@remits/remits-cli 0.1.129 → 0.1.132

package/index.js

@@ -4,18 +4,18 @@
 ## Table of Contents
 
 - L22  Runtime Bootstrap And Shared State
-- L116  Sessions, Account Resolution, And Production Guards
-- L595  Local State, Workspaces, And Verification Evidence
-- L1448  Account Repos, Guide Sync, And Platform Repo
-- L2106  Component Discovery And HTTP Logging
-- L2598  Skill Delivery And TOC Resolution
-- L2908  Auth And Component Staging
-- L3506  Component Summaries, Status, And Sync Gates
-- L5457  Branches, Promotion, Commit, And Test Runs
-- L6682  Tokens, Tools, Verification, And Config
-- L7598  Service Dashboard And WebSocket Listener
-- L9693  Agent And Ticket Workflows
-- L12751  Help, Auto Update, And Command Dispatch
+- L119  Sessions, Account Resolution, And Production Guards
+- L603  Local State, Workspaces, And Verification Evidence
+- L2155  Account Repos, Guide Sync, And Platform Repo
+- L2813  Component Discovery And HTTP Logging
+- L3389  Skill Delivery And TOC Resolution
+- L3699  Auth And Component Staging
+- L4312  Component Summaries, Status, And Sync Gates
+- L6375  Branches, Promotion, Commit, And Test Runs
+- L8036  Tokens, Tools, Verification, And Config
+- L9251  Service Dashboard And WebSocket Listener
+- L11367  Agent And Ticket Workflows
+- L14559  Help, Auto Update, And Command Dispatch
 */
 
 /*
@@ -102,9 +102,12 @@ const ACCOUNT_SCAN_EXCLUDE_DIRS = new Set([
   'tmp'
 ]);
 
+const LOCAL_ACTOR_MAX_LENGTH = 64;
+let LOCAL_ACTOR_CONTEXT = null;
+
 // Flags that are legitimately repeatable accumulate into an array instead of last-wins. Every other
 // flag keeps last-wins so existing callers are unaffected.
-const REPEATABLE_FLAGS = new Set(['expected-removed', 'expectedRemoved', 'names']);
+const REPEATABLE_FLAGS = new Set(['expected-removed', 'expectedRemoved', 'names', 'tag', 'tags', 'key', 'keys', 'case-key']);
 
 // `-m "msg"` is how git spells a commit message, and agents type it from habit. Before this the parser took a
 // single-dash token as the VALUE of whatever flag preceded it: `--json -m "x"` silently turned JSON mode
@@ -405,6 +408,7 @@ function resolveSessionIdentity(cwd, flags = {}) {
     branchName,
     workspace,
     workspaceSource: workspaceSource(cwd, flags),
+    localState: localStateSummary(cwd, flags),
     dataMode,
     // `test run` resolves its lane from the FLAG ONLY (testRunCommand), never the stored session, so that
     // an account whose session is parked on prod cannot have a test run silently follow it. Report both
@@ -433,6 +437,8 @@ function printSessionIdentity(identity, options = {}) {
     console.log('Data mode (test run):', identity.testRunDataMode || DEFAULT_DATA_MODE,
       '[' + (identity.testRunDataModeSource || 'cliDefault') + ']');
     console.log('Base URL:', identity.baseUrl);
+    console.log('Local actor:', identity.localState.actor + '   (from ' + identity.localState.actorSource + ')');
+    console.log('Local state:', identity.localState.stateDir);
     return;
   }
 
@@ -456,6 +462,8 @@ function printSessionIdentity(identity, options = {}) {
   console.log('  Branch:', identity.branchName);
   console.log('  Workspace:', (identity.workspace || 'none (shared default lane)') +
     (identity.workspaceSource ? '   [' + identity.workspaceSource + ']' : ''));
+  console.log('  Local actor:', identity.localState.actor + '   (from ' + identity.localState.actorSource + ')');
+  console.log('  Local state:', identity.localState.stateDir);
   console.log('  Data mode:', identity.dataMode, '(applies to tool/tools/token)');
   // `test run` deliberately ignores the stored session lane and defaults to test, so a session sitting on
   // prod would otherwise read as "prod" here while the next test run went to the test lane. Say so rather
@@ -603,16 +611,316 @@ function ensureDir(dirPath) {
 
 function localStatePaths(cwd) {
   const base = path.join(cwd, '.remits-cli');
+  const actor = resolveLocalActor();
+  const actorDir = path.join(base, 'actors', actor.id);
+  const legacyVerificationDir = path.join(base, 'verification');
   return {
     base,
-    toolsDir: path.join(base, 'tools'),
-    sessionsDir: path.join(base, 'sessions'),
-    toolResponsesDir: path.join(base, 'tool-responses'),
-    verificationDir: path.join(base, 'verification'),
-    activeVerificationFile: path.join(base, 'verification', 'active'),
-    activeVerificationContextsFile: path.join(base, 'verification', 'active-contexts.json'),
-    currentSessionFile: path.join(base, 'current-session.txt'),
-    workspaceFile: path.join(base, 'workspace')
+    actor,
+    actorsDir: path.join(base, 'actors'),
+    actorDir,
+    sharedDir: path.join(base, 'shared'),
+    toolsDir: path.join(base, 'shared', 'tools'),
+    sessionsDir: path.join(actorDir, 'sessions'),
+    toolResponsesDir: path.join(actorDir, 'tool-responses'),
+    verificationDir: path.join(actorDir, 'verification'),
+    diagnosticsDir: path.join(actorDir, 'diagnostics'),
+    activeVerificationFile: path.join(actorDir, 'verification', 'active'),
+    activeVerificationContextsFile: path.join(actorDir, 'verification', 'active-contexts.json'),
+    currentSessionFile: path.join(actorDir, 'current-session.txt'),
+    workspaceFile: path.join(base, 'workspace'),
+    stateVersionFile: path.join(base, 'state-version.json'),
+    legacy: {
+      toolsDir: path.join(base, 'tools'),
+      sessionsDir: path.join(base, 'sessions'),
+      toolResponsesDir: path.join(base, 'tool-responses'),
+      verificationDir: legacyVerificationDir,
+      activeVerificationFile: path.join(legacyVerificationDir, 'active'),
+      activeVerificationContextsFile: path.join(legacyVerificationDir, 'active-contexts.json'),
+      currentSessionFile: path.join(base, 'current-session.txt')
+    }
+  };
+}
+
+function normalizeLocalActor(value) {
+  if (value === undefined || value === null) return null;
+  const trimmed = String(value).trim();
+  if (!trimmed) return null;
+  let normalized = trimmed
+    .toLowerCase()
+    .replace(/[^a-z0-9._-]/g, '-')
+    .replace(/-+/g, '-')
+    .replace(/^[-.]+/, '')
+    .replace(/[-.]+$/, '');
+  if (normalized.length > LOCAL_ACTOR_MAX_LENGTH) {
+    normalized = normalized.slice(0, LOCAL_ACTOR_MAX_LENGTH).replace(/[-.]+$/, '');
+  }
+  return normalized || null;
+}
+
+// The generated fallback id must be STABLE for a given user and checkout. It used to carry process.pid, so every
+// single CLI invocation minted a fresh actor directory: 85 of them accumulated in one account repo, each holding a
+// partial copy of the session and tool-response state, the "other actor state exists" warning grew to a ~50-name
+// wall, and — because the active-verification pointer lives in the actor directory — no invocation could ever see
+// the envelope the previous one opened, so everything silently fell back to the legacy flat state.
+// Genuine concurrent agents still isolate themselves explicitly, with --actor / --local-agent / REMITS_AGENT_ID
+// (which `agent serve` exports into each child), and that path is unchanged.
+function generatedLocalActorId() {
+  const base = 'local-' + os.userInfo().username + '-' + path.basename(process.cwd());
+  return normalizeLocalActor(base) || 'local-default';
+}
+
+function resolveLocalActor(flags = {}) {
+  if (LOCAL_ACTOR_CONTEXT && LOCAL_ACTOR_CONTEXT.id) return LOCAL_ACTOR_CONTEXT;
+  const explicit = flags['local-agent'] || flags.localAgent || flags['actor'] || flags.actor;
+  const envValue = process.env.REMITS_AGENT_ID || process.env.REMITS_LOCAL_AGENT_ID;
+  const explicitId = normalizeLocalActor(explicit);
+  if (explicitId) return { id: explicitId, source: flags['local-agent'] || flags.localAgent ? '--local-agent' : '--actor' };
+  const envId = normalizeLocalActor(envValue);
+  if (envId) return { id: envId, source: process.env.REMITS_AGENT_ID ? 'REMITS_AGENT_ID' : 'REMITS_LOCAL_AGENT_ID' };
+  return { id: generatedLocalActorId(), source: 'generated from process and checkout' };
+}
+
+function configureLocalActor(flags = {}) {
+  const explicit = flags['local-agent'] || flags.localAgent || flags['actor'] || flags.actor;
+  const explicitId = normalizeLocalActor(explicit);
+  if (explicitId) {
+    LOCAL_ACTOR_CONTEXT = { id: explicitId, source: flags['local-agent'] || flags.localAgent ? '--local-agent' : '--actor' };
+  } else if (!LOCAL_ACTOR_CONTEXT) {
+    LOCAL_ACTOR_CONTEXT = resolveLocalActor({});
+  }
+  return LOCAL_ACTOR_CONTEXT;
+}
+
+function localActorId(flags = {}) {
+  return resolveLocalActor(flags).id;
+}
+
+function printLocalActor(cwd, flags = {}) {
+  const paths = localStatePaths(cwd);
+  console.log('Local actor:', paths.actor.id + '   (from ' + paths.actor.source + ')');
+  console.log('Local state:', paths.actorDir);
+}
+
+function listActorDirectories(cwd) {
+  const paths = localStatePaths(cwd);
+  try {
+    if (!fs.existsSync(paths.actorsDir)) return [];
+    return fs.readdirSync(paths.actorsDir, { withFileTypes: true })
+      .filter((entry) => entry.isDirectory())
+      .map((entry) => {
+        const actorDir = path.join(paths.actorsDir, entry.name);
+        const stat = fileStat(actorDir);
+        return {
+          actor: entry.name,
+          path: actorDir,
+          current: entry.name === paths.actor.id,
+          updatedAt: stat ? stat.mtime.toISOString() : null
+        };
+      })
+      .sort((a, b) => String(a.actor).localeCompare(String(b.actor)));
+  } catch (_) {
+    return [];
+  }
+}
+
+function gitTrackedRemitsCliFiles(cwd) {
+  try {
+    const output = runGit(cwd, 'git ls-files .remits-cli');
+    return output ? output.split(/\r?\n/).filter(Boolean) : [];
+  } catch (_) {
+    return [];
+  }
+}
+
+function fileRowsUnder(dir, suffixPattern = null, max = 50) {
+  const rows = [];
+  function walk(current) {
+    if (rows.length >= max || !fs.existsSync(current)) return;
+    let entries = [];
+    try {
+      entries = fs.readdirSync(current, { withFileTypes: true });
+    } catch (_) {
+      return;
+    }
+    entries.forEach((entry) => {
+      if (rows.length >= max) return;
+      const entryPath = path.join(current, entry.name);
+      if (entry.isDirectory()) {
+        walk(entryPath);
+      } else if (!suffixPattern || suffixPattern.test(entry.name)) {
+        const stat = fileStat(entryPath);
+        rows.push({
+          path: entryPath,
+          size: stat ? stat.size : 0,
+          updatedAt: stat ? stat.mtime.toISOString() : null
+        });
+      }
+    });
+  }
+  walk(dir);
+  return rows;
+}
+
+function likelyRawPayloadSessionLog(file) {
+  const entries = readJsonLinesFile(file, 120);
+  return entries.some((entry) => {
+    if (!entry || typeof entry !== 'object') return false;
+    if (entry.unsafePayloadLogging === true) return true;
+    const request = entry.request;
+    if (!request || typeof request !== 'object') return false;
+    const text = JSON.stringify(request);
+    return /statementText|ocrText|messages|actionInput|source|html|schema/i.test(text) &&
+      text.length > 2000;
+  });
+}
+
+function localStateReport(cwd, flags = {}) {
+  const paths = ensureLocalState(cwd);
+  const actors = listActorDirectories(cwd);
+  const legacySessionLogs = fileRowsUnder(paths.legacy.sessionsDir, /\.jsonl$/);
+  const actorSessionLogs = fileRowsUnder(paths.sessionsDir, /\.jsonl$/);
+  const legacyToolResponses = fileRowsUnder(paths.legacy.toolResponsesDir, /\.json$/);
+  const actorToolResponses = fileRowsUnder(paths.toolResponsesDir, /\.json$/);
+  const largest = actorSessionLogs.concat(legacySessionLogs, actorToolResponses, legacyToolResponses)
+    .sort((a, b) => b.size - a.size)
+    .slice(0, 10);
+  return {
+    cwd,
+    actor: paths.actor,
+    activeActorStateDir: paths.actorDir,
+    workspace: resolveWorkspace(cwd, flags),
+    workspaceSource: workspaceSource(cwd, flags),
+    workspaceFile: paths.workspaceFile,
+    trackedFiles: gitTrackedRemitsCliFiles(cwd),
+    actors,
+    foreignActors: actors.filter((actor) => !actor.current),
+    legacy: {
+      currentSessionFile: paths.legacy.currentSessionFile,
+      currentSessionExists: fs.existsSync(paths.legacy.currentSessionFile),
+      sessionLogs: legacySessionLogs,
+      toolResponses: legacyToolResponses,
+      likelyRawPayloadLogs: legacySessionLogs.filter((row) => likelyRawPayloadSessionLog(row.path))
+    },
+    current: {
+      currentSessionFile: paths.currentSessionFile,
+      sessionLogs: actorSessionLogs,
+      toolResponses: actorToolResponses,
+      likelyRawPayloadLogs: actorSessionLogs.filter((row) => likelyRawPayloadSessionLog(row.path))
+    },
+    largestFiles: largest
+  };
+}
+
+const FOREIGN_ACTOR_RECENT_MS = 7 * 24 * 60 * 60 * 1000;
+
+// Directories left by the old per-process generated id ('session-<pid>-<user>-<checkout>'). Nothing mints that
+// shape any more, so however recently one was written it is debris from a finished process, never a live agent:
+// it is prunable regardless of age, which matters because the defect produced dozens of them in a single day.
+const LEGACY_PER_PROCESS_ACTOR = /^session-\d+-/;
+
+function isDisposableActor(actor, cutoff) {
+  if (!actor || actor.current) return false;
+  if (LEGACY_PER_PROCESS_ACTOR.test(String(actor.actor))) return true;
+  return !(actor.updatedAt && Date.parse(actor.updatedAt) >= cutoff);
+}
+
+// Remove actor state directories that are neither the current actor nor recently active. Only ever touches
+// directories under .remits-cli/actors, and never the active one, so the worst case is discarding old session
+// logs and tool responses that nothing reads.
+function pruneStaleActorDirectories(cwd) {
+  const paths = localStatePaths(cwd);
+  const cutoff = Date.now() - FOREIGN_ACTOR_RECENT_MS;
+  const removed = [];
+  const failed = [];
+  let kept = 0;
+  listActorDirectories(cwd).forEach((actor) => {
+    if (!isDisposableActor(actor, cutoff)) {
+      kept += 1;
+      return;
+    }
+    if (path.dirname(actor.path) !== paths.actorsDir) return;
+    try {
+      fs.rmSync(actor.path, { recursive: true, force: true });
+      removed.push(actor.actor);
+    } catch (_) {
+      failed.push(actor.actor);
+    }
+  });
+  return { removed, failed, kept };
+}
+
+function localStateWarnings(cwd, flags = {}) {
+  const report = localStateReport(cwd, flags);
+  const warnings = [];
+  if (!report.workspace) {
+    warnings.push('Using the shared/default workspace lane. Run `remits-cli workspace use --auto` for isolated staging.');
+  }
+  if (report.trackedFiles.length) {
+    warnings.push('.remits-cli is tracked by git (' + report.trackedFiles.length + ' file(s)); untrack it before committing.');
+  }
+  if (report.actor.source && report.actor.source.startsWith('generated') && report.foreignActors.length) {
+    // Only RECENTLY active other actors are a signal. Every generated actor leaves a directory behind forever,
+    // so listing them all printed a ~50-name wall on every command that drowned the warnings worth reading.
+    const cutoff = Date.now() - FOREIGN_ACTOR_RECENT_MS;
+    const recent = report.foreignActors
+      .filter((a) => !isDisposableActor(a, cutoff))
+      .sort((a, b) => Date.parse(b.updatedAt || 0) - Date.parse(a.updatedAt || 0));
+    const shown = recent.slice(0, 3).map((a) => a.actor);
+    const stale = report.foreignActors.length - recent.length;
+    const setOne = 'Name this one with --actor <name> (or REMITS_AGENT_ID) if another agent shares this checkout.';
+    const pruneHint = stale
+      ? stale + ' spent actor dir(s) (idle, or left behind by finished processes) can be cleared with `remits-cli doctor local-state --prune-actors`.'
+      : '';
+    if (shown.length) {
+      warnings.push('Other actor state is live here: ' + shown.join(', ') +
+        (recent.length > shown.length ? ' (+' + (recent.length - shown.length) + ' more)' : '') + '. ' + setOne +
+        (pruneHint ? ' ' + pruneHint : ''));
+    } else if (pruneHint) {
+      warnings.push(pruneHint);
+    }
+  }
+  if (report.legacy.currentSessionExists || report.legacy.sessionLogs.length || report.legacy.toolResponses.length) {
+    warnings.push('Legacy flat .remits-cli state exists; new writes use actor-scoped state and legacy files are read only as fallback.');
+  }
+  if (report.current.likelyRawPayloadLogs.length || report.legacy.likelyRawPayloadLogs.length) {
+    warnings.push('At least one session log appears to contain raw or unsafe payload-shaped fields.');
+  }
+  return { report, warnings };
+}
+
+function printLocalStateWarnings(cwd, flags = {}) {
+  const { warnings } = localStateWarnings(cwd, flags);
+  if (!warnings.length) return;
+  console.log('Local state warnings:');
+  warnings.forEach((warning) => console.log('  - ' + warning));
+}
+
+function printLocalCommandContext(cwd, flags = {}, context = {}) {
+  const paths = localStatePaths(cwd);
+  const branchName = context.branchName || flags.branch || safeGitValue(cwd, 'git rev-parse --abbrev-ref HEAD') || 'unknown';
+  const workspace = context.workspace !== undefined ? context.workspace : resolveWorkspace(cwd, flags);
+  const dataMode = context.dataMode || null;
+  const accountId = context.accountId || null;
+  console.log('Local actor:', paths.actor.id + '   (from ' + paths.actor.source + ')');
+  console.log('Local state:', paths.actorDir);
+  const pieces = [];
+  if (accountId) pieces.push('account=' + accountId);
+  pieces.push('branch=' + branchName);
+  pieces.push('workspace=' + (workspace || 'shared'));
+  if (dataMode) pieces.push('dataMode=' + dataMode);
+  console.log('Command context:', pieces.join(', '));
+}
+
+function localStateSummary(cwd, flags = {}) {
+  const paths = localStatePaths(cwd);
+  return {
+    actor: paths.actor.id,
+    actorSource: paths.actor.source,
+    stateDir: paths.actorDir,
+    workspace: resolveWorkspace(cwd, flags),
+    workspaceSource: workspaceSource(cwd, flags),
+    sharedWorkspace: !resolveWorkspace(cwd, flags)
   };
 }
 
@@ -713,10 +1021,21 @@ function printStagingLane(branchName, workspace, source) {
 function ensureLocalState(cwd) {
   const paths = localStatePaths(cwd);
   ensureDir(paths.base);
+  ensureDir(paths.actorsDir);
+  ensureDir(paths.actorDir);
+  ensureDir(paths.sharedDir);
   ensureDir(paths.toolsDir);
   ensureDir(paths.sessionsDir);
   ensureDir(paths.toolResponsesDir);
   ensureDir(paths.verificationDir);
+  ensureDir(paths.diagnosticsDir);
+  if (!fs.existsSync(paths.stateVersionFile)) {
+    atomicWriteFile(paths.stateVersionFile, JSON.stringify({
+      version: 2,
+      shape: 'actor-scoped',
+      updatedAt: new Date().toISOString()
+    }, null, 2));
+  }
   return paths;
 }
 
@@ -740,8 +1059,14 @@ function sessionJsonlFile(cwd) {
 }
 
 const CONTENT_FIELDS = new Set(['source', 'html', 'javascript', 'css', 'schema', 'inputSchema', 'previewData', 'messages']);
+const LARGE_LOG_STRING_BYTES = 256;
+const MAX_LOG_SUMMARY_DEPTH = 2;
 const SECRET_LOG_FIELDS = new Set([
   'token',
+  'embedtokenkey',
+  'embeddableurl',
+  'liveurl',
+  'shortbasepath',
   'tokeninput',
   'tokenkey',
   'authtoken',
@@ -751,6 +1076,26 @@ const SECRET_LOG_FIELDS = new Set([
   'x-remits-token',
   'authorization'
 ]);
+const CONTENT_LOG_FIELDS = new Set([
+  'actioninput',
+  'content',
+  'css',
+  'file',
+  'filecontents',
+  'html',
+  'input',
+  'inputschema',
+  'javascript',
+  'messages',
+  'ocrtext',
+  'payload',
+  'previewdata',
+  'prompt',
+  'schema',
+  'source',
+  'statementtext',
+  'text'
+]);
 
 function sanitizeForLog(value) {
   if (value === null || value === undefined) {
@@ -775,6 +1120,173 @@ function sanitizeForLog(value) {
   return out;
 }
 
+function estimatedJsonBytes(value) {
+  try {
+    return Buffer.byteLength(JSON.stringify(value));
+  } catch (_) {
+    return Buffer.byteLength(String(value));
+  }
+}
+
+function safeHashValue(value) {
+  try {
+    return sha256(stableStringify(value));
+  } catch (_) {
+    return sha256(String(value));
+  }
+}
+
+function fieldLooksSensitive(key) {
+  return SECRET_LOG_FIELDS.has(String(key || '').toLowerCase());
+}
+
+function fieldLooksContent(key) {
+  return CONTENT_LOG_FIELDS.has(String(key || '').toLowerCase());
+}
+
+function summarizeLogValue(value, key = null, state = { nestedKeyCount: 0, redactions: [] }, depth = 0) {
+  const keyText = key == null ? '' : String(key);
+  const nestedPayloadValue = depth > 0;
+  if (fieldLooksSensitive(keyText)) {
+    state.redactions.push(keyText + ' redacted');
+    return { type: 'redacted', redacted: true };
+  }
+  if (value === null || value === undefined) {
+    return { type: value === null ? 'null' : 'undefined' };
+  }
+  if (typeof value === 'string') {
+    const bytes = Buffer.byteLength(value);
+    if (nestedPayloadValue || fieldLooksContent(keyText) || bytes > LARGE_LOG_STRING_BYTES) {
+      state.redactions.push((keyText || 'string') + ' omitted by default');
+      return { type: 'string', bytes, sha256: sha256(value), omitted: true };
+    }
+    return { type: 'string', bytes, value };
+  }
+  if (typeof value === 'number' || typeof value === 'boolean') {
+    if (nestedPayloadValue) {
+      state.redactions.push((keyText || typeof value) + ' omitted by default');
+      return { type: typeof value, sha256: safeHashValue(value), omitted: true };
+    }
+    return { type: typeof value, value };
+  }
+  if (Array.isArray(value)) {
+    if (depth >= MAX_LOG_SUMMARY_DEPTH) {
+      state.redactions.push((keyText || 'array') + ' nested array omitted by default');
+      return {
+        type: 'array',
+        length: value.length,
+        estimatedBytes: estimatedJsonBytes(value),
+        sha256: safeHashValue(value),
+        omitted: true
+      };
+    }
+    const sample = value.slice(0, 5).map((entry) => summarizeLogValue(entry, keyText, state, depth + 1));
+    if (value.length > 5) {
+      state.redactions.push((keyText || 'array') + ' sample capped at 5 of ' + value.length);
+    }
+    return {
+      type: 'array',
+      length: value.length,
+      estimatedBytes: estimatedJsonBytes(value),
+      sha256: safeHashValue(value),
+      sample
+    };
+  }
+  if (typeof value === 'object') {
+    const keys = Object.keys(value).sort();
+    state.nestedKeyCount += keys.length;
+    if (depth >= MAX_LOG_SUMMARY_DEPTH) {
+      state.redactions.push((keyText || 'object') + ' nested object omitted by default');
+      return {
+        type: 'object',
+        keyCount: keys.length,
+        keys,
+        estimatedBytes: estimatedJsonBytes(value),
+        sha256: safeHashValue(value),
+        omitted: true
+      };
+    }
+    const fields = {};
+    keys.slice(0, 50).forEach((childKey) => {
+      fields[childKey] = summarizeLogValue(value[childKey], childKey, state, depth + 1);
+    });
+    if (keys.length > 50) {
+      state.redactions.push((keyText || 'object') + ' keys capped at 50 of ' + keys.length);
+    }
+    return {
+      type: 'object',
+      keyCount: keys.length,
+      keys,
+      estimatedBytes: estimatedJsonBytes(value),
+      sha256: safeHashValue(value),
+      fields
+    };
+  }
+  return { type: typeof value, bytes: estimatedJsonBytes(value), sha256: safeHashValue(value), omitted: true };
+}
+
+function summarizePayloadFieldsForLog(payload, defaultRedaction) {
+  const input = payload && typeof payload === 'object' ? payload : { value: payload };
+  const state = { nestedKeyCount: 0, redactions: [] };
+  const topLevelKeys = Object.keys(input).sort();
+  const fieldSummary = {};
+  topLevelKeys.forEach((key) => {
+    fieldSummary[key] = summarizeLogValue(input[key], key, state);
+  });
+  if (state.redactions.length === 0 && defaultRedaction) {
+    state.redactions.push(defaultRedaction);
+  }
+  return { input, state, topLevelKeys, fieldSummary };
+}
+
+function summarizeRequestForLog(payload = {}) {
+  const { input, state, topLevelKeys, fieldSummary } = summarizePayloadFieldsForLog(
+    payload,
+    'payload summarized; nested values omitted by default'
+  );
+  return {
+    accountId: input.accountId !== undefined ? input.accountId : null,
+    dataMode: input.dataMode || null,
+    branchName: input.branchName || null,
+    workspace: input.workspace || null,
+    command: input.command || null,
+    toolName: input.name || input.toolName || null,
+    callId: input.callId || null,
+    topLevelKeys,
+    nestedKeyCount: state.nestedKeyCount,
+    estimatedBytes: estimatedJsonBytes(input),
+    sha256: safeHashValue(input),
+    fields: fieldSummary,
+    redactions: Array.from(new Set(state.redactions))
+  };
+}
+
+function summarizeResponseForLog(payload = {}) {
+  const { input, state, topLevelKeys, fieldSummary } = summarizePayloadFieldsForLog(
+    payload,
+    'response summarized; nested values omitted by default'
+  );
+  return {
+    topLevelKeys,
+    nestedKeyCount: state.nestedKeyCount,
+    estimatedBytes: estimatedJsonBytes(input),
+    sha256: safeHashValue(input),
+    fields: fieldSummary,
+    redactions: Array.from(new Set(state.redactions))
+  };
+}
+
+function unsafePayloadLoggingEnabled() {
+  return process.env.REMITS_CLI_UNSAFE_LOG_PAYLOADS === '1';
+}
+
+function requestPayloadForSessionLog(payload) {
+  if (unsafePayloadLoggingEnabled()) {
+    return sanitizeForLog(payload);
+  }
+  return undefined;
+}
+
 function appendSessionLog(cwd, entry) {
   const file = sessionJsonlFile(cwd);
   fs.appendFileSync(file, JSON.stringify(entry) + '\n');
@@ -866,13 +1378,24 @@ function toolEvidenceSummary(data = {}, responseFile) {
 function readToolResponseFile(cwd, callId) {
   if (!callId) return null;
   const paths = ensureLocalState(cwd);
-  const file = path.join(paths.toolResponsesDir, callId + '.json');
-  if (!fs.existsSync(file)) return null;
-  try {
-    return JSON.parse(fs.readFileSync(file, 'utf8'));
-  } catch (_) {
-    return null;
+  const candidates = [
+    path.join(paths.toolResponsesDir, callId + '.json'),
+    path.join(paths.legacy.toolResponsesDir, callId + '.json')
+  ];
+  for (const file of candidates) {
+    if (!fs.existsSync(file)) continue;
+    try {
+      const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+      if (parsed && typeof parsed === 'object' && file.includes(path.sep + 'tool-responses' + path.sep)) {
+        parsed._localStateFile = file;
+        parsed._legacyLocalState = file.startsWith(paths.legacy.toolResponsesDir);
+      }
+      return parsed;
+    } catch (_) {
+      return null;
+    }
   }
+  return null;
 }
 
 function verificationPaths(cwd, envelopeId) {
@@ -888,24 +1411,51 @@ function verificationPaths(cwd, envelopeId) {
   };
 }
 
+// The active envelope is bound to the checkout world an agent WORKS in: host, account, branch, workspace - the
+// same identity as its staging lane. The data lane is deliberately NOT part of it. Commands resolve their lane
+// differently (`test run` defaults to test; stage/token/tool/sync follow the session), so a lane in this key made
+// one agent see a different envelope - or none - from one command to the next: evidence silently never attached,
+// and `verify report` answered "No verification envelope selected" for the envelope it had just started. Whether
+// a command's lane fits the envelope is the platform's call (`verificationPreflight`), and it is made out loud.
 function verificationContextKey(context = {}) {
   const baseUrl = normalizeBaseUrl(context.baseUrl || context.host || DEFAULT_BASE_URL);
   const accountId = context.accountId != null ? String(context.accountId) : 'unknown-account';
   const branchName = context.branchName || context.branch || 'unknown-branch';
   const workspace = normalizeWorkspace(context.workspace) || 'shared';
-  const dataMode = normalizeDataMode(context.dataMode);
-  return [baseUrl, accountId, branchName, workspace, dataMode].join('|');
+  return [baseUrl, accountId, branchName, workspace].join('|');
+}
+
+// Pointers written while the data lane was still part of the key end in `|test` / `|prod`. They name the same
+// checkout world, so read them (newest first) rather than orphan an envelope an older CLI selected.
+function legacyVerificationContextKeys(key) {
+  return [key + '|test', key + '|prod'];
+}
+
+function activeVerificationContextEntry(contexts, key) {
+  const normalize = (entry) => (typeof entry === 'string' ? { envelopeId: entry } : entry);
+  const current = contexts && contexts[key];
+  if (current) return normalize(current);
+  const legacy = legacyVerificationContextKeys(key)
+    .map((legacyKey) => contexts && contexts[legacyKey])
+    .filter((entry) => entry && (typeof entry === 'string' || entry.envelopeId))
+    .map(normalize)
+    .sort((left, right) => String(right.updatedAt || '').localeCompare(String(left.updatedAt || '')));
+  return legacy[0] || null;
 }
 
 function readActiveVerificationContexts(cwd) {
-  const file = localStatePaths(cwd).activeVerificationContextsFile;
-  if (!fs.existsSync(file)) return {};
-  try {
-    const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
-    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
-  } catch (_) {
-    return {};
+  const paths = localStatePaths(cwd);
+  const candidates = [paths.activeVerificationContextsFile, paths.legacy.activeVerificationContextsFile];
+  for (const file of candidates) {
+    if (!fs.existsSync(file)) continue;
+    try {
+      const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+      return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+    } catch (_) {
+      return {};
+    }
   }
+  return {};
 }
 
 function writeActiveVerificationContexts(cwd, contexts) {
@@ -925,20 +1475,21 @@ function activeVerificationContext(cwd, flags = {}, session = null, accountId =
 
 function readActiveVerificationEnvelope(cwd, context = null) {
   if (context) {
-    const contexts = readActiveVerificationContexts(cwd);
-    const entry = contexts[verificationContextKey(context)];
-    if (entry && typeof entry === 'object') return entry.envelopeId || null;
-    if (typeof entry === 'string') return entry || null;
-    return null;
+    const entry = activeVerificationContextEntry(readActiveVerificationContexts(cwd), verificationContextKey(context));
+    return entry && entry.envelopeId ? String(entry.envelopeId) : null;
   }
-  const file = verificationPaths(cwd).activeFile;
-  try {
-    if (!fs.existsSync(file)) return null;
-    const id = fs.readFileSync(file, 'utf8').trim();
-    return id || null;
-  } catch (_) {
-    return null;
+  const paths = verificationPaths(cwd);
+  const candidates = [paths.activeFile, localStatePaths(cwd).legacy.activeVerificationFile];
+  for (const file of candidates) {
+    try {
+      if (!fs.existsSync(file)) continue;
+      const id = fs.readFileSync(file, 'utf8').trim();
+      return id || null;
+    } catch (_) {
+      return null;
+    }
   }
+  return null;
 }
 
 function writeActiveVerificationEnvelope(cwd, envelopeId, context = null) {
@@ -946,6 +1497,7 @@ function writeActiveVerificationEnvelope(cwd, envelopeId, context = null) {
   if (context) {
     const contexts = readActiveVerificationContexts(cwd);
     const key = verificationContextKey(context);
+    legacyVerificationContextKeys(key).forEach((legacyKey) => { delete contexts[legacyKey]; });
     if (!envelopeId) {
       delete contexts[key];
     } else {
@@ -968,10 +1520,15 @@ function writeActiveVerificationEnvelope(cwd, envelopeId, context = null) {
   return String(envelopeId);
 }
 
+function explicitVerificationEnvelopeId(flags = {}) {
+  const explicit = flags['verify-envelope'] || flags.verifyEnvelope || flags.envelope;
+  return explicit !== undefined && explicit !== null && explicit !== true ? (String(explicit).trim() || null) : null;
+}
+
 function verificationEnvelopeIdForCommand(cwd, flags = {}, context = null) {
   if (flagEnabled(flags['no-verify-envelope']) || flagEnabled(flags.noVerifyEnvelope)) return null;
-  const explicit = flags['verify-envelope'] || flags.verifyEnvelope || flags.envelope;
-  if (explicit !== undefined && explicit !== null && explicit !== true) return String(explicit).trim() || null;
+  const explicit = explicitVerificationEnvelopeId(flags);
+  if (explicit) return explicit;
   return context ? readActiveVerificationEnvelope(cwd, context) : readActiveVerificationEnvelope(cwd);
 }
 
@@ -980,7 +1537,10 @@ function writeLocalVerificationEnvelope(cwd, envelope) {
   const paths = verificationPaths(cwd, envelope.envelopeId);
   ensureDir(paths.base);
   ensureDir(paths.packetsDir);
-  atomicWriteFile(paths.envelopeFile, JSON.stringify(envelope, null, 2));
+  // Attach and status answer with a PACKETLESS header. Layer it over the mirror instead of replacing it, or the
+  // offline fallback loses the packets and evaluation the last full read stored.
+  const mirrored = Array.isArray(envelope.packets) ? envelope : Object.assign({}, readLocalVerificationEnvelope(cwd, envelope.envelopeId) || {}, envelope);
+  atomicWriteFile(paths.envelopeFile, JSON.stringify(mirrored, null, 2));
   if (envelope.acceptance) {
     atomicWriteFile(paths.manifestFile, JSON.stringify(envelope.acceptance, null, 2));
   }
@@ -990,29 +1550,36 @@ function writeLocalVerificationEnvelope(cwd, envelope) {
 
 function readLocalVerificationEnvelope(cwd, envelopeId) {
   const paths = verificationPaths(cwd, envelopeId);
-  if (!fs.existsSync(paths.envelopeFile)) return null;
-  try {
-    return JSON.parse(fs.readFileSync(paths.envelopeFile, 'utf8'));
-  } catch (_) {
-    return null;
+  const legacyBase = path.join(localStatePaths(cwd).legacy.verificationDir, String(envelopeId));
+  const candidates = [paths.envelopeFile, path.join(legacyBase, 'envelope.json')];
+  for (const file of candidates) {
+    if (!fs.existsSync(file)) continue;
+    try {
+      return JSON.parse(fs.readFileSync(file, 'utf8'));
+    } catch (_) {
+      return null;
+    }
   }
+  return null;
 }
 
 function readLocalVerificationPackets(cwd, envelopeId, filters = {}) {
   const paths = verificationPaths(cwd, envelopeId);
+  const legacyPacketsDir = path.join(localStatePaths(cwd).legacy.verificationDir, String(envelopeId), 'packets');
   const packets = [];
-  if (fs.existsSync(paths.packetsDir)) {
-    fs.readdirSync(paths.packetsDir)
+  [paths.packetsDir, legacyPacketsDir].forEach((packetsDir) => {
+    if (!fs.existsSync(packetsDir)) return;
+    fs.readdirSync(packetsDir)
       .filter((name) => name.endsWith('.json'))
       .forEach((name) => {
         try {
-          const parsed = JSON.parse(fs.readFileSync(path.join(paths.packetsDir, name), 'utf8'));
+          const parsed = JSON.parse(fs.readFileSync(path.join(packetsDir, name), 'utf8'));
           if (parsed && typeof parsed === 'object') packets.push(parsed);
         } catch (_) {
           // Ignore one malformed local packet; the rest of the envelope remains useful.
         }
       });
-  }
+  });
   if (!packets.length) {
     const envelope = readLocalVerificationEnvelope(cwd, envelopeId);
     if (envelope && Array.isArray(envelope.packets)) packets.push(...envelope.packets);
@@ -1144,6 +1711,135 @@ function syncEvidencePayload(sync) {
   return Object.assign({}, sync, { syncResults: trimmedResults });
 }
 
+// The flag that would put a command into the envelope's world, per mismatched field. Rendering only: WHETHER a
+// field mismatches is the platform's answer (`compatibility`), never recomputed here.
+function verificationWorldHints(diffs = []) {
+  return (Array.isArray(diffs) ? diffs : []).map((diff) => {
+    const expected = diff && diff.expected;
+    if (expected === undefined || expected === null || expected === '') return null;
+    switch (diff.field) {
+      case 'dataMode': return '--data-mode ' + expected;
+      case 'workspace': return '--workspace ' + expected;
+      case 'repoAccountId': return '--account-id ' + expected;
+      case 'accountId': return '--as-account ' + expected;
+      case 'componentBranch':
+      case 'variantBranch': return '--variant-branch ' + expected;
+      case 'gitBranch':
+      case 'branchName': return 'run from git branch ' + expected;
+      default: return null;
+    }
+  }).filter(Boolean);
+}
+
+function verificationDiffSummary(diffs = []) {
+  return (Array.isArray(diffs) ? diffs : []).map((diff) =>
+    diff.field + ': envelope requires ' + diff.expected + ', this command has ' + (diff.command == null ? 'none (shared lane)' : diff.command)).join('; ');
+}
+
+function verificationRefusalLines(result = {}, commandLabel = 'this command') {
+  const lines = [result.message || ('Evidence from ' + commandLabel + ' would not count for verification envelope ' + result.envelopeId + '.')];
+  const hints = verificationWorldHints(result.diffs);
+  lines.push('Nothing ran. Pick one and re-run ' + commandLabel + ':');
+  if (hints.length) lines.push("  - prove it in the envelope's world:  " + hints.join('  '));
+  lines.push('  - run it without recording evidence:  --no-verify-envelope');
+  lines.push('  - it is different work:  remits-cli verify start --summary "..."  (selects a new envelope for this checkout)');
+  lines.push('  - record it anyway as context (reported wrong-world):  --allow-wrong-world-evidence');
+  return lines;
+}
+
+function flagsWithoutVerificationEnvelope(flags = {}) {
+  return Object.assign({}, flags, { 'no-verify-envelope': true });
+}
+
+// Asks the platform - by the evaluator's own world rule - whether evidence from this command would count for the
+// selected envelope, BEFORE the command runs. The CLI used to answer this with its own copy of the rule, which had
+// drifted (shared lane vs a named workspace, the execution account, packet-type exemptions) and so blessed
+// evidence the report then rejected.
+//
+// `probe` is `{ packetType, world, test? }`, with world keys as a packet records them. Resolves to
+// `{ envelopeId, verdict, evidenceFlags }`: pass `evidenceFlags` to every appendVerificationPacket of the command.
+//   attach  - same world: evidence attaches to exactly this envelope (pinned by id, no second lookup).
+//   refuse  - a requirement could use this packet but the world differs: THROWS a refusal, nothing runs.
+//   detach  - differs, but nothing in the manifest could use it (or the envelope is closed): runs, attaches
+//             nothing, and says so once. Refusing there would cost the agent a turn and protect nothing.
+// Idempotent within one invocation: a caller that already asked passes the answer in `__verificationPreflight`.
+async function verificationPreflight(api, cwd, session, accountId, flags = {}, probe = {}, options = {}) {
+  if (flags.__verificationPreflight) return flags.__verificationPreflight;
+  const label = options.command || 'this command';
+  const context = activeVerificationContext(cwd, flags, session, accountId);
+  const envelopeId = verificationEnvelopeIdForCommand(cwd, flags, context);
+  if (!envelopeId) return { envelopeId: null, verdict: 'none', evidenceFlags: flags };
+  const pinned = Object.assign({}, flags, { 'verify-envelope': envelopeId });
+  let result;
+  try {
+    result = await postVerificationCommand(api, cwd, session, accountId, 'compatibility', { envelopeId, probe });
+  } catch (err) {
+    const status = err && err.response && err.response.status;
+    if (status === 404) {
+      if (explicitVerificationEnvelopeId(flags)) {
+        const refusal = new Error('Verification envelope ' + envelopeId + ' does not exist on ' + context.baseUrl +
+          '. Run `remits-cli verify list` to find the right id, or drop --verify-envelope.');
+        refusal.refused = true;
+        throw refusal;
+      }
+      console.error('Verification envelope ' + envelopeId + ' (selected for this checkout) no longer exists; evidence is not attached. ' +
+        'Run `remits-cli verify list`, then `verify use <id>` or `verify start`.');
+      return { envelopeId: null, verdict: 'detach', evidenceFlags: flagsWithoutVerificationEnvelope(flags) };
+    }
+    // A platform without `compatibility`, or one that is unreachable: attach as before. The report still judges
+    // the world; this only loses the early answer.
+    return { envelopeId, verdict: 'unchecked', evidenceFlags: pinned };
+  }
+  const verdict = result.verdict === 'refuse' && options.neverRefuse ? 'detach' : (result.verdict || 'attach');
+  const allowWrongWorld = flagEnabled(flags['allow-wrong-world-evidence']) || flagEnabled(flags.allowWrongWorldEvidence);
+  if (verdict === 'refuse' && !allowWrongWorld) {
+    const refusal = new Error(verificationRefusalLines(result, label).join('\n'));
+    refusal.refused = true;
+    refusal.compatibility = result;
+    throw refusal;
+  }
+  if (verdict === 'refuse') {
+    console.error('Attaching wrong-world evidence as context (--allow-wrong-world-evidence): ' + result.message);
+    return { envelopeId, verdict, compatibility: result, evidenceFlags: pinned };
+  }
+  if (verdict === 'detach') {
+    if (!options.quiet && result.message) {
+      const hints = verificationWorldHints(result.diffs);
+      console.error('Verification: ' + result.message + (hints.length ? ' (It would attach, as context only, with: ' + hints.join('  ') + ')' : ''));
+    }
+    return { envelopeId: null, verdict, compatibility: result, evidenceFlags: flagsWithoutVerificationEnvelope(flags) };
+  }
+  return { envelopeId, verdict, compatibility: result, evidenceFlags: pinned };
+}
+
+// "Would a plain `test run` from this checkout count for this envelope?" - printed where an agent selects or
+// inspects an envelope, so a mismatch is learned before the first run rather than from a refusal after it.
+async function printVerificationRunProbe(api, cwd, session, accountId, envelopeId, world = {}, options = {}) {
+  if (!envelopeId) return null;
+  let result;
+  try {
+    result = await postVerificationCommand(api, cwd, session, accountId, 'compatibility', {
+      envelopeId,
+      probe: { packetType: 'test_run', world }
+    });
+  } catch (_) {
+    return null;
+  }
+  if (options.onlyMismatch && result.verdict === 'attach') return result;
+  if (result.comparisonWorld) {
+    console.log('Proof world (' + (result.comparisonWorldSource || 'unknown') + '):', JSON.stringify(result.comparisonWorld));
+  }
+  if (result.verdict === 'attach') {
+    console.log('A `test run` from this checkout (dataMode=' + (world.dataMode || DEFAULT_DATA_MODE) + ') attaches to this envelope.');
+  } else if (result.verdict === 'refuse' || result.verdict === 'detach') {
+    const hints = verificationWorldHints(result.diffs);
+    console.log('A `test run` from this checkout (dataMode=' + (world.dataMode || DEFAULT_DATA_MODE) + ') would ' +
+      (result.verdict === 'refuse' ? 'be REFUSED' : 'NOT attach') + ' - ' + verificationDiffSummary(result.diffs) + '.');
+    if (hints.length) console.log('  to prove it for this envelope, pass: ' + hints.join('  '));
+  }
+  return result;
+}
+
 async function appendVerificationPacket(api, cwd, session, accountId, flags, packet, options = {}) {
   const context = activeVerificationContext(cwd, flags, session, accountId);
   const envelopeId = verificationEnvelopeIdForCommand(cwd, flags, context);
@@ -1159,11 +1855,22 @@ async function appendVerificationPacket(api, cwd, session, accountId, flags, pac
   try {
     const response = await postVerificationCommand(api, cwd, session, accountId, 'packet', {
       envelopeId,
-      packet: finalPacket
+      packet: finalPacket,
+      // Packetless answer: this runs on every command while an envelope is active.
+      compact: true
     });
     if (response.packet) writeLocalVerificationPacket(cwd, envelopeId, response.packet);
     if (response.envelope) writeLocalVerificationEnvelope(cwd, response.envelope);
-    if (!options.quiet) console.log('Verification envelope:', envelopeId, '(packet ' + finalPacket.type + ' attached)');
+    if (!options.quiet) {
+      console.log('Verification envelope:', envelopeId, '(packet ' + finalPacket.type + ' attached)');
+      // The platform's own verdict on the stored packet, so this line and `verify report` cannot disagree.
+      const diffs = Array.isArray(response.worldDiffs) ? response.worldDiffs : [];
+      if (diffs.length) {
+        console.log('  WARNING: this packet is from a different world than the envelope requires - ' +
+          diffs.map((diff) => diff.field + ' expected ' + diff.expected + ' got ' + (diff.packet == null ? 'none' : diff.packet)).join('; ') +
+          '. It is attached, but it cannot satisfy a requirement.');
+      }
+    }
     return response;
   } catch (err) {
     if (!options.quiet) {
@@ -2114,11 +2821,75 @@ function resolveSessionContext(cwd, flags) {
  * file there is no id, so the two can disagree (`new_PDFStatement` vs `name: PDF Statement`), and the file
  * identity is the only thing both the payload and the git changed set agree on.
  */
-function withFileKey(target, key) {
+function withFileKey(target, key, filePaths) {
   Object.defineProperty(target, 'fileKey', { value: key, enumerable: false, configurable: true });
+  if (filePaths) {
+    addHiddenFilePaths(target, filePaths);
+  }
+  return target;
+}
+
+function addHiddenFilePaths(target, filePaths) {
+  if (!target || !filePaths) return target;
+  const paths = Array.isArray(filePaths) ? filePaths : [filePaths];
+  if (!Object.prototype.hasOwnProperty.call(target, 'filePaths')) {
+    Object.defineProperty(target, 'filePaths', { value: [], enumerable: false, configurable: true });
+  }
+  for (const filePath of paths) {
+    const normalized = String(filePath || '').replace(/\\/g, '/');
+    if (normalized && !target.filePaths.includes(normalized)) target.filePaths.push(normalized);
+  }
   return target;
 }
 
+function isRootReadmeComponent(component) {
+  return component &&
+    component.type === 'prompt' &&
+    component.fileKey === 'prompt:name:readme' &&
+    normalizeName(String(component.name || '')).toLowerCase() === 'readme' &&
+    String(component.purpose || '').toUpperCase() === 'README' &&
+    (component.path === 'README.md' || (component.filePaths || []).includes('README.md'));
+}
+
+function isLegacyReadmePromptComponent(component) {
+  if (!component || component.type !== 'prompt' ||
+    normalizeName(String(component.name || '')).toLowerCase() !== 'readme') {
+    return false;
+  }
+  return [component.path].concat(component.filePaths || []).some((filePath) =>
+    /^components\/prompts\/[^/]+_README\.md$/i.test(String(filePath || '')));
+}
+
+function canonicalizeReadmePromptComponents(components) {
+  const list = Array.isArray(components) ? components : [];
+  const rootReadme = list.find(isRootReadmeComponent);
+  if (!rootReadme) {
+    return { components: list, warnings: [] };
+  }
+
+  const warnings = [];
+  const canonical = [];
+  for (const component of list) {
+    if (component !== rootReadme && isLegacyReadmePromptComponent(component)) {
+      const legacyPaths = [component.path].concat(component.filePaths || [])
+        .filter((filePath) => /^components\/prompts\/[^/]+_README\.md$/i.test(String(filePath || '')))
+        .sort();
+      warnings.push({
+        type: 'legacy-readme-prompt-suppressed',
+        canonicalPath: 'README.md',
+        legacyPaths,
+        id: component.id == null ? null : component.id,
+        name: component.name || 'README',
+        message: 'Skipped legacy README prompt file ' + (legacyPaths.join(', ') || 'components/prompts/*_README.md') +
+          ' because root README.md owns the reserved README prompt identity.'
+      });
+      continue;
+    }
+    canonical.push(component);
+  }
+  return { components: canonical, warnings };
+}
+
 function collectComponents(cwd) {
   const mapping = {
     schemas: 'schema',
@@ -2170,6 +2941,7 @@ function collectComponents(cwd) {
       }
       const component = byKey.get(key);
       const filePath = path.join(dir, fileName);
+      addHiddenFilePaths(component, path.relative(cwd, filePath).replace(/\\/g, '/'));
       const content = fs.readFileSync(filePath, 'utf8');
 
       if (ext === 'meta') {
@@ -2233,7 +3005,7 @@ function collectComponents(cwd) {
       category: 'default',
       prompt: fs.readFileSync(rootReadme, 'utf8'),
       metadataAuthoritative: true
-    }, 'prompt:name:readme');
+    }, 'prompt:name:readme', 'README.md');
     const fingerprint = {};
     Object.keys(component).sort().forEach((key) => {
       if (key !== 'hash') {
@@ -2244,7 +3016,13 @@ function collectComponents(cwd) {
     components.push(component);
   }
 
-  return components;
+  const canonicalized = canonicalizeReadmePromptComponents(components);
+  Object.defineProperty(canonicalized.components, 'discoveryWarnings', {
+    value: canonicalized.warnings,
+    enumerable: false,
+    configurable: true
+  });
+  return canonicalized.components;
 }
 
 function componentPathInfo(cwd, filePath) {
@@ -2534,6 +3312,11 @@ async function loggedPost(api, cwd, endpoint, payload, options = {}) {
   let responseData = null;
   let error = null;
   let responseFile = null;
+  const actor = resolveLocalActor();
+  const unsafePayloadLog = unsafePayloadLoggingEnabled();
+  if (unsafePayloadLog && !options.skipSessionLog) {
+    console.error('WARNING: REMITS_CLI_UNSAFE_LOG_PAYLOADS=1 is enabled; session logs may contain request payload values.');
+  }
 
   try {
     responseData = await api.post(endpoint, payload).then((r) => r.data);
@@ -2551,15 +3334,19 @@ async function loggedPost(api, cwd, endpoint, payload, options = {}) {
       const status = error ? 'error' : 'success';
       const responseForLog = responseFile
         ? { responseFile, note: 'Tool response stored externally' }
-        : sanitizeForLog(responseData);
+        : summarizeResponseForLog(responseData);
       appendSessionLog(cwd, {
         ts: new Date().toISOString(),
         requestId,
         endpoint,
         method: 'POST',
+        actor: actor.id,
+        actorSource: actor.source,
         status,
         durationMs: Date.now() - started,
-        request: sanitizeForLog(payload),
+        requestSummary: summarizeRequestForLog(payload),
+        unsafePayloadLogging: unsafePayloadLog,
+        request: requestPayloadForSessionLog(payload),
         response: responseForLog,
         error: error ? describeError(error) : null
       });
@@ -2572,6 +3359,7 @@ async function loggedGet(api, cwd, endpoint, params = {}) {
   const started = Date.now();
   let responseData = null;
   let error = null;
+  const actor = resolveLocalActor();
   try {
     responseData = await api.get(endpoint, { params }).then((r) => r.data);
     return { data: responseData, requestId };
@@ -2585,10 +3373,13 @@ async function loggedGet(api, cwd, endpoint, params = {}) {
       requestId,
       endpoint,
       method: 'GET',
+      actor: actor.id,
+      actorSource: actor.source,
       status: error ? 'error' : 'success',
       durationMs: Date.now() - started,
-      request: sanitizeForLog(params),
-      response: sanitizeForLog(responseData),
+      requestSummary: summarizeRequestForLog(params),
+      request: requestPayloadForSessionLog(params),
+      response: summarizeResponseForLog(responseData),
       error: error ? describeError(error) : null
     });
   }
@@ -3128,6 +3919,7 @@ async function pushComponentsCommand(flags) {
   const emptyWorksetPolicy = normalizeEmptyWorksetPolicy(flags);
 
   let components = collectComponents(cwd);
+  const componentDiscoveryWarnings = Array.isArray(components.discoveryWarnings) ? components.discoveryWarnings : [];
   // Named the way the payload is named, BEFORE anything compares the two — see alignChangedSetWithComponents.
   const changedFromWorkingTree = alignChangedSetWithComponents(changedFromGit, components);
   // Changes git reported that a component payload cannot carry — a deleted component file has nothing to
@@ -3187,7 +3979,9 @@ async function pushComponentsCommand(flags) {
           : null,
         changedFromWorkingTree: [],
         changedFromWorkingTreeAvailable: true,
-        unrepresentableChanges: unstageable
+        unrepresentableChanges: unstageable,
+        componentDiscoveryWarnings,
+        localState: localStateSummary(cwd, flags)
       };
       if (flagEnabled(flags.json)) {
         console.log(JSON.stringify(emptyResponse, null, 2));
@@ -3199,6 +3993,9 @@ async function pushComponentsCommand(flags) {
           console.log('  or re-run with `--empty-workset clear` if an empty lane is what you meant.');
         }
         printStagingLane(branchName, workspace, workspaceSource(cwd, flags));
+        printLocalCommandContext(cwd, flags, { accountId, branchName, workspace, dataMode });
+        printLocalStateWarnings(cwd, flags);
+        printComponentDiscoveryWarnings(componentDiscoveryWarnings);
         printUnrepresentableChanges(unstageable);
       }
       return emptyResponse;
@@ -3216,6 +4013,10 @@ async function pushComponentsCommand(flags) {
   // or, worse, conclude staging was broken and go on reading trunk. Scaled by payload size, floored at
   // the old default, and overridable.
   const api = buildAxios(baseUrl, session.token, stageTimeoutMs(components, flags));
+  const verification = await verificationPreflight(api, cwd, session, accountId, flags, {
+    packetType: 'stage',
+    world: { accountId, dataMode, branchName, workspace }
+  }, { command: 'components stage' });
   const stagePayload = {
     token: session.token,
     accountId,
@@ -3259,7 +4060,7 @@ async function pushComponentsCommand(flags) {
     // the platform rejected it. The packet is best-effort: a failing stage must surface the STAGE error,
     // never an error from writing the record of it.
     try {
-      await appendVerificationPacket(api, cwd, session, accountId, flags, {
+      await appendVerificationPacket(api, cwd, session, accountId, verification.evidenceFlags, {
         type: 'stage',
         success: false,
         claim: 'Components refused at staging',
@@ -3287,6 +4088,8 @@ async function pushComponentsCommand(flags) {
   response.changedFromWorkingTreeAvailable = changedFromWorkingTree !== null;
   response.requestedStageMode = stageMode;
   response.unrepresentableChanges = unstageable;
+  response.componentDiscoveryWarnings = componentDiscoveryWarnings;
+  response.localState = localStateSummary(cwd, flags);
   if (response.success === false) {
     // A 200 that says `success:false`. The 422 path throws out of stageOrRefuse above and never lands
     // here, so this stays as the belt-and-braces case — print whatever detail came with it first.
@@ -3294,7 +4097,7 @@ async function pushComponentsCommand(flags) {
     throw new Error(response.message || 'Server stage failed');
   }
 
-  await appendVerificationPacket(api, cwd, session, accountId, flags, {
+  await appendVerificationPacket(api, cwd, session, accountId, verification.evidenceFlags, {
     type: 'stage',
     success: response.success !== false,
     claim: 'Components staged for verification',
@@ -3320,6 +4123,9 @@ async function pushComponentsCommand(flags) {
 
   printSessionResolutionWarning(sessionContext);
   printResolvedBaseUrl(baseUrl);
+  printLocalCommandContext(cwd, flags, { accountId, branchName, workspace, dataMode: response.dataMode || dataMode });
+  printLocalStateWarnings(cwd, flags);
+  printComponentDiscoveryWarnings(componentDiscoveryWarnings);
   printStagingLane(response.branchName || branchName, response.workspace || workspace, workspaceSource(cwd, flags));
   console.log('Data mode:', response.dataMode || dataMode);
   printComponentPolicy(response);
@@ -3522,6 +4328,15 @@ function printComponentPolicy(response) {
   (policy.overrides || []).forEach((id) => console.log('Policy override recorded for rule: ' + id));
 }
 
+function printComponentDiscoveryWarnings(warnings) {
+  const list = Array.isArray(warnings) ? warnings : [];
+  if (!list.length) return;
+  console.log('Component discovery warnings:');
+  list.forEach((warning) => {
+    console.log('  - ' + (warning.message || JSON.stringify(warning)));
+  });
+}
+
 /**
  * What the platform compiled, and what it could not.
  *
@@ -4020,6 +4835,8 @@ function printBranchContext(response) {
       ('this account resolves the branch through an ancestor owned by account ' + ctx.resolvingOwnerAccountId + '.')));
   }
 
+  variantBranchIdentityLines(response).forEach((line) => console.log(line));
+
   if (!ctx.onTrunk) {
     console.log('  variants stored on this branch: ' + (ctx.variantCount || 0));
     const subs = ctx.subscribers || [];
@@ -4033,6 +4850,29 @@ function printBranchContext(response) {
   console.log('');
 }
 
+// A variant branch whose checkout identifies as its OWNER (account-info.json names the owner) runs every command as
+// the owner, and the owner subscribes to nothing — so a feature branch cut from this checkout resolves TRUNK, and no
+// run exercises what the subscriber actually gets. With exactly one subscriber that identity is repairable, and the
+// agent should hear it here rather than infer it from a page that rendered trunk. Pure.
+function variantBranchIdentityLines(response) {
+  const ctx = response && response.branchContext;
+  if (!ctx || ctx.onTrunk || ctx.variantBranchSource === 'subscription-fallback') return [];
+  const subs = Array.isArray(ctx.subscribers) ? ctx.subscribers : [];
+  const checkoutAccountId = response.accountId;
+  if (subs.length !== 1 || checkoutAccountId == null || String(subs[0].accountId) === String(checkoutAccountId)) return [];
+  if (ctx.commitOwnerAccountId != null && String(ctx.commitOwnerAccountId) !== String(checkoutAccountId)) return [];
+  const sub = subs[0];
+  const label = sub.accountId + (sub.accountName ? ' (' + sub.accountName + ')' : '');
+  return [
+    '',
+    '  CHECKOUT IDENTITY: this branch has one subscriber, account ' + label + ', but this checkout runs as the owner,',
+    '  account ' + checkoutAccountId + ' (account-info.json names it). Feature branches cut from here run as ' + checkoutAccountId +
+      ' too, which subscribes to nothing, so they resolve trunk.',
+    '    run as the subscriber:  --as-account ' + sub.accountId,
+    '    repair the identity:    remits-cli components sync --account-id ' + sub.accountId + '   then   git pull --ff-only'
+  ];
+}
+
 function printClearSummary(response, flags) {
   console.log('Cleared keys:', response.clearedCount || 0);
   console.log('Remaining staged count:', response.remainingCount || 0);
@@ -4091,13 +4931,83 @@ async function workspaceCommand(flags) {
   const branchName = flags.branch || currentBranch(cwd);
   const workspace = resolveWorkspace(cwd, flags);
   printStagingLane(branchName, workspace, workspaceSource(cwd, flags));
+  printLocalActor(cwd, flags);
+  printLocalStateWarnings(cwd, flags);
+  console.log('');
+  console.log('Precedence: --workspace  >  REMITS_WORKSPACE  >  .remits-cli/workspace  >  shared default lane');
+  console.log('');
+  console.log('  remits-cli workspace use <name>     set this checkout\'s lane');
+  console.log('  remits-cli workspace use --auto     name it after this directory (' + normalizeWorkspace(path.basename(cwd)) + ')');
+  console.log('  remits-cli workspace clear          go back to the shared default lane');
+  console.log('  remits-cli components status        see every lane staged on this branch');
+}
+
+function printFileRows(label, rows, max = 5) {
+  console.log(label + ':', rows.length);
+  rows.slice(0, max).forEach((row) => {
+    console.log('  - ' + row.path + ' (' + row.size + ' bytes' + (row.updatedAt ? ', updated ' + row.updatedAt : '') + ')');
+  });
+  if (rows.length > max) {
+    console.log('  ...' + (rows.length - max) + ' more');
+  }
+}
+
+async function doctorCommand(flags, subcommand) {
+  const sub = String(subcommand || (flags._ && flags._[1]) || 'local-state').toLowerCase();
+  if (sub !== 'local-state' && sub !== 'state') {
+    throw new Error('Unknown doctor subcommand "' + sub + '". Expected local-state.');
+  }
+  const cwd = process.cwd();
+  if (flagEnabled(flags['prune-actors'])) {
+    const pruned = pruneStaleActorDirectories(cwd);
+    console.log('Pruned ' + pruned.removed.length + ' idle actor dir(s)' +
+      (pruned.kept ? ', kept ' + pruned.kept + ' (current or active in the last 7 days)' : '') + '.');
+    pruned.removed.slice(0, 20).forEach((name) => console.log('  - ' + name));
+    if (pruned.removed.length > 20) console.log('  ...' + (pruned.removed.length - 20) + ' more');
+    if (pruned.failed.length) console.log('  Could not remove: ' + pruned.failed.join(', '));
+  }
+  const { report, warnings } = localStateWarnings(cwd, flags);
+  if (flagEnabled(flags.json)) {
+    console.log(JSON.stringify(report, null, 2));
+    return report;
+  }
+  console.log('Local state doctor');
+  console.log('Working directory:', cwd);
+  console.log('Local actor:', report.actor.id + '   (from ' + report.actor.source + ')');
+  console.log('Active actor state:', report.activeActorStateDir);
+  console.log('Workspace:', report.workspace || 'shared default lane', '  [' + report.workspaceSource + ']');
+  console.log('Workspace file:', report.workspaceFile);
+  if (warnings.length) {
+    console.log('');
+    console.log('Warnings:');
+    warnings.forEach((warning) => console.log('  - ' + warning));
+  }
+  console.log('');
+  console.log('Actor directories:', report.actors.length);
+  const listedActors = report.actors
+    .slice()
+    .sort((a, b) => (a.current ? -1 : b.current ? 1 : Date.parse(b.updatedAt || 0) - Date.parse(a.updatedAt || 0)));
+  listedActors.slice(0, 15).forEach((actor) => {
+    console.log('  ' + (actor.current ? '* ' : '  ') + actor.actor + '  ' + actor.path + (actor.updatedAt ? '  updated ' + actor.updatedAt : ''));
+  });
+  if (listedActors.length > 15) console.log('  ...' + (listedActors.length - 15) + ' more (newest first; --prune-actors clears the idle ones)');
+  console.log('  (* = active actor)');
   console.log('');
-  console.log('Precedence: --workspace  >  REMITS_WORKSPACE  >  .remits-cli/workspace  >  shared default lane');
+  console.log('.remits-cli tracked by git:', report.trackedFiles.length ? 'YES' : 'no');
+  report.trackedFiles.slice(0, 20).forEach((file) => console.log('  - ' + file));
+  if (report.trackedFiles.length > 20) console.log('  ...' + (report.trackedFiles.length - 20) + ' more');
   console.log('');
-  console.log('  remits-cli workspace use <name>     set this checkout\'s lane');
-  console.log('  remits-cli workspace use --auto     name it after this directory (' + normalizeWorkspace(path.basename(cwd)) + ')');
-  console.log('  remits-cli workspace clear          go back to the shared default lane');
-  console.log('  remits-cli components status        see every lane staged on this branch');
+  printFileRows('Current actor session logs', report.current.sessionLogs);
+  printFileRows('Current actor tool responses', report.current.toolResponses);
+  printFileRows('Legacy session logs', report.legacy.sessionLogs);
+  printFileRows('Legacy tool responses', report.legacy.toolResponses);
+  printFileRows('Largest local-state files', report.largestFiles, 10);
+  const suspicious = report.current.likelyRawPayloadLogs.concat(report.legacy.likelyRawPayloadLogs);
+  if (suspicious.length) {
+    console.log('');
+    printFileRows('Logs with raw/unsafe payload-shaped fields', suspicious, 10);
+  }
+  return report;
 }
 
 async function statusComponentsCommand(flags) {
@@ -4140,6 +5050,7 @@ async function statusComponentsCommand(flags) {
     isAncestor: (a, b) => gitIsAncestor(cwd, a, b)
   });
   response.repositoryCheck = repositoryCheck(cwd, response.branchContext);
+  response.localState = localStateSummary(cwd, flags);
 
   await appendVerificationPacket(api, cwd, session, accountId, flags, {
     type: 'component_status',
@@ -4159,6 +5070,8 @@ async function statusComponentsCommand(flags) {
 
   printSessionResolutionWarning(sessionContext);
   printResolvedBaseUrl(baseUrl);
+  printLocalCommandContext(cwd, flags, { accountId, branchName, workspace, dataMode: response.dataMode || dataMode });
+  printLocalStateWarnings(cwd, flags);
   console.log('Data mode:', response.dataMode || dataMode);
   console.log('Mode:', response.mode || 'status');
   printStatusSummary(response, flags);
@@ -4376,6 +5289,11 @@ async function syncComponentsCommand(rawFlags) {
   const preflightRequested = syncPreflightRequested(flags);
   const namesOnly = flagEnabled(flags['names-only']) || flagEnabled(flags.namesOnly);
 
+  const verification = await verificationPreflight(api, cwd, session, accountId, flags, {
+    packetType: dryRun || namesOnly ? 'sync_dry_run' : 'sync_mutation',
+    world: { accountId, dataMode, branchName, workspace }
+  }, { command: 'components sync' });
+
   printProdDataBanner({
     dataMode,
     accountId,
@@ -4587,7 +5505,7 @@ async function syncComponentsCommand(rawFlags) {
   summary.gates = gate.checks;
   summary.gateViolations = gate.violations;
 
-  await appendVerificationPacket(api, cwd, session, accountId, flags, {
+  await appendVerificationPacket(api, cwd, session, accountId, verification.evidenceFlags, {
     type: response.sync && response.sync.dryRun ? 'sync_dry_run' : 'sync_mutation',
     success: response.success !== false,
     claim: response.sync && response.sync.dryRun ? 'Component sync dry-run observed' : 'Component sync completed',
@@ -5812,10 +6730,21 @@ function short(sha) {
   return sha ? String(sha).slice(0, 8) : 'unknown';
 }
 
+// A component signature is structured, not a bare hash: 'version:12:ab34cd', 'content:<sha>', 'cli:<hash>'.
+// Truncating the whole thing to 8 characters rendered the commonest case as the literal string 'version:' —
+// the prefix exactly fills the budget and the part that identifies the code is what got cut.
+function shortSignature(signature) {
+  if (!signature) return 'unknown';
+  const parts = String(signature).split(':');
+  if (parts.length < 2) return short(signature);
+  const last = parts.pop();
+  return parts.concat(short(last)).join(':');
+}
+
 async function commitComponentsCommand(flags) {
   const cwd = process.cwd();
   ensureLocalState(cwd);
-  const { accountId } = resolveSessionContext(cwd, flags);
+  const { session, accountId } = resolveSessionContext(cwd, flags);
   const branchName = flags.branch || currentBranch(cwd);
   const commitMessage = String(flags.message || ('remits-cli commit sync ' + new Date().toISOString()));
   const allowEmpty = flags['allow-empty'] === true || flags['allow-empty'] === 'true';
@@ -5828,6 +6757,15 @@ async function commitComponentsCommand(flags) {
   if (await refuseUnsafeTrunkCommitBeforeGit(flags, accountId, branchName, skipGit)) {
     return;
   }
+  // The sync's verification answer, asked BEFORE `git push`. Asked inside the sync it could refuse only after the
+  // push, leaving a pushed-but-unsynced branch - the one state this command exists to avoid. The sync below
+  // reuses this answer instead of asking again.
+  const commitVerification = await verificationPreflight(
+    buildAxios(flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL, session.token),
+    cwd, session, accountId, Object.assign({}, flags, { branch: branchName }), {
+      packetType: 'sync_mutation',
+      world: { accountId, dataMode: resolveDataMode(flags, session), branchName, workspace: resolveWorkspace(cwd, flags) }
+    }, { command: 'components commit' });
 
   // Landing is serial and nothing can make it concurrent: `git add -A` sweeps a shared checkout, and the
   // platform pushes a regenerated `account-info.json` back to the branch during sync, so two commits
@@ -5923,7 +6861,8 @@ async function commitComponentsCommand(flags) {
   const syncResponse = await withStdoutRoutedToStderr(jsonOutput, () => syncComponentsCommand({
     ...flags,
     branch: branchName,
-    'account-id': accountId
+    'account-id': accountId,
+    __verificationPreflight: commitVerification
   }));
   outcome.sync = syncResponse && flagEnabled(flags.summary) ? buildSyncSummary(syncResponse) : (syncResponse || null);
   // Stop here when the sync did not succeed. In --json mode a refused sync gate RETURNS (with a non-zero
@@ -6363,7 +7302,12 @@ function printTestRunPivots(status = {}) {
   }
   tests.filter((test) => test && test.passed === false).forEach((test) => {
     console.log('Pivots for failed case:', test.name || '(unnamed)');
+    if (test.outcome) console.log('  Outcome:', test.outcome + (test.outcomeReason && test.outcomeReason !== test.error ? ' - ' + String(test.outcomeReason).slice(0, 300) : ''));
     if (test.duration != null) console.log('  Duration:', formatDurationMs(test.duration));
+    if (test.ai && (test.ai.calls || test.ai.liveCalls)) {
+      console.log('  AI:', (test.ai.liveCalls || 0) + ' live ' + formatUsd(test.ai.cost) + ', ' + (test.ai.mockedCalls || 0) + ' mocked' +
+        ((test.ai.errors || []).length ? ', errors: ' + test.ai.errors.map((e) => (e.classification || 'error') + ' ' + (e.model || '')).join('; ') : ''));
+    }
     if (test.threadGroupingId || test.threadGroupId || test.traceId) {
       console.log('  Trace:', test.traceId || test.threadGroupingId || test.threadGroupId);
     }
@@ -6379,7 +7323,8 @@ function printTestRunPivots(status = {}) {
         (entry.signature ? ' ' + short(entry.signature) : '')).join(', '));
     }
     if (Array.isArray(test.liveHttpCalls) && test.liveHttpCalls.length) {
-      console.log('  Live HTTP calls:', test.liveHttpCalls.length);
+      const intentional = test.liveHttpCalls.filter((call) => call && call.intentional === true).length;
+      console.log('  Live HTTP calls:', test.liveHttpCalls.length + (intentional ? ' (' + intentional + ' intentional, inside withAiBudget)' : ''));
     }
   });
 }
@@ -6391,6 +7336,276 @@ function formatDurationMs(value) {
   return (ms / 1000).toFixed(ms < 10000 ? 1 : 0) + 's';
 }
 
+// A local corpus manifest -> case entries, reading expected/source JSON files and artifact paths RELATIVE to the
+// manifest. Artifacts are described (path, size) and only base64-encoded at send time, per batch.
+function corpusManifestEntries(manifest, manifestDir) {
+  const root = manifest && typeof manifest === 'object' ? manifest : {};
+  const cases = Array.isArray(root.cases) ? root.cases : [];
+  const readJson = (file) => JSON.parse(fs.readFileSync(path.resolve(manifestDir, file), 'utf8'));
+  return cases.map((raw, index) => {
+    const entry = raw && typeof raw === 'object' ? raw : {};
+    if (!entry.caseKey) throw new Error('cases[' + index + '] has no caseKey');
+    const out = { caseKey: String(entry.caseKey) };
+    ['split', 'tags', 'expected', 'expectedStatus', 'source', 'notes', 'retired'].forEach((key) => {
+      if (entry[key] !== undefined) out[key] = entry[key];
+    });
+    if (typeof entry.expectedFile === 'string') out.expected = readJson(entry.expectedFile);
+    if (typeof entry.sourceFile === 'string') out.source = readJson(entry.sourceFile);
+    out.artifacts = (Array.isArray(entry.artifacts) ? entry.artifacts : []).map((artifact, artifactIndex) => {
+      const spec = typeof artifact === 'string' ? { path: artifact } : (artifact || {});
+      if (!spec.path) throw new Error('cases[' + index + '].artifacts[' + artifactIndex + '] has no path');
+      const resolved = path.resolve(manifestDir, spec.path);
+      if (!fs.existsSync(resolved)) throw new Error('cases[' + index + '] artifact not found: ' + resolved);
+      return {
+        name: spec.name || (artifactIndex === 0 ? 'source' : path.basename(resolved).replace(/[^A-Za-z0-9._-]+/g, '_')),
+        path: resolved,
+        fileName: spec.fileName || path.basename(resolved),
+        contentType: spec.contentType || undefined,
+        bytes: fs.statSync(resolved).size
+      };
+    });
+    return out;
+  });
+}
+
+// Split corpus case entries into requests under the server's per-request limits (artifact bytes and count).
+function batchCorpusEntries(entries, maxBytes = 40 * 1024 * 1024, maxCount = 100) {
+  const batches = [];
+  let current = [];
+  let currentBytes = 0;
+  (entries || []).forEach((entry) => {
+    const bytes = (entry.artifacts || []).reduce((sum, a) => sum + Number(a.bytes || 0), 0);
+    if (current.length && (current.length >= maxCount || currentBytes + bytes > maxBytes)) {
+      batches.push(current);
+      current = [];
+      currentBytes = 0;
+    }
+    current.push(entry);
+    currentBytes += bytes;
+  });
+  if (current.length) batches.push(current);
+  return batches;
+}
+
+// The corpus_import verification packet: case keys, statuses, changed KEYS, artifact ids/hashes/sizes. Never an
+// expected answer, a provenance value or a byte of artifact content.
+function corpusImportPacketBody(responses) {
+  const cases = [];
+  let world = null;
+  let corpus = null;
+  let ownerAccountId = null;
+  (responses || []).forEach((response) => {
+    if (!response) return;
+    if (response.world && !world) world = response.world;
+    corpus = corpus || response.corpus;
+    ownerAccountId = ownerAccountId || response.ownerAccountId;
+    (Array.isArray(response.cases) ? response.cases : []).forEach((c) => {
+      cases.push({
+        caseKey: c.caseKey,
+        status: c.status,
+        changedKeys: c.changedKeys,
+        artifacts: (c.artifacts || []).map((a) => ({ name: a.name, objectId: a.objectId, sha256: a.sha256, bytes: a.bytes, created: a.created })),
+        message: c.status === 'failed' ? c.message : undefined
+      });
+    });
+  });
+  const counts = cases.reduce((acc, c) => { acc[c.status] = (acc[c.status] || 0) + 1; return acc; }, {});
+  return { world, corpus, ownerAccountId, counts, cases, success: cases.length > 0 && !cases.some((c) => c.status === 'failed') };
+}
+
+function parseCorpusFilterValues(flags, names) {
+  const values = [];
+  (names || []).forEach((name) => {
+    const raw = flags[name];
+    if (raw === undefined || raw === null || raw === true) return;
+    (Array.isArray(raw) ? raw : [raw]).forEach((value) => {
+      String(value).split(',').forEach((part) => {
+        const trimmed = part.trim();
+        if (trimmed) values.push(trimmed);
+      });
+    });
+  });
+  return Array.from(new Set(values));
+}
+
+function testRunDependencies(status = {}) {
+  const tests = status.result && Array.isArray(status.result.tests) ? status.result.tests : [];
+  const liveHttpCalls = [];
+  tests.forEach((test) => (Array.isArray(test.liveHttpCalls) ? test.liveHttpCalls : []).forEach((call) => {
+    liveHttpCalls.push(Object.assign({ caseName: test.name }, call));
+  }));
+  const ai = status.result && status.result.summary && status.result.summary.ai;
+  return {
+    liveHttpCalls: liveHttpCalls.slice(0, 50),
+    unintendedLiveHttpCalls: liveHttpCalls.filter((call) => call.intentional !== true).length,
+    liveAi: ai ? {
+      liveCalls: ai.liveCalls || 0,
+      mockedCalls: ai.mockedCalls || 0,
+      cost: ai.cost,
+      intentional: (ai.intentionalLiveCalls || 0) > 0 && (ai.intentionalLiveCalls || 0) >= (ai.liveCalls || 0),
+      intentionalLiveCalls: ai.intentionalLiveCalls || 0,
+      budgets: ai.budgets || []
+    } : null
+  };
+}
+
+function formatUsd(value) {
+  const n = Number(value);
+  if (!Number.isFinite(n)) return 'unknown';
+  // Real spend must never render as $0.00. Per-call costs of a few microdollars are normal for small models,
+  // and a live run printing "$0.0000" reads as "this cost nothing", which is how a live run gets mistaken for
+  // a replay — the exact confusion the AI-mode labelling exists to prevent.
+  if (n !== 0 && Math.abs(n) < 0.0001) return (n < 0 ? '-' : '') + '<$0.0001';
+  return '$' + n.toFixed(n !== 0 && Math.abs(n) < 0.01 ? 4 : 2);
+}
+
+// The world a run executes in, as the lines printed BEFORE the result: host, who it runs as, the data lane,
+// the component world, the staging lane with its content hash, and the platform sync against the local HEAD.
+// One block, stated once, so an agent never has to assemble "which world was that?" from five other outputs —
+// the localhost-vs-prod mismatch that sent account 21 in circles was two of these lines disagreeing.
+function runWorldLines(world, context = {}) {
+  if (!world || typeof world !== 'object') return [];
+  const lines = ['World:'];
+  if (context.host) lines.push('  host:            ' + context.host);
+  const accounts = ['account ' + (world.executionAccountId || context.accountId || 'unknown')];
+  if (world.checkoutAccountId && world.checkoutAccountId !== world.executionAccountId) accounts.push('checkout ' + world.checkoutAccountId);
+  if (world.componentOwnerAccountId && world.componentOwnerAccountId !== world.executionAccountId) accounts.push('component owner ' + world.componentOwnerAccountId);
+  lines.push('  runs as:         ' + accounts.join(', '));
+  lines.push('  data lane:       ' + (world.dataMode || context.dataMode || 'unknown'));
+  const contextVariantWorld = context.variantWorld && typeof context.variantWorld === 'object' ? context.variantWorld : {};
+  const subscribedComponentBranch = world.subscribedComponentBranch || contextVariantWorld.subscribedComponentBranch;
+  const componentBranch = world.componentBranch || subscribedComponentBranch || contextVariantWorld.componentBranch || world.variantBranch;
+  const branchSource = componentBranch && subscribedComponentBranch && String(componentBranch) === String(subscribedComponentBranch)
+    ? 'subscription'
+    : (world.componentBranchSource || contextVariantWorld.componentBranchSource || world.variantBranchSource || contextVariantWorld.variantBranchSource);
+  const branchLabel = componentBranch
+    ? "componentBranch=" + componentBranch + (branchSource ? ' via ' + branchSource : '')
+    : (branchSource || '');
+  const branchSuffix = branchLabel ? '  [' + branchLabel + ']' : '';
+  lines.push('  component world: ' + (world.resolves || (componentBranch ? "trunk + the '" + componentBranch + "' variant overlays" : 'trunk')) + branchSuffix);
+  const laneParts = [world.stagingLane || (world.branchName ? world.branchName + (world.workspace ? ' [ws:' + world.workspace + ']' : '') : 'none')];
+  if (world.sharedLane) laneParts.push('(shared lane)');
+  if (world.laneContentHash) laneParts.push('content ' + String(world.laneContentHash).slice(0, 12));
+  if (world.stagedCount !== undefined && world.stagedCount !== null) laneParts.push(world.stagedCount + ' staged');
+  lines.push('  staging lane:    ' + laneParts.join('  '));
+  if (world.laneId) lines.push('  lane id:         ' + world.laneId);
+  const localHead = context.gitHead ? String(context.gitHead).slice(0, 8) : null;
+  const synced = world.platformSyncSha ? String(world.platformSyncSha).slice(0, 8) : null;
+  if (synced || localHead) {
+    let syncLine = '  platform sync:   ' + (synced || 'unknown') + (localHead ? '   local HEAD ' + localHead : '');
+    if (synced && localHead && !String(context.gitHead).startsWith(String(world.platformSyncSha).slice(0, 8))) {
+      syncLine += '   (differ: committed components run as last synced; only STAGED components reflect this checkout)';
+    }
+    lines.push(syncLine);
+  }
+  if (world.testComponentSource) {
+    lines.push('  test component:  ' + world.testComponentSource + (world.testComponentSignature ? ' ' + shortSignature(world.testComponentSignature) : '') +
+      (world.testComponentBranch ? "  variant '" + world.testComponentBranch + "'" : ''));
+  }
+  lines.push(...stagedMaskedByVariantLines(world.stagedMaskedByVariant, world.executionAccountId || context.accountId));
+  return lines;
+}
+
+// Staged edits from a TRUNK lane that the execution account will not run, because its branch overrides those
+// components with committed variants. Production behaves the same way (the variant keeps shadowing trunk), so this
+// is drift to report, not a bug to route around. Pure.
+function stagedMaskedByVariantLines(masked, accountId) {
+  if (!Array.isArray(masked) || !masked.length) return [];
+  const lines = ['  NOT RUN FOR THIS ACCOUNT: ' + masked.length + ' staged trunk edit(s) are shadowed by account ' +
+    (accountId || '?') + "'s committed variant, exactly as in production:"];
+  masked.slice(0, 10).forEach((entry) => {
+    lines.push('    - ' + entry.type + ' ' + (entry.componentId != null ? entry.componentId + ' ' : '') + (entry.componentName || '') +
+      "  (variant " + (entry.variantId || '?') + " on '" + entry.branch + "')");
+  });
+  if (masked.length > 10) lines.push('    ...' + (masked.length - 10) + ' more');
+  lines.push("    To change what this account runs, edit the component on its variant branch ('" + masked[0].branch +
+    "') or promote the trunk change to that branch.");
+  return lines;
+}
+
+// The corpus-style roll-up printed after a run: outcome counts, case duration percentiles, AI usage split
+// live/mocked, and the durable record. Built only from the result the platform returned.
+function testRunSummaryLines(status = {}) {
+  const result = status.result || {};
+  const summary = result.summary || {};
+  const lines = [];
+  const outcomes = summary.outcomes && typeof summary.outcomes === 'object' ? summary.outcomes : null;
+  if (outcomes && Object.keys(outcomes).length) {
+    lines.push('Outcomes: ' + Object.keys(outcomes).map((key) => key + ' ' + outcomes[key]).join(', '));
+  }
+  if (summary.durationMs) {
+    lines.push('Case duration: median ' + formatDurationMs(summary.durationMs.median) + ', p95 ' +
+      formatDurationMs(summary.durationMs.p95) + ', max ' + formatDurationMs(summary.durationMs.max));
+  }
+  const ai = summary.ai;
+  if (ai && (ai.calls || ai.liveCalls || ai.mockedCalls)) {
+    let aiLine = 'AI: ' + (ai.liveCalls || 0) + ' live call(s) ' + formatUsd(ai.cost) + ', ' + (ai.mockedCalls || 0) + ' mocked';
+    if (ai.uncostedLiveCalls) aiLine += ', ' + ai.uncostedLiveCalls + ' live call(s) unpriced (cost is a floor)';
+    if (ai.intentionalLiveCalls) aiLine += ', ' + ai.intentionalLiveCalls + ' intentional (withAiBudget)';
+    lines.push(aiLine);
+    const models = Array.isArray(ai.models) ? ai.models : [];
+    if (models.length) {
+      lines.push('AI models: ' + models.slice(0, 6).map((m) => (m.model || 'unknown') + ' ' + (m.liveCalls || 0) + ' live/' + (m.mockedCalls || 0) + ' mocked').join('; '));
+    }
+    if (Array.isArray(ai.budgets) && ai.budgets.length) lines.push('AI budgets: ' + ai.budgets.join(', '));
+  }
+  const unintended = (Array.isArray(result.tests) ? result.tests : [])
+    .reduce((sum, test) => sum + (Array.isArray(test.liveHttpCalls) ? test.liveHttpCalls.filter((c) => c && c.intentional !== true).length : 0), 0);
+  if (unintended) {
+    lines.push('Unmocked live HTTP calls: ' + unintended + ' (missing mocks, or live AI outside withAiBudget)');
+  }
+  if (result.durableRecord && result.durableRecord.stored) {
+    lines.push('Durable record: kept after the live status expires — remits-cli test status --task-id ' + result.durableRecord.taskId);
+  } else if (status.durable) {
+    lines.push('Durable record: ' + (status.durableNote || 'read from the durable test run record'));
+  }
+  return lines;
+}
+
+// Per-case comparison of two runs of the same suite: which cases changed outcome, and how cost and duration
+// moved. The answer to "did this revision do better than the last one" without reconstructing either run.
+function compareTestRunResults(baseResult = {}, headResult = {}) {
+  const outcomeOf = (test) => test.outcome || (test.passed === true ? 'passed' : (test.passed === false ? 'failed' : 'unknown'));
+  const byName = (result) => {
+    const map = new Map();
+    (Array.isArray(result.tests) ? result.tests : []).forEach((test) => { if (test && test.name) map.set(test.name, test); });
+    return map;
+  };
+  const base = byName(baseResult);
+  const head = byName(headResult);
+  const names = Array.from(new Set([...base.keys(), ...head.keys()]));
+  const cases = names.map((name) => {
+    const b = base.get(name);
+    const h = head.get(name);
+    const entry = {
+      name,
+      base: b ? outcomeOf(b) : 'absent',
+      head: h ? outcomeOf(h) : 'absent',
+      baseCost: b && b.ai ? Number(b.ai.cost || 0) : null,
+      headCost: h && h.ai ? Number(h.ai.cost || 0) : null,
+      baseDurationMs: b ? b.duration : null,
+      headDurationMs: h ? h.duration : null,
+      headReason: h && h.outcome !== 'passed' ? (h.outcomeReason || h.error || null) : null
+    };
+    entry.changed = entry.base !== entry.head;
+    entry.direction = !entry.changed ? 'same' : (entry.head === 'passed' ? 'improved' : (entry.base === 'passed' ? 'regressed' : 'changed'));
+    return entry;
+  });
+  const count = (result, outcome) => (Array.isArray(result.tests) ? result.tests : []).filter((t) => outcomeOf(t) === outcome).length;
+  const aiCost = (result) => (result.summary && result.summary.ai && Number(result.summary.ai.cost)) || 0;
+  return {
+    base: { taskId: baseResult.taskId, passed: count(baseResult, 'passed'), total: (baseResult.tests || []).length, cost: aiCost(baseResult) },
+    head: { taskId: headResult.taskId, passed: count(headResult, 'passed'), total: (headResult.tests || []).length, cost: aiCost(headResult) },
+    improved: cases.filter((c) => c.direction === 'improved').map((c) => c.name),
+    regressed: cases.filter((c) => c.direction === 'regressed').map((c) => c.name),
+    changed: cases.filter((c) => c.changed),
+    cases
+  };
+}
+
+
+
+
 async function waitForToolStatus(api, cwd, options) {
   const started = Date.now();
   let pollDelayMs = parsePositiveInt(options.pollIntervalMs, 1000);
@@ -6422,6 +7637,19 @@ async function waitForToolStatus(api, cwd, options) {
   }
 }
 
+// One compact progress line for a streamed TestSuite frame: a finished case, or the suite roll-up.
+function testSuiteProgressLine(payload = {}) {
+  if (payload.total != null || Array.isArray(payload.tests)) {
+    const total = payload.total != null ? payload.total : (payload.tests || []).length;
+    const passed = payload.passed != null ? payload.passed : (payload.tests || []).filter((t) => t && t.passed).length;
+    return '[ws] ' + (payload.testName || 'suite') + ': ' + passed + '/' + total + ' passed';
+  }
+  const mark = payload.passed === false ? 'FAIL' : 'pass';
+  const detail = payload.outcome && payload.outcome !== 'passed' ? ' [' + payload.outcome + ']' : '';
+  return '[ws] ' + mark + ' ' + (payload.name || 'case') + detail +
+    (payload.duration != null ? ' ' + payload.duration + 'ms' : '');
+}
+
 function watchWebsocket(baseUrl, topicId, taskId, options = {}) {
   const emit = options.stderr ? console.error : console.log;
   const client = new Client({
@@ -6442,7 +7670,11 @@ function watchWebsocket(baseUrl, topicId, taskId, options = {}) {
             return;
           }
           if (payload.tests || payload.name || payload.total != null) {
-            emit('[ws][TestSuite]', JSON.stringify(payload));
+            // Progress, not the payload. This used to print the whole suite result — every case, every
+            // stacktrace — as one enormous line immediately before the readable summary said the same thing,
+            // which buried the run world, the outcomes and the pivots an agent actually reads. --verbose still
+            // gets the raw frame.
+            emit(options.verbose ? '[ws][TestSuite] ' + JSON.stringify(payload) : testSuiteProgressLine(payload));
           }
         }
       } catch (err) {
@@ -6493,6 +7725,22 @@ async function testCommand(flags) {
   // --variant-branch explicitly probes a committed variant branch. Normally omitted: variants resolve
   // from the account's subscription edge, which is what production does.
   const variantBranch = flags['variant-branch'];
+  // Asked BEFORE the run: a run whose evidence could only fail the envelope's contract is refused here, not
+  // discovered at `verify report` after the minutes it took.
+  const numericTestRef = /^\d+$/.test(String(testRef));
+  const verification = await verificationPreflight(api, cwd, session, accountId, flags, {
+    packetType: 'test_run',
+    world: {
+      accountId,
+      executionAccountId: asAccountId ? Number(asAccountId) : Number(accountId),
+      dataMode,
+      branchName,
+      workspace,
+      componentBranch: variantBranch || undefined
+    },
+    test: numericTestRef ? { testId: Number(testRef) } : { testName: String(testRef) }
+  }, { command: 'test run' });
+  const activeEnvelopeId = verification.envelopeId;
 
   withStdoutRoutedToStderr(jsonOutput, () => {
     printProdDataBanner({
@@ -6525,12 +7773,21 @@ async function testCommand(flags) {
   withStdoutRoutedToStderr(jsonOutput, () => {
     printSessionResolutionWarning(sessionContext);
     printResolvedBaseUrl(baseUrl);
+    printLocalCommandContext(cwd, flags, { accountId: asAccountId || accountId, branchName, workspace, dataMode });
+    printLocalStateWarnings(cwd, flags);
     printStagingLane(branchName, workspace, workspaceSource(cwd, flags));
     printStagingLaneOwnerNotice(start.staging || {});
     if (start.staging && Array.isArray(start.staging.accountLanes)) {
       printOrphanedWorkspaceWarning(start.staging);
       printAccountLanes({ accountLanes: start.staging.accountLanes, branchName, workspace });
     }
+    runWorldLines(start.world, {
+      host: normalizeBaseUrl(baseUrl),
+      accountId: asAccountId || accountId,
+      dataMode,
+      variantWorld: start.variantWorld,
+      gitHead: safeGitValue(cwd, 'git rev-parse HEAD')
+    }).forEach((line) => console.log(line));
     console.log('Test run started:', start.taskId);
   });
   runtimeState.currentTestTaskId = start.taskId;
@@ -6539,11 +7796,12 @@ async function testCommand(flags) {
   if (flags.watch !== 'false') {
     const topic = session.websocketTopic || start.websocketTopic || (session.user && String(session.user.uuid || '').replace(/-/g, ''));
     if (topic) {
-      stopWs = watchWebsocket(baseUrl, topic, start.taskId, { stderr: jsonOutput });
+      stopWs = watchWebsocket(baseUrl, topic, start.taskId, { stderr: jsonOutput, verbose: flagEnabled(flags.verbose) });
     }
   }
 
   const status = await waitForStatus(api, cwd, accountId, branchName, start.taskId, session.token, dataMode);
+  status.localState = localStateSummary(cwd, flags);
   if (stopWs) {
     stopWs();
   }
@@ -6556,6 +7814,7 @@ async function testCommand(flags) {
   } else {
     console.log('Final status:', JSON.stringify(status, null, 2));
     printStagingLaneOwnerNotice(status.staging || {});
+    testRunSummaryLines(status).forEach((line) => console.log(line));
     printTestRunPivots(status);
   }
 
@@ -6581,8 +7840,6 @@ async function testCommand(flags) {
     process.exitCode = 1;
   }
 
-  const verificationContext = activeVerificationContext(cwd, flags, session, accountId);
-  const activeEnvelopeId = verificationEnvelopeIdForCommand(cwd, flags, verificationContext);
   const componentProvenance = testComponentProvenance(status);
   const sourceRevision = collectVerificationSource(cwd, flags);
   const priorPackets = await readVerificationPacketsForDiagnostics(api, cwd, session, accountId, activeEnvelopeId, {
@@ -6602,7 +7859,7 @@ async function testCommand(flags) {
     });
   }
 
-  await appendVerificationPacket(api, cwd, session, accountId, flags, {
+  await appendVerificationPacket(api, cwd, session, accountId, verification.evidenceFlags, {
     type: 'test_run',
     success: status.status === 'completed' && !(status.result && status.result.failed > 0) && !unmatched.length,
     claim: 'Test run ' + String(testRef),
@@ -6625,10 +7882,14 @@ async function testCommand(flags) {
       unmatchedTestNames: unmatched
     },
     evidenceCategories: testEvidenceCategories(status, names),
+    // What the run spent and whether that live AI was declared (withAiBudget), so an envelope can tell a
+    // measurement run from a suite with missing mocks without re-reading every case.
+    dependencies: testRunDependencies(status),
+    summary: status.result && status.result.summary,
     limitations: []
       .concat(unmatched.length ? ['One or more requested test case selectors matched no case.'] : [])
       .concat(nondeterminism ? [nondeterminism.message] : []),
-    rawRefs: { testStatusKey: start.taskId },
+    rawRefs: { testStatusKey: start.taskId, durableTestRun: status.result && status.result.durableRecord ? start.taskId : undefined },
     status
   }, { quiet: jsonOutput });
 }
@@ -6665,6 +7926,11 @@ async function testStatusCommand(flags) {
   printResolvedBaseUrl(baseUrl);
   console.log('Test run status:', status.status || 'unknown');
   console.log('Task ID:', taskId);
+  // Say where this answer came from. A durable record is a finished snapshot rebuilt from the database after the
+  // live status was gone; without this line a reconstructed run is indistinguishable from one still being watched.
+  console.log('Source:', status.durable
+    ? 'durable run record (the live status has expired; this run is final)'
+    : 'live run status');
   console.log('Data mode:', status.dataMode || dataMode);
   if (status.result) {
     console.log('Cases:', (status.result.passed || 0) + ' passed, ' + (status.result.failed || 0) + ' failed, ' + (status.result.total || 0) + ' total');
@@ -6672,12 +7938,100 @@ async function testStatusCommand(flags) {
   if (status.error || status.message) {
     console.log('Message:', status.error || status.message);
   }
+  if (status.world) runWorldLines(status.world, { host: normalizeBaseUrl(baseUrl) }).forEach((line) => console.log(line));
+  testRunSummaryLines(status).forEach((line) => console.log(line));
+  printTestRunPivots(status);
   if (status.status === 'failed' || (status.result && status.result.failed > 0)) {
     process.exitCode = 1;
   }
   return status;
 }
 
+// `test runs --test X`: the durable history of a suite, newest first. With --compare, the latest run is
+// compared case-by-case with the one before it.
+async function testRunsCommand(flags) {
+  const cwd = process.cwd();
+  ensureLocalState(cwd);
+  const sessionContext = resolveSessionContext(cwd, flags);
+  const { session, accountId } = sessionContext;
+  const baseUrl = flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL;
+  const api = buildAxios(baseUrl, session.token);
+  const testRef = flags.test || flags['test-id'] || flags.name;
+  const data = await loggedPost(api, cwd, '/cli/testRuns', {
+    token: session.token,
+    accountId,
+    asAccountId: flags['as-account'] || flags['as-account-id'],
+    testId: testRef && /^\d+$/.test(String(testRef)) ? Number(testRef) : undefined,
+    testName: testRef && !/^\d+$/.test(String(testRef)) ? String(testRef) : undefined,
+    max: flags.limit || flags.max || 20
+  }).then((r) => r.data);
+  if (!data.success) throw new Error(data.message || 'Could not list test runs');
+
+  if (flagEnabled(flags.compare)) {
+    const runs = data.runs || [];
+    if (runs.length < 2) throw new Error('--compare needs at least two recorded runs' + (testRef ? ' of ' + testRef : '') + '; found ' + runs.length);
+    return testCompareCommand(Object.assign({}, flags, { base: runs[1].taskId, head: runs[0].taskId }));
+  }
+  if (flagEnabled(flags.json)) {
+    console.log(JSON.stringify(data, null, 2));
+    return data;
+  }
+  printSessionResolutionWarning(sessionContext);
+  printResolvedBaseUrl(baseUrl);
+  console.log('Recorded test runs' + (testRef ? ' for ' + testRef : '') + ' (account ' + data.accountId + '), newest first:');
+  (data.runs || []).forEach((run) => {
+    console.log('- ' + run.taskId + '  ' + (run.status || 'unknown') + '  ' + (run.passed || 0) + '/' + (run.total || 0) + ' passed' +
+      '  ' + corpusAiLabel(run) +
+      (run.durationMs ? '  ' + formatDurationMs(run.durationMs) : '') +
+      '  ' + (run.dataMode || '?') + '  ' + (run.branchName || '?') + (run.workspace ? ' [ws:' + run.workspace + ']' : '') +
+      (run.laneContentHash ? '  lane ' + String(run.laneContentHash).slice(0, 12) : '') +
+      '  ' + formatTime(run.completedAt) + '  ' + (run.testName || ''));
+  });
+  if (!(data.runs || []).length) console.log('(none recorded)');
+  return data;
+}
+
+// `test compare --base <taskId> --head <taskId>`: per-case outcome, cost and duration deltas between two runs,
+// read from the durable records.
+async function testCompareCommand(flags) {
+  const cwd = process.cwd();
+  ensureLocalState(cwd);
+  const sessionContext = resolveSessionContext(cwd, flags);
+  const { session, accountId } = sessionContext;
+  const baseUrl = flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL;
+  const api = buildAxios(baseUrl, session.token);
+  const baseTask = flags.base;
+  const headTask = flags.head;
+  if (!baseTask || !headTask) throw new Error('test compare needs --base <taskId> and --head <taskId> (or: test runs --test X --compare)');
+  const fetchStatus = (taskId) => loggedPost(api, cwd, '/cli/test', {
+    token: session.token, command: 'status', accountId, branchName: flags.branch || currentBranch(cwd), taskId
+  }).then((r) => r.data);
+  const [baseStatus, headStatus] = await Promise.all([fetchStatus(baseTask), fetchStatus(headTask)]);
+  const comparison = compareTestRunResults(Object.assign({ taskId: baseTask }, baseStatus.result || {}), Object.assign({ taskId: headTask }, headStatus.result || {}));
+  comparison.baseWorld = baseStatus.world || (baseStatus.result && baseStatus.result.world) || null;
+  comparison.headWorld = headStatus.world || (headStatus.result && headStatus.result.world) || null;
+  if (flagEnabled(flags.json)) {
+    console.log(JSON.stringify(comparison, null, 2));
+    return comparison;
+  }
+  printResolvedBaseUrl(baseUrl);
+  console.log('Base ' + baseTask + ': ' + comparison.base.passed + '/' + comparison.base.total + ' passed, AI ' + formatUsd(comparison.base.cost));
+  console.log('Head ' + headTask + ': ' + comparison.head.passed + '/' + comparison.head.total + ' passed, AI ' + formatUsd(comparison.head.cost));
+  const worldDiff = ['laneContentHash', 'componentBranch', 'dataMode', 'workspace', 'platformSyncSha']
+    .filter((key) => comparison.baseWorld && comparison.headWorld && String(comparison.baseWorld[key] || '') !== String(comparison.headWorld[key] || ''))
+    .map((key) => key + ' ' + short(String(comparison.baseWorld[key] || 'none')) + ' -> ' + short(String(comparison.headWorld[key] || 'none')));
+  if (worldDiff.length) console.log('World changed: ' + worldDiff.join('; '));
+  if (comparison.improved.length) console.log('Improved (' + comparison.improved.length + '): ' + comparison.improved.join(', '));
+  if (comparison.regressed.length) console.log('Regressed (' + comparison.regressed.length + '): ' + comparison.regressed.join(', '));
+  comparison.changed.filter((c) => c.direction === 'changed').forEach((c) => console.log('Changed: ' + c.name + ' ' + c.base + ' -> ' + c.head));
+  comparison.cases.filter((c) => c.head !== 'passed' && c.headReason).slice(0, 20).forEach((c) => {
+    console.log('  ' + c.name + ' [' + c.head + ']: ' + String(c.headReason).slice(0, 300));
+  });
+  if (!comparison.changed.length) console.log('No case changed outcome.');
+  return comparison;
+}
+
+
 /*
 ## Tokens, Tools, Verification, And Config
 */
@@ -6703,6 +8057,18 @@ async function tokenCommand(flags) {
   // Embeddable resolves that account's branch variants rather than the owner's trunk.
   // --variant-branch explicitly probes a committed variant branch before any edge subscribes.
   const variantBranch = flags['variant-branch'];
+  const tokenAsAccountId = flags['as-account'] || flags['as-account-id'];
+  const verification = await verificationPreflight(api, cwd, session, accountId, flags, {
+    packetType: 'token_inspect',
+    world: {
+      accountId,
+      executionAccountId: tokenAsAccountId ? Number(tokenAsAccountId) : Number(accountId),
+      dataMode,
+      branchName,
+      workspace,
+      componentBranch: variantBranch || undefined
+    }
+  }, { command: 'token' });
   // Send the path so the server can also mint the EMBEDDABLE-SCOPED token key. `tokenKey` opens a
   // tokenized URL in a browser; `embedTokenKey` lets the `<script>` embed loader resolve the component
   // from persisted token context because the loader request sends no path.
@@ -6747,7 +8113,8 @@ async function tokenCommand(flags) {
     accountLanes: data.accountLanes,
     dataMode: data.dataMode || dataMode,
     shortBasePath: data.shortBasePath,
-    embeddableUrl
+    embeddableUrl,
+    localState: localStateSummary(cwd, flags)
   };
 
   // What the token will RESOLVE AS. `accountId` says which account it executes as; on a hierarchy the
@@ -6757,6 +8124,11 @@ async function tokenCommand(flags) {
   if (data.resolution) {
     output.resolution = data.resolution;
   }
+  if (Array.isArray(data.stagedMaskedByVariant) && data.stagedMaskedByVariant.length) {
+    output.stagedMaskedByVariant = data.stagedMaskedByVariant;
+    // stderr: stdout is the JSON document. Said before the URL is opened, not discovered from what renders.
+    stagedMaskedByVariantLines(data.stagedMaskedByVariant, data.accountId).forEach((line) => console.error(line.replace(/^  /, '')));
+  }
 
   // Present only when the path resolved to an Embeddable. `embedTokenKey` is what a host site pastes
   // into the loader snippet; the render shape is echoed because it decides what that host receives.
@@ -6770,10 +8142,14 @@ async function tokenCommand(flags) {
     output.embedSnippet = data.embedSnippet;
   }
 
-  printSessionResolutionWarning(sessionContext);
+  if (!flagEnabled(flags.json)) {
+    printSessionResolutionWarning(sessionContext);
+    printLocalCommandContext(cwd, flags, { accountId: output.accountId || accountId, branchName, workspace: output.workspace, dataMode: output.dataMode || dataMode });
+    printLocalStateWarnings(cwd, flags);
+  }
   console.log(JSON.stringify(output, null, 2));
 
-  await appendVerificationPacket(api, cwd, session, accountId, flags, {
+  await appendVerificationPacket(api, cwd, session, accountId, verification.evidenceFlags, {
     type: 'token_inspect',
     success: true,
     claim: 'Verification token minted',
@@ -6786,7 +8162,7 @@ async function tokenCommand(flags) {
     },
     evidenceCategories: ['token_inspect'],
     token: Object.assign({}, output, { tokenKey: output.tokenKey ? '[redacted]' : undefined, embedTokenKey: output.embedTokenKey ? '[redacted]' : undefined })
-  });
+  }, { quiet: flagEnabled(flags.json) });
 }
 
 async function tokenInspectCommand(flags) {
@@ -6988,13 +8364,19 @@ async function toolCommand(flags) {
 
     data.responseFile = statusResponse.responseFile;
     data.sessionLog = sessionJsonlFile(cwd);
+    data.localState = localStateSummary(cwd, flags);
     // A completed run can still carry a tool-level refusal — see toolResultFailed.
     const polledFailed = data.toolSuccess === false || toolResultFailed(data.result);
     if (polledFailed) {
       data.toolMessage = data.toolMessage || toolResultMessage(data.result);
     }
     if (data.status === 'failed' || polledFailed) process.exitCode = 1;
-    await appendVerificationPacket(api, cwd, session, accountId, flags, {
+    // Same question as the call that started it: a poll must not attach where the call itself would not.
+    const statusVerification = await verificationPreflight(api, cwd, session, accountId, flags, {
+      packetType: 'tool_call',
+      world: { accountId: statusAccountId, dataMode: data.dataMode || dataMode, branchName: flags.branch || (stored && stored.branchName) || branchName, workspace: resolveWorkspace(cwd, flags) }
+    }, { command: 'tool status', neverRefuse: true, quiet: jsonOutput });
+    await appendVerificationPacket(api, cwd, session, accountId, statusVerification.evidenceFlags, {
       type: 'tool_call',
       success: data.status !== 'failed' && !polledFailed,
       claim: 'Tool status ' + requestedCallId,
@@ -7010,6 +8392,8 @@ async function toolCommand(flags) {
     }
     printSessionResolutionWarning(sessionContext);
     printResolvedBaseUrl(baseUrl);
+    printLocalCommandContext(cwd, flags, { accountId: statusAccountId, branchName: flags.branch || (stored && stored.branchName) || branchName, dataMode: data.dataMode || dataMode });
+    printLocalStateWarnings(cwd, flags);
     console.log('Tool call status:', data.status);
     console.log('Call ID:', requestedCallId);
     console.log('Data mode:', data.dataMode || dataMode);
@@ -7032,6 +8416,12 @@ async function toolCommand(flags) {
     stderr: jsonOutput
   });
 
+  const toolWorkspace = resolveWorkspace(cwd, flags);
+  const verification = await verificationPreflight(api, cwd, session, accountId, flags, {
+    packetType: 'tool_call',
+    world: { accountId, dataMode, branchName, workspace: toolWorkspace }
+  }, { command: 'tool --name ' + String(toolName) });
+
   const response = await loggedPost(api, cwd, '/cli/tool', {
     token: session.token,
     accountId,
@@ -7041,7 +8431,7 @@ async function toolCommand(flags) {
     // what the call may discover — has to survive that. The server validates it; it is never authorization.
     scopeRootAccountId: accountId,
     branchName,
-    workspace: resolveWorkspace(cwd, flags),
+    workspace: toolWorkspace,
     dataMode,
     variantBranch,
     name: String(toolName),
@@ -7064,6 +8454,7 @@ async function toolCommand(flags) {
   const toolFailureMessage = data.toolMessage || toolResultMessage(data.result);
   data.responseFile = response.responseFile;
   data.sessionLog = sessionJsonlFile(cwd);
+  data.localState = localStateSummary(cwd, flags);
   if (toolFailureMessage && !data.toolMessage) data.toolMessage = toolFailureMessage;
 
   let evidenceData = data;
@@ -7072,6 +8463,8 @@ async function toolCommand(flags) {
   if (!jsonOutput) {
     printSessionResolutionWarning(sessionContext);
     printResolvedBaseUrl(baseUrl);
+    printLocalCommandContext(cwd, flags, { accountId, branchName, workspace: resolveWorkspace(cwd, flags), dataMode: data.dataMode || dataMode });
+    printLocalStateWarnings(cwd, flags);
     console.log(asyncMode ? 'Tool call started.'
       : (toolFailed ? 'Tool call FAILED — the tool ran and returned an error.' : 'Tool call succeeded.'));
     if (toolFailed && toolFailureMessage) console.log('Tool error:', toolFailureMessage);
@@ -7118,7 +8511,7 @@ async function toolCommand(flags) {
     if (jsonOutput) Object.assign(data, { finalStatus: finalStatus.data });
   }
 
-  await appendVerificationPacket(api, cwd, session, accountId, flags, {
+  await appendVerificationPacket(api, cwd, session, accountId, verification.evidenceFlags, {
     type: 'tool_call',
     success: asyncMode && !waitForAsync ? null : (!toolFailed && (!asyncMode || process.exitCode !== 1)),
     pending: asyncMode && !waitForAsync,
@@ -7140,6 +8533,225 @@ async function toolCommand(flags) {
   }
 }
 
+// Human output for the read-only corpus commands, from the platform's response alone.
+// How a run or a case actually exercised AI. A replayed suite and a measured one produce identical outcomes,
+// scores and metrics, so every scorecard line has to say which it was or it is not evidence of anything.
+function corpusAiLabel(row = {}) {
+  // When the corpus cases themselves recorded no AI, the platform falls back to the whole suite run's counters
+  // and says so with aiModeSource. Report that as "run AI ...", never as the corpus cases' own measurement.
+  const fromRun = row.aiModeSource === 'run';
+  const live = Number((fromRun ? row.runLiveAiCalls : row.liveAiCalls) || 0);
+  const mocked = Number((fromRun ? row.runMockedAiCalls : row.mockedAiCalls) || 0);
+  const calls = Number((fromRun ? row.runAiCalls : row.aiCalls) || 0);
+  const prefix = fromRun ? 'run AI ' : 'AI ';
+  if (live > 0) return prefix + 'live ' + formatUsd(row.liveAiCost) + ' (' + live + '/' + (calls || live) + ' live)';
+  if (mocked > 0 || calls > 0) return prefix + 'MOCKED (' + (mocked || calls) + ' replayed, $0.00)';
+  return 'no AI';
+}
+
+function corpusLines(sub, data = {}) {
+  const lines = ['Corpus: ' + (data.corpus || '?') + ' (owner account ' + (data.ownerAccountId || '?') + ')'];
+  if (sub === 'cases') {
+    const cases = data.cases || [];
+    lines.push('Cases: ' + cases.length);
+    cases.forEach((c) => lines.push('- ' + c.caseKey + (c.split ? '  [' + c.split + ']' : '') + (c.tags && c.tags.length ? '  tags ' + c.tags.join(',') : '') +
+      '  expected ' + (c.hasExpected ? (c.expectedStatus || 'present') : 'none') + '  artifacts ' + (c.artifacts || []).map((a) => a.name + ':' + a.bytes + 'b').join(' ')));
+  } else if (sub === 'results') {
+    (data.results || []).forEach((r) => lines.push('- ' + r.caseKey + '  ' + (r.outcome || '?') + (r.score !== undefined ? '  score ' + r.score : '') +
+      '  run ' + r.taskId + '  ' + corpusAiLabel(r) + (r.durationMs ? '  ' + formatDurationMs(r.durationMs) : '') +
+      '  metrics ' + String(r.metricsHash || '').slice(0, 10) + '  ' + formatTime(r.recordedAt)));
+  } else if (sub === 'runs') {
+    (data.runs || []).forEach((r) => lines.push('- ' + r.taskId + '  ' + r.cases + ' case(s)  ' + Object.keys(r.outcomes || {}).map((k) => k + ' ' + r.outcomes[k]).join(', ') +
+      '  ' + corpusAiLabel(r) + '  ' + (r.dataMode || '?') + '  ' + (r.branchName || '?') + (r.workspace ? ' [ws:' + r.workspace + ']' : '') +
+      (r.laneContentHash ? '  lane ' + String(r.laneContentHash).slice(0, 12) : '') + '  ' + formatTime(r.recordedAt)));
+    if ((data.runs || []).some((r) => r.aiMode === 'mocked')) {
+      lines.push('Runs marked AI MOCKED replayed every AI turn from aiMock - they measure the harness, not the model.');
+    }
+  } else if (sub === 'compare') {
+    const cmp = data.comparison || {};
+    lines.push('Base ' + cmp.baseTaskId + ' -> head ' + cmp.headTaskId + ': ' + Object.keys(cmp.counts || {}).map((k) => k + ' ' + cmp.counts[k]).join(', '));
+    lines.push('AI mode: base ' + (cmp.baseAiMode || '?') + ', head ' + (cmp.headAiMode || '?'));
+    if (cmp.aiModeChanged) lines.push('WARNING: ' + cmp.aiModeChanged);
+    (cmp.cases || []).filter((c) => c.direction !== 'same').forEach((c) => {
+      lines.push('- ' + c.caseKey + '  ' + c.direction + (c.base ? '  ' + c.base.outcome : '') + (c.head ? ' -> ' + c.head.outcome : '') +
+        (c.expectedChanged ? '  (EXPECTED ANSWER CHANGED between runs)' : ''));
+      (c.changedMetrics || []).slice(0, 8).forEach((m) => lines.push('    ' + m.metric + ': ' + JSON.stringify(m.base) + ' -> ' + JSON.stringify(m.head)));
+      if (c.head && c.head.outcomeReason && c.head.outcome !== 'passed') lines.push('    reason: ' + String(c.head.outcomeReason).slice(0, 300));
+    });
+  } else if (sub === 'retire') {
+    lines.push('Result: ' + Object.keys(data.counts || {}).map((k) => k + ' ' + data.counts[k]).join(', '));
+    (data.cases || []).forEach((c) => lines.push('- ' + c.caseKey + '  ' + c.status + (c.message ? '  ' + c.message : (c.changed === false ? '  (already in that state)' : ''))));
+    // Only explain what retirement means when something was actually retired; after a wholly refused call the
+    // reader needs the refusal, not a description of a state nothing reached.
+    if ((data.cases || []).some((c) => c.status === 'retired' || c.status === 'restored')) {
+      lines.push('Retired cases stay readable in results and compare; they are just no longer handed to runs. `corpus cases --include-retired` lists them, `corpus retire --restore` puts them back.');
+    }
+  } else if (sub === 'consistency') {
+    const con = data.consistency || {};
+    lines.push('Case ' + con.caseKey + ': ' + con.runs + ' run(s), ' + (con.stable ? 'STABLE (identical metrics every run)' : (con.variants || []).length + ' distinct metric results') +
+      (con.aiModes && con.aiModes.length ? '  AI ' + con.aiModes.join('+') : ''));
+    if (con.note) lines.push('WARNING: ' + con.note);
+    (con.variants || []).forEach((v) => lines.push('- metrics ' + String(v.metricsHash).slice(0, 10) + '  runs ' + (v.runs || []).map((r) => r.taskId + ':' + r.outcome + (r.aiMode && r.aiMode !== 'none' ? '/' + r.aiMode : '')).join(', ')));
+  }
+  return lines;
+}
+
+// `corpus import|cases|results|runs|compare|consistency`: test corpora through the platform's own corpus(name).
+async function corpusCommand(flags, subcommand) {
+  const cwd = process.cwd();
+  ensureLocalState(cwd);
+  const sessionContext = resolveSessionContext(cwd, flags);
+  const { session, accountId } = sessionContext;
+  const baseUrl = flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL;
+  const branchName = flags.branch || currentBranch(cwd);
+  const workspace = resolveWorkspace(cwd, flags);
+  const dataMode = hasExplicitDataModeFlag(flags) ? resolveDataMode(flags, null) : DEFAULT_DATA_MODE;
+  const jsonOutput = flagEnabled(flags.json);
+  const sub = String(subcommand || 'cases').toLowerCase();
+  const emit = jsonOutput ? console.error : console.log;
+  const api = buildAxios(baseUrl, session.token, parsePositiveInt(flags['timeout-ms'], 300000));
+  const base = {
+    token: session.token,
+    accountId,
+    asAccountId: flags['as-account'] || flags['as-account-id'],
+    variantBranch: flags['variant-branch'],
+    branchName,
+    workspace,
+    dataMode
+  };
+  const post = async (payload) => {
+    try {
+      return await loggedPost(api, cwd, '/cli/corpus', Object.assign({}, base, payload)).then((r) => r.data);
+    } catch (err) {
+      const data = err && err.response && err.response.data;
+      if (data && data.message) throw new Error(data.message);
+      throw err;
+    }
+  };
+
+  if (sub === 'import') {
+    const manifestFile = flags.manifest || flags.file;
+    if (!manifestFile) throw new Error('corpus import requires --manifest <manifest.json>');
+    const resolved = path.resolve(cwd, String(manifestFile));
+    const manifest = JSON.parse(fs.readFileSync(resolved, 'utf8'));
+    const corpusName = flags.corpus || manifest.corpus;
+    if (!corpusName) throw new Error('corpus import needs a corpus name: "corpus" in the manifest or --corpus');
+    const entries = corpusManifestEntries(manifest, path.dirname(resolved));
+    if (!entries.length) throw new Error('The manifest has no cases');
+
+    withStdoutRoutedToStderr(jsonOutput, () => {
+      printSessionResolutionWarning(sessionContext);
+      printResolvedBaseUrl(baseUrl);
+      printLocalCommandContext(cwd, flags, { accountId: flags['as-account'] || accountId, branchName, workspace, dataMode });
+      printProdDataBanner({ dataMode, accountId: flags['as-account'] || accountId, baseUrl, operation: 'corpus import', mutating: true });
+    });
+    const totalBytes = entries.reduce((sum, e) => sum + e.artifacts.reduce((n, a) => n + a.bytes, 0), 0);
+    emit('Importing ' + entries.length + ' case(s) into corpus "' + corpusName + '", ' +
+      entries.reduce((n, e) => n + e.artifacts.length, 0) + ' artifact(s), ' + totalBytes + ' bytes (artifacts in the ' + dataMode + ' lane)');
+
+    const responses = [];
+    for (const batch of batchCorpusEntries(entries)) {
+      const cases = batch.map((entry) => Object.assign({}, entry, {
+        artifacts: entry.artifacts.map((a) => ({
+          name: a.name,
+          fileName: a.fileName,
+          contentType: a.contentType,
+          // Read and encoded only here, per batch. The session log records sizes and hashes, never this value.
+          contentBase64: fs.readFileSync(a.path).toString('base64')
+        }))
+      }));
+      responses.push(await post({ command: 'import', corpus: corpusName, confirmProd: flagEnabled(flags['confirm-prod']), cases }));
+    }
+    const body = corpusImportPacketBody(responses);
+    if (!body.success) process.exitCode = 1;
+    if (jsonOutput) {
+      console.log(JSON.stringify(body, null, 2));
+    } else {
+      console.log('Corpus: ' + body.corpus + ' (owner account ' + body.ownerAccountId + ')');
+      console.log('Result: ' + Object.keys(body.counts).map((k) => k + ' ' + body.counts[k]).join(', '));
+      body.cases.forEach((c) => {
+        console.log('- ' + c.caseKey + '  ' + c.status + (c.changedKeys && c.changedKeys.length && c.status === 'updated' ? '  changed: ' + c.changedKeys.join(', ') : '') + (c.message ? '  ' + c.message : ''));
+        (c.artifacts || []).forEach((a) => console.log('    ' + a.name + '  object ' + a.objectId + '  ' + a.bytes + ' bytes  sha256 ' + String(a.sha256).slice(0, 12) + '  ' + (a.created ? 'stored' : 'already stored')));
+      });
+      // Only point at the next step when something actually landed. Printing it after a wholly failed import
+      // told the reader to go use a corpus that has no cases in it.
+      if (body.success) {
+        console.log('Use it in a Test with corpus(\'' + body.corpus + '\').cases(); compare runs with remits-cli corpus compare.');
+      } else {
+        console.log('Import did not fully succeed - fix the case(s) above and re-run; import is idempotent, so unchanged cases stay unchanged.');
+      }
+    }
+    await appendVerificationPacket(api, cwd, session, accountId, flags, {
+      type: 'corpus_import',
+      success: body.success,
+      claim: 'Corpus ' + body.corpus + ' import: ' + Object.keys(body.counts).map((k) => k + ' ' + body.counts[k]).join(', '),
+      world: Object.assign({}, body.world || {}, { host: normalizeBaseUrl(baseUrl), branchName, workspace, dataMode }),
+      revision: collectVerificationSource(cwd, flags),
+      evidenceCategories: ['corpus_import'],
+      corpusImport: { corpus: body.corpus, ownerAccountId: body.ownerAccountId, counts: body.counts, cases: body.cases }
+    }, { quiet: jsonOutput });
+    return body;
+  }
+
+  const corpusName = flags.corpus || (flags._ && flags._[2]);
+  if (!corpusName) throw new Error('corpus ' + sub + ' requires --corpus <name>');
+  let data;
+  if (sub === 'cases') {
+    const tags = parseCorpusFilterValues(flags, ['tag', 'tags']);
+    const keys = parseCorpusFilterValues(flags, ['key', 'keys', 'case', 'case-key']);
+    data = await post({ command: 'cases', corpus: corpusName, split: flags.split, tags: tags.length ? tags : undefined, keys: keys.length ? keys : undefined, includeValues: flagEnabled(flags['include-values']), includeRetired: flagEnabled(flags['include-retired']), limit: flags.limit });
+  } else if (sub === 'results') {
+    data = await post({ command: 'results', corpus: corpusName, caseKey: flags.case || flags['case-key'], taskId: flags['task-id'], limit: flags.limit || 50 });
+  } else if (sub === 'runs') {
+    data = await post({ command: 'runs', corpus: corpusName, limit: flags.limit || 20 });
+  } else if (sub === 'compare') {
+    if (!flags.base || !flags.head) throw new Error('corpus compare requires --base <taskId> --head <taskId>');
+    data = await post({ command: 'compare', corpus: corpusName, base: flags.base, head: flags.head });
+  } else if (sub === 'consistency') {
+    const caseKey = flags.case || flags['case-key'];
+    if (!caseKey) throw new Error('corpus consistency requires --case <caseKey>');
+    data = await post({ command: 'consistency', corpus: corpusName, caseKey, limit: flags.limit || 20 });
+  } else if (sub === 'retire') {
+    const retireKeys = parseCorpusFilterValues(flags, ['key', 'keys', 'case', 'case-key']);
+    if (!retireKeys.length) throw new Error('corpus retire requires --case <caseKey> (repeatable) or --keys a,b,c');
+    data = await post({ command: 'retire', corpus: corpusName, keys: retireKeys, restore: flagEnabled(flags.restore) });
+    if (data && data.success === false) process.exitCode = 1;
+  } else {
+    throw new Error('Unknown corpus subcommand: ' + sub + ' (use import, cases, results, runs, compare, consistency or retire)');
+  }
+  if (jsonOutput) {
+    console.log(JSON.stringify(data, null, 2));
+    return data;
+  }
+  printSessionResolutionWarning(sessionContext);
+  printResolvedBaseUrl(baseUrl);
+  corpusLines(sub, data).forEach((line) => console.log(line));
+  return data;
+}
+
+// `verify token` / `verify tool` say "prove this for the envelope", so without an explicit --data-mode they run
+// in the envelope's lane when that lane is TEST. A plain `token`/`tool` follows the session, and a session parked
+// on prod otherwise refuses (or silently detaches) against the test envelope the agent just started. Never
+// adopts PROD: production proof keeps requiring an explicit --data-mode prod, which the refusal names.
+async function verifyWrapperFlags(api, cwd, session, accountId, flags, envelopeId) {
+  const pinned = Object.assign({}, flags, { 'verify-envelope': envelopeId });
+  if (hasExplicitDataModeFlag(flags)) return pinned;
+  try {
+    const result = await postVerificationCommand(api, cwd, session, accountId, 'compatibility', {
+      envelopeId,
+      probe: { packetType: 'manual_observation', world: {} }
+    });
+    const lane = result.comparisonWorld && result.comparisonWorld.dataMode;
+    if (lane && normalizeDataMode(lane) === 'test' && resolveDataMode(flags, session) !== 'test') {
+      console.error('Data lane: test (the lane envelope ' + envelopeId + ' proves; your session is on ' + resolveDataMode(flags, session) + ')');
+      return Object.assign(pinned, { 'data-mode': 'test' });
+    }
+  } catch (_) {
+    // The command's own preflight still answers; this only saves a turn.
+  }
+  return pinned;
+}
+
 async function verifyCommand(flags, subcommand) {
   const cwd = process.cwd();
   ensureLocalState(cwd);
@@ -7148,28 +8760,57 @@ async function verifyCommand(flags, subcommand) {
   const sessionContext = resolveSessionContext(cwd, flags);
   const { session, accountId } = sessionContext;
   const baseUrl = flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL;
-  const dataMode = resolveDataMode(flags, session);
+  // `verify start` proves in the TEST lane unless told otherwise, for the reason `test run` does: production
+  // proof needs explicit provenance. It used to inherit the session's lane, so a session parked on prod started
+  // prod envelopes that every default `test run` then contradicted.
+  const dataMode = sub === 'start' && !hasExplicitDataModeFlag(flags)
+    ? DEFAULT_DATA_MODE
+    : resolveDataMode(flags, session);
   const branchName = flags.branch || currentBranch(cwd);
   const workspace = resolveWorkspace(cwd, flags);
   const api = buildAxios(baseUrl, session.token);
+  // Selection is by checkout world only (no data lane) - see verificationContextKey.
   const activeContext = activeVerificationContext(cwd, flags, session, accountId);
+  const checkoutWorldLine = 'account=' + accountId + ', branch=' + branchName + ', workspace=' + (workspace || 'shared');
+  // What a plain `test run` from here would record, for the "would it count" probe.
+  const testRunWorld = {
+    accountId,
+    executionAccountId: Number(accountId),
+    dataMode: hasExplicitDataModeFlag(flags) ? resolveDataMode(flags, null) : DEFAULT_DATA_MODE,
+    branchName,
+    workspace
+  };
 
   if (sub === 'current') {
     const active = readActiveVerificationEnvelope(cwd, activeContext);
     printSessionResolutionWarning(sessionContext);
     printResolvedBaseUrl(baseUrl);
-    console.log('Context:', 'account=' + accountId + ', branch=' + branchName + ', workspace=' + (workspace || 'shared') + ', dataMode=' + dataMode);
+    printLocalCommandContext(cwd, flags, { accountId, branchName, workspace, dataMode });
+    printLocalStateWarnings(cwd, flags);
+    console.log('Checkout world:', checkoutWorldLine);
     if (!active) {
-      const legacy = readActiveVerificationEnvelope(cwd);
-      console.log('No active verification envelope for this context.');
-      if (legacy) {
-        console.log('Legacy active envelope ignored for this context:', legacy);
+      console.log('No active verification envelope for this checkout world.');
+      // Name the envelopes selected in SIBLING worlds (another workspace/branch of this checkout): the usual
+      // cause is a workspace or branch switch, and "start a new one" is the wrong next step for that.
+      const siblings = Object.values(readActiveVerificationContexts(cwd))
+        .filter((entry) => entry && typeof entry === 'object' && entry.envelopeId && entry.context &&
+          String(entry.context.accountId) === String(accountId))
+        .sort((left, right) => String(right.updatedAt || '').localeCompare(String(left.updatedAt || '')))
+        .filter((entry, index, all) => all.findIndex((other) => other.envelopeId === entry.envelopeId) === index)
+        .slice(0, 3);
+      siblings.forEach((entry) => {
+        console.log('  selected in another world: ' + entry.envelopeId + '  (branch=' + (entry.context.branchName || '?') +
+          ', workspace=' + (entry.context.workspace || 'shared') + ')');
+      });
+      if (siblings.length) {
+        console.log('  Switch back to that workspace/branch, or `remits-cli verify use <id>` to select one here.');
       }
       return;
     }
     console.log('Active verification envelope:', active);
     const local = readLocalVerificationEnvelope(cwd, active);
     if (local && local.summary) console.log('Summary:', local.summary);
+    await printVerificationRunProbe(api, cwd, session, accountId, active, testRunWorld);
     return;
   }
 
@@ -7178,7 +8819,10 @@ async function verifyCommand(flags, subcommand) {
     if (!envelopeId) throw new Error('Usage: remits-cli verify use <envelopeId>');
     writeActiveVerificationEnvelope(cwd, envelopeId, activeContext);
     console.log('Active verification envelope:', envelopeId);
-    console.log('Context:', 'account=' + accountId + ', branch=' + branchName + ', workspace=' + (workspace || 'shared') + ', dataMode=' + dataMode);
+    printLocalCommandContext(cwd, flags, { accountId, branchName, workspace, dataMode });
+    printLocalStateWarnings(cwd, flags);
+    console.log('Checkout world:', checkoutWorldLine);
+    await printVerificationRunProbe(api, cwd, session, accountId, String(envelopeId), testRunWorld);
     return;
   }
 
@@ -7189,8 +8833,9 @@ async function verifyCommand(flags, subcommand) {
       console.log('All active verification envelope pointers cleared for this checkout.');
     } else {
       writeActiveVerificationEnvelope(cwd, null, activeContext);
-      console.log('Verification envelope cleared for this context.');
-      console.log('Context:', 'account=' + accountId + ', branch=' + branchName + ', workspace=' + (workspace || 'shared') + ', dataMode=' + dataMode);
+      console.log('Verification envelope cleared for this checkout world.');
+      printLocalCommandContext(cwd, flags, { accountId, branchName, workspace, dataMode });
+      console.log('Checkout world:', checkoutWorldLine);
     }
     return;
   }
@@ -7241,7 +8886,15 @@ async function verifyCommand(flags, subcommand) {
     writeLocalVerificationEnvelope(cwd, envelope);
     writeActiveVerificationEnvelope(cwd, envelope.envelopeId, activeContext);
     console.log('Verification envelope started:', envelope.envelopeId);
-    console.log('Target:', 'account=' + accountId + ', branch=' + branchName + ', workspace=' + (workspace || 'shared') + ', dataMode=' + dataMode);
+    printLocalCommandContext(cwd, flags, { accountId, branchName, workspace, dataMode });
+    printLocalStateWarnings(cwd, flags);
+    console.log('Target:', checkoutWorldLine + ', dataMode=' + dataMode +
+      (hasExplicitDataModeFlag(flags) ? '' : '  (verify start default; pass --data-mode prod to prove against production data)'));
+    // Say NOW whether a plain `test run` from here will count - a prod lane or a manifest world elsewhere both
+    // mean it will not - rather than after the first refusal. A PLAIN run: `--data-mode prod` on `verify start`
+    // names the envelope's lane, not the run's. Silent when it attaches.
+    await printVerificationRunProbe(api, cwd, session, accountId, envelope.envelopeId,
+      Object.assign({}, testRunWorld, { dataMode: DEFAULT_DATA_MODE }), { onlyMismatch: true });
     printAcceptanceWarnings(envelope);
     printEnvelopeWarnings(envelope);
     console.log('Local mirror:', verificationPaths(cwd, envelope.envelopeId).base);
@@ -7370,7 +9023,7 @@ async function verifyCommand(flags, subcommand) {
     return await testCommand(Object.assign({}, flags, { 'verify-envelope': envelopeId }));
   }
   if (sub === 'token') {
-    return await tokenCommand(Object.assign({}, flags, { 'verify-envelope': envelopeId }));
+    return await tokenCommand(await verifyWrapperFlags(api, cwd, session, accountId, flags, envelopeId));
   }
   if (sub === 'stage') {
     return await pushComponentsCommand(Object.assign({}, flags, { 'verify-envelope': envelopeId }));
@@ -7379,7 +9032,7 @@ async function verifyCommand(flags, subcommand) {
     return await syncComponentsCommand(Object.assign({}, flags, { 'verify-envelope': envelopeId }));
   }
   if (sub === 'tool') {
-    return await toolCommand(Object.assign({}, flags, { 'verify-envelope': envelopeId }));
+    return await toolCommand(await verifyWrapperFlags(api, cwd, session, accountId, flags, envelopeId));
   }
 
   if (sub === 'invalidate') {
@@ -7411,6 +9064,12 @@ async function verifyCommand(flags, subcommand) {
   if (sub === 'status' || sub === 'report') {
     let statusPacket = null;
     try {
+      // Only attach the status observation when it is from the envelope's world; otherwise it is noise the
+      // report would list as wrong-world evidence on every status check.
+      const statusVerification = await verificationPreflight(api, cwd, session, accountId, { 'verify-envelope': envelopeId }, {
+        packetType: 'component_status',
+        world: { accountId, dataMode, branchName, workspace }
+      }, { command: 'verify status', quiet: true, neverRefuse: true });
       const componentStatus = await loggedPost(api, cwd, '/cli/components', {
         token: session.token,
         accountId,
@@ -7429,22 +9088,16 @@ async function verifyCommand(flags, subcommand) {
         rawRefs: { command: 'components status' },
         componentStatus
       };
-      await appendVerificationPacket(api, cwd, session, accountId, { 'verify-envelope': envelopeId }, statusPacket, { quiet: true });
+      await appendVerificationPacket(api, cwd, session, accountId, statusVerification.evidenceFlags, statusPacket, { quiet: true });
     } catch (err) {
       if (!flagEnabled(flags.json)) {
         console.error('Warning: could not attach component_status packet before rendering report:', describeError(err));
       }
     }
-    const response = await postVerificationCommand(api, cwd, session, accountId, sub, {
-      envelopeId,
-      currentWorld: buildCommandWorld(statusPacket && statusPacket.componentStatus, {
-        accountId,
-        dataMode,
-        branchName,
-        workspace,
-        host: normalizeBaseUrl(baseUrl)
-      })
-    });
+    // No `currentWorld`: status and report judge the SAME world (manifest, else the envelope's start world), so
+    // they cannot give two verdicts on one envelope. Sending the session's world made every --as-account packet
+    // wrong-world under `status` while `report` verified it, and made the verdict depend on the session lane.
+    const response = await postVerificationCommand(api, cwd, session, accountId, sub, { envelopeId });
     if (response.envelope) writeLocalVerificationEnvelope(cwd, response.envelope);
     if (response.report) {
       console.log(response.report);
@@ -8104,7 +9757,10 @@ function detectIssueSignals(repoEntries, globalFiles) {
   }
 
   for (const repo of repoEntries || []) {
-    const sessionLogFile = (repo.files || []).find((file) => file.label === '.remits-cli/session log (tail)');
+    const sessionLogFile = (repo.files || []).find((file) =>
+      file.label === '.remits-cli/active-actor/session log (tail)' ||
+      file.label === '.remits-cli/session log (tail)' ||
+      file.label === '.remits-cli/legacy/session log (tail)');
     if (!sessionLogFile || !sessionLogFile.path || !fs.existsSync(sessionLogFile.path)) {
       continue;
     }
@@ -8300,23 +9956,41 @@ function buildGlobalFileSnapshot() {
 function buildRepoSnapshot(entry) {
   const directory = entry.directory;
   const localPaths = localStatePaths(directory);
+  const actors = listActorDirectories(directory);
   const currentSessionName = fs.existsSync(localPaths.currentSessionFile)
     ? fs.readFileSync(localPaths.currentSessionFile, 'utf8').trim()
     : '';
   const currentSessionLog = currentSessionName
     ? path.join(localPaths.sessionsDir, currentSessionName + '.jsonl')
     : null;
+  const legacySessionName = fs.existsSync(localPaths.legacy.currentSessionFile)
+    ? fs.readFileSync(localPaths.legacy.currentSessionFile, 'utf8').trim()
+    : '';
+  const legacySessionLog = legacySessionName
+    ? path.join(localPaths.legacy.sessionsDir, legacySessionName + '.jsonl')
+    : null;
   const repoFiles = [
     { label: 'account-info.json', path: entry.accountInfoPath || path.join(directory, 'account-info.json'), mode: 'json' },
     { label: 'account-hierarchy.json', path: path.join(directory, 'account-hierarchy.json'), mode: 'json' },
-    { label: '.remits-cli/current-session.txt', path: localPaths.currentSessionFile, mode: 'text' },
-    { label: '.remits-cli/tools/tools.json', path: path.join(localPaths.toolsDir, 'tools.json'), mode: 'json' },
-    { label: '.remits-cli/session log (tail)', path: currentSessionLog, mode: 'tail' }
+    { label: '.remits-cli/active-actor/current-session.txt', path: localPaths.currentSessionFile, mode: 'text' },
+    { label: '.remits-cli/shared/tools/tools.json', path: path.join(localPaths.toolsDir, 'tools.json'), mode: 'json' },
+    { label: '.remits-cli/active-actor/session log (tail)', path: currentSessionLog, mode: 'tail' },
+    { label: '.remits-cli/legacy/current-session.txt', path: localPaths.legacy.currentSessionFile, mode: 'text' },
+    { label: '.remits-cli/legacy/session log (tail)', path: legacySessionLog, mode: 'tail' }
   ];
 
   return {
     ...entry,
     exists: fs.existsSync(directory),
+    localState: {
+      activeActor: localPaths.actor,
+      activeActorDir: localPaths.actorDir,
+      actors,
+      foreignActors: actors.filter((actor) => !actor.current),
+      legacyStatePresent: fs.existsSync(localPaths.legacy.currentSessionFile) ||
+        fs.existsSync(localPaths.legacy.sessionsDir) ||
+        fs.existsSync(localPaths.legacy.toolResponsesDir)
+    },
     files: repoFiles.map((file) => {
       const stat = file.path ? fileStat(file.path) : null;
       let content = null;
@@ -12176,6 +13850,137 @@ function describeRunLocation(record) {
   return parts.join('  ');
 }
 
+async function activityInspectCommand(flags) {
+  const cwd = process.cwd();
+  ensureLocalState(cwd);
+  const sessionContext = resolveSessionContext(cwd, flags);
+  const { session, accountId } = sessionContext;
+  const baseUrl = flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL;
+  const api = buildAxios(baseUrl, session.token, 30000);
+  const response = await loggedPost(api, cwd, '/cli/activityInspect', {
+    token: session.token,
+    accountId,
+    scope: flags.scope || 'self',
+    dataMode: resolveDataMode(flags, session),
+    userId: flags['user-id'] || flags.userId || flags['cli-user-id'],
+    userEmail: flags['user-email'] || flags.email,
+    limit: flags.limit || flags.max || 20,
+    envelopeLimit: flags['envelope-limit'] || flags.envelopeLimit
+  }).then((r) => r.data);
+
+  if (!response.success) throw new Error(response.message || 'Activity inspection failed');
+  if (flagEnabled(flags.json)) {
+    console.log(JSON.stringify(response, null, 2));
+    return response;
+  }
+
+  printSessionResolutionWarning(sessionContext);
+  printResolvedBaseUrl(baseUrl);
+  printActivityInspectSummary(response);
+  return response;
+}
+
+function printActivityInspectSummary(response) {
+  const subject = response.subjectUser
+    ? ' for ' + (response.subjectUser.email || response.subjectUser.name || ('user ' + response.subjectUser.id))
+    : '';
+  console.log('Activity inspection' + subject + ' — ' + response.dataMode + ' lane');
+  console.log('Scope: ' + (response.accountName || ('account ' + response.accountId)) +
+    ' (' + response.accountId + '), ' + (response.scope || 'self') +
+    ' · accounts ' + ((response.accountIds || []).join(', ') || response.accountId));
+  const counts = response.counts || {};
+  console.log('Counts: ' +
+    (counts.agents || 0) + ' agent(s), ' +
+    (counts.lanes || 0) + ' lane(s), ' +
+    (counts.verificationEnvelopes || 0) + ' envelope(s), ' +
+    (counts.testRuns || 0) + ' test run(s), ' +
+    (counts.corpusResults || 0) + ' corpus result(s)');
+
+  const smells = response.smells || [];
+  console.log('');
+  if (!smells.length) {
+    console.log('Smells: none detected in this slice.');
+  } else {
+    console.log('Smells (' + smells.length + '):');
+    smells.slice(0, 20).forEach((smell) => {
+      console.log('  [' + (smell.severity || 'info') + '] ' + (smell.type || 'signal') + ': ' + smell.summary);
+      const pivots = [
+        smell.accountId ? 'account ' + smell.accountId : null,
+        smell.laneId ? 'lane ' + smell.laneId : null,
+        smell.envelopeId ? 'envelope ' + smell.envelopeId : null,
+        smell.taskId ? 'task ' + smell.taskId : null,
+        smell.testName || null,
+        smell.branchName ? 'branch ' + smell.branchName : null,
+        smell.workspace ? 'ws:' + smell.workspace : null
+      ].filter(Boolean);
+      if (pivots.length) console.log('       ' + pivots.join(' · '));
+    });
+    if (smells.length > 20) console.log('  ...' + (smells.length - 20) + ' more; rerun with --json');
+  }
+
+  const lanes = response.lanes || [];
+  if (lanes.length) {
+    console.log('');
+    console.log('Current staging lanes:');
+    lanes.slice(0, 12).forEach((lane) => {
+      const ws = lane.workspace ? ' [ws:' + lane.workspace + ']' : ' [shared]';
+      const workset = lane.worksetKnown && lane.worksetCountAsOf != null
+        ? ' workset ' + lane.worksetCountAsOf
+        : ' workset unknown';
+      console.log('  - account ' + lane.accountId + ' ' + (lane.branchName || '?') + ws +
+        ' overlay ' + (lane.stagedCountAsOf || 0) + workset +
+        (lane.userEmail ? ' · ' + lane.userEmail : '') +
+        (lane.expiresInSeconds != null ? ' · expires ~' + Math.round(lane.expiresInSeconds / 60) + 'm' : ''));
+    });
+    if (lanes.length > 12) console.log('  ...' + (lanes.length - 12) + ' more lane(s)');
+  }
+
+  const envelopes = response.envelopes || [];
+  if (envelopes.length) {
+    console.log('');
+    console.log('Recent verification envelopes:');
+    envelopes.slice(0, 8).forEach((env) => {
+      console.log('  - ' + (env.status || 'unknown') + ' · ' + (env.packetCount || 0) + ' packet(s) · ' +
+        (env.summary || env.envelopeId) + ' · ' + formatTime(env.updatedAtMs || env.lastPacketAtMs || env.createdAt));
+      if (env.currentFailureCount) console.log('      current failures: ' + env.currentFailureCount);
+    });
+  }
+
+  const runs = response.testRuns || [];
+  if (runs.length) {
+    console.log('');
+    console.log('Recent test runs:');
+    runs.slice(0, 8).forEach((run) => {
+      console.log('  - ' + (run.testName || run.taskId) + ' · ' + (run.passed || 0) + '/' + (run.total || 0) +
+        ' passed · ' + (run.branchName || '?') + (run.workspace ? ' [ws:' + run.workspace + ']' : '') +
+        ' · ' + corpusAiLabel(run) + ' · ' + formatTime(run.completedAt || run.startedAt));
+    });
+  }
+
+  const corpus = response.corpusResults || [];
+  if (corpus.length) {
+    console.log('');
+    console.log('Recent corpus measurements:');
+    corpus.slice(0, 6).forEach((row) => {
+      console.log('  - ' + (row.corpus || '?') + '/' + (row.caseKey || '?') + ' · ' +
+        (row.outcome || 'unknown') + ' · ' + (row.testName || row.taskId) +
+        ' · ' + formatTime(row.recordedAt));
+    });
+  }
+
+  const timeline = response.timeline || [];
+  if (timeline.length) {
+    console.log('');
+    console.log('Timeline:');
+    timeline.slice(0, 12).forEach((item) => {
+      console.log('  - ' + formatTime(item.at) + ' · ' + item.type + ' · ' +
+        (item.label || '') + (item.detail ? ' · ' + item.detail : ''));
+    });
+  }
+  console.log('');
+  console.log('Full structured payload: remits-cli activity inspect --json');
+}
+
 /**
  * The live work map: which repositories are being edited, by whom, and who else is around.
  *
@@ -12449,6 +14254,7 @@ async function agentCommand(flags, subcommand) {
     case 'work': return agentWorkCommand(flags);
     case 'list': case 'ls': return agentListCommand(flags);
     case 'map': case 'work-map': case 'workmap': return agentWorkMapCommand(flags);
+    case 'inspect': case 'activity': return activityInspectCommand(flags);
     case 'repos': case 'repo': return agentReposCommand(flags);
     case 'release': case 'deregister': case 'stop': return agentReleaseCommand(flags);
     case 'heartbeat-daemon': return agentHeartbeatDaemonCommand(flags);
@@ -12501,6 +14307,8 @@ function printAgentHelp() {
   console.log('');
   console.log('  list [--account-id ID] [--json]      Who else is available for an account.');
   console.log('  map  [--account-ids 1,4] [--json]    Who is EDITING which repository right now.');
+  console.log('  inspect [--account-id ID] [--scope self|children] [--user-email E] [--json]');
+  console.log('      Read-only workstream story + smell signals for another CLI user or agent fleet.');
   console.log('      One agent at a time may edit an account\'s repo (the edit lease); everyone else');
   console.log('      investigates read-only. Check this before starting work that changes files.');
   console.log('  repos [--rescan] [--json]            WHERE each account is checked out on this machine —');
@@ -13048,6 +14856,8 @@ function printComponentsHelp(subcommand) {
 function printTestHelp() {
   console.log('Usage: remits-cli test run --test <id|name> [--base-url URL] [--branch stagingScope] [--names "a|b"] [--watch true|false] [--data-mode test|prod] [--as-account ID] [--variant-branch NAME|none] [--json]');
   console.log('       remits-cli test status --task-id <taskId> [--base-url URL] [--account-id ID] [--branch stagingScope] [--data-mode test|prod] [--json]');
+  console.log('       remits-cli test runs [--test <id|name>] [--limit 20] [--compare] [--json]   # durable run history');
+  console.log('       remits-cli test compare --base <taskId> --head <taskId> [--json]            # per-case outcome/cost deltas');
   console.log('');
   console.log('Runs a Test component against the staged/variant world for this checkout.');
   console.log('Examples:');
@@ -13065,6 +14875,38 @@ function printTestHelp() {
   console.log('       value with --variant-branch none when existing staged entries would shadow DB rows.');
   console.log('  --json prints only the final status JSON to stdout; banners and progress go to stderr.');
   console.log('  --data-mode prod intentionally targets live production data.');
+  console.log('  Every finished run is recorded durably: test status keeps working after the live status');
+  console.log('       expires, and test runs / test compare read those records.');
+}
+
+
+function printCorpusHelp() {
+  console.log('Usage: remits-cli corpus import --manifest corpus-manifest.json [--corpus <name>] [--as-account ID] [--data-mode test|prod --confirm-prod] [--json]');
+  console.log('       remits-cli corpus cases --corpus <name> [--split dev] [--tag name] [--key caseKey] [--include-values] [--include-retired] [--json]');
+  console.log('       remits-cli corpus results --corpus <name> [--case <caseKey>] [--task-id <taskId>] [--limit 50] [--json]');
+  console.log('       remits-cli corpus runs --corpus <name> [--limit 20] [--json]');
+  console.log('       remits-cli corpus compare --corpus <name> --base <taskId> --head <taskId> [--json]');
+  console.log('       remits-cli corpus consistency --corpus <name> --case <caseKey> [--limit 20] [--json]');
+  console.log('       remits-cli corpus retire --corpus <name> --case <caseKey> [--case ...] [--restore] [--json]');
+  console.log('');
+  console.log('A corpus is a named, durable set of cases an evaluation-style Test runs again and again (front stage:');
+  console.log('corpus(name)). Cases live in a platform table owned by one account and visible to the accounts beneath');
+  console.log('it, whatever the data lane or branch. Case files are stored once as immutable FILE source Objects.');
+  console.log('Measurements are recorded by Test runs and read back with results / runs / compare / consistency.');
+  console.log('');
+  console.log('  - import is idempotent by caseKey: created | updated (with changed keys) | unchanged; identical artifact');
+  console.log('    bytes are not stored twice. Artifacts are created in the --data-mode lane (default test).');
+  console.log('  - Output and session logs carry keys, statuses, hashes, sizes and object ids, never artifact bytes;');
+  console.log('    cases hides expected/source values unless --include-values.');
+  console.log('  - cases filters by --split, repeated/comma-separated --tag/--tags, and --key/--keys before applying --limit.');
+  console.log('  - runs / results / compare label each run AI live, AI MOCKED or no AI. A suite whose AI turns were all');
+  console.log('    replayed from aiMock produces the same outcomes and metrics as a measured one, so read that label');
+  console.log('    before treating a green run as evidence; compare warns when base and head used different AI modes.');
+  console.log('  - retire drops a case from future runs without deleting it: existing measurements stay readable.');
+  console.log('');
+  console.log('Manifest (paths relative to the manifest):');
+  console.log('  {"corpus":"invoice-totals","cases":[{"caseKey":"inv-001","split":"dev","tags":["multi-page"],');
+  console.log('    "expected":{"total":1234.5},"source":{"note":"copied from ..."},"artifacts":[{"name":"source","path":"inv-001.pdf"}]}]}');
 }
 
 function printToolHelp() {
@@ -13105,7 +14947,7 @@ function printVerifyHelp() {
   console.log('Usage: remits-cli verify <subcommand>');
   console.log('');
   console.log('Envelope lifecycle:');
-  console.log('  remits-cli verify start --summary "..." [--manifest file.json] [--ticket ID]');
+  console.log('  remits-cli verify start --summary "..." [--manifest file.json] [--ticket ID] [--data-mode test|prod]');
   console.log('  remits-cli verify list [--max 50] [--json]');
   console.log('  remits-cli verify use <envelopeId>');
   console.log('  remits-cli verify current');
@@ -13115,7 +14957,8 @@ function printVerifyHelp() {
   console.log('  remits-cli verify report [--envelope ID]');
   console.log('  remits-cli verify abandon --envelope ID --reason "..."');
   console.log('  remits-cli verify supersede --envelope ID --superseded-by ID [--reason "..."]');
-  console.log('  Active envelopes are scoped by host, account, branch, workspace, and data mode.');
+  console.log('  One active envelope per checkout world: host, account, git branch, workspace (not data lane).');
+  console.log('  verify start proves in the test lane unless you pass --data-mode prod.');
   console.log('');
   console.log('Manifest and manual evidence:');
   console.log('  remits-cli verify manifest --file file.json [--envelope ID]');
@@ -13131,6 +14974,14 @@ function printVerifyHelp() {
   console.log('  remits-cli verify sync --safe');
   console.log('  remits-cli verify tool --name mcp_tool --input \'{...}\'');
   console.log('');
+  console.log('World check (asked of the platform before stage, test run, token, tool, sync, and commit run):');
+  console.log('  attach  same world as the envelope requires - evidence attaches.');
+  console.log('  refuse  different world AND a requirement could use this evidence - nothing runs; the');
+  console.log('          refusal names the flag that fixes it (e.g. --data-mode prod, --as-account 21).');
+  console.log('  detach  different world, nothing in the manifest could use it - runs, attaches nothing, says so.');
+  console.log('  --allow-wrong-world-evidence attaches anyway as context (the report lists it wrong-world).');
+  console.log('  verify token / verify tool run in the envelope\'s lane when it is test.');
+  console.log('');
   console.log('Existing commands also accept --verify-envelope <id> and --no-verify-envelope.');
 }
 
@@ -13138,6 +14989,7 @@ async function main() {
   migrateSessionIfNeeded();
   const originalArgv = process.argv.slice(2);
   const args = parseArgs(originalArgv);
+  configureLocalActor(args);
   const [command, subcommand] = args._;
   const wantsHelp = args.help === true || subcommand === 'help' || subcommand === '--help' || args._.includes('--help');
   const wantsJson = flagEnabled(args.json);
@@ -13168,7 +15020,7 @@ async function main() {
   try { updateAccountRepoIndex(process.cwd()); } catch (_) { /* not in account repo */ }
   // Auto-start the background service if not already running.
   // Skip for lifecycle subcommands and help.
-  const isLifecycleCmd = command === 'listen' || command === 'start' || command === 'stop' || command === 'status' || command === 'whoami' || command === 'agent' || command === 'ticket';
+  const isLifecycleCmd = command === 'listen' || command === 'start' || command === 'stop' || command === 'status' || command === 'whoami' || command === 'doctor' || command === 'agent' || command === 'ticket';
   const isHelpCmd = !command || command === 'help' || command === '--help' || wantsHelp;
   if (!wantsJson && !isHelpCmd && !isLifecycleCmd && !isListenerRunning()) {
     try {
@@ -13191,7 +15043,7 @@ async function main() {
 
   if (!command || command === 'help' || command === '--help') {
     console.log('Usage: remits-cli <command>');
-    console.log('Global options: --no-auto-update');
+    console.log('Global options: --no-auto-update, --local-agent NAME');
     console.log('  remits-cli auth [--base-url URL] [--account-id ID] [--port 8765] [--data-mode test|prod]');
     console.log('  remits-cli sessions [list|remove] [--account-id ID] [--base-url URL] [--data-mode test|prod]');
     console.log('  remits-cli config [set] [--agent claude|codex|gemini]');
@@ -13200,10 +15052,12 @@ async function main() {
     console.log('  remits-cli agent status [--state idle|working|paused] [--ticket ID] [--activity "..."]');
     console.log('  remits-cli agent list [--account-id ID]                             # who else is available');
     console.log('  remits-cli agent map [--account-ids 1,4] [--json]                   # who is EDITING what, where, right now');
+    console.log('  remits-cli activity inspect [--account-id ID] [--scope self|children] [--user-email E] [--json]');
     console.log('  remits-cli agent release                                            # stop receiving tickets now');
     console.log('  remits-cli start [--foreground true] [--port 8787]                  # human dashboard in the browser');
     console.log('  remits-cli stop');
     console.log('  remits-cli status [--base-url URL] [--account-id ID] [--data-mode test|prod] [--json]');
+    console.log('  remits-cli doctor local-state [--json]                         # actor/workspace/local state hygiene');
     console.log('  remits-cli whoami [--base-url URL] [--account-id ID] [--data-mode test|prod] [--json]');
     console.log('  remits-cli listen [stop|status] [--foreground true]  # compatibility alias');
     console.log('  remits-cli data-mode [set test|prod]');
@@ -13228,6 +15082,10 @@ async function main() {
     console.log('  remits-cli components branch <name> --unsubscribe <accountId>    # return that account to trunk');
     console.log('  remits-cli components branch <name> --retire [--force]           # delete the branch\'s overlays');
     console.log('  remits-cli test run --test <id|name> [--base-url URL] [--branch stagingScope] [--names "a|b"] [--watch true|false] [--data-mode test|prod] [--as-account ID] [--variant-branch NAME|none] [--json]');
+    console.log('  remits-cli test runs [--test <id|name>] [--compare]                 # durable run history; compare latest two');
+    console.log('  remits-cli test compare --base <taskId> --head <taskId>');
+    console.log('  remits-cli corpus import --manifest corpus-manifest.json             # seed a test corpus: cases + artifacts');
+    console.log('  remits-cli corpus runs|results|compare|consistency --corpus <name>   # measurements across Test runs');
     console.log('  remits-cli token [--base-url URL] [--branch BRANCH] [--path embeddable/path] [--data-mode test|prod] [--as-account ID] [--variant-branch NAME|none]');
     console.log('  remits-cli token inspect --token <token|tokenKey|URL> [--base-url URL] [--account-id ID]');
     console.log('');
@@ -13398,6 +15256,11 @@ async function main() {
     return;
   }
 
+  if (command === 'doctor') {
+    await doctorCommand(args, subcommand);
+    return;
+  }
+
   if (command === 'whoami') {
     await whoamiCommand(args);
     return;
@@ -13412,6 +15275,22 @@ async function main() {
     return;
   }
 
+  if (command === 'activity') {
+    if (wantsHelp || !subcommand) {
+      console.log('Usage: remits-cli activity inspect [--account-id ID] [--scope self|children] [--user-id ID|--user-email EMAIL] [--limit N] [--json]');
+      console.log('');
+      console.log('Read-only workstream inspection for agent/operator review. Joins current staging lanes,');
+      console.log('verification envelopes, durable test runs, corpus measurements, live agent presence,');
+      console.log('and heuristic smell signals without changing any lane or checkout.');
+      return;
+    }
+    if (subcommand === 'inspect') {
+      await activityInspectCommand(args);
+      return;
+    }
+    throw new Error('Unknown activity subcommand: ' + subcommand);
+  }
+
   if (command === 'ticket') {
     if (wantsHelp || !subcommand) {
       printTicketHelp();
@@ -13444,6 +15323,23 @@ async function main() {
     await testStatusCommand(args);
     return;
   }
+  if (command === 'test' && (subcommand === 'runs' || subcommand === 'history')) {
+    await testRunsCommand(args);
+    return;
+  }
+  if (command === 'test' && subcommand === 'compare') {
+    await testCompareCommand(args);
+    return;
+  }
+
+  if (command === 'corpus') {
+    if (wantsHelp || !subcommand) {
+      printCorpusHelp();
+      process.exit(0);
+    }
+    await corpusCommand(args, subcommand);
+    return;
+  }
 
   if (command === 'token') {
     await tokenCommand(args);