skalpel 4.0.8 → 4.0.10

package/autopsy.mjs

@@ -0,0 +1,844 @@
+#!/usr/bin/env node
+// autopsy.mjs — `skalpel autopsy`: a LOCAL, READ-ONLY, ZERO-NETWORK receipt.
+//
+// It graduates the resident statistical instrument (the relational backtest that returned GO with an
+// independently-verified 0/20 false-join rate) into a one-shot command. It reads the coding logs that
+// are ALREADY on this machine — ~/.claude/projects/**/*.jsonl (top-level interactive sessions) and, for
+// context only, ~/.skalpel/*.ndjson — and renders a plain-text, screenshot-native receipt of 1-3
+// VERIFIED behavioral relations. Every number it prints re-derives exactly from the raw logs: each
+// relation quotes the user's own lines VERBATIM with {session,turn,ts} citations and a `reproduce:`
+// line that re-opens the cited files fresh from disk and re-confirms the count.
+//
+// HARD INVARIANTS (enforced by construction):
+//   1. ZERO NETWORK. This file imports ONLY node:fs / node:path / node:os / node:readline.
+//      No http/https/net/dns/fetch/child_process. It never opens a socket. It only reads local files.
+//   2. NO FABRICATED STATS. Nothing is rendered unless it re-derives verbatim from disk. If there is
+//      not enough history to cross the bar, it prints an HONEST ZERO-STATE with a live turn counter —
+//      never an invented finding.
+//   3. HONEST FOOTER. It states that THIS RECEIPT is generated locally, read-only. It does NOT and must
+//      not claim the whole product is local: the per-turn hook and SessionEnd ingest STILL upload
+//      transcripts today. Zero-network ingest is a later cycle.
+//
+// Cells graduated from the backtest:
+//   CELL A — cross-session RESTATEMENT/RECURRENCE on a DETERMINISTIC anchor (error string / code symbol
+//            / normalized n-gram), witness per session. Asserted as a headline.
+//   CELL C — density-gated MEASURED SPIRAL: the same error anchor recurring within <=30min gaps inside
+//            one session, with wall-clock duration. Asserted as a headline.
+//   CELL B — "answer already on screen" is DEMOTED to witness-adjudicated only (it is the fakeable-by-
+//            mislabel trust bomb) and is NEVER surfaced as an asserted headline here.
+
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import readline from "node:readline";
+
+const HOME = os.homedir();
+const PROJECTS_DIR = path.join(HOME, ".claude", "projects");
+const SKALPEL_DIR = path.join(HOME, ".skalpel");
+
+// ---------- deterministic helpers (verbatim from the backtest engine) ----------
+const SPAN = 90;
+const norm = (s) =>
+  s
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, " ")
+    .replace(/\s+/g, " ")
+    .trim();
+const tokens = (s) => norm(s).split(" ").filter(Boolean);
+
+const BOILER_MARKERS = [
+  "[skalpel",
+  "<system-reminder",
+  "deferred_tools",
+  "MCP server",
+  "You are Claude Code",
+  "IMPORTANT: These instructions OVERRIDE",
+  "hookSpecificOutput",
+  "additionalContext",
+  "behavioral profile",
+  "this context may or may not be relevant",
+  "system-reminder",
+  "Operating doctrine",
+  "claudeMd",
+  "userEmail",
+  "currentDate",
+];
+const isBoiler = (t) => {
+  const l = t.slice(0, 400);
+  return BOILER_MARKERS.some((m) => l.includes(m));
+};
+
+const GENERIC = new Set([
+  "error",
+  "value",
+  "string",
+  "number",
+  "object",
+  "result",
+  "index",
+  "data",
+  "type",
+  "function",
+  "const",
+  "return",
+  "import",
+  "export",
+  "module",
+  "class",
+  "name",
+  "file",
+  "test",
+  "code",
+  "true",
+  "false",
+  "null",
+  "undefined",
+  "array",
+  "list",
+  "item",
+  "count",
+  "total",
+  "main",
+  "build",
+  "node",
+  "none",
+]);
+
+const WORKFLOW_TEMPLATE = new Set([
+  "agents_empty_result",
+  "agents_done",
+  "agents_error",
+  "agents_skipped",
+  "agents_running",
+  "agents_total",
+  "output_file",
+  "tool_use_id",
+  "task_notification",
+  "task_id",
+  "run_id",
+]);
+const isTemplateTok = (a) => WORKFLOW_TEMPLATE.has(a.toLowerCase());
+
+// ---------- anchor extraction (deterministic; verbatim from the backtest engine) ----------
+function extractAnchors(text) {
+  const out = [];
+  const push = (kind, anchor, at) => {
+    if (anchor) out.push({ kind, anchor, at });
+  };
+  let m;
+
+  const errRes = [
+    [/error\[E\d{2,4}\]/g, "rustc"],
+    [/\bTS\d{4}\b/g, "tsc"],
+    [/\b[A-Z][a-zA-Z]{2,}(?:Error|Exception)\b/g, "exc"],
+    [/\b(?:ENOENT|EADDRINUSE|ECONNREFUSED|EACCES|ETIMEDOUT|EPIPE|EEXIST|ENOTFOUND)\b/g, "errno"],
+    [/panicked at [^\n]{0,60}/g, "panic"],
+    [/\bcannot find (?:module|name|type|value) ['"`]?[\w./@-]+/gi, "notfound"],
+    [/\bunresolved import [\w:]+/gi, "unresolved"],
+    [/\bborrow of moved value\b/gi, "borrowck"],
+    [/SQLX_OFFLINE/g, "sqlx"],
+    [/\bsegmentation fault\b/gi, "segfault"],
+  ];
+  for (const [re, tag] of errRes) {
+    re.lastIndex = 0;
+    while ((m = re.exec(text))) push("err:" + tag, m[0].trim(), m.index);
+  }
+
+  const fileRe =
+    /\b[\w-]+(?:\/[\w.-]+)*\.(?:rs|ts|tsx|jsx|mjs|cjs|go|py|sql|toml|yaml|yml|sh|astro|vue|svelte)\b/g;
+  while ((m = fileRe.exec(text))) {
+    const base = m[0].split("/").pop();
+    if (!GENERIC.has(base.split(".")[0])) push("sym:file", base, m.index);
+  }
+  const rustRe = /\b[a-z_][a-z0-9_]{2,}::[a-z_][a-z0-9_:]{2,}/g;
+  while ((m = rustRe.exec(text))) push("sym:path", m[0], m.index);
+  const identRe = /\b[a-z][a-z0-9]*(?:_[a-z0-9]+){2,}\b|\b[a-z]+(?:[A-Z][a-z0-9]+){2,}\b/g;
+  while ((m = identRe.exec(text))) {
+    const id = m[0];
+    if (id.length >= 10 && !GENERIC.has(id.toLowerCase())) push("sym:ident", id, m.index);
+  }
+
+  return out;
+}
+
+function span(text, at, len) {
+  const a = Math.max(0, at - SPAN),
+    b = Math.min(text.length, at + len + SPAN);
+  return text.slice(a, b).replace(/\s+/g, " ").trim().slice(0, 200);
+}
+
+// ---------- parse one session (verbatim shape from the backtest engine) ----------
+function parseSession(file, rootDir) {
+  return new Promise((resolve) => {
+    const sessionId = path.basename(file, ".jsonl");
+    const turns = [];
+    let idx = 0;
+    const rl = readline.createInterface({ input: fs.createReadStream(file), crlfDelay: Infinity });
+    rl.on("line", (line) => {
+      if (!line) return;
+      let o;
+      try {
+        o = JSON.parse(line);
+      } catch {
+        return;
+      }
+      const t = o.type;
+      if (t !== "user" && t !== "assistant") return;
+      const msg = o.message;
+      if (!msg) return;
+      let text = "",
+        role = t,
+        toolErrText = "";
+      const toolCalls = [];
+      const c = msg.content;
+      if (typeof c === "string") {
+        text = c;
+      } else if (Array.isArray(c)) {
+        for (const b of c) {
+          if (b.type === "text") text += (b.text || "") + "\n";
+          else if (b.type === "tool_use") toolCalls.push(b.name);
+          else if (b.type === "tool_result") {
+            let tc = b.content;
+            if (typeof tc === "string") toolErrText += tc.slice(0, 2000) + "\n";
+            else if (Array.isArray(tc))
+              for (const x of tc)
+                if (x && x.type === "text") toolErrText += (x.text || "").slice(0, 2000) + "\n";
+          }
+        }
+      }
+      text = text.trim();
+      toolErrText = toolErrText.trim();
+      if (!text && !toolErrText && toolCalls.length === 0) return;
+      const boiler = text ? isBoiler(text) : false;
+      turns.push({
+        session_id: sessionId,
+        root: rootDir,
+        role,
+        turn_idx: idx++,
+        ts: o.timestamp || null,
+        tms: o.timestamp ? Date.parse(o.timestamp) : null,
+        text: text.slice(0, 6000),
+        toolErrText: toolErrText.slice(0, 4000),
+        mineErrOnly: !text && !!toolErrText,
+        toolCalls,
+        boiler,
+      });
+    });
+    rl.on("close", () => resolve({ sessionId, rootDir, turns }));
+    rl.on("error", () => resolve({ sessionId, rootDir, turns }));
+  });
+}
+
+// ---------- reproduce affordance: re-open a cited file FRESH, jump to the turn, re-confirm ----------
+// This is the authoritative re-derivation. It reads the raw jsonl again (independent of the in-memory
+// parse) and confirms the anchor is verbatim present at the cited turn.
+function readTurnText(file, targetIdx) {
+  let lines;
+  try {
+    lines = fs.readFileSync(file, "utf8").split("\n");
+  } catch {
+    return null;
+  }
+  let idx = 0;
+  for (const line of lines) {
+    if (!line) continue;
+    let o;
+    try {
+      o = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (o.type !== "user" && o.type !== "assistant") continue;
+    const msg = o.message;
+    if (!msg) continue;
+    let text = "",
+      toolErrText = "";
+    const c = msg.content;
+    let hasTool = false;
+    if (typeof c === "string") text = c;
+    else if (Array.isArray(c))
+      for (const b of c) {
+        if (b.type === "text") text += (b.text || "") + "\n";
+        else if (b.type === "tool_use") hasTool = true;
+        else if (b.type === "tool_result") {
+          let tc = b.content;
+          if (typeof tc === "string") toolErrText += tc.slice(0, 2000) + "\n";
+          else if (Array.isArray(tc))
+            for (const x of tc)
+              if (x && x.type === "text") toolErrText += (x.text || "").slice(0, 2000) + "\n";
+        }
+      }
+    text = text.trim();
+    toolErrText = toolErrText.trim();
+    if (!text && !toolErrText && !hasTool) continue;
+    if (idx === targetIdx) return text || toolErrText;
+    idx++;
+  }
+  return null;
+}
+
+// Re-derive a relation's number from disk. Returns { confirmed, total } — how many cited witnesses
+// still have the anchor verbatim at the cited turn after a fresh, independent re-read.
+function reproduceCount(fileIndex, anchor, witnesses) {
+  let confirmed = 0;
+  const total = witnesses.length;
+  for (const w of witnesses) {
+    const file = fileIndex.get(w.session_id);
+    if (!file) continue;
+    const txt = readTurnText(file, w.turn_idx);
+    if (txt && norm(txt).includes(norm(anchor))) confirmed++;
+  }
+  return { confirmed, total };
+}
+
+// ---------- rendering helpers ----------
+const short = (sid) => (sid || "").slice(0, 8);
+const shortTs = (ts) => {
+  if (!ts) return "??";
+  // 2026-07-12T21:02:49.558Z -> 2026-07-12 21:02
+  const m = /^(\d{4}-\d{2}-\d{2})T(\d{2}:\d{2})/.exec(ts);
+  return m ? `${m[1]} ${m[2]}` : ts.slice(0, 16);
+};
+const RULE = "─".repeat(64);
+
+function plainAnchor(kind, anchor) {
+  if (kind.startsWith("err")) return `the error ${JSON.stringify(anchor)}`;
+  if (kind === "sym:file") return `the file ${anchor}`;
+  if (kind === "sym:path") return `the symbol ${anchor}`;
+  return `the symbol ${anchor}`;
+}
+
+function projLabel(root) {
+  // ~/.claude/projects encodes the cwd as a dash-flattened path; show a short tail if meaningful.
+  // The HOME catch-all root is not a project — suppress it (handled by projTail returning null).
+  const tail = projTail(root);
+  return tail ? `  (${tail})` : "";
+}
+// ~/.claude/projects encodes cwd as a dash-flattened path. The HOME dir ("-Users-ryan") is the
+// catch-all launch root for most sessions — it is NOT a project, so it never counts as "related context".
+function decodeRoot(root) {
+  return root ? "/" + root.replace(/^-/, "").replace(/-/g, "/") : "";
+}
+const isHomeRoot = (root) => {
+  const d = decodeRoot(root);
+  return !d || d === HOME;
+};
+function projTail(root) {
+  if (isHomeRoot(root)) return null; // home dir is not a project label
+  const parts = root.replace(/^-/, "").split("-").filter(Boolean);
+  const tail = parts.slice(-2).join("/");
+  return tail ? `~/${tail}` : null;
+}
+// Detect any email (incl. TLDs truncated by the 200-char span slice, e.g. "name@host.c" or "name@host").
+const EMAIL_RE = /[A-Za-z0-9._%+-]+@[A-Za-z0-9][A-Za-z0-9.-]*/g;
+
+// ---------- PII redaction (default ON; --raw reveals locally) ----------
+// The default receipt is meant to be screenshot-shareable. Third-party emails, personal/company
+// domains, IPs and secrets in the quoted verbatim spans are redacted to typed placeholders. `--raw`
+// (a purely local flag; there is still no network) reveals the unredacted spans for the user's eyes.
+const RAW = process.argv.slice(2).includes("--raw");
+// TLD allowlist so real domains are caught but code filenames (foo.rs / bar.mjs / package.json) are NOT.
+const DOMAIN_RE =
+  /\b(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+(?:com|ai|io|co|org|net|dev|app|xyz|so|gg|inc|us|uk|ca|de|eu|me|info|biz|tech|studio|cloud|sh|live|news|gov|edu|ly)\b/gi;
+function redact(s) {
+  if (RAW || !s) return s;
+  let t = s;
+  // secrets/keys/tokens first (before anything else can nibble their edges)
+  t = t.replace(/\b(?:sk|pk|rk)-[A-Za-z0-9_-]{16,}\b/g, "[token]");
+  t = t.replace(/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g, "[token]");
+  t = t.replace(/\bAKIA[0-9A-Z]{16}\b/g, "[token]");
+  t = t.replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g, "[token]");
+  t = t.replace(/\b[Bb]earer\s+[A-Za-z0-9._-]{16,}/g, "Bearer [token]");
+  // full URLs (host + path) collapse to [url] — a URL can carry a personal host and query params
+  t = t.replace(/\bhttps?:\/\/[^\s"'<>)\]]+/gi, "[url]");
+  // emails (before bare-domain pass; matches even TLD-truncated tails at a 200-char span boundary)
+  t = t.replace(EMAIL_RE, "[email]");
+  // IPv4
+  t = t.replace(/\b\d{1,3}(?:\.\d{1,3}){3}\b/g, "[ip]");
+  // bare domains (company / personal sites)
+  t = t.replace(DOMAIN_RE, "[domain]");
+  return t;
+}
+
+// ---------- autopsy self-echo filter ----------
+// This command prints error strings and symbols into the terminal; that output is itself captured in
+// the transcript. Without this guard a prior receipt's own text would re-enter as fresh "occurrences"
+// and manufacture recurrence/spirals out of nothing. Any turn that looks like autopsy output is dropped.
+const AUTOPSY_ECHO = [
+  "skalpel autopsy",
+  "nothing left this machine",
+  "density-gated spiral",
+  "re-surfaced across days",
+  "resurfaced across days",
+  "reproduce: re-read the cited",
+  "verified findings so far",
+  "This receipt was generated locally",
+  "the same corner of the codebase",
+  "No reproducible cross-session relation",
+  "recurred",
+  "cited turns",
+  "false join",
+  "all hit the error",
+  "in the same project",
+  "Your session hit the error",
+];
+const isAutopsyEcho = (s) => {
+  if (!s) return false;
+  const l = s.slice(0, 800);
+  // require two distinct markers to avoid nuking legitimate turns that merely say "recurred" once
+  let hits = 0;
+  for (const m of AUTOPSY_ECHO) {
+    if (l.includes(m)) {
+      hits++;
+      if (hits >= 2) return true;
+    }
+  }
+  return false;
+};
+
+// ---------- sourcing: user-typed vs tool/session output ----------
+// A witness is "you wrote" ONLY when it is a user-role turn whose anchor came from the typed message
+// body. Assistant text and tool_result output are "session output" — never attributed to the user.
+const isUserTyped = (w) => w.role === "user" && w.from === "message";
+const srcTag = (w) => (isUserTyped(w) ? "you wrote" : "session output");
+
+// ---------- main ----------
+async function main() {
+  const out = [];
+  const P = (s = "") => out.push(s);
+
+  // enumerate ALL top-level interactive session files (exclude nested subagent/workflow threads,
+  // which live under <session>/subagents/ and are not distinct user sessions).
+  let roots = [];
+  try {
+    roots = fs.readdirSync(PROJECTS_DIR).filter((d) => {
+      try {
+        return fs.statSync(path.join(PROJECTS_DIR, d)).isDirectory();
+      } catch {
+        return false;
+      }
+    });
+  } catch {
+    // no history at all
+  }
+  const files = [];
+  for (const r of roots) {
+    const dir = path.join(PROJECTS_DIR, r);
+    let entries = [];
+    try {
+      entries = fs.readdirSync(dir);
+    } catch {
+      continue;
+    }
+    for (const f of entries)
+      if (f.endsWith(".jsonl")) files.push({ file: path.join(dir, f), root: r });
+  }
+  files.sort((a, b) => {
+    try {
+      return fs.statSync(b.file).size - fs.statSync(a.file).size;
+    } catch {
+      return 0;
+    }
+  });
+
+  const fileIndex = new Map();
+  for (const { file } of files) fileIndex.set(path.basename(file, ".jsonl"), file);
+
+  const sessions = [];
+  let totalTurns = 0;
+  for (const { file, root } of files) {
+    const s = await parseSession(file, root);
+    if (s.turns.length) {
+      sessions.push(s);
+      totalTurns += s.turns.length;
+    }
+  }
+
+  // ============ CELL A: cross-session recurrence on deterministic anchors ============
+  const anchorMap = new Map();
+  for (const s of sessions) {
+    for (const turn of s.turns) {
+      const mineText = turn.boiler ? "" : turn.text || turn.toolErrText || "";
+      if (!mineText || isAutopsyEcho(mineText)) continue;
+      const errOnly = turn.mineErrOnly;
+      const seenThisTurn = new Set();
+      for (const { kind, anchor, at } of extractAnchors(mineText)) {
+        if (errOnly && !kind.startsWith("err")) continue;
+        const key = kind.startsWith("sym") ? anchor : kind + "|" + anchor.toLowerCase();
+        if (seenThisTurn.has(key)) continue;
+        seenThisTurn.add(key);
+        if (!anchorMap.has(key)) anchorMap.set(key, { kind, anchor, sessions: new Map() });
+        const rec = anchorMap.get(key);
+        if (!rec.sessions.has(s.sessionId)) {
+          rec.sessions.set(s.sessionId, {
+            session_id: s.sessionId,
+            turn_idx: turn.turn_idx,
+            ts: turn.ts,
+            role: turn.role,
+            root: turn.root,
+            from: errOnly ? "tool_output" : "message",
+            verbatim: span(mineText, at, anchor.length),
+          });
+        }
+      }
+    }
+  }
+  // THE HEADLINE BAR (all must hold to be asserted as a cross-session headline):
+  //   (a) SPECIFIC anchor — a concrete file/path/symbol, OR an error carrying a specific identifier
+  //       (rustc code E####, TS####, a named missing module/import, a panic with a location, SQLX_OFFLINE).
+  //       A BARE generic error class (ECONNREFUSED / ENOENT / TypeError / segfault / "borrow of moved
+  //       value") is SUPPRESSED — the token recurs across unrelated domains; it is noise, not insight.
+  //   (b) RELATED CONTEXT — the recurring witnesses must share a context. The concrete, deterministic
+  //       relatedness signal on disk is the project root (~/.claude/projects encodes the cwd). We take
+  //       the largest same-root group of witnesses and require it to be >= 2. A generic token colliding
+  //       across different project dirs (an IPC race here, a pricing-404 there) never clears this.
+  //   (c) NON-OBVIOUS — carried by (a)+(b): the SAME specific anchor recurring in the SAME project on
+  //       different days is a real friction point, not something the user would trivially recite.
+  //       (The strongest non-obvious signal — a density-gated in-session SPIRAL — is CELL C, below.)
+  // Bare exception classes and cross-session sym:path / sym:ident hits (harness/runtime tokens like
+  // resumeFromRunId, processTicksAndRejections) are still computed but NEVER asserted as a headline.
+  const ERR_SPECIFIC = new Set([
+    "err:rustc",
+    "err:tsc",
+    "err:notfound",
+    "err:unresolved",
+    "err:panic",
+    "err:sqlx",
+  ]);
+  const BARE_FILES = new Set([
+    "index.ts",
+    "index.js",
+    "index.tsx",
+    "index.mjs",
+    "index.jsx",
+    "mod.rs",
+    "main.rs",
+    "lib.rs",
+    "package.json",
+    "README.md",
+    "tsconfig.json",
+    "Cargo.toml",
+  ]);
+  const cellA = [];
+  for (const [, rec] of anchorMap) {
+    if (rec.sessions.size < 2) continue;
+    if (isTemplateTok(rec.anchor)) continue;
+    // (a) specificity gate
+    let eligible = false;
+    if (rec.kind.startsWith("err")) eligible = ERR_SPECIFIC.has(rec.kind);
+    else if (rec.kind === "sym:file") eligible = !BARE_FILES.has(rec.anchor);
+    // sym:path / sym:ident are intentionally NOT headline-eligible (harness/runtime token noise).
+    if (!eligible) continue;
+    // (b) relatedness gate — largest same-root witness group must be >= 2
+    const byRoot = new Map();
+    for (const w of rec.sessions.values()) {
+      const rk = w.root || "";
+      if (!byRoot.has(rk)) byRoot.set(rk, []);
+      byRoot.get(rk).push(w);
+    }
+    let topRoot = "",
+      topWit = [];
+    for (const [rk, ws] of byRoot)
+      if (ws.length > topWit.length) {
+        topWit = ws;
+        topRoot = rk;
+      }
+    if (topWit.length < 2) continue;
+    // An ERROR string's relatedness comes only from the project it recurs in — the HOME catch-all root is
+    // not a project, so a bare-home error recurrence is not "related context". A FILE anchor is itself the
+    // shared context (same file, different days), so it is allowed to recur across the home root.
+    if (rec.kind.startsWith("err") && isHomeRoot(topRoot)) continue;
+    topWit.sort((a, b) => (a.turn_idx || 0) - (b.turn_idx || 0));
+    let spec = rec.anchor.length + (rec.kind.startsWith("err") ? 20 : 6);
+    cellA.push({
+      kind: rec.kind,
+      anchor: rec.anchor,
+      relatedN: topWit.length,
+      root: topRoot,
+      spec,
+      nSessTotal: rec.sessions.size,
+      witnesses: topWit,
+    });
+  }
+  // most-recurring, then most-specific first
+  cellA.sort((a, b) => b.relatedN - a.relatedN || b.spec - a.spec);
+
+  // ============ CELL C: density-gated measured spiral (within a session) ============
+  const cellC = [];
+  for (const s of sessions) {
+    const perAnchor = new Map();
+    for (const turn of s.turns) {
+      const mineText = turn.boiler ? "" : turn.text || turn.toolErrText || "";
+      if (!mineText || !turn.tms || isAutopsyEcho(mineText)) continue;
+      const set = new Set();
+      for (const { kind, anchor } of extractAnchors(mineText)) {
+        if (!kind.startsWith("err")) continue;
+        const key = kind + "|" + anchor.toLowerCase();
+        if (set.has(key)) continue;
+        set.add(key);
+        if (!perAnchor.has(key)) perAnchor.set(key, { anchor, kind, turns: [] });
+        perAnchor.get(key).turns.push(turn);
+      }
+    }
+    for (const [, rec] of perAnchor) {
+      const GAP_MAX = 30 * 60000;
+      const all = rec.turns.slice().sort((a, b) => a.tms - b.tms);
+      let bestRun = [],
+        cur = [all[0]];
+      for (let i = 1; i < all.length; i++) {
+        if (all[i].tms - all[i - 1].tms <= GAP_MAX) cur.push(all[i]);
+        else {
+          if (cur.length > bestRun.length) bestRun = cur;
+          cur = [all[i]];
+        }
+      }
+      if (cur.length > bestRun.length) bestRun = cur;
+      const ts = bestRun;
+      if (ts.length < 3) continue;
+      const distinctTurns = new Set(ts.map((t) => t.turn_idx)).size;
+      if (distinctTurns < 3) continue;
+      const first = ts[0],
+        last = ts[ts.length - 1];
+      const durMin = (last.tms - first.tms) / 60000;
+      if (durMin <= 0 || durMin > 240) continue; // >240min => idle gap, not an active spiral
+      const hasUser = s.turns.some(
+        (t) =>
+          t.role === "user" &&
+          !t.boiler &&
+          t.text &&
+          t.turn_idx > first.turn_idx &&
+          t.turn_idx < last.turn_idx,
+      );
+      if (!hasUser) continue;
+      const genericExc = rec.kind === "err:exc"; // bare exception class: weak spiral anchor, demote
+      const mid = ts[Math.floor(ts.length / 2)];
+      // center the quoted span on the anchor occurrence so the reader SEES it in the quote (the reproduce
+      // check reads full turn text; without centering the anchor can fall outside the 200-char window).
+      const vb = (t) => {
+        const full = t.text || t.toolErrText || "";
+        const pos = full.toLowerCase().indexOf(rec.anchor.toLowerCase());
+        return pos < 0
+          ? full.replace(/\s+/g, " ").trim().slice(0, 200)
+          : span(full, pos, rec.anchor.length);
+      };
+      cellC.push({
+        session_id: s.sessionId,
+        root: first.root,
+        anchor: rec.anchor,
+        kind: rec.kind,
+        genericExc,
+        occurrences: ts.length,
+        distinct_turns: distinctTurns,
+        duration_min: +durMin.toFixed(1),
+        witnesses: [first, mid, last].map((t) => ({
+          session_id: s.sessionId,
+          turn_idx: t.turn_idx,
+          ts: t.ts,
+          role: t.role,
+          from: t.mineErrOnly ? "tool_output" : "message",
+          verbatim: vb(t),
+        })),
+      });
+    }
+  }
+  // Email-density demotion: a spiral whose witness spans are full of third-party emails is not a single-
+  // cause loop — it is a batch job hitting many different hosts that happen to share one generic errno
+  // (the same cross-context-collision pathology, just inside one session). A PII-clean coding spiral (an
+  // endpoint timing out, a hook aborting) is the real, shareable signal and must rank above it.
+  for (const r of cellC) {
+    let emails = 0;
+    for (const w of r.witnesses) {
+      const m = (w.verbatim || "").match(EMAIL_RE);
+      if (m) emails += m.length;
+    }
+    r.emailHits = emails;
+    // >= 2 email hits across the spans = a contact-list batch (many hosts). A lone hit is almost always
+    // an npm spec / version string / git ref false-positive, so it must not demote a clean coding spiral.
+    // (Real emails are redacted from the DISPLAY regardless; this threshold only governs RANKING.)
+    r.piiDense = emails >= 2 ? 1 : 0;
+  }
+  cellC.sort(
+    (a, b) =>
+      a.piiDense - b.piiDense ||
+      a.genericExc - b.genericExc ||
+      b.duration_min - a.duration_min ||
+      b.occurrences - a.occurrences,
+  );
+
+  // ============ assemble up to 3 VERIFIED, re-derived relations ============
+  // Every survivor is re-derived from disk; only relations whose anchor is still verbatim in >= 2 cited
+  // sessions/turns are rendered. Bare exception classes and cross-session sym:ident/sym:path hits
+  // (harness/runtime tokens) are computed but NEVER asserted as a cross-session headline.
+  // Editorial order (strongest, most non-obvious first):
+  //   class 1 — the single strongest measured SPIRAL (CELL C): density-gated, single-context, wall-clock.
+  //             This is the most non-obvious signal, so it leads. A generic error CLASS is allowed here
+  //             ONLY because a spiral is one session in one context — it is NOT a cross-context collision.
+  //   class 2 — SPECIFIC cross-session errors sharing a project root (up to 2).
+  //   class 3 — SPECIFIC files you kept returning to in the same project (fill remaining slots).
+  const errorsA = cellA.filter((r) => r.kind.startsWith("err"));
+  const filesA = cellA.filter((r) => r.kind === "sym:file");
+  const rendered = [];
+  const takeA = (r) => {
+    const rep = reproduceCount(fileIndex, r.anchor, r.witnesses);
+    if (rep.confirmed < 2) return false;
+    rendered.push({ cell: "A", ...r, rep });
+    return true;
+  };
+
+  // class 1: the single strongest measured spiral
+  for (const r of cellC) {
+    if (rendered.length >= 3) break;
+    const rep = reproduceCount(fileIndex, r.anchor, r.witnesses);
+    if (rep.confirmed < 2) continue;
+    rendered.push({ cell: "C", ...r, rep });
+    break;
+  }
+
+  // class 2: specific cross-session errors in a shared project (up to 2)
+  let c2 = 0;
+  for (const r of errorsA) {
+    if (rendered.length >= 3 || c2 >= 2) break;
+    if (takeA(r)) c2++;
+  }
+
+  // class 3: specific files you kept returning to (fill remaining slots)
+  for (const r of filesA) {
+    if (rendered.length >= 3) break;
+    takeA(r);
+  }
+
+  // ---------- render ----------
+  P();
+  P("  skalpel autopsy");
+  P("  " + RULE);
+  P(
+    `  read ${sessions.length} local session${sessions.length === 1 ? "" : "s"} · ${totalTurns} turns · nothing left this machine`,
+  );
+  P();
+
+  if (rendered.length === 0) {
+    // HONEST ZERO-STATE — a live counter, never a fabricated finding.
+    P("  No reproducible cross-session relation has crossed the bar yet.");
+    P();
+    if (sessions.length === 0) {
+      P("  There's no Claude Code history on this machine to read.");
+    } else {
+      P(
+        `  verified findings so far: 0  ·  scanned ${totalTurns} turns across ${sessions.length} session${sessions.length === 1 ? "" : "s"}`,
+      );
+      P();
+      P("  The bar is deliberately high. A headline needs a SPECIFIC anchor — a");
+      P("  concrete file or symbol, or an error carrying an identifier (not a bare");
+      P("  ECONNREFUSED / TypeError) — recurring in the SAME project across two");
+      P("  sessions, or the same error spiralling inside one. Generic error-class");
+      P("  collisions across unrelated projects are suppressed on purpose. This is");
+      P("  a live count, not a verdict: keep coding and the first real finding will");
+      P("  render itself here, with receipts.");
+    }
+    P();
+    P("  " + RULE);
+    renderFooter(P);
+    process.stdout.write(out.join("\n") + "\n");
+    return;
+  }
+
+  let n = 0;
+  for (const r of rendered) {
+    n++;
+    P(`  ${n}.`);
+    if (r.cell === "A") {
+      const shown = r.witnesses.slice(0, 3);
+      const proj = projTail(r.root);
+      const where = proj ? ` in ${proj}` : "";
+      if (r.kind === "sym:file") {
+        // "returning to a file" is a behavior sourced from either side; the FILENAME is the shared context.
+        P(`  You kept returning to the file ${r.anchor} across ${r.relatedN} separate`);
+        P(`  sessions${where} — the same file, on different days.`);
+      } else {
+        // errors here are compiler/runtime output — sourced to the SESSION, never "you hit".
+        const anyUser = shown.some(isUserTyped);
+        if (anyUser) {
+          P(`  ${plainAnchor(r.kind, r.anchor)} came up across ${r.relatedN} separate`);
+          P(`  sessions${where} — the same specific error, on different days.`);
+        } else {
+          P(`  Your sessions hit ${plainAnchor(r.kind, r.anchor)} across ${r.relatedN}`);
+          P(`  separate sessions${where} — the same specific error resurfaced across days.`);
+        }
+      }
+      P();
+      for (const w of shown) {
+        P(
+          `    ${short(w.session_id)} · turn ${w.turn_idx} · ${shortTs(w.ts)} · ${srcTag(w)}${projLabel(w.root)}`,
+        );
+        P(`      "${redact(w.verbatim)}"`);
+      }
+      P();
+      P(`    reproduce: re-read the cited sessions fresh from disk at the cited`);
+      P(`    turns → anchor present verbatim in ${r.rep.confirmed}/${r.rep.total} cited sessions`);
+      P(
+        `    (${r.rep.total - r.rep.confirmed} false join${r.rep.total - r.rep.confirmed === 1 ? "" : "s"}). Files:`,
+      );
+      for (const w of shown) {
+        const f = fileIndex.get(w.session_id);
+        if (f) P(`      ${f}  @turn ${w.turn_idx}`);
+      }
+    } else {
+      // CELL C — measured spiral. State the mechanical fact; the quoted turns self-adjudicate.
+      const proj = projTail(r.root);
+      const where = proj ? ` in ${proj}` : "";
+      P(`  ${plainAnchor(r.kind, r.anchor)} recurred ${r.occurrences}× inside one session${where}`);
+      P(
+        `  over a ${r.duration_min}-minute window (wall-clock), across ${r.distinct_turns} turns with`,
+      );
+      P(`  your replies in between — a density-gated spiral (gaps <=30min).`);
+      P(`  The cited turns (● you wrote · ○ session output):`);
+      P();
+      for (const w of r.witnesses) {
+        const mark = isUserTyped(w) ? "●" : "○";
+        P(
+          `    ${mark} ${short(w.session_id)} · turn ${w.turn_idx} · ${shortTs(w.ts)}${projLabel(w.root)}`,
+        );
+        P(`      "${redact(w.verbatim)}"`);
+      }
+      P();
+      P(`    reproduce: re-read this session fresh from disk at the cited turns →`);
+      P(
+        `    anchor present verbatim at all ${r.rep.confirmed}/${r.rep.total} cited turns (of ${r.occurrences} total`,
+      );
+      P(`    occurrences); the ${r.duration_min}min span = last.ts − first.ts, both quoted. File:`);
+      const f = fileIndex.get(r.session_id);
+      if (f) P(`      ${f}`);
+    }
+    P();
+    P("  " + RULE);
+  }
+
+  renderFooter(P);
+  process.stdout.write(out.join("\n") + "\n");
+}
+
+function renderFooter(P) {
+  P();
+  P("  This receipt was generated locally, read-only, with zero network calls —");
+  P("  rendered from files already on your disk (~/.claude/projects, ~/.skalpel).");
+  P("  Every number above re-derives from the raw logs at the cited turns.");
+  P();
+  if (RAW) {
+    P("  --raw: third-party emails / domains / IPs / secrets are shown UNREDACTED");
+    P("  (local screen only). Drop --raw before sharing a screenshot.");
+  } else {
+    P("  Shareable-safe: third-party emails, domains, IPs and secrets in the quoted");
+    P("  spans are redacted to [email]/[domain]/[ip]/[token]. Run with --raw to reveal.");
+  }
+  P();
+  P("  Honest scope: this AUTOPSY is local. The rest of skalpel is not yet —");
+  P("  the per-turn hook and session-end ingest still upload transcripts today.");
+  P("  Zero-network ingest is a later cycle; this receipt is the first step.");
+  P();
+}
+
+main().catch((e) => {
+  // fail closed and quiet: never crash a user's terminal, never invent output.
+  process.stderr.write(`skalpel autopsy: ${e && e.message ? e.message : e}\n`);
+  process.exit(0);
+});