sawbuck 0.1.11 → 0.1.13

package/GLOSSARY.md

@@ -32,7 +32,9 @@ two vocabularies.
 | what Sawbuck leaves you | **verified history** | the findings you can trust |
 | a surfaced past outcome | **finding** | |
 | mounting Sawbuck to a repo | **attach** / **cinch** | `sawbuck attach <repo>` |
-| reading the repo's shape | **fit** | history + config |
+| reading the repo's shape | **fit** | history + config; a concept, not a command (it is what `attach` reads to decide what it can measure) |
+| code still silenced in HEAD now | **debt** (suppression debt) | disabled/weakened tests + lint/type suppressions still live; `sawbuck debt` ranks it by severity and file fragility |
+| the one-view accumulation | **inventory** | `sawbuck status`: what it has caught over time + the debt accruing now + whether it is armed here |
 
 ## The one humility rule
 

package/README.md

@@ -31,6 +31,7 @@ sawbuck: gamed recorded on test.js       (the win came from editing the test, no
 
 - **Verifies the win.** `check` re-runs your metric from the source diff alone. A faked green (a deleted, weakened, or skipped test; a mocked grader; an edited golden file) reads `gamed`. Deterministic, zero-LLM, $0, and it cannot be obfuscated against because it never reads the trajectory (89% recall on a labeled gaming benchmark).
 - **Remembers what broke.** `context` and `rank` surface the relevant history (reverts, fragile areas, test-weakening) for the files you are touching: a ranked trail guide, before you act.
+- **Shows you everything.** `status` is the inventory: what it has caught for you over time, the debt accruing now, and whether it is armed here, in one view. On-demand, so it is quiet until you go looking.
 - **Rides on, does not replace.** Sawbuck is the verify + memory layer. Your agent and your loop stay yours.
 - **Clean on and off.** `attach` touches nothing in your worktree (the hook lives in `.git/`, the record is excluded locally); `detach` is a true inverse. `trace` shows every byte it placed, and `detach --verify` proves the repo came back unchanged.
 
@@ -43,11 +44,33 @@ sawbuck: gamed recorded on test.js       (the win came from editing the test, no
 | `sawbuck check [--base R --head R]` | verify a commit; record a regression or a gamed win |
 | `sawbuck context` · `sawbuck rank` | the ranked relevant history for the current change |
 | `sawbuck debt` | the whole-repo live suppression debt: what is still silenced in HEAD now, disabled tests first, heaviest files ranked |
+| `sawbuck status` · `sawbuck log` | the inventory (caught over time + debt now + armed state), in one view; and the recent per-check feed |
 | `sawbuck run --attempt '<agent cmd>'` | thin harness: load context, run one attempt through the keep-if-verified gate |
 | `sawbuck trace` · `sawbuck doctor` · `detach --verify` | show the footprint; check the attachment resolves; prove a clean removal |
 
 Each repo needs a `promptwheel.config.json` saying what to measure (your tests, lint, coverage, or an eval).
 
+## Gate debt on pull requests
+
+`sawbuck debt --since <base>` shows only the suppression debt a branch adds. Fail the build when a PR adds the kind you care about:
+
+```yaml
+# .github/workflows/debt.yml
+name: debt
+on: pull_request
+jobs:
+  debt:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with: { fetch-depth: 0 }   # the base ref must be present to diff against
+      - run: npx -y sawbuck debt --since "origin/${{ github.base_ref }}" --fail-on undocumented
+```
+
+`--fail-on` takes `undocumented` (a bare `# type: ignore` / `# noqa` with no code), `test` (a newly disabled test), `any`, or a number of new suppressions. Exit 1 fails the check; add `--json` for the machine-readable delta. This repo is also a composite action: `uses: sawbuck-ai/sawbuck@v0` with `base` and `fail-on` inputs.
+
+Debt also rises on its own: once attached, the per-turn `context` hook surfaces the live suppression debt on the files your agent is touching when it is the suspect kind (undocumented, a disabled test, or on code that keeps breaking), so you do not have to run anything.
+
 ## The engines
 
 Sawbuck is thin glue over two tools it depends on:

package/debt.mjs

@@ -26,6 +26,8 @@ const flag = (n, d) => { const i = process.argv.indexOf(n); return i > -1 ? (pro
 const repo = resolve(flag('--repo', process.cwd()));
 const top = Math.max(1, parseInt(flag('--top', '12'), 10) || 12);
 const since = flag('--since', null);
+const failRaw = flag('--fail-on', null); // undocumented | test | any | <N>; bare --fail-on = undocumented
+const failMode = failRaw === true ? 'undocumented' : (failRaw ? String(failRaw).toLowerCase() : null);
 const asJson = process.argv.includes('--json');
 
 // A disabled/skipped/weakened TEST is a hidden-failure risk; a lint/type/error suppression is
@@ -67,14 +69,21 @@ if (since && typeof since === 'string') {
   const norm = (s) => String(s).trim().replace(/\s+/g, ' ');
   const base = new Set(parseGrep(grepAt(since), since).map((r) => r.file + '\u0000' + norm(r.content)));
   const added = live.filter((it) => it.content && !base.has(it.file + '\u0000' + norm(it.content)));
-  if (asJson) { console.log(JSON.stringify({ since, added: added.length, testSkips: added.filter((it) => isTestSkip(it.kind)).length, undocumented: added.filter((it) => !it.documented).length, items: added.map((it) => ({ file: it.file, line: it.line, kind: String(it.kind).trim(), documented: it.documented })) }, null, 2)); process.exit(0); }
-  if (!added.length) { console.log(`🐴 sawbuck: no new suppression debt since ${since} (clean).`); process.exit(0); }
   const skips = added.filter((it) => isTestSkip(it.kind)).length, undoc = added.filter((it) => !it.documented).length;
+  // the gate: fail (exit 1) when the branch adds the kind of debt --fail-on names.
+  const fail = !failMode ? false
+    : /^\d+$/.test(failMode) ? added.length >= +failMode
+    : failMode === 'any' ? added.length > 0
+    : (failMode === 'test' || failMode === 'tests' || failMode === 'disabled') ? skips > 0
+    : undoc > 0; // default: undocumented
+  if (asJson) { console.log(JSON.stringify({ since, added: added.length, testSkips: skips, undocumented: undoc, failOn: failMode, fail, items: added.map((it) => ({ file: it.file, line: it.line, kind: String(it.kind).trim(), documented: it.documented })) }, null, 2)); process.exit(fail ? 1 : 0); }
+  if (!added.length) { console.log(`🐴 sawbuck: no new suppression debt since ${since} (clean).`); process.exit(0); }
   const o = [`🐴 sawbuck: ${added.length} new suppression${added.length === 1 ? '' : 's'} since ${since}  ·  ${skips} disabled test${skips === 1 ? '' : 's'}  ·  ${undoc} undocumented (no code/reason)`];
   for (const it of added.slice(0, Math.max(top, 20))) o.push(`     ${isTestSkip(it.kind) ? '🔴' : (it.documented ? '  ' : '✎ ')} ${it.file}:${it.line}  ${String(it.kind).trim()}${it.documented ? '' : '   (bare - no code/reason)'}`);
   o.push(`\n   ✎ = bare/undocumented (the suspect kind); declare intent (a rule code or reason) or remove it.`);
+  if (failMode) o.push(fail ? `\n   ❌ debt gate FAILED (--fail-on ${failMode}): this branch adds debt that must be declared or removed.` : `\n   ✓ debt gate passed (--fail-on ${failMode}).`);
   console.log(o.join('\n'));
-  process.exit(0);
+  process.exit(fail ? 1 : 0);
 }
 
 if (!live.length) { console.log(asJson ? '{"total":0,"testSkips":0,"codeSuppressions":0,"undocumented":0,"files":[]}' : '🐴 sawbuck: no live suppression debt in HEAD (nothing silenced in src/test/config). A clean tree.'); process.exit(0); }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sawbuck",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "Sign your agent to a contract so it does what you want: a deterministic, zero-LLM check that re-proves every win from the agent's source edits alone, so a green that came from editing the test is caught and reverted. A saddle for your coding harness.",
   "type": "module",
   "license": "MIT",
@@ -26,6 +26,7 @@
     "sawbuck-hook.mjs",
     "rank.mjs",
     "debt.mjs",
+    "status.mjs",
     "run.mjs",
     "README.md",
     "GLOSSARY.md",

package/rank.mjs

@@ -90,22 +90,57 @@ const normMult = (p, kind) => {
   return Math.max(0.4, Math.min(1, REF / b));
 };
 
+// Classify a live suppression MARKER (disabled test = hidden-failure risk) and its line as
+// DOCUMENTED (a rule code/reason follows) vs BARE (just the directive, the suspect kind). Same
+// splits `sawbuck debt` uses, so the ambient surface and the ledger agree.
+const isTestSkip = (m) => /\bit\.skip\b|\btest\.skip\b|xit\(|xdescribe\(|\bdescribe\.skip\b|pytest\.mark\.skip|unittest\.skip|\bt\.Skip\b|@Disabled\b|@Ignore\b|^\[Ignore\b|^Skip\s*=|^#\[ignore|markTestSkipped|markTestIncomplete/.test(String(m).trim());
+const isDocumented = (c) => {
+  c = String(c || '');
+  if (/eslint-disable/.test(c)) return /eslint-disable(?:-next-line|-line)?\s+\S/.test(c);
+  if (/@ts-ignore/.test(c)) return false;
+  if (/@ts-expect-error/.test(c)) return /@ts-expect-error\s+\S/.test(c);
+  if (/noqa/i.test(c)) return /noqa:\s*\w/i.test(c);
+  if (/type:\s*ignore/i.test(c)) return /ignore\s*\[/.test(c);
+  return /\(\s*["']/.test(c) || /=\s*["']/.test(c);
+};
+// The "slider": debt rises on its own, but gently. A disabled test or an undocumented suppression
+// on a touched file always surfaces; a file that is churning (hot / reverted) surfaces any debt;
+// a stable file's routine documented suppressions stay quiet until they pile past DEBT_MIN. Tune
+// with SAWBUCK_DEBT_MIN. This is how debt rises by itself in the per-turn context, no command run.
+const DEBT_MIN = Math.max(1, +(process.env.SAWBUCK_DEBT_MIN) || 6);
+
 // Still-live filter (lead #4). A suppression on a path that is now CLEAN of suppressions is churn,
 // not current risk (the study: AutoMapper carries 4 live `[Ignore]` vs ~158/repo across C# history).
 // logbook's own SUPPRESS_PAT, git-grepped at HEAD but SCOPED to just the touched paths so the
 // per-turn hook stays cheap, tells us which still carry one. Imported so the pattern never drifts;
 // degrades to "treat all as live" if logbook cannot be imported. --raw turns it off.
 let liveSet = null;
+const liveDebt = new Map(); // path -> { n, skips, bare }: live suppressions in HEAD, for ambient surfacing
 if (!raw && paths.length) {
   try {
-    const { SUPPRESS_PAT } = await import(pathToFileURL(LB).href);
+    const { SUPPRESS_PAT, kindAllowedInFile, isMention } = await import(pathToFileURL(LB).href);
     if (SUPPRESS_PAT && SUPPRESS_PAT.source) {
+      // -nP (content), still scoped to the touched paths, so we can both weight AND surface the debt.
       let grep = '';
-      try { grep = execFileSync('git', ['-C', repo, 'grep', '-lP', SUPPRESS_PAT.source, 'HEAD', '--', ...paths], { encoding: 'utf8' }); }
+      try { grep = execFileSync('git', ['-C', repo, 'grep', '-nP', SUPPRESS_PAT.source, 'HEAD', '--', ...paths], { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 }); }
       catch (e) { grep = (e.stdout || '').toString(); } // git grep exits 1 when nothing matches
-      liveSet = new Set(grep.split('\n').filter(Boolean).map((l) => l.replace(/^HEAD:/, '')));
+      liveSet = new Set();
+      for (const row of grep.split('\n')) {
+        const m = /^HEAD:(.+?):\d+:(.*)$/.exec(row); if (!m) continue;
+        const file = m[1], content = m[2];
+        const re = new RegExp(SUPPRESS_PAT.source, 'g'); let mm;
+        while ((mm = re.exec(content))) {
+          if (kindAllowedInFile && !kindAllowedInFile(mm[0], file)) continue; // gate exactly like audit
+          if (isMention && isMention(content, mm.index, mm[0])) continue;      // a comment ABOUT it is not live
+          liveSet.add(file);
+          const d = liveDebt.get(file) || { n: 0, skips: 0, bare: 0 };
+          d.n++;
+          if (isTestSkip(mm[0])) d.skips++; else if (!isDocumented(content)) d.bare++;
+          liveDebt.set(file, d);
+        }
+      }
     }
-  } catch { liveSet = null; } // logbook unavailable -> skip the filter, do not crash the read face
+  } catch { liveSet = null; liveDebt.clear(); } // logbook unavailable -> skip, do not crash the read face
 }
 // a suppression on a still-silenced path keeps its weight; on a now-clean path it is near-zero.
 const stillLive = (p) => (liveSet === null || liveSet.has(p) ? 1 : 0.25);
@@ -140,6 +175,20 @@ const ranked = paths.map((p) => {
   let burst = 0;
   for (let i = 0; i + 2 < fixDates.length; i++) if (fixDates[i + 2] - fixDates[i] <= 30 * DAY) { burst = fixDates.filter((x) => x >= fixDates[i] && x <= fixDates[i] + 30 * DAY).length; break; }
   if (burst >= 3) { score += 4; hits.unshift({ date: new Date(fixDates[fixDates.length - 1]).toISOString().slice(0, 10), kind: `HOT: ${burst} fixes in 30 days`, subject: 'this file was actively on fire, verify carefully', w: 99 }); }
+  // ambient debt: the live suppression debt on this file rises on its own when it is the suspect kind
+  // (a disabled test or an undocumented suppression), when the file is fragile (hot/reverted), or when
+  // it piles past the slider. Routine documented suppressions on stable files stay quiet. The score
+  // bump lets a file with ONLY debt (no history) surface at all; `sawbuck debt` is the full ledger.
+  const dbt = liveDebt.get(p);
+  if (dbt) {
+    const fragile = burst >= 3 || hits.some((h) => /revert/.test(h.kind || ''));
+    if (dbt.skips || dbt.bare || (fragile && dbt.n) || dbt.n >= DEBT_MIN) {
+      const extra = [dbt.skips ? `${dbt.skips} disabled test${dbt.skips === 1 ? '' : 's'}` : '', dbt.bare ? `${dbt.bare} undocumented` : ''].filter(Boolean).join(', ');
+      const w = dbt.skips ? 2.6 : (dbt.bare ? 2.2 : 1.4);
+      score += w;
+      hits.push({ kind: 'live debt here', subject: `${dbt.n} suppression${dbt.n === 1 ? '' : 's'} still silenced${extra ? ` (${extra})` : ''}; sawbuck debt for the ledger`, w });
+    }
+  }
   hits.sort((a, b) => b.w - a.w);
   return { path: p, score: +score.toFixed(2), top: hits.slice(0, 3), hot: burst >= 3 };
 }).filter((r) => r.score > 0).sort((a, b) => b.score - a.score).slice(0, top);

package/sawbuck.mjs

@@ -78,17 +78,18 @@ Usage:
   sawbuck doctor [repo]     Check attachments are healthy (hook still resolves to a live sawbuck); --all for every repo
   sawbuck where             List every repo Sawbuck is attached to
   sawbuck statusline        One-line segment for your status line (🐴 watching | N caught)
-  sawbuck status [repo]     Show the results receipt (what the check has caught)
+  sawbuck status [repo]     The inventory: everything it has accumulated here, in one view, caught
+                            over time + debt accruing now + whether it is armed. --json for the feed
   sawbuck log [repo] [-n N] Recent activity, newest first: every check (verified / gamed / regression)
   sawbuck check [repo]      Try it: verify your latest change right now (working tree if dirty, else the
                             last commit). Zero-config, no attach, no hook. The fastest way to see it work.
   sawbuck rank [--base R --head R] [--file P ...]
                             Show the relevant past findings for the paths a change touches
   sawbuck context [repo]    Ranked relevant history for your current working changes (the read face)
-  sawbuck debt [repo] [--since REF]
+  sawbuck debt [repo] [--since REF] [--fail-on undocumented|test|any|N]
                             The whole-repo live suppression debt: what is still silenced in HEAD now,
                             risk-ranked (severity x file fragility), undocumented flagged. --since REF
-                            shows only the debt a branch/PR adds vs REF
+                            shows only the debt a branch adds; --fail-on exits nonzero for a CI gate
   sawbuck run --attempt '<cmd>' [--loops N]
                             Thin harness: load context, run one attempt through the keep-if-verified gate
   sawbuck --help | --version
@@ -108,10 +109,10 @@ switch (cmd) {
     break;
   }
   case 'status': {
-    let o = '';
-    try { o = execFileSync(process.execPath, [join(HERE, 'dispatch.mjs'), '--repo', repoArg(), '--force'], { encoding: 'utf8' }); }
-    catch (e) { o = (e.stdout || '').toString(); }
-    out(o.trim() ? o : 'sawbuck: nothing recorded yet.');
+    // the inventory: one view unioning what the check has caught over time, what debt is accruing
+    // now, and whether it is armed here. The "show me everything" face.
+    try { execFileSync(process.execPath, [join(HERE, 'status.mjs'), '--repo', repoArg(), ...rest.filter((a) => a.startsWith('--'))], { stdio: 'inherit' }); }
+    catch (e) { process.exit(e.status || 1); }
     break;
   }
   case 'check': {

package/status.mjs

@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+// status.mjs, the inventory: one on-demand view of everything Sawbuck has accumulated for a repo.
+// Unions the three faces that are otherwise surfaced piecemeal: what it has CAUGHT for you over
+// time (the outcome record), what debt is ACCRUING right now (the live suppression ledger), and
+// whether it is ARMED here (what it can measure). The quiet per-turn faces stay quiet; this is the
+// "show me everything" face you run when you go looking.
+//
+// Read-only, zero-dep, bounded. The debt scan is best-effort (a pointer if it cannot run in time).
+// Usage: node status.mjs [--repo P] [--json]
+
+import { execFileSync } from 'node:child_process';
+import { readFileSync, existsSync } from 'node:fs';
+import { join, dirname, resolve, basename } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const flag = (n, d) => { const i = process.argv.indexOf(n); return i > -1 ? (process.argv[i + 1] ?? true) : d; };
+const repo = resolve(flag('--repo', process.cwd()));
+const asJson = process.argv.includes('--json');
+
+const readJSON = (p) => { try { return JSON.parse(readFileSync(p, 'utf8')); } catch { return null; } };
+const readLines = (p) => { try { return readFileSync(p, 'utf8').split('\n').filter(Boolean); } catch { return []; } };
+const git = (...a) => { try { return execFileSync('git', ['-C', repo, ...a], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim(); } catch { return ''; } };
+
+const ICON = { verified: '✓', gamed: '🚩', regression: '✗', inconclusive: '≈', allowed: '✎' };
+
+// --- 1) the outcome record: what the check has done here -------------------
+// results.json holds the all-time catch tally (gamed + regression, never trimmed); activity.jsonl is
+// the recent per-check feed (verified included, capped ~200). We read both and keep each honest.
+const results = readJSON(join(repo, '.sawbuck', 'results.json')) || {};
+const feed = readLines(join(repo, '.sawbuck', 'activity.jsonl')).map((l) => { try { return JSON.parse(l); } catch { return null; } }).filter(Boolean);
+const tally = { verified: 0, gamed: 0, regression: 0, inconclusive: 0, allowed: 0 };
+for (const e of feed) if (e && tally[e.kind] != null) tally[e.kind]++;
+const seen = feed.length;
+const catchesAllTime = (results.regressions || 0) + (results.gamed || 0);
+const latest = results.latest || (feed.length ? feed[feed.length - 1] : null);
+const since = feed.length ? (feed[0].at || '').slice(0, 10) : null;
+
+// --- 2) the armed state: what it can measure here (mirror of statusline) ---
+const isGit = !!existsSync(join(repo, '.git'));
+const hasConfig = existsSync(join(repo, 'promptwheel.config.json'));
+const watching = existsSync(join(repo, '.sawbuck', 'state.json'));
+const armed = hasConfig || existsSync(join(repo, 'package.json'));
+const mem = existsSync(join(repo, 'LOGBOOK.md')) || existsSync(join(repo, 'events.jsonl'));
+const state = watching ? 'watching' : armed ? 'ready' : mem ? 'memory' : 'unarmed';
+
+// --- 3) the live debt ledger: best-effort, bounded -------------------------
+// A full-repo HEAD grep + gating; fast on normal repos, can be heavy on a giant one. Bounded so
+// status never hangs; on timeout/failure it degrades to a pointer at `sawbuck debt`.
+let debt = null, debtErr = null;
+if (isGit) {
+  const ms = +(process.env.SAWBUCK_STATUS_DEBT_MS) || 20000;
+  try {
+    const o = execFileSync(process.execPath, [join(HERE, 'debt.mjs'), '--repo', repo, '--json'], { encoding: 'utf8', timeout: ms, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 64 * 1024 * 1024 });
+    debt = JSON.parse(o.slice(o.indexOf('{')));
+  } catch (e) { debtErr = e.killed ? 'timeout' : 'unavailable'; }
+}
+
+// --- JSON face -------------------------------------------------------------
+if (asJson) {
+  console.log(JSON.stringify({
+    repo: basename(repo),
+    state,
+    armed,
+    git: isGit,
+    config: hasConfig,
+    outcomes: { seen, caughtAllTime: catchesAllTime, gamedAllTime: results.gamed || 0, regressionsAllTime: results.regressions || 0, recent: tally, latest, since },
+    debt: debt ? { total: debt.total, testSkips: debt.testSkips, undocumented: debt.undocumented, filesOnFragileCode: debt.filesOnFragileCode, top: (debt.files || []).slice(0, 5) } : null,
+    debtError: debtErr,
+  }, null, 2));
+  process.exit(0);
+}
+
+// --- human face ------------------------------------------------------------
+const out = [];
+const stateLabel = { watching: 'watching (wired in)', ready: 'ready (checkable, not wired yet)', memory: 'memory only (history, no check configured)', unarmed: 'not a measurable repo yet' }[state];
+out.push(`🐴 sawbuck · ${basename(repo)}  ·  ${stateLabel}`);
+
+// Outcomes
+if (seen || catchesAllTime) {
+  out.push('');
+  out.push(`   Caught for you${seen ? `  ·  last ${seen} check${seen === 1 ? '' : 's'}` : ''}`);
+  if (seen) {
+    const parts = [
+      tally.verified ? `${ICON.verified} ${tally.verified} verified` : '',
+      tally.gamed ? `${ICON.gamed} ${tally.gamed} gamed` : '',
+      tally.regression ? `${ICON.regression} ${tally.regression} regression${tally.regression === 1 ? '' : 's'}` : '',
+      tally.inconclusive ? `${ICON.inconclusive} ${tally.inconclusive} inconclusive` : '',
+      tally.allowed ? `${ICON.allowed} ${tally.allowed} allowed` : '',
+    ].filter(Boolean).join('   ');
+    out.push(`     ${parts || 'no checks recorded yet'}`);
+  }
+  // the all-time catch count outlasts the 200-line window, so surface it when it is larger
+  if (catchesAllTime && catchesAllTime > (tally.gamed + tally.regression)) {
+    out.push(`     ${catchesAllTime} caught here all-time (${results.gamed || 0} gamed, ${results.regressions || 0} regression${(results.regressions || 0) === 1 ? '' : 's'})`);
+  }
+  if (latest) {
+    const k = latest.kind || '';
+    const when = (latest.at || '').slice(0, 10);
+    const why = String(latest.reason || '').replace(/^sawbuck:\s*/i, '').slice(0, 90);
+    out.push(`     latest: ${ICON[k] || '·'} ${k}${latest.file ? ` · ${latest.file}` : ''}${why ? ` · ${why}` : ''}${when ? `  (${when})` : ''}`);
+  }
+} else {
+  out.push('');
+  out.push(`   Caught for you  ·  nothing recorded yet (the check logs here on each commit/turn)`);
+}
+
+// Debt
+out.push('');
+if (debt && debt.total) {
+  out.push(`   Debt accruing now`);
+  out.push(`     ${debt.total} silenced in HEAD  ·  ${debt.testSkips} disabled test${debt.testSkips === 1 ? '' : 's'}  ·  ${debt.undocumented} undocumented (no code/reason)`);
+  for (const f of (debt.files || []).slice(0, 3)) {
+    const bits = [f.testSkips ? `${f.testSkips} test` : '', f.suppressions ? `${f.suppressions} lint/type${f.undocumented ? `, ${f.undocumented} bare` : ''}` : ''].filter(Boolean).join(' + ');
+    const frag = [f.reverts ? `${f.reverts} revert${f.reverts === 1 ? '' : 's'}` : '', f.hot ? 'fix-hotspot' : ''].filter(Boolean).join(', ');
+    out.push(`     ${f.reverts || f.hot ? '🔥 ' : '   '}${f.file}  ·  ${f.live} (${bits})${frag ? `  · ${frag}` : ''}  ·  risk ${f.risk}`);
+  }
+  out.push(`     → sawbuck debt for the full ledger`);
+} else if (debt) {
+  out.push(`   Debt accruing now  ·  none live in HEAD (nothing silenced in src/test/config). A clean tree.`);
+} else if (debtErr === 'timeout') {
+  out.push(`   Debt accruing now  ·  scan did not finish in time here (a large repo); run \`sawbuck debt\` directly.`);
+} else if (isGit) {
+  out.push(`   Debt accruing now  ·  could not read the ledger; run \`sawbuck debt\` for the detail.`);
+}
+
+// Measuring / next action
+out.push('');
+if (!isGit) {
+  out.push(`   Not a git repo here, so there is nothing to verify or remember. cd into your project.`);
+} else if (state === 'watching') {
+  out.push(`   Measuring here  ·  ${hasConfig ? '✓ wired in with a contract (promptwheel.config.json)' : '✓ wired in (zero-config auto-detect)'}. It verifies each commit/turn automatically.`);
+} else if (state === 'ready') {
+  out.push(`   Measuring here  ·  checkable but not wired yet. Try it now: \`sawbuck check\`  •  make it automatic: \`sawbuck attach --claude\``);
+} else {
+  out.push(`   Measuring here  ·  ${hasConfig ? 'a contract exists' : 'no test command detected yet'}. \`sawbuck init\` to set up the check, or \`sawbuck context\` for the history alone.`);
+}
+
+console.log(out.join('\n'));