skalpel 4.0.34 → 4.0.36

package/analytics.mjs

@@ -0,0 +1,622 @@
+#!/usr/bin/env node
+// analytics.mjs — `skalpel analytics`: an INTERACTIVE, keyboard-navigable, LOCAL analytics view.
+//
+// WHAT IT IS: one screen over the honest data skalpel already keeps on this machine — the caught
+// lies (verify-shadow.log FALSE rows), the MEASURED red→green cost (real timestamp deltas only),
+// the steer count, and the per-session re-ask trend — navigable with ↑/↓ (or j/k), Enter to drill
+// into a catch, Esc/h/Backspace to go back, q or Ctrl-C to quit.
+//
+// HARD RED LINES (same contract as ledger.mjs / card.mjs):
+//   • READ-ONLY + LOCAL + ZERO-NETWORK. Imports only node: core + local sibling modules (their CLI
+//     blocks are isMain-guarded, so importing runs nothing). Opens no socket, re-runs no proof,
+//     writes no file. It renders what is already on disk — nothing else.
+//   • NO FABRICATED / ESTIMATED NUMBERS. Every figure reproduces from a real logged row:
+//       - caught lies   = ledger FALSE rows (mismatch:true) in verify-shadow.log
+//       - measured cost = Σ of (later same-session same-proof PASS ts − caught-FALSE ts) — real
+//         timestamps via measureFixDelta; a catch with no later PASS contributes NOTHING
+//       - steers        = count of valid JSON lines in ~/.skalpel/steers.ndjson (the append-only
+//         STEERS SOURCE CONTRACT log; one atomic line per APPLIED steer) — a COUNT only; the banned
+//         "minutes saved" metric never appears
+//       - re-ask trend  = per-session counts of recorded re-ask/interrupt resets in
+//         ~/.skalpel/insights.ndjson (metrics.ndjson rows carry no session identity, so deriving a
+//         per-session series from them would be invention — we don't)
+//     Anything absent renders as an honest "no data yet" — never a made-up zero-padded trend.
+//   • NODE CORE ONLY. No npm dependency (no ink/blessed/chalk) — a new dep is itself a
+//     cross-device + supply-chain risk for a read-only stats viewer.
+//   • THE TERMINAL IS SACRED. Non-TTY (pipe/CI) prints a plain static snapshot and exits 0 without
+//     ever touching raw mode. Interactive mode uses the ALTERNATE screen (scrollback untouched) and
+//     ONE idempotent cleanup() — raw off, cursor shown, alt-screen left, listeners removed — that
+//     runs on EVERY exit path: q/Esc/Ctrl-C, 'exit', SIGINT/SIGTERM/SIGHUP, and any thrown error.
+//   • FAIL-OPEN. Any read/parse/render error → cleanup + one honest plain line + exit 0. Never a
+//     stack trace at the user, never a hung or broken terminal.
+import { readFileSync } from "node:fs";
+import { realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { emitKeypressEvents } from "node:readline";
+// READ-ONLY reuse of the honest engine. ledger.mjs derives everything from verify-shadow.log;
+// verify-shadow.mjs single-sources the log path + the fail-count extractor. Importing either runs
+// nothing (their CLI blocks are isMain-guarded).
+import { readLedgerRows, buildLedger, measureFixDelta, formatDuration } from "./ledger.mjs";
+import { VERIFY_LOG_PATH, extractFailCount } from "./verify-shadow.mjs";
+
+// ---------- palette (the same vocabulary as ledger.mjs / card.mjs / the statusline) ----------
+const R = "\x1b[38;2;233;38;31m"; // skalpel red
+const G = "\x1b[38;2;124;184;108m"; // success green
+const CYAN = "\x1b[36m";
+const BOLD = "\x1b[1m";
+const DIM = "\x1b[2m";
+const RESET = "\x1b[0m";
+
+const SKALPEL_DIR = join(homedir(), ".skalpel");
+const STEERS_PATH = join(SKALPEL_DIR, "steers.ndjson");
+const INSIGHTS_PATH = join(SKALPEL_DIR, "insights.ndjson");
+// Bound every read so a pathological file can never OOM us (same cap as card.mjs).
+const MAX_READ_BYTES = 4 * 1024 * 1024;
+const SPARK = "▁▂▃▄▅▆▇";
+
+// ---------- sanitize (claims/evidence come from captured agent output — never trust them) ----------
+// Strip ANSI CSI sequences + other C0 control chars so logged content can never inject its own
+// escape codes into the live terminal (same defense as card.mjs), then collapse whitespace and cap.
+export function clean(s, n) {
+  const t = String(s == null ? "" : s)
+    // eslint-disable-next-line no-control-regex
+    .replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, "")
+    // eslint-disable-next-line no-control-regex
+    .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, " ")
+    .replace(/\s+/g, " ")
+    .trim();
+  if (n && t.length > n) return t.slice(0, n - 1) + "…";
+  return t;
+}
+
+// ---------- (1) gather the four panels — every number derived from real local data ----------
+// Steers: the honest count from ~/.skalpel/steers.ndjson — the append-only STEERS SOURCE CONTRACT
+// log (see skalpel-hook.mjs): one atomic line per APPLIED steer, {"ts",saved_min_delta}, never
+// rewritten. This MIRRORS the merged skalpel-statusline.mjs readState() exactly: steers = count of
+// valid JSON lines (trim, skip blank/garbage, JSON.parse guard, must be a non-null object);
+// saved_min = Σ of finite positive saved_min_delta (rounded 1 dp). Readers MUST fail open
+// (absent/unreadable → {steers:0, saved_min:0}) and MUST NOT mutate the file. The whole file is
+// read for an EXACT count (the TUI renders on demand, not every terminal tick — no hot-path cost);
+// the try/catch fails open on a huge/corrupt file, so it never hangs. The banned "minutes saved"
+// metric is never displayed — savedMin is computed only to honor the contract, not shown.
+export function readSteersState(steersPath = STEERS_PATH) {
+  try {
+    const raw = readFileSync(steersPath, "utf8");
+    let steers = 0;
+    let savedMin = 0;
+    for (const line of raw.split("\n")) {
+      const l = line.trim();
+      if (!l) continue;
+      let rec;
+      try {
+        rec = JSON.parse(l);
+      } catch {
+        continue; // a partial/garbage line — skip it (fail-open), keep counting the rest
+      }
+      if (!rec || typeof rec !== "object") continue;
+      steers += 1; // one valid line == one applied steer (append-only ⇒ exact, race-free count)
+      if (Number.isFinite(rec.saved_min_delta) && rec.saved_min_delta > 0)
+        savedMin += rec.saved_min_delta;
+    }
+    return { steers, savedMin: Math.round(savedMin * 10) / 10 };
+  } catch {
+    return { steers: 0, savedMin: 0 }; // absent/unreadable → honest zero-state (fail-open)
+  }
+}
+
+// Re-ask trend: per-session counts of recorded re-ask/interrupt resets from insights.ndjson.
+// A `kind:"reset"` row is the hook's record of a REAL detected re-ask cascade ("we've gone back
+// and forth N× — resetting"), stamped with session_id. Sessions appear in file order (the file is
+// append-only, so first appearance == chronological order); a session with rows but no resets is
+// an honest 0. metrics.ndjson is NOT a fallback: its rows ({ts,event,outcome,ms}) carry no session
+// identity and no re-ask signal, so no per-session series can be derived from it without inventing
+// one. No usable rows → null (rendered "no data yet").
+const RE_ASK_KINDS = new Set(["reset", "re_ask", "reask", "re-ask", "interrupt"]);
+export function readReaskTrend(insightsPath = INSIGHTS_PATH) {
+  let raw;
+  try {
+    raw = readFileSync(insightsPath, "utf8");
+  } catch {
+    return null;
+  }
+  if (raw.length > MAX_READ_BYTES) raw = raw.slice(-MAX_READ_BYTES);
+  const order = [];
+  const bySession = new Map();
+  for (const line of raw.split("\n")) {
+    const l = line.trim();
+    if (!l) continue;
+    let r;
+    try {
+      r = JSON.parse(l);
+    } catch {
+      continue; // partial/garbage line — skip (fail-open)
+    }
+    const sid = typeof r?.session_id === "string" && r.session_id ? r.session_id : null;
+    if (!sid) continue; // no session identity → can't attribute honestly
+    if (!bySession.has(sid)) {
+      bySession.set(sid, { session: sid, count: 0, firstTs: r.ts || null });
+      order.push(sid);
+    }
+    if (RE_ASK_KINDS.has(r.kind)) bySession.get(sid).count += 1;
+  }
+  if (order.length === 0) return null;
+  return order.map((sid) => bySession.get(sid));
+}
+
+// spark(values) → a unicode sparkline, one glyph per value, scaled to the REAL max (0 → ▁).
+export function spark(values) {
+  const max = Math.max(...values, 0);
+  return values
+    .map((v) => {
+      if (max <= 0) return SPARK[0];
+      const idx = Math.min(SPARK.length - 1, Math.round((v / max) * (SPARK.length - 1)));
+      return SPARK[Math.max(0, idx)];
+    })
+    .join("");
+}
+
+// collectData() — one read-only pass over the local files. Every field is either a real derived
+// number or null ("no data yet"). Never throws (each source fails open independently).
+export function collectData({
+  logPath = process.env.SKALPEL_LEDGER_LOG || VERIFY_LOG_PATH,
+  steersPath = STEERS_PATH,
+  insightsPath = INSIGHTS_PATH,
+} = {}) {
+  let rows = null;
+  try {
+    rows = readLedgerRows(logPath);
+  } catch {
+    rows = null;
+  }
+  let ledger = null;
+  try {
+    ledger = rows == null ? null : buildLedger(rows);
+  } catch {
+    ledger = null;
+  }
+  // Caught lies, newest first (the navigable list). Sanitize once here — content is untrusted.
+  const catches = (ledger ? [...ledger.falseEntries] : []).reverse().map((e) => ({
+    ts: e.ts,
+    session: e.session,
+    claim_text: clean(e.claim_text, 2000),
+    proof_command: clean(e.proof_command, 400),
+    evidence: clean(e.evidence, 2000),
+    fail_count: e.fail_count,
+    fix_delta_ms: e.fix_delta_ms ?? measureFixDelta(e._row, rows || [])?.ms ?? null,
+    fixed_at: e.fixed_at ?? measureFixDelta(e._row, rows || [])?.atTs ?? null,
+  }));
+  // Measured cost: Σ of REAL red→green deltas. A catch with no later same-session same-proof PASS
+  // contributes NOTHING (never estimated).
+  let costMs = 0;
+  let costPairs = 0;
+  for (const c of catches) {
+    if (c.fix_delta_ms != null && Number.isFinite(c.fix_delta_ms)) {
+      costMs += c.fix_delta_ms;
+      costPairs += 1;
+    }
+  }
+  const { steers } = readSteersState(steersPath);
+  const trend = readReaskTrend(insightsPath);
+  return {
+    logPath,
+    ledger, // null → no verify-shadow.log yet
+    catches,
+    costMs,
+    costPairs,
+    unmeasured: catches.length - costPairs,
+    steers, // count of applied-steer lines in steers.ndjson (0 when absent — fail-open, never null)
+    trend, // null → no per-session insight rows
+    empty: ledger == null && !steers && trend == null,
+  };
+}
+
+// ---------- (2) panel text (shared by the static snapshot and the interactive view) ----------
+function costLine(data) {
+  if (data.ledger == null) return "no data yet";
+  if (data.catches.length === 0) return "0 — nothing to measure";
+  if (data.costPairs === 0)
+    return `no measured red→green pair yet — ${data.catches.length} caught, none re-passed its own proof later (count only, nothing estimated)`;
+  const dur = formatDuration(data.costMs) || "<1s";
+  const excl =
+    data.unmeasured > 0
+      ? ` · ${data.unmeasured} caught without a later PASS — excluded, never estimated`
+      : "";
+  return `${dur} measured red→green across ${data.costPairs} caught lie${data.costPairs === 1 ? "" : "s"} (real timestamps)${excl}`;
+}
+
+function steersLine(data) {
+  // steers is always a finite ≥0 count (steers.ndjson reader fails open to 0, never null), so this
+  // is honestly present even at "0 (count only)" — matching the statusline's always-on `N steers`.
+  return `${data.steers} (count only)`;
+}
+
+function trendLine(data, width) {
+  if (data.trend == null) return "no data yet";
+  const n = Math.max(1, Math.min(data.trend.length, Math.max(4, width)));
+  const last = data.trend.slice(-n);
+  const counts = last.map((s) => s.count);
+  const total = counts.reduce((a, b) => a + b, 0);
+  const max = Math.max(...counts, 0);
+  return `${spark(counts)}  ${total} re-ask reset${total === 1 ? "" : "s"} across last ${last.length} session${last.length === 1 ? "" : "s"} (max ${max}/session)`;
+}
+
+function catchesHeadline(data) {
+  if (data.ledger == null) return "no data yet";
+  const { checked, falseCount } = data.ledger;
+  return `${falseCount} verified FALSE · ${checked} done-claim${checked === 1 ? "" : "s"} checked`;
+}
+
+// ---------- (3) the static snapshot (non-TTY / raw-mode-unavailable path) — plain text ----------
+export function renderStatic(data) {
+  const L = [];
+  L.push("");
+  L.push("  🔬 skalpel analytics — local, read-only, derived from your own logs");
+  L.push("  " + "─".repeat(74));
+  if (data.empty) {
+    L.push("");
+    L.push('  nothing caught yet — keep coding, I\'ll log every "done" your agent claims.');
+    L.push("");
+    L.push("  Enable the shadow with SKALPEL_VERIFY_SHADOW=1; every completion claim gets its own");
+    L.push("  proof re-run and appended to the local ledger. Nothing here is ever estimated.");
+    L.push("");
+    return L.join("\n");
+  }
+  L.push(`  CAUGHT LIES     ${catchesHeadline(data)}`);
+  for (const c of data.catches.slice(0, 5)) {
+    const failN = c.fail_count != null ? ` (${c.fail_count} failing)` : "";
+    L.push(`    · "${clean(c.claim_text, 56)}" — $ ${clean(c.proof_command, 40)}${failN}`);
+  }
+  if (data.catches.length > 5) L.push(`    …and ${data.catches.length - 5} more`);
+  L.push(`  MEASURED COST   ${costLine(data)}`);
+  L.push(`  STEERS APPLIED  ${steersLine(data)}`);
+  L.push(`  RE-ASK TREND    ${trendLine(data, 24)}`);
+  L.push("  " + "─".repeat(74));
+  L.push(`  ledger: ${data.logPath}`);
+  L.push("");
+  return L.join("\n");
+}
+
+// ---------- (4) interactive rendering helpers ----------
+// Visible-width-aware clip that PRESERVES our own CSI sequences (content is already sanitized, so
+// any escape in the string is ours). Astral code points (e.g. 🔬) budget 2 cells. Always ends with
+// RESET when styling was present so a clipped line can never bleed style into the next.
+export function clipAnsi(line, max) {
+  const s = String(line);
+  let out = "";
+  let vis = 0;
+  let i = 0;
+  let hadEsc = false;
+  while (i < s.length) {
+    if (s[i] === "\x1b") {
+      const m = /^\x1b\[[0-9;?]*[ -/]*[@-~]/.exec(s.slice(i));
+      if (m) {
+        out += m[0];
+        hadEsc = true;
+        i += m[0].length;
+        continue;
+      }
+      i += 1; // stray ESC — drop it
+      continue;
+    }
+    const cp = s.codePointAt(i);
+    const ch = String.fromCodePoint(cp);
+    const w = cp > 0xffff ? 2 : 1;
+    if (vis + w > max) break;
+    out += ch;
+    vis += w;
+    i += ch.length;
+  }
+  return hadEsc ? out + RESET : out;
+}
+
+// Plain word-wrap (content is sanitized before wrapping; long words hard-split).
+function wrapText(text, width) {
+  const w = Math.max(4, width);
+  const out = [];
+  let cur = "";
+  for (let word of String(text).split(" ")) {
+    while (word.length > w) {
+      if (cur) {
+        out.push(cur);
+        cur = "";
+      }
+      out.push(word.slice(0, w));
+      word = word.slice(w);
+    }
+    if (!word) continue;
+    if (!cur) cur = word;
+    else if (cur.length + 1 + word.length <= w) cur += " " + word;
+    else {
+      out.push(cur);
+      cur = word;
+    }
+  }
+  if (cur) out.push(cur);
+  return out.length ? out : [""];
+}
+
+function listLines(data, cols, rows, state) {
+  const L = [];
+  L.push(`  ${BOLD}🔬 skalpel analytics${RESET} ${DIM}· local · read-only · your own logs${RESET}`);
+  L.push(`  ${DIM}${"─".repeat(Math.max(4, Math.min(74, cols - 4)))}${RESET}`);
+  if (data.empty) {
+    L.push("");
+    L.push(
+      `  ${BOLD}nothing caught yet${RESET} ${DIM}— keep coding, I'll log every "done" your agent claims.${RESET}`,
+    );
+    L.push("");
+    L.push(
+      `  ${DIM}Enable the shadow with ${RESET}${BOLD}SKALPEL_VERIFY_SHADOW=1${RESET}${DIM} — every completion claim gets its${RESET}`,
+    );
+    L.push(
+      `  ${DIM}own proof re-run and appended locally. Nothing here is ever estimated.${RESET}`,
+    );
+    L.push("");
+    L.push(`  ${DIM}q quit${RESET}`);
+    return L;
+  }
+  const headline =
+    data.ledger == null
+      ? `${DIM}no data yet${RESET}`
+      : `${R}${BOLD}${data.ledger.falseCount} verified FALSE${RESET} ${DIM}· ${data.ledger.checked} done-claims checked${RESET}`;
+  L.push(`  ${CYAN}${BOLD}CAUGHT LIES${RESET}     ${headline}`);
+  // The navigable list — window it so the selection is always visible.
+  const fixedBelow = 6; // cost + steers + trend + rule + footer + breathing room
+  const capacity = Math.max(0, rows - L.length - fixedBelow);
+  const n = data.catches.length;
+  const win = Math.min(capacity, n);
+  let start = 0;
+  if (win > 0) {
+    start = Math.min(Math.max(0, state.sel - win + 1), Math.max(0, n - win));
+    if (state.sel < start) start = state.sel;
+    for (let i = start; i < start + win; i++) {
+      const c = data.catches[i];
+      const sel = i === state.sel;
+      const failN = c.fail_count != null ? ` ${DIM}(${c.fail_count} failing)${RESET}` : "";
+      const mark = sel ? `${R}▸${RESET}` : " ";
+      const claim = clean(c.claim_text, Math.max(12, Math.floor(cols * 0.45)));
+      const proof = clean(c.proof_command, Math.max(8, Math.floor(cols * 0.3)));
+      const body = `"${claim}" ${DIM}· $${RESET} ${proof}${failN}`;
+      L.push(`   ${mark} ${sel ? BOLD : ""}${body}${RESET}`);
+    }
+    if (start + win < n) L.push(`     ${DIM}…and ${n - start - win} more (↓)${RESET}`);
+  } else if (n > 0) {
+    L.push(`     ${DIM}${n} caught — terminal too small to list; drill with Enter${RESET}`);
+  }
+  L.push(`  ${CYAN}${BOLD}MEASURED COST${RESET}   ${DIM}${costLine(data)}${RESET}`);
+  L.push(`  ${CYAN}${BOLD}STEERS APPLIED${RESET}  ${DIM}${steersLine(data)}${RESET}`);
+  L.push(`  ${CYAN}${BOLD}RE-ASK TREND${RESET}    ${trendLine(data, Math.max(4, cols - 46))}`);
+  L.push(`  ${DIM}${"─".repeat(Math.max(4, Math.min(74, cols - 4)))}${RESET}`);
+  L.push(`  ${DIM}↑/↓ j/k move · Enter details · q quit${RESET}`);
+  return L;
+}
+
+function detailLines(data, cols, state) {
+  const c = data.catches[state.sel];
+  const L = [];
+  L.push(
+    `  ${BOLD}🔬 skalpel analytics${RESET} ${DIM}· caught lie ${state.sel + 1} of ${data.catches.length}${RESET}`,
+  );
+  L.push(`  ${DIM}${"─".repeat(Math.max(4, Math.min(74, cols - 4)))}${RESET}`);
+  if (!c) {
+    L.push(`  ${DIM}nothing selected${RESET}`);
+    L.push(`  ${DIM}Esc back · q quit${RESET}`);
+    return L;
+  }
+  const width = Math.max(10, cols - 6);
+  L.push(`  ${DIM}the agent claimed:${RESET}`);
+  for (const w of wrapText(`"${c.claim_text}"`, width)) L.push(`    ${BOLD}${w}${RESET}`);
+  L.push("");
+  L.push(`  ${DIM}its own proof, re-run out-of-band:${RESET}`);
+  for (const w of wrapText(`$ ${c.proof_command || "(none recorded)"}`, width)) L.push(`    ${w}`);
+  const failN = extractFailCount(c.evidence);
+  L.push(
+    `    ${R}${BOLD}→ FAIL${RESET}${failN != null ? ` ${DIM}· ${failN} failing${RESET}` : ""}`,
+  );
+  if (c.evidence) {
+    L.push("");
+    L.push(`  ${DIM}real output:${RESET}`);
+    for (const w of wrapText(c.evidence, width).slice(0, 6)) L.push(`    ${DIM}${w}${RESET}`);
+  }
+  L.push("");
+  L.push(`  ${DIM}claimed FALSE at${RESET}  ${c.ts || "unknown"}`);
+  if (c.fixed_at != null) {
+    const dur = formatDuration(c.fix_delta_ms);
+    L.push(
+      `  ${DIM}same proof PASSED${RESET} ${c.fixed_at}${dur ? ` ${G}· ${dur} later (measured, real timestamps)${RESET}` : ""}`,
+    );
+  } else {
+    L.push(`  ${DIM}no later PASS logged for this proof — count only, no time estimated.${RESET}`);
+  }
+  if (c.session) L.push(`  ${DIM}session${RESET}         ${DIM}${clean(c.session, 60)}${RESET}`);
+  L.push(`  ${DIM}${"─".repeat(Math.max(4, Math.min(74, cols - 4)))}${RESET}`);
+  L.push(`  ${DIM}j/k scroll · Esc/h back · q quit${RESET}`);
+  return L;
+}
+
+// ---------- (5) the interactive loop — event-driven only, terminal always restored ----------
+function runInteractive(data) {
+  const state = { view: "list", sel: 0, scroll: 0 };
+  let cleaned = false;
+  let pendingDraw = null;
+
+  // ONE cleanup, idempotent, never throws — every exit path funnels through it.
+  const cleanup = () => {
+    if (cleaned) return;
+    cleaned = true;
+    try {
+      if (pendingDraw) clearImmediate(pendingDraw);
+    } catch {
+      /* never throw from cleanup */
+    }
+    try {
+      if (process.stdin.isTTY) process.stdin.setRawMode(false);
+    } catch {
+      /* raw mode already off / stdin gone */
+    }
+    try {
+      process.stdout.write("\x1b[?25h\x1b[?1049l"); // show cursor + leave the alternate screen
+    } catch {
+      /* stdout gone — nothing to restore onto */
+    }
+    try {
+      process.stdin.removeAllListeners("keypress");
+      process.stdout.removeAllListeners("resize");
+      process.removeAllListeners("SIGWINCH");
+      process.removeAllListeners("SIGINT");
+      process.removeAllListeners("SIGTERM");
+      process.removeAllListeners("SIGHUP");
+      process.stdin.pause();
+    } catch {
+      /* best-effort */
+    }
+  };
+
+  const die = (msg) => {
+    cleanup();
+    try {
+      process.stdout.write(`${msg}\n`);
+    } catch {
+      /* nothing left to say it to */
+    }
+    process.exit(0);
+  };
+
+  // Raw mode inside try/catch — if the terminal can't do it, fall back to the static snapshot.
+  try {
+    process.stdin.setRawMode(true);
+  } catch {
+    process.stdout.write(renderStatic(data) + "\n");
+    process.exit(0);
+  }
+
+  try {
+    process.on("exit", cleanup); // the backstop: no exit path escapes restoration
+    for (const sig of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+      process.on(sig, () => {
+        cleanup();
+        process.exit(0);
+      });
+    }
+    process.on("uncaughtException", () => die("skalpel analytics — could not render analytics"));
+    process.on("unhandledRejection", () => die("skalpel analytics — could not render analytics"));
+
+    process.stdout.write("\x1b[?1049h\x1b[?25l"); // alternate screen + hidden cursor
+
+    const draw = () => {
+      try {
+        const cols = Math.max(10, process.stdout.columns || 80);
+        const rowsN = Math.max(3, process.stdout.rows || 24);
+        const lines =
+          state.view === "detail"
+            ? detailLines(data, cols, state)
+            : listLines(data, cols, rowsN, state);
+        // Detail view scrolls when taller than the terminal (keep the footer reachable).
+        let visible = lines;
+        if (state.view === "detail" && lines.length > rowsN) {
+          const maxScroll = lines.length - rowsN;
+          state.scroll = Math.min(Math.max(0, state.scroll), maxScroll);
+          visible = lines.slice(state.scroll, state.scroll + rowsN);
+        } else {
+          visible = lines.slice(0, rowsN);
+        }
+        const body = visible.map((l) => clipAnsi(l, cols - 1)).join("\r\n");
+        process.stdout.write("\x1b[H\x1b[2J" + body);
+      } catch {
+        die("skalpel analytics — could not render analytics");
+      }
+    };
+
+    // Coalesce resize bursts through ONE unref'd immediate — event-driven, never a poll loop.
+    const scheduleDraw = () => {
+      if (pendingDraw) return;
+      pendingDraw = setImmediate(() => {
+        pendingDraw = null;
+        draw();
+      });
+      if (pendingDraw && typeof pendingDraw.unref === "function") pendingDraw.unref();
+    };
+
+    emitKeypressEvents(process.stdin);
+    process.stdin.resume();
+    process.stdin.on("keypress", (str, key) => {
+      try {
+        const k = key || {};
+        const name = k.name || str || "";
+        if ((k.ctrl && name === "c") || name === "q") {
+          cleanup();
+          process.exit(0);
+        }
+        if (state.view === "list") {
+          if (name === "up" || name === "k") state.sel = Math.max(0, state.sel - 1);
+          else if (name === "down" || name === "j")
+            state.sel = Math.min(Math.max(0, data.catches.length - 1), state.sel + 1);
+          else if (name === "return" || name === "enter") {
+            if (data.catches.length > 0) {
+              state.view = "detail";
+              state.scroll = 0;
+            }
+          } else if (name === "escape") {
+            cleanup();
+            process.exit(0);
+          }
+        } else {
+          if (name === "escape" || name === "backspace" || name === "h") {
+            state.view = "list";
+            state.scroll = 0;
+          } else if (name === "up" || name === "k") state.scroll = Math.max(0, state.scroll - 1);
+          else if (name === "down" || name === "j") state.scroll += 1; // clamped in draw()
+        }
+        scheduleDraw();
+      } catch {
+        die("skalpel analytics — could not render analytics");
+      }
+    });
+    process.stdout.on("resize", scheduleDraw); // node's SIGWINCH surface
+    process.on("SIGWINCH", scheduleDraw); // belt-and-suspenders (no-op where unsupported)
+
+    draw();
+  } catch {
+    die("skalpel analytics — could not render analytics");
+  }
+}
+
+// ---------- CLI ----------
+const isMain = (() => {
+  try {
+    return (
+      Boolean(process.argv[1]) &&
+      realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))
+    );
+  } catch {
+    return false;
+  }
+})();
+
+if (isMain) {
+  let data;
+  try {
+    data = collectData();
+  } catch {
+    process.stdout.write("\nskalpel analytics — no data yet\n\n");
+    process.exit(0);
+  }
+  // NON-TTY DEGRADE (pipes, CI, dumb harnesses): plain static snapshot, exit 0, raw mode untouched.
+  if (!process.stdout.isTTY || !process.stdin.isTTY) {
+    try {
+      process.stdout.write(renderStatic(data) + "\n");
+    } catch {
+      /* a closed pipe still exits 0 */
+    }
+    process.exit(0);
+  }
+  // A totally-fresh machine has nothing to navigate — print the honest empty screen and exit clean
+  // rather than opening an interactive view over four "no data yet" panels.
+  if (data.empty) {
+    process.stdout.write(renderStatic(data) + "\n");
+    process.exit(0);
+  }
+  runInteractive(data);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skalpel",
-  "version": "4.0.34",
+  "version": "4.0.36",
   "description": "Behavioral graph for AI-assisted coding — learns how you work and steers Claude Code + Codex in real time.",
   "type": "module",
   "bin": {

package/skalpel-hook.mjs

@@ -146,6 +146,43 @@ function writePending(obj) {
   }
 }
 
+// ALWAYS-ON PRESENCE tally — the honest lifetime record the statusline reads for its baseline line.
+// Concept is Raahil's (#609): steers = count of steers ACTUALLY applied (fired AND not suppressed) across
+// all sessions; saved_min = Σ, over those applied steers, of the user's OWN median cost of one loop of
+// that steer's work-type (the server's `median_loop_min`, from the causal graph's sink/loop stats). It is
+// NEVER a server wall-clock estimate; when the server has no median (null) we credit NOTHING.
+//
+// RACE-FREE by construction (audit Finding 2 — a read-modify-write single-counter loses increments under
+// concurrent hook double-fires; metrics.mjs's own comment warns the same). So this is an APPEND-ONLY log:
+// ONE atomic `appendFileSync` line per applied steer. POSIX guarantees a single small append is atomic, so
+// N concurrent applied-steer writes yield exactly N lines (0 loss). No read, no tmp, no rename, no mutated
+// counter. Same idiom as metrics.ndjson / insights.ndjson.
+//
+// ── STEERS SOURCE CONTRACT (the source of truth for the statusline baseline AND #620's analytics TUI) ──
+//   file  : ~/.skalpel/steers.ndjson   (append-only; one line per APPLIED steer; never rewritten/trimmed)
+//   line  : {"ts": <epoch ms>, "saved_min_delta": <number ≥ 0>}
+//             ts              = Date.now() when the steer was applied.
+//             saved_min_delta = the median_loop_min credited for THIS steer (≥ 0; 0 when the server sent
+//                               no positive median — never fabricated).
+//   derive: steers    = count of valid JSON lines (one line == one applied steer).
+//           saved_min = Σ saved_min_delta over valid lines (round to 1 dp; garbage/partial lines skipped).
+//   Readers MUST fail open (unreadable/absent → {steers:0, saved_min:0}) and MUST NOT mutate this file.
+const STATE_LOG_PATH = join(homedir(), ".skalpel", "steers.ndjson");
+function bumpState(medianMin) {
+  try {
+    // credit ONLY a real, positive median from the server; null/NaN/<=0 → 0 credit (no fabrication).
+    const savedMinDelta = Number.isFinite(medianMin) && medianMin > 0 ? medianMin : 0;
+    mkdirSync(join(homedir(), ".skalpel"), { recursive: true });
+    // ONE atomic append == ONE applied steer. Race-free (never a read-modify-write of a counter).
+    appendFileSync(
+      STATE_LOG_PATH,
+      JSON.stringify({ ts: Date.now(), saved_min_delta: savedMinDelta }) + "\n",
+    );
+  } catch {
+    /* the presence tally is a bonus; never block the hook */
+  }
+}
+
 // STEER label — the statusline reads this so the user SEES skalpel steering LIVE, every turn a steer
 // injects, INDEPENDENT of whether the model surfaces a 🔬 line (the deterministic awareness channel).
 // A one-glance 2-word label derived from the top injected steer type. Overwritten each turn.
@@ -559,6 +596,7 @@ async function main() {
   let steerType = null; // raw top-steer type (TELL/SINK/…) — for the feedback loop + session log
   let steerWt = null; // the work-type the steer is about (refine/debug/…)
   let brokeOut = false; // behavioral-only: did expected-waste-ahead drop after last turn's steer (adherence)
+  let medianLoopMin = null; // server's per-work-type median loop cost (min) — the ONLY input to "saved"
 
   if (!authNote) {
     const remaining = deadline - Date.now();
@@ -596,6 +634,14 @@ async function main() {
         steerLabel = j?.steer_label; // surfaced on the statusline (written once below, with any credit)
         steerType = j?.steer_type || null;
         steerWt = j?.steer_wt || (j?.entry ? String(j.entry).split("/")[0] : null);
+        // the user's OWN median cost of one loop of this steer's work-type (from the graph's sink stats).
+        // The ONLY quantity we ever turn into "saved" minutes, and only for an APPLIED steer (below).
+        medianLoopMin =
+          typeof j?.median_loop_min === "number" &&
+          isFinite(j.median_loop_min) &&
+          j.median_loop_min > 0
+            ? j.median_loop_min
+            : null;
         if (j?.entry) pushTraj(String(j.entry).split("/")[0]); // remember this turn's work-type
         dbg(`  -> sim=${j?.top_sim ?? "?"} ${injection ? "INJECT" : "silent"}`);
 
@@ -693,6 +739,9 @@ async function main() {
   const steerId = injection ? String(Date.now()) : null;
   writeSteer(steerLabel, steerType, steerWt, steerId);
   if (injection) logSessionEvent({ type: steerType, wt: steerWt }); // feed the end-of-session recap
+  // ALWAYS-ON presence tally: a steer was APPLIED this turn (fired + survived suppression). Count it,
+  // and credit its honest median-loop cost ONLY when the server sent a real number (null -> +0).
+  if (injection) bumpState(medianLoopMin);
 
   // LOCAL INSIGHT RECORDS (~/.skalpel/insights.ndjson) — one plain-English row per note kind that
   // fired this turn, post-suppression (a muted/suppressed steer writes nothing). recordInsight

package/skalpel-setup.mjs

@@ -64,6 +64,7 @@ const KNOWN_SUBS = new Set([
   "catches",
   "card",
   "ledger",
+  "analytics",
   "__build",
   "__verify-report",
 ]);
@@ -81,6 +82,7 @@ usage:
   skalpel catches                               scan your own history for "done" claims over failing tests
   skalpel card [--last|--id <id>] [--md]        share one verified catch: the claim + its own failing proof
   skalpel ledger                                your running tally: N "done"s checked, M verified FALSE
+  skalpel analytics                             interactive local analytics — caught lies, measured cost, steers, re-asks
   skalpel uninstall [--purge]                   remove the hooks + local data from this machine
 
 options:
@@ -906,6 +908,14 @@ async function main() {
     spawnSync("node", [join(__dir, "ledger.mjs"), ...argv.slice(1)], { stdio: "inherit" });
     return;
   }
+  // `skalpel analytics` — INTERACTIVE LOCAL ANALYTICS: a keyboard-navigable, READ-ONLY terminal view
+  // derived from the same honest local data as `skalpel ledger` (verify-shadow.log + steers.ndjson +
+  // insights.ndjson). Zero network, zero writes, zero estimates. Degrades to a plain static snapshot
+  // when stdin/stdout isn't a TTY, and restores the terminal on every exit path.
+  if (sub === "analytics") {
+    spawnSync("node", [join(__dir, "analytics.mjs"), ...argv.slice(1)], { stdio: "inherit" });
+    return;
+  }
   // `skalpel __verify-report` — the claim-verification SHADOW instrument: reads the local
   // verify-shadow.log and prints the three numbers (claim fire-rate, proof-reconstruction rate, and the
   // headline MISMATCH rate = how often the agent claimed done but its OWN proof, re-run, failed).

package/skalpel-statusline.mjs

@@ -1,12 +1,31 @@
 #!/usr/bin/env node
-// skalpel statusline — COUNT-OR-NOTHING. Prints ONLY facts that reproduce from local state, never an
-// estimate dressed up as a measurement. There is no "~Xh saved" and no "+min this turn": those were a
-// SERVER estimate of expected-waste (never a measured clock), so they are gone. What can honestly show:
+// skalpel statusline — HONEST-OR-NOTHING. Prints only facts grounded in local state, never a server
+// estimate dressed up as a measurement. In priority order (highest first):
+//   • the AHA CATCH reveal — agent claimed done, its OWN proof re-run GENUINELY failed (opt-in,
+//     SKALPEL_VERIFY_REVEAL; dark by default → byte-identical to the always-on baseline when off); else
+//   • the green "✓ verified" stamp — that same proof re-run really PASSED (same opt-in flag); else
 //   • the live re-ask/interrupt COUNT for THIS session, read straight from the transcript Claude Code
 //     hands us on stdin — the exact material `skalpel autopsy` re-derives from disk, a count of things
-//     that verifiably happened, or
-//   • the current steer's plain-English label (what skalpel is doing now) — a description, not a number.
-// A clean session prints NOTHING. Fail-open: any error → print nothing, exit 0. Never blocks the bar.
+//     that verifiably happened; else
+//   • the current steer's plain-English label (what skalpel is doing now) — a description, not a number;
+//     else
+//   • the ALWAYS-ON presence line, "skalpel · N steers[ · <time clause>]".
+//     N = steers ACTUALLY applied (fired + not suppressed), counted from the append-only
+//     ~/.skalpel/steers.ndjson — a fresh install reads "0 steers", present, never blank. The optional
+//     TIME clause is chosen by BASELINE_TIME_MODE (Ryan flips one constant):
+//       · <Xm> caught — the CUMULATIVE LIFETIME sum of every real MEASURED red→green delta (each caught
+//         false "done" and the moment that SAME proof, that SAME session, was later logged PASS — real
+//         timestamps; reuses ledger.mjs's measureFixDelta logic). ALWAYS-ON once real catches exist (it is
+//         skalpel's terminal presence — never gated/hidden). A measured total, NEVER an estimate; a catch
+//         with no later PASS adds 0. Cumulative framing (not present-tense) keeps it honest for old data.
+//       · ~Xm saved — Raahil's #609 estimate: (applied steers) × (the user's OWN median loop cost from
+//         their causal graph). A `~`-prefixed ESTIMATE grounded in their own data, shown only when
+//         saved_min > 0. Never a server wall-clock number; never "skalpel saved you X" as a fact.
+// Every value here is a real count or a real measured timestamp delta (or a clearly `~`-marked estimate).
+// NOTE: this always-on presence line is a DELIBERATE new behavior — origin/main's clean-idle bar emitted
+// ZERO bytes; this emits "skalpel · 0 steers" (Ryan: always-on presence, non-negotiable). Byte-identical
+// to origin/main is preserved ONLY for the untouched reveal / verdict / re-ask surfaces, not clean-idle.
+// Fail-open: any error → print nothing (or just the presence line), exit 0. Never blocks the bar.
 import { readFileSync, rmSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -19,16 +38,34 @@ const BOLD = "\x1b[1m";
 const DIM = "\x1b[2m";
 const RESET = "\x1b[0m";
 
+// ── RENDER MODE — the ONE constant Ryan flips. Governs the optional TIME clause on the always-on
+// `skalpel · N steers` baseline. The steers count + Raahil's #609 BOLD/CYAN styling are ALWAYS present,
+// unchanged, in every mode. Nothing else on the bar (reveal / verdict / re-ask / steer label) is affected.
+//   "steers"   → skalpel · N steers
+//   "measured" → skalpel · N steers · 38m caught          (DEFAULT — cumulative lifetime MEASURED red→green)
+//   "saved"    → skalpel · N steers · ~7m saved           (Raahil's own-graph ESTIMATE, from steers.ndjson)
+//   "both"     → skalpel · N steers · 38m caught · ~7m saved
+const BASELINE_TIME_MODE = "measured";
+const SHOW_MEASURED = BASELINE_TIME_MODE === "measured" || BASELINE_TIME_MODE === "both";
+const SHOW_SAVED = BASELINE_TIME_MODE === "saved" || BASELINE_TIME_MODE === "both";
+
 // AHA CATCH REVEAL — how long a fresh catch stays on the bar before it auto-clears (so it never
 // wallpapers). verify-shadow.mjs writes the reveal the moment a GENUINE_FAIL mismatch is re-run; it also
 // retracts it if a later proof re-run PASSES. This TTL covers the abandoned case (user moved on).
 const REVEAL_TTL_MS = 90_000;
 // LIVE VERDICT green stamp — the earned "✓ verified" written on a clean PASS. DELIBERATELY short-lived:
 // it flashes right after the claim, then recedes so a stream of greens stays ambient (quiet trust) and
-// never competes with the loud red catch. Short TTL is the whole point — a green that lingers is clutter;
-// a green that blinks by, turn after turn, is what makes the rare red land like a thunderclap.
+// never competes with the loud red catch. Short TTL is the whole point — a green that lingers is clutter.
 const VERDICT_TTL_MS = 20_000;
 
+// The verify-shadow log the measured clause reads. Defined LOCALLY (not imported from verify-shadow.mjs)
+// on purpose: this runs on EVERY bar render, so it must not pull that module's heavy (child_process /
+// probe) import graph onto the hot path — it only READS the file verify-shadow.mjs owns. verify-shadow.mjs
+// self-trims the log to ~1MB/500 lines, so this bounded tail reads the whole retained log in practice
+// while staying safe against a pathological huge file (a bounded read can only UNDERCOUNT, never overstate).
+const VERIFY_LOG_PATH = join(homedir(), ".skalpel", "verify-shadow.log");
+const SHADOW_READ_BYTES = 1024 * 1024;
+
 // Claude Code pipes a JSON status payload on stdin (transcript_path, session_id, …). Read it ONLY when
 // stdin is actually piped — never block on a TTY (manual invocation) where reading fd 0 would hang.
 function readPayload() {
@@ -101,7 +138,7 @@ function steerLabel() {
 // The opt-in AHA CATCH: read the reveal state file verify-shadow.mjs wrote. Returns the plain reveal
 // line (fresh + honest — the statusline never invents it, it only renders what the re-run recorded) or
 // null. Auto-clears when stale (past the TTL) so an old catch can't wallpaper the bar. GATED entirely on
-// SKALPEL_VERIFY_REVEAL: when off, this is never called and the bar is byte-identical to the original.
+// SKALPEL_VERIFY_REVEAL: when off, this is never called and the bar is byte-identical to the baseline.
 function revealNote() {
   try {
     const r = JSON.parse(readFileSync(REVEAL_PATH, "utf8"));
@@ -125,7 +162,7 @@ function revealNote() {
 // The LIVE VERDICT green stamp: read the verdict state verify-shadow.mjs wrote on a clean PASS. Returns
 // the plain "✓ verified" line (fresh + honest — the statusline never invents it, it only renders what the
 // re-run recorded) or null. Auto-clears past its short TTL so a stale green never lingers. GATED entirely
-// on SKALPEL_VERIFY_REVEAL: when off, this is never called and the bar is byte-identical to the original.
+// on SKALPEL_VERIFY_REVEAL: when off, this is never called and the bar is byte-identical to the baseline.
 function verdictNote() {
   try {
     const r = JSON.parse(readFileSync(VERDICT_PATH, "utf8"));
@@ -146,21 +183,148 @@ function verdictNote() {
   }
 }
 
-async function main() {
+// The always-on presence tally — derived from ~/.skalpel/steers.ndjson, the APPEND-ONLY log the hook
+// writes (one atomic line per APPLIED steer; see the STEERS SOURCE CONTRACT in skalpel-hook.mjs). This is
+// the RACE-FREE replacement for the old mutated state.json counter (audit Finding 2): steers = the count
+// of valid lines, saved_min = Σ saved_min_delta. Defaults to zeros so the baseline line is never blank;
+// garbage/partial lines are skipped; the sum only ever adds ≥0 deltas, so it is honest and never negative.
+function readState() {
+  try {
+    const raw = readFileSync(join(homedir(), ".skalpel", "steers.ndjson"), "utf8");
+    let steers = 0;
+    let savedMin = 0;
+    for (const line of raw.split("\n")) {
+      const l = line.trim();
+      if (!l) continue;
+      let rec;
+      try {
+        rec = JSON.parse(l);
+      } catch {
+        continue; // a partial/garbage line — skip it (fail-open), keep counting the rest
+      }
+      if (!rec || typeof rec !== "object") continue;
+      steers += 1; // one valid line == one applied steer (append-only ⇒ exact, race-free count)
+      if (Number.isFinite(rec.saved_min_delta) && rec.saved_min_delta > 0)
+        savedMin += rec.saved_min_delta;
+    }
+    return { steers, savedMin: Math.round(savedMin * 10) / 10 };
+  } catch {
+    return { steers: 0, savedMin: 0 }; // absent/unreadable → honest zero-state (fail-open)
+  }
+}
+
+// The `~`-prefixed saved ESTIMATE, or null when there's no real credit (never show a fake/zero number).
+// Minutes below an hour render as ~Xm; an hour or more as ~Xh (one decimal, trimmed of a trailing .0).
+// [Raahil #609 — preserved verbatim so the "saved"/"both" modes match his line byte-for-byte.]
+function savedPhrase(min) {
+  if (!(min > 0)) return null;
+  if (min >= 60) {
+    const h = min / 60;
+    const s = h >= 10 ? String(Math.round(h)) : h.toFixed(1).replace(/\.0$/, "");
+    return `~${s}h saved`;
+  }
+  return `~${Math.round(min)}m saved`;
+}
+
+// ── MEASURED red→green delta (real timestamps only — the honest replacement for the banned "~Xh saved").
+// tsMs + measureFixDelta are the EXACT logic from ledger.mjs, replicated here (not imported) so the hot
+// statusline path never pulls verify-shadow.mjs's heavy graph. Parse an ISO ts to epoch ms, or null.
+function tsMs(ts) {
+  if (typeof ts !== "string") return null;
+  const n = Date.parse(ts);
+  return Number.isFinite(n) ? n : null;
+}
+
+// measureFixDelta(falseRow, rows) → { ms, atTs } for the EARLIEST later row that is, in the SAME session,
+// the SAME proof_command, and a genuine PASS whose timestamp is strictly after the caught-false claim.
+// That is the real moment the false "done" became a true "done": the exact proof that failed later passed.
+// Returns null when no such row exists (then we show NO time — never an invented minute). [ledger.mjs]
+function measureFixDelta(falseRow, rows) {
+  const t0 = tsMs(falseRow.ts);
+  if (t0 == null) return null;
+  const session = falseRow.session ?? null;
+  // Finding 3: a REAL session id is required to tie a fix to a claim. With a null session, the
+  // `(r.session ?? null) !== session` guard below would treat every OTHER null-session row as
+  // "same session" and cross-attribute a bogus delta — so refuse to measure when session is null.
+  if (session == null) return null;
+  const proof = falseRow.proof_command || null;
+  if (!proof) return null; // can't tie a fix to a claim with no proof — count only
+  let best = null;
+  for (const r of rows) {
+    if (r === falseRow) continue;
+    if ((r.session ?? null) !== session) continue;
+    if ((r.proof_command || null) !== proof) continue;
+    if (r.outcome !== "PASS") continue; // the SAME proof genuinely passing = the real done
+    const t1 = tsMs(r.ts);
+    if (t1 == null || t1 <= t0) continue; // must be strictly LATER than the false claim
+    if (best == null || t1 < best) best = t1;
+  }
+  return best == null ? null : { ms: best - t0, atTs: new Date(best).toISOString() };
+}
+
+// Compact one-line duration for the bar. Input is a real (t_pass − t_false) MEASURED delta; this only
+// formats it. FLOORS every unit so it can never round UP into a number larger than the real measurement.
+// Sub-second deltas → null (nothing worth a clause). Seconds < 1m; whole minutes < 1h; else hours.
+function compactMeasured(ms) {
+  if (!Number.isFinite(ms) || ms < 1000) return null;
+  const s = Math.floor(ms / 1000);
+  if (s < 60) return `${s}s`;
+  const m = Math.floor(s / 60);
+  if (m < 60) return `${m}m`;
+  const h = s / 3600;
+  return h >= 10
+    ? `${Math.floor(h)}h`
+    : `${(Math.floor(h * 10) / 10).toFixed(1).replace(/\.0$/, "")}h`;
+}
+
+// measuredCaughtTotalMs() → the CUMULATIVE LIFETIME sum, in ms, of EVERY real measured red→green delta:
+// each caught false "done" (mismatch row) that has a later same-session same-proof PASS contributes that
+// one measured (t_pass − t_false) delta; a catch with no later PASS contributes 0 (never estimated). This
+// is an AGGREGATE — only the total number is ever rendered, never any per-catch claim text or proof (those
+// stay in the opt-in reveal + the analytics TUI). Framed on the bar as a cumulative "Xm caught", NOT a
+// present-tense "just caught", so it stays honest for old catches — the TOTAL genuinely happened.
+//
+// This always-on aggregate counter is an EXPLICIT PRODUCT DECISION by the owner: it is skalpel's terminal
+// presence and must never be gated/hidden ("never remove it from the terminal otherwise skalpel is
+// invisible"). Aggregate-only + no fabrication is what keeps that always-on surface honest.
+function measuredCaughtTotalMs() {
+  try {
+    const lines = tailLines(VERIFY_LOG_PATH, SHADOW_READ_BYTES);
+    if (!lines.length) return 0;
+    const rows = [];
+    for (const l of lines) {
+      try {
+        const r = JSON.parse(l);
+        if (r && typeof r === "object") rows.push(r);
+      } catch {
+        /* partial / garbage line — skip it, keep the rest (fail-open) */
+      }
+    }
+    let total = 0;
+    for (const r of rows) {
+      if (r.mismatch !== true) continue; // only a caught false "done" (verify-shadow's money metric)
+      const d = measureFixDelta(r, rows); // exact ledger.mjs logic; null-session rows excluded (Finding 3)
+      if (d && Number.isFinite(d.ms) && d.ms > 0) total += d.ms; // real measured delta only; else +0
+    }
+    return total;
+  } catch {
+    return 0; // any error → no measured total (fail-open: never break or slow the bar)
+  }
+}
+
+function main() {
   const payload = readPayload();
 
-  // AHA CATCH REVEAL (opt-in). The single highest-priority line: the agent claimed done but its OWN proof,
-  // re-run, GENUINELY failed. Fully gated on SKALPEL_VERIFY_REVEAL — when off, this branch never runs and
-  // the statusline output is byte-identical to the count-or-nothing original.
+  // AHA CATCH REVEAL / green ✓ verified (opt-in). The highest-priority surfaces: the agent claimed done
+  // and its OWN proof, re-run, GENUINELY failed (red) — or really passed (green). Fully gated on
+  // SKALPEL_VERIFY_REVEAL — when off (the default) this branch never runs and the bar is byte-identical to
+  // the always-on baseline below.
   if (revealEnabled(process.env)) {
     const reveal = revealNote();
     if (reveal) {
       process.stdout.write(`${BOLD}${reveal}${RESET}`);
       return;
     }
-    // No red catch pending → the quiet green half. A fresh PASS stamp shows dim (ambient, not shouting)
-    // for a short beat. Lower priority than the red catch, higher than the re-ask count: it's the most
-    // recent verdict on the last claim, and it's what earns the trust the red catch spends.
     const verdict = verdictNote();
     if (verdict) {
       process.stdout.write(`${DIM}${GREEN}${verdict}${RESET}`);
@@ -178,17 +342,40 @@ async function main() {
     return;
   }
 
-  // Otherwise, if a steer is live, name what it's doing — a description, no number. Else: print NOTHING.
+  // Otherwise, if a steer is live, name what it's doing — a description, no number.
   const label = steerLabel();
   if (label) {
     process.stdout.write(`${BOLD}skalpel${RESET} · ${CYAN}${label}${RESET}`);
     return;
   }
-  // Clean session → COUNT-OR-NOTHING resolves to nothing. Emit no bytes.
+
+  // ALWAYS-ON baseline presence line — skalpel's terminal presence (owner product decision: never gated,
+  // never hidden). `N steers` is ALWAYS shown (fresh install reads "0 steers" — honest, present, never
+  // blank; the user's own applied-steer count). Then the ONE optional time clause selected by
+  // BASELINE_TIME_MODE, each an AGGREGATE number only (never per-catch claim text / proof — those live in
+  // the opt-in reveal + the TUI), shown only when its real value exists:
+  //   • MEASURED "· Xm caught" — the CUMULATIVE LIFETIME sum of every real measured red→green delta
+  //     (measuredCaughtTotalMs). Always-on once real catches exist; a MEASURED wall-clock, never an
+  //     estimate. Cumulative framing (not present-tense "just caught"), so it stays honest for old catches.
+  //   • Raahil's `~`-prefixed saved ESTIMATE ("· ~7m saved") — shown only when saved_min > 0 (its data is
+  //     the user's own steers.ndjson credit, not the shadow log, so it keeps his always-on #609 behavior).
+  const { steers, savedMin } = readState();
+  let line = `${BOLD}skalpel${RESET} · ${CYAN}${steers} steers${RESET}`;
+  if (SHOW_MEASURED) {
+    const caught = compactMeasured(measuredCaughtTotalMs()); // null when < 1s of real measured catches
+    if (caught) line += ` · ${CYAN}${caught} caught${RESET}`;
+  }
+  if (SHOW_SAVED) {
+    const phrase = savedPhrase(savedMin);
+    if (phrase) line += ` · ${CYAN}${phrase}${RESET}`;
+  }
+  process.stdout.write(line);
 }
 
-// Fail-open, matching the other three hooks (skalpel-hook / -session / -session-end): any error →
-// print nothing → exit 0, so a thrown error can never spill a stack trace into the live status bar.
-main()
-  .then(() => process.exit(0))
-  .catch(() => process.exit(0));
+// Fail-open: wrap the whole render so a thrown error can never spill a stack trace into the live status
+// bar. Every helper is already individually try/caught; this is the last-line guard. Exit 0 regardless.
+try {
+  main();
+} catch {
+  /* never let the statusline break or slow the bar */
+}