@remits/remits-cli 0.1.127 → 0.1.129

package/README.md

@@ -28,7 +28,7 @@ remits-cli components stage                   # FULL SNAPSHOT of the repo into t
 remits-cli components status
 remits-cli components clear
 remits-cli test run --test 45
-remits-cli test run --test "My New Test" --names "test case 1,test case 2"
+remits-cli test run --test "My New Test" --names "test case 1|test case 2"
 git add -A
 git commit -m "sync passing changes"
 git push
@@ -98,7 +98,8 @@ remits-cli install --skills --overwrite true
 - Branch defaults to the current local git branch.
 - Data mode defaults to `test`. For `remits-cli test run`, that default is now enforced even if the most-recent authenticated session for the account is `prod`; a production test run therefore requires an explicit `--data-mode prod` on the command line. Use `remits-cli data-mode set prod` only for production investigation.
 - If the same account is authenticated against more than one host and you omit `--base-url`, the CLI auto-resolves the best matching session and now prints the resolved host. Pass `--base-url` explicitly whenever the target host matters.
-- Avoid commas in individual test names. The `--names` filter is comma-delimited, so a single test case whose name contains commas cannot be targeted cleanly through `remits-cli test run --names ...`.
+- `--names` is `|`-delimited and may be repeated. A comma still splits a single value for compatibility,
+  so a case name containing a comma should be passed with `|` or by repeating `--names`.
 - Nested help is available before required-argument validation, including `remits-cli test run --help`, `remits-cli components sync --help`, and `remits-cli tool --help`.
 - `components sync --safe` is the recommended agent path on a variant branch. It expands to `--summary --changed-only --fail-on-errors --fail-on-removed`, resolves `--changed-since` from the branch's merge base with trunk when you did not name one (local refs only; it never runs an implicit `git fetch`), and prints the planned writes before mutating unless `--yes` is passed. On trunk there is no plan to gate, so it states what a trunk reconcile does and requires `--yes`.
 - `components sync` has fail-closed safety gates for unattended/agent use. Each exits non-zero instead of printing a wall of JSON: `--changed-only` (fail unless every planned write is a component this checkout edited), `--names-only` (print only `BUCKET type:id name` lines), `--fail-on-removed`, `--fail-on-errors`, and `--expected-removed <type:id>` (repeatable or comma-delimited; implies `--fail-on-removed`, so any removal you did not name fails). `--changed-only` also fails closed when the checkout is not a git working tree, because "git could not answer" must never be read as "nothing changed".

package/index.js

@@ -6,16 +6,16 @@
 - L22  Runtime Bootstrap And Shared State
 - L116  Sessions, Account Resolution, And Production Guards
 - L595  Local State, Workspaces, And Verification Evidence
-- L1296  Account Repos, Guide Sync, And Platform Repo
-- L1954  Component Discovery And HTTP Logging
-- L2444  Skill Delivery And TOC Resolution
-- L2754  Auth And Component Staging
-- L3352  Component Summaries, Status, And Sync Gates
-- L5107  Branches, Promotion, Commit, And Test Runs
-- L6231  Tokens, Tools, Verification, And Config
-- L7141  Service Dashboard And WebSocket Listener
-- L9236  Agent And Ticket Workflows
-- L12294  Help, Auto Update, And Command Dispatch
+- L1448  Account Repos, Guide Sync, And Platform Repo
+- L2106  Component Discovery And HTTP Logging
+- L2598  Skill Delivery And TOC Resolution
+- L2908  Auth And Component Staging
+- L3506  Component Summaries, Status, And Sync Gates
+- L5457  Branches, Promotion, Commit, And Test Runs
+- L6682  Tokens, Tools, Verification, And Config
+- L7598  Service Dashboard And WebSocket Listener
+- L9693  Agent And Ticket Workflows
+- L12751  Help, Auto Update, And Command Dispatch
 */
 
 /*
@@ -821,6 +821,22 @@ function fileEvidence(pathname) {
   };
 }
 
+const LARGE_TOOL_RESPONSE_BYTES = 200 * 1024;
+
+function formatToolResponseFile(pathname) {
+  const evidence = fileEvidence(pathname);
+  if (!evidence.bytes) return String(pathname || '');
+  return pathname + ' (' + evidence.bytes + ' bytes, sha256 ' + evidence.sha256.slice(0, 12) + ')';
+}
+
+function printToolResponseFileLine(label, pathname) {
+  console.log(label + ':', formatToolResponseFile(pathname));
+  const evidence = fileEvidence(pathname);
+  if (evidence.bytes && evidence.bytes >= LARGE_TOOL_RESPONSE_BYTES) {
+    console.log('Large response: inspect selectively with jq or targeted offset reads instead of opening the whole file.');
+  }
+}
+
 function boundedToolExcerpt(data = {}) {
   const result = data.result && typeof data.result === 'object' ? data.result : {};
   const candidates = [
@@ -982,6 +998,35 @@ function readLocalVerificationEnvelope(cwd, envelopeId) {
   }
 }
 
+function readLocalVerificationPackets(cwd, envelopeId, filters = {}) {
+  const paths = verificationPaths(cwd, envelopeId);
+  const packets = [];
+  if (fs.existsSync(paths.packetsDir)) {
+    fs.readdirSync(paths.packetsDir)
+      .filter((name) => name.endsWith('.json'))
+      .forEach((name) => {
+        try {
+          const parsed = JSON.parse(fs.readFileSync(path.join(paths.packetsDir, name), 'utf8'));
+          if (parsed && typeof parsed === 'object') packets.push(parsed);
+        } catch (_) {
+          // Ignore one malformed local packet; the rest of the envelope remains useful.
+        }
+      });
+  }
+  if (!packets.length) {
+    const envelope = readLocalVerificationEnvelope(cwd, envelopeId);
+    if (envelope && Array.isArray(envelope.packets)) packets.push(...envelope.packets);
+  }
+  const type = filters.type || filters.packetType;
+  const suite = filters.suite || filters.testName;
+  const max = parsePositiveInt(filters.max, 50);
+  const filtered = packets
+    .filter((packet) => !type || packet.type === type)
+    .filter((packet) => !suite || testRunSuiteNameFromPacket(packet) === String(suite))
+    .sort((a, b) => Number(a.createdAt || 0) - Number(b.createdAt || 0));
+  return filtered.slice(Math.max(0, filtered.length - max));
+}
+
 function writeLocalVerificationPacket(cwd, envelopeId, packet) {
   if (!envelopeId || !packet) return null;
   const paths = verificationPaths(cwd, envelopeId);
@@ -1062,6 +1107,43 @@ async function postVerificationCommand(api, cwd, session, accountId, command, pa
   return response;
 }
 
+// The repo/session account a packet was recorded from, stated explicitly in its world. `world.accountId` is the
+// account the command EXECUTED as, so an --as-account run carried the subscriber there and a manifest's
+// repoAccountId could never match it. Only fills a missing value; a packet that already knows keeps its own.
+function stampPacketRepoAccount(packet, accountId) {
+  if (!packet || accountId === undefined || accountId === null || accountId === '') return packet;
+  const repoAccountId = Number(accountId);
+  if (!Number.isFinite(repoAccountId)) return packet;
+  if (!packet.world || typeof packet.world !== 'object') packet.world = {};
+  if (packet.world.repoAccountId === undefined || packet.world.repoAccountId === null) {
+    packet.world.repoAccountId = repoAccountId;
+  }
+  return packet;
+}
+
+// A sync packet is evidence of WHAT a sync planned or wrote, not a second copy of the preview. The per-field
+// trunk/branch text a dry run attaches for the admin diff panel is up to 400 KB per sync, and storing it on
+// every packet made one busy envelope 9.4 MB — slow enough that `verify show` timed out. Field NAMES
+// (`changedFields`) stay; the full plan is always one `components sync --dry-run` away.
+function syncEvidencePayload(sync) {
+  if (!sync || typeof sync !== 'object') return sync;
+  const results = sync.syncResults;
+  if (!results || typeof results !== 'object') return sync;
+  const trimmedResults = {};
+  Object.keys(results).forEach((bucket) => {
+    const entries = results[bucket];
+    trimmedResults[bucket] = Array.isArray(entries)
+      ? entries.map((entry) => {
+        if (!entry || typeof entry !== 'object' || !('fields' in entry)) return entry;
+        const copy = Object.assign({}, entry);
+        delete copy.fields;
+        return copy;
+      })
+      : entries;
+  });
+  return Object.assign({}, sync, { syncResults: trimmedResults });
+}
+
 async function appendVerificationPacket(api, cwd, session, accountId, flags, packet, options = {}) {
   const context = activeVerificationContext(cwd, flags, session, accountId);
   const envelopeId = verificationEnvelopeIdForCommand(cwd, flags, context);
@@ -1072,6 +1154,7 @@ async function appendVerificationPacket(api, cwd, session, accountId, flags, pac
     success: true
   }, packet || {});
   finalPacket.envelopeId = envelopeId;
+  stampPacketRepoAccount(finalPacket, accountId);
   writeLocalVerificationPacket(cwd, envelopeId, finalPacket);
   try {
     const response = await postVerificationCommand(api, cwd, session, accountId, 'packet', {
@@ -1103,11 +1186,13 @@ function printVerificationSummaryLine(env) {
   const failures = env.currentFailureCount ? ' currentFailures=' + env.currentFailureCount : (env.failedCount ? ' failed=' + env.failedCount : '');
   const required = ' required=' + (env.satisfiedCount || 0) + '/' + (env.requiredCount || 0);
   const noManifest = env.noRequiredEvidence ? ' no-manifest' : '';
+  const stale = env.staleCount ? ' stale=' + env.staleCount : '';
+  const changed = env.requirementsChangedAfterEvidence ? ' requirements-changed' : '';
   const lane = [env.branchName || 'unknown-branch', env.workspace ? 'ws:' + env.workspace : 'shared', env.dataMode || null, env.sourceLayer || null]
     .filter(Boolean).join(' | ');
-  console.log('- ' + (env.envelopeId || '(no id)') + '  ' + (env.status || 'unknown') + health + failures + required + noManifest);
+  console.log('- ' + (env.envelopeId || '(no id)') + '  ' + (env.status || 'unknown') + health + failures + required + stale + noManifest + changed);
   if (env.summary) console.log('  ' + env.summary);
-  console.log('  ' + lane + '  packets=' + (env.packetCount || 0) + '  updated=' + formatTime(env.updatedAtMs || env.latestPacketAtMs));
+  console.log('  ' + lane + '  packets=' + (env.packetCount || 0) + '  lastPacket=' + formatTime(env.lastPacketAtMs || env.latestPacketAtMs) + '  updated=' + formatTime(env.updatedAtMs || env.latestPacketAtMs));
 }
 
 function printVerificationEnvelope(envelope, fallbackEnvelopeId) {
@@ -1124,6 +1209,12 @@ function printVerificationEnvelope(envelope, fallbackEnvelopeId) {
   if (evaluation.failedCount) {
     console.log('Failed packets:', evaluation.failedCount, 'current failures:', evaluation.currentFailureCount || 0);
   }
+  if (evaluation.requirementsChangedAfterEvidence) {
+    console.log('Requirements changed after evidence was collected.');
+  }
+  if (Array.isArray(evaluation.stale) && evaluation.stale.length) {
+    console.log('Stale packets:', evaluation.stale.length);
+  }
   const packets = Array.isArray(envelope.packets) ? envelope.packets : [];
   console.log('Packets:', packets.length);
   packets.slice(-20).forEach((packet) => {
@@ -1147,6 +1238,56 @@ function printAcceptanceWarnings(envelope) {
   });
 }
 
+function printEnvelopeWarnings(envelope) {
+  const warnings = envelope && Array.isArray(envelope.warnings) ? envelope.warnings : [];
+  if (!warnings.length) return;
+  console.log('Envelope warnings:');
+  warnings.forEach((warning) => {
+    console.log('- ' + (warning.message || warning.code || JSON.stringify(warning)));
+    if (Array.isArray(warning.envelopes) && warning.envelopes.length) {
+      warning.envelopes.forEach((env) => {
+        console.log('  ' + (env.envelopeId || '(no id)') + (env.status ? ' ' + env.status : ''));
+      });
+    }
+  });
+}
+
+function manifestRequiredEvidence(manifest = {}) {
+  const required = [];
+  if (Array.isArray(manifest.requiredEvidence)) required.push(...manifest.requiredEvidence);
+  const journeys = Array.isArray(manifest.journeys) ? manifest.journeys :
+    (Array.isArray(manifest.requestedJourneys) ? manifest.requestedJourneys : []);
+  journeys.forEach((journey) => {
+    if (journey && Array.isArray(journey.requiredEvidence)) required.push(...journey.requiredEvidence);
+  });
+  return required;
+}
+
+async function readVerificationEnvelopeForDiagnostics(api, cwd, session, accountId, envelopeId) {
+  if (!envelopeId) return null;
+  try {
+    const response = await postVerificationCommand(api, cwd, session, accountId, 'show', { envelopeId });
+    if (response.envelope) {
+      writeLocalVerificationEnvelope(cwd, response.envelope);
+      return response.envelope;
+    }
+  } catch (_) {
+    // Local evidence is still useful for diagnostics when the platform read fails.
+  }
+  return readLocalVerificationEnvelope(cwd, envelopeId);
+}
+
+async function readVerificationPacketsForDiagnostics(api, cwd, session, accountId, envelopeId, filters = {}) {
+  if (!envelopeId) return [];
+  try {
+    const response = await postVerificationCommand(api, cwd, session, accountId, 'packets', Object.assign({ envelopeId }, filters));
+    if (Array.isArray(response.packets)) return response.packets;
+  } catch (_) {
+    // Local full-fidelity packet files remain the fallback when the platform read is unavailable.
+  }
+  return readLocalVerificationPackets(cwd, envelopeId, filters);
+}
+
 function buildCommandWorld(response, fallback = {}) {
   const source = (response && response.staging) || {};
   const resolution = (response && response.resolution) || {};
@@ -1178,6 +1319,17 @@ function buildCommandWorld(response, fallback = {}) {
   };
 }
 
+// A variant sync writes overlays on exactly one component branch; say so in the packet world, where a manifest's
+// componentBranch is compared. Without it no sync_mutation could satisfy a manifest that declares one.
+function syncPacketWorld(response, world, branchName) {
+  const sync = (response && response.sync) || {};
+  const out = Object.assign({}, world || {});
+  if (sync.mode === 'variant' && !out.componentBranch) {
+    out.componentBranch = sync.branchName || branchName || null;
+  }
+  return out;
+}
+
 function laneContentHashFrom(response) {
   if (!response) return null;
   const laneSummary = response.laneSummary || (response.staging && response.staging.laneSummary) ||
@@ -2395,21 +2547,23 @@ async function loggedPost(api, cwd, endpoint, payload, options = {}) {
     error = err;
     throw err;
   } finally {
-    const status = error ? 'error' : 'success';
-    const responseForLog = responseFile
-      ? { responseFile, note: 'Tool response stored externally' }
-      : sanitizeForLog(responseData);
-    appendSessionLog(cwd, {
-      ts: new Date().toISOString(),
-      requestId,
-      endpoint,
-      method: 'POST',
-      status,
-      durationMs: Date.now() - started,
-      request: sanitizeForLog(payload),
-      response: responseForLog,
-      error: error ? describeError(error) : null
-    });
+    if (!options.skipSessionLog) {
+      const status = error ? 'error' : 'success';
+      const responseForLog = responseFile
+        ? { responseFile, note: 'Tool response stored externally' }
+        : sanitizeForLog(responseData);
+      appendSessionLog(cwd, {
+        ts: new Date().toISOString(),
+        requestId,
+        endpoint,
+        method: 'POST',
+        status,
+        durationMs: Date.now() - started,
+        request: sanitizeForLog(payload),
+        response: responseForLog,
+        error: error ? describeError(error) : null
+      });
+    }
   }
 }
 
@@ -3598,6 +3752,7 @@ function describeStageMode(mode) {
 function printStatusSummary(response, flags) {
   printBranchContext(response);
   printStagingLane(response.branchName, response.workspace, null);
+  printStagingLaneOwnerNotice(response);
   printLaneSummary(response);
   printOrphanedWorkspaceWarning(response);
   printStagingFreshness(response.freshness);
@@ -3625,6 +3780,28 @@ function printStatusSummary(response, flags) {
   printComponentCommandResponse('Components staging', response, flags);
 }
 
+function stagingLaneOwnerNotice(response = {}) {
+  const owner = response.laneOwnerAccountId != null ? response.laneOwnerAccountId :
+    (response.staging && response.staging.laneOwnerAccountId);
+  const checkout = response.checkoutAccountId != null ? response.checkoutAccountId :
+    (response.accountId != null ? response.accountId : (response.staging && response.staging.checkoutAccountId));
+  const stagedCount = Number(response.stagedCount != null ? response.stagedCount :
+    (response.laneSummary && response.laneSummary.stagedCount != null ? response.laneSummary.stagedCount :
+      (response.staging && response.staging.stagedCount != null ? response.staging.stagedCount :
+        (response.staging && response.staging.laneSummary && response.staging.laneSummary.stagedCount))));
+  if (owner == null || checkout == null || String(owner) === String(checkout) || !(stagedCount > 0)) {
+    return [];
+  }
+  return [
+    'WARNING: staged entries shown here are under account ' + owner + ', not checkout account ' + checkout + '.',
+    '  clear with: remits-cli components clear --all --account-id ' + owner
+  ];
+}
+
+function printStagingLaneOwnerNotice(response = {}) {
+  stagingLaneOwnerNotice(response).forEach((line) => console.log(line));
+}
+
 function printLanesSummary(response, flags) {
   printBranchContext(response);
   const lanes = Array.isArray(response.lanes) ? response.lanes : (Array.isArray(response.accountLanes) ? response.accountLanes : []);
@@ -3999,19 +4176,25 @@ async function lanesComponentsCommand(flags) {
   const dataMode = resolveDataMode(flags, session);
   const api = buildAxios(baseUrl, session.token);
 
-  const response = await loggedPost(api, cwd, '/cli/components', {
+  const requestPayload = {
     token: session.token,
     accountId,
     branchName,
     workspace,
     dataMode,
     mode: 'lanes'
-  }).then((r) => r.data);
+  };
+
+  let response = await loggedPost(api, cwd, '/cli/components', requestPayload).then((r) => r.data);
 
   if (!response.success) {
     throw new Error(response.message || 'Staging lanes failed');
   }
 
+  if (flagEnabled(flags['wait-change']) || flagEnabled(flags.waitChange)) {
+    response = await waitForLaneChange(api, cwd, requestPayload, response, flags);
+  }
+
   if (flagEnabled(flags.json)) {
     console.log(JSON.stringify(response, null, 2));
     return response;
@@ -4024,6 +4207,55 @@ async function lanesComponentsCommand(flags) {
   return response;
 }
 
+function laneWaitSignature(response, laneId) {
+  const lanes = Array.isArray(response && response.lanes)
+    ? response.lanes
+    : (Array.isArray(response && response.accountLanes) ? response.accountLanes : []);
+  const selected = laneId ? lanes.filter((lane) => String(lane.laneId || '') === String(laneId)) : lanes;
+  return stableStringify(selected.map((lane) => ({
+    laneId: lane.laneId,
+    accountId: lane.accountId,
+    branchName: lane.branchName,
+    workspace: lane.workspace || null,
+    stagedCount: lane.stagedCountAsOf || lane.stagedCount || 0,
+    contentHash: lane.contentHash || (lane.laneSummary && lane.laneSummary.contentHash) || null,
+    updatedAtMs: lane.updatedAtMs || null
+  })));
+}
+
+async function waitForLaneChange(api, cwd, requestPayload, initialResponse, flags) {
+  const laneId = flags['lane-id'] || flags.laneId || flags.lane;
+  const timeoutSeconds = parsePositiveInt(flags.timeout || flags['timeout-seconds'] || flags.timeoutSeconds, 600);
+  const pollMs = parsePositiveInt(flags['poll-ms'] || flags.pollMs, 2000);
+  const started = Date.now();
+  const initialSignature = laneWaitSignature(initialResponse, laneId);
+  if (!flagEnabled(flags.json)) {
+    console.log('Waiting for staging lane change' + (laneId ? ' on ' + laneId : '') + ' for up to ' + timeoutSeconds + 's...');
+  }
+  while (Date.now() - started < timeoutSeconds * 1000) {
+    await new Promise((resolve) => setTimeout(resolve, pollMs));
+    const next = await loggedPost(api, cwd, '/cli/components', requestPayload, { skipSessionLog: true }).then((r) => r.data);
+    if (!next.success) {
+      throw new Error(next.message || 'Staging lanes failed while waiting for a change');
+    }
+    if (laneWaitSignature(next, laneId) !== initialSignature) {
+      next.waitChange = {
+        changed: true,
+        laneId: laneId || null,
+        waitedMs: Date.now() - started
+      };
+      return next;
+    }
+  }
+  initialResponse.waitChange = {
+    changed: false,
+    laneId: laneId || null,
+    waitedMs: Date.now() - started,
+    timeoutSeconds
+  };
+  return initialResponse;
+}
+
 async function entriesComponentsCommand(flags) {
   const cwd = process.cwd();
   ensureLocalState(cwd);
@@ -4219,6 +4451,30 @@ async function syncComponentsCommand(rawFlags) {
       }
       throw new Error(mismatch + ' Nothing was synced.');
     }
+    const featureRefusal = !namesOnly ? featureBranchSyncRefusal(branchContext, branchName, flags) : null;
+    if (featureRefusal) {
+      if (flagEnabled(flags.json)) {
+        const refusal = {
+          success: false,
+          mode: 'sync',
+          dataMode,
+          accountId,
+          branchName,
+          workspace,
+          dryRun,
+          safe,
+          branchContext,
+          repositoryCheck: preflightRepoCheck,
+          refusal: 'feature_branch_landing',
+          gateViolations: [featureRefusal],
+          message: featureRefusal
+        };
+        console.log(JSON.stringify(refusal, null, 2));
+        process.exitCode = 1;
+        return refusal;
+      }
+      throw new Error(featureRefusal + ' Nothing was synced.');
+    }
     if (branchContextIsTrunk(branchContext)) {
       // Trunk has no dry-run plan to gate on, and pretending otherwise would be worse than refusing:
       // an agent would read "safe" and get an ungated authoritative reconcile. Say what trunk sync is
@@ -4335,7 +4591,7 @@ async function syncComponentsCommand(rawFlags) {
     type: response.sync && response.sync.dryRun ? 'sync_dry_run' : 'sync_mutation',
     success: response.success !== false,
     claim: response.sync && response.sync.dryRun ? 'Component sync dry-run observed' : 'Component sync completed',
-    world: buildCommandWorld(response, { accountId, dataMode, branchName, workspace, host: normalizeBaseUrl(baseUrl), sourceLayer: response.sync && response.sync.mode === 'variant' ? 'variant' : 'trunk' }),
+    world: syncPacketWorld(response, buildCommandWorld(response, { accountId, dataMode, branchName, workspace, host: normalizeBaseUrl(baseUrl), sourceLayer: response.sync && response.sync.mode === 'variant' ? 'variant' : 'trunk' }), branchName),
     revision: Object.assign(collectVerificationSource(cwd, flags), {
       platformSyncedSha: response.sync && (response.sync.postSyncSha || response.sync.branchHeadSha)
     }),
@@ -4344,7 +4600,7 @@ async function syncComponentsCommand(rawFlags) {
       { category: response.sync && response.sync.dryRun ? 'sync_dry_run' : 'sync_mutation', summary }
     ],
     rawRefs: { command: 'components sync' },
-    sync: response.sync,
+    sync: syncEvidencePayload(response.sync),
     summary
   }, { quiet: flagEnabled(flags.json) });
 
@@ -4375,11 +4631,31 @@ async function syncComponentsCommand(rawFlags) {
     return response;
   }
   console.log('Components sync:', JSON.stringify(response, null, 2));
+  printVariantSyncWrites(summary);
   printPromotionSignals(response);
   failOnSyncGate(gate);
   return response;
 }
 
+// The one line a person needs from a variant sync of a long-lived branch: what THIS sync changes, apart from
+// the overlays it merely re-confirms (the totals alone read the same on every sync).
+function printVariantSyncWrites(summary) {
+  const writes = summary && summary.writes;
+  if (!writes || summary.mode !== 'variant') return;
+  console.log('');
+  if (!writes.known) {
+    console.log('Overlay changes: unknown (this platform does not report which overlays were already stored).');
+    return;
+  }
+  const verb = summary.dryRun ? 'would change' : 'changed';
+  console.log('Overlay changes: ' + writes.changed + ' ' + verb + ', ' + writes.alreadyCurrent + ' already current, ' +
+    writes.removed + ' removed, ' + writes.pruned + ' pruned (converged back to trunk)');
+  (writes.changedComponents || []).forEach((entry) => {
+    console.log('  ' + String(entry.type || 'component').toLowerCase() + ':' + (entry.id != null ? entry.id : entry.name) +
+      (entry.name && entry.id != null ? '  ' + entry.name : ''));
+  });
+}
+
 // A sync is a step in a longer loop, and the steps after it are the ones that get skipped — so print what
 // the server just observed about this branch's relationship to trunk, not only what it wrote.
 function printPromotionSignals(response) {
@@ -4548,7 +4824,9 @@ function syncPlanEntries(response) {
         type: String(entry.type || entry.kind || 'component').toLowerCase(),
         id: entry.id == null ? null : String(entry.id),
         name: entry.name || null,
-        path: entry.path || null
+        path: entry.path || null,
+        // true when the overlay already stored for this component matches the branch: re-confirmed, not changed.
+        storedCurrent: entry.storedCurrent === true
       });
     });
   });
@@ -4594,6 +4872,8 @@ function evaluateSyncGates(response, flags, changedFromWorkingTree, cwd) {
   const expectedRemoved = parseExpectedRemoved(flags);
   const violations = [];
   const checks = {};
+  // Overlays the --changed-only gate did not count because the platform already stores them with this content.
+  let alreadyCurrentCount = null;
 
   if (flagEnabled(flags['fail-on-errors']) || flagEnabled(flags.failOnErrors)) {
     checks.failOnErrors = errors.length === 0;
@@ -4633,13 +4913,20 @@ function evaluateSyncGates(response, flags, changedFromWorkingTree, cwd) {
       const allowedIds = new Set(changedSet.filter((c) => c.id != null).map((c) => c.type + ':' + c.id));
       const allowedNames = new Set(changedSet.filter((c) => c.name).map((c) => c.type + ':' + String(c.name).toLowerCase()));
       const allowedPaths = new Set([].concat(...changedSet.map((c) => (Array.isArray(c.paths) ? c.paths : []))).map(String));
+      // An overlay the platform ALREADY stores with this exact content is not something this sync changes. A
+      // long-lived branch (a permanent customer release train) re-reports every one of its overlays on every sync,
+      // so counting those made the gate refuse ordinary work with "plan touches 80 components" and blame a stale
+      // branch that `components promotion` reported as ready. Removals are never exempt.
+      const alreadyCurrent = entries.filter((entry) => entry.storedCurrent && entry.bucket !== 'removed');
       const unexpected = entries.filter((entry) => {
+        if (entry.storedCurrent && entry.bucket !== 'removed') return false;
         if (entry.path && allowedPaths.has(String(entry.path))) return false;
         if (entry.id != null && allowedIds.has(entry.type + ':' + entry.id)) return false;
         if (entry.name && allowedNames.has(entry.type + ':' + String(entry.name).toLowerCase())) return false;
         return true;
       });
       checks.changedOnly = unexpected.length === 0;
+      alreadyCurrentCount = alreadyCurrent.length;
       if (unexpected.length) {
         // Name the most likely cause instead of only the symptom. An empty changed set with a non-empty
         // plan is the ordinary post-commit state, not evidence that the plan is dangerous.
@@ -4651,11 +4938,10 @@ function evaluateSyncGates(response, flags, changedFromWorkingTree, cwd) {
           // physically carries old copies of files nobody on it touched, and a variant sync turns each of
           // those into an unrelated override. Naming the cause is the difference between a gate that
           // stops the damage and a gate that also tells you how to clear it.
-          : (changedSet.length && unexpected.length > changedSet.length)
-            ? '\n    Most likely cause: this branch is BEHIND trunk and still carries old copies of files ' +
-              'it never changed. A variant sync turns each of those into an unrelated override.' +
-              '\n    Next step: merge trunk into this branch, push, then re-run the same command:' +
-              '\n      git merge <trunk> && git push origin <branch>'
+          // With --changed-since the empty-set hint above does not apply, so a ref that shows no committed change
+          // still needs the cause named — that is exactly the behind-trunk branch whose plan is all stale copies.
+          : ((changedSet.length || since) && unexpected.length > changedSet.length)
+            ? staleBranchGateHint(response)
             : '';
         violations.push('--changed-only: plan touches ' + unexpected.length + ' component(s) this checkout did not change: ' +
           unexpected.slice(0, 20).map(syncEntryToken).join(', ') + (unexpected.length > 20 ? ', ...' : '') + hint);
@@ -4663,7 +4949,28 @@ function evaluateSyncGates(response, flags, changedFromWorkingTree, cwd) {
     }
   }
 
-  return { violations, checks };
+  return { violations, checks, alreadyCurrentCount };
+}
+
+// Name the stale-branch cause only when the platform's own git comparison says the branch IS behind trunk. The
+// hint used to fire on the count alone, and told agents on an up-to-date permanent branch to merge trunk in.
+function staleBranchGateHint(response) {
+  const sync = (response && response.sync) || {};
+  const comparison = sync.branchComparison || (sync.promotion && sync.promotion.git) || null;
+  const behindBy = comparison && Number.isFinite(Number(comparison.behindBy)) ? Number(comparison.behindBy) : null;
+  if (behindBy !== null && behindBy > 0) {
+    return '\n    Most likely cause: this branch is BEHIND trunk by ' + behindBy + ' commit(s) and still carries old copies ' +
+      'of files it never changed. A variant sync turns each of those into an unrelated override.' +
+      '\n    Next step: merge trunk into this branch, push, then re-run the same command:' +
+      '\n      git merge <trunk> && git push origin <branch>';
+  }
+  if (behindBy === 0) {
+    return '\n    The branch is current with trunk, so these are not stale copies: they are overlays whose stored content ' +
+      'differs from this branch but that this checkout\'s changed set does not name. Widen --changed-since to the ' +
+      'commit the platform last synced (components promotion shows it), or review the plan with --dry-run.';
+  }
+  return '\n    The platform could not compare this branch with trunk. Run `remits-cli components promotion` to see ' +
+    'whether it is behind before merging anything.';
 }
 
 function failOnSyncGate(gate) {
@@ -4781,6 +5088,15 @@ function featureBranchCommitRefusal(branchContext, branchName, flags) {
     'deliberately creating a NEW variant branch, re-run with --create-variant-branch.';
 }
 
+function featureBranchSyncRefusal(branchContext, branchName, flags) {
+  if (!branchContext || branchContext.variantBranchSource !== 'subscription-fallback') return null;
+  if (flags && (flags['create-variant-branch'] === true || flags['create-variant-branch'] === 'true')) return null;
+  return 'components sync refused: \'' + branchName + '\' is not a variant branch (no committed variants, no ' +
+    'subscribers). ' + featureBranchLandingHint(branchContext) + ' Syncing here would write overlays for \'' +
+    branchName + '\' that nobody subscribes to, and flip every other lane on that branch to them. If you are ' +
+    'deliberately creating a NEW variant branch, re-run with --create-variant-branch.';
+}
+
 // What a verification envelope records as the world it verified. Taken from the platform's answer
 // (`variantWorld`, the same rule every run uses), never inferred from `onTrunk`: a feature branch cut from a
 // variant branch is not on trunk, yet resolves the SUBSCRIBED branch, and labelling it by its own name recorded
@@ -4947,6 +5263,36 @@ function printTrunkSyncWarning(trunkBranch, options) {
   emit('  For a gated plan, work on a variant branch instead.');
 }
 
+function variantSyncWrites(overridden, added, removed, unchanged) {
+  const overlays = overridden.concat(added);
+  const known = overlays.every((entry) => entry && typeof entry.storedCurrent === 'boolean');
+  const pruned = unchanged.filter((entry) => entry && entry.pruned === true).length;
+  if (!known) {
+    return { changed: null, alreadyCurrent: null, removed: removed.length, pruned, known: false };
+  }
+  const changed = overlays.filter((entry) => !entry.storedCurrent);
+  return {
+    changed: changed.length,
+    changedComponents: changed.slice(0, 50).map((entry) => ({ type: entry.type, name: entry.name, id: entry.id })),
+    alreadyCurrent: overlays.length - changed.length,
+    removed: removed.length,
+    pruned,
+    known: true
+  };
+}
+
+// `|` separates selectors and a repeated --names needs no separator. A COMMA is never a separator any more: it
+// is sent as part of the selector, and the platform matches a comma-bearing selector either as one whole case name
+// ("… the complete statement, offer, and surcharge matrix") or, for older invocations, as its comma-separated
+// parts (Test.selectorMatchesCase). Splitting in the CLI took the real name apart before the platform could see it.
+function parseTestCaseSelectors(rawNames) {
+  return (Array.isArray(rawNames) ? rawNames : [rawNames])
+    .filter((value) => value !== undefined && value !== null)
+    .flatMap((value) => String(value).split('|'))
+    .map((value) => value.trim())
+    .filter(Boolean);
+}
+
 function buildSyncSummary(response) {
   const sync = (response && response.sync) || {};
   const results = sync.syncResults || {};
@@ -5076,6 +5422,10 @@ function buildSyncSummary(response) {
     gateViolations: (response && response.gateViolations) || null,
     overridden: overridden.length,
     added: added.length,
+    // What THIS sync changes, as opposed to the whole overlay set it re-reports. `overridden`/`added` are totals,
+    // so five consecutive syncs of a long-lived branch all printed `overridden: 48, added: 32` and nobody could see
+    // which overlays their own sync moved. Null counts mean the platform predates the storedCurrent flag.
+    writes: variantSyncWrites(overridden, added, removed, unchanged),
     removed: removed.map((entry) => ({
       type: entry.type,
       kind: entry.kind,
@@ -5916,6 +6266,94 @@ function testCompileSignatures(status = {}) {
     .filter(Boolean);
 }
 
+function testRunSuiteNameFromStatus(status = {}) {
+  return status.test && status.test.name ? String(status.test.name) : null;
+}
+
+function testRunSuiteNameFromPacket(packet = {}) {
+  return packet.test && packet.test.testName
+    ? String(packet.test.testName)
+    : (packet.status && packet.status.test && packet.status.test.name ? String(packet.status.test.name) : null);
+}
+
+function testCaseOutcomesFromStatusLike(status = {}) {
+  const tests = status.result && Array.isArray(status.result.tests) ? status.result.tests :
+    (status.test && Array.isArray(status.test.tests) ? status.test.tests : []);
+  return tests
+    .filter((test) => test && test.name && typeof test.passed === 'boolean')
+    .map((test) => ({ name: String(test.name), passed: test.passed === true }));
+}
+
+function provenanceSignature(value) {
+  const rows = Array.isArray(value) ? value : [];
+  return sha256(stableStringify(rows.map((entry) => ({
+    type: entry && entry.type || null,
+    id: entry && entry.id || null,
+    name: entry && entry.name || null,
+    signature: entry && entry.signature || null,
+    source: entry && entry.source || null
+  }))));
+}
+
+function packetEvidenceIdentity(packet = {}) {
+  const world = packet.world || {};
+  const revision = packet.revision || {};
+  const laneSummary = packet.laneSummary || (packet.componentStatus && packet.componentStatus.laneSummary) || {};
+  return {
+    laneContentHash: world.laneContentHash || world.stagedOverlayHash || revision.laneContentHash ||
+      revision.stagedOverlayHash || laneSummary.contentHash || null,
+    gitHead: revision.gitHead || null
+  };
+}
+
+function sameNondeterminismIdentity(left = {}, right = {}) {
+  return !!(left.laneContentHash && right.laneContentHash && left.gitHead && right.gitHead &&
+    String(left.laneContentHash) === String(right.laneContentHash) &&
+    String(left.gitHead) === String(right.gitHead));
+}
+
+function detectNondeterministicTestRun(priorPackets, currentStatus, currentProvenance, currentIdentity = {}) {
+  const packets = Array.isArray(priorPackets) ? priorPackets : [];
+  const suiteName = testRunSuiteNameFromStatus(currentStatus);
+  const currentCases = testCaseOutcomesFromStatusLike(currentStatus);
+  if (!suiteName || !currentCases.length) return null;
+  if (!Array.isArray(currentProvenance) || !currentProvenance.length) return null;
+  if (!currentIdentity.laneContentHash || !currentIdentity.gitHead) return null;
+
+  const currentSignature = provenanceSignature(currentProvenance);
+  const currentByName = new Map(currentCases.map((outcome) => [outcome.name, outcome]));
+  for (let i = packets.length - 1; i >= 0; i -= 1) {
+    const packet = packets[i];
+    if (!packet || packet.type !== 'test_run') continue;
+    if (testRunSuiteNameFromPacket(packet) !== suiteName) continue;
+    const previousProvenance = packet.revision && packet.revision.componentProvenance;
+    if (!Array.isArray(previousProvenance) || !previousProvenance.length) continue;
+    if (!sameNondeterminismIdentity(currentIdentity, packetEvidenceIdentity(packet))) continue;
+    const previousSignature = provenanceSignature(previousProvenance);
+    if (previousSignature !== currentSignature) continue;
+    const previousCases = testCaseOutcomesFromStatusLike(packet.status || packet);
+    const flips = previousCases
+      .map((previous) => {
+        const current = currentByName.get(previous.name);
+        return current && current.passed !== previous.passed
+          ? { caseName: previous.name, previousPassed: previous.passed, currentPassed: current.passed, previousPacketId: packet.packetId }
+          : null;
+      })
+      .filter(Boolean);
+    if (flips.length) {
+      return {
+        nondeterministic: true,
+        message: 'Outcome changed with no source change - likely nondeterministic (AI/live data).',
+        suite: suiteName,
+        provenanceSignature: currentSignature,
+        previousPacketId: packet.packetId,
+        flips
+      };
+    }
+  }
+  return null;
+}
+
 function printTestRunPivots(status = {}) {
   const tests = status.result && Array.isArray(status.result.tests) ? status.result.tests : [];
   if (!tests.length) return;
@@ -6041,26 +6479,12 @@ async function testCommand(flags) {
     throw new Error('Missing --test <id-or-name>');
   }
 
-  // Test case names are English prose, so COMMAS occur in them naturally. A comma-delimited selector
-  // therefore split a legitimate name in half, matched nothing, and (before the server learned to
-  // report unmatched selectors) reported a clean run of zero cases. `|` is the delimiter now; the
-  // comma still works when no `|` is present, so existing invocations keep behaving as before.
-  // `--names` may also be repeated, which needs no delimiter at all.
+  // Test case names are English prose, so COMMAS occur in them naturally. `|` (or repeating --names) is the
+  // only delimiter; see parseTestCaseSelectors for how a comma-bearing selector is matched.
   const rawNames = flags.names === undefined || flags.names === null
     ? []
     : (Array.isArray(flags.names) ? flags.names : [flags.names]);
-  const repeated = rawNames.length > 1;
-  const names = rawNames
-    .flatMap((value) => {
-      const text = String(value);
-      if (text.includes('|')) return text.split('|');
-      // Comma-splitting is the legacy behaviour, kept so existing invocations still work. It is applied
-      // ONLY to a single --names value: repeating the flag is already unambiguous, so splitting there
-      // would take a deliberate literal name back apart.
-      return repeated ? [text] : text.split(',');
-    })
-    .map((s) => s.trim())
-    .filter(Boolean);
+  const names = parseTestCaseSelectors(rawNames);
 
   const api = buildAxios(baseUrl, session.token);
   // --as-account runs the Test AS a (descendant) subscriber account, so that account's relationship
@@ -6102,6 +6526,7 @@ async function testCommand(flags) {
     printSessionResolutionWarning(sessionContext);
     printResolvedBaseUrl(baseUrl);
     printStagingLane(branchName, workspace, workspaceSource(cwd, flags));
+    printStagingLaneOwnerNotice(start.staging || {});
     if (start.staging && Array.isArray(start.staging.accountLanes)) {
       printOrphanedWorkspaceWarning(start.staging);
       printAccountLanes({ accountLanes: start.staging.accountLanes, branchName, workspace });
@@ -6130,6 +6555,7 @@ async function testCommand(flags) {
     console.log(JSON.stringify(status, null, 2));
   } else {
     console.log('Final status:', JSON.stringify(status, null, 2));
+    printStagingLaneOwnerNotice(status.staging || {});
     printTestRunPivots(status);
   }
 
@@ -6155,15 +6581,38 @@ async function testCommand(flags) {
     process.exitCode = 1;
   }
 
+  const verificationContext = activeVerificationContext(cwd, flags, session, accountId);
+  const activeEnvelopeId = verificationEnvelopeIdForCommand(cwd, flags, verificationContext);
+  const componentProvenance = testComponentProvenance(status);
+  const sourceRevision = collectVerificationSource(cwd, flags);
+  const priorPackets = await readVerificationPacketsForDiagnostics(api, cwd, session, accountId, activeEnvelopeId, {
+    packetType: 'test_run',
+    suite: status.test && status.test.name,
+    max: 50
+  });
+  const nondeterminism = detectNondeterministicTestRun(priorPackets, status, componentProvenance, {
+    laneContentHash: status.staging && status.staging.laneSummary && status.staging.laneSummary.contentHash,
+    gitHead: sourceRevision.gitHead
+  });
+  if (nondeterminism && !jsonOutput) {
+    console.log('Nondeterministic signal:', nondeterminism.message);
+    nondeterminism.flips.slice(0, 6).forEach((flip) => {
+      console.log('  - ' + flip.caseName + ': ' + (flip.previousPassed ? 'passed' : 'failed') + ' -> ' + (flip.currentPassed ? 'passed' : 'failed') +
+        ' (previous packet ' + (flip.previousPacketId || 'unknown') + ')');
+    });
+  }
+
   await appendVerificationPacket(api, cwd, session, accountId, flags, {
     type: 'test_run',
     success: status.status === 'completed' && !(status.result && status.result.failed > 0) && !unmatched.length,
     claim: 'Test run ' + String(testRef),
     world: buildCommandWorld(status, { accountId, dataMode: status.dataMode || dataMode, dataModeSource, branchName, workspace, host: normalizeBaseUrl(baseUrl), sourceLayer: status.staging && status.staging.testComponentSource }),
-    revision: Object.assign(collectVerificationSource(cwd, flags), {
+    revision: Object.assign(sourceRevision, {
       compileSignatures: testCompileSignatures(status),
-      componentProvenance: testComponentProvenance(status)
+      componentProvenance
     }),
+    nondeterministic: nondeterminism ? true : undefined,
+    nondeterminism: nondeterminism || undefined,
     test: {
       taskId: start.taskId,
       testId: status.test && status.test.id,
@@ -6176,7 +6625,9 @@ async function testCommand(flags) {
       unmatchedTestNames: unmatched
     },
     evidenceCategories: testEvidenceCategories(status, names),
-    limitations: unmatched.length ? ['One or more requested test case selectors matched no case.'] : [],
+    limitations: []
+      .concat(unmatched.length ? ['One or more requested test case selectors matched no case.'] : [])
+      .concat(nondeterminism ? [nondeterminism.message] : []),
     rawRefs: { testStatusKey: start.taskId },
     status
   }, { quiet: jsonOutput });
@@ -6564,8 +7015,7 @@ async function toolCommand(flags) {
     console.log('Data mode:', data.dataMode || dataMode);
     if (data.threadGroupingId) console.log('Thread grouping ID:', data.threadGroupingId);
     console.log('Session log:', data.sessionLog);
-    const responseEvidence = fileEvidence(data.responseFile);
-    console.log('Tool response file:', data.responseFile + (responseEvidence.bytes ? ' (' + responseEvidence.bytes + ' bytes, sha256 ' + responseEvidence.sha256.slice(0, 12) + ')' : ''));
+    printToolResponseFileLine('Tool response file', data.responseFile);
     if (polledFailed) {
       console.log('Tool error:', data.toolMessage);
     }
@@ -6636,8 +7086,7 @@ async function toolCommand(flags) {
       console.log('Component:', `${data.componentSource}${sig}`);
     }
     console.log('Session log:', data.sessionLog);
-    const responseEvidence = fileEvidence(data.responseFile);
-    console.log('Tool response file:', data.responseFile + (responseEvidence.bytes ? ' (' + responseEvidence.bytes + ' bytes, sha256 ' + responseEvidence.sha256.slice(0, 12) + ')' : ''));
+    printToolResponseFileLine('Tool response file', data.responseFile);
   }
 
   // Non-zero exit so scripted/agent callers that check status notice the refusal too.
@@ -6661,8 +7110,7 @@ async function toolCommand(flags) {
     evidenceResponseFile = finalStatus.responseFile;
     if (!jsonOutput) {
       console.log('Final status:', finalStatus.data.status);
-      const finalEvidence = fileEvidence(finalStatus.responseFile);
-      console.log('Tool response file:', finalStatus.responseFile + (finalEvidence.bytes ? ' (' + finalEvidence.bytes + ' bytes, sha256 ' + finalEvidence.sha256.slice(0, 12) + ')' : ''));
+      printToolResponseFileLine('Tool response file', finalStatus.responseFile);
     }
     if (finalStatus.data.status !== 'completed') {
       process.exitCode = 1;
@@ -6673,6 +7121,7 @@ async function toolCommand(flags) {
   await appendVerificationPacket(api, cwd, session, accountId, flags, {
     type: 'tool_call',
     success: asyncMode && !waitForAsync ? null : (!toolFailed && (!asyncMode || process.exitCode !== 1)),
+    pending: asyncMode && !waitForAsync,
     claim: 'Tool call ' + String(toolName),
     world: buildCommandWorld(evidenceData, { accountId: evidenceData.accountId || accountId, dataMode: evidenceData.dataMode || dataMode, branchName: evidenceData.branchName || branchName, workspace: resolveWorkspace(cwd, flags), host: normalizeBaseUrl(baseUrl), sourceLayer: evidenceData.componentSource }),
     revision: Object.assign(collectVerificationSource(cwd, flags), {
@@ -6753,6 +7202,12 @@ async function verifyCommand(flags, subcommand) {
     if (flags.manifest || flags.file) {
       manifest = parseManifestFile(flags.manifest || flags.file);
     }
+    if (dataMode === 'prod' && !manifestRequiredEvidence(manifest).length && !flagEnabled(flags['no-contract'])) {
+      console.error('');
+      console.error('Warning: starting a prod-data verification envelope with no required evidence contract.');
+      console.error('Attach a manifest with requiredEvidence before destructive work, or pass --no-contract when this is intentionally evidence-only.');
+      console.error('');
+    }
     let statusResponse = null;
     try {
       statusResponse = await loggedPost(api, cwd, '/cli/components', {
@@ -6788,6 +7243,7 @@ async function verifyCommand(flags, subcommand) {
     console.log('Verification envelope started:', envelope.envelopeId);
     console.log('Target:', 'account=' + accountId + ', branch=' + branchName + ', workspace=' + (workspace || 'shared') + ', dataMode=' + dataMode);
     printAcceptanceWarnings(envelope);
+    printEnvelopeWarnings(envelope);
     console.log('Local mirror:', verificationPaths(cwd, envelope.envelopeId).base);
     return envelope;
   }
@@ -6829,6 +7285,7 @@ async function verifyCommand(flags, subcommand) {
     console.log('Manifest attached to envelope:', envelopeId);
     console.log('Required evidence:', (((response.envelope || {}).acceptance || {}).requiredEvidence || []).length);
     printAcceptanceWarnings(response.envelope);
+    printEnvelopeWarnings(response.envelope);
     return response.envelope;
   }
 
@@ -12521,11 +12978,12 @@ function printComponentsHelp(subcommand) {
     return;
   }
   if (subcommand === 'lanes' || subcommand === 'lane') {
-    console.log('Usage: remits-cli components lanes [--base-url URL] [--account-id ID] [--branch BRANCH] [--workspace NAME] [--json]');
+    console.log('Usage: remits-cli components lanes [--base-url URL] [--account-id ID] [--branch BRANCH] [--workspace NAME] [--wait-change [--lane-id ID] [--timeout 600]] [--json]');
     console.log('');
     console.log('Lists every indexed staging lane on the account, across users, branches, and workspaces.');
     console.log('This is read-only and uses the same lane registry that powers the admin Platforms view.');
     console.log('Use `components entries --lane-id <id>` to inspect the actual staged files in a lane.');
+    console.log('Use --wait-change to wait until the lane registry changes instead of polling in a loop.');
     return;
   }
   if (subcommand === 'entries' || subcommand === 'entry' || subcommand === 'staged') {
@@ -12564,7 +13022,7 @@ function printComponentsHelp(subcommand) {
   console.log('so several agents can iterate at once. See: remits-cli workspace --help');
   console.log('  remits-cli components stage [--workset|--changed-only] [--base-url URL] [--account-id ID] [--branch BRANCH] [--data-mode test|prod] [--json|--verbose]');
   console.log('  remits-cli components status [--base-url URL] [--account-id ID] [--branch BRANCH] [--component-type TYPE --component-id ID] [--json|--verbose]');
-  console.log('  remits-cli components lanes [--base-url URL] [--account-id ID] [--json]');
+  console.log('  remits-cli components lanes [--base-url URL] [--account-id ID] [--wait-change [--lane-id ID] [--timeout 600]] [--json]');
   console.log('  remits-cli components entries --lane-id ID [--base-url URL] [--account-id ID] [--json|--verbose]');
   console.log('  remits-cli components clear [--base-url URL] [--account-id ID] [--branch BRANCH] [--component-type TYPE] [--component-id ID] [--all] [--json|--verbose]');
   console.log('  remits-cli components sync [--safe] [--base-url URL] [--account-id ID] [--branch BRANCH] [--data-mode test|prod] [--force-tombstones] [--dry-run] [--summary]');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remits/remits-cli",
-  "version": "0.1.127",
+  "version": "0.1.129",
   "description": "Local CLI for auth, component sync, and live test execution against Remits",
   "license": "MIT",
   "private": false,

package/skills/remits-cli/references/branch-variants.md

@@ -363,7 +363,9 @@ The analogous hazard is different, and you must still respect it:
   explicitly.
 - **Use `components sync --dry-run` before risky variant syncs.** It reports `overridden`, `added`,
   `removed`, `unchanged`, `skipped`, and `errors` without writing rows, caching the sync SHA, or clearing
-  staging. Existing overlay ids appear as `variantId`; an `unchanged` row with `pruned:true` means the
+  staging. `overridden`/`added` are the branch's WHOLE overlay set; read the `Overlay changes:` line (or
+  `writes` in `--summary`) for what this sync actually changes, and `storedCurrent: true` on an entry for
+  an overlay that is already stored as-is. Existing overlay ids appear as `variantId`; an `unchanged` row with `pruned:true` means the
   branch has converged back to trunk and the overlay would be removed. It is rejected on trunk, and
   `components commit --dry-run` is unsupported because `commit` performs compile validation and local git
   writes before syncing.

package/skills/remits-cli/references/cli-state.md

@@ -72,6 +72,11 @@ Think about remits-cli as two cooperating layers:
      - where a large tool response was written
      - which tool schemas were most recently cached here
 
+Tool response files under `./.remits-cli/tool-responses/` are the full CLI results. The CLI may print a
+size/hash hint for large files so you can inspect them selectively with `jq`, `rg`, or byte-range reads,
+but it does not truncate the local JSON file. Do not confuse this with the in-platform OpenRouter client,
+which can offload large tool results inside the model conversation and inject a read-back tool for the AI.
+
 When a user asks an indirect question, map it to the right layer first:
 
 - "Why did this ticket open in the wrong repo?" → start in global state.

package/skills/remits-cli/references/command-reference.md

@@ -85,7 +85,10 @@ deterministically:
 remits-cli tool --name "mcp_run_action" --input '{"accountId":49,"actionId":200,"executionMode":"async","actionRunId":"my-stable-run-id","actionInput":{"sourceDocumentId":"..."}}' --data-mode prod
 ```
 
-Every tool response is saved to `./.remits-cli/tool-responses/<callId>.json`.
+Every tool response is saved in full to `./.remits-cli/tool-responses/<callId>.json`. Large responses may
+print an early size/hash line and a selective-read hint before any preview text, but the saved CLI file is
+not truncated or offloaded. That is separate from the platform's OpenRouter model loop, where the AI
+client may offload large tool results before feeding context back to the model.
 
 ### Hierarchy-scoped tool reads
 
@@ -272,7 +275,10 @@ Existing commands also accept `--verify-envelope <id>` to attach to a specific e
 Failed `remits-cli test run` output includes compact pivots per failed case: duration, trace id,
 bounded `report(...)` diagnostics, live HTTP signals, and resolved component provenance when the
 platform returns it. Re-read an existing run with `remits-cli test status --task-id <taskId>` before
-rerunning a long suite.
+rerunning a long suite. If the same suite/case flips pass/fail while the resolved component provenance
+signature is unchanged, the CLI prints a nondeterministic signal and records `nondeterministic:true` on
+the `test_run` packet. Treat that as an AI/live-data/flaky-fixture investigation cue, not as proof that
+source changed.
 
 Test-run requirements must name the suite/cases they mean:
 
@@ -281,23 +287,28 @@ Test-run requirements must name the suite/cases they mean:
 {"id":"one_case", "packetType":"test_run", "suite":"Statement API Flow", "cases":["rejects duplicated fee evidence"]}
 ```
 
-`verify start` and `verify manifest` warn when a requirement has a `packetType` but no discriminator.
-The evaluator treats pending async tool packets as pending, not passing; a later `tool status` packet is
-the proof. Tool packets store the response file path, byte size and hash rather than copying the whole
-tool payload into the envelope.
-
-Use `remits-cli verify list` to review open envelopes for the account without SQL. If a newer envelope
-replaces an older one, use `verify supersede`; if a duplicate or abandoned attempt should no longer read
-as live work, use `verify abandon`. Both keep the evidence history.
+A suite-only Test requirement is treated as `allCases:true`. A category-only Test requirement matches only
+a run carrying that exact evidence category, or the case whose name the category names; unrelated Test
+runs cannot replace it. `verify start` and `verify manifest` warn when a requirement has a `packetType` but
+no discriminator. The evaluator treats pending async tool packets as pending, not passing; a later
+`tool status` packet is the proof. Tool packets store the response file path, byte size and hash rather
+than copying the whole tool payload into the envelope.
+
+Use `remits-cli verify list` to review open envelopes for the account without SQL. The list shows stale
+counts, requirements-changed markers, and last packet time. `verify start` warns when another open envelope
+with the same summary/account/world exists; use `verify use <id>` to continue that contract or
+`verify supersede` when a newer envelope replaces it. If a duplicate or abandoned attempt should no longer
+read as live work, use `verify abandon`. Both keep the evidence history. Starting a prod-data envelope
+without required evidence prints a loud no-contract warning; add a manifest unless the envelope is
+intentionally evidence-only.
 
 The manifest is the proof contract. It should name the world being exercised: repo account, host,
 git/component branch, workspace, data mode, source layer, user journeys, artifacts and hashes, and the
 evidence categories required before the final response may claim the work is done. If the manifest
 cannot be written because the workflow is ambiguous, ask before implementation. For machine-gated report
 requirements, prefer structured entries like `{"id":"actual_upload","packetType":"browser_step",
-"category":"browser_session.actual_upload"}`. Plain strings work when they match a packet type or an
-evidence category, but structured entries are clearer when several agents collect packets for one
-envelope.
+"category":"browser_session.actual_upload"}`. Plain strings work for evidence categories, but do not use
+plain `"test_run"` as acceptance: it cannot say which Test or case proved the behavior.
 
 Common packet meanings:
 
@@ -318,14 +329,21 @@ Final claims should come from `remits-cli verify report`. Treat `Verified` as th
 the report lists it under `Verified`. If the report says `partially_verified`, stale, or missing evidence,
 say that plainly instead of widening the claim. In particular, staged proof is not committed variant/trunk
 proof, a token is not browser proof, and a direct DOM or Alpine state mutation is not the same as a user
-click/upload/reload flow.
+action.
+
+Evidence from the wrong world is excluded before it can satisfy a requirement. When the manifest declares
+fields such as `repoAccountId`, `gitBranch`, `componentBranch`, `workspace`, or `dataMode`, the report names
+the mismatch (`expected X got Y`) under missing evidence. Later stage/sync/source facts can stale earlier
+packets; explicit invalidations stale only packets collected before the invalidation, so a fresh rerun can
+verify the same requirement again.
 
 For tests specifically:
 - If `--data-mode` is omitted, `remits-cli test run` uses `test` and sends `dataModeSource:"cliDefault"`.
   An explicit `--data-mode prod` sends `dataModeSource:"explicitFlag"` so production test runs are
   auditable from the server status payload even when the original terminal history is gone.
-- `--names` is `|`-delimited (a comma still splits a single value) and may be repeated; an unmatched
-  selector fails the run instead of reporting zero cases as success.
+- `--names` is `|`-delimited and may be repeated. A selector containing commas matches a case with that
+  exact name first, else its comma-separated parts; an unmatched selector fails the run instead of
+  reporting zero cases as success.
 - `--as-account <ID>` runs AS a descendant subscriber so its edge selects the component branch
   (*"what does customer X get?"*); `--variant-branch <name>` probes a branch from any checkout
   (*"what does branch Y look like?"*), and `--variant-branch none` forces production/subscription semantics.

package/skills/remits-cli/references/component-resolution.md

@@ -160,7 +160,10 @@ TestMode still uses the committed DB source. Staging remains a dev/verification
 - **Inspect another lane without impersonating it:** `remits-cli components lanes` lists every indexed
   lane on the account; `remits-cli components entries --lane-id <id>` reads the authoritative staged
   files for one lane. These are read-only review surfaces. They do not switch your workspace, clear
-  anything, or change what your own test/token/tool runs resolve.
+  anything, or change what your own test/token/tool runs resolve. Use
+  `remits-cli components lanes --wait-change [--lane-id ID] [--timeout 600]` when you need to wait for a
+  sibling lane to move; it watches the lane registry's `updatedAtMs`/content hash instead of making you
+  poll in a loop.
 - **Clear only your own lane:** `remits-cli components clear` removes entries when you intentionally want
   to fall back to DB source. `--all` is scoped to the command's account/user/branch/workspace lane, not
   every lane another agent may be using.
@@ -209,7 +212,9 @@ commit write `ComponentVariant` overlays for a branch nobody subscribes to).
   account's lane context in their responses. A shared current lane is printed loudly; sibling lanes are
   listed when they matter.
 - `remits-cli components lanes` is the review view across users/branches/workspaces, and
-  `remits-cli components entries --lane-id <id>` is the drill-down into actual staged files.
+  `remits-cli components entries --lane-id <id>` is the drill-down into actual staged files. When you are
+  coordinating with another agent, prefer `components lanes --wait-change --lane-id <id>` to repeated
+  status checks.
 - `remits-cli components clear --all` is scoped to YOUR lane and never touches another agent's.
 - In lane rows, `currentLane` (also `mine`) marks THIS command's lane; `ownedByCaller` marks every lane
   staged by your CLI user — your other clones' agents included.

package/skills/remits-cli/references/development-loop.md

@@ -104,9 +104,13 @@ For Test requirements, be specific enough for the evaluator to know what a pass
 {"id":"duplicate_fee_case", "packetType":"test_run", "suite":"Statement API Flow", "cases":["rejects duplicated fee evidence"]}
 ```
 
-A requirement that says only `{"packetType":"test_run"}` is intentionally only a warning-worthy sketch:
-it will not turn a random Test packet into acceptance. Full-suite runs emit suite and passed-case
-categories automatically, so case-level requirements can be satisfied by a real full run.
+A suite-only Test requirement is treated as `allCases:true`. A category-only Test requirement matches only
+a run carrying that exact evidence category, or the case whose name the category names. A requirement that
+says only `{"packetType":"test_run"}` is intentionally only a warning-worthy sketch: it will not turn a
+random Test packet into acceptance. Full-suite runs emit suite and passed-case categories automatically,
+so case-level requirements can be satisfied by a real full run. The evaluator excludes packets collected
+in the wrong account/data lane/git branch/component branch/workspace before satisfying requirements, and
+pending async packets do not count until a result packet arrives.
 
 ## Development Workflow