" and get a number, not an opinion.
+- media gains an explicit policy instead of an implicit one that contradicts its siblings.
+
+## Rejected
+
+- **"A full suite is a defect."** Wrong for a release gate and wrong for a repo whose coverage
+  floor is a hard number; it makes the rule get ignored rather than followed.
+- **Full suite by default.** Re-pays the whole cost on every iteration; the Social pair are
+  right that an inflated brief is a defect in the brief, not thoroughness.

simt_dev/vendored/docs/decisions/ADR-004-hook-owns-format.md

@@ -0,0 +1,45 @@
+# ADR-004 — The hook owns format and lint for staged files
+
+Status: **accepted** · 2026-10-05 · affects all repos
+
+## Context
+
+- `repo-11`: "lint and format are enforced by the pre-commit hook — **do not run them
+  manually.**"
+- `repo-14`: "the local pre-push hook republishes opportunistically when a token happens to
+  be present." Never says the hook is the gate; instructs agents to run static checks directly.
+- A repo outside this estate: tells agents to run its linter and `git diff --check` by hand,
+  and its contributor guide repeats it.
+- `repo-04`, and 11 repos with no hooks at all: silent.
+
+The audit also found the estate's hook reality: 4 incompatible conventions, and
+`repo-05/hooks/pre-push` is **0 bytes** while the real git-lfs pre-push sits unused in
+`scripts/hooks/`.
+
+## Ruling
+
+The pre-commit hook owns format and lint **for staged files**. Do not re-run what the hook
+just ran on the same files.
+
+Manual runs are correct when:
+
+1. The hook is not installed in this checkout, or
+2. A check failed and you are diagnosing it, or
+3. The check is not hook-covered (typecheck, migration verification, contract generation).
+
+A repo with no hook installed still runs its checks manually. Silence is not permission to
+skip.
+
+## Consequences
+
+- The shared hook dispatcher from plan 0001 lands in every repo that has one, which also
+  delivers the dead `repo-05/hooks/pre-push` fix.
+- `simt-dev doctor` reports hook installation state, so "the hook will cover it" is a
+  verifiable claim rather than an assumption.
+- The 11 hook-less repos get a pre-commit on adoption, which ends the silent case entirely.
+
+## Rejected
+
+- **"Never run lint manually."** False whenever the hook is absent, which is most of the
+  estate today.
+- **"Always run lint manually."** Re-runs what a hook already verified, on every iteration.

simt_dev/vendored/docs/decisions/ADR-005-file-length.md

@@ -0,0 +1,42 @@
+# ADR-005 — File length is two tiers: 400 review trigger, 1000 hard ceiling
+
+Status: **accepted** · 2026-10-05 · affects all repos
+
+## Context
+
+- `repo-14` / `repo-11`: "**Split any file once it exceeds 1000 lines**; extract
+  along the nearest cohesive boundary instead of growing the file further."
+- `repo-07`: "**File length: 400 lines is a smell threshold, not a hard gate.**" Generated
+  `.mc` files are exempt, with a named exception for a 408-line template.
+- Several repos: no file-length rule stated at all.
+
+The two numbers are not in conflict — they measure different things. 400 is where a human
+should start asking questions; 1000 is where the file must already have been split.
+
+## Ruling
+
+Two tiers, both advisory in wording but checkable in `simt-dev check`:
+
+- **400 lines — review trigger.** Crossing it requires a stated reason to keep the file whole.
+- **1000 lines — hard ceiling.** `simt-dev check` fails. Extract along the nearest cohesive
+  boundary.
+- **Generated files are exempt**, declared per repo in `simt-dev.json`. The hook must name the
+  generator.
+
+Per-repo overrides are permitted via `limits.fileLines` in `simt-dev.json`.
+
+## Consequences
+
+- one repository' hard 1000 gate and garmin's soft 400 both survive unchanged in force.
+- The generated-file exemption that garmin had to state in prose becomes a declared property,
+  so the hook can honour it without hardcoding `.mc`.
+- `repo-14`'s pre-commit file-size check (currently inlined as 1000 lines of shell, and
+  duplicating `scripts/check-file-sizes.ts`) becomes one implementation in the shared
+  dispatcher.
+
+## Rejected
+
+- **One number org-wide.** Either it is too tight for legitimately long declarative files or
+  too loose to prompt a human at 400.
+- **No rule.** one repository' pre-commit check exists precisely because a rule was missing,
+  and it is now implemented twice.

simt_dev/vendored/docs/decisions/ADR-006-coverage-bar.md

@@ -0,0 +1,59 @@
+# ADR-006 — Evidence discipline is central; the numeric bar is per-repo
+
+Status: **accepted** · 2026-10-05 · affects all repos
+
+## Context
+
+The coverage bar is the one concept that is mutually incompatible *in kind* across the estate:
+
+| Repo | Bar |
+|---|---|
+| Repos with a declared numeric bar (outside this estate) | Quantitative. `fail_under = 100`, branch coverage, "a behavioural coverage gate, not a line-count scoreboard" |
+| `repo-07` | Quantitative, but a different quantity. Memory: 64 KB app / 24 KB Glance against a 32 KB ceiling, plus 12 named lint scripts |
+| `repo-14`, `repo-11`, `repo-13` | Qualitative. No number anywhere. Evidence discipline: named commands, 100 % pass, no unjustified skips, behavioural test delta |
+| `repo-04` | Neither. Three verification commands. |
+
+You cannot average these. 100 % line coverage is unreachable for Kotlin/Compose UI code and for
+Monkey C memory budgets; a memory ceiling is not a coverage proxy; "no number" is not a weaker
+version of 100 %, it is a different instrument.
+
+## Ruling
+
+**The central rule mandates evidence discipline. The numeric threshold is a declared,
+per-repo constant.**
+
+Central, mandatory, portable — for every repo regardless of stack:
+
+1. Name the exact commands and the exact test files.
+2. Those commands must exit 0 with **all** selected tests passing. Partial pass is a hard
+   blocker; "6/8 pass" is the canonical worked example of a blocked state.
+3. No test is skipped without a pre-existing written justification.
+4. Every executable change carries a test delta: new or extended test for new behaviour, a
+   regression test reproducing the failure mode for a bugfix, or a stated reason existing tests
+   fully prove the invariant.
+5. Never claim a test you did not run. Never cite a partial suite as evidence.
+6. Approval by budget never converts a known failure into an approval.
+
+Per-repo, declared in `simt-dev.json` under `limits`: the numeric gate, if any — coverage
+percentage, memory budget, size ceiling. The central rule specifies *how to declare it*, never
+the value.
+
+## Consequences
+
+- A repo that declares `coverage: 100` keeps it and its "untested paths are typed holes"
+  framing intact; the ruling constrains only what a new repo declares.
+- garmin declares its memory budgets in the same slot, and its "layer-conditional 5a–5m matrix"
+  becomes a declared gate list rather than 12 prose sentences.
+- The three social repos declare no number and keep their evidence discipline verbatim — which
+  is now shared rather than independently re-invented in each.
+- A new repo inherits a real policy from `simt-dev init` with no configuration, and can opt into a
+  number later without changing the rule.
+
+## Rejected
+
+- **Hard 100 % coverage org-wide.** Unreachable in Kotlin/Compose and meaningless for Monkey C;
+  would push repos to delete the rule rather than meet it.
+- **No number anywhere.** Leaves a genuinely strong gate unenforced org-wide and invites
+  every new repo to skip the question.
+- **One number for coverage and a separate slot for memory.** Two slots invite a repo to declare
+  only the one it likes.

simt_dev/vendored/docs/decisions/ADR-007-section-skeleton.md

@@ -0,0 +1,54 @@
+# ADR-007 — One canonical section skeleton
+
+Status: **accepted** · 2026-10-05 · affects all repos
+
+## Context
+
+Six `AGENTS.md` files use the same conceptual sections under three different headings:
+
+| File | Authority | Invariants |
+|---|---|---|
+| `repo-04`, `repo-13` | "Authority and Scope" | "Non-Negotiable Invariants" |
+| `repo-07`, `repo-14` | "Authority and scope" | "Non-negotiable invariants" |
+| `repo-11` | "Authority and **ownership**" | "Non-negotiable invariants" |
+
+At least one repo outside this estate uses a numbered 12-part layout with no equivalent
+sections at all.
+
+The deeper difference is in what "non-negotiable" means. Garmin's are **platform physics**
+("breaking any of these produces a product that is wrong, crashes, or cannot be shipped"); the
+Social pair's are **product and privacy policy**; api/media's are **data and schema
+invariants**. Those are three different kinds of claim wearing one heading, which is why the
+naming drifted — nobody could tell whether the sections were meant to align.
+
+## Ruling
+
+One canonical skeleton, sentence case:
+
+```
+## Authority and ownership
+## Non-negotiable invariants
+## Engineering conventions
+## Workflow and validation
+```
+
+Repos may add sections after these; they may not rename them. A repo that arrives with its
+own numbered layout keeps it during adoption and maps each part onto a canonical section in
+`simt-dev.json`, so both structures remain navigable while it migrates.
+
+Each invariant states **which kind of claim it is** — platform, policy, or data — so a reader
+knows immediately what breaking it costs and who may change it.
+
+## Consequences
+
+- Cross-repo reading becomes possible: section N means the same class of thing everywhere.
+- A future grep for "what are the invariants" returns a comparable list across all 16 repos.
+- "Ownership" is kept in the heading because `repo-11` earned it by being the only
+  file that enumerates ownership explicitly.
+
+## Rejected
+
+- **Standardise on Title Case** (`repo-04`'s variant). Capitalisation in headings is noise;
+  three repos already use sentence case.
+- **Normalise a differently-shaped layout immediately.** A mechanical conversion of 12
+  numbered parts would produce a worse document than a mapping.

simt_dev/vendored/docs/decisions/ADR-008-verdict-vocabulary.md

@@ -0,0 +1,59 @@
+# ADR-008 — One review verdict vocabulary: three values
+
+Status: **accepted** · 2026-10-05 · affects all repos
+
+## Context
+
+The estate has two incompatible verdict vocabularies.
+
+`.cursor/rules/test-gate.mdc` — used by all three one repository — allows one outcome:
+
+> Return `BLOCK` when: any test fails, is skipped without pre-existing justification, or is
+> unrun; the executable diff has no test delta without explicit justification; the coordinator
+> cites partial suite results or defers failing tests.
+
+`principal-milestone-reviewer.agent.md` — the final pre-commit gate — uses three:
+
+> `APPROVE` / `APPROVE WITH RESIDUAL RISK` / `BLOCK`
+
+With only two values, a reviewer who finds no blocker but did not finish has no honest answer
+and is pushed toward `APPROVE` by omission or toward `BLOCK` by exaggeration. With three, the
+budget mechanism works: "Use one focused pass, normally no more than 5 minutes or 8 targeted
+tool calls… If the budget is reached without a concrete blocker, stop and return `APPROVE WITH
+RESIDUAL RISK`. List what was not reviewed."
+
+The agent also re-embeds the `.mdc` text verbatim as its checklist item 1, so the vocabulary
+mismatch propagates from the rule into the gate.
+
+## Ruling
+
+Adopt the three-value vocabulary everywhere:
+
+| Verdict | Meaning |
+|---|---|
+| `BLOCK` | A concrete defect, missing mandatory gate, partial test pass, or missing test delta. Always paired with a file:line or command reference. |
+| `APPROVE WITH RESIDUAL RISK` | No blocker found within the review budget. **Must** list what was not reviewed. |
+| `APPROVE` | Fully reviewed, no blocker. |
+
+`APPROVE WITH RESIDUAL RISK` never converts a known failure into an approval — that constraint
+travels with the verdict, verbatim from the review agent.
+
+The `.mdc` files are updated to the three-value vocabulary. `BLOCK` remains the only value that
+stops work; the other two do not weaken the block conditions, which are stated identically in
+all three rules.
+
+## Consequences
+
+- A reviewer who runs out of budget has a correct answer, so the budget stops being a reason to
+  over-search.
+- Rule text and agent text stop diverging, because they now share a vocabulary and the agent no
+  longer has to paraphrase the rule.
+- Output format is uniform across the 15 agent files: severity-ordered findings, clickable
+  file:line references, a verdict, and — when not fully reviewed — the unreviewed list.
+
+## Rejected
+
+- **`BLOCK` only.** Loses the honest "I did not finish" answer and makes the strict review
+  budget unusable as written.
+- **Four values** (adding `NEEDS WORK`). Three already distinguishes blocked from
+  budget-limited; a fourth would be chosen on judgement and collapse back into two.

simt_dev/vendored/docs/decisions/ADR-009-skill-layout.md

@@ -0,0 +1,48 @@
+# ADR-009 — Skills are `<name>/SKILL.md` with mandatory frontmatter
+
+Status: **accepted** · 2026-10-05 · affects all repos
+
+## Context
+
+All 37 skill entries in the estate use `<name>/SKILL.md`. A wider audit that included repos
+now out of scope found exactly one entry that did not: a flat 7 266-byte file that also omitted
+the `name` frontmatter key. The layout ruling exists because that defect class is real, not
+because this estate still has it.
+
+Frontmatter field usage across the wider audit's 46 entries: `name` 45, `description` 46,
+`argument-hint` 14, `disable-model-invocation` 2, `references` 1, `compatibility` 1, and
+**`globs` zero**. No skill in any audited repo scopes itself by file pattern.
+
+That last point matters for discovery. A skill that could declare `globs: "migrations/**"`
+would let the resolver select it from the diff alone. Since none do, path-based resolution has
+to come from the graph registry instead — which is why `paths` lives in
+`graph/skills.graph.json` (plan 0002 §3.2) rather than in frontmatter.
+
+## Ruling
+
+- A skill is a directory `<name>/` containing `SKILL.md`.
+- `name` and `description` are **mandatory** in frontmatter.
+- `argument-hint` is recommended for any skill invoked by hand, and is optional otherwise —
+  repo-05's 7 skills omit it legitimately, since they are task-shaped rather than
+  user-invoked.
+- Body size and reference-file count are declared in `graph/skills.graph.json`, not in
+  frontmatter, so the registry stays the single source of truth for resolution metadata.
+
+The one flat file found in the wider audit was wrapped into `coverage-hunt/SKILL.md` with
+its `name` added. This estate has no such entry left to migrate.
+
+## Consequences
+
+- Every skill becomes addressable by one stable name across all 16 repos, which is a
+  precondition for `simt-dev skills find/show/install` and for `variant-of` edges.
+- The registry in `graph/skills.graph.json` becomes the one place resolution metadata lives,
+  instead of metadata split across frontmatter, prose and directory size.
+- `simt-dev skills eval` can key on skill names, because every skill has one.
+
+## Rejected
+
+- **Require `globs` in frontmatter.** Attractive, but it would put resolution metadata in two
+  places and drift from the graph — the exact failure mode that produced the 8 divergent
+  `.mdc` files. Recorded as considered and rejected.
+- **Keep flat `.md` as an accepted form.** Two layouts means two resolver paths and two sets of
+  conventions to police.

simt_dev/vendored/docs/decisions/ADR-010-runner-invocation.md

@@ -0,0 +1,56 @@
+# ADR-010 — Invoke tools through the repo's own runner, never a package runner
+
+Status: **accepted** · 2026-10-05 · affects all repos
+
+## Context
+
+Four repos independently arrived at the same rule, in two ecosystems, with the same rationale.
+
+- `repo-14` / `repo-11`: "Run tests and quality checks through repository `npm run
+  ...` scripts… **Do not invoke local package binaries through `npx` or `npm exec`** unless no
+  repository script supports the required operation."
+- A Python repo outside this estate, in the same form: "**Do not use `uv run pytest`**; the
+  console entrypoint can miss the `uv` import path and fail to import dependencies." Its
+  contributor guide states the same rule with a stronger failure description: it "can
+  **silently** run against the wrong environment."
+
+The failure mode is identical: a package runner resolves a binary outside the project's
+configured environment, so the tool runs, the import path is wrong, and the result is either an
+obvious import error or — worse — a pass against the wrong interpreter.
+
+Note the severity disagreement on that last point: "fail to import" versus "silently run
+against the wrong environment." The second is far worse and is treated as canonical below.
+
+## Ruling
+
+Invoke tools through the repository's own declared runner, in every ecosystem:
+
+- Node: `npm run <script>`. Never `npx` or `npm exec` for a binary that is a declared
+  dependency.
+- Python: the module form, `uv run -m pytest`, or the repo's own wrapper. Never the bare
+  console entrypoint.
+- Gradle: `./gradlew`, never a system `gradle`.
+- Any other ecosystem: the repo's declared entrypoint, never a bare global binary.
+
+**Read the actual runner manifest before running anything.** A command that does not exist in
+`package.json` is not a command. This is stated because it is the other half of the failure:
+guessing a script name is how an agent concludes a check "passed" when it never ran.
+
+Exception: a tool that is genuinely not a project dependency (a one-off inspector, a global
+formatter) may be invoked directly, provided its version is pinned.
+
+## Consequences
+
+- The estates' two ecosystems converge on one rule, so an agent moving between a Python repo
+  and a TypeScript repo does not have to learn the rule twice.
+- The stronger failure description is canonical: silently running against the wrong environment
+  is worse than failing, and the rule exists to prevent it.
+- Repos with no declared scripts get them from the tooling baseline (plan 0001 §3.1), so this
+  ruling is always actionable.
+
+## Rejected
+
+- **Adopt only the npm half.** Leaves the identical failure unguarded in Python, Gradle and
+  every future ecosystem.
+- **Permit `npx` for convenience.** `npx` will fetch a package that is not the project's
+  version, which reintroduces exactly the environment drift the rule prevents.

simt_dev/vendored/docs/decisions/ADR-011-windows-support.md

@@ -0,0 +1,52 @@
+# ADR-011 — Windows is supported from v1
+
+Status: **superseded by [ADR-012](ADR-012-drop-windows-support.md)** · 2026-10-05
+Affects: the `simt-dev` CLI
+
+> Superseded the same day. The cost table below is retained because it is what ADR-012's
+> reasoning turns on: three of the five obligations are permanent tax on the hook dispatcher
+> and the projection injector, not one-off work. See ADR-012 for the weighing.
+
+## Context
+
+No Windows developer currently appears in the estate, and the cheap alternative was
+`"os": ["darwin", "linux"]` in `package.json`, which makes npm refuse to install on Windows
+with a clear message instead of failing obscurely inside a git hook.
+
+That option was put to you and declined in favour of full v1 support.
+
+The cost is real and is recorded here so it is paid deliberately rather than discovered:
+
+| Obligation | Why |
+|---|---|
+| Hook scripts must not assume POSIX | `core.hooksPath` hooks run under Git for Windows' bundled sh, which does exist — but the dispatcher cannot assume a POSIX `#!/bin/sh` shebang alone is sufficient. Hook entrypoints are `.cmd`-aware or invoked through `node` explicitly. |
+| The projection injector must normalise line endings | The audit found **10 of 16 repos have no `.editorconfig`**, so a generated region written with the host's EOL would produce a whole-file diff on Windows checkouts. The injector writes the canonical EOL from `.gitattributes` (`* text=auto eol=lf`), defaulting to LF. |
+| Path handling must not assume `/` | Resolver globs, `paths` matching and every emitted file reference must normalise separators. |
+| npm bin shim | The published package must rely on npm's generated shim rather than a hand-written launcher. |
+| CI must actually run it | A macOS-only CI run cannot verify a Windows claim. GitHub Actions gains a `windows-latest` job for the CLI itself — not for the repos it serves, which stay macOS/Linux as their own tooling dictates. |
+
+## Ruling
+
+Windows is a supported v1 platform for the `simt-dev` CLI itself. `package.json` declares no
+`os` restriction, and CI verifies on `windows-latest`.
+
+Scope is deliberately limited: this covers the CLI running *on* Windows. It does not imply that
+any repo's own toolchain is Windows-ready — Python packaging, Monkey C, and Android Gradle
+builds are governed by their own repos.
+
+## Consequences
+
+- The shared hook dispatcher ships with a Windows-safe entrypoint from day one. Retrofitting
+  this after 16 repos have installed the dispatcher is far more expensive than building it now.
+- The EOL normalisation in the projection injector becomes a correctness requirement rather
+  than a nicety — which is worth doing regardless, given 10 repos lack `.editorconfig`.
+- `windows-latest` CI costs minutes per run and buys an install story that does not break on the
+  first non-Mac contributor.
+
+## Rejected
+
+- **`os: ["darwin", "linux"]`.** Cheapest, and a defensible engineering call on estate
+  evidence — declined because the hook dispatcher's Windows-safety is substantially harder to
+  retrofit across 16 installed repos than to build.
+- **Windows via WSL only.** Avoids the native path work but leaves a Windows contributor
+  needing a Linux environment, which is the failure this ruling exists to prevent.

simt_dev/vendored/docs/decisions/ADR-012-drop-windows-support.md

@@ -0,0 +1,59 @@
+# ADR-012 — Windows support is dropped; POSIX only
+
+Status: **accepted** · 2026-10-05 · supersedes [ADR-011](ADR-011-windows-support.md)
+Affects: the `simt-dev` CLI
+
+## Context
+
+ADR-011 committed to supporting Windows in the CLI from v1, against the recommendation to
+declare `"os": ["darwin", "linux"]` and let npm refuse the install elsewhere. The reasoning
+for that decision was sound but the weighing was wrong.
+
+ADR-011's own cost table listed five obligations, three of which are permanent tax on
+every future change to the hook dispatcher and the projection injector rather than one-off
+work:
+
+1. Hook entrypoints must be `.cmd`-aware instead of relying on a POSIX shebang.
+2. The projection injector must normalise line endings on every write.
+3. Glob matching and every emitted path reference must normalise separators.
+4. npm's generated bin shim must be relied on rather than a hand-written launcher.
+5. CI must carry a permanent `windows-latest` job.
+
+Against that: **no Windows developer appears anywhere in the repos**, and no repo's own
+toolchain is Windows-ready either — `repo-07` drives the Monkey C toolchain, and
+`repo-05`/`repo-03`/`repo-01` drive Gradle and Android tooling. So the CLI would have been the
+*only* Windows-ready artefact in the estate, serving nobody.
+
+The deciding argument is not the cost, it is the shape: obligations 1–3 are correctness
+constraints that every contributor must keep satisfying forever. Adopting them to serve a
+population of zero is how a codebase accumulates permanent complexity nobody can evaluate.
+
+## Ruling
+
+**POSIX only: macOS and Linux.** `package.json` declares `"os": ["darwin", "linux"]`, so npm
+refuses to install on Windows with a clear message instead of failing obscurely inside a git
+hook. CI verifies on `macos-latest` and `ubuntu-latest` only.
+
+The code obligations of ADR-011 are withdrawn, with one exception that stands on its own
+merits rather than on Windows: **the projection injector still normalises line endings to the
+canonical EOL.** 10 of 16 repos have no `.editorconfig`, so a generated region written with
+whatever the host produced would cause whole-file diffs on checkouts whose
+`core.autocrlf` differs. That is a cross-platform problem among POSIX hosts and has nothing
+to do with Windows.
+
+## Consequences
+
+- `bin/simt-dev.mjs` keeps its shebang as a plain POSIX entrypoint; no `.cmd` shim handling.
+- Glob matching and emitted paths assume `/`. The existing forward-slash normalisation in
+  `fingerprint.mjs` is retained as cheap insurance, not as a Windows requirement.
+- The permanent `windows-latest` CI job is not added.
+- Revisit only when a Windows developer joins the estate — at which point the deciding
+  argument is gone and the cost table in ADR-011 becomes the deciding one.
+
+## Rejected
+
+- **Keeping Windows v1 (ADR-011).** Permanent correctness constraints in the dispatcher and
+  injector, serving zero users, in the only part of the estate that would have been
+  Windows-ready.
+- **Deferring rather than dropping.** A deferred platform is an unbounded promise; the
+  obligations would still shape the code.