simt-dev 0.2.2__tar.gz → 0.3.0__tar.gz

{simt_dev-0.2.2 → simt_dev-0.3.0}/.gitignore

@@ -7,4 +7,10 @@
 git.config
 
 .pybuild/
-dist/
+dist/
+
+# Local index, evidence ledger and benchmark run outputs (plan 0003 §4).
+# Task descriptors in .simt-dev/bench/tasks/*.json are committed; runs are not.
+.simt-dev/index.sqlite
+.simt-dev/ledger.jsonl
+.simt-dev/bench/runs/

{simt_dev-0.2.2 → simt_dev-0.3.0}/CHANGELOG.md

@@ -6,6 +6,42 @@ All notable changes to this package are recorded here. The format follows
 
 ## [Unreleased]
 
+## [0.3.0] — 2026-10-17
+
+### The rules and the decisions are readable as MCP resources
+
+A client that wants to browse this tool's rules and rulings had no way to: every answer came back from a tool call with an argument in it. They are addressable now, as one URI per rule and one per decision record, with the byte size each will cost stated up front — the one number a client cannot get without spending the read.
+
+Both resource revisions of the specification were read rather than recalled, and they disagree about the behaviour that decides whether a client retries or gives up: a missing resource is `-32602` on the newest revision and `-32002` on the two older ones, and neither lets a server answer with an empty body. A decision record is redacted on the way out, because a resource travels further than the CLI did (ADR-074).
+
+### A plan is resumed one slice at a time
+
+`simt plan next` returns the next ready slice and only its section. `simt plan done` rewrites that one row, and previews the change unless `--yes` is given. The directories and the table format come from the `plans` key in `simt.json` when a repository sets one; otherwise the tracker template delivered with the tool is used, which reads `docs/plans` and `docs/reviews` (ADR-081, ADR-082). `init` keeps a manifest key it does not write, which is what lets `plans` survive a re-init.
+
+### The rules are enforced at the tool call
+
+Three rules that text does not hold — a `git push`, a `--no-verify`, an edit inside a generated region — are now a decision before the tool call. `simt agent-hooks install` writes one policy into the harnesses that read a hooks file, and keeps every key it does not own. `simt agent-hook` is the entry point those harnesses call (ADR-079).
+
+### A line the repository already proves does not ship
+
+A rule line may say when the repository already proves it. `simt sync` drops that line, and `--explain` names the line and the fact, so a removal is visible rather than silent (ADR-078).
+
+### The region leads with this repository's commands
+
+The projected region opens with the commands this repository actually runs, derived from its committed gates and runner, in both the full projection and kernel mode (ADR-077).
+
+### A change to what an agent reads can be measured
+
+`simt bench mine`, `run`, `report`, `ablate` and `probes` measure a change to projected context against tasks taken from this repository's own history. A change that cannot be run says `unmeasured` in its record rather than implying a result (ADR-076).
+
+### What each reader loads, and a transcript split
+
+`simt harness loaders` reports what each reader loads at session start, in bytes, and what its size cap drops. DeepSeek is one of those readers. `simt tokens --session` splits a local Claude Code or Codex transcript into rules, file reads and tool output.
+
+### A name this tool owns is not reported as a repository
+
+`simt rules why` keeps this tool's own names (`simt-priority`, `simt-hooks`, and the rest) and still redacts a repository the reader cannot open (ADR-080).
+
 ## [0.2.2] — 2026-10-14
 
 ### A repository can ask for a smaller projection
@@ -527,6 +563,7 @@ never ran `simt hooks install` again will find nothing until the dependency is r
 and `simt hooks install --yes` is re-run. That is a real upgrade step and it is called out
 here rather than discovered.
 
+[0.3.0]: https://github.com/QuazarMedia/simt-dev/releases/tag/v0.3.0
 [0.2.2]: https://github.com/QuazarMedia/simt-dev/releases/tag/v0.2.2
 [0.2.1]: https://github.com/QuazarMedia/simt-dev/releases/tag/v0.2.1
 [0.2.0]: https://github.com/QuazarMedia/simt-dev/releases/tag/v0.2.0

{simt_dev-0.2.2 → simt_dev-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: simt-dev
-Version: 0.2.2
+Version: 0.3.0
 Summary: Shared agent rules, skills and git hooks for a repository: one command adopts a repo, and every gate it declares is probed before it is written.
 Project-URL: Homepage, https://github.com/QuazarMedia/simt-dev
 Project-URL: Repository, https://github.com/QuazarMedia/simt-dev

simt_dev-0.3.0/bin/simt-dev.mjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+// simt-dev - developer and agent tooling for the SIMT ecosystem.
+//
+// POSIX only (ADR-012). package.json declares os: [darwin, linux], so npm refuses
+// the install elsewhere rather than letting a hook fail obscurely.
+
+import { parse } from '../src/argv.mjs';
+import { EXIT, fail, jsonFailMode, jsonIndentDefault } from '../src/output/index.mjs';
+
+try {
+  const argv = process.argv.slice(2);
+  const parsed = parse(argv);
+  if (!parsed.ok) {
+    process.exit(parsed.code);
+  }
+  const { flags, positional } = parsed.value;
+
+  // No arguments at all is a usage error, not a silent help dump: an agent that
+  // ran the wrong thing should be told so rather than handed 40 lines of prose.
+  if (positional.length === 0 && !flags.help && !flags.version) {
+    process.exit(fail('no command given', EXIT.USAGE));
+  }
+
+  jsonIndentDefault(flags.pretty === true);
+  jsonFailMode(flags.json === true);
+
+  // The one command that runs on somebody else's hot path, and therefore the one that
+  // does not load the registry. `agent-hook` is called before every tool call an agent
+  // makes, so its latency is a product requirement rather than a nicety (plan 0003
+  // R15), and the registry's imports - detection, projection, the bench corpus - cost
+  // tens of milliseconds before the command itself starts. Measured on the machine
+  // this was written on: 127.7 ms through the registry against 91.5 ms with only this
+  // module's imports, where the bare runtime is 86.9 ms of it.
+  //
+  // Only the exact spelling the renderers write takes this path. Anything else -
+  // including `agent-hook --help` - loads the registry, so help stays the one list of
+  // every command and this shortcut cannot become a second, thinner command surface.
+  if (positional[0] === 'agent-hook' && !flags.help && !flags.version) {
+    const { agentHookCommand } = await import('../src/commands/agenthook.mjs');
+    process.exit((await agentHookCommand(positional.slice(1), flags)) ?? EXIT.OK);
+  }
+
+  const { dispatch } = await import('../src/commands/index.mjs');
+  process.exit((await dispatch(argv)) ?? EXIT.OK);
+} catch (error) {
+  process.exit(fail(error?.message ?? String(error), EXIT.FAIL));
+}

simt_dev-0.3.0/docs/decisions/ADR-074-a-rule-and-a-decision-are-readable-by-uri.md

@@ -0,0 +1,99 @@
+# ADR-074 — A rule and a decision are addressable, so they are readable by URI
+
+Status: **accepted** · 2026-10-14 · filed as S43
+**Affects:** `src/mcp/resources.mjs`, `src/mcp/server.mjs`, `test/mcp.test.mjs`
+
+## Context
+
+Review 0002 filed that the MCP server is two protocol revisions behind and returns text
+only. ADR-068 closed the revision half and every tool now declares an output schema and
+annotations. What remained was the other half of the finding: the server has no
+**resources**, so the two things this tool is actually authoritative about — the rules it
+projects and the decisions it settles — are reachable only through a tool call with an
+argument in it.
+
+That matters for a client that wants to browse rather than query. A tool call asks a
+question and gets an answer; a resource is something a client can list, show in a picker,
+attach to a context window and re-read on demand. The CLI already answers both by id
+(`rules show`, `rules why`); what was missing was the addressable form.
+
+So the specification was fetched and read for both revisions rather than recalled, and it
+turned out the two disagree in a way that decides an observable behaviour: **a missing
+resource is `-32602` (Invalid Params) in 2026-07-28 and `-32002` (Resource not found) in
+2025-06-18.** 2026-07-28 keeps `-32002` only as something a *client* should still accept.
+Both revisions forbid an empty `contents` array for a resource that does not exist, because
+empty is ambiguous — it reads as "here is a resource with no body".
+
+Both revisions also require the capability to be declared, and both permit the empty
+object for a server with no subscriptions and no change notifications. The newer one adds
+`ttlMs` and `cacheScope` to resource results, which is why a resource list is cacheable on
+the newest revision and is a bare list on the two older ones — the same rule ADR-068
+already applies to tools.
+
+## Rulings
+
+1. **Two collections and no others: the rules and the decisions.**
+   `simt://rules/{id}` and `simt://decisions/{adr}`. A resource set that grew with the
+   registry would be a second index to keep honest, and the registry is workspace data
+   (ADR-061) — the package ships none of it, so a client browsing this server in one
+   repository and another would see different sets anyway.
+
+2. **The capability is declared unconditionally, as an empty object.** Every rule and every
+   decision record ships with the package, so there is always something to read; and
+   `{}` is the documented way to say "no subscriptions, no change notifications", which
+   are the two things this server has no way to honour. The previous code gated the
+   capability on a property hung on the tools array that nothing ever set — a promise a
+   client waits on forever, only quieter.
+
+3. **A missing resource is an error, and the code is the revision's own.** `-32602` from
+   2026-07-28, `-32002` from the two older revisions, and never an empty `contents`. A
+   client that reads a URI and gets silence cannot tell a bug from an empty rule, and the
+   two revisions disagree about which code that silence should wear.
+
+4. **Every listed resource carries the bytes it will cost.** `size` is in the specification
+   and it is the one number a client cannot get without reading: an agent assembling a
+   context window needs to know what a resource costs before it spends it. This is the
+   same argument as `simt tokens`, arriving at a different surface.
+
+5. **The frontmatter is rebuilt, unprefixed, and the body's own heading is not repeated.**
+   A rule on disk opens with frontmatter this tool's namespace owns (`simt-`); a resource
+   is read by a client that knows nothing about that namespace, so the identity is
+   reconstructed under plain keys. The loader no longer carries the H1, so the title lives
+   in the frontmatter rather than being re-added by hand in two places.
+
+6. **A decision body is redacted on the way out.** `redactInternalPaths(redactEstate(...))`,
+   the same pass the CLI applies. A resource is readable by anyone holding the connection,
+   which is a wider audience than the repository the CLI is aimed at, and a record whose
+   argument names an estate repository should not travel further just because it became
+   addressable.
+
+7. **Every URI is validated, and a rules id cannot contain a slash.** Custom schemes are
+   allowed, which is precisely why the server checks: a URI naming another scheme, a
+   `..` segment, an empty id or a nested path is refused with the same revision-correct
+   error as one that simply does not exist. A refusal that is distinguishable from a miss
+   is a way to probe the filesystem.
+
+## Consequences
+
+`resources/list` answers 97 entries in this checkout — 20 rules, the process rules, and 73
+decision records — and a client can attach any of them without a tool call. The templates
+list publishes the two shapes, so a client can build the URI for an id it has not listed
+yet.
+
+What this does not do: subscribe to a rule changing, because there is no stream to
+subscribe to and the capability says so. That is a feature, not an omission — a client
+that believes it is subscribed to a projection that only changes on `sync` would be
+waiting for an event this tool will never emit.
+
+## Rejected
+
+- **Serving resources only through tool calls.** That is what the server already did, and
+  the finding is that a client cannot browse what it can only ask about.
+- **An empty `contents` array for a URI that does not exist.** Both revisions treat it as
+  ambiguous, and ambiguity here is what makes a client retry forever.
+- **Exposing the registry as resources too.** It is workspace data and this package ships
+  none of it (ADR-061); a resource list that differed per repository would be the
+  same definition-of-one-thing-twice defect, one layer up.
+- **One error code for all three revisions.** `-32602` on the older two would be a code
+  that revision never defined, and `-32002` on the newest would be advice to clients
+  rather than the specification's own answer.

simt_dev-0.3.0/docs/decisions/ADR-075-nothing-leaves-the-machine.md

@@ -0,0 +1,56 @@
+# ADR-075 — Nothing leaves the machine: no telemetry, local transcripts, loopback models by default
+
+Status: **accepted** · 2026-10-14 · filed as D7 (R06)
+**Affects:** `src/measure/session.mjs`, `src/measure/context.mjs`, `src/commands/tokens.mjs`, `src/argv.mjs`, `test/tokens.test.mjs`
+
+## Context
+
+The context meter (`simt tokens`) now goes beyond static repository files to inspect
+recorded agent transcripts (`simt tokens --session <path>`), and later slices in the
+research programme connect optional local model servers for embeddings, distillation and
+pre-review critique.
+
+Session transcripts are among the most sensitive files on a developer's machine: they hold
+every file an agent read, every command output it saw, uncommitted diffs, environment
+diagnostics and prompts written in the middle of debugging. A tool that fetched remote
+session URLs, phoned home usage metrics, or defaulted model calls to a hosted endpoint
+would turn a local measurement command into an exfiltration surface.
+
+## Rulings
+
+1. **No command emits telemetry, analytics or background network traffic.** Every command
+   operates over the local filesystem and stdio alone unless the user explicitly invokes a
+   documented network flag in a later adapter.
+
+2. **`simt tokens --session <path>` accepts local filesystem paths only and refuses URLs.**
+   Any argument carrying a URI scheme (`http://`, `https://`, `ws://`, `ssh://` or any
+   `<scheme>://`) is rejected at argument validation with a configuration exit code and a
+   remedy naming a local file path, before any socket or filesystem read is attempted.
+
+3. **Session attribution is computed deterministically in process with zero dependencies.**
+   Transcript JSON and JSONL records from Claude Code and Codex are split into `rules`
+   (system instructions, inline instruction blocks, and reads of instruction, rule or skill
+   files), `fileReads` (reads of repository source and config files) and `toolOutput`
+   (command and tool execution results) by inspecting the local file alone.
+
+4. **Future local-model adapters default to loopback (`127.0.0.1` / `localhost`) and refuse
+   remote hosts unless explicitly overridden.** When no local model is configured in
+   `simt-dev.json`, no socket is opened at all.
+
+## Consequences
+
+`simt tokens --session <path>` can be run safely on production incident transcripts and
+private repositories because the parser cannot open a network connection. And coupling the
+static meter to the harness loader table (`R14`) means `simt tokens` now counts what each
+reader actually loads at session start — flat `.agents/rules/` scans for Antigravity,
+`alwaysApply: true` for Cursor, `@path` imports for Claude Code, and root-to-cwd chain
+caps for Codex — without leaving the machine.
+
+## Rejected
+
+- **Fetching remote session URLs or cloud share links in `simt tokens --session`.** Convenience
+  for a shared link is also an outbound request from a tool whose contract is that it
+  only reads local state.
+- **Anonymous opt-out telemetry for context budget numbers.** Even aggregate byte counts
+  reveal repository names, adoption state and working hours, and an opt-out flag still
+  ships a network client in the default path.

simt_dev-0.3.0/docs/decisions/ADR-076-a-change-to-what-agents-read-is-measured.md

@@ -0,0 +1,70 @@
+# ADR-076 — A change to what agents read is measured before it ships, or labelled unmeasured in its record
+
+Status: **accepted** · 2026-10-15 · filed as D1 (R01)
+**Affects:** `src/bench/mine.mjs`, `src/commands/bench.mjs`, `src/commands/index.mjs`, `src/commands/help.mjs`, `test/bench.test.mjs`
+
+## Context
+
+Every rule and profile projected by this package enters an agent's context window on every
+turn, yet nothing in the repository could say whether a paragraph improved resolution,
+increased token cost, or did neither. Controlled studies on repository context files show
+that unmeasured instructions routinely raise inference cost by 20% or more without moving
+task resolution when they repeat facts the repository already proves.
+
+Without a repository-native task suite and a rule requiring evidence, changes to projected
+context are judged by how plausible the prose sounds to a reviewer rather than by what an
+agent does with it. And a task suite whose verification tests sit inside the agent's
+worktree is trivial to game: an agent can read or weaken the test it is being graded by.
+
+## Rulings
+
+1. **A change to projected context is measured against the benchmark suite before it ships,
+   or its decision record states `unmeasured` and why.** Context changes include core
+   rules, stack profiles, process rules, kernel compilation, command cards and brief
+   assembly. When a slice cannot be run through the benchmark (for example, before the
+   runner is wired or when a rule governs an external release gate), the decision record
+   must carry the explicit label `unmeasured` rather than implying an empirical win.
+
+2. **Benchmark tasks are mined deterministically from non-merge git history.** `simt bench mine`
+   walks non-merge commits with a parent, selects commits that modify both test paths and
+   implementation paths, splits each commit into `test.patch` (test files) and `gold.patch`
+   (implementation files), and assigns the deterministic identifier `t-<shortSha>-01`.
+
+3. **Every mined task is validated twice in an isolated worktree before acceptance.** At
+   the parent commit `BASE`:
+   - `BASE` plus `test.patch` must fail (`RED`) on two consecutive runs with the same
+     failing and passing test identifiers;
+   - `BASE` plus `test.patch` plus `gold.patch` must pass (`GOLD`) on two consecutive runs
+     with zero failing tests and the same passing test identifiers;
+   - any commit whose test outcome differs between the two runs is discarded as flaky.
+
+4. **Test identifiers are extracted from runner-native machine output, never from human
+   console summaries.** The miner parses TAP (`node --test --test-reporter=tap`), Vitest
+   JSON (`--reporter=json`), JUnit XML (Gradle, Maven and `pytest --junitxml`) and Go JSON
+   event streams (`go test -json`) to record exact `f2p` (`FAIL_TO_PASS`) and `p2p`
+   (`PASS_TO_PASS`) test identifiers.
+
+5. **Hidden test patches live in a verifier vault outside every worktree.** Task metadata
+   is written to the adopting repository's benchmark task directory so the suite
+   membership is versioned and reviewable, while `test.patch` and `gold.patch` are written
+   to the user's cache vault (`~/.cache/simt-dev/vault/<repo-id>/<id>/`, or the platform
+   cache equivalent) so an agent running inside a task workspace cannot inspect the
+   verifier test diff or the oracle fix.
+
+## Consequences
+
+`simt bench mine --yes` mines a deterministic, flake-filtered task suite from a
+repository's own commits without network access or model calls. Re-running the miner over
+the same commit history produces byte-identical task JSON files and vault patches.
+
+## Rejected
+
+- **Keeping `test.patch` inside the repository's committed task directory.** An agent
+  evaluated in a checkout of the repository could read the hidden test expectations or the
+  oracle patch directly from disk.
+- **Accepting any commit that touches a test file without running `RED` and `GOLD` twice.**
+  Refactors, formatting commits and flaky tests touch test files without failing on `BASE`,
+  producing tasks where a no-op agent scores 100% or a valid fix fails at random.
+- **Scraping human-formatted test summaries with regular expressions.** Console summaries
+  vary by locale, terminal width and runner version, and do not name individual
+  `FAIL_TO_PASS` test cases needed to grade partial regressions.

simt_dev-0.3.0/docs/decisions/ADR-077-the-command-card-leads-the-region-and-reads-committed-evidence.md

@@ -0,0 +1,91 @@
+# ADR-077 — The command card leads the region, and is derived from committed evidence only
+
+Status: **accepted** · 2026-10-16 · filed as R10 (plan 0003)
+**Affects:** `src/kernel/card.mjs`, `src/projection/rules.mjs`, `rules/core.md` (indirectly, as
+the region's first bytes), `test/card.test.mjs`
+
+## Context
+
+Plan 0003 R10 asks for the highest-value, non-inferable bytes: the exact commands for *this*
+repository, at the top of the region, in a block of at most 600 B, "derived from gates and
+runner detection alone, so it needs no index". A reader who has the rules has the same rules
+every other repository has; what they cannot infer is that *their* tests run under
+`./gradlew :app:testDebugUnitTest` and not `npm test`.
+
+Two things the plan leaves open, and both are the kind an implementer gets wrong once:
+
+1. **Which modes carry the card.** R07's kernel is a smaller projection a repository asks
+   for (ADR-073), and R10 says "at the top of the kernel". Read literally, the card would
+   appear only for the repositories that opted into kernel mode — that is, only for the
+   readers who already measured that they can do without guidance. The reader who kept
+   `full` is the one who has the commands nowhere.
+
+2. **What evidence the card may read.** "Runner detection" has two possible meanings here.
+   `readCapability` answers "can this machine run it" by probing PATH and `node_modules`,
+   and that answer is machine-specific. But the projected region is required to be
+   byte-identical on two machines (plan 0003 P4 and R13): the whole reason the tool has no
+   model and no network is that a pull request can meaningfully diff a projection. A card
+   that named whichever linter happened to be installed would differ between a laptop and
+   CI for no reason a diff could explain, and `check` would flake on a clean tree.
+
+## Rulings
+
+1. **The card leads the region in both modes.** `full` and `kernel` differ in which *rules*
+   are packed (ADR-073 ruling 5); neither withholds the commands. The card is bytes the
+   reader most needs and the rules never carry, so it is above even the core, and it is not
+   a rule the kernel can defer.
+
+2. **It is derived from committed evidence only.** Three sources, in precedence order: the
+   manifest's declared `gates.commands`, the repository's own `package.json` scripts, and
+   the marker facts that name its ecosystem. It never reads PATH or `node_modules`.
+   Runnability is a property of the machine; a command is a property of the repository, and
+   only the second belongs in bytes that leave it.
+
+3. **The ecosystem table is the single source, and the gate list cannot disagree with it.**
+   The fallback for a marker that has no declared command is the same `ECOSYSTEMS` table
+   `manifest.mjs` seeds gates from. Two tables would eventually name two different test
+   commands for one repository, which is the drift this tool exists to remove. Python is the
+   one ecosystem the table does not seed, because its runner varies (uv, poetry, tox, nox); the
+   card still names the command a committed lockfile proves — `uv run -m pytest`, never
+   `uv run pytest`, because the uv profile is explicit that the console entrypoint can run a
+   different copy of the package than the one under test.
+
+4. **A template is labelled as a template, per path kind.** The focused-test entries carry
+   `{file}`, `{pkg}`, `{Test}` and `{class}` placeholders and are labelled by the kind of
+   path they apply to, so a reader never pastes a brace into a shell. Which test a given
+   `{file}` maps to is R24's refinement, not R10's.
+
+5. **The ceiling is 600 B, enforced by dropping whole lines, never silently.** Lines drop in
+   a stated order — `format`, `typecheck`, `lint`, `build`, then focused templates from the
+   last — and `test` is never among them, because a card that dropped the test command would
+   have dropped the command it exists to carry. Every drop is named in the projection notes;
+   a card that lost a command in silence is a card the reader cannot tell is incomplete.
+
+6. **It is computed in `desiredRegion`, the one place the region is computed.** `plan` and
+   `checkTarget` therefore cannot hold two opinions about the same card, which is the same
+   property that keeps a clean tree from reporting drift (the comment on `desiredRegion`).
+
+## Consequences
+
+Every adopted repository's region gains the card on the next `sync`, in both modes. That is
+the point of the slice: the bytes were absent everywhere, and the ones added are the ones a
+reader can act on. The card is derived, so it moves only when the repository's own commands
+move — a new `package.json` script, a declared command, or a marker file appearing.
+
+What is not here: which test a `{file}` should be mapped to (R24), the inferability filter
+that would drop a card line the repository already states (R09), and the cost measurement
+that would say whether the card earns its bytes (R02, R27). This ruling is what makes those
+measurable rather than what concludes them.
+
+## Rejected
+
+- **Kernel mode only.** It withholds the card from the readers who kept the larger
+  projection, which is all of them until R02 has run.
+- **Probing PATH or `node_modules`** so the card shows only commands that will run here. The
+  answer would not survive a second machine, and the region is required to.
+- **Writing the commands as rule text.** The commands are data about one repository; a rule
+  is the same in every repository, and a rule that stated one repository's test command would
+  be wrong in every other.
+- **Letting the card grow past 600 B, or trimming it silently.** An unbounded card is a
+  second copy of the rules, and a silently short one is a reader who trusts a card that is
+  missing a command.

simt_dev-0.3.0/docs/decisions/ADR-078-a-line-the-repository-already-proves-does-not-ship.md

@@ -0,0 +1,117 @@
+# ADR-078 — A line the repository already proves does not ship, and the author says so
+
+Status: **accepted** · 2026-10-16 · filed as R09 (plan 0003)
+**Affects:** `src/kernel/inferability.mjs`, `src/projection/rules.mjs`, `src/kernel/card.mjs`
+(the verb vocabulary), `src/argv.mjs`, `src/commands/help.mjs`, `test/inferability.test.mjs`,
+`test/shipped.test.mjs` (the estate-name guard's allowlist of the tool's own words)
+
+## Context
+
+Plan 0003 R09 asks for an inferability filter: a rule line may declare
+`simt-inferable-when: <fact expression>`, and when the repository already proves the
+expression the line is dropped — "use `./gradlew`" when the wrapper is the only runner and
+the card names it, "use pnpm" when only `pnpm-lock.yaml` exists. The basis is that content
+the repository already states does not help its reader.
+
+ADR-077 built the card that names this repository's commands and left R09 open as the filter
+"that would drop a card line the repository already states". What the plan leaves open is
+the part that decides whether the mechanism is usable or a trap:
+
+1. **Who may drop a line.** An inferability filter that guesses is a filter that deletes
+   rules a reader needed. "The repository has a `.editorconfig`, so the indentation rule is
+   inferable" is exactly the reasoning that is right most of the time and silent when it is
+   wrong.
+
+2. **What evidence may be read.** The same choice ADR-077 ruling 2 had to make, and the same
+   answer applies: the projected region is required to be byte-identical on two machines
+   (plan 0003 P4, R13), so evidence read off the machine cannot decide what leaves.
+
+3. **What a removal costs the author.** A line that leaves a projection with no trace is the
+   mistake ADR-073 rejected for deferred rules. But a `## Dropped` section would spend region
+   bytes on lines the reader is being told not to read, which is the opposite of the slice's
+   purpose.
+
+## Rulings
+
+1. **A line leaves only when its author says it may.** The mechanism is opt-in per block, by
+   a marker the rule author writes — `<!-- simt-inferable-when: <expression> -->`. Nothing is
+   dropped by inference alone. The tool checks a claim; it does not make one.
+
+2. **The unit is the blank-line-delimited block, and the marker never reaches the region.**
+   A wrapped bullet is marked once and leaves whole, rather than leaving half a sentence
+   behind. The comment is stripped from the region whether or not the line is dropped:
+   `simt-` vocabulary is for the rule's author, not for its reader.
+
+3. **The expression is a conjunction of positive terms over a closed vocabulary.** A term is
+   a fact or stack tag in `KNOWN_TAGS`, a `card:<verb>` for one of the card's five verbs, or
+   a `gate:<name>` the repository declares. There is no negation: every reason a line is
+   redundant is a positive proof the repository offers, and a grammar for a case nobody has
+   is a grammar nobody can be taught. A term outside the vocabulary is a defect, reported
+   through the same field as a broken frontmatter key, so `check` and `rules list` need no
+   second path to a broken rule.
+
+4. **The proofs are committed bytes only.** The repository's own facts and stack, the gates
+   its manifest declares, and the verbs its card names. Never PATH and never `node_modules`,
+   for the reason ADR-077 ruling 2 already settled: a proof read off the machine would make
+   the region differ between a laptop and CI for no reason a diff could explain.
+
+5. **The filter is about the repository's evidence, not about the mode.** It runs in both
+   `full` and `kernel`, for the same reason the card does (ADR-077 ruling 1): inferability is
+   a property of what the repository commits, and inferability of the mode would withhold the
+   saving from every reader who kept the larger projection.
+
+6. **Never silent, and never a heading.** By default a removal is reported as one count in
+   the projection notes, with the command that names each one: `--explain` prints every
+   removal and the evidence behind it. A count is enough to act on; the per-line detail is
+   what an author needs, and a reader is not an author.
+
+7. **The vocabulary has one definition.** `card.mjs` exports the five verbs the card can
+   name, and the filter validates `card:<verb>` against that same list. A copy of the list in
+   the filter would let the card name a verb the filter called unknown.
+
+## Consequences
+
+The region of a repository whose rules carry no marker does not move a byte: the filter
+returns the body by identity when there is nothing marked, so this ruling cannot drift a
+repository that did not ask for it. Where a marker is written — in a repository's own
+`.simt-dev/profiles`, or in a pack — the marked line leaves the region on the next `sync`,
+and `sync --explain` names it and the evidence.
+
+**What has not landed: no shipped rule carries a marker.** `rules/stacks/go.md` states
+"`go build ./...`, `go test ./...` are the entrypoints; `go vet ./...` runs with them" and
+`rules/stacks/uv.md` states "`uv run -m pytest`; **never** `uv run pytest`" — both duplicate a
+card line, and neither is *wholly* inferable, because each also carries a reason the card does
+not state. Dropping them would lose the reason. Marking shipped rule text is therefore a
+content pass with its own blast radius (a change to shipped rule text changes every repository
+at once), not a step of this slice; the mechanism ships first so that pass can be measured.
+
+A marker stays visible in `simt rules show <id>`, which prints the rule's own text. That is
+deliberate: it is the author's annotation, and it is the reason a line they can see in the
+file is absent from the region. It is not region text, and it never reaches one.
+
+`--explain` is a `sync` flag and not a `check` flag, because `sync` is the command that prints
+projection notes and the preview a reader reads before writing. The JSON payload of `sync`
+does not carry notes, so this adds no contract.
+
+One visible oddity, stated because the reader will meet it: `simt rules why ADR-078` prints
+`simt-inferable-when` as a repository this record surveyed, because the decisions reader
+treats every `simt-` word outside its allowlist as one. That is a defect in the reader rather
+than in this ruling — ADR-073 carries the identical one for `simt-priority` — and it is not
+fixed here.
+
+## Rejected
+
+- **Dropping a line the tool judges inferable without a marker.** It is the failure the slice
+  exists to avoid: a rule deleted by a heuristic with no way for the author to see the
+  heuristic was wrong.
+- **A marker on every physical line.** A wrapped bullet is one sentence across two lines;
+  marking lines would let a removal leave half of one behind.
+- **Negation, parentheses or disjunction in the expression.** No shipped reason for a removal
+  is negative, and a grammar with a case nobody uses is a grammar nobody can be taught.
+- **Letting the filter run in `kernel` mode only.** It would withhold a saving from the
+  readers who kept the larger projection, which is all of them until R02 has run.
+- **A `## Dropped` section in the region.** It spends bytes on lines the reader is told not
+  to read, and it moves the rule set for a reason that is not about the reader.
+- **Marking shipped rules now.** No shipped line is wholly inferable, so it would delete
+  rationales to save bytes that the card already saves, and it would change every
+  repository's region in a slice about a mechanism.