Let a rule be switched off, and make that mean something

Work item V7 of the M3 plan. The rules table has carried an enabled flag since
the schema was written, set to true on every import, and nothing read it. This
makes it load-bearing and gives it a screen.

A switched-off rule is left out of the snapshot a new review is frozen with, so
its text never reaches the model and its mechanical sweeps never run. The end
of that chain is tested where it actually matters: the recorded argv of the
adversarial call does not contain the disabled rule's text, and does contain
the next one's.

Toggling moves the ruleset's version, because a review's snapshot names the
version. Without the bump two different sets of rules would share a name and a
number, and a report saying which version it used would not identify what the
review was actually judged against. Toggling a rule to the value it already has
moves nothing.

The exported document keeps every rule, disabled ones included, and comes back
byte-identical to what was imported. That is the difference between the
document and the choice this app made about applying it: switching a rule off
is not an edit to what the author wrote.

Freezing a ruleset with nothing enabled is refused, for the same reason
importing an empty one is: a review judged against no rules comes back clean
and reads exactly like a review that found nothing wrong.

Driven live: importing gave twelve rules at version 1, switching rule 3 off
returned version 2 and showed it off, and the export was byte-identical to the
source document with the disabled rule still in it. Three mutations checked and
all caught: keeping disabled rules in the snapshot, not moving the version, and
allowing an empty ruleset to be frozen.

Author: Poolchaos

docs/DECISIONS.md

@@ -761,3 +761,20 @@ verified evidence, in writing, here.
   check whose whole job is to answer a question calmly. Found by pointing
   TRYSQUARE_CLAUDE_PATH at the fake and watching the route return a JSON
   syntax error instead of "not signed in".
+- 2026-07-31 DECIDED (V7, D-40): switching a rule off bumps the ruleset
+  version. A review's frozen snapshot names the version, so without the bump
+  two different sets of rules would share a name and a number, and a report
+  saying which version it used would not identify what the review was actually
+  judged against. Toggling to the value a rule already has moves nothing.
+- 2026-07-31 DECIDED (V7): the frozen snapshot stores enabled rules only, and
+  the exported document always contains every rule. That is the difference
+  between the document and the choice this app made about applying it: the
+  export has to reproduce what was imported, byte for byte, and a rule someone
+  switched off is not part of what a new review is judged against.
+- 2026-07-31 DECIDED (V7): freezing a ruleset with nothing enabled is refused.
+  A review judged against no rules comes back clean and reads exactly like a
+  review that found nothing wrong, which is the same hazard the empty-import
+  guard exists for.
+- 2026-07-31 DECIDED (V7, D-44): the new-review screen links to the ruleset
+  page rather than opening a drawer. At one screen of this size a drawer
+  duplicates a page that already exists.

docs/plans/M3-FINISH-PLAN.md

@@ -349,7 +349,7 @@ confirms the wiring.
 | V4 | preflight route and panel, linked toggle with suggestion      | V3         | DONE   |
 | V5 | report renderer, report/export routes, report UI              | V2         | DONE   |
 | V6 | resume/queued/merged/delete UI, settings editor, probe buttons | V2         | DONE   |
-| V7 | rulesets detail, enable toggle, snapshot filter, export       | V1         |        |
+| V7 | rulesets detail, enable toggle, snapshot filter, export       | V1         | DONE   |
 | V8 | e2e journey, theme screenshots, design audit, CI --e2e        | V2-V7      |        |
 | V9 | PROJECT-STATE, indexes, FG-2 checklist and evidence, G1 row   | V8         |        |
 

src/app/api/rulesets/[id]/export/route.ts

@@ -0,0 +1,33 @@
+/**
+ * The protocol document this ruleset came from.
+ *
+ * Byte-exact, because every rule's verbatim markdown is stored alongside its
+ * parsed fields. Disabled rules are included: the document is the document,
+ * and switching a rule off is a choice this app made about applying it, not an
+ * edit to what the author wrote.
+ */
+
+import { exportProtocol } from "@/lib/rulesets/import";
+import { loadRuleset, requireRuleset } from "@/server/db/repositories/rulesets";
+import { handler } from "@/server/api/respond";
+import { runtime } from "@/server/runtime";
+
+export const dynamic = "force-dynamic";
+
+export async function GET(
+  _request: Request,
+  context: { params: Promise<{ id: string }> },
+): Promise<Response> {
+  return handler(async () => {
+    const { db } = runtime();
+    const { id } = await context.params;
+    const row = requireRuleset(db, id);
+
+    return new Response(exportProtocol(loadRuleset(db, id)), {
+      headers: {
+        "Content-Type": "text/markdown; charset=utf-8",
+        "Content-Disposition": `attachment; filename="${row.name.replace(/[^\w.-]+/g, "-")}.md"`,
+      },
+    });
+  });
+}

src/app/api/rulesets/[id]/route.ts

@@ -0,0 +1,39 @@
+/** One ruleset: what it checks, and which of those checks are switched on. */
+
+import { loadRuleset, requireRuleset } from "@/server/db/repositories/rulesets";
+import { handler, ok } from "@/server/api/respond";
+import { runtime } from "@/server/runtime";
+
+export const dynamic = "force-dynamic";
+
+export async function GET(
+  _request: Request,
+  context: { params: Promise<{ id: string }> },
+): Promise<Response> {
+  return handler(async () => {
+    const { db } = runtime();
+    const { id } = await context.params;
+    const row = requireRuleset(db, id);
+    // Everything, disabled included: this screen is where a rule is switched
+    // back on, so it cannot show only the ones that are already on.
+    const ruleset = loadRuleset(db, id);
+    const enabledOnly = loadRuleset(db, id, { enabledOnly: true });
+    const enabled = new Set(enabledOnly.rules.map((rule) => rule.code));
+
+    return ok({
+      ruleset: { id: row.id, name: row.name, tier: row.tier, version: row.version },
+      directives: ruleset.directives.map((directive) => ({
+        section: directive.section,
+        title: directive.title,
+      })),
+      rules: ruleset.rules.map((rule) => ({
+        code: rule.code,
+        title: rule.title,
+        severity: rule.severity,
+        tags: rule.tags,
+        sweepPatterns: rule.sweepPatterns.length,
+        enabled: enabled.has(rule.code),
+      })),
+    });
+  });
+}

src/app/api/rulesets/[id]/rules/[code]/route.ts

@@ -0,0 +1,34 @@
+/**
+ * Switching one rule on or off.
+ *
+ * Moves the ruleset's version, because a review's frozen snapshot names it.
+ * Without the bump two different sets of rules would share a name and a
+ * number, and a report saying which version it used would not identify what
+ * the review was actually judged against.
+ */
+
+import { z } from "zod";
+import { setRuleEnabled } from "@/server/db/repositories/rulesets";
+import { failed, handler, ok, readJson } from "@/server/api/respond";
+import { runtime } from "@/server/runtime";
+
+export const dynamic = "force-dynamic";
+
+const body = z.object({ enabled: z.boolean() });
+
+export async function PATCH(
+  request: Request,
+  context: { params: Promise<{ id: string; code: string }> },
+): Promise<Response> {
+  return handler(async () => {
+    const { db } = runtime();
+    const { id, code } = await context.params;
+    const { enabled } = await readJson(request, body);
+
+    try {
+      return ok(setRuleEnabled(db, id, decodeURIComponent(code), enabled));
+    } catch (error) {
+      return failed(error, 400);
+    }
+  });
+}

src/app/reviews/new/page.tsx

@@ -335,7 +335,10 @@ function NewReview() {
               </Select>
             </Field>
 
-            <Field label="Rules" hint="What the change is judged against, frozen at the start.">
+            <Field
+              label="Rules"
+              hint="What the change is judged against, frozen when the review starts."
+            >
               <Select value={rulesetId} onChange={(event) => setRulesetId(event.target.value)}>
                 {rulesets.length === 0 ? <option value="">No rulesets imported yet</option> : null}
                 {rulesets.map((ruleset) => (
@@ -344,6 +347,14 @@ function NewReview() {
                   </option>
                 ))}
               </Select>
+              {rulesetId ? (
+                <Link
+                  href={`/rulesets/${rulesetId}`}
+                  className="text-xs text-[var(--color-accent)] hover:underline"
+                >
+                  See which rules apply
+                </Link>
+              ) : null}
             </Field>
 
             <Field label="Model">

src/app/rulesets/[id]/page.tsx

@@ -0,0 +1,171 @@
+"use client";
+
+/**
+ * One ruleset: every rule it contains, and which of them apply.
+ *
+ * Switching a rule off moves the ruleset's version, which the page says out
+ * loud, because a review's report names the version it was judged against and
+ * two different rule sets must never share one.
+ */
+
+import { use, useEffect, useState } from "react";
+import { PageBody, PageHeader } from "@/components/page";
+import { Badge, Button, Card, Mono, Problem, severityTone } from "@/components/ui";
+
+interface Detail {
+  ruleset: { id: string; name: string; tier: string; version: number };
+  directives: { section: string; title: string }[];
+  rules: {
+    code: string;
+    title: string;
+    severity: string;
+    tags: string[];
+    sweepPatterns: number;
+    enabled: boolean;
+  }[];
+}
+
+export default function RulesetPage({ params }: { params: Promise<{ id: string }> }) {
+  const { id } = use(params);
+  const [detail, setDetail] = useState<Detail | null>(null);
+  const [error, setError] = useState("");
+  const [busy, setBusy] = useState("");
+  const [showDirectives, setShowDirectives] = useState(false);
+
+  useEffect(() => {
+    let cancelled = false;
+    void (async () => {
+      const response = await fetch(`/api/rulesets/${id}`);
+      if (response.ok && !cancelled) setDetail((await response.json()) as Detail);
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [id]);
+
+  async function toggle(code: string, enabled: boolean) {
+    setError("");
+    setBusy(code);
+    try {
+      const response = await fetch(`/api/rulesets/${id}/rules/${encodeURIComponent(code)}`, {
+        method: "PATCH",
+        body: JSON.stringify({ enabled }),
+      });
+      if (!response.ok) {
+        setError(((await response.json()) as { error?: string }).error ?? "That did not work.");
+        return;
+      }
+      const refreshed = await fetch(`/api/rulesets/${id}`);
+      if (refreshed.ok) setDetail((await refreshed.json()) as Detail);
+    } finally {
+      setBusy("");
+    }
+  }
+
+  if (!detail) return <PageBody>Loading...</PageBody>;
+
+  const off = detail.rules.filter((rule) => !rule.enabled).length;
+
+  return (
+    <>
+      <PageHeader
+        title={detail.ruleset.name}
+        subtitle={
+          <span className="flex flex-wrap items-center gap-3">
+            <Badge>{detail.ruleset.tier}</Badge>
+            <span>version {detail.ruleset.version}</span>
+            <span>
+              {detail.rules.length} rule(s)
+              {off > 0 ? `, ${off} switched off` : ""}
+            </span>
+          </span>
+        }
+        actions={
+          <a href={`/api/rulesets/${id}/export`} download>
+            <Button>Export document</Button>
+          </a>
+        }
+      />
+      <PageBody>
+        {error ? (
+          <div className="mb-4">
+            <Problem>{error}</Problem>
+          </div>
+        ) : null}
+
+        <p className="mb-4 max-w-2xl text-sm text-[var(--color-ink-muted)]">
+          A switched-off rule is left out of the rules a new review is judged against, and its
+          mechanical sweeps do not run. Reviews already started keep the rules they were frozen
+          with. The exported document always contains every rule, because it is the document that
+          was imported.
+        </p>
+
+        <Card className="overflow-x-auto">
+          <table className="w-full text-sm">
+            <thead>
+              <tr className="border-b border-[var(--color-border)] text-left text-xs text-[var(--color-ink-muted)]">
+                <th className="px-3 py-2 font-medium">Rule</th>
+                <th className="px-3 py-2 font-medium">Severity</th>
+                <th className="px-3 py-2 font-medium">Tags</th>
+                <th className="px-3 py-2 font-medium">Sweeps</th>
+                <th className="px-3 py-2 text-right font-medium">Applies</th>
+              </tr>
+            </thead>
+            <tbody>
+              {detail.rules.map((rule) => (
+                <tr
+                  key={rule.code}
+                  className={`border-b border-[var(--color-border)] last:border-0 ${
+                    rule.enabled ? "" : "opacity-55"
+                  }`}
+                >
+                  <td className="px-3 py-2">
+                    <Mono className="text-xs text-[var(--color-ink-muted)]">{rule.code}</Mono>
+                    <span className="ml-2">{rule.title}</span>
+                  </td>
+                  <td className="px-3 py-2">
+                    <Badge tone={severityTone(rule.severity)}>{rule.severity}</Badge>
+                  </td>
+                  <td className="px-3 py-2 text-xs text-[var(--color-ink-muted)]">
+                    {rule.tags.join(", ") || "any"}
+                  </td>
+                  <td className="px-3 py-2 text-[var(--color-ink-muted)]">{rule.sweepPatterns}</td>
+                  <td className="px-3 py-2 text-right">
+                    <label className="inline-flex items-center gap-2">
+                      <span className="text-xs text-[var(--color-ink-muted)]">
+                        {rule.enabled ? "on" : "off"}
+                      </span>
+                      <input
+                        type="checkbox"
+                        checked={rule.enabled}
+                        disabled={busy !== ""}
+                        onChange={(event) => void toggle(rule.code, event.target.checked)}
+                      />
+                    </label>
+                  </td>
+                </tr>
+              ))}
+            </tbody>
+          </table>
+        </Card>
+
+        <button
+          type="button"
+          className="mt-6 text-sm text-[var(--color-accent)] hover:underline"
+          onClick={() => setShowDirectives((shown) => !shown)}
+        >
+          {showDirectives ? "Hide" : "Show"} the {detail.directives.length} process directive(s)
+        </button>
+        {showDirectives ? (
+          <ul className="mt-2 grid gap-1 text-sm text-[var(--color-ink-muted)]">
+            {detail.directives.map((directive) => (
+              <li key={`${directive.section}-${directive.title}`}>
+                {directive.section}: {directive.title}
+              </li>
+            ))}
+          </ul>
+        ) : null}
+      </PageBody>
+    </>
+  );
+}

src/app/rulesets/page.tsx

@@ -8,6 +8,7 @@
  * than saving it out first.
  */
 
+import Link from "next/link";
 import { useCallback, useEffect, useState } from "react";
 import { PageBody, PageHeader } from "@/components/page";
 import {
@@ -140,8 +141,13 @@ export default function RulesetsPage() {
               <ul className="grid gap-2">
                 {rulesets.map((ruleset) => (
                   <li key={ruleset.id}>
-                    <Card className="flex items-center justify-between gap-3 p-3">
-                      <span className="font-medium">{ruleset.name}</span>
+                    <Card className="flex items-center justify-between gap-3 p-3 hover:border-[var(--color-border-strong)]">
+                      <Link
+                        href={`/rulesets/${ruleset.id}`}
+                        className="font-medium hover:underline"
+                      >
+                        {ruleset.name}
+                      </Link>
                       <span className="flex items-center gap-2">
                         <Badge>{ruleset.tier}</Badge>
                         <span className="text-xs text-[var(--color-ink-muted)]">