skalpel 4.0.44 → 4.0.46

package/anchor-shadow.mjs

@@ -438,6 +438,434 @@ export async function runProbe(rawTarget) {
   return { pass: null, evidence: "unknown target kind" };
 }
 
+// ===================================================================================================
+// SHIP-STATUS v1 ("Remote-Truth"): STRICT kind↔probe reconstruction + read-only probes.
+//
+// Distinct from the doubt-spiral reconstructTarget/runProbe above (which allow claim-FAMILY fallbacks
+// to resolve a user's re-verify spiral): the ship-status CATCH must be precision-first. So here EACH
+// ship claim kind maps to EXACTLY ONE probe family, with NO cross-kind fallback — a `pushed` claim can
+// NEVER fall back to a PR probe (the cross-kind false-gotcha that fires "PR #n is OPEN" against a TRUE
+// push). No target of the RIGHT kind → null → the caller stays honestly silent (NO_TARGET, never a red).
+//
+// Every probe is READ-ONLY, execFile arg-array (never a shell), args re-validated against strict
+// whitelists, bounded timeout, fail-open (any error → UNKNOWN, never a lie). The `pushed` probe is the
+// new REMOTE-TRUTH read: one `git ls-remote` (the ONLY network read) resolves the REAL remote tip, then
+// a purely-local `git merge-base --is-ancestor` decides reachability — so a push that never left the
+// machine is caught, while a legitimate feature-branch push is never false-accused.
+// ===================================================================================================
+
+// The 1:1 map the caller asserts: each ship claim kind → its single allowed probe FAMILY. `live` &
+// `deployed` share the URL probe; `released` & `published` share the registry/tag family; the rest are
+// unique. reconstructShipTargetV1 ALWAYS returns a target whose family is SHIP_KIND_PROBE[claim], or null.
+export const SHIP_KIND_PROBE = {
+  pushed: "git-remote",
+  merged: "pr",
+  live: "url",
+  deployed: "url",
+  released: "registry",
+  published: "registry",
+  ci: "gh-checks",
+};
+
+// shipProbeFamily(targetKind) → the probe FAMILY a concrete target belongs to (npm & git-tag are both
+// the registry/tag family). Used to assert reconstruction never crosses kinds.
+export function shipProbeFamily(kind) {
+  if (kind === "npm" || kind === "git-tag") return "registry";
+  return kind; // git-remote | pr | url | gh-checks
+}
+
+// Strict arg whitelists (defense in depth — execFile already means no shell).
+const SHIP_SAFE_REF = /^[A-Za-z0-9._@/+-]{1,120}$/; // git remote/branch/tag name
+const SHIP_SHA_RE = /^[0-9a-f]{7,40}$/;
+const SHIP_SEMVER_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+const SHIP_NPM_NAME_RE = /^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/i;
+const SHIP_NET_TIMEOUT_MS = 10000; // network probes (ls-remote / npm view / gh) get a touch more than 5s
+
+// findPushBranch(text) → the LAST `git push [<remote>] [<branch>]` seen in context, as {remote, branch}
+// (either may be null). Used ONLY to name the branch/remote whose remote tip the `pushed` probe reads —
+// never executed. A refspec `local:remote` keeps the remote-side ref. Both fields strictly validated.
+function findPushBranch(text) {
+  const re = /\bgit\s+push\b([^\n;&|]*)/gi;
+  let last = null;
+  let m;
+  while ((m = re.exec(text))) {
+    const pos = m[1]
+      .trim()
+      .split(/\s+/)
+      .filter((t) => t && !t.startsWith("-"));
+    if (pos.length >= 2) last = { remote: pos[0], branch: pos[1] };
+    else if (pos.length === 1) last = { remote: pos[0], branch: null };
+    else last = { remote: null, branch: null };
+  }
+  if (!last) return null;
+  let branch = last.branch;
+  if (branch && branch.includes(":")) branch = branch.split(":").pop(); // refspec local:remote → remote
+  const remote = last.remote && SHIP_SAFE_REF.test(last.remote) ? last.remote : null;
+  branch = branch && SHIP_SAFE_REF.test(branch) ? branch : null;
+  return { remote, branch };
+}
+
+// findTag(text) → a release tag (vX.Y.Z or a `git tag <t>` / `git push origin <t>` mention). Validated.
+function findTag(text) {
+  const near = /\bgit\s+(?:tag|push[^\n;&|]*?)\s+(v?\d+\.\d+\.\d+[0-9A-Za-z.\-+]*)\b/i.exec(text);
+  if (near && SHIP_SAFE_REF.test(near[1])) return near[1];
+  const m = /\b(v\d+\.\d+\.\d+[0-9A-Za-z.\-+]*)\b/.exec(text);
+  return m && SHIP_SAFE_REF.test(m[1]) ? m[1] : null;
+}
+
+// findNpmVersion(text) → a semver version string near a publish/version mention (strict semver). The
+// npm target's NAME is read from the session's own package.json — never from claim/prompt content.
+function findNpmVersion(text) {
+  const near =
+    /\b(?:publish|version|v)\s*@?\s*(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)\b/i.exec(
+      text,
+    ) || /@(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)\b/.exec(text);
+  if (near && SHIP_SEMVER_RE.test(near[1])) return near[1];
+  const m = /\b(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)\b/.exec(text);
+  return m && SHIP_SEMVER_RE.test(m[1]) ? m[1] : null;
+}
+
+// readPkgName(repoDir) → the "name" field of the session's own package.json, validated against npm's
+// package-name rules, or null. This is the ONLY source of the published package name (never the claim).
+function readPkgName(repoDir) {
+  try {
+    if (!repoDir) return null;
+    const name = JSON.parse(readFileSync(join(repoDir, "package.json"), "utf8"))?.name;
+    return typeof name === "string" && SHIP_NPM_NAME_RE.test(name) ? name : null;
+  } catch {
+    return null;
+  }
+}
+
+// reconstructShipTargetV1(claim, contextText, payload) → the STRICT, single-family target for a ship
+// claim, or null. NO cross-kind fallback: a kind that can't reconstruct ITS OWN target returns null.
+export function reconstructShipTargetV1(claim, contextText, payload) {
+  const text = String(contextText || "");
+  const repoDir = repoDirOf(payload);
+  const family = SHIP_KIND_PROBE[claim];
+  if (!family) return null;
+  switch (family) {
+    case "git-remote": {
+      // pushed → REMOTE-TRUTH. Needs the claimed sha + a repo. The branch (from the session's own
+      // `git push`, else resolved at probe time from the upstream) is optional here; ambiguity that
+      // can't be resolved becomes UNKNOWN in the probe, never a false red.
+      const sha = findSha(text);
+      if (!sha || !repoDir) return null;
+      const pb = findPushBranch(text) || {};
+      return {
+        kind: "git-remote",
+        sha,
+        remote: pb.remote || null,
+        branch: pb.branch || null,
+        repoDir,
+      };
+    }
+    case "pr": {
+      // merged → the PR probe ONLY. No PR number in context → null (never a git/url fallback).
+      const n = findPr(text);
+      return n != null ? { kind: "pr", n, repoDir } : null;
+    }
+    case "url": {
+      // live/deployed → the URL probe ONLY.
+      const url = findUrl(text);
+      return url ? { kind: "url", url } : null;
+    }
+    case "registry": {
+      // released/published → the registry/tag family ONLY. Prefer npm when the session actually ran
+      // `npm publish` AND both the package name (from package.json) and a semver version reconstruct;
+      // else a git tag if one is present. Neither → null.
+      if (/\bnpm\s+publish\b/i.test(text)) {
+        const name = readPkgName(repoDir);
+        const version = findNpmVersion(text);
+        if (name && version) return { kind: "npm", name, version };
+      }
+      const tag = findTag(text);
+      if (tag && repoDir) {
+        const pb = findPushBranch(text) || {};
+        return { kind: "git-tag", tag, remote: pb.remote || "origin", repoDir };
+      }
+      return null;
+    }
+    case "gh-checks": {
+      // "CI green/passing" → gh checks ONLY (a PR's checks, else a commit's runs).
+      const n = findPr(text);
+      if (n != null) return { kind: "gh-checks", n, repoDir };
+      const sha = findSha(text);
+      if (sha) return { kind: "gh-checks", sha, repoDir };
+      return null;
+    }
+    default:
+      return null;
+  }
+}
+
+// validateShipTargetV1(t) → re-validate every field of a ship-v1 target before it is passed to execFile
+// (defense in depth). Returns a normalized target or null. Never throws.
+function validateShipTargetV1(t) {
+  if (!t || typeof t !== "object") return null;
+  switch (t.kind) {
+    case "url":
+      return isSafeUrl(t.url) ? { kind: "url", url: t.url } : null;
+    case "pr": {
+      const n = Number(t.n);
+      if (!Number.isInteger(n) || n <= 0 || n >= 1e7) return null;
+      return { kind: "pr", n, repoDir: validDir(t.repoDir) };
+    }
+    case "git-remote": {
+      if (!SHIP_SHA_RE.test(String(t.sha || ""))) return null;
+      const repoDir = validDir(t.repoDir);
+      if (!repoDir) return null;
+      const remote = t.remote && SHIP_SAFE_REF.test(t.remote) ? t.remote : "origin";
+      const branch = t.branch && SHIP_SAFE_REF.test(t.branch) ? t.branch : null;
+      return { kind: "git-remote", sha: String(t.sha).toLowerCase(), remote, branch, repoDir };
+    }
+    case "npm": {
+      if (
+        !SHIP_NPM_NAME_RE.test(String(t.name || "")) ||
+        !SHIP_SEMVER_RE.test(String(t.version || ""))
+      )
+        return null;
+      return { kind: "npm", name: t.name, version: t.version };
+    }
+    case "git-tag": {
+      const repoDir = validDir(t.repoDir);
+      if (!repoDir || !SHIP_SAFE_REF.test(String(t.tag || ""))) return null;
+      const remote = t.remote && SHIP_SAFE_REF.test(t.remote) ? t.remote : "origin";
+      return { kind: "git-tag", tag: t.tag, remote, repoDir };
+    }
+    case "gh-checks": {
+      const repoDir = validDir(t.repoDir);
+      const n = t.n != null ? Number(t.n) : null;
+      const sha = t.sha ? String(t.sha).toLowerCase() : null;
+      if (n != null && Number.isInteger(n) && n > 0 && n < 1e7)
+        return { kind: "gh-checks", n, repoDir };
+      if (sha && SHIP_SHA_RE.test(sha)) return { kind: "gh-checks", sha, repoDir };
+      return null;
+    }
+    default:
+      return null;
+  }
+}
+
+// classifyHttpVerdict(code) → the Defect-3 HTTP precision map. A responding server is REACHABLE; only a
+// genuine "gone" (404/410) is a FAIL CANDIDATE (never an immediate red — the caller confirm-reprobes).
+// 401/403/405 (auth-walled), 429 (rate-limit), 5xx (transient), and any other response → UNKNOWN.
+export function classifyHttpVerdict(code) {
+  if (!Number.isFinite(code) || code === 0) return "UNKNOWN";
+  if (code >= 200 && code < 400) return "PASS";
+  if (code === 404 || code === 410) return "FAIL_CANDIDATE";
+  return "UNKNOWN";
+}
+
+// parseLsRemoteTip(stdout, branch) → the 40-hex tip sha for refs/heads/<branch> (or the sole ref line),
+// else null. `git ls-remote <remote> <branch>` prints `<sha>\t<ref>` lines.
+function parseLsRemoteTip(stdout, branch) {
+  const lines = String(stdout || "").split("\n");
+  for (const line of lines) {
+    const mm = line.match(/^([0-9a-f]{40})\s+(\S+)/i);
+    if (mm && (mm[2] === `refs/heads/${branch}` || mm[2] === "HEAD")) return mm[1].toLowerCase();
+  }
+  const first = String(stdout || "").match(/^([0-9a-f]{40})\b/im);
+  return first ? first[1].toLowerCase() : null;
+}
+
+// runShipProbeV1(target, exec) → ONE read-only probe for the strict target. Returns
+// { verdict, evidence } where verdict ∈ PASS | FAIL | FAIL_CANDIDATE | UNKNOWN. `exec` is injectable
+// (defaults to the real read-only `run`) purely so the eval harness can drive it hermetically. Never throws.
+export async function runShipProbeV1(rawTarget, exec = run) {
+  const t = validateShipTargetV1(rawTarget);
+  if (!t) return { verdict: "UNKNOWN", evidence: "rejected: target failed validation" };
+  try {
+    if (t.kind === "url") {
+      // curl -sS -m 5 -o /dev/null -w "%{http_code}" <url>  (READ-ONLY). curl exits 0 on ANY HTTP
+      // status; a non-zero exit is a transport error (6=NXDOMAIN, 7=refused → fail candidate; else unknown).
+      const { err, stdout } = await exec(
+        "curl",
+        ["-sS", "-m", "5", "-o", "/dev/null", "-w", "%{http_code}", t.url],
+        { timeout: SHIP_NET_TIMEOUT_MS },
+      );
+      if (err) {
+        const c = err.code;
+        if (c === 6)
+          return { verdict: "FAIL_CANDIDATE", evidence: "curl: could not resolve host (NXDOMAIN)" };
+        if (c === 7) return { verdict: "FAIL_CANDIDATE", evidence: "curl: connection refused" };
+        return {
+          verdict: "UNKNOWN",
+          evidence: clip(`curl error: ${err.killed ? "timeout" : err.message || c}`),
+        };
+      }
+      const code = parseInt(stdout, 10);
+      const verdict = classifyHttpVerdict(code);
+      const evidence =
+        Number.isFinite(code) && code !== 0 ? `http_code=${code}` : clip(`no http code: ${stdout}`);
+      return { verdict, evidence };
+    }
+    if (t.kind === "pr") {
+      // gh pr view <n> --json state,mergedAt  (READ-ONLY, DECISIVE)
+      const opts = t.repoDir ? { cwd: t.repoDir } : {};
+      const { err, stdout } = await exec(
+        "gh",
+        ["pr", "view", String(t.n), "--json", "state,mergedAt"],
+        opts,
+      );
+      if (err)
+        return {
+          verdict: "UNKNOWN",
+          evidence: clip(`gh error: ${err.killed ? "timeout" : err.message}`),
+        };
+      let j;
+      try {
+        j = JSON.parse(stdout);
+      } catch {
+        return { verdict: "UNKNOWN", evidence: clip(`gh non-json: ${stdout}`) };
+      }
+      const merged = j.state === "MERGED" || !!j.mergedAt;
+      return {
+        verdict: merged ? "PASS" : "FAIL",
+        evidence: clip(`state=${j.state} mergedAt=${j.mergedAt || "null"}`),
+      };
+    }
+    if (t.kind === "git-remote") {
+      // REMOTE-TRUTH. Resolve the branch (from the push, else the upstream / current branch), read the
+      // REAL remote tip with ONE `git ls-remote`, then decide reachability locally with merge-base.
+      const remote = t.remote || "origin";
+      let branch = t.branch;
+      if (!branch) {
+        const up = await exec(
+          "git",
+          ["-C", t.repoDir, "rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{upstream}"],
+          { timeout: SHIP_NET_TIMEOUT_MS },
+        );
+        if (!up.err) {
+          const ref = String(up.stdout || "").trim(); // e.g. origin/feat-x
+          const idx = ref.indexOf("/");
+          if (idx > 0) branch = ref.slice(idx + 1);
+        }
+        if (!branch) {
+          const cur = await exec("git", ["-C", t.repoDir, "symbolic-ref", "--short", "HEAD"], {
+            timeout: SHIP_NET_TIMEOUT_MS,
+          });
+          if (!cur.err) branch = String(cur.stdout || "").trim() || null;
+        }
+        if (!branch || !SHIP_SAFE_REF.test(branch))
+          return { verdict: "UNKNOWN", evidence: "git-remote: branch unresolved (ambiguous)" };
+      }
+      const ls = await exec("git", ["-C", t.repoDir, "ls-remote", remote, branch], {
+        timeout: SHIP_NET_TIMEOUT_MS,
+      });
+      if (ls.err)
+        return {
+          verdict: "UNKNOWN",
+          evidence: clip(`ls-remote error: ${ls.err.killed ? "timeout" : ls.err.message}`),
+        };
+      const tip = parseLsRemoteTip(ls.stdout, branch);
+      if (!tip)
+        return { verdict: "UNKNOWN", evidence: clip(`no remote tip for ${remote}/${branch}`) };
+      const mb = await exec("git", ["-C", t.repoDir, "merge-base", "--is-ancestor", t.sha, tip], {
+        timeout: SHIP_NET_TIMEOUT_MS,
+      });
+      const evid = `sha=${t.sha.slice(0, 12)} branch=${remote}/${branch} remoteTip=${tip.slice(0, 12)}`;
+      // exit 0 → reachable (PASS). exit 1 → both objects known AND not reachable (DECISIVE FAIL — it
+      // never left the machine). Any other exit → a commit is unknown locally → UNKNOWN (never a lie).
+      if (!mb.err) return { verdict: "PASS", evidence: clip(`${evid} ancestor`) };
+      if (mb.err.code === 1) return { verdict: "FAIL", evidence: clip(`${evid} not-ancestor`) };
+      return {
+        verdict: "UNKNOWN",
+        evidence: clip(`${evid} merge-base indeterminate (tip/sha unknown locally)`),
+      };
+    }
+    if (t.kind === "npm") {
+      // npm view <name>@<version> version  (READ-ONLY registry read, DECISIVE)
+      const { err, stdout, stderr } = await exec(
+        "npm",
+        ["view", `${t.name}@${t.version}`, "version"],
+        {
+          timeout: SHIP_NET_TIMEOUT_MS,
+        },
+      );
+      if (!err) {
+        return String(stdout || "").trim()
+          ? {
+              verdict: "PASS",
+              evidence: clip(`npm ${t.name}@${t.version} = ${String(stdout).trim()}`),
+            }
+          : { verdict: "UNKNOWN", evidence: clip(`npm empty for ${t.name}@${t.version}`) };
+      }
+      const combined = `${stderr || ""} ${stdout || ""}`;
+      if (/E404|No match found|is not in (?:this|the)/i.test(combined))
+        return { verdict: "FAIL", evidence: clip(`npm: ${t.name}@${t.version} not on registry`) };
+      return {
+        verdict: "UNKNOWN",
+        evidence: clip(`npm error: ${err.killed ? "timeout" : err.message}`),
+      };
+    }
+    if (t.kind === "git-tag") {
+      // git -C <repo> ls-remote --tags <remote> <tag>  (READ-ONLY, DECISIVE)
+      const { err, stdout } = await exec(
+        "git",
+        ["-C", t.repoDir, "ls-remote", "--tags", t.remote, t.tag],
+        {
+          timeout: SHIP_NET_TIMEOUT_MS,
+        },
+      );
+      if (err)
+        return {
+          verdict: "UNKNOWN",
+          evidence: clip(`ls-remote --tags error: ${err.killed ? "timeout" : err.message}`),
+        };
+      const esc = t.tag.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      const has = new RegExp(`\\brefs/tags/${esc}(?:\\^\\{\\})?$`, "m").test(String(stdout || ""));
+      return has
+        ? { verdict: "PASS", evidence: clip(`tag ${t.remote}/${t.tag} present`) }
+        : { verdict: "FAIL", evidence: clip(`tag ${t.tag} not on ${t.remote}`) };
+    }
+    if (t.kind === "gh-checks") {
+      // gh pr checks <n> --json ...  /  gh run list --commit <sha> --json ...  (READ-ONLY). gh prints
+      // JSON even on a non-zero exit (failing/pending), so we parse stdout regardless of err.
+      const opts = t.repoDir ? { cwd: t.repoDir } : {};
+      let err, stdout;
+      if (t.n != null) {
+        ({ err, stdout } = await exec(
+          "gh",
+          ["pr", "checks", String(t.n), "--json", "state,bucket"],
+          opts,
+        ));
+      } else {
+        ({ err, stdout } = await exec(
+          "gh",
+          ["run", "list", "--commit", t.sha, "--json", "conclusion,status"],
+          opts,
+        ));
+      }
+      const out = String(stdout || "");
+      if (err && !out.trim())
+        return {
+          verdict: "UNKNOWN",
+          evidence: clip(`gh checks error: ${err.killed ? "timeout" : err.message}`),
+        };
+      let arr;
+      try {
+        arr = JSON.parse(out);
+      } catch {
+        return { verdict: "UNKNOWN", evidence: clip(`gh checks non-json: ${out}`) };
+      }
+      if (!Array.isArray(arr) || !arr.length)
+        return { verdict: "UNKNOWN", evidence: "gh checks: none reported" };
+      const norm = arr.map((c) =>
+        String((c && (c.bucket || c.conclusion || c.state || c.status)) || "").toLowerCase(),
+      );
+      if (norm.some((s) => /fail|error|cancel|timed_out|action_required/.test(s)))
+        return { verdict: "FAIL", evidence: clip(`checks: ${norm.join(",")}`) };
+      if (norm.some((s) => s === "" || /pending|queued|in_progress|waiting|requested/.test(s)))
+        return { verdict: "UNKNOWN", evidence: clip(`checks pending: ${norm.join(",")}`) };
+      return { verdict: "PASS", evidence: clip(`checks: ${norm.join(",")}`) };
+    }
+  } catch (e) {
+    return { verdict: "UNKNOWN", evidence: clip(`probe threw: ${e}`) };
+  }
+  return { verdict: "UNKNOWN", evidence: "unknown ship target kind" };
+}
+
 // ---------------------------------------------------------------------------------------------------
 // Logging — the ONLY side effect. Append-only NDJSON at ~/.skalpel/anchor-shadow.log. Never throws.
 // ---------------------------------------------------------------------------------------------------

package/card.mjs

@@ -69,7 +69,20 @@ export function isGenuineCatch(row) {
   // Ship-status catches (category:"ship", outcome SHIP_FAIL) record the check under probe_command, not
   // proof_command — accept either so a genuine "you said deployed, it's 404" catch is not invisible.
   const command = row.proof_command || row.probe_command;
-  return failed && !!command && !!row.claim_text;
+  if (!failed || !command || !row.claim_text) return false;
+  // RETRO catches (category:"retro") are RECORDED at claim time — never re-run. The whole indictment rests
+  // on the exit code the transcript already recorded, so a retro row is a genuine catch ONLY when it carries
+  // that recorded non-zero exit code; without it we can't render the "already failed" provenance truthfully.
+  if (row.category === "retro") {
+    return Number.isInteger(row.recorded_exit_code) && row.recorded_exit_code !== 0;
+  }
+  return true;
+}
+
+// A retro row is RECORDED at claim time (from the user's own transcript), never re-run — so its wording
+// must never borrow the live card's "skalpel re-ran its own proof" language.
+function isRetro(row) {
+  return row && row.category === "retro";
 }
 
 // readCatches() → all genuine-catch rows in the shadow log, oldest→newest as written. Fail-open: any
@@ -133,9 +146,17 @@ export function extractCode(evidence) {
 
 // verdictPhrase(row) → the honest one-line verdict. Always truthful for a catch row.
 function verdictPhrase(row) {
-  const code = extractCode(row.evidence);
   const failN = extractFailCount(row.evidence);
   const count = failN != null ? ` · ${failN} failing` : "";
+  // RETRO: the exit code was RECORDED in the transcript at claim time — we never re-ran it, so the verdict
+  // must say "had already failed", never "re-ran". recorded_exit_code is a required field for a retro catch.
+  if (isRetro(row)) {
+    const n = Number.isInteger(row.recorded_exit_code)
+      ? ` (recorded exit ${row.recorded_exit_code})`
+      : "";
+    return `FAIL — its own test had already failed when it said this${n}${count}`;
+  }
+  const code = extractCode(row.evidence);
   if (code && code.kind === "http") return `FAIL — its own proof got HTTP ${code.value}${count}`;
   if (code && code.kind === "exit") return `FAIL — its own proof exited ${code.value}${count}`;
   return `FAIL — its own proof re-ran and exited non-zero${count}`;
@@ -152,13 +173,18 @@ export function renderPlainCard(row) {
   const claim = clean(row.claim_text, 200) || "it's done";
   const proof = clean(row.proof_command || row.probe_command, 200) || "its own proof";
   const evidence = clean(row.evidence, 200);
+  const retro = isRetro(row);
   const L = [];
-  L.push("🔬 skalpel — verified catch");
+  L.push(retro ? "🔬 skalpel — recorded catch" : "🔬 skalpel — verified catch");
   L.push("");
   L.push("The agent claimed:");
   L.push(`  "${claim}"`);
   L.push("");
-  L.push("skalpel re-ran the agent's OWN proof, out-of-band:");
+  L.push(
+    retro
+      ? "Its own test had already failed when it said this — recorded in your transcript at claim time:"
+      : "skalpel re-ran the agent's OWN proof, out-of-band:",
+  );
   L.push(`  $ ${proof}`);
   L.push(`  → ${verdictPhrase(row)}`);
   if (evidence) {
@@ -167,8 +193,16 @@ export function renderPlainCard(row) {
     L.push(`  ${evidence}`);
   }
   L.push("");
-  L.push(`caught ${stamp(row.ts)}`);
-  L.push("The agent said done. Its own proof, re-run, disagreed.");
+  L.push(
+    retro
+      ? `recorded ${stamp(row.ts)} (your transcript, at claim time)`
+      : `caught ${stamp(row.ts)}`,
+  );
+  L.push(
+    retro
+      ? "The agent said done. Its own test, recorded at that moment, had already failed."
+      : "The agent said done. Its own proof, re-run, disagreed.",
+  );
   return L.join("\n");
 }
 
@@ -177,13 +211,18 @@ export function renderMarkdownCard(row) {
   const claim = clean(row.claim_text, 200) || "it's done";
   const proof = clean(row.proof_command || row.probe_command, 200) || "its own proof";
   const evidence = clean(row.evidence, 200);
+  const retro = isRetro(row);
   const FENCE = "```";
   const L = [];
-  L.push("**🔬 skalpel — verified catch**");
+  L.push(retro ? "**🔬 skalpel — recorded catch**" : "**🔬 skalpel — verified catch**");
   L.push("");
   L.push(`> The agent claimed: _"${claim}"_`);
   L.push("");
-  L.push("skalpel re-ran the agent's own proof, out-of-band:");
+  L.push(
+    retro
+      ? "Its own test had already failed when it said this — recorded in your transcript at claim time:"
+      : "skalpel re-ran the agent's own proof, out-of-band:",
+  );
   L.push(FENCE);
   L.push(`$ ${proof}`);
   L.push(`→ ${verdictPhrase(row)}`);
@@ -194,7 +233,11 @@ export function renderMarkdownCard(row) {
     L.push(evidence);
     L.push(FENCE);
   }
-  L.push(`_Caught ${stamp(row.ts)}. The agent said done; its own proof, re-run, disagreed._`);
+  L.push(
+    retro
+      ? `_Recorded ${stamp(row.ts)} in your transcript, at claim time. The agent said done; its own test had already failed._`
+      : `_Caught ${stamp(row.ts)}. The agent said done; its own proof, re-run, disagreed._`,
+  );
   return L.join("\n");
 }
 
@@ -203,14 +246,21 @@ function renderTerminalCard(row) {
   const claim = clean(row.claim_text, 200) || "it's done";
   const proof = clean(row.proof_command || row.probe_command, 200) || "its own proof";
   const evidence = clean(row.evidence, 180);
+  const retro = isRetro(row);
   const L = [];
   L.push("");
-  L.push(`  ${B}🔬 skalpel${X} ${D}·${X} ${B}${R}verified catch${X}`);
+  L.push(
+    `  ${B}🔬 skalpel${X} ${D}·${X} ${B}${R}${retro ? "recorded catch" : "verified catch"}${X}`,
+  );
   L.push(`  ${D}${"─".repeat(70)}${X}`);
   L.push(`  ${D}The agent claimed:${X}`);
   L.push(`    ${B}"${claim}"${X}`);
   L.push("");
-  L.push(`  ${D}skalpel re-ran the agent's OWN proof, out-of-band:${X}`);
+  L.push(
+    retro
+      ? `  ${D}Its own test had already failed when it said this — recorded at claim time:${X}`
+      : `  ${D}skalpel re-ran the agent's OWN proof, out-of-band:${X}`,
+  );
   L.push(`    ${D}$${X} ${proof}`);
   L.push(`    ${R}${B}→ ${verdictPhrase(row)}${X}`);
   if (evidence) {
@@ -219,7 +269,9 @@ function renderTerminalCard(row) {
   }
   L.push(`  ${D}${"─".repeat(70)}${X}`);
   L.push(
-    `  ${D}caught ${stamp(row.ts)} — the agent said done; its own proof, re-run, disagreed.${X}`,
+    retro
+      ? `  ${D}recorded ${stamp(row.ts)} — the agent said done; its own test had already failed.${X}`
+      : `  ${D}caught ${stamp(row.ts)} — the agent said done; its own proof, re-run, disagreed.${X}`,
   );
   L.push("");
   return L.join("\n");