@remits/remits-cli 0.1.130 → 0.1.132

package/README.md

@@ -45,6 +45,7 @@ remits-cli data-mode
 remits-cli data-mode set prod
 remits-cli sessions list
 remits-cli config set --agent codex
+remits-cli activity inspect --account-id 4 --scope children --data-mode test
 ```
 
 ## Skill Install
@@ -78,6 +79,7 @@ remits-cli install --skills --overwrite true
 - `components lanes` lists every indexed staging lane on the account. `components entries --lane-id <id>` reads the authoritative staged files for one lane without switching your workspace, clearing anything, or using SQL.
 - `components clear` clears staged entries. Scope it with `--component-type` and/or `--component-id`. Component ids are type-local, so an id alone clears that one component when the id is staged in only one family; if the same id is staged across multiple families it returns an ambiguity error asking you to add `--component-type`. With no filter it clears every staged entry for the current branch; pass `--all` to force the full-branch wipe explicitly.
 - `components stage`, `components status`, `components lanes`, `components entries`, and `components clear` print concise summaries by default. Add `--json` or `--verbose` to print the full server response.
+- `activity inspect` is a read-only workstream view for operator/agent review. It joins staging lanes, verification envelopes, Test runs, corpus measurements, live agent presence, and heuristic smell signals. Use `--scope children` from a platform/root account and `--user-email` or `--user-id` to focus on one CLI user.
 - `components stage` and `components status` report three separate numbers, and they answer three different questions: the **workset** (components git reports this working tree changed), what was **submitted**, and the materialized **overlay** the lane now holds — which is what a run resolves. A number that could not be established prints as `unknown`, never as `0`.
 - `components sync` performs a server-side sync from the git remote into the Remits platform for the selected branch. It does not run local git commands. After a successful non-dry-run sync, the platform clears the branch/user staging scope so staged aliases cannot keep shadowing the newly synced DB rows.
 - On trunk, `components sync` performs the full repo-to-DB reconcile. On a non-trunk branch, it writes `ComponentVariant` overlays only and may refresh branch-local `account-info.json`, `account-hierarchy.json`, and `account-configurations.json` for the subscribing account that initiated the sync. `--dry-run` is accepted only for non-trunk variant syncs and reports overrides/additions/tombstones without writing variants, caching the sync SHA, updating metadata, or clearing staging. Add `--summary` to dry-run output when you only need counts, removals/tombstones, errors, skipped items, and warnings. `--force-tombstones` is accepted only for non-trunk variant syncs and should be used only when missing trunk component files are intentional tombstone overrides.

package/index.js

@@ -6,16 +6,16 @@
 - L22  Runtime Bootstrap And Shared State
 - L119  Sessions, Account Resolution, And Production Guards
 - L603  Local State, Workspaces, And Verification Evidence
-- L2018  Account Repos, Guide Sync, And Platform Repo
-- L2676  Component Discovery And HTTP Logging
-- L3252  Skill Delivery And TOC Resolution
-- L3562  Auth And Component Staging
-- L4171  Component Summaries, Status, And Sync Gates
-- L6204  Branches, Promotion, Commit, And Test Runs
-- L7813  Tokens, Tools, Verification, And Config
-- L8943  Service Dashboard And WebSocket Listener
-- L11059  Agent And Ticket Workflows
-- L14117  Help, Auto Update, And Command Dispatch
+- L2155  Account Repos, Guide Sync, And Platform Repo
+- L2813  Component Discovery And HTTP Logging
+- L3389  Skill Delivery And TOC Resolution
+- L3699  Auth And Component Staging
+- L4312  Component Summaries, Status, And Sync Gates
+- L6375  Branches, Promotion, Commit, And Test Runs
+- L8036  Tokens, Tools, Verification, And Config
+- L9251  Service Dashboard And WebSocket Listener
+- L11367  Agent And Ticket Workflows
+- L14559  Help, Auto Update, And Command Dispatch
 */
 
 /*
@@ -1411,13 +1411,36 @@ function verificationPaths(cwd, envelopeId) {
   };
 }
 
+// The active envelope is bound to the checkout world an agent WORKS in: host, account, branch, workspace - the
+// same identity as its staging lane. The data lane is deliberately NOT part of it. Commands resolve their lane
+// differently (`test run` defaults to test; stage/token/tool/sync follow the session), so a lane in this key made
+// one agent see a different envelope - or none - from one command to the next: evidence silently never attached,
+// and `verify report` answered "No verification envelope selected" for the envelope it had just started. Whether
+// a command's lane fits the envelope is the platform's call (`verificationPreflight`), and it is made out loud.
 function verificationContextKey(context = {}) {
   const baseUrl = normalizeBaseUrl(context.baseUrl || context.host || DEFAULT_BASE_URL);
   const accountId = context.accountId != null ? String(context.accountId) : 'unknown-account';
   const branchName = context.branchName || context.branch || 'unknown-branch';
   const workspace = normalizeWorkspace(context.workspace) || 'shared';
-  const dataMode = normalizeDataMode(context.dataMode);
-  return [baseUrl, accountId, branchName, workspace, dataMode].join('|');
+  return [baseUrl, accountId, branchName, workspace].join('|');
+}
+
+// Pointers written while the data lane was still part of the key end in `|test` / `|prod`. They name the same
+// checkout world, so read them (newest first) rather than orphan an envelope an older CLI selected.
+function legacyVerificationContextKeys(key) {
+  return [key + '|test', key + '|prod'];
+}
+
+function activeVerificationContextEntry(contexts, key) {
+  const normalize = (entry) => (typeof entry === 'string' ? { envelopeId: entry } : entry);
+  const current = contexts && contexts[key];
+  if (current) return normalize(current);
+  const legacy = legacyVerificationContextKeys(key)
+    .map((legacyKey) => contexts && contexts[legacyKey])
+    .filter((entry) => entry && (typeof entry === 'string' || entry.envelopeId))
+    .map(normalize)
+    .sort((left, right) => String(right.updatedAt || '').localeCompare(String(left.updatedAt || '')));
+  return legacy[0] || null;
 }
 
 function readActiveVerificationContexts(cwd) {
@@ -1452,11 +1475,8 @@ function activeVerificationContext(cwd, flags = {}, session = null, accountId =
 
 function readActiveVerificationEnvelope(cwd, context = null) {
   if (context) {
-    const contexts = readActiveVerificationContexts(cwd);
-    const entry = contexts[verificationContextKey(context)];
-    if (entry && typeof entry === 'object') return entry.envelopeId || null;
-    if (typeof entry === 'string') return entry || null;
-    return null;
+    const entry = activeVerificationContextEntry(readActiveVerificationContexts(cwd), verificationContextKey(context));
+    return entry && entry.envelopeId ? String(entry.envelopeId) : null;
   }
   const paths = verificationPaths(cwd);
   const candidates = [paths.activeFile, localStatePaths(cwd).legacy.activeVerificationFile];
@@ -1477,6 +1497,7 @@ function writeActiveVerificationEnvelope(cwd, envelopeId, context = null) {
   if (context) {
     const contexts = readActiveVerificationContexts(cwd);
     const key = verificationContextKey(context);
+    legacyVerificationContextKeys(key).forEach((legacyKey) => { delete contexts[legacyKey]; });
     if (!envelopeId) {
       delete contexts[key];
     } else {
@@ -1499,10 +1520,15 @@ function writeActiveVerificationEnvelope(cwd, envelopeId, context = null) {
   return String(envelopeId);
 }
 
+function explicitVerificationEnvelopeId(flags = {}) {
+  const explicit = flags['verify-envelope'] || flags.verifyEnvelope || flags.envelope;
+  return explicit !== undefined && explicit !== null && explicit !== true ? (String(explicit).trim() || null) : null;
+}
+
 function verificationEnvelopeIdForCommand(cwd, flags = {}, context = null) {
   if (flagEnabled(flags['no-verify-envelope']) || flagEnabled(flags.noVerifyEnvelope)) return null;
-  const explicit = flags['verify-envelope'] || flags.verifyEnvelope || flags.envelope;
-  if (explicit !== undefined && explicit !== null && explicit !== true) return String(explicit).trim() || null;
+  const explicit = explicitVerificationEnvelopeId(flags);
+  if (explicit) return explicit;
   return context ? readActiveVerificationEnvelope(cwd, context) : readActiveVerificationEnvelope(cwd);
 }
 
@@ -1511,7 +1537,10 @@ function writeLocalVerificationEnvelope(cwd, envelope) {
   const paths = verificationPaths(cwd, envelope.envelopeId);
   ensureDir(paths.base);
   ensureDir(paths.packetsDir);
-  atomicWriteFile(paths.envelopeFile, JSON.stringify(envelope, null, 2));
+  // Attach and status answer with a PACKETLESS header. Layer it over the mirror instead of replacing it, or the
+  // offline fallback loses the packets and evaluation the last full read stored.
+  const mirrored = Array.isArray(envelope.packets) ? envelope : Object.assign({}, readLocalVerificationEnvelope(cwd, envelope.envelopeId) || {}, envelope);
+  atomicWriteFile(paths.envelopeFile, JSON.stringify(mirrored, null, 2));
   if (envelope.acceptance) {
     atomicWriteFile(paths.manifestFile, JSON.stringify(envelope.acceptance, null, 2));
   }
@@ -1682,27 +1711,133 @@ function syncEvidencePayload(sync) {
   return Object.assign({}, sync, { syncResults: trimmedResults });
 }
 
-// The world an envelope was STARTED in, read the same way the platform reads it
-// (VerificationEnvelopeService.envelopeStartWorld / ENVELOPE_START_WORLD_KEYS). Kept field-for-field identical so
-// the attach-time warning and the verify-time wrong-world verdict can never disagree.
-function envelopeWorldDrift(envelope, context = {}) {
-  if (!envelope || typeof envelope !== 'object') return [];
-  const source = envelope.source && typeof envelope.source === 'object' ? envelope.source : {};
-  const account = envelope.account && typeof envelope.account === 'object' ? envelope.account : {};
-  const started = {
-    'repo account': account.repoAccountId != null ? String(account.repoAccountId) : (envelope.accountId != null ? String(envelope.accountId) : null),
-    'data lane': normalizeDataMode(account.dataMode || source.dataMode) || null,
-    'git branch': source.gitBranch || source.branchName || null,
-    workspace: normalizeWorkspace(source.workspace) || null
-  };
-  const now = {
-    'repo account': context.accountId != null ? String(context.accountId) : null,
-    'data lane': normalizeDataMode(context.dataMode) || null,
-    'git branch': context.branchName || null,
-    workspace: normalizeWorkspace(context.workspace) || null
-  };
-  return Object.keys(started).filter((key) => started[key] && now[key] && started[key] !== now[key])
-    .map((key) => key + ' ' + started[key] + ' -> ' + now[key]);
+// The flag that would put a command into the envelope's world, per mismatched field. Rendering only: WHETHER a
+// field mismatches is the platform's answer (`compatibility`), never recomputed here.
+function verificationWorldHints(diffs = []) {
+  return (Array.isArray(diffs) ? diffs : []).map((diff) => {
+    const expected = diff && diff.expected;
+    if (expected === undefined || expected === null || expected === '') return null;
+    switch (diff.field) {
+      case 'dataMode': return '--data-mode ' + expected;
+      case 'workspace': return '--workspace ' + expected;
+      case 'repoAccountId': return '--account-id ' + expected;
+      case 'accountId': return '--as-account ' + expected;
+      case 'componentBranch':
+      case 'variantBranch': return '--variant-branch ' + expected;
+      case 'gitBranch':
+      case 'branchName': return 'run from git branch ' + expected;
+      default: return null;
+    }
+  }).filter(Boolean);
+}
+
+function verificationDiffSummary(diffs = []) {
+  return (Array.isArray(diffs) ? diffs : []).map((diff) =>
+    diff.field + ': envelope requires ' + diff.expected + ', this command has ' + (diff.command == null ? 'none (shared lane)' : diff.command)).join('; ');
+}
+
+function verificationRefusalLines(result = {}, commandLabel = 'this command') {
+  const lines = [result.message || ('Evidence from ' + commandLabel + ' would not count for verification envelope ' + result.envelopeId + '.')];
+  const hints = verificationWorldHints(result.diffs);
+  lines.push('Nothing ran. Pick one and re-run ' + commandLabel + ':');
+  if (hints.length) lines.push("  - prove it in the envelope's world:  " + hints.join('  '));
+  lines.push('  - run it without recording evidence:  --no-verify-envelope');
+  lines.push('  - it is different work:  remits-cli verify start --summary "..."  (selects a new envelope for this checkout)');
+  lines.push('  - record it anyway as context (reported wrong-world):  --allow-wrong-world-evidence');
+  return lines;
+}
+
+function flagsWithoutVerificationEnvelope(flags = {}) {
+  return Object.assign({}, flags, { 'no-verify-envelope': true });
+}
+
+// Asks the platform - by the evaluator's own world rule - whether evidence from this command would count for the
+// selected envelope, BEFORE the command runs. The CLI used to answer this with its own copy of the rule, which had
+// drifted (shared lane vs a named workspace, the execution account, packet-type exemptions) and so blessed
+// evidence the report then rejected.
+//
+// `probe` is `{ packetType, world, test? }`, with world keys as a packet records them. Resolves to
+// `{ envelopeId, verdict, evidenceFlags }`: pass `evidenceFlags` to every appendVerificationPacket of the command.
+//   attach  - same world: evidence attaches to exactly this envelope (pinned by id, no second lookup).
+//   refuse  - a requirement could use this packet but the world differs: THROWS a refusal, nothing runs.
+//   detach  - differs, but nothing in the manifest could use it (or the envelope is closed): runs, attaches
+//             nothing, and says so once. Refusing there would cost the agent a turn and protect nothing.
+// Idempotent within one invocation: a caller that already asked passes the answer in `__verificationPreflight`.
+async function verificationPreflight(api, cwd, session, accountId, flags = {}, probe = {}, options = {}) {
+  if (flags.__verificationPreflight) return flags.__verificationPreflight;
+  const label = options.command || 'this command';
+  const context = activeVerificationContext(cwd, flags, session, accountId);
+  const envelopeId = verificationEnvelopeIdForCommand(cwd, flags, context);
+  if (!envelopeId) return { envelopeId: null, verdict: 'none', evidenceFlags: flags };
+  const pinned = Object.assign({}, flags, { 'verify-envelope': envelopeId });
+  let result;
+  try {
+    result = await postVerificationCommand(api, cwd, session, accountId, 'compatibility', { envelopeId, probe });
+  } catch (err) {
+    const status = err && err.response && err.response.status;
+    if (status === 404) {
+      if (explicitVerificationEnvelopeId(flags)) {
+        const refusal = new Error('Verification envelope ' + envelopeId + ' does not exist on ' + context.baseUrl +
+          '. Run `remits-cli verify list` to find the right id, or drop --verify-envelope.');
+        refusal.refused = true;
+        throw refusal;
+      }
+      console.error('Verification envelope ' + envelopeId + ' (selected for this checkout) no longer exists; evidence is not attached. ' +
+        'Run `remits-cli verify list`, then `verify use <id>` or `verify start`.');
+      return { envelopeId: null, verdict: 'detach', evidenceFlags: flagsWithoutVerificationEnvelope(flags) };
+    }
+    // A platform without `compatibility`, or one that is unreachable: attach as before. The report still judges
+    // the world; this only loses the early answer.
+    return { envelopeId, verdict: 'unchecked', evidenceFlags: pinned };
+  }
+  const verdict = result.verdict === 'refuse' && options.neverRefuse ? 'detach' : (result.verdict || 'attach');
+  const allowWrongWorld = flagEnabled(flags['allow-wrong-world-evidence']) || flagEnabled(flags.allowWrongWorldEvidence);
+  if (verdict === 'refuse' && !allowWrongWorld) {
+    const refusal = new Error(verificationRefusalLines(result, label).join('\n'));
+    refusal.refused = true;
+    refusal.compatibility = result;
+    throw refusal;
+  }
+  if (verdict === 'refuse') {
+    console.error('Attaching wrong-world evidence as context (--allow-wrong-world-evidence): ' + result.message);
+    return { envelopeId, verdict, compatibility: result, evidenceFlags: pinned };
+  }
+  if (verdict === 'detach') {
+    if (!options.quiet && result.message) {
+      const hints = verificationWorldHints(result.diffs);
+      console.error('Verification: ' + result.message + (hints.length ? ' (It would attach, as context only, with: ' + hints.join('  ') + ')' : ''));
+    }
+    return { envelopeId: null, verdict, compatibility: result, evidenceFlags: flagsWithoutVerificationEnvelope(flags) };
+  }
+  return { envelopeId, verdict, compatibility: result, evidenceFlags: pinned };
+}
+
+// "Would a plain `test run` from this checkout count for this envelope?" - printed where an agent selects or
+// inspects an envelope, so a mismatch is learned before the first run rather than from a refusal after it.
+async function printVerificationRunProbe(api, cwd, session, accountId, envelopeId, world = {}, options = {}) {
+  if (!envelopeId) return null;
+  let result;
+  try {
+    result = await postVerificationCommand(api, cwd, session, accountId, 'compatibility', {
+      envelopeId,
+      probe: { packetType: 'test_run', world }
+    });
+  } catch (_) {
+    return null;
+  }
+  if (options.onlyMismatch && result.verdict === 'attach') return result;
+  if (result.comparisonWorld) {
+    console.log('Proof world (' + (result.comparisonWorldSource || 'unknown') + '):', JSON.stringify(result.comparisonWorld));
+  }
+  if (result.verdict === 'attach') {
+    console.log('A `test run` from this checkout (dataMode=' + (world.dataMode || DEFAULT_DATA_MODE) + ') attaches to this envelope.');
+  } else if (result.verdict === 'refuse' || result.verdict === 'detach') {
+    const hints = verificationWorldHints(result.diffs);
+    console.log('A `test run` from this checkout (dataMode=' + (world.dataMode || DEFAULT_DATA_MODE) + ') would ' +
+      (result.verdict === 'refuse' ? 'be REFUSED' : 'NOT attach') + ' - ' + verificationDiffSummary(result.diffs) + '.');
+    if (hints.length) console.log('  to prove it for this envelope, pass: ' + hints.join('  '));
+  }
+  return result;
 }
 
 async function appendVerificationPacket(api, cwd, session, accountId, flags, packet, options = {}) {
@@ -1720,18 +1855,20 @@ async function appendVerificationPacket(api, cwd, session, accountId, flags, pac
   try {
     const response = await postVerificationCommand(api, cwd, session, accountId, 'packet', {
       envelopeId,
-      packet: finalPacket
+      packet: finalPacket,
+      // Packetless answer: this runs on every command while an envelope is active.
+      compact: true
     });
     if (response.packet) writeLocalVerificationPacket(cwd, envelopeId, response.packet);
     if (response.envelope) writeLocalVerificationEnvelope(cwd, response.envelope);
     if (!options.quiet) {
       console.log('Verification envelope:', envelopeId, '(packet ' + finalPacket.type + ' attached)');
-      // Say it HERE, not only at `verify` time. Evidence attached to an envelope started in a different world
-      // is evidence about a different world, and the reader has to learn that while they can still redo the run.
-      const drift = envelopeWorldDrift(response.envelope, context);
-      if (drift.length) {
-        console.log('  WARNING: this envelope was started in a different world - ' + drift.join('; ') +
-          '. The packet is attached, but it will be reported wrong-world at verify time.');
+      // The platform's own verdict on the stored packet, so this line and `verify report` cannot disagree.
+      const diffs = Array.isArray(response.worldDiffs) ? response.worldDiffs : [];
+      if (diffs.length) {
+        console.log('  WARNING: this packet is from a different world than the envelope requires - ' +
+          diffs.map((diff) => diff.field + ' expected ' + diff.expected + ' got ' + (diff.packet == null ? 'none' : diff.packet)).join('; ') +
+          '. It is attached, but it cannot satisfy a requirement.');
       }
     }
     return response;
@@ -3876,6 +4013,10 @@ async function pushComponentsCommand(flags) {
   // or, worse, conclude staging was broken and go on reading trunk. Scaled by payload size, floored at
   // the old default, and overridable.
   const api = buildAxios(baseUrl, session.token, stageTimeoutMs(components, flags));
+  const verification = await verificationPreflight(api, cwd, session, accountId, flags, {
+    packetType: 'stage',
+    world: { accountId, dataMode, branchName, workspace }
+  }, { command: 'components stage' });
   const stagePayload = {
     token: session.token,
     accountId,
@@ -3919,7 +4060,7 @@ async function pushComponentsCommand(flags) {
     // the platform rejected it. The packet is best-effort: a failing stage must surface the STAGE error,
     // never an error from writing the record of it.
     try {
-      await appendVerificationPacket(api, cwd, session, accountId, flags, {
+      await appendVerificationPacket(api, cwd, session, accountId, verification.evidenceFlags, {
         type: 'stage',
         success: false,
         claim: 'Components refused at staging',
@@ -3956,7 +4097,7 @@ async function pushComponentsCommand(flags) {
     throw new Error(response.message || 'Server stage failed');
   }
 
-  await appendVerificationPacket(api, cwd, session, accountId, flags, {
+  await appendVerificationPacket(api, cwd, session, accountId, verification.evidenceFlags, {
     type: 'stage',
     success: response.success !== false,
     claim: 'Components staged for verification',
@@ -4694,6 +4835,8 @@ function printBranchContext(response) {
       ('this account resolves the branch through an ancestor owned by account ' + ctx.resolvingOwnerAccountId + '.')));
   }
 
+  variantBranchIdentityLines(response).forEach((line) => console.log(line));
+
   if (!ctx.onTrunk) {
     console.log('  variants stored on this branch: ' + (ctx.variantCount || 0));
     const subs = ctx.subscribers || [];
@@ -4707,6 +4850,29 @@ function printBranchContext(response) {
   console.log('');
 }
 
+// A variant branch whose checkout identifies as its OWNER (account-info.json names the owner) runs every command as
+// the owner, and the owner subscribes to nothing — so a feature branch cut from this checkout resolves TRUNK, and no
+// run exercises what the subscriber actually gets. With exactly one subscriber that identity is repairable, and the
+// agent should hear it here rather than infer it from a page that rendered trunk. Pure.
+function variantBranchIdentityLines(response) {
+  const ctx = response && response.branchContext;
+  if (!ctx || ctx.onTrunk || ctx.variantBranchSource === 'subscription-fallback') return [];
+  const subs = Array.isArray(ctx.subscribers) ? ctx.subscribers : [];
+  const checkoutAccountId = response.accountId;
+  if (subs.length !== 1 || checkoutAccountId == null || String(subs[0].accountId) === String(checkoutAccountId)) return [];
+  if (ctx.commitOwnerAccountId != null && String(ctx.commitOwnerAccountId) !== String(checkoutAccountId)) return [];
+  const sub = subs[0];
+  const label = sub.accountId + (sub.accountName ? ' (' + sub.accountName + ')' : '');
+  return [
+    '',
+    '  CHECKOUT IDENTITY: this branch has one subscriber, account ' + label + ', but this checkout runs as the owner,',
+    '  account ' + checkoutAccountId + ' (account-info.json names it). Feature branches cut from here run as ' + checkoutAccountId +
+      ' too, which subscribes to nothing, so they resolve trunk.',
+    '    run as the subscriber:  --as-account ' + sub.accountId,
+    '    repair the identity:    remits-cli components sync --account-id ' + sub.accountId + '   then   git pull --ff-only'
+  ];
+}
+
 function printClearSummary(response, flags) {
   console.log('Cleared keys:', response.clearedCount || 0);
   console.log('Remaining staged count:', response.remainingCount || 0);
@@ -5123,6 +5289,11 @@ async function syncComponentsCommand(rawFlags) {
   const preflightRequested = syncPreflightRequested(flags);
   const namesOnly = flagEnabled(flags['names-only']) || flagEnabled(flags.namesOnly);
 
+  const verification = await verificationPreflight(api, cwd, session, accountId, flags, {
+    packetType: dryRun || namesOnly ? 'sync_dry_run' : 'sync_mutation',
+    world: { accountId, dataMode, branchName, workspace }
+  }, { command: 'components sync' });
+
   printProdDataBanner({
     dataMode,
     accountId,
@@ -5334,7 +5505,7 @@ async function syncComponentsCommand(rawFlags) {
   summary.gates = gate.checks;
   summary.gateViolations = gate.violations;
 
-  await appendVerificationPacket(api, cwd, session, accountId, flags, {
+  await appendVerificationPacket(api, cwd, session, accountId, verification.evidenceFlags, {
     type: response.sync && response.sync.dryRun ? 'sync_dry_run' : 'sync_mutation',
     success: response.success !== false,
     claim: response.sync && response.sync.dryRun ? 'Component sync dry-run observed' : 'Component sync completed',
@@ -6573,7 +6744,7 @@ function shortSignature(signature) {
 async function commitComponentsCommand(flags) {
   const cwd = process.cwd();
   ensureLocalState(cwd);
-  const { accountId } = resolveSessionContext(cwd, flags);
+  const { session, accountId } = resolveSessionContext(cwd, flags);
   const branchName = flags.branch || currentBranch(cwd);
   const commitMessage = String(flags.message || ('remits-cli commit sync ' + new Date().toISOString()));
   const allowEmpty = flags['allow-empty'] === true || flags['allow-empty'] === 'true';
@@ -6586,6 +6757,15 @@ async function commitComponentsCommand(flags) {
   if (await refuseUnsafeTrunkCommitBeforeGit(flags, accountId, branchName, skipGit)) {
     return;
   }
+  // The sync's verification answer, asked BEFORE `git push`. Asked inside the sync it could refuse only after the
+  // push, leaving a pushed-but-unsynced branch - the one state this command exists to avoid. The sync below
+  // reuses this answer instead of asking again.
+  const commitVerification = await verificationPreflight(
+    buildAxios(flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL, session.token),
+    cwd, session, accountId, Object.assign({}, flags, { branch: branchName }), {
+      packetType: 'sync_mutation',
+      world: { accountId, dataMode: resolveDataMode(flags, session), branchName, workspace: resolveWorkspace(cwd, flags) }
+    }, { command: 'components commit' });
 
   // Landing is serial and nothing can make it concurrent: `git add -A` sweeps a shared checkout, and the
   // platform pushes a regenerated `account-info.json` back to the branch during sync, so two commits
@@ -6681,7 +6861,8 @@ async function commitComponentsCommand(flags) {
   const syncResponse = await withStdoutRoutedToStderr(jsonOutput, () => syncComponentsCommand({
     ...flags,
     branch: branchName,
-    'account-id': accountId
+    'account-id': accountId,
+    __verificationPreflight: commitVerification
   }));
   outcome.sync = syncResponse && flagEnabled(flags.summary) ? buildSyncSummary(syncResponse) : (syncResponse || null);
   // Stop here when the sync did not succeed. In --json mode a refused sync gate RETURNS (with a non-zero
@@ -7291,8 +7472,17 @@ function runWorldLines(world, context = {}) {
   if (world.componentOwnerAccountId && world.componentOwnerAccountId !== world.executionAccountId) accounts.push('component owner ' + world.componentOwnerAccountId);
   lines.push('  runs as:         ' + accounts.join(', '));
   lines.push('  data lane:       ' + (world.dataMode || context.dataMode || 'unknown'));
-  const branchSource = world.variantBranchSource ? '  [' + world.variantBranchSource + ']' : '';
-  lines.push('  component world: ' + (world.resolves || (world.componentBranch ? "trunk + the '" + world.componentBranch + "' variant overlays" : 'trunk')) + branchSource);
+  const contextVariantWorld = context.variantWorld && typeof context.variantWorld === 'object' ? context.variantWorld : {};
+  const subscribedComponentBranch = world.subscribedComponentBranch || contextVariantWorld.subscribedComponentBranch;
+  const componentBranch = world.componentBranch || subscribedComponentBranch || contextVariantWorld.componentBranch || world.variantBranch;
+  const branchSource = componentBranch && subscribedComponentBranch && String(componentBranch) === String(subscribedComponentBranch)
+    ? 'subscription'
+    : (world.componentBranchSource || contextVariantWorld.componentBranchSource || world.variantBranchSource || contextVariantWorld.variantBranchSource);
+  const branchLabel = componentBranch
+    ? "componentBranch=" + componentBranch + (branchSource ? ' via ' + branchSource : '')
+    : (branchSource || '');
+  const branchSuffix = branchLabel ? '  [' + branchLabel + ']' : '';
+  lines.push('  component world: ' + (world.resolves || (componentBranch ? "trunk + the '" + componentBranch + "' variant overlays" : 'trunk')) + branchSuffix);
   const laneParts = [world.stagingLane || (world.branchName ? world.branchName + (world.workspace ? ' [ws:' + world.workspace + ']' : '') : 'none')];
   if (world.sharedLane) laneParts.push('(shared lane)');
   if (world.laneContentHash) laneParts.push('content ' + String(world.laneContentHash).slice(0, 12));
@@ -7312,6 +7502,24 @@ function runWorldLines(world, context = {}) {
     lines.push('  test component:  ' + world.testComponentSource + (world.testComponentSignature ? ' ' + shortSignature(world.testComponentSignature) : '') +
       (world.testComponentBranch ? "  variant '" + world.testComponentBranch + "'" : ''));
   }
+  lines.push(...stagedMaskedByVariantLines(world.stagedMaskedByVariant, world.executionAccountId || context.accountId));
+  return lines;
+}
+
+// Staged edits from a TRUNK lane that the execution account will not run, because its branch overrides those
+// components with committed variants. Production behaves the same way (the variant keeps shadowing trunk), so this
+// is drift to report, not a bug to route around. Pure.
+function stagedMaskedByVariantLines(masked, accountId) {
+  if (!Array.isArray(masked) || !masked.length) return [];
+  const lines = ['  NOT RUN FOR THIS ACCOUNT: ' + masked.length + ' staged trunk edit(s) are shadowed by account ' +
+    (accountId || '?') + "'s committed variant, exactly as in production:"];
+  masked.slice(0, 10).forEach((entry) => {
+    lines.push('    - ' + entry.type + ' ' + (entry.componentId != null ? entry.componentId + ' ' : '') + (entry.componentName || '') +
+      "  (variant " + (entry.variantId || '?') + " on '" + entry.branch + "')");
+  });
+  if (masked.length > 10) lines.push('    ...' + (masked.length - 10) + ' more');
+  lines.push("    To change what this account runs, edit the component on its variant branch ('" + masked[0].branch +
+    "') or promote the trunk change to that branch.");
   return lines;
 }
 
@@ -7517,6 +7725,22 @@ async function testCommand(flags) {
   // --variant-branch explicitly probes a committed variant branch. Normally omitted: variants resolve
   // from the account's subscription edge, which is what production does.
   const variantBranch = flags['variant-branch'];
+  // Asked BEFORE the run: a run whose evidence could only fail the envelope's contract is refused here, not
+  // discovered at `verify report` after the minutes it took.
+  const numericTestRef = /^\d+$/.test(String(testRef));
+  const verification = await verificationPreflight(api, cwd, session, accountId, flags, {
+    packetType: 'test_run',
+    world: {
+      accountId,
+      executionAccountId: asAccountId ? Number(asAccountId) : Number(accountId),
+      dataMode,
+      branchName,
+      workspace,
+      componentBranch: variantBranch || undefined
+    },
+    test: numericTestRef ? { testId: Number(testRef) } : { testName: String(testRef) }
+  }, { command: 'test run' });
+  const activeEnvelopeId = verification.envelopeId;
 
   withStdoutRoutedToStderr(jsonOutput, () => {
     printProdDataBanner({
@@ -7561,6 +7785,7 @@ async function testCommand(flags) {
       host: normalizeBaseUrl(baseUrl),
       accountId: asAccountId || accountId,
       dataMode,
+      variantWorld: start.variantWorld,
       gitHead: safeGitValue(cwd, 'git rev-parse HEAD')
     }).forEach((line) => console.log(line));
     console.log('Test run started:', start.taskId);
@@ -7615,8 +7840,6 @@ async function testCommand(flags) {
     process.exitCode = 1;
   }
 
-  const verificationContext = activeVerificationContext(cwd, flags, session, accountId);
-  const activeEnvelopeId = verificationEnvelopeIdForCommand(cwd, flags, verificationContext);
   const componentProvenance = testComponentProvenance(status);
   const sourceRevision = collectVerificationSource(cwd, flags);
   const priorPackets = await readVerificationPacketsForDiagnostics(api, cwd, session, accountId, activeEnvelopeId, {
@@ -7636,7 +7859,7 @@ async function testCommand(flags) {
     });
   }
 
-  await appendVerificationPacket(api, cwd, session, accountId, flags, {
+  await appendVerificationPacket(api, cwd, session, accountId, verification.evidenceFlags, {
     type: 'test_run',
     success: status.status === 'completed' && !(status.result && status.result.failed > 0) && !unmatched.length,
     claim: 'Test run ' + String(testRef),
@@ -7834,6 +8057,18 @@ async function tokenCommand(flags) {
   // Embeddable resolves that account's branch variants rather than the owner's trunk.
   // --variant-branch explicitly probes a committed variant branch before any edge subscribes.
   const variantBranch = flags['variant-branch'];
+  const tokenAsAccountId = flags['as-account'] || flags['as-account-id'];
+  const verification = await verificationPreflight(api, cwd, session, accountId, flags, {
+    packetType: 'token_inspect',
+    world: {
+      accountId,
+      executionAccountId: tokenAsAccountId ? Number(tokenAsAccountId) : Number(accountId),
+      dataMode,
+      branchName,
+      workspace,
+      componentBranch: variantBranch || undefined
+    }
+  }, { command: 'token' });
   // Send the path so the server can also mint the EMBEDDABLE-SCOPED token key. `tokenKey` opens a
   // tokenized URL in a browser; `embedTokenKey` lets the `<script>` embed loader resolve the component
   // from persisted token context because the loader request sends no path.
@@ -7889,6 +8124,11 @@ async function tokenCommand(flags) {
   if (data.resolution) {
     output.resolution = data.resolution;
   }
+  if (Array.isArray(data.stagedMaskedByVariant) && data.stagedMaskedByVariant.length) {
+    output.stagedMaskedByVariant = data.stagedMaskedByVariant;
+    // stderr: stdout is the JSON document. Said before the URL is opened, not discovered from what renders.
+    stagedMaskedByVariantLines(data.stagedMaskedByVariant, data.accountId).forEach((line) => console.error(line.replace(/^  /, '')));
+  }
 
   // Present only when the path resolved to an Embeddable. `embedTokenKey` is what a host site pastes
   // into the loader snippet; the render shape is echoed because it decides what that host receives.
@@ -7909,7 +8149,7 @@ async function tokenCommand(flags) {
   }
   console.log(JSON.stringify(output, null, 2));
 
-  await appendVerificationPacket(api, cwd, session, accountId, flags, {
+  await appendVerificationPacket(api, cwd, session, accountId, verification.evidenceFlags, {
     type: 'token_inspect',
     success: true,
     claim: 'Verification token minted',
@@ -8131,7 +8371,12 @@ async function toolCommand(flags) {
       data.toolMessage = data.toolMessage || toolResultMessage(data.result);
     }
     if (data.status === 'failed' || polledFailed) process.exitCode = 1;
-    await appendVerificationPacket(api, cwd, session, accountId, flags, {
+    // Same question as the call that started it: a poll must not attach where the call itself would not.
+    const statusVerification = await verificationPreflight(api, cwd, session, accountId, flags, {
+      packetType: 'tool_call',
+      world: { accountId: statusAccountId, dataMode: data.dataMode || dataMode, branchName: flags.branch || (stored && stored.branchName) || branchName, workspace: resolveWorkspace(cwd, flags) }
+    }, { command: 'tool status', neverRefuse: true, quiet: jsonOutput });
+    await appendVerificationPacket(api, cwd, session, accountId, statusVerification.evidenceFlags, {
       type: 'tool_call',
       success: data.status !== 'failed' && !polledFailed,
       claim: 'Tool status ' + requestedCallId,
@@ -8171,6 +8416,12 @@ async function toolCommand(flags) {
     stderr: jsonOutput
   });
 
+  const toolWorkspace = resolveWorkspace(cwd, flags);
+  const verification = await verificationPreflight(api, cwd, session, accountId, flags, {
+    packetType: 'tool_call',
+    world: { accountId, dataMode, branchName, workspace: toolWorkspace }
+  }, { command: 'tool --name ' + String(toolName) });
+
   const response = await loggedPost(api, cwd, '/cli/tool', {
     token: session.token,
     accountId,
@@ -8180,7 +8431,7 @@ async function toolCommand(flags) {
     // what the call may discover — has to survive that. The server validates it; it is never authorization.
     scopeRootAccountId: accountId,
     branchName,
-    workspace: resolveWorkspace(cwd, flags),
+    workspace: toolWorkspace,
     dataMode,
     variantBranch,
     name: String(toolName),
@@ -8260,7 +8511,7 @@ async function toolCommand(flags) {
     if (jsonOutput) Object.assign(data, { finalStatus: finalStatus.data });
   }
 
-  await appendVerificationPacket(api, cwd, session, accountId, flags, {
+  await appendVerificationPacket(api, cwd, session, accountId, verification.evidenceFlags, {
     type: 'tool_call',
     success: asyncMode && !waitForAsync ? null : (!toolFailed && (!asyncMode || process.exitCode !== 1)),
     pending: asyncMode && !waitForAsync,
@@ -8478,6 +8729,29 @@ async function corpusCommand(flags, subcommand) {
   return data;
 }
 
+// `verify token` / `verify tool` say "prove this for the envelope", so without an explicit --data-mode they run
+// in the envelope's lane when that lane is TEST. A plain `token`/`tool` follows the session, and a session parked
+// on prod otherwise refuses (or silently detaches) against the test envelope the agent just started. Never
+// adopts PROD: production proof keeps requiring an explicit --data-mode prod, which the refusal names.
+async function verifyWrapperFlags(api, cwd, session, accountId, flags, envelopeId) {
+  const pinned = Object.assign({}, flags, { 'verify-envelope': envelopeId });
+  if (hasExplicitDataModeFlag(flags)) return pinned;
+  try {
+    const result = await postVerificationCommand(api, cwd, session, accountId, 'compatibility', {
+      envelopeId,
+      probe: { packetType: 'manual_observation', world: {} }
+    });
+    const lane = result.comparisonWorld && result.comparisonWorld.dataMode;
+    if (lane && normalizeDataMode(lane) === 'test' && resolveDataMode(flags, session) !== 'test') {
+      console.error('Data lane: test (the lane envelope ' + envelopeId + ' proves; your session is on ' + resolveDataMode(flags, session) + ')');
+      return Object.assign(pinned, { 'data-mode': 'test' });
+    }
+  } catch (_) {
+    // The command's own preflight still answers; this only saves a turn.
+  }
+  return pinned;
+}
+
 async function verifyCommand(flags, subcommand) {
   const cwd = process.cwd();
   ensureLocalState(cwd);
@@ -8486,11 +8760,26 @@ async function verifyCommand(flags, subcommand) {
   const sessionContext = resolveSessionContext(cwd, flags);
   const { session, accountId } = sessionContext;
   const baseUrl = flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL;
-  const dataMode = resolveDataMode(flags, session);
+  // `verify start` proves in the TEST lane unless told otherwise, for the reason `test run` does: production
+  // proof needs explicit provenance. It used to inherit the session's lane, so a session parked on prod started
+  // prod envelopes that every default `test run` then contradicted.
+  const dataMode = sub === 'start' && !hasExplicitDataModeFlag(flags)
+    ? DEFAULT_DATA_MODE
+    : resolveDataMode(flags, session);
   const branchName = flags.branch || currentBranch(cwd);
   const workspace = resolveWorkspace(cwd, flags);
   const api = buildAxios(baseUrl, session.token);
+  // Selection is by checkout world only (no data lane) - see verificationContextKey.
   const activeContext = activeVerificationContext(cwd, flags, session, accountId);
+  const checkoutWorldLine = 'account=' + accountId + ', branch=' + branchName + ', workspace=' + (workspace || 'shared');
+  // What a plain `test run` from here would record, for the "would it count" probe.
+  const testRunWorld = {
+    accountId,
+    executionAccountId: Number(accountId),
+    dataMode: hasExplicitDataModeFlag(flags) ? resolveDataMode(flags, null) : DEFAULT_DATA_MODE,
+    branchName,
+    workspace
+  };
 
   if (sub === 'current') {
     const active = readActiveVerificationEnvelope(cwd, activeContext);
@@ -8498,18 +8787,30 @@ async function verifyCommand(flags, subcommand) {
     printResolvedBaseUrl(baseUrl);
     printLocalCommandContext(cwd, flags, { accountId, branchName, workspace, dataMode });
     printLocalStateWarnings(cwd, flags);
-    console.log('Context:', 'account=' + accountId + ', branch=' + branchName + ', workspace=' + (workspace || 'shared') + ', dataMode=' + dataMode);
+    console.log('Checkout world:', checkoutWorldLine);
     if (!active) {
-      const legacy = readActiveVerificationEnvelope(cwd);
-      console.log('No active verification envelope for this context.');
-      if (legacy) {
-        console.log('Legacy active envelope ignored for this context:', legacy);
+      console.log('No active verification envelope for this checkout world.');
+      // Name the envelopes selected in SIBLING worlds (another workspace/branch of this checkout): the usual
+      // cause is a workspace or branch switch, and "start a new one" is the wrong next step for that.
+      const siblings = Object.values(readActiveVerificationContexts(cwd))
+        .filter((entry) => entry && typeof entry === 'object' && entry.envelopeId && entry.context &&
+          String(entry.context.accountId) === String(accountId))
+        .sort((left, right) => String(right.updatedAt || '').localeCompare(String(left.updatedAt || '')))
+        .filter((entry, index, all) => all.findIndex((other) => other.envelopeId === entry.envelopeId) === index)
+        .slice(0, 3);
+      siblings.forEach((entry) => {
+        console.log('  selected in another world: ' + entry.envelopeId + '  (branch=' + (entry.context.branchName || '?') +
+          ', workspace=' + (entry.context.workspace || 'shared') + ')');
+      });
+      if (siblings.length) {
+        console.log('  Switch back to that workspace/branch, or `remits-cli verify use <id>` to select one here.');
       }
       return;
     }
     console.log('Active verification envelope:', active);
     const local = readLocalVerificationEnvelope(cwd, active);
     if (local && local.summary) console.log('Summary:', local.summary);
+    await printVerificationRunProbe(api, cwd, session, accountId, active, testRunWorld);
     return;
   }
 
@@ -8520,7 +8821,8 @@ async function verifyCommand(flags, subcommand) {
     console.log('Active verification envelope:', envelopeId);
     printLocalCommandContext(cwd, flags, { accountId, branchName, workspace, dataMode });
     printLocalStateWarnings(cwd, flags);
-    console.log('Context:', 'account=' + accountId + ', branch=' + branchName + ', workspace=' + (workspace || 'shared') + ', dataMode=' + dataMode);
+    console.log('Checkout world:', checkoutWorldLine);
+    await printVerificationRunProbe(api, cwd, session, accountId, String(envelopeId), testRunWorld);
     return;
   }
 
@@ -8531,9 +8833,9 @@ async function verifyCommand(flags, subcommand) {
       console.log('All active verification envelope pointers cleared for this checkout.');
     } else {
       writeActiveVerificationEnvelope(cwd, null, activeContext);
-      console.log('Verification envelope cleared for this context.');
+      console.log('Verification envelope cleared for this checkout world.');
       printLocalCommandContext(cwd, flags, { accountId, branchName, workspace, dataMode });
-      console.log('Context:', 'account=' + accountId + ', branch=' + branchName + ', workspace=' + (workspace || 'shared') + ', dataMode=' + dataMode);
+      console.log('Checkout world:', checkoutWorldLine);
     }
     return;
   }
@@ -8586,7 +8888,13 @@ async function verifyCommand(flags, subcommand) {
     console.log('Verification envelope started:', envelope.envelopeId);
     printLocalCommandContext(cwd, flags, { accountId, branchName, workspace, dataMode });
     printLocalStateWarnings(cwd, flags);
-    console.log('Target:', 'account=' + accountId + ', branch=' + branchName + ', workspace=' + (workspace || 'shared') + ', dataMode=' + dataMode);
+    console.log('Target:', checkoutWorldLine + ', dataMode=' + dataMode +
+      (hasExplicitDataModeFlag(flags) ? '' : '  (verify start default; pass --data-mode prod to prove against production data)'));
+    // Say NOW whether a plain `test run` from here will count - a prod lane or a manifest world elsewhere both
+    // mean it will not - rather than after the first refusal. A PLAIN run: `--data-mode prod` on `verify start`
+    // names the envelope's lane, not the run's. Silent when it attaches.
+    await printVerificationRunProbe(api, cwd, session, accountId, envelope.envelopeId,
+      Object.assign({}, testRunWorld, { dataMode: DEFAULT_DATA_MODE }), { onlyMismatch: true });
     printAcceptanceWarnings(envelope);
     printEnvelopeWarnings(envelope);
     console.log('Local mirror:', verificationPaths(cwd, envelope.envelopeId).base);
@@ -8715,7 +9023,7 @@ async function verifyCommand(flags, subcommand) {
     return await testCommand(Object.assign({}, flags, { 'verify-envelope': envelopeId }));
   }
   if (sub === 'token') {
-    return await tokenCommand(Object.assign({}, flags, { 'verify-envelope': envelopeId }));
+    return await tokenCommand(await verifyWrapperFlags(api, cwd, session, accountId, flags, envelopeId));
   }
   if (sub === 'stage') {
     return await pushComponentsCommand(Object.assign({}, flags, { 'verify-envelope': envelopeId }));
@@ -8724,7 +9032,7 @@ async function verifyCommand(flags, subcommand) {
     return await syncComponentsCommand(Object.assign({}, flags, { 'verify-envelope': envelopeId }));
   }
   if (sub === 'tool') {
-    return await toolCommand(Object.assign({}, flags, { 'verify-envelope': envelopeId }));
+    return await toolCommand(await verifyWrapperFlags(api, cwd, session, accountId, flags, envelopeId));
   }
 
   if (sub === 'invalidate') {
@@ -8756,6 +9064,12 @@ async function verifyCommand(flags, subcommand) {
   if (sub === 'status' || sub === 'report') {
     let statusPacket = null;
     try {
+      // Only attach the status observation when it is from the envelope's world; otherwise it is noise the
+      // report would list as wrong-world evidence on every status check.
+      const statusVerification = await verificationPreflight(api, cwd, session, accountId, { 'verify-envelope': envelopeId }, {
+        packetType: 'component_status',
+        world: { accountId, dataMode, branchName, workspace }
+      }, { command: 'verify status', quiet: true, neverRefuse: true });
       const componentStatus = await loggedPost(api, cwd, '/cli/components', {
         token: session.token,
         accountId,
@@ -8774,22 +9088,16 @@ async function verifyCommand(flags, subcommand) {
         rawRefs: { command: 'components status' },
         componentStatus
       };
-      await appendVerificationPacket(api, cwd, session, accountId, { 'verify-envelope': envelopeId }, statusPacket, { quiet: true });
+      await appendVerificationPacket(api, cwd, session, accountId, statusVerification.evidenceFlags, statusPacket, { quiet: true });
     } catch (err) {
       if (!flagEnabled(flags.json)) {
         console.error('Warning: could not attach component_status packet before rendering report:', describeError(err));
       }
     }
-    const response = await postVerificationCommand(api, cwd, session, accountId, sub, {
-      envelopeId,
-      currentWorld: buildCommandWorld(statusPacket && statusPacket.componentStatus, {
-        accountId,
-        dataMode,
-        branchName,
-        workspace,
-        host: normalizeBaseUrl(baseUrl)
-      })
-    });
+    // No `currentWorld`: status and report judge the SAME world (manifest, else the envelope's start world), so
+    // they cannot give two verdicts on one envelope. Sending the session's world made every --as-account packet
+    // wrong-world under `status` while `report` verified it, and made the verdict depend on the session lane.
+    const response = await postVerificationCommand(api, cwd, session, accountId, sub, { envelopeId });
     if (response.envelope) writeLocalVerificationEnvelope(cwd, response.envelope);
     if (response.report) {
       console.log(response.report);
@@ -13542,6 +13850,137 @@ function describeRunLocation(record) {
   return parts.join('  ');
 }
 
+async function activityInspectCommand(flags) {
+  const cwd = process.cwd();
+  ensureLocalState(cwd);
+  const sessionContext = resolveSessionContext(cwd, flags);
+  const { session, accountId } = sessionContext;
+  const baseUrl = flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL;
+  const api = buildAxios(baseUrl, session.token, 30000);
+  const response = await loggedPost(api, cwd, '/cli/activityInspect', {
+    token: session.token,
+    accountId,
+    scope: flags.scope || 'self',
+    dataMode: resolveDataMode(flags, session),
+    userId: flags['user-id'] || flags.userId || flags['cli-user-id'],
+    userEmail: flags['user-email'] || flags.email,
+    limit: flags.limit || flags.max || 20,
+    envelopeLimit: flags['envelope-limit'] || flags.envelopeLimit
+  }).then((r) => r.data);
+
+  if (!response.success) throw new Error(response.message || 'Activity inspection failed');
+  if (flagEnabled(flags.json)) {
+    console.log(JSON.stringify(response, null, 2));
+    return response;
+  }
+
+  printSessionResolutionWarning(sessionContext);
+  printResolvedBaseUrl(baseUrl);
+  printActivityInspectSummary(response);
+  return response;
+}
+
+function printActivityInspectSummary(response) {
+  const subject = response.subjectUser
+    ? ' for ' + (response.subjectUser.email || response.subjectUser.name || ('user ' + response.subjectUser.id))
+    : '';
+  console.log('Activity inspection' + subject + ' — ' + response.dataMode + ' lane');
+  console.log('Scope: ' + (response.accountName || ('account ' + response.accountId)) +
+    ' (' + response.accountId + '), ' + (response.scope || 'self') +
+    ' · accounts ' + ((response.accountIds || []).join(', ') || response.accountId));
+  const counts = response.counts || {};
+  console.log('Counts: ' +
+    (counts.agents || 0) + ' agent(s), ' +
+    (counts.lanes || 0) + ' lane(s), ' +
+    (counts.verificationEnvelopes || 0) + ' envelope(s), ' +
+    (counts.testRuns || 0) + ' test run(s), ' +
+    (counts.corpusResults || 0) + ' corpus result(s)');
+
+  const smells = response.smells || [];
+  console.log('');
+  if (!smells.length) {
+    console.log('Smells: none detected in this slice.');
+  } else {
+    console.log('Smells (' + smells.length + '):');
+    smells.slice(0, 20).forEach((smell) => {
+      console.log('  [' + (smell.severity || 'info') + '] ' + (smell.type || 'signal') + ': ' + smell.summary);
+      const pivots = [
+        smell.accountId ? 'account ' + smell.accountId : null,
+        smell.laneId ? 'lane ' + smell.laneId : null,
+        smell.envelopeId ? 'envelope ' + smell.envelopeId : null,
+        smell.taskId ? 'task ' + smell.taskId : null,
+        smell.testName || null,
+        smell.branchName ? 'branch ' + smell.branchName : null,
+        smell.workspace ? 'ws:' + smell.workspace : null
+      ].filter(Boolean);
+      if (pivots.length) console.log('       ' + pivots.join(' · '));
+    });
+    if (smells.length > 20) console.log('  ...' + (smells.length - 20) + ' more; rerun with --json');
+  }
+
+  const lanes = response.lanes || [];
+  if (lanes.length) {
+    console.log('');
+    console.log('Current staging lanes:');
+    lanes.slice(0, 12).forEach((lane) => {
+      const ws = lane.workspace ? ' [ws:' + lane.workspace + ']' : ' [shared]';
+      const workset = lane.worksetKnown && lane.worksetCountAsOf != null
+        ? ' workset ' + lane.worksetCountAsOf
+        : ' workset unknown';
+      console.log('  - account ' + lane.accountId + ' ' + (lane.branchName || '?') + ws +
+        ' overlay ' + (lane.stagedCountAsOf || 0) + workset +
+        (lane.userEmail ? ' · ' + lane.userEmail : '') +
+        (lane.expiresInSeconds != null ? ' · expires ~' + Math.round(lane.expiresInSeconds / 60) + 'm' : ''));
+    });
+    if (lanes.length > 12) console.log('  ...' + (lanes.length - 12) + ' more lane(s)');
+  }
+
+  const envelopes = response.envelopes || [];
+  if (envelopes.length) {
+    console.log('');
+    console.log('Recent verification envelopes:');
+    envelopes.slice(0, 8).forEach((env) => {
+      console.log('  - ' + (env.status || 'unknown') + ' · ' + (env.packetCount || 0) + ' packet(s) · ' +
+        (env.summary || env.envelopeId) + ' · ' + formatTime(env.updatedAtMs || env.lastPacketAtMs || env.createdAt));
+      if (env.currentFailureCount) console.log('      current failures: ' + env.currentFailureCount);
+    });
+  }
+
+  const runs = response.testRuns || [];
+  if (runs.length) {
+    console.log('');
+    console.log('Recent test runs:');
+    runs.slice(0, 8).forEach((run) => {
+      console.log('  - ' + (run.testName || run.taskId) + ' · ' + (run.passed || 0) + '/' + (run.total || 0) +
+        ' passed · ' + (run.branchName || '?') + (run.workspace ? ' [ws:' + run.workspace + ']' : '') +
+        ' · ' + corpusAiLabel(run) + ' · ' + formatTime(run.completedAt || run.startedAt));
+    });
+  }
+
+  const corpus = response.corpusResults || [];
+  if (corpus.length) {
+    console.log('');
+    console.log('Recent corpus measurements:');
+    corpus.slice(0, 6).forEach((row) => {
+      console.log('  - ' + (row.corpus || '?') + '/' + (row.caseKey || '?') + ' · ' +
+        (row.outcome || 'unknown') + ' · ' + (row.testName || row.taskId) +
+        ' · ' + formatTime(row.recordedAt));
+    });
+  }
+
+  const timeline = response.timeline || [];
+  if (timeline.length) {
+    console.log('');
+    console.log('Timeline:');
+    timeline.slice(0, 12).forEach((item) => {
+      console.log('  - ' + formatTime(item.at) + ' · ' + item.type + ' · ' +
+        (item.label || '') + (item.detail ? ' · ' + item.detail : ''));
+    });
+  }
+  console.log('');
+  console.log('Full structured payload: remits-cli activity inspect --json');
+}
+
 /**
  * The live work map: which repositories are being edited, by whom, and who else is around.
  *
@@ -13815,6 +14254,7 @@ async function agentCommand(flags, subcommand) {
     case 'work': return agentWorkCommand(flags);
     case 'list': case 'ls': return agentListCommand(flags);
     case 'map': case 'work-map': case 'workmap': return agentWorkMapCommand(flags);
+    case 'inspect': case 'activity': return activityInspectCommand(flags);
     case 'repos': case 'repo': return agentReposCommand(flags);
     case 'release': case 'deregister': case 'stop': return agentReleaseCommand(flags);
     case 'heartbeat-daemon': return agentHeartbeatDaemonCommand(flags);
@@ -13867,6 +14307,8 @@ function printAgentHelp() {
   console.log('');
   console.log('  list [--account-id ID] [--json]      Who else is available for an account.');
   console.log('  map  [--account-ids 1,4] [--json]    Who is EDITING which repository right now.');
+  console.log('  inspect [--account-id ID] [--scope self|children] [--user-email E] [--json]');
+  console.log('      Read-only workstream story + smell signals for another CLI user or agent fleet.');
   console.log('      One agent at a time may edit an account\'s repo (the edit lease); everyone else');
   console.log('      investigates read-only. Check this before starting work that changes files.');
   console.log('  repos [--rescan] [--json]            WHERE each account is checked out on this machine —');
@@ -14505,7 +14947,7 @@ function printVerifyHelp() {
   console.log('Usage: remits-cli verify <subcommand>');
   console.log('');
   console.log('Envelope lifecycle:');
-  console.log('  remits-cli verify start --summary "..." [--manifest file.json] [--ticket ID]');
+  console.log('  remits-cli verify start --summary "..." [--manifest file.json] [--ticket ID] [--data-mode test|prod]');
   console.log('  remits-cli verify list [--max 50] [--json]');
   console.log('  remits-cli verify use <envelopeId>');
   console.log('  remits-cli verify current');
@@ -14515,7 +14957,8 @@ function printVerifyHelp() {
   console.log('  remits-cli verify report [--envelope ID]');
   console.log('  remits-cli verify abandon --envelope ID --reason "..."');
   console.log('  remits-cli verify supersede --envelope ID --superseded-by ID [--reason "..."]');
-  console.log('  Active envelopes are scoped by host, account, branch, workspace, and data mode.');
+  console.log('  One active envelope per checkout world: host, account, git branch, workspace (not data lane).');
+  console.log('  verify start proves in the test lane unless you pass --data-mode prod.');
   console.log('');
   console.log('Manifest and manual evidence:');
   console.log('  remits-cli verify manifest --file file.json [--envelope ID]');
@@ -14531,6 +14974,14 @@ function printVerifyHelp() {
   console.log('  remits-cli verify sync --safe');
   console.log('  remits-cli verify tool --name mcp_tool --input \'{...}\'');
   console.log('');
+  console.log('World check (asked of the platform before stage, test run, token, tool, sync, and commit run):');
+  console.log('  attach  same world as the envelope requires - evidence attaches.');
+  console.log('  refuse  different world AND a requirement could use this evidence - nothing runs; the');
+  console.log('          refusal names the flag that fixes it (e.g. --data-mode prod, --as-account 21).');
+  console.log('  detach  different world, nothing in the manifest could use it - runs, attaches nothing, says so.');
+  console.log('  --allow-wrong-world-evidence attaches anyway as context (the report lists it wrong-world).');
+  console.log('  verify token / verify tool run in the envelope\'s lane when it is test.');
+  console.log('');
   console.log('Existing commands also accept --verify-envelope <id> and --no-verify-envelope.');
 }
 
@@ -14601,6 +15052,7 @@ async function main() {
     console.log('  remits-cli agent status [--state idle|working|paused] [--ticket ID] [--activity "..."]');
     console.log('  remits-cli agent list [--account-id ID]                             # who else is available');
     console.log('  remits-cli agent map [--account-ids 1,4] [--json]                   # who is EDITING what, where, right now');
+    console.log('  remits-cli activity inspect [--account-id ID] [--scope self|children] [--user-email E] [--json]');
     console.log('  remits-cli agent release                                            # stop receiving tickets now');
     console.log('  remits-cli start [--foreground true] [--port 8787]                  # human dashboard in the browser');
     console.log('  remits-cli stop');
@@ -14823,6 +15275,22 @@ async function main() {
     return;
   }
 
+  if (command === 'activity') {
+    if (wantsHelp || !subcommand) {
+      console.log('Usage: remits-cli activity inspect [--account-id ID] [--scope self|children] [--user-id ID|--user-email EMAIL] [--limit N] [--json]');
+      console.log('');
+      console.log('Read-only workstream inspection for agent/operator review. Joins current staging lanes,');
+      console.log('verification envelopes, durable test runs, corpus measurements, live agent presence,');
+      console.log('and heuristic smell signals without changing any lane or checkout.');
+      return;
+    }
+    if (subcommand === 'inspect') {
+      await activityInspectCommand(args);
+      return;
+    }
+    throw new Error('Unknown activity subcommand: ' + subcommand);
+  }
+
   if (command === 'ticket') {
     if (wantsHelp || !subcommand) {
       printTicketHelp();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remits/remits-cli",
-  "version": "0.1.130",
+  "version": "0.1.132",
   "description": "Local CLI for auth, component sync, and live test execution against Remits",
   "license": "MIT",
   "private": false,

package/skills/remits-cli/references/branch-variants.md

@@ -170,8 +170,9 @@ resolves `X`.
 
 **Subscribing to a branch and resolving through it are different facts.** An account subscribes on an
 edge; a *request* resolves through that edge only when something named the path (`--as-account`, the
-edge's own host, an explicit `--variant-branch`). An account with no `parentId` and several upward links
-resolves trunk by design — the resolver refuses to guess a path. So this is a normal, explainable state:
+edge's own host, an explicit `--variant-branch`), or when its links leave no doubt — a single upward link, or
+several with exactly one carrying a branch, which every account beneath it inherits too. An account whose
+several links carry several branches refuses to guess a path. So this is a normal, explainable state:
 
 ```
 "componentBranch": null,              // this token resolves TRUNK
@@ -421,9 +422,14 @@ a confirm-gated override when the removal guard refuses. Preview there is the sa
 - A test/tool response reports `testComponentSource` as `staged` | `variant` | `db`, so you can see which
   layer the run resolved without reading logs.
 
-> **A populated staging cache makes a variant look broken.** Anything carrying a CLI `TestMode` — a
+> **A trunk lane never overrides a variant.** Staged edits from your account's trunk branch do not reach an
+> account whose branch overrides that component — production behaves the same way — so `test run` and `token`
+> list them under **NOT RUN FOR THIS ACCOUNT** (`stagedMaskedByVariant`). To change what that account runs, edit
+> the component on its variant branch.
+>
+> **A populated NON-trunk staging lane makes a variant look broken.** Anything carrying a CLI `TestMode` — a
 > `remits-cli token` URL, `/s/<tokenKey>/...`, an `X-Auth-Token` request, a script-loader embed — resolves
-> the STAGED layer, which outranks the variant. So with components staged under the same branch/user, a
+> a variant-branch or feature-branch lane's STAGED layer, which outranks the variant. So with components staged under the same branch/user, a
 > tokenized page reports `Component Branch: <branch>` but `Variant Applied: none` and renders trunk, while
 > an anonymous `?account_id=` request to the same page reports the variant. That is the documented
 > precedence (staged -> variant -> trunk) working correctly, and it reads exactly like "tokens break

package/skills/remits-cli/references/command-reference.md

@@ -173,6 +173,8 @@ remits-cli agent work [--wait SECONDS] [--json]
 remits-cli agent status [--state idle|working|paused] [--ticket ID] [--activity "..."] [--step "..."]
 remits-cli agent list [--account-id ID] [--json]
 remits-cli agent map [--account-ids 1,4] [--json]       # who is EDITING which repository, from which checkout/branch/staging lane
+remits-cli agent inspect [--account-id ID] [--scope self|children] [--user-id ID|--user-email EMAIL] [--limit N] [--json]
+remits-cli activity inspect [--account-id ID] [--scope self|children] [--user-id ID|--user-email EMAIL] [--limit N] [--json]
 remits-cli agent release
 remits-cli ticket read|accept|status|progress|complete|release|reopen|assign|planning --ticket ID [--status S] [--resolution "..."] [--summary "..."] [--category C] [--assignee EMAIL] [--workstream VALUE] [--planned-in VALUE] [--board-stage VALUE] [--rank N] [--size VALUE] [--blocked-by VALUE] [--notes "..."]
 remits-cli ticket lease|unlease|force-unlease --ticket ID [--reason "..."]   # force-unlease breaks SOMEBODY ELSE'S lease; operator only
@@ -236,7 +238,7 @@ remits-cli token inspect --token <token|tokenKey|URL>                  # inspect
 remits-cli tools [--branch <name>] [--data-mode test|prod] [--variant-branch <name|none>]
 remits-cli tool --name <toolName> [--branch <name>] [--input "{...}"] [--data-mode test|prod] [--variant-branch <name|none>] [--timeout-ms 60000] [--async true --wait true]
 remits-cli tool status --call-id <callId> [--data-mode test|prod]
-remits-cli verify start --summary "..." [--manifest file.json] [--ticket ID]
+remits-cli verify start --summary "..." [--manifest file.json] [--ticket ID] [--data-mode test|prod]   # default: test
 remits-cli verify list [--max 50] [--json]
 remits-cli verify use <envelopeId>
 remits-cli verify current
@@ -261,6 +263,30 @@ remits-cli verify abandon --envelope ID --reason "..."
 remits-cli verify supersede --envelope ID --superseded-by <envelopeId> [--reason "..."]
 ```
 
+### Activity inspection
+
+`remits-cli activity inspect` is a read-only operator view for understanding an agent or account
+workstream without touching a checkout or staging lane. It joins the current staging-lane registry,
+verification envelopes, durable Test runs, corpus measurements, and live CLI agent presence, then adds
+heuristic smell signals such as shared lanes, broad overlays, retained staged entries, unfinished
+verification, current evidence failures, repeated test failures, corpus failures, and tests that were run
+outside a verification envelope.
+
+Use it from the platform repo when a remote agent fleet is looping or a human reports that work is going
+around in circles:
+
+```bash
+remits-cli activity inspect --account-id 4 --scope children --data-mode test
+remits-cli activity inspect --account-id 4 --scope children --user-email jason@example.com --json
+remits-cli agent inspect --account-id 1742 --limit 50
+```
+
+`--scope children` expands from the selected account to its hierarchy children, which is usually the right
+shape for platform-level review. `--user-id` / `--user-email` filters the stream to one CLI user when the
+platform can identify them from staged lanes, envelopes, tests, or live agent registration. `--json`
+returns the full structured payload for deeper analysis; the text view is intentionally compact and
+human-readable.
+
 ### Verification envelopes
 
 Use a verification envelope for workflow-shaped work: concrete user journeys, browser-facing changes,

package/skills/remits-cli/references/development-loop.md

@@ -84,6 +84,25 @@ command world. While active, `components stage`, `components status`, `test run`
 `--verify-envelope <id>` to name one explicitly or `--no-verify-envelope` when a command should not be
 attached.
 
+`verify start` proves in the **test** lane unless you pass `--data-mode prod` (your session's lane does not
+decide it). One envelope is active per checkout world (host, account, git branch, workspace); the data lane
+is not part of that selection.
+
+Before stage, test run, token, tool, sync or commit runs, the CLI asks the platform whether its evidence
+would count for the active envelope:
+
+- **attach**: same world, so the evidence attaches.
+- **refuse**: different world and a required evidence item could use this packet. Nothing ran, and the
+  refusal names the fix (`--data-mode prod`, `--as-account 21`, `--workspace x`, ...). Apply the fix that
+  matches your intent. Use `--no-verify-envelope` when the run is not meant as proof, or `verify start` when
+  it is different work. `--allow-wrong-world-evidence` only records context; that evidence never satisfies
+  anything.
+- **detach**: different world and nothing in the manifest could use it. The command runs and one line says
+  nothing was attached.
+
+`verify current` / `verify use` print whether a plain `test run` from this checkout would attach, so you can
+catch a mismatch before the first run.
+
 Use the wrappers when you want the intent to be unmistakable:
 
 ```bash

package/skills/remits-cli/references/tool-reference.md

@@ -237,9 +237,10 @@ client accounts beneath it:
 > is a fully supported shape: it resolves the branch, **and so do all of its descendants**. You do not need
 > to make the subscriber a structural child of its owner.
 >
-> What is NOT resolved by default is genuine **ambiguity** — an account with *several* upward links, where
-> the platform refuses to guess which product it was reached through. That account (and its descendants)
-> resolve trunk until a request names the path: `--as-account`, `--variant-branch`, or the edge's own host.
+> Several upward links are fine when exactly one carries the branch: the account and its descendants roll up
+> through that subscription. What is NOT resolved by default is genuine **ambiguity** — several links and no
+> single subscription among them. That account (and its descendants) resolve nothing above it until a request
+> names the path: `--as-account`, `--variant-branch`, or the edge's own host.
 > An account that has a `parentId` **and** a separate membership edge carrying the branch is this case: the
 > `parentId` wins, so put the branch on the link the account actually inherits through.
 >