@remits/remits-cli 0.1.126 → 0.1.128

package/README.md

@@ -28,7 +28,7 @@ remits-cli components stage                   # FULL SNAPSHOT of the repo into t
 remits-cli components status
 remits-cli components clear
 remits-cli test run --test 45
-remits-cli test run --test "My New Test" --names "test case 1,test case 2"
+remits-cli test run --test "My New Test" --names "test case 1|test case 2"
 git add -A
 git commit -m "sync passing changes"
 git push
@@ -98,7 +98,8 @@ remits-cli install --skills --overwrite true
 - Branch defaults to the current local git branch.
 - Data mode defaults to `test`. For `remits-cli test run`, that default is now enforced even if the most-recent authenticated session for the account is `prod`; a production test run therefore requires an explicit `--data-mode prod` on the command line. Use `remits-cli data-mode set prod` only for production investigation.
 - If the same account is authenticated against more than one host and you omit `--base-url`, the CLI auto-resolves the best matching session and now prints the resolved host. Pass `--base-url` explicitly whenever the target host matters.
-- Avoid commas in individual test names. The `--names` filter is comma-delimited, so a single test case whose name contains commas cannot be targeted cleanly through `remits-cli test run --names ...`.
+- `--names` is `|`-delimited and may be repeated. A comma still splits a single value for compatibility,
+  so a case name containing a comma should be passed with `|` or by repeating `--names`.
 - Nested help is available before required-argument validation, including `remits-cli test run --help`, `remits-cli components sync --help`, and `remits-cli tool --help`.
 - `components sync --safe` is the recommended agent path on a variant branch. It expands to `--summary --changed-only --fail-on-errors --fail-on-removed`, resolves `--changed-since` from the branch's merge base with trunk when you did not name one (local refs only; it never runs an implicit `git fetch`), and prints the planned writes before mutating unless `--yes` is passed. On trunk there is no plan to gate, so it states what a trunk reconcile does and requires `--yes`.
 - `components sync` has fail-closed safety gates for unattended/agent use. Each exits non-zero instead of printing a wall of JSON: `--changed-only` (fail unless every planned write is a component this checkout edited), `--names-only` (print only `BUCKET type:id name` lines), `--fail-on-removed`, `--fail-on-errors`, and `--expected-removed <type:id>` (repeatable or comma-delimited; implies `--fail-on-removed`, so any removal you did not name fails). `--changed-only` also fails closed when the checkout is not a git working tree, because "git could not answer" must never be read as "nothing changed".

package/index.js

@@ -6,16 +6,16 @@
 - L22  Runtime Bootstrap And Shared State
 - L116  Sessions, Account Resolution, And Production Guards
 - L595  Local State, Workspaces, And Verification Evidence
-- L1234  Account Repos, Guide Sync, And Platform Repo
-- L1892  Component Discovery And HTTP Logging
-- L2382  Skill Delivery And TOC Resolution
-- L2692  Auth And Component Staging
-- L3280  Component Summaries, Status, And Sync Gates
-- L4991  Branches, Promotion, Commit, And Test Runs
-- L5988  Tokens, Tools, Verification, And Config
-- L6889  Service Dashboard And WebSocket Listener
-- L8984  Agent And Ticket Workflows
-- L12042  Help, Auto Update, And Command Dispatch
+- L1399  Account Repos, Guide Sync, And Platform Repo
+- L2057  Component Discovery And HTTP Logging
+- L2549  Skill Delivery And TOC Resolution
+- L2859  Auth And Component Staging
+- L3457  Component Summaries, Status, And Sync Gates
+- L5323  Branches, Promotion, Commit, And Test Runs
+- L6562  Tokens, Tools, Verification, And Config
+- L7478  Service Dashboard And WebSocket Listener
+- L9573  Agent And Ticket Workflows
+- L12631  Help, Auto Update, And Command Dispatch
 */
 
 /*
@@ -811,6 +811,58 @@ function writeToolResponseFile(cwd, callId, responsePayload) {
   return file;
 }
 
+function fileEvidence(pathname) {
+  if (!pathname || !fs.existsSync(pathname)) return {};
+  const body = fs.readFileSync(pathname);
+  return {
+    responseFile: pathname,
+    bytes: body.length,
+    sha256: sha256(body)
+  };
+}
+
+const LARGE_TOOL_RESPONSE_BYTES = 200 * 1024;
+
+function formatToolResponseFile(pathname) {
+  const evidence = fileEvidence(pathname);
+  if (!evidence.bytes) return String(pathname || '');
+  return pathname + ' (' + evidence.bytes + ' bytes, sha256 ' + evidence.sha256.slice(0, 12) + ')';
+}
+
+function printToolResponseFileLine(label, pathname) {
+  console.log(label + ':', formatToolResponseFile(pathname));
+  const evidence = fileEvidence(pathname);
+  if (evidence.bytes && evidence.bytes >= LARGE_TOOL_RESPONSE_BYTES) {
+    console.log('Large response: inspect selectively with jq or targeted offset reads instead of opening the whole file.');
+  }
+}
+
+function boundedToolExcerpt(data = {}) {
+  const result = data.result && typeof data.result === 'object' ? data.result : {};
+  const candidates = [
+    data.message,
+    data.toolMessage,
+    data.error,
+    result.message,
+    result.error,
+    result.reason
+  ].filter(Boolean).map((value) => String(value));
+  const excerpt = candidates.join(' | ').trim();
+  return excerpt ? excerpt.slice(0, 1200) : null;
+}
+
+function toolEvidenceSummary(data = {}, responseFile) {
+  return Object.assign({
+    callId: data.callId,
+    name: data.name,
+    async: data.async,
+    status: data.status,
+    toolSuccess: data.toolSuccess,
+    threadGroupingId: data.threadGroupingId,
+    message: boundedToolExcerpt(data)
+  }, fileEvidence(responseFile));
+}
+
 function readToolResponseFile(cwd, callId) {
   if (!callId) return null;
   const paths = ensureLocalState(cwd);
@@ -946,6 +998,35 @@ function readLocalVerificationEnvelope(cwd, envelopeId) {
   }
 }
 
+function readLocalVerificationPackets(cwd, envelopeId, filters = {}) {
+  const paths = verificationPaths(cwd, envelopeId);
+  const packets = [];
+  if (fs.existsSync(paths.packetsDir)) {
+    fs.readdirSync(paths.packetsDir)
+      .filter((name) => name.endsWith('.json'))
+      .forEach((name) => {
+        try {
+          const parsed = JSON.parse(fs.readFileSync(path.join(paths.packetsDir, name), 'utf8'));
+          if (parsed && typeof parsed === 'object') packets.push(parsed);
+        } catch (_) {
+          // Ignore one malformed local packet; the rest of the envelope remains useful.
+        }
+      });
+  }
+  if (!packets.length) {
+    const envelope = readLocalVerificationEnvelope(cwd, envelopeId);
+    if (envelope && Array.isArray(envelope.packets)) packets.push(...envelope.packets);
+  }
+  const type = filters.type || filters.packetType;
+  const suite = filters.suite || filters.testName;
+  const max = parsePositiveInt(filters.max, 50);
+  const filtered = packets
+    .filter((packet) => !type || packet.type === type)
+    .filter((packet) => !suite || testRunSuiteNameFromPacket(packet) === String(suite))
+    .sort((a, b) => Number(a.createdAt || 0) - Number(b.createdAt || 0));
+  return filtered.slice(Math.max(0, filtered.length - max));
+}
+
 function writeLocalVerificationPacket(cwd, envelopeId, packet) {
   if (!envelopeId || !packet) return null;
   const paths = verificationPaths(cwd, envelopeId);
@@ -1067,11 +1148,13 @@ function printVerificationSummaryLine(env) {
   const failures = env.currentFailureCount ? ' currentFailures=' + env.currentFailureCount : (env.failedCount ? ' failed=' + env.failedCount : '');
   const required = ' required=' + (env.satisfiedCount || 0) + '/' + (env.requiredCount || 0);
   const noManifest = env.noRequiredEvidence ? ' no-manifest' : '';
+  const stale = env.staleCount ? ' stale=' + env.staleCount : '';
+  const changed = env.requirementsChangedAfterEvidence ? ' requirements-changed' : '';
   const lane = [env.branchName || 'unknown-branch', env.workspace ? 'ws:' + env.workspace : 'shared', env.dataMode || null, env.sourceLayer || null]
     .filter(Boolean).join(' | ');
-  console.log('- ' + (env.envelopeId || '(no id)') + '  ' + (env.status || 'unknown') + health + failures + required + noManifest);
+  console.log('- ' + (env.envelopeId || '(no id)') + '  ' + (env.status || 'unknown') + health + failures + required + stale + noManifest + changed);
   if (env.summary) console.log('  ' + env.summary);
-  console.log('  ' + lane + '  packets=' + (env.packetCount || 0) + '  updated=' + formatTime(env.updatedAtMs || env.latestPacketAtMs));
+  console.log('  ' + lane + '  packets=' + (env.packetCount || 0) + '  lastPacket=' + formatTime(env.lastPacketAtMs || env.latestPacketAtMs) + '  updated=' + formatTime(env.updatedAtMs || env.latestPacketAtMs));
 }
 
 function printVerificationEnvelope(envelope, fallbackEnvelopeId) {
@@ -1088,6 +1171,12 @@ function printVerificationEnvelope(envelope, fallbackEnvelopeId) {
   if (evaluation.failedCount) {
     console.log('Failed packets:', evaluation.failedCount, 'current failures:', evaluation.currentFailureCount || 0);
   }
+  if (evaluation.requirementsChangedAfterEvidence) {
+    console.log('Requirements changed after evidence was collected.');
+  }
+  if (Array.isArray(evaluation.stale) && evaluation.stale.length) {
+    console.log('Stale packets:', evaluation.stale.length);
+  }
   const packets = Array.isArray(envelope.packets) ? envelope.packets : [];
   console.log('Packets:', packets.length);
   packets.slice(-20).forEach((packet) => {
@@ -1100,12 +1189,78 @@ function printVerificationEnvelope(envelope, fallbackEnvelopeId) {
   }
 }
 
+function printAcceptanceWarnings(envelope) {
+  const warnings = envelope && envelope.acceptance && Array.isArray(envelope.acceptance.warnings)
+    ? envelope.acceptance.warnings
+    : [];
+  if (!warnings.length) return;
+  console.log('Manifest warnings:');
+  warnings.forEach((warning) => {
+    console.log('- ' + (warning.message || warning.code || JSON.stringify(warning)));
+  });
+}
+
+function printEnvelopeWarnings(envelope) {
+  const warnings = envelope && Array.isArray(envelope.warnings) ? envelope.warnings : [];
+  if (!warnings.length) return;
+  console.log('Envelope warnings:');
+  warnings.forEach((warning) => {
+    console.log('- ' + (warning.message || warning.code || JSON.stringify(warning)));
+    if (Array.isArray(warning.envelopes) && warning.envelopes.length) {
+      warning.envelopes.forEach((env) => {
+        console.log('  ' + (env.envelopeId || '(no id)') + (env.status ? ' ' + env.status : ''));
+      });
+    }
+  });
+}
+
+function manifestRequiredEvidence(manifest = {}) {
+  const required = [];
+  if (Array.isArray(manifest.requiredEvidence)) required.push(...manifest.requiredEvidence);
+  const journeys = Array.isArray(manifest.journeys) ? manifest.journeys :
+    (Array.isArray(manifest.requestedJourneys) ? manifest.requestedJourneys : []);
+  journeys.forEach((journey) => {
+    if (journey && Array.isArray(journey.requiredEvidence)) required.push(...journey.requiredEvidence);
+  });
+  return required;
+}
+
+async function readVerificationEnvelopeForDiagnostics(api, cwd, session, accountId, envelopeId) {
+  if (!envelopeId) return null;
+  try {
+    const response = await postVerificationCommand(api, cwd, session, accountId, 'show', { envelopeId });
+    if (response.envelope) {
+      writeLocalVerificationEnvelope(cwd, response.envelope);
+      return response.envelope;
+    }
+  } catch (_) {
+    // Local evidence is still useful for diagnostics when the platform read fails.
+  }
+  return readLocalVerificationEnvelope(cwd, envelopeId);
+}
+
+async function readVerificationPacketsForDiagnostics(api, cwd, session, accountId, envelopeId, filters = {}) {
+  if (!envelopeId) return [];
+  try {
+    const response = await postVerificationCommand(api, cwd, session, accountId, 'packets', Object.assign({ envelopeId }, filters));
+    if (Array.isArray(response.packets)) return response.packets;
+  } catch (_) {
+    // Local full-fidelity packet files remain the fallback when the platform read is unavailable.
+  }
+  return readLocalVerificationPackets(cwd, envelopeId, filters);
+}
+
 function buildCommandWorld(response, fallback = {}) {
   const source = (response && response.staging) || {};
   const resolution = (response && response.resolution) || {};
+  const result = (response && response.result) || {};
+  const laneHash = laneContentHashFrom(response) || fallback.laneContentHash || fallback.stagedOverlayHash;
+  const executionAccountId = response && (response.executionAccountId || result.accountId || source.executionAccountId || response.accountId) ||
+    resolution.executionAccountId ||
+    fallback.executionAccountId;
   return {
     accountId: response && (response.accountId || response.ownerAccountId) || fallback.accountId,
-    executionAccountId: response && (response.executionAccountId || response.accountId) || resolution.executionAccountId || fallback.executionAccountId,
+    executionAccountId,
     addressedAccountId: resolution.addressedAccountId || fallback.addressedAccountId,
     host: fallback.host,
     dataMode: response && response.dataMode || fallback.dataMode,
@@ -1113,16 +1268,26 @@ function buildCommandWorld(response, fallback = {}) {
     branchName: response && response.branchName || fallback.branchName,
     workspace: response && response.workspace !== undefined ? response.workspace : fallback.workspace,
     stagingLane: response && response.stagingLane || source.stagingLane || fallback.stagingLane,
+    laneContentHash: laneHash,
+    stagedOverlayHash: laneHash,
     // `variantWorld.componentBranch` is the platform's answer for the run (the variant branch, else the
     // subscription); a bare `variantBranch` is null whenever the subscription decided.
     componentBranch: resolution.componentBranch ||
       response && ((response.variantWorld && response.variantWorld.componentBranch) || response.variantBranch) ||
       fallback.componentBranch,
+    variantBranchSource: response && (response.variantBranchSource || (response.variantWorld && response.variantWorld.variantBranchSource)) || fallback.variantBranchSource,
     variantId: resolution.variantId || fallback.variantId,
     sourceLayer: fallback.sourceLayer || (source.testComponentSource === 'staged' ? 'staged' : undefined)
   };
 }
 
+function laneContentHashFrom(response) {
+  if (!response) return null;
+  const laneSummary = response.laneSummary || (response.staging && response.staging.laneSummary) ||
+    (response.componentStatus && response.componentStatus.laneSummary);
+  return laneSummary && laneSummary.contentHash ? laneSummary.contentHash : null;
+}
+
 function normalizeName(name) {
   return name.replace(/([a-z])([A-Z])/g, '$1 $2').replace(/\s+/g, ' ').trim();
 }
@@ -2333,21 +2498,23 @@ async function loggedPost(api, cwd, endpoint, payload, options = {}) {
     error = err;
     throw err;
   } finally {
-    const status = error ? 'error' : 'success';
-    const responseForLog = responseFile
-      ? { responseFile, note: 'Tool response stored externally' }
-      : sanitizeForLog(responseData);
-    appendSessionLog(cwd, {
-      ts: new Date().toISOString(),
-      requestId,
-      endpoint,
-      method: 'POST',
-      status,
-      durationMs: Date.now() - started,
-      request: sanitizeForLog(payload),
-      response: responseForLog,
-      error: error ? describeError(error) : null
-    });
+    if (!options.skipSessionLog) {
+      const status = error ? 'error' : 'success';
+      const responseForLog = responseFile
+        ? { responseFile, note: 'Tool response stored externally' }
+        : sanitizeForLog(responseData);
+      appendSessionLog(cwd, {
+        ts: new Date().toISOString(),
+        requestId,
+        endpoint,
+        method: 'POST',
+        status,
+        durationMs: Date.now() - started,
+        request: sanitizeForLog(payload),
+        response: responseForLog,
+        error: error ? describeError(error) : null
+      });
+    }
   }
 }
 
@@ -3057,6 +3224,7 @@ async function pushComponentsCommand(flags) {
         rawRefs: { command: 'components stage' },
         stage: (err.responseBody || {}).stage,
         compileValidation: (err.responseBody || {}).compileValidation,
+        refusalDetails: stageRefusalDetails(err.responseBody || {}),
         changedFromWorkingTree: changedFromWorkingTree || [],
         unrepresentableChanges: unstageable
       }, { quiet: true });
@@ -3091,6 +3259,7 @@ async function pushComponentsCommand(flags) {
     rawRefs: { command: 'components stage' },
     stage: response.stage,
     laneSummary: response.laneSummary,
+    compileValidation: response.compileValidation || null,
     changedFromWorkingTree: response.changedFromWorkingTree,
     unrepresentableChanges: response.unrepresentableChanges
   }, { quiet: flagEnabled(flags.json) });
@@ -3276,6 +3445,14 @@ async function stageOrRefuse(api, cwd, payload) {
   }
 }
 
+function stageRefusalDetails(body = {}) {
+  const details = {};
+  ['duplicates', 'compileValidation', 'policy', 'editLease', 'skipped', 'reconcile', 'laneHoldsRejectedSource'].forEach((key) => {
+    if (body[key] !== undefined) details[key] = sanitizeForLog(body[key]);
+  });
+  return Object.keys(details).length ? details : undefined;
+}
+
 /*
 ## Component Summaries, Status, And Sync Gates
 */
@@ -3331,6 +3508,10 @@ function printCompileValidation(validation, options) {
   // A skip is neither a pass nor a failure, and it used to be printed as a pass ("1/1 compiled" over a
   // component whose source was blank). Named, so the reader knows exactly what was NOT looked at.
   const unchecked = Array.isArray(validation.unchecked) ? validation.unchecked : [];
+  const warnings = Array.isArray(validation.warnings) ? validation.warnings : [];
+  warnings.forEach((warning) => {
+    emit('  Warning: ' + (warning.message || JSON.stringify(warning)));
+  });
   if (unchecked.length) {
     emit('  ' + unchecked.length + ' NOT compile-checked: ' + unchecked.map((entry) =>
       (entry.type || 'component') + ' ' + (entry.id || entry.name || '?') + ' (' + (entry.reason || 'unchecked') + ')').join(', '));
@@ -3495,6 +3676,9 @@ function printStageSummary(response, flags) {
   // The CLI's own findings (deleted files) and the platform's (a README withheld on a variant branch) are
   // different sources. Preferring the first whenever it existed — even as an empty list — hid the second.
   printUnrepresentableChanges(mergeUnrepresentable(response.unrepresentableChanges, stage.unrepresentable));
+  if (typeof printOrphanedWorkspaceWarning === 'function') {
+    printOrphanedWorkspaceWarning(response);
+  }
   if (typeof printAccountLanes === 'function') {
     printAccountLanes(response);
   }
@@ -3519,7 +3703,9 @@ function describeStageMode(mode) {
 function printStatusSummary(response, flags) {
   printBranchContext(response);
   printStagingLane(response.branchName, response.workspace, null);
+  printStagingLaneOwnerNotice(response);
   printLaneSummary(response);
+  printOrphanedWorkspaceWarning(response);
   printStagingFreshness(response.freshness);
   printRepositoryCheck(response.repositoryCheck);
   printComponentTypeCounts(response.entries || []);
@@ -3545,6 +3731,28 @@ function printStatusSummary(response, flags) {
   printComponentCommandResponse('Components staging', response, flags);
 }
 
+function stagingLaneOwnerNotice(response = {}) {
+  const owner = response.laneOwnerAccountId != null ? response.laneOwnerAccountId :
+    (response.staging && response.staging.laneOwnerAccountId);
+  const checkout = response.checkoutAccountId != null ? response.checkoutAccountId :
+    (response.accountId != null ? response.accountId : (response.staging && response.staging.checkoutAccountId));
+  const stagedCount = Number(response.stagedCount != null ? response.stagedCount :
+    (response.laneSummary && response.laneSummary.stagedCount != null ? response.laneSummary.stagedCount :
+      (response.staging && response.staging.stagedCount != null ? response.staging.stagedCount :
+        (response.staging && response.staging.laneSummary && response.staging.laneSummary.stagedCount))));
+  if (owner == null || checkout == null || String(owner) === String(checkout) || !(stagedCount > 0)) {
+    return [];
+  }
+  return [
+    'WARNING: staged entries shown here are under account ' + owner + ', not checkout account ' + checkout + '.',
+    '  clear with: remits-cli components clear --all --account-id ' + owner
+  ];
+}
+
+function printStagingLaneOwnerNotice(response = {}) {
+  stagingLaneOwnerNotice(response).forEach((line) => console.log(line));
+}
+
 function printLanesSummary(response, flags) {
   printBranchContext(response);
   const lanes = Array.isArray(response.lanes) ? response.lanes : (Array.isArray(response.accountLanes) ? response.accountLanes : []);
@@ -3678,6 +3886,36 @@ function printAccountLanes(response) {
   console.log('  resolves the account\'s subscription beneath its staged entries and cannot be landed.');
 }
 
+function printOrphanedWorkspaceWarning(response) {
+  const currentCount = Number((response && response.stagedCount) ||
+    (response && response.laneSummary && response.laneSummary.stagedCount) || 0);
+  if (currentCount > 0) return;
+  const lanes = Array.isArray(response && response.accountLanes) ? response.accountLanes : [];
+  const currentBranch = response && response.branchName;
+  const currentWorkspace = response && response.workspace;
+  const orphan = lanes.find((lane) => lane && lane.sameWorkspaceOtherBranch === true);
+  if (!orphan) return;
+  const age = orphan.updatedAtMs ? formatAge(Date.now() - Number(orphan.updatedAtMs)) + ' ago' : 'recently';
+  console.log('');
+  console.log('WARNING: Your workspace "' + (currentWorkspace || orphan.workspace || 'shared') + '" has ' +
+    (orphan.stagedCountAsOf || orphan.stagedCount || 0) + ' staged entr' +
+    ((orphan.stagedCountAsOf || orphan.stagedCount || 0) === 1 ? 'y' : 'ies') +
+    ' on branch "' + orphan.branchName + '" (staged ' + age + '); this checkout is now on "' +
+    (currentBranch || 'unknown') + '". Re-stage here, or switch back.');
+}
+
+function formatAge(ms) {
+  const value = Number(ms);
+  if (!Number.isFinite(value) || value < 0) return 'unknown age';
+  const seconds = Math.round(value / 1000);
+  if (seconds < 90) return seconds + 's';
+  const minutes = Math.round(seconds / 60);
+  if (minutes < 90) return minutes + 'm';
+  const hours = Math.round(minutes / 60);
+  if (hours < 48) return hours + 'h';
+  return Math.round(hours / 24) + 'd';
+}
+
 // The world a lane row resolves, from the platform's answer. null onTrunk means the owner could not be
 // resolved, and a non-trunk lane without a reported source (an older platform) is only known to be
 // non-trunk — never guessed to be a variant branch. Pure.
@@ -3846,6 +4084,7 @@ async function statusComponentsCommand(flags) {
   // supplies the facts (the last SHA it synced, each entry's base) and the comparison happens here.
   response.freshness = stagingFreshness({
     head: safeGitValue(cwd, 'git rev-parse HEAD'),
+    originHead: safeGitValue(cwd, 'git rev-parse ' + shellQuote('origin/' + branchName)),
     lastSyncedSha: response.branchContext && response.branchContext.lastSyncedSha,
     entries: response.entries,
     laneSummary: response.laneSummary,
@@ -3888,19 +4127,25 @@ async function lanesComponentsCommand(flags) {
   const dataMode = resolveDataMode(flags, session);
   const api = buildAxios(baseUrl, session.token);
 
-  const response = await loggedPost(api, cwd, '/cli/components', {
+  const requestPayload = {
     token: session.token,
     accountId,
     branchName,
     workspace,
     dataMode,
     mode: 'lanes'
-  }).then((r) => r.data);
+  };
+
+  let response = await loggedPost(api, cwd, '/cli/components', requestPayload).then((r) => r.data);
 
   if (!response.success) {
     throw new Error(response.message || 'Staging lanes failed');
   }
 
+  if (flagEnabled(flags['wait-change']) || flagEnabled(flags.waitChange)) {
+    response = await waitForLaneChange(api, cwd, requestPayload, response, flags);
+  }
+
   if (flagEnabled(flags.json)) {
     console.log(JSON.stringify(response, null, 2));
     return response;
@@ -3913,6 +4158,55 @@ async function lanesComponentsCommand(flags) {
   return response;
 }
 
+function laneWaitSignature(response, laneId) {
+  const lanes = Array.isArray(response && response.lanes)
+    ? response.lanes
+    : (Array.isArray(response && response.accountLanes) ? response.accountLanes : []);
+  const selected = laneId ? lanes.filter((lane) => String(lane.laneId || '') === String(laneId)) : lanes;
+  return stableStringify(selected.map((lane) => ({
+    laneId: lane.laneId,
+    accountId: lane.accountId,
+    branchName: lane.branchName,
+    workspace: lane.workspace || null,
+    stagedCount: lane.stagedCountAsOf || lane.stagedCount || 0,
+    contentHash: lane.contentHash || (lane.laneSummary && lane.laneSummary.contentHash) || null,
+    updatedAtMs: lane.updatedAtMs || null
+  })));
+}
+
+async function waitForLaneChange(api, cwd, requestPayload, initialResponse, flags) {
+  const laneId = flags['lane-id'] || flags.laneId || flags.lane;
+  const timeoutSeconds = parsePositiveInt(flags.timeout || flags['timeout-seconds'] || flags.timeoutSeconds, 600);
+  const pollMs = parsePositiveInt(flags['poll-ms'] || flags.pollMs, 2000);
+  const started = Date.now();
+  const initialSignature = laneWaitSignature(initialResponse, laneId);
+  if (!flagEnabled(flags.json)) {
+    console.log('Waiting for staging lane change' + (laneId ? ' on ' + laneId : '') + ' for up to ' + timeoutSeconds + 's...');
+  }
+  while (Date.now() - started < timeoutSeconds * 1000) {
+    await new Promise((resolve) => setTimeout(resolve, pollMs));
+    const next = await loggedPost(api, cwd, '/cli/components', requestPayload, { skipSessionLog: true }).then((r) => r.data);
+    if (!next.success) {
+      throw new Error(next.message || 'Staging lanes failed while waiting for a change');
+    }
+    if (laneWaitSignature(next, laneId) !== initialSignature) {
+      next.waitChange = {
+        changed: true,
+        laneId: laneId || null,
+        waitedMs: Date.now() - started
+      };
+      return next;
+    }
+  }
+  initialResponse.waitChange = {
+    changed: false,
+    laneId: laneId || null,
+    waitedMs: Date.now() - started,
+    timeoutSeconds
+  };
+  return initialResponse;
+}
+
 async function entriesComponentsCommand(flags) {
   const cwd = process.cwd();
   ensureLocalState(cwd);
@@ -4108,6 +4402,30 @@ async function syncComponentsCommand(rawFlags) {
       }
       throw new Error(mismatch + ' Nothing was synced.');
     }
+    const featureRefusal = !namesOnly ? featureBranchSyncRefusal(branchContext, branchName, flags) : null;
+    if (featureRefusal) {
+      if (flagEnabled(flags.json)) {
+        const refusal = {
+          success: false,
+          mode: 'sync',
+          dataMode,
+          accountId,
+          branchName,
+          workspace,
+          dryRun,
+          safe,
+          branchContext,
+          repositoryCheck: preflightRepoCheck,
+          refusal: 'feature_branch_landing',
+          gateViolations: [featureRefusal],
+          message: featureRefusal
+        };
+        console.log(JSON.stringify(refusal, null, 2));
+        process.exitCode = 1;
+        return refusal;
+      }
+      throw new Error(featureRefusal + ' Nothing was synced.');
+    }
     if (branchContextIsTrunk(branchContext)) {
       // Trunk has no dry-run plan to gate on, and pretending otherwise would be worse than refusing:
       // an agent would read "safe" and get an ungated authoritative reconcile. Say what trunk sync is
@@ -4670,6 +4988,15 @@ function featureBranchCommitRefusal(branchContext, branchName, flags) {
     'deliberately creating a NEW variant branch, re-run with --create-variant-branch.';
 }
 
+function featureBranchSyncRefusal(branchContext, branchName, flags) {
+  if (!branchContext || branchContext.variantBranchSource !== 'subscription-fallback') return null;
+  if (flags && (flags['create-variant-branch'] === true || flags['create-variant-branch'] === 'true')) return null;
+  return 'components sync refused: \'' + branchName + '\' is not a variant branch (no committed variants, no ' +
+    'subscribers). ' + featureBranchLandingHint(branchContext) + ' Syncing here would write overlays for \'' +
+    branchName + '\' that nobody subscribes to, and flip every other lane on that branch to them. If you are ' +
+    'deliberately creating a NEW variant branch, re-run with --create-variant-branch.';
+}
+
 // What a verification envelope records as the world it verified. Taken from the platform's answer
 // (`variantWorld`, the same rule every run uses), never inferred from `onTrunk`: a feature branch cut from a
 // variant branch is not on trunk, yet resolves the SUBSCRIBED branch, and labelling it by its own name recorded
@@ -4759,7 +5086,7 @@ function gitIsAncestor(cwd, ancestor, descendant) {
  * `stageBaseSha`; only the local checkout can order commits, so the comparison happens here. Pure — git is
  * injected as `isAncestor(a, b)` — so it can be tested without a repository.
  */
-function stagingFreshness({ head, lastSyncedSha, entries, laneSummary, isAncestor }) {
+function stagingFreshness({ head, originHead, lastSyncedSha, entries, laneSummary, isAncestor }) {
   const rows = Array.isArray(entries) ? entries : [];
   const staged = rows.filter((entry) => entry && entry.stageBaseSha);
   const memo = new Map();
@@ -4785,7 +5112,9 @@ function stagingFreshness({ head, lastSyncedSha, entries, laneSummary, isAncesto
 
   return {
     head: head || null,
+    originHead: originHead || null,
     lastSyncedSha: lastSyncedSha || null,
+    freshnessUnknownReason: !originHead ? 'branch has no upstream' : (!lastSyncedSha ? 'platform has no last synced SHA for this branch' : null),
     landedSinceHead,
     entriesBehindLastSync: behindLastSync.length,
     entriesFromOtherCommits: fromOtherCommits.length,
@@ -4799,6 +5128,9 @@ function stagingFreshness({ head, lastSyncedSha, entries, laneSummary, isAncesto
 function printStagingFreshness(freshness) {
   if (!freshness) return;
   const plural = (n) => n + ' staged entr' + (n === 1 ? 'y' : 'ies');
+  if (freshness.freshnessUnknownReason) {
+    console.log('Freshness unknown:', freshness.freshnessUnknownReason + '.');
+  }
   if (freshness.landedSinceHead === true) {
     console.log('');
     console.log('LANDED SINCE YOUR BASE: the platform last synced ' + short(freshness.lastSyncedSha) +
@@ -5759,6 +6091,172 @@ async function waitForStatus(api, cwd, accountId, branchName, taskId, token, dat
   }
 }
 
+function testEvidenceCategories(status = {}, selectedNames = []) {
+  const categories = new Set(['test_run']);
+  const test = status.test || {};
+  if (test.name) categories.add('test_run.suite:' + String(test.name));
+  if (test.id !== undefined && test.id !== null) categories.add('test_run.suite_id:' + String(test.id));
+  (Array.isArray(selectedNames) ? selectedNames : []).forEach((name) => {
+    if (name) categories.add('test_run.' + String(name));
+  });
+  const results = status.result && Array.isArray(status.result.tests) ? status.result.tests : [];
+  results.forEach((result) => {
+    if (result && result.passed === true && result.name) {
+      categories.add('test_run.case:' + String(result.name));
+      categories.add('test_run.' + String(result.name));
+    }
+  });
+  return Array.from(categories);
+}
+
+function testComponentProvenance(status = {}) {
+  const direct = status.resolvedComponentProvenance || (status.result && status.result.resolvedComponentProvenance) ||
+    (status.staging && status.staging.resolvedComponentProvenance);
+  if (Array.isArray(direct)) return direct;
+  const staging = status.staging || {};
+  if (staging.testComponentSignature) {
+    return [{
+      type: 'test',
+      id: status.test && status.test.id,
+      name: status.test && status.test.name,
+      signature: staging.testComponentSignature,
+      source: staging.testComponentSource || null
+    }];
+  }
+  return [];
+}
+
+function testCompileSignatures(status = {}) {
+  return testComponentProvenance(status)
+    .map((entry) => entry && entry.signature)
+    .filter(Boolean);
+}
+
+function testRunSuiteNameFromStatus(status = {}) {
+  return status.test && status.test.name ? String(status.test.name) : null;
+}
+
+function testRunSuiteNameFromPacket(packet = {}) {
+  return packet.test && packet.test.testName
+    ? String(packet.test.testName)
+    : (packet.status && packet.status.test && packet.status.test.name ? String(packet.status.test.name) : null);
+}
+
+function testCaseOutcomesFromStatusLike(status = {}) {
+  const tests = status.result && Array.isArray(status.result.tests) ? status.result.tests :
+    (status.test && Array.isArray(status.test.tests) ? status.test.tests : []);
+  return tests
+    .filter((test) => test && test.name && typeof test.passed === 'boolean')
+    .map((test) => ({ name: String(test.name), passed: test.passed === true }));
+}
+
+function provenanceSignature(value) {
+  const rows = Array.isArray(value) ? value : [];
+  return sha256(stableStringify(rows.map((entry) => ({
+    type: entry && entry.type || null,
+    id: entry && entry.id || null,
+    name: entry && entry.name || null,
+    signature: entry && entry.signature || null,
+    source: entry && entry.source || null
+  }))));
+}
+
+function packetEvidenceIdentity(packet = {}) {
+  const world = packet.world || {};
+  const revision = packet.revision || {};
+  const laneSummary = packet.laneSummary || (packet.componentStatus && packet.componentStatus.laneSummary) || {};
+  return {
+    laneContentHash: world.laneContentHash || world.stagedOverlayHash || revision.laneContentHash ||
+      revision.stagedOverlayHash || laneSummary.contentHash || null,
+    gitHead: revision.gitHead || null
+  };
+}
+
+function sameNondeterminismIdentity(left = {}, right = {}) {
+  return !!(left.laneContentHash && right.laneContentHash && left.gitHead && right.gitHead &&
+    String(left.laneContentHash) === String(right.laneContentHash) &&
+    String(left.gitHead) === String(right.gitHead));
+}
+
+function detectNondeterministicTestRun(priorPackets, currentStatus, currentProvenance, currentIdentity = {}) {
+  const packets = Array.isArray(priorPackets) ? priorPackets : [];
+  const suiteName = testRunSuiteNameFromStatus(currentStatus);
+  const currentCases = testCaseOutcomesFromStatusLike(currentStatus);
+  if (!suiteName || !currentCases.length) return null;
+  if (!Array.isArray(currentProvenance) || !currentProvenance.length) return null;
+  if (!currentIdentity.laneContentHash || !currentIdentity.gitHead) return null;
+
+  const currentSignature = provenanceSignature(currentProvenance);
+  const currentByName = new Map(currentCases.map((outcome) => [outcome.name, outcome]));
+  for (let i = packets.length - 1; i >= 0; i -= 1) {
+    const packet = packets[i];
+    if (!packet || packet.type !== 'test_run') continue;
+    if (testRunSuiteNameFromPacket(packet) !== suiteName) continue;
+    const previousProvenance = packet.revision && packet.revision.componentProvenance;
+    if (!Array.isArray(previousProvenance) || !previousProvenance.length) continue;
+    if (!sameNondeterminismIdentity(currentIdentity, packetEvidenceIdentity(packet))) continue;
+    const previousSignature = provenanceSignature(previousProvenance);
+    if (previousSignature !== currentSignature) continue;
+    const previousCases = testCaseOutcomesFromStatusLike(packet.status || packet);
+    const flips = previousCases
+      .map((previous) => {
+        const current = currentByName.get(previous.name);
+        return current && current.passed !== previous.passed
+          ? { caseName: previous.name, previousPassed: previous.passed, currentPassed: current.passed, previousPacketId: packet.packetId }
+          : null;
+      })
+      .filter(Boolean);
+    if (flips.length) {
+      return {
+        nondeterministic: true,
+        message: 'Outcome changed with no source change - likely nondeterministic (AI/live data).',
+        suite: suiteName,
+        provenanceSignature: currentSignature,
+        previousPacketId: packet.packetId,
+        flips
+      };
+    }
+  }
+  return null;
+}
+
+function printTestRunPivots(status = {}) {
+  const tests = status.result && Array.isArray(status.result.tests) ? status.result.tests : [];
+  if (!tests.length) return;
+  const slowest = tests.slice().sort((a, b) => Number(b.duration || 0) - Number(a.duration || 0))[0];
+  if (slowest && slowest.duration != null) {
+    console.log('Slowest case:', (slowest.name || '(unnamed)') + ' in ' + formatDurationMs(slowest.duration));
+  }
+  tests.filter((test) => test && test.passed === false).forEach((test) => {
+    console.log('Pivots for failed case:', test.name || '(unnamed)');
+    if (test.duration != null) console.log('  Duration:', formatDurationMs(test.duration));
+    if (test.threadGroupingId || test.threadGroupId || test.traceId) {
+      console.log('  Trace:', test.traceId || test.threadGroupingId || test.threadGroupId);
+    }
+    if (test.error) console.log('  Error:', String(test.error).slice(0, 500));
+    const diagnostics = test.diagnostics && typeof test.diagnostics === 'object' ? test.diagnostics : null;
+    if (diagnostics && Object.keys(diagnostics).length) {
+      console.log('  Diagnostics:', JSON.stringify(diagnostics).slice(0, 1200));
+    }
+    if (Array.isArray(test.resolvedComponentProvenance) && test.resolvedComponentProvenance.length) {
+      console.log('  Components:', test.resolvedComponentProvenance.slice(0, 8).map((entry) =>
+        (entry.type || 'component') + ' ' + (entry.id || entry.name || '?') +
+        (entry.source ? ' [' + entry.source + ']' : '') +
+        (entry.signature ? ' ' + short(entry.signature) : '')).join(', '));
+    }
+    if (Array.isArray(test.liveHttpCalls) && test.liveHttpCalls.length) {
+      console.log('  Live HTTP calls:', test.liveHttpCalls.length);
+    }
+  });
+}
+
+function formatDurationMs(value) {
+  const ms = Number(value);
+  if (!Number.isFinite(ms)) return String(value);
+  if (ms < 1000) return ms + 'ms';
+  return (ms / 1000).toFixed(ms < 10000 ? 1 : 0) + 's';
+}
+
 async function waitForToolStatus(api, cwd, options) {
   const started = Date.now();
   let pollDelayMs = parsePositiveInt(options.pollIntervalMs, 1000);
@@ -5908,7 +6406,9 @@ async function testCommand(flags) {
     printSessionResolutionWarning(sessionContext);
     printResolvedBaseUrl(baseUrl);
     printStagingLane(branchName, workspace, workspaceSource(cwd, flags));
+    printStagingLaneOwnerNotice(start.staging || {});
     if (start.staging && Array.isArray(start.staging.accountLanes)) {
+      printOrphanedWorkspaceWarning(start.staging);
       printAccountLanes({ accountLanes: start.staging.accountLanes, branchName, workspace });
     }
     console.log('Test run started:', start.taskId);
@@ -5935,6 +6435,8 @@ async function testCommand(flags) {
     console.log(JSON.stringify(status, null, 2));
   } else {
     console.log('Final status:', JSON.stringify(status, null, 2));
+    printStagingLaneOwnerNotice(status.staging || {});
+    printTestRunPivots(status);
   }
 
   // A selector that matched no case is a mis-specified run, not a passing one. Say so in the terminal
@@ -5959,14 +6461,38 @@ async function testCommand(flags) {
     process.exitCode = 1;
   }
 
+  const verificationContext = activeVerificationContext(cwd, flags, session, accountId);
+  const activeEnvelopeId = verificationEnvelopeIdForCommand(cwd, flags, verificationContext);
+  const componentProvenance = testComponentProvenance(status);
+  const sourceRevision = collectVerificationSource(cwd, flags);
+  const priorPackets = await readVerificationPacketsForDiagnostics(api, cwd, session, accountId, activeEnvelopeId, {
+    packetType: 'test_run',
+    suite: status.test && status.test.name,
+    max: 50
+  });
+  const nondeterminism = detectNondeterministicTestRun(priorPackets, status, componentProvenance, {
+    laneContentHash: status.staging && status.staging.laneSummary && status.staging.laneSummary.contentHash,
+    gitHead: sourceRevision.gitHead
+  });
+  if (nondeterminism && !jsonOutput) {
+    console.log('Nondeterministic signal:', nondeterminism.message);
+    nondeterminism.flips.slice(0, 6).forEach((flip) => {
+      console.log('  - ' + flip.caseName + ': ' + (flip.previousPassed ? 'passed' : 'failed') + ' -> ' + (flip.currentPassed ? 'passed' : 'failed') +
+        ' (previous packet ' + (flip.previousPacketId || 'unknown') + ')');
+    });
+  }
+
   await appendVerificationPacket(api, cwd, session, accountId, flags, {
     type: 'test_run',
     success: status.status === 'completed' && !(status.result && status.result.failed > 0) && !unmatched.length,
     claim: 'Test run ' + String(testRef),
     world: buildCommandWorld(status, { accountId, dataMode: status.dataMode || dataMode, dataModeSource, branchName, workspace, host: normalizeBaseUrl(baseUrl), sourceLayer: status.staging && status.staging.testComponentSource }),
-    revision: Object.assign(collectVerificationSource(cwd, flags), {
-      compileSignatures: status.staging && status.staging.testComponentSignature ? [status.staging.testComponentSignature] : []
+    revision: Object.assign(sourceRevision, {
+      compileSignatures: testCompileSignatures(status),
+      componentProvenance
     }),
+    nondeterministic: nondeterminism ? true : undefined,
+    nondeterminism: nondeterminism || undefined,
     test: {
       taskId: start.taskId,
       testId: status.test && status.test.id,
@@ -5974,16 +6500,64 @@ async function testCommand(flags) {
       selectedCases: names,
       passed: status.result && status.result.passed,
       failed: status.result && status.result.failed,
+      tests: status.result && status.result.tests,
       dataModeSource: status.dataModeSource || dataModeSource,
       unmatchedTestNames: unmatched
     },
-    evidenceCategories: ['test_run'].concat(names.map((name) => 'test_run.' + name)),
-    limitations: unmatched.length ? ['One or more requested test case selectors matched no case.'] : [],
+    evidenceCategories: testEvidenceCategories(status, names),
+    limitations: []
+      .concat(unmatched.length ? ['One or more requested test case selectors matched no case.'] : [])
+      .concat(nondeterminism ? [nondeterminism.message] : []),
     rawRefs: { testStatusKey: start.taskId },
     status
   }, { quiet: jsonOutput });
 }
 
+async function testStatusCommand(flags) {
+  const cwd = process.cwd();
+  ensureLocalState(cwd);
+  const sessionContext = resolveSessionContext(cwd, flags);
+  const { session, accountId } = sessionContext;
+  const baseUrl = flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL;
+  const branchName = flags.branch || currentBranch(cwd);
+  const dataMode = hasExplicitDataModeFlag(flags)
+    ? resolveDataMode(flags, null)
+    : DEFAULT_DATA_MODE;
+  const taskId = flags['task-id'] || flags.taskId || flags.id || (flags._ && flags._[2]);
+  const jsonOutput = flagEnabled(flags.json);
+  if (!taskId) throw new Error('Missing --task-id <taskId>');
+
+  const api = buildAxios(baseUrl, session.token);
+  const status = await loggedPost(api, cwd, '/cli/test', {
+    token: session.token,
+    command: 'status',
+    accountId,
+    branchName,
+    taskId,
+    dataMode
+  }).then((r) => r.data);
+
+  if (jsonOutput) {
+    console.log(JSON.stringify(status, null, 2));
+    return status;
+  }
+  printSessionResolutionWarning(sessionContext);
+  printResolvedBaseUrl(baseUrl);
+  console.log('Test run status:', status.status || 'unknown');
+  console.log('Task ID:', taskId);
+  console.log('Data mode:', status.dataMode || dataMode);
+  if (status.result) {
+    console.log('Cases:', (status.result.passed || 0) + ' passed, ' + (status.result.failed || 0) + ' failed, ' + (status.result.total || 0) + ' total');
+  }
+  if (status.error || status.message) {
+    console.log('Message:', status.error || status.message);
+  }
+  if (status.status === 'failed' || (status.result && status.result.failed > 0)) {
+    process.exitCode = 1;
+  }
+  return status;
+}
+
 /*
 ## Tokens, Tools, Verification, And Config
 */
@@ -6308,8 +6882,7 @@ async function toolCommand(flags) {
       revision: collectVerificationSource(cwd, flags),
       evidenceCategories: ['tool_call'],
       rawRefs: { toolResponsePath: statusResponse.responseFile, callId: requestedCallId },
-      tool: { callId: requestedCallId, status: data.status, name: stored && stored.name },
-      result: data
+      tool: Object.assign(toolEvidenceSummary(data, statusResponse.responseFile), { callId: requestedCallId, name: stored && stored.name })
     }, { quiet: jsonOutput });
     if (jsonOutput) {
       console.log(JSON.stringify(data, null, 2));
@@ -6322,7 +6895,7 @@ async function toolCommand(flags) {
     console.log('Data mode:', data.dataMode || dataMode);
     if (data.threadGroupingId) console.log('Thread grouping ID:', data.threadGroupingId);
     console.log('Session log:', data.sessionLog);
-    console.log('Tool response file:', data.responseFile);
+    printToolResponseFileLine('Tool response file', data.responseFile);
     if (polledFailed) {
       console.log('Tool error:', data.toolMessage);
     }
@@ -6373,6 +6946,9 @@ async function toolCommand(flags) {
   data.sessionLog = sessionJsonlFile(cwd);
   if (toolFailureMessage && !data.toolMessage) data.toolMessage = toolFailureMessage;
 
+  let evidenceData = data;
+  let evidenceResponseFile = response.responseFile;
+
   if (!jsonOutput) {
     printSessionResolutionWarning(sessionContext);
     printResolvedBaseUrl(baseUrl);
@@ -6390,7 +6966,7 @@ async function toolCommand(flags) {
       console.log('Component:', `${data.componentSource}${sig}`);
     }
     console.log('Session log:', data.sessionLog);
-    console.log('Tool response file:', data.responseFile);
+    printToolResponseFileLine('Tool response file', data.responseFile);
   }
 
   // Non-zero exit so scripted/agent callers that check status notice the refusal too.
@@ -6410,9 +6986,11 @@ async function toolCommand(flags) {
 
     finalStatus.data.responseFile = finalStatus.responseFile;
     finalStatus.data.sessionLog = sessionJsonlFile(cwd);
+    evidenceData = finalStatus.data;
+    evidenceResponseFile = finalStatus.responseFile;
     if (!jsonOutput) {
       console.log('Final status:', finalStatus.data.status);
-      console.log('Tool response file:', finalStatus.responseFile);
+      printToolResponseFileLine('Tool response file', finalStatus.responseFile);
     }
     if (finalStatus.data.status !== 'completed') {
       process.exitCode = 1;
@@ -6422,20 +7000,20 @@ async function toolCommand(flags) {
 
   await appendVerificationPacket(api, cwd, session, accountId, flags, {
     type: 'tool_call',
-    success: !toolFailed && (!asyncMode || !waitForAsync || process.exitCode !== 1),
+    success: asyncMode && !waitForAsync ? null : (!toolFailed && (!asyncMode || process.exitCode !== 1)),
+    pending: asyncMode && !waitForAsync,
     claim: 'Tool call ' + String(toolName),
-    world: buildCommandWorld(data, { accountId: data.accountId || accountId, dataMode: data.dataMode || dataMode, branchName: data.branchName || branchName, workspace: resolveWorkspace(cwd, flags), host: normalizeBaseUrl(baseUrl), sourceLayer: data.componentSource }),
+    world: buildCommandWorld(evidenceData, { accountId: evidenceData.accountId || accountId, dataMode: evidenceData.dataMode || dataMode, branchName: evidenceData.branchName || branchName, workspace: resolveWorkspace(cwd, flags), host: normalizeBaseUrl(baseUrl), sourceLayer: evidenceData.componentSource }),
     revision: Object.assign(collectVerificationSource(cwd, flags), {
-      compileSignatures: data.componentSignature ? [data.componentSignature] : []
+      compileSignatures: evidenceData.componentSignature ? [evidenceData.componentSignature] : []
     }),
     evidenceCategories: ['tool_call'],
     dependencies: {
       mocks: [],
-      liveHttpCalls: data.liveHttpCalls || []
+      liveHttpCalls: evidenceData.liveHttpCalls || []
     },
-    rawRefs: { toolResponsePath: response.responseFile, callId },
-    tool: { callId, name: String(toolName), async: asyncMode, status: data.status, toolSuccess: data.toolSuccess },
-    result: data
+    rawRefs: { toolResponsePath: evidenceResponseFile, callId },
+    tool: Object.assign(toolEvidenceSummary(evidenceData, evidenceResponseFile), { callId, name: String(toolName), async: asyncMode })
   }, { quiet: jsonOutput });
   if (jsonOutput) {
     console.log(JSON.stringify(data, null, 2));
@@ -6504,6 +7082,12 @@ async function verifyCommand(flags, subcommand) {
     if (flags.manifest || flags.file) {
       manifest = parseManifestFile(flags.manifest || flags.file);
     }
+    if (dataMode === 'prod' && !manifestRequiredEvidence(manifest).length && !flagEnabled(flags['no-contract'])) {
+      console.error('');
+      console.error('Warning: starting a prod-data verification envelope with no required evidence contract.');
+      console.error('Attach a manifest with requiredEvidence before destructive work, or pass --no-contract when this is intentionally evidence-only.');
+      console.error('');
+    }
     let statusResponse = null;
     try {
       statusResponse = await loggedPost(api, cwd, '/cli/components', {
@@ -6522,7 +7106,8 @@ async function verifyCommand(flags, subcommand) {
       source.componentBranch = verifiedWorld.componentBranch;
       source.sourceLayer = verifiedWorld.sourceLayer;
       if (verifiedWorld.variantBranchSource) source.variantBranchSource = verifiedWorld.variantBranchSource;
-      source.stagedOverlayHash = statusResponse.laneSummary ? sha256(stableStringify(statusResponse.laneSummary)) : null;
+      source.laneContentHash = laneContentHashFrom(statusResponse);
+      source.stagedOverlayHash = source.laneContentHash;
     }
 
     const response = await postVerificationCommand(api, cwd, session, accountId, 'start', {
@@ -6537,6 +7122,8 @@ async function verifyCommand(flags, subcommand) {
     writeActiveVerificationEnvelope(cwd, envelope.envelopeId, activeContext);
     console.log('Verification envelope started:', envelope.envelopeId);
     console.log('Target:', 'account=' + accountId + ', branch=' + branchName + ', workspace=' + (workspace || 'shared') + ', dataMode=' + dataMode);
+    printAcceptanceWarnings(envelope);
+    printEnvelopeWarnings(envelope);
     console.log('Local mirror:', verificationPaths(cwd, envelope.envelopeId).base);
     return envelope;
   }
@@ -6577,6 +7164,8 @@ async function verifyCommand(flags, subcommand) {
     writeLocalVerificationEnvelope(cwd, response.envelope);
     console.log('Manifest attached to envelope:', envelopeId);
     console.log('Required evidence:', (((response.envelope || {}).acceptance || {}).requiredEvidence || []).length);
+    printAcceptanceWarnings(response.envelope);
+    printEnvelopeWarnings(response.envelope);
     return response.envelope;
   }
 
@@ -12269,11 +12858,12 @@ function printComponentsHelp(subcommand) {
     return;
   }
   if (subcommand === 'lanes' || subcommand === 'lane') {
-    console.log('Usage: remits-cli components lanes [--base-url URL] [--account-id ID] [--branch BRANCH] [--workspace NAME] [--json]');
+    console.log('Usage: remits-cli components lanes [--base-url URL] [--account-id ID] [--branch BRANCH] [--workspace NAME] [--wait-change [--lane-id ID] [--timeout 600]] [--json]');
     console.log('');
     console.log('Lists every indexed staging lane on the account, across users, branches, and workspaces.');
     console.log('This is read-only and uses the same lane registry that powers the admin Platforms view.');
     console.log('Use `components entries --lane-id <id>` to inspect the actual staged files in a lane.');
+    console.log('Use --wait-change to wait until the lane registry changes instead of polling in a loop.');
     return;
   }
   if (subcommand === 'entries' || subcommand === 'entry' || subcommand === 'staged') {
@@ -12312,7 +12902,7 @@ function printComponentsHelp(subcommand) {
   console.log('so several agents can iterate at once. See: remits-cli workspace --help');
   console.log('  remits-cli components stage [--workset|--changed-only] [--base-url URL] [--account-id ID] [--branch BRANCH] [--data-mode test|prod] [--json|--verbose]');
   console.log('  remits-cli components status [--base-url URL] [--account-id ID] [--branch BRANCH] [--component-type TYPE --component-id ID] [--json|--verbose]');
-  console.log('  remits-cli components lanes [--base-url URL] [--account-id ID] [--json]');
+  console.log('  remits-cli components lanes [--base-url URL] [--account-id ID] [--wait-change [--lane-id ID] [--timeout 600]] [--json]');
   console.log('  remits-cli components entries --lane-id ID [--base-url URL] [--account-id ID] [--json|--verbose]');
   console.log('  remits-cli components clear [--base-url URL] [--account-id ID] [--branch BRANCH] [--component-type TYPE] [--component-id ID] [--all] [--json|--verbose]');
   console.log('  remits-cli components sync [--safe] [--base-url URL] [--account-id ID] [--branch BRANCH] [--data-mode test|prod] [--force-tombstones] [--dry-run] [--summary]');
@@ -12337,11 +12927,13 @@ function printComponentsHelp(subcommand) {
 
 function printTestHelp() {
   console.log('Usage: remits-cli test run --test <id|name> [--base-url URL] [--branch stagingScope] [--names "a|b"] [--watch true|false] [--data-mode test|prod] [--as-account ID] [--variant-branch NAME|none] [--json]');
+  console.log('       remits-cli test status --task-id <taskId> [--base-url URL] [--account-id ID] [--branch stagingScope] [--data-mode test|prod] [--json]');
   console.log('');
   console.log('Runs a Test component against the staged/variant world for this checkout.');
   console.log('Examples:');
   console.log('  remits-cli test run --test 11');
   console.log('  remits-cli test run --test "Merchant Statements" --names "managed account case"');
+  console.log('  remits-cli test status --task-id 7a1b...');
   console.log('');
   console.log('Notes:');
   console.log('  --names is delimited by "|" (comma also works when no "|" is present), and may be repeated.');
@@ -12728,6 +13320,10 @@ async function main() {
     await testCommand(args);
     return;
   }
+  if (command === 'test' && subcommand === 'status') {
+    await testStatusCommand(args);
+    return;
+  }
 
   if (command === 'token') {
     await tokenCommand(args);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remits/remits-cli",
-  "version": "0.1.126",
+  "version": "0.1.128",
   "description": "Local CLI for auth, component sync, and live test execution against Remits",
   "license": "MIT",
   "private": false,

package/skills/remits-cli/references/cli-state.md

@@ -72,6 +72,11 @@ Think about remits-cli as two cooperating layers:
      - where a large tool response was written
      - which tool schemas were most recently cached here
 
+Tool response files under `./.remits-cli/tool-responses/` are the full CLI results. The CLI may print a
+size/hash hint for large files so you can inspect them selectively with `jq`, `rg`, or byte-range reads,
+but it does not truncate the local JSON file. Do not confuse this with the in-platform OpenRouter client,
+which can offload large tool results inside the model conversation and inject a read-back tool for the AI.
+
 When a user asks an indirect question, map it to the right layer first:
 
 - "Why did this ticket open in the wrong repo?" → start in global state.

package/skills/remits-cli/references/command-reference.md

@@ -85,7 +85,10 @@ deterministically:
 remits-cli tool --name "mcp_run_action" --input '{"accountId":49,"actionId":200,"executionMode":"async","actionRunId":"my-stable-run-id","actionInput":{"sourceDocumentId":"..."}}' --data-mode prod
 ```
 
-Every tool response is saved to `./.remits-cli/tool-responses/<callId>.json`.
+Every tool response is saved in full to `./.remits-cli/tool-responses/<callId>.json`. Large responses may
+print an early size/hash line and a selective-read hint before any preview text, but the saved CLI file is
+not truncated or offloaded. That is separate from the platform's OpenRouter model loop, where the AI
+client may offload large tool results before feeding context back to the model.
 
 ### Hierarchy-scoped tool reads
 
@@ -207,6 +210,7 @@ remits-cli components branch <name> --subscribe <accountId> [--parent-account <i
 remits-cli components branch <name> --unsubscribe <accountId>                          # return that account to trunk
 remits-cli components branch <name> --retire [--force]                                 # delete the branch's overlays
 remits-cli test run --test <id|name> [--branch <stagingScope>] [--names "a|b"] [--watch true|false] [--data-mode test|prod] [--as-account <ID>] [--variant-branch <name|none>] [--json]
+remits-cli test status --task-id <taskId> [--branch <stagingScope>] [--data-mode test|prod] [--json]
 remits-cli token [--path <embeddablePathOrId>] [--data-mode test|prod] [--as-account <ID>] [--variant-branch <name|none>]
 remits-cli token inspect --token <token|tokenKey|URL>                  # inspect token metadata, safety/dataMode evidence, and full context
 remits-cli tools [--branch <name>] [--data-mode test|prod] [--variant-branch <name|none>]
@@ -268,18 +272,43 @@ remits-cli verify report
 Existing commands also accept `--verify-envelope <id>` to attach to a specific envelope and
 `--no-verify-envelope` to suppress automatic attachment for one command.
 
-Use `remits-cli verify list` to review open envelopes for the account without SQL. If a newer envelope
-replaces an older one, use `verify supersede`; if a duplicate or abandoned attempt should no longer read
-as live work, use `verify abandon`. Both keep the evidence history.
+Failed `remits-cli test run` output includes compact pivots per failed case: duration, trace id,
+bounded `report(...)` diagnostics, live HTTP signals, and resolved component provenance when the
+platform returns it. Re-read an existing run with `remits-cli test status --task-id <taskId>` before
+rerunning a long suite. If the same suite/case flips pass/fail while the resolved component provenance
+signature is unchanged, the CLI prints a nondeterministic signal and records `nondeterministic:true` on
+the `test_run` packet. Treat that as an AI/live-data/flaky-fixture investigation cue, not as proof that
+source changed.
+
+Test-run requirements must name the suite/cases they mean:
+
+```json
+{"id":"api_flow", "packetType":"test_run", "suite":"Statement API Flow", "allCases":true}
+{"id":"one_case", "packetType":"test_run", "suite":"Statement API Flow", "cases":["rejects duplicated fee evidence"]}
+```
+
+A suite-only Test requirement is treated as `allCases:true`. A category-only Test requirement matches only
+a run carrying that exact evidence category, or the case whose name the category names; unrelated Test
+runs cannot replace it. `verify start` and `verify manifest` warn when a requirement has a `packetType` but
+no discriminator. The evaluator treats pending async tool packets as pending, not passing; a later
+`tool status` packet is the proof. Tool packets store the response file path, byte size and hash rather
+than copying the whole tool payload into the envelope.
+
+Use `remits-cli verify list` to review open envelopes for the account without SQL. The list shows stale
+counts, requirements-changed markers, and last packet time. `verify start` warns when another open envelope
+with the same summary/account/world exists; use `verify use <id>` to continue that contract or
+`verify supersede` when a newer envelope replaces it. If a duplicate or abandoned attempt should no longer
+read as live work, use `verify abandon`. Both keep the evidence history. Starting a prod-data envelope
+without required evidence prints a loud no-contract warning; add a manifest unless the envelope is
+intentionally evidence-only.
 
 The manifest is the proof contract. It should name the world being exercised: repo account, host,
 git/component branch, workspace, data mode, source layer, user journeys, artifacts and hashes, and the
 evidence categories required before the final response may claim the work is done. If the manifest
 cannot be written because the workflow is ambiguous, ask before implementation. For machine-gated report
 requirements, prefer structured entries like `{"id":"actual_upload","packetType":"browser_step",
-"category":"browser_session.actual_upload"}`. Plain strings work when they match a packet type or an
-evidence category, but structured entries are clearer when several agents collect packets for one
-envelope.
+"category":"browser_session.actual_upload"}`. Plain strings work for evidence categories, but do not use
+plain `"test_run"` as acceptance: it cannot say which Test or case proved the behavior.
 
 Common packet meanings:
 
@@ -300,7 +329,13 @@ Final claims should come from `remits-cli verify report`. Treat `Verified` as th
 the report lists it under `Verified`. If the report says `partially_verified`, stale, or missing evidence,
 say that plainly instead of widening the claim. In particular, staged proof is not committed variant/trunk
 proof, a token is not browser proof, and a direct DOM or Alpine state mutation is not the same as a user
-click/upload/reload flow.
+action.
+
+Evidence from the wrong world is excluded before it can satisfy a requirement. When the manifest declares
+fields such as `repoAccountId`, `gitBranch`, `componentBranch`, `workspace`, or `dataMode`, the report names
+the mismatch (`expected X got Y`) under missing evidence. Later stage/sync/source facts can stale earlier
+packets; explicit invalidations stale only packets collected before the invalidation, so a fresh rerun can
+verify the same requirement again.
 
 For tests specifically:
 - If `--data-mode` is omitted, `remits-cli test run` uses `test` and sends `dataModeSource:"cliDefault"`.

package/skills/remits-cli/references/component-resolution.md

@@ -57,9 +57,10 @@ source-layer facts the command observed. A staged test packet is proof of the st
 is proof of a source transition; a token packet is proof of the browser token's resolution tuple. Those
 are not interchangeable.
 
-Use `remits-cli verify report` before summarizing the work. It will naturally say when the evidence only
-covered staged source, when committed variant/trunk proof is missing, or when evidence became stale after
-the git head, overlay, or platform sync moved.
+Use `remits-cli verify report` before summarizing the work. It will say when the evidence only covered
+staged source, when committed variant/trunk proof is missing, when the manifest world does not match the
+packet world, or when later packet facts made an earlier proof stale. Packets carry a lane content hash,
+git head, workspace, data lane, and variant-world facts so a re-stage or branch move is visible.
 
 ### Staging cache key format
 
@@ -159,7 +160,10 @@ TestMode still uses the committed DB source. Staging remains a dev/verification
 - **Inspect another lane without impersonating it:** `remits-cli components lanes` lists every indexed
   lane on the account; `remits-cli components entries --lane-id <id>` reads the authoritative staged
   files for one lane. These are read-only review surfaces. They do not switch your workspace, clear
-  anything, or change what your own test/token/tool runs resolve.
+  anything, or change what your own test/token/tool runs resolve. Use
+  `remits-cli components lanes --wait-change [--lane-id ID] [--timeout 600]` when you need to wait for a
+  sibling lane to move; it watches the lane registry's `updatedAtMs`/content hash instead of making you
+  poll in a loop.
 - **Clear only your own lane:** `remits-cli components clear` removes entries when you intentionally want
   to fall back to DB source. `--all` is scoped to the command's account/user/branch/workspace lane, not
   every lane another agent may be using.
@@ -208,10 +212,15 @@ commit write `ComponentVariant` overlays for a branch nobody subscribes to).
   account's lane context in their responses. A shared current lane is printed loudly; sibling lanes are
   listed when they matter.
 - `remits-cli components lanes` is the review view across users/branches/workspaces, and
-  `remits-cli components entries --lane-id <id>` is the drill-down into actual staged files.
+  `remits-cli components entries --lane-id <id>` is the drill-down into actual staged files. When you are
+  coordinating with another agent, prefer `components lanes --wait-change --lane-id <id>` to repeated
+  status checks.
 - `remits-cli components clear --all` is scoped to YOUR lane and never touches another agent's.
 - In lane rows, `currentLane` (also `mine`) marks THIS command's lane; `ownedByCaller` marks every lane
   staged by your CLI user — your other clones' agents included.
+- If your current lane is empty but the same workspace has staged entries on another branch, the CLI
+  prints a warning. That usually means the checkout switched branches after staging; re-stage on this
+  branch or switch back.
 - **A landing clears only the lander's lane.** Every stage records the commit it came from
   (`stageBaseSha`), and `components status` compares that with the last commit the platform synced for the
   branch (`branchContext.lastSyncedSha`) using your local git:

package/skills/remits-cli/references/development-loop.md

@@ -97,6 +97,21 @@ remits-cli verify report
 The report is the final-response source. It separates verified claims, missing evidence, stale packets,
 and the source/account/lane tuple, so do not replace it with a generic "verified" sentence.
 
+For Test requirements, be specific enough for the evaluator to know what a pass means:
+
+```json
+{"id":"api_flow", "packetType":"test_run", "suite":"Statement API Flow", "allCases":true}
+{"id":"duplicate_fee_case", "packetType":"test_run", "suite":"Statement API Flow", "cases":["rejects duplicated fee evidence"]}
+```
+
+A suite-only Test requirement is treated as `allCases:true`. A category-only Test requirement matches only
+a run carrying that exact evidence category, or the case whose name the category names. A requirement that
+says only `{"packetType":"test_run"}` is intentionally only a warning-worthy sketch: it will not turn a
+random Test packet into acceptance. Full-suite runs emit suite and passed-case categories automatically,
+so case-level requirements can be satisfied by a real full run. The evaluator excludes packets collected
+in the wrong account/data lane/git branch/component branch/workspace before satisfying requirements, and
+pending async packets do not count until a result packet arrives.
+
 ## Development Workflow
 
 ### The Golden Rule: Writing Code Is Not Finishing the Job
@@ -327,9 +342,13 @@ This applies to:
 ```bash
 remits-cli test run --test <TEST_ID_OR_NAME>
 remits-cli test run --test "Invoice Tests" --names "specific test case"
+remits-cli test status --task-id <TASK_ID>
 ```
 
-Tests run on the platform against your staged snapshot. They stream results in real-time. If they fail, fix the code, re-stage, and re-run.
+Tests run on the platform against your staged snapshot. They stream results in real-time. If they fail,
+read the printed pivots first: failed cases include timing, trace ids, bounded `report(...)`
+diagnostics, live HTTP signals, and resolved component provenance when available. Fix the code,
+re-stage, and re-run only after those pivots explain the failure.
 
 Important test-runner constraints:
 - `remits-cli test run` now defaults to `test` dataMode unless you explicitly pass `--data-mode prod`.