simt-dev 0.2.0__py3-none-any.whl

simt_dev/vendored/docs/decisions/ADR-044-compatibility-is-not-evidence.md

@@ -0,0 +1,116 @@
+# ADR-044 — Compatibility is not evidence, and a resolver nobody measured is merely felt
+
+Status: **accepted** · 2026-10-08 · affects what `skills brief` and `skills find` return
+
+## Context
+
+Review 0001 §S04, marked P1, reproduced exactly through the shipped binary. Two facts, both
+measured in a Workers fixture before anything was changed:
+
+- `skills brief --task "fix d1 migration"` resolved 29 914 bytes against a 20 480-byte budget and
+  reported `(budget capped)`. The tail was `complete-testing` and `slice-commit`, selected on
+  `stack:node+cloudflare-workers` alone.
+- `skills brief --task "fix a typo in the README"` resolved four skills, every one of them on
+  `summary:the` or `summary:in`, and filled the budget with bodies about launch galaxies.
+
+The mechanism is one line. Stack overlap is 15 a tag, any score above zero selects, and the stack
+gate already ran. Compatibility is a **precondition**, so a score made of nothing but compatibility is
+not a weak match — it is no match, reported as one. Meanwhile `summary` is weight 8 and clears a
+threshold of zero, so a word of shared English was enough to select anything.
+
+The review asked for three things: make stack a tiebreaker, add a stopword list with a minimum score
+of 25, and add a gold corpus. It also noted that plan 0002 §11 step 5 claims an `eval` corpus
+"passes" and is marked **done**. There is no `skills eval` command and there was no corpus. Every
+ranking change in this repository had been argued from examples.
+
+## Ruling
+
+**One.** A score may select only with evidence. `scoreSkill` returns `evidence` — the score without
+its stack contribution — and the threshold is applied to that, never to the total. Both halves matter:
+stack is 15 a tag, so a repo matching three of a skill's tags is 45 on its own, and a threshold that
+counted stack would wave it through.
+
+**Two.** `MIN_SCORE` is `W.capability`, 25. Below it the only available signals are `summary` at 8 and
+`stack` at 15, and neither is a statement about the task. "Only a capability-strength signal or better
+selects" is the rule the review states and the number it gives.
+
+**Three.** Stopwords are suppressed in the summary signal only. A keyword is an explicit declaration
+and a name is an identity, so hiding those would suppress something a person wrote on purpose; a
+summary is prose, and prose carries words that are there for grammar. `do not push` is a declared
+keyword and stays reachable.
+
+**Four.** The rejection says why. `NOT SELECTED` is the block an agent uses to override, so a
+rejection that cannot be acted on is the same defect as a bad selection.
+
+**Five.** One place decides, and three commands call it: `rankSkills`, `skills find`, and the MCP
+`skills_find` tool. They each ranked on `score > 0` independently, and an assertion that one of them
+kept that rule would have passed the entire suite — see the fourth mutation below.
+
+## Consequences
+
+The two acceptance cases in review 0001 §S04 now hold, and both are asserted against the shipped
+binary: `fix d1 migration` selects `d1-safe-change` and not `api-contract-sync`, and a task of
+stopwords resolves nothing and says why. The budget no longer caps on either.
+
+The gold corpus is `test/fixtures/eval-corpus.json`, ten cases across four ecosystems, run by
+`test/eval.test.mjs`. It states `select` (must return) and `reject` (must not), and asserts that
+every skill it names still exists in the registry — a corpus citing a renamed skill otherwise passes
+by comparing two lists that no longer overlap.
+
+Five mutations, each reverted, each caught by the test that claims it:
+
+| Mutation | Caught by |
+| --- | --- |
+| the minimum score dropped | two corpus cases, the weak-signal test, and the shipped-binary test |
+| stack counted toward the threshold again | two corpus cases and the weak-signal test |
+| stopwords not applied to the summary signal | both stopword tests |
+| `skills find` reverted to `score > 0` | **nothing** — see below |
+| the stopword list emptied | both stopword tests |
+
+The fourth is the one worth keeping. Reverting `skills find` to its own weaker rule passed all 621
+tests at the time, because it was the third command to be moved and no test covered the third. It is
+ADR-035's lesson exactly: a promise about a set of commands is only true while something checks the
+set. The test that now catches it queries `secrets`, chosen because that word lands strictly between
+0 and `MIN_SCORE` for exactly one skill (`wrangler`, at 8 via its summary), so the two rules give
+visibly different answers — 3 matches against 4.
+
+The first version of the precision metric was also wrong and was caught by the corpus itself. It
+scored precision against `select + reject`, so a case where the resolver selected a skill neither
+list named scored a perfect 1.0. That is not precision, it is agreement with whatever was written
+down. Precision is now measured two ways and both must hold: every named negative stays unselected,
+and every case whose answer is "nothing" returns nothing at all.
+
+### What the corpus found that the review did not predict
+
+The `regenerate the openapi contract` case failed on the first run, against my own expectation: I had
+written that `web-feature-slice` and `api-feature-slice` should not be selected. The resolver was
+right and the corpus was wrong. `web-feature-slice` and `add-country-galaxy` both declare capability
+`contract`, and `api-feature-slice` declares keyword `openapi` — so each carries a capability-strength
+signal, which is exactly what ruling two admits. A hand-authored gold set is an opinion written down,
+and this one had been written without checking the registry.
+
+That leaves a real question this record does not answer: whether `contract` is the right capability
+for a skill that registers a country. Changing `graph/skills.graph.json` changes
+`provenanceDigest()`, which stamps every consumer repository, so the answer is not a question this
+slice may decide by editing one line of data.
+
+## Rejected
+
+**Making the minimum score a `--min-score` flag.** It would let a user recover the old behaviour and
+it would put the default in a place nobody reads. The old behaviour is not a preference some
+repositories want; it is the reason `NOT SELECTED` was empty and the budget was full of bodies.
+
+**Thresholding on the total score instead of on evidence.** Simpler, and wrong: it fails for exactly
+the repos this tool serves. A repo matching three tags is the common case, not the edge.
+
+**Removing the stack signal from the score entirely.** It orders candidates, which is a tiebreaker's
+job, and removing it would make two equally-evidenced skills order by name alone.
+
+**Putting the corpus under `graph/`, beside the registry.** `provenanceDigest()` walks `rules/` and
+`graph/`, so a corpus file there changes the content digest and forces every consumer repository to
+be restamped. A test corpus is not worth a migration, and the digest would move invisibly.
+
+**Building the `skills eval` command this record could have built.** Plan 0002 §9 lists it. It is a
+new product surface with its own flags, JSON contract and help text, and its absence is a defect in
+the plan rather than in the tool. The corpus and the runner are what S04 asked for; the command is
+recorded below as still owed.

simt_dev/vendored/docs/decisions/ADR-045-a-dashboard-that-counts-a-defect.md

@@ -0,0 +1,119 @@
+# ADR-045 — A dashboard that counts a defect and will not name it is worse than one that does not count it
+
+Status: **accepted** · 2026-10-08 · amends ADR-016 · affects what `compare` reports and exits on
+
+## Context
+
+Review 0002 §S25, marked P1, reported two defects in one row. Both measured against the estate
+before anything was changed, and both confirmed exactly as written.
+
+**One.** `src/compare/row.mjs` gated the stale-rule-file problem on `row.adoption === 'adopted'`.
+`adoption` was initialised at line 78 and only assigned at lines 127–131, so the gate ran before
+anything settled it and compared against the initialiser's `'unmanaged'`. It could never fire.
+
+Measured over the 16 repositories at `~/code/simt`:
+
+```
+staleRuleFiles: 17
+repos naming stale rule files in problems: 0
+repo-05 problems:
+  "the generated region was hand-edited; restore it with: simt-dev sync --yes"
+  "core.hooksPath is \"hooks\", not the shared dispatcher; run: simt-dev hooks install --yes"
+```
+
+Five adopted repositories have stale rule files — `repo-05`, `repo-06` and `repo-14` at 0
+of 3 current, `repo-11` and `repo-13` at 0 of 4 — and not one of them said so in
+its problems list. The summary already said `staleRuleFiles: 17`, because `summarise` has always
+counted them. So the dashboard was reporting a count of a defect it refused to call a defect.
+
+**Two.** `profiles` was documented at `row.mjs:33` as "profile ids that would be selected",
+initialised to `[]` at line 83, and never assigned anywhere in the file's life. Every row of every
+run reported no profiles. `plan()` — the thing `sync` renders — returns them.
+
+## Ruling
+
+**One.** A row's problems list names every stale rule file, and the exit code follows. The gate
+reads `adoption` after it is settled, which means the ordering is part of the contract: **a gate
+that reads a field the line above has not set yet is not a gate.** That sentence is the whole fix.
+
+**Two.** The gate stays. A repo that has never been adopted has its own files, and reporting them
+as "not current" turns the normal mid-migration state into a red estate — ADR-018's reasoning for
+hooks, applied here to rule files. There is a test for the negative half specifically, because
+fixing the gate is exactly the kind of change that turns this on.
+
+**Three.** `profiles` is filled from the same `select()` call, on the same inputs, that
+`desiredRegion` makes. Not from a copy of the rule table and not from the manifest's declared
+stack: a dashboard that disagrees with the tool about what it would write is worse than one that
+says nothing, because it is believed.
+
+**Four.** A field documented as an answer must be either answered or absent. `profiles` was neither:
+it was present, empty, and described as populated in the type it was documented with.
+
+## Consequences
+
+The estate now names all 17: five repositories carry the problem line, and `compare` exits non-zero
+on them. Nothing else about the detection changed — the count was 17 before the fix and is 17 after
+it. This slice changed reporting, not measurement, and the test asserts that by requiring the
+fixture to start current before the edit.
+
+### The ruling this amends
+
+ADR-016 ruled that "`compare` continues to report one row per repo using `AGENTS.md` only, because a
+dashboard row cannot represent four files. The gate uses the full finding list, so the dashboard's
+coarser view is not inherited by the thing that must not be wrong."
+
+That ruling is about the row's **shape** — which files it displays — and it still holds. The row
+already carried `ruleFiles.total`, `ruleFiles.current` and `ruleFiles.stale` before this change, so
+ADR-016's coarser display was never the problem.
+
+What was missing is that ADR-016 reasoned about the *display* and the *problems list* together, and
+they came apart. The dashboard was allowed to be coarse about which files it shows, and it was also
+allowed to be silent about whether an agent reading them would get correct rules. Those are
+different permissions, and only the first was granted on purpose. The problems list is not a
+display; it is the exit code.
+
+So: ADR-016 is amended, not overruled. The row stays coarse; the problems list does not.
+
+### Three mutations, each caught by exactly its own test
+
+| Mutation | Caught by |
+| --- | --- |
+| the stale-rule-file gate cannot fire | `a stale rule file on an adopted repo is a problem` |
+| `profiles` back to its initialiser | `compare reports the profiles sync would project` |
+| `profiles` computed from the declared stack instead of the detected one | `compare reports the profiles sync would project` |
+
+The third is the one that matters. It is the shape this defect actually takes when it recurs: not an
+empty array but a plausible array computed from the wrong input. A test asserting a hardcoded
+expected list would have caught the second mutation and passed the third; asserting
+`row.profiles` equals `plan(root).profiles` catches both, because it is the relationship rather
+than the value that is the contract.
+
+### A fixture that asserted nothing
+
+The first version of the stale-file test appended a line after the `END` marker. That is hand-owned
+content by design — the containment guarantee another test in the same file already asserts — so the
+file was correctly not stale and the test failed. The fixture was making an edit the test claimed
+wasn't being made. It now edits inside the region and asserts that the edit landed by checking the
+recorded SHA marker is present first.
+
+A first attempt at the mutation was also too coarse: re-deriving `adoption` in the wrong place broke
+ten tests at once, which told me the ordering is load-bearing but not which gate depended on it. The
+isolated mutation is `if (false && …)` on the one gate.
+
+## Rejected
+
+**Reporting per-file drift in the row's display, so the dashboard shows all four files.** ADR-016
+already rejected this and its reason has not changed. A row is read across sixteen repositories at
+once; four filenames per row is noise at that scale.
+
+**Making `compare` defer entirely to `check` and drop the problems list.** The dashboard is the thing
+a reader runs when they want to know where the estate stands; a command that says "run the other one"
+has moved the problem rather than answered it.
+
+**Exiting non-zero on an unmanaged repo's stray rule files.** The gate exists for the reason in
+ruling two, and there is a test that asserts the negative so the fix cannot quietly widen it.
+
+**Filling `profiles` from the manifest's declared stack.** It is cheaper and it is wrong: the
+manifest is a declaration, `fingerprint` is a measurement, and `sync` selects on the measurement.
+A dashboard reporting the declaration would be consistent with itself and inconsistent with the
+tool. Mutation three is what that looks like when it happens.

simt_dev/vendored/docs/decisions/ADR-046-one-rule-one-copy.md

@@ -0,0 +1,140 @@
+# ADR-046 — One rule, one copy: a reader that reads AGENTS.md must not also get the file
+
+Status: **accepted** · 2026-10-08 · supersedes ADR-021 ruling 3 · settles P7's context-budget question
+
+## Context
+
+Only ADR-021 **ruling 3** is superseded. Its other rulings — one surface per repo, a pointer is not
+a copy, a written file is not removed, skills follow the same rule — stand, and ruling 6 is load
+bearing *here*. So the status line deliberately does not name it in the form the index parses
+(`supersedes [ADR-NNN]`): marking the whole record superseded would be false, exactly as it would
+be for a narrowing.
+
+Review 0001 §S12, marked P1 and "decision". Measured across the estate before anything changed —
+the five repositories selecting `opencode,cursor`:
+
+```
+repo-05           folded=3  .mdc=3  0/3 current
+repo-06          folded=3  .mdc=3  0/3 current
+repo-14        folded=3  .mdc=3  0/3 current
+repo-11    folded=4  .mdc=4  0/4 current
+repo-13  folded=4  .mdc=4  0/4 current
+```
+
+Seventeen generated rule files. Every one of them byte-identical to the section already folded into
+the same repository's `AGENTS.md`, verified by extracting both bodies and diffing: the only
+difference was a trailing marker line in my first extraction, and the second extraction made 14 of
+the 17 identical and the remaining three identical apart from that marker. **28,101 bytes of context
+loaded twice per session**, in five repositories, forever.
+
+ADR-021 ruling 3 decided this deliberately: "Folding is `some`, not `all`: a repo that also opts into
+Cursor still folds, because an opencode reader's only channel is `AGENTS.md` **and a Cursor reader
+getting `.mdc` files does not serve them**."
+
+The bolded clause is the whole dispute, and it is a factual claim about a vendor. It is false.
+Cursor's own documentation says `AGENTS.md` is "a simple markdown file for defining agent
+instructions... an alternative to `.cursor/rules`", and that "Cursor supports AGENTS.md in the
+project root and subdirectories." Cursor reads `AGENTS.md`.
+
+Note where the original claim came from: the `readers` string on **simt-dev's own opencode row**
+already said "AGENTS.md is also read natively by Codex, Cursor, Windsurf, Zed, Amp, Jules, Copilot
+CLI and the DeepSeek harness". The table knew. The decision that depended on the fact was written
+without checking the table, which is the shape of error this repository keeps having.
+
+## Ruling
+
+**One.** A surface declares `readsPrimary: true` when its own vendor documents that its reader loads
+`AGENTS.md`. When any selected surface folds, `ruleTargets` skips per-rule files for those surfaces
+and says so in the plan: the note names the file and the reason.
+
+**Two.** It is per-surface, not global, because Copilot is the counter-example and the row says so
+already: its CLI reads `AGENTS.md`; its editor and code review do not. A per-rule file there is the
+only channel two of its three readers have, and dropping it would remove the process rules from a
+chat that had nowhere else to get them.
+
+**Three.** The skip depends on folding. With no folding surface selected there is no region to
+duplicate, so a repo on `cursor` alone still gets its files — asserted, because a flag that reads
+as "cursor never gets files" would be a different and much larger change.
+
+**Four.** `sync` never deletes a file it wrote (ADR-021 ruling 6), so a file that becomes orphaned
+cannot be repaired by any command. It is therefore a **note with a remedy, never a problem**, and it
+never fails the gate. A gate nothing can satisfy is worse than a gate that is merely noisy.
+
+**Five.** The tool must not stop looking at it. `orphanedRuleFiles` scans the rule directories of
+every `readsPrimary` surface — **whether or not the repo still selects it** — for files carrying a
+simt-dev region, and reports them. A file without the marker is hand-owned and is never mentioned.
+
+## Consequences
+
+`sync --surfaces opencode,cursor` now writes `AGENTS.md` and no `.cursor/rules/*.mdc`. The three
+always-on rules still arrive, folded, and the plan says why each file was not written.
+
+The estate reports all 17 as notes with a delete command. Nothing was deleted: removal is a human
+decision with a visible diff, and this record does not authorise a tool to make it.
+
+### The invisibility that ruling five exists to prevent
+
+The skip landed first and the estate run showed `staleRuleFiles` go from **17 to 0**. Every one of
+those files was still on disk. A tool that stops looking at a file it generated has not cleaned up —
+it has lost track of it — and the symptom is a dashboard reporting a clean estate while seventeen
+files are being read twice.
+
+The first version of the scan then made the same mistake in a subtler form: it iterated the
+*selected* surfaces. A file becomes orphaned precisely when a repo **drops** the surface that wrote
+it, so scanning the selected set finds nothing at all — the one repo that needs the note is the one
+that dropped the surface. Both defects were found by running the command against the estate, not by
+reading the code. The estate run is worth more than either unit test.
+
+### Six mutations, three of which caught nothing at first
+
+| Mutation | Caught by |
+| --- | --- |
+| the skip never fires | `opting into a rule surface ... writes one file, not two` |
+| `readsPrimary` applied without the folding condition | three tests, including `cursor alone still gets its own files` |
+| the orphan scan deleted | **nothing** — found, then fixed |
+| `orphaned` made blocking | **nothing** — found, then fixed |
+| `orphaned` counted as a stale problem | **nothing** — found, then fixed |
+| orphan scan restricted to selected surfaces | `compare reports an orphaned rule file as a note` |
+
+The middle three passed all 627 tests, which is worth recording plainly: the half of this slice with
+the most dangerous failure mode — a gate nothing can satisfy — shipped with no test at all, and only
+a deliberate mutation found it. Four tests were written afterwards, including a negative control
+("a repo's own rule files are never reported as orphaned"), because a scan that always returned an
+empty array satisfies every positive test in the file.
+
+### Two tests that encoded the old ruling
+
+`test/surfaces.test.mjs` asserted the three `.mdc` files beside the folded region, with the comment
+"One canonical source, two destinations" — a fair description of the behaviour, and the behaviour
+was wrong. `test/upgrade.test.mjs` used `--surfaces opencode,cursor` to produce the generated file
+whose wholesale repair it tests. Both now use **copilot**, whose reader does not read the primary, so
+the properties under test are unchanged while their fixtures remain honest. A test fixture built on
+a behaviour a new ADR reverses has to be moved deliberately, and the reason recorded, or the next
+reader moves it back.
+
+`test/compare.test.mjs`'s S25 fixture also moved to copilot for the same reason — and its helper
+selected rule files by the `.mdc` suffix, which silently matched nothing and reported "the fixture
+must project at least one rule file" rather than "the fixture is broken".
+
+## Rejected
+
+**Deleting the orphaned files automatically.** ADR-021 ruling 6, and the reason is sound: `sync` is a
+projection, and a projection that deletes is a second, silent writer. The file is reported with the
+command that removes it.
+
+**Making `readsPrimary` global.** It would drop Copilot's only channel for its editor and code
+review. The flag is per-surface for that reason and the Copilot row carries the note that says why.
+
+**Keeping the `.mdc` files and not folding into the region when both surfaces are selected** — the
+alternative review 0001 named. It gives opencode users nothing in mixed repos, which is ADR-021's
+original objection to one surface per repo and still true.
+
+**Removing Cursor support entirely, on the grounds that it reads `AGENTS.md`.** That would be true
+and would lose the `.mdc` channel for anyone whose Cursor does not surface `AGENTS.md`, and it would
+make a narrowing into a removal — which is not this tool's habit. The rules still reach a Cursor
+reader; they just reach them once.
+
+**The worktree-agent caveat becoming a gate.** A Cursor bug report records `AGENTS.md` not being read
+in worktree agents by default, fixed in 3.9. That is a fact about a product and it is recorded on
+the row, but gating on a version number would make a rule's presence depend on a vendor's release
+cadence — and the alternative for those readers is a duplicated 5 KB, which is the cheaper error.

simt_dev/vendored/docs/decisions/ADR-047-a-profile-selects-on-what-a-repository-runs-on.md

@@ -0,0 +1,141 @@
+# ADR-047 — A profile selects on what a repository runs on, not on what it is written in
+
+Status: **accepted** · 2026-10-09 · refines ADR-013 ruling 1
+
+## Context
+
+Review 0002 §S28, P1, marked "decision" (proposal P3). Four profiles selected on a language or a
+build tool while their bodies advised on a platform. Measured across the estate before anything
+changed — the review's four rows, plus two smaller defects in the same table:
+
+| Repo shape | Profile it received | Why that is wrong |
+| --- | --- | --- |
+| any TypeScript library | `cloudflare-workers` (D1, Durable Objects, wrangler) | applied on `typescript` |
+| Spring or Ktor backend on Gradle | `jvm-android` (Compose, Wear OS, overlay policy) | applied on `gradle`, `kotlin` |
+| React Native / Expo app | `react-web` (CSS logical properties, WCAG reflow, a browser matrix) | applied on `react`, and `DEP_TAGS` mapped `react` and `react-dom` to the same tag |
+| Poetry project | a `python` body that says `uv run -m`, `uv.lock` | the body was uv-specific, the selection was any Python marker |
+
+Two smaller ones in the same table: `hono` also keyed `cloudflare-workers`, and Hono runs on
+Node, Bun and Deno as happily as on Workers — a library tag read as platform evidence. And
+`wrangler.json` was missing from `MARKERS`, so a Worker configured with the plain JSON file and
+no `wrangler` dependency had no evidence of being a Worker at all.
+
+ADR-013 ruling 1 made platform tags and facts interchangeable in `applies`, and its consequences
+promised that "every tag a profile may name is one the engine emits" would hold for facts too,
+with "the registry validator and the profile loader share one derived vocabulary so they cannot
+desynchronise." Half of that was implemented: `graph lint` checked a skill's `stack` array
+against the vocabulary, and nothing checked a profile's `applies`. The four rows above are what
+that half produced — not a typo, but selections the vocabulary permitted and no check objected to.
+
+## Ruling
+
+**One.** A profile's `applies` names the evidence of what its body advises on. Where platform
+evidence exists, a bare language or build-tool tag is not that evidence:
+
+| Profile | Before | After | What selects it |
+| --- | --- | --- | --- |
+| `cloudflare-workers` | `cloudflare-workers, hono, typescript` | `cloudflare-workers` | a wrangler config or the `wrangler` dependency |
+| `jvm-android`, split into `jvm` | `gradle, kotlin, wear-os` | `jvm`: `gradle, has-maven-pom, kotlin, java` | a JVM build |
+| `jvm-android`, split into `android` | (the same file) | `android`: `has-android-manifest` | a module with an `AndroidManifest.xml` |
+| `react-web` | `react, react-router, maplibre, firebase` | `react-dom, react-router, maplibre, firebase` | the browser renderer |
+| `react-native`, new | — | `react-native` | a `react-native` or `expo` dependency |
+| `python`, split into `python` and `uv` | `python` (with a uv-specific body) | `python`: `python`; `uv`: `has-uv-lock` | the language / the lockfile |
+
+The exception is where a language *is* the finest fact available: `python`'s body advises
+invocation hygiene that holds in every Python repository, so the `python` marker is the right
+key there. The test that separates those two cases is the pair of rows whose shared stack is
+exactly `node, react` and which differ only by the renderer tag: one receives `react-web`, the
+other `react-native`, and neither receives both.
+
+**Two.** The Android and uv facts name a path at an unknown depth, which the two existing kinds
+(`file`, `dir`) cannot express. A third kind, `glob`, walks at most `GLOB_DEPTH` directory levels
+below the root. The bound is a convention, not a preference: the Android Gradle Plugin puts a
+module's manifest at `<module>/src/main/AndroidManifest.xml`, and repo-05's sits at
+`app/src/main/AndroidManifest.xml`. A shallower bound makes `has-android-manifest` the shape S07
+found — a fact no repository could have. A deeper one is a scan rather than a probe, and
+ADR-013's promise is that adding an ecosystem is data, so a fact must not cost a search.
+
+The walk skips dot-directories and `node_modules` for the reason the extension sample skips them;
+the matcher is the registry's `matchesGlob` (ADR-042), so a fact's shape and a skill's `path:`
+are one language rather than two; and the evidence for a `glob` fact is the matched path, never
+the pattern — `doctor` answers "why did you think that?", and a shape is not an answer.
+
+**Three.** `wrangler.json` and `wrangler.jsonc` join the Workers markers beside `wrangler.toml`.
+
+**Four.** The vocabulary check now covers profiles as well as skills. `describeDefect` rejects a
+`simt-applies` entry that `fingerprint()` cannot emit — `simt-applies names "pyton", which
+fingerprint() never emits, so this profile could never be selected` — for central and local
+profiles alike. A tag the engine cannot emit is a profile that can never be selected, and the
+defect lives in the file that names it, not in whatever repository happens to load it. This is
+the half of ADR-013's shared-vocabulary consequence that was unimplemented, and it is what makes
+ruling one enforceable rather than aspirational: a future profile that re-keys on a language tag
+spelling no detector emits fails at load time, in the file's own defect list.
+
+## Consequences
+
+`compare` over the estate before and after — 16 repositories, **4 move, 12 unchanged**, and no
+repository loses coverage:
+
+| Repo | Before | After |
+| --- | --- | --- |
+| `repo-01`, `repo-05`, `repo-03` | `core, jvm-android` | `core, android, jvm` |
+| `repo-02` | `container, core, python` | `container, core, python, uv` |
+
+The three Android repositories gain the profile whose body they actually needed and keep the JVM
+build rules; `repo-05` gaining `android` was the row's acceptance criterion. `repo-02`
+carries a committed `uv.lock`, so its gain is the defect repaired, not a new selection.
+
+The rename is breaking in one narrow way: the id `jvm-android` no longer exists. A consumer that
+pinned it — a manifest's `profiles` array, a local profile shadowing by id, a document that names
+it — must rename to `jvm` and `android`. Nothing in the estate pinned it, which is why the table
+above is complete; a consumer outside it learns from this record.
+
+The provenance digest moves `47160e9e…` to `0cfea39f…` because files under `rules/stacks/` were
+added and removed. Every adopted repository re-stamps on its next `sync` or `upgrade`.
+
+The fixture table in `test/genericity.test.mjs` asserts each row's `stack` **and** its exact
+profile set, in order — `core` first because it applies always, the rest in profile-file read
+order. Asserting the set alone would still pass if a fixture stopped being the thing its row
+claims (a "TypeScript library" that is no longer TypeScript), which is the weaker claim a
+mutation produces. The hand-maintained `PROFILES` list in `test/shipped.test.mjs` is deleted:
+S28's rename broke it, and it guarded nothing — the leak check already iterates `loadRules()`.
+
+Seven mutations, all caught:
+
+| Mutation | Caught by |
+| --- | --- |
+| `react-web` re-keyed on `react-dom, react` | the exact-set row test |
+| the `glob` probe reduced to a root-presence check | four tests: row, evidence, bound, root shape |
+| `GLOB_DEPTH` 3 → 2 | three tests: row, evidence, bound |
+| `wrangler.json` dropped from the markers | the row test |
+| `hono` restored to the Workers applies | the row test |
+| the vocabulary check removed from `describeDefect` | the local-profile probe: an error where the message belongs |
+| the android fact made a shallow `dir` probe (S07's shape) | three exact-set rows |
+
+## Rejected
+
+**Selecting on the language and excluding with an extra condition** — `cloudflare-workers`
+applies on `typescript`, but not when …. Selection by subtraction needs its own detector for
+every new shape of repository, and each exclusion is a hole until it is written. The positive
+form asks one question — *is this a Worker?* — and the answer is a file or a dependency, which is
+what a fact is for.
+
+**The build-plugin half of `has-android-manifest`.** The review proposed the manifest *or* the
+`com.android.application` / `com.android.library` plugin in a build file. The plugin has two
+spellings (Groovy `apply plugin:` and the Kotlin DSL `id(...)`), moves with the plugin's
+versioning, and a repository can carry the plugin without the manifest while it is mid-migration.
+The manifest is the one path shape that makes a module buildable as Android, and it is what
+`doctor` can point at. The plugin half is recorded here rather than implemented, so the next
+reader does not discover it as a gap.
+
+**An unbounded glob walk.** It would find the manifest, and it would also make detection a scan
+of every file below the root, which is what ADR-013's promise rules out: adding an ecosystem is a
+profile file, not a search. The bound is the convention the fact exists to see.
+
+**Keeping `jvm-android` and documenting the mis-selection.** That ships a profile whose body the
+review measured as wrong for a whole class of repositories, with a comment where a fix belongs.
+
+**A per-renderer tag for every framework.** `react-dom` is the renderer, and it is what
+distinguishes a browser from every other surface. The other keys on `react-web` — `react-router`,
+`maplibre`, `firebase` — were already there as discriminators, and they stay: each names a
+library whose presence implies a browser deployment the same way `wrangler` implies Workers.