@remits/remits-cli 0.1.130 → 0.1.133

package/index.js

@@ -6,16 +6,16 @@
 - L22  Runtime Bootstrap And Shared State
 - L119  Sessions, Account Resolution, And Production Guards
 - L603  Local State, Workspaces, And Verification Evidence
-- L2018  Account Repos, Guide Sync, And Platform Repo
-- L2676  Component Discovery And HTTP Logging
-- L3252  Skill Delivery And TOC Resolution
-- L3562  Auth And Component Staging
-- L4171  Component Summaries, Status, And Sync Gates
-- L6204  Branches, Promotion, Commit, And Test Runs
-- L7813  Tokens, Tools, Verification, And Config
-- L8943  Service Dashboard And WebSocket Listener
-- L11059  Agent And Ticket Workflows
-- L14117  Help, Auto Update, And Command Dispatch
+- L2255  Account Repos, Guide Sync, And Platform Repo
+- L2949  Component Discovery And HTTP Logging
+- L3525  Skill Delivery And TOC Resolution
+- L3835  Auth And Component Staging
+- L4449  Component Summaries, Status, And Sync Gates
+- L6518  Branches, Promotion, Commit, And Test Runs
+- L8183  Tokens, Tools, Verification, And Config
+- L9405  Service Dashboard And WebSocket Listener
+- L11521  Agent And Ticket Workflows
+- L14815  Help, Auto Update, And Command Dispatch
 */
 
 /*
@@ -1411,13 +1411,36 @@ function verificationPaths(cwd, envelopeId) {
   };
 }
 
+// The active envelope is bound to the checkout world an agent WORKS in: host, account, branch, workspace - the
+// same identity as its staging lane. The data lane is deliberately NOT part of it. Commands resolve their lane
+// differently (`test run` defaults to test; stage/token/tool/sync follow the session), so a lane in this key made
+// one agent see a different envelope - or none - from one command to the next: evidence silently never attached,
+// and `verify report` answered "No verification envelope selected" for the envelope it had just started. Whether
+// a command's lane fits the envelope is the platform's call (`verificationPreflight`), and it is made out loud.
 function verificationContextKey(context = {}) {
   const baseUrl = normalizeBaseUrl(context.baseUrl || context.host || DEFAULT_BASE_URL);
   const accountId = context.accountId != null ? String(context.accountId) : 'unknown-account';
   const branchName = context.branchName || context.branch || 'unknown-branch';
   const workspace = normalizeWorkspace(context.workspace) || 'shared';
-  const dataMode = normalizeDataMode(context.dataMode);
-  return [baseUrl, accountId, branchName, workspace, dataMode].join('|');
+  return [baseUrl, accountId, branchName, workspace].join('|');
+}
+
+// Pointers written while the data lane was still part of the key end in `|test` / `|prod`. They name the same
+// checkout world, so read them (newest first) rather than orphan an envelope an older CLI selected.
+function legacyVerificationContextKeys(key) {
+  return [key + '|test', key + '|prod'];
+}
+
+function activeVerificationContextEntry(contexts, key) {
+  const normalize = (entry) => (typeof entry === 'string' ? { envelopeId: entry } : entry);
+  const current = contexts && contexts[key];
+  if (current) return normalize(current);
+  const legacy = legacyVerificationContextKeys(key)
+    .map((legacyKey) => contexts && contexts[legacyKey])
+    .filter((entry) => entry && (typeof entry === 'string' || entry.envelopeId))
+    .map(normalize)
+    .sort((left, right) => String(right.updatedAt || '').localeCompare(String(left.updatedAt || '')));
+  return legacy[0] || null;
 }
 
 function readActiveVerificationContexts(cwd) {
@@ -1452,11 +1475,8 @@ function activeVerificationContext(cwd, flags = {}, session = null, accountId =
 
 function readActiveVerificationEnvelope(cwd, context = null) {
   if (context) {
-    const contexts = readActiveVerificationContexts(cwd);
-    const entry = contexts[verificationContextKey(context)];
-    if (entry && typeof entry === 'object') return entry.envelopeId || null;
-    if (typeof entry === 'string') return entry || null;
-    return null;
+    const entry = activeVerificationContextEntry(readActiveVerificationContexts(cwd), verificationContextKey(context));
+    return entry && entry.envelopeId ? String(entry.envelopeId) : null;
   }
   const paths = verificationPaths(cwd);
   const candidates = [paths.activeFile, localStatePaths(cwd).legacy.activeVerificationFile];
@@ -1477,6 +1497,7 @@ function writeActiveVerificationEnvelope(cwd, envelopeId, context = null) {
   if (context) {
     const contexts = readActiveVerificationContexts(cwd);
     const key = verificationContextKey(context);
+    legacyVerificationContextKeys(key).forEach((legacyKey) => { delete contexts[legacyKey]; });
     if (!envelopeId) {
       delete contexts[key];
     } else {
@@ -1499,10 +1520,15 @@ function writeActiveVerificationEnvelope(cwd, envelopeId, context = null) {
   return String(envelopeId);
 }
 
+function explicitVerificationEnvelopeId(flags = {}) {
+  const explicit = flags['verify-envelope'] || flags.verifyEnvelope || flags.envelope;
+  return explicit !== undefined && explicit !== null && explicit !== true ? (String(explicit).trim() || null) : null;
+}
+
 function verificationEnvelopeIdForCommand(cwd, flags = {}, context = null) {
   if (flagEnabled(flags['no-verify-envelope']) || flagEnabled(flags.noVerifyEnvelope)) return null;
-  const explicit = flags['verify-envelope'] || flags.verifyEnvelope || flags.envelope;
-  if (explicit !== undefined && explicit !== null && explicit !== true) return String(explicit).trim() || null;
+  const explicit = explicitVerificationEnvelopeId(flags);
+  if (explicit) return explicit;
   return context ? readActiveVerificationEnvelope(cwd, context) : readActiveVerificationEnvelope(cwd);
 }
 
@@ -1511,7 +1537,10 @@ function writeLocalVerificationEnvelope(cwd, envelope) {
   const paths = verificationPaths(cwd, envelope.envelopeId);
   ensureDir(paths.base);
   ensureDir(paths.packetsDir);
-  atomicWriteFile(paths.envelopeFile, JSON.stringify(envelope, null, 2));
+  // Attach and status answer with a PACKETLESS header. Layer it over the mirror instead of replacing it, or the
+  // offline fallback loses the packets and evaluation the last full read stored.
+  const mirrored = Array.isArray(envelope.packets) ? envelope : Object.assign({}, readLocalVerificationEnvelope(cwd, envelope.envelopeId) || {}, envelope);
+  atomicWriteFile(paths.envelopeFile, JSON.stringify(mirrored, null, 2));
   if (envelope.acceptance) {
     atomicWriteFile(paths.manifestFile, JSON.stringify(envelope.acceptance, null, 2));
   }
@@ -1682,27 +1711,133 @@ function syncEvidencePayload(sync) {
   return Object.assign({}, sync, { syncResults: trimmedResults });
 }
 
-// The world an envelope was STARTED in, read the same way the platform reads it
-// (VerificationEnvelopeService.envelopeStartWorld / ENVELOPE_START_WORLD_KEYS). Kept field-for-field identical so
-// the attach-time warning and the verify-time wrong-world verdict can never disagree.
-function envelopeWorldDrift(envelope, context = {}) {
-  if (!envelope || typeof envelope !== 'object') return [];
-  const source = envelope.source && typeof envelope.source === 'object' ? envelope.source : {};
-  const account = envelope.account && typeof envelope.account === 'object' ? envelope.account : {};
-  const started = {
-    'repo account': account.repoAccountId != null ? String(account.repoAccountId) : (envelope.accountId != null ? String(envelope.accountId) : null),
-    'data lane': normalizeDataMode(account.dataMode || source.dataMode) || null,
-    'git branch': source.gitBranch || source.branchName || null,
-    workspace: normalizeWorkspace(source.workspace) || null
-  };
-  const now = {
-    'repo account': context.accountId != null ? String(context.accountId) : null,
-    'data lane': normalizeDataMode(context.dataMode) || null,
-    'git branch': context.branchName || null,
-    workspace: normalizeWorkspace(context.workspace) || null
-  };
-  return Object.keys(started).filter((key) => started[key] && now[key] && started[key] !== now[key])
-    .map((key) => key + ' ' + started[key] + ' -> ' + now[key]);
+// The flag that would put a command into the envelope's world, per mismatched field. Rendering only: WHETHER a
+// field mismatches is the platform's answer (`compatibility`), never recomputed here.
+function verificationWorldHints(diffs = []) {
+  return (Array.isArray(diffs) ? diffs : []).map((diff) => {
+    const expected = diff && diff.expected;
+    if (expected === undefined || expected === null || expected === '') return null;
+    switch (diff.field) {
+      case 'dataMode': return '--data-mode ' + expected;
+      case 'workspace': return '--workspace ' + expected;
+      case 'repoAccountId': return '--account-id ' + expected;
+      case 'accountId': return '--as-account ' + expected;
+      case 'componentBranch':
+      case 'variantBranch': return '--variant-branch ' + expected;
+      case 'gitBranch':
+      case 'branchName': return 'run from git branch ' + expected;
+      default: return null;
+    }
+  }).filter(Boolean);
+}
+
+function verificationDiffSummary(diffs = []) {
+  return (Array.isArray(diffs) ? diffs : []).map((diff) =>
+    diff.field + ': envelope requires ' + diff.expected + ', this command has ' + (diff.command == null ? 'none (shared lane)' : diff.command)).join('; ');
+}
+
+function verificationRefusalLines(result = {}, commandLabel = 'this command') {
+  const lines = [result.message || ('Evidence from ' + commandLabel + ' would not count for verification envelope ' + result.envelopeId + '.')];
+  const hints = verificationWorldHints(result.diffs);
+  lines.push('Nothing ran. Pick one and re-run ' + commandLabel + ':');
+  if (hints.length) lines.push("  - prove it in the envelope's world:  " + hints.join('  '));
+  lines.push('  - run it without recording evidence:  --no-verify-envelope');
+  lines.push('  - it is different work:  remits-cli verify start --summary "..."  (selects a new envelope for this checkout)');
+  lines.push('  - record it anyway as context (reported wrong-world):  --allow-wrong-world-evidence');
+  return lines;
+}
+
+function flagsWithoutVerificationEnvelope(flags = {}) {
+  return Object.assign({}, flags, { 'no-verify-envelope': true });
+}
+
+// Asks the platform - by the evaluator's own world rule - whether evidence from this command would count for the
+// selected envelope, BEFORE the command runs. The CLI used to answer this with its own copy of the rule, which had
+// drifted (shared lane vs a named workspace, the execution account, packet-type exemptions) and so blessed
+// evidence the report then rejected.
+//
+// `probe` is `{ packetType, world, test? }`, with world keys as a packet records them. Resolves to
+// `{ envelopeId, verdict, evidenceFlags }`: pass `evidenceFlags` to every appendVerificationPacket of the command.
+//   attach  - same world: evidence attaches to exactly this envelope (pinned by id, no second lookup).
+//   refuse  - a requirement could use this packet but the world differs: THROWS a refusal, nothing runs.
+//   detach  - differs, but nothing in the manifest could use it (or the envelope is closed): runs, attaches
+//             nothing, and says so once. Refusing there would cost the agent a turn and protect nothing.
+// Idempotent within one invocation: a caller that already asked passes the answer in `__verificationPreflight`.
+async function verificationPreflight(api, cwd, session, accountId, flags = {}, probe = {}, options = {}) {
+  if (flags.__verificationPreflight) return flags.__verificationPreflight;
+  const label = options.command || 'this command';
+  const context = activeVerificationContext(cwd, flags, session, accountId);
+  const envelopeId = verificationEnvelopeIdForCommand(cwd, flags, context);
+  if (!envelopeId) return { envelopeId: null, verdict: 'none', evidenceFlags: flags };
+  const pinned = Object.assign({}, flags, { 'verify-envelope': envelopeId });
+  let result;
+  try {
+    result = await postVerificationCommand(api, cwd, session, accountId, 'compatibility', { envelopeId, probe });
+  } catch (err) {
+    const status = err && err.response && err.response.status;
+    if (status === 404) {
+      if (explicitVerificationEnvelopeId(flags)) {
+        const refusal = new Error('Verification envelope ' + envelopeId + ' does not exist on ' + context.baseUrl +
+          '. Run `remits-cli verify list` to find the right id, or drop --verify-envelope.');
+        refusal.refused = true;
+        throw refusal;
+      }
+      console.error('Verification envelope ' + envelopeId + ' (selected for this checkout) no longer exists; evidence is not attached. ' +
+        'Run `remits-cli verify list`, then `verify use <id>` or `verify start`.');
+      return { envelopeId: null, verdict: 'detach', evidenceFlags: flagsWithoutVerificationEnvelope(flags) };
+    }
+    // A platform without `compatibility`, or one that is unreachable: attach as before. The report still judges
+    // the world; this only loses the early answer.
+    return { envelopeId, verdict: 'unchecked', evidenceFlags: pinned };
+  }
+  const verdict = result.verdict === 'refuse' && options.neverRefuse ? 'detach' : (result.verdict || 'attach');
+  const allowWrongWorld = flagEnabled(flags['allow-wrong-world-evidence']) || flagEnabled(flags.allowWrongWorldEvidence);
+  if (verdict === 'refuse' && !allowWrongWorld) {
+    const refusal = new Error(verificationRefusalLines(result, label).join('\n'));
+    refusal.refused = true;
+    refusal.compatibility = result;
+    throw refusal;
+  }
+  if (verdict === 'refuse') {
+    console.error('Attaching wrong-world evidence as context (--allow-wrong-world-evidence): ' + result.message);
+    return { envelopeId, verdict, compatibility: result, evidenceFlags: pinned };
+  }
+  if (verdict === 'detach') {
+    if (!options.quiet && result.message) {
+      const hints = verificationWorldHints(result.diffs);
+      console.error('Verification: ' + result.message + (hints.length ? ' (It would attach, as context only, with: ' + hints.join('  ') + ')' : ''));
+    }
+    return { envelopeId: null, verdict, compatibility: result, evidenceFlags: flagsWithoutVerificationEnvelope(flags) };
+  }
+  return { envelopeId, verdict, compatibility: result, evidenceFlags: pinned };
+}
+
+// "Would a plain `test run` from this checkout count for this envelope?" - printed where an agent selects or
+// inspects an envelope, so a mismatch is learned before the first run rather than from a refusal after it.
+async function printVerificationRunProbe(api, cwd, session, accountId, envelopeId, world = {}, options = {}) {
+  if (!envelopeId) return null;
+  let result;
+  try {
+    result = await postVerificationCommand(api, cwd, session, accountId, 'compatibility', {
+      envelopeId,
+      probe: { packetType: 'test_run', world }
+    });
+  } catch (_) {
+    return null;
+  }
+  if (options.onlyMismatch && result.verdict === 'attach') return result;
+  if (result.comparisonWorld) {
+    console.log('Proof world (' + (result.comparisonWorldSource || 'unknown') + '):', JSON.stringify(result.comparisonWorld));
+  }
+  if (result.verdict === 'attach') {
+    console.log('A `test run` from this checkout (dataMode=' + (world.dataMode || DEFAULT_DATA_MODE) + ') attaches to this envelope.');
+  } else if (result.verdict === 'refuse' || result.verdict === 'detach') {
+    const hints = verificationWorldHints(result.diffs);
+    console.log('A `test run` from this checkout (dataMode=' + (world.dataMode || DEFAULT_DATA_MODE) + ') would ' +
+      (result.verdict === 'refuse' ? 'be REFUSED' : 'NOT attach') + ' - ' + verificationDiffSummary(result.diffs) + '.');
+    if (hints.length) console.log('  to prove it for this envelope, pass: ' + hints.join('  '));
+  }
+  return result;
 }
 
 async function appendVerificationPacket(api, cwd, session, accountId, flags, packet, options = {}) {
@@ -1720,18 +1855,20 @@ async function appendVerificationPacket(api, cwd, session, accountId, flags, pac
   try {
     const response = await postVerificationCommand(api, cwd, session, accountId, 'packet', {
       envelopeId,
-      packet: finalPacket
+      packet: finalPacket,
+      // Packetless answer: this runs on every command while an envelope is active.
+      compact: true
     });
     if (response.packet) writeLocalVerificationPacket(cwd, envelopeId, response.packet);
     if (response.envelope) writeLocalVerificationEnvelope(cwd, response.envelope);
     if (!options.quiet) {
       console.log('Verification envelope:', envelopeId, '(packet ' + finalPacket.type + ' attached)');
-      // Say it HERE, not only at `verify` time. Evidence attached to an envelope started in a different world
-      // is evidence about a different world, and the reader has to learn that while they can still redo the run.
-      const drift = envelopeWorldDrift(response.envelope, context);
-      if (drift.length) {
-        console.log('  WARNING: this envelope was started in a different world - ' + drift.join('; ') +
-          '. The packet is attached, but it will be reported wrong-world at verify time.');
+      // The platform's own verdict on the stored packet, so this line and `verify report` cannot disagree.
+      const diffs = Array.isArray(response.worldDiffs) ? response.worldDiffs : [];
+      if (diffs.length) {
+        console.log('  WARNING: this packet is from a different world than the envelope requires - ' +
+          diffs.map((diff) => diff.field + ' expected ' + diff.expected + ' got ' + (diff.packet == null ? 'none' : diff.packet)).join('; ') +
+          '. It is attached, but it cannot satisfy a requirement.');
       }
     }
     return response;
@@ -1797,6 +1934,106 @@ function printVerificationEnvelope(envelope, fallbackEnvelopeId) {
   }
 }
 
+function slimVerificationPacket(packet) {
+  const p = packet || {};
+  const world = p.world || {};
+  return {
+    packetId: p.packetId || p.id || null,
+    type: p.type || 'unknown',
+    success: p.success !== false,
+    stale: Boolean(p.stale),
+    claim: p.claim || p.summary || null,
+    taskId: p.taskId || (p.testRun && p.testRun.taskId) || null,
+    testName: p.testName || (p.testRun && p.testRun.testName) || null,
+    accountId: world.accountId || p.accountId || null,
+    dataMode: world.dataMode || p.dataMode || null,
+    branchName: world.branchName || p.branchName || null,
+    workspace: world.workspace || p.workspace || null,
+    recordedAt: formatTime(p.recordedAt || p.createdAt || p.at || p.timestamp),
+    message: p.message || p.error || null
+  };
+}
+
+function compactVerificationEnvelope(envelope, fallbackEnvelopeId) {
+  const env = envelope || {};
+  const evaluation = env.evaluation || {};
+  const packets = Array.isArray(env.packets) ? env.packets : [];
+  const failures = Array.isArray(evaluation.currentFailures)
+    ? evaluation.currentFailures
+    : packets.filter((packet) => packet && packet.success === false && !packet.stale);
+  const stale = Array.isArray(evaluation.stale) ? evaluation.stale : packets.filter((packet) => packet && packet.stale);
+  const requiredEvidence = ((env.acceptance || {}).requiredEvidence || evaluation.requiredEvidence || []);
+  const latestByType = evaluation.latestByType || env.latestByType || {};
+  const nextActions = [];
+
+  if (evaluation.noRequiredEvidence) {
+    nextActions.push('Attach a manifest or required evidence contract; packets are context, not proof of completion.');
+  }
+  if (failures.length) {
+    nextActions.push('Inspect and replace the current failing evidence packet(s).');
+  }
+  if (stale.length) {
+    nextActions.push('Re-run stale evidence after the requirement/source change.');
+  }
+
+  return {
+    envelopeId: env.envelopeId || fallbackEnvelopeId || null,
+    summary: env.summary || null,
+    status: env.status || 'unknown',
+    health: evaluation.health || null,
+    acceptanceStatus: evaluation.acceptanceStatus || env.acceptanceStatus || null,
+    requiredEvidence: {
+      satisfiedCount: evaluation.satisfiedCount || 0,
+      requiredCount: evaluation.requiredCount || requiredEvidence.length || 0,
+      missingCount: evaluation.missingCount || 0,
+      staleCount: evaluation.staleCount || stale.length || 0,
+      noRequiredEvidence: Boolean(evaluation.noRequiredEvidence),
+      declared: requiredEvidence.slice(0, 10).map((entry) => ({
+        type: entry && entry.type || entry && entry.evidenceType || null,
+        category: entry && entry.category || null,
+        claim: entry && entry.claim || entry && entry.description || null
+      }))
+    },
+    packets: {
+      count: packets.length,
+      failedCount: evaluation.failedCount || failures.length || 0,
+      currentFailureCount: evaluation.currentFailureCount || failures.length || 0,
+      lastPacketAt: formatTime(env.lastPacketAtMs || env.latestPacketAtMs || env.updatedAtMs),
+      recent: packets.slice(-5).map(slimVerificationPacket)
+    },
+    latestByType,
+    currentFailures: failures.slice(0, 10).map(slimVerificationPacket),
+    stale: stale.slice(0, 10).map(slimVerificationPacket),
+    warnings: (env.warnings || []).slice(0, 10),
+    nextActions
+  };
+}
+
+function printCompactVerificationEnvelope(compact) {
+  console.log('Verification envelope:', compact.envelopeId || '(no id)');
+  if (compact.summary) console.log('Summary:', compact.summary);
+  console.log('Status:', compact.status + (compact.health ? '  health=' + compact.health : ''));
+  if (compact.requiredEvidence.noRequiredEvidence) {
+    console.log('Required evidence: none declared');
+  } else {
+    console.log('Required evidence:', compact.requiredEvidence.satisfiedCount + '/' + compact.requiredEvidence.requiredCount +
+      (compact.requiredEvidence.staleCount ? '  stale=' + compact.requiredEvidence.staleCount : ''));
+  }
+  console.log('Packets:', compact.packets.count + '  current failures=' + compact.packets.currentFailureCount);
+  if (compact.currentFailures.length) {
+    console.log('Current failures:');
+    compact.currentFailures.forEach((packet) => {
+      console.log('  - ' + packet.type + ' ' + (packet.packetId || '') + (packet.claim ? ' - ' + packet.claim : '') +
+        (packet.message ? ' (' + packet.message + ')' : ''));
+    });
+  }
+  if (compact.nextActions.length) {
+    console.log('Next actions:');
+    compact.nextActions.forEach((action) => console.log('  - ' + action));
+  }
+  console.log('Full envelope: remits-cli verify show --json');
+}
+
 function printAcceptanceWarnings(envelope) {
   const warnings = envelope && envelope.acceptance && Array.isArray(envelope.acceptance.warnings)
     ? envelope.acceptance.warnings
@@ -2672,6 +2909,42 @@ function resolveSessionContext(cwd, flags) {
   };
 }
 
+function hasExplicitAccountIdFlag(flags) {
+  const value = Number(flags && flags['account-id']);
+  return Number.isFinite(value) && value > 0;
+}
+
+function platformRepoEntryMatchesCwd(cwd) {
+  const entry = getPlatformRepoEntry();
+  if (!entry || !entry.directory || !cwd) return false;
+  try {
+    return path.resolve(entry.directory) === path.resolve(cwd);
+  } catch (_) {
+    return false;
+  }
+}
+
+function platformRepoAccountCommandProblem(cwd, flags, commandName, sessionContext) {
+  if (hasExplicitAccountIdFlag(flags)) return null;
+  try {
+    if (loadAccountInfo(cwd)) return null;
+  } catch (_) {
+    // No account-info.json means the command would fall back to session state.
+  }
+  if (!looksLikePlatformRepo(cwd) && !platformRepoEntryMatchesCwd(cwd)) return null;
+
+  const account = sessionContext && sessionContext.accountId
+    ? 'account ' + sessionContext.accountId
+    : 'the last authenticated account';
+  return 'Refusing ' + commandName + ' from the Remits platform repo. This checkout is back-stage platform source, not an account repository, so the command would target ' +
+    account + ' from session state. Run it from that account repo, or pass --account-id <id> explicitly if you really intend to inspect that account from here.';
+}
+
+function requireAccountRepoContext(cwd, flags, commandName, sessionContext) {
+  const problem = platformRepoAccountCommandProblem(cwd, flags, commandName, sessionContext);
+  if (problem) throw new Error(problem);
+}
+
 /*
 ## Component Discovery And HTTP Logging
 */
@@ -3755,6 +4028,7 @@ async function pushComponentsCommand(flags) {
   const cwd = process.cwd();
   ensureLocalState(cwd);
   const sessionContext = resolveSessionContext(cwd, flags);
+  requireAccountRepoContext(cwd, flags, 'components stage', sessionContext);
   const { session, accountId } = sessionContext;
   const baseUrl = flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL;
   const branchName = flags.branch || currentBranch(cwd);
@@ -3876,6 +4150,10 @@ async function pushComponentsCommand(flags) {
   // or, worse, conclude staging was broken and go on reading trunk. Scaled by payload size, floored at
   // the old default, and overridable.
   const api = buildAxios(baseUrl, session.token, stageTimeoutMs(components, flags));
+  const verification = await verificationPreflight(api, cwd, session, accountId, flags, {
+    packetType: 'stage',
+    world: { accountId, dataMode, branchName, workspace }
+  }, { command: 'components stage' });
   const stagePayload = {
     token: session.token,
     accountId,
@@ -3919,7 +4197,7 @@ async function pushComponentsCommand(flags) {
     // the platform rejected it. The packet is best-effort: a failing stage must surface the STAGE error,
     // never an error from writing the record of it.
     try {
-      await appendVerificationPacket(api, cwd, session, accountId, flags, {
+      await appendVerificationPacket(api, cwd, session, accountId, verification.evidenceFlags, {
         type: 'stage',
         success: false,
         claim: 'Components refused at staging',
@@ -3956,7 +4234,7 @@ async function pushComponentsCommand(flags) {
     throw new Error(response.message || 'Server stage failed');
   }
 
-  await appendVerificationPacket(api, cwd, session, accountId, flags, {
+  await appendVerificationPacket(api, cwd, session, accountId, verification.evidenceFlags, {
     type: 'stage',
     success: response.success !== false,
     claim: 'Components staged for verification',
@@ -4682,7 +4960,8 @@ function printBranchContext(response) {
   console.log('  commit writes:  ' + ctx.commitWrites);
   if (Object.prototype.hasOwnProperty.call(ctx, 'lastSyncedSha')) {
     // null is "unknown" (never synced, expired, or the last sync had errors) — never "nothing landed".
-    console.log('  last platform sync of this branch: ' + (ctx.lastSyncedSha ? short(ctx.lastSyncedSha) : 'unknown'));
+    const source = ctx.lastSyncedShaSource ? ' [' + ctx.lastSyncedShaSource + ']' : '';
+    console.log('  last platform sync of this branch: ' + (ctx.lastSyncedSha ? short(ctx.lastSyncedSha) : 'unknown') + source);
   }
   if (ctx.repository) {
     console.log('  sync reads repository: ' + ctx.repository +
@@ -4694,6 +4973,8 @@ function printBranchContext(response) {
       ('this account resolves the branch through an ancestor owned by account ' + ctx.resolvingOwnerAccountId + '.')));
   }
 
+  variantBranchIdentityLines(response).forEach((line) => console.log(line));
+
   if (!ctx.onTrunk) {
     console.log('  variants stored on this branch: ' + (ctx.variantCount || 0));
     const subs = ctx.subscribers || [];
@@ -4707,6 +4988,29 @@ function printBranchContext(response) {
   console.log('');
 }
 
+// A variant branch whose checkout identifies as its OWNER (account-info.json names the owner) runs every command as
+// the owner, and the owner subscribes to nothing — so a feature branch cut from this checkout resolves TRUNK, and no
+// run exercises what the subscriber actually gets. With exactly one subscriber that identity is repairable, and the
+// agent should hear it here rather than infer it from a page that rendered trunk. Pure.
+function variantBranchIdentityLines(response) {
+  const ctx = response && response.branchContext;
+  if (!ctx || ctx.onTrunk || ctx.variantBranchSource === 'subscription-fallback') return [];
+  const subs = Array.isArray(ctx.subscribers) ? ctx.subscribers : [];
+  const checkoutAccountId = response.accountId;
+  if (subs.length !== 1 || checkoutAccountId == null || String(subs[0].accountId) === String(checkoutAccountId)) return [];
+  if (ctx.commitOwnerAccountId != null && String(ctx.commitOwnerAccountId) !== String(checkoutAccountId)) return [];
+  const sub = subs[0];
+  const label = sub.accountId + (sub.accountName ? ' (' + sub.accountName + ')' : '');
+  return [
+    '',
+    '  CHECKOUT IDENTITY: this branch has one subscriber, account ' + label + ', but this checkout runs as the owner,',
+    '  account ' + checkoutAccountId + ' (account-info.json names it). Feature branches cut from here run as ' + checkoutAccountId +
+      ' too, which subscribes to nothing, so they resolve trunk.',
+    '    run as the subscriber:  --as-account ' + sub.accountId,
+    '    repair the identity:    remits-cli components sync --account-id ' + sub.accountId + '   then   git pull --ff-only'
+  ];
+}
+
 function printClearSummary(response, flags) {
   console.log('Cleared keys:', response.clearedCount || 0);
   console.log('Remaining staged count:', response.remainingCount || 0);
@@ -4848,6 +5152,7 @@ async function statusComponentsCommand(flags) {
   const cwd = process.cwd();
   ensureLocalState(cwd);
   const sessionContext = resolveSessionContext(cwd, flags);
+  requireAccountRepoContext(cwd, flags, 'components status', sessionContext);
   const { session, accountId } = sessionContext;
   const baseUrl = flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL;
   const branchName = flags.branch || currentBranch(cwd);
@@ -4916,6 +5221,7 @@ async function lanesComponentsCommand(flags) {
   const cwd = process.cwd();
   ensureLocalState(cwd);
   const sessionContext = resolveSessionContext(cwd, flags);
+  requireAccountRepoContext(cwd, flags, 'components lanes', sessionContext);
   const { session, accountId } = sessionContext;
   const baseUrl = flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL;
   const branchName = flags.branch || currentBranch(cwd);
@@ -5007,6 +5313,7 @@ async function entriesComponentsCommand(flags) {
   const cwd = process.cwd();
   ensureLocalState(cwd);
   const sessionContext = resolveSessionContext(cwd, flags);
+  requireAccountRepoContext(cwd, flags, 'components entries', sessionContext);
   const { session, accountId } = sessionContext;
   const baseUrl = flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL;
   const branchName = flags.branch || currentBranch(cwd);
@@ -5050,6 +5357,7 @@ async function clearComponentsCommand(flags) {
   const cwd = process.cwd();
   ensureLocalState(cwd);
   const sessionContext = resolveSessionContext(cwd, flags);
+  requireAccountRepoContext(cwd, flags, 'components clear', sessionContext);
   const { session, accountId } = sessionContext;
   const baseUrl = flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL;
   const branchName = flags.branch || currentBranch(cwd);
@@ -5109,6 +5417,7 @@ async function syncComponentsCommand(rawFlags) {
   const flags = safe ? expandSafeSyncFlags(rawFlags) : rawFlags;
   ensureLocalState(cwd);
   const sessionContext = resolveSessionContext(cwd, flags);
+  requireAccountRepoContext(cwd, flags, 'components sync', sessionContext);
   const { session, accountId } = sessionContext;
   const baseUrl = flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL;
   const branchName = flags.branch || currentBranch(cwd);
@@ -5123,6 +5432,11 @@ async function syncComponentsCommand(rawFlags) {
   const preflightRequested = syncPreflightRequested(flags);
   const namesOnly = flagEnabled(flags['names-only']) || flagEnabled(flags.namesOnly);
 
+  const verification = await verificationPreflight(api, cwd, session, accountId, flags, {
+    packetType: dryRun || namesOnly ? 'sync_dry_run' : 'sync_mutation',
+    world: { accountId, dataMode, branchName, workspace }
+  }, { command: 'components sync' });
+
   printProdDataBanner({
     dataMode,
     accountId,
@@ -5334,7 +5648,7 @@ async function syncComponentsCommand(rawFlags) {
   summary.gates = gate.checks;
   summary.gateViolations = gate.violations;
 
-  await appendVerificationPacket(api, cwd, session, accountId, flags, {
+  await appendVerificationPacket(api, cwd, session, accountId, verification.evidenceFlags, {
     type: response.sync && response.sync.dryRun ? 'sync_dry_run' : 'sync_mutation',
     success: response.success !== false,
     claim: response.sync && response.sync.dryRun ? 'Component sync dry-run observed' : 'Component sync completed',
@@ -6211,6 +6525,7 @@ async function branchesComponentsCommand(flags) {
   const cwd = process.cwd();
   ensureLocalState(cwd);
   const sessionContext = resolveSessionContext(cwd, flags);
+  requireAccountRepoContext(cwd, flags, 'components branches', sessionContext);
   const { session, accountId } = sessionContext;
   const baseUrl = flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL;
   const api = buildAxios(baseUrl, session.token);
@@ -6408,6 +6723,7 @@ async function promotionComponentsCommand(flags) {
   const cwd = process.cwd();
   ensureLocalState(cwd);
   const sessionContext = resolvePromotionSessionContext(cwd, flags);
+  requireAccountRepoContext(cwd, flags, 'components promotion', sessionContext);
   const { session, accountId } = sessionContext;
   const baseUrl = flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL;
   const api = buildAxios(baseUrl, session.token);
@@ -6573,7 +6889,9 @@ function shortSignature(signature) {
 async function commitComponentsCommand(flags) {
   const cwd = process.cwd();
   ensureLocalState(cwd);
-  const { accountId } = resolveSessionContext(cwd, flags);
+  const sessionContext = resolveSessionContext(cwd, flags);
+  requireAccountRepoContext(cwd, flags, 'components commit', sessionContext);
+  const { session, accountId } = sessionContext;
   const branchName = flags.branch || currentBranch(cwd);
   const commitMessage = String(flags.message || ('remits-cli commit sync ' + new Date().toISOString()));
   const allowEmpty = flags['allow-empty'] === true || flags['allow-empty'] === 'true';
@@ -6586,6 +6904,15 @@ async function commitComponentsCommand(flags) {
   if (await refuseUnsafeTrunkCommitBeforeGit(flags, accountId, branchName, skipGit)) {
     return;
   }
+  // The sync's verification answer, asked BEFORE `git push`. Asked inside the sync it could refuse only after the
+  // push, leaving a pushed-but-unsynced branch - the one state this command exists to avoid. The sync below
+  // reuses this answer instead of asking again.
+  const commitVerification = await verificationPreflight(
+    buildAxios(flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL, session.token),
+    cwd, session, accountId, Object.assign({}, flags, { branch: branchName }), {
+      packetType: 'sync_mutation',
+      world: { accountId, dataMode: resolveDataMode(flags, session), branchName, workspace: resolveWorkspace(cwd, flags) }
+    }, { command: 'components commit' });
 
   // Landing is serial and nothing can make it concurrent: `git add -A` sweeps a shared checkout, and the
   // platform pushes a regenerated `account-info.json` back to the branch during sync, so two commits
@@ -6681,7 +7008,8 @@ async function commitComponentsCommand(flags) {
   const syncResponse = await withStdoutRoutedToStderr(jsonOutput, () => syncComponentsCommand({
     ...flags,
     branch: branchName,
-    'account-id': accountId
+    'account-id': accountId,
+    __verificationPreflight: commitVerification
   }));
   outcome.sync = syncResponse && flagEnabled(flags.summary) ? buildSyncSummary(syncResponse) : (syncResponse || null);
   // Stop here when the sync did not succeed. In --json mode a refused sync gate RETURNS (with a non-zero
@@ -7291,8 +7619,17 @@ function runWorldLines(world, context = {}) {
   if (world.componentOwnerAccountId && world.componentOwnerAccountId !== world.executionAccountId) accounts.push('component owner ' + world.componentOwnerAccountId);
   lines.push('  runs as:         ' + accounts.join(', '));
   lines.push('  data lane:       ' + (world.dataMode || context.dataMode || 'unknown'));
-  const branchSource = world.variantBranchSource ? '  [' + world.variantBranchSource + ']' : '';
-  lines.push('  component world: ' + (world.resolves || (world.componentBranch ? "trunk + the '" + world.componentBranch + "' variant overlays" : 'trunk')) + branchSource);
+  const contextVariantWorld = context.variantWorld && typeof context.variantWorld === 'object' ? context.variantWorld : {};
+  const subscribedComponentBranch = world.subscribedComponentBranch || contextVariantWorld.subscribedComponentBranch;
+  const componentBranch = world.componentBranch || subscribedComponentBranch || contextVariantWorld.componentBranch || world.variantBranch;
+  const branchSource = componentBranch && subscribedComponentBranch && String(componentBranch) === String(subscribedComponentBranch)
+    ? 'subscription'
+    : (world.componentBranchSource || contextVariantWorld.componentBranchSource || world.variantBranchSource || contextVariantWorld.variantBranchSource);
+  const branchLabel = componentBranch
+    ? "componentBranch=" + componentBranch + (branchSource ? ' via ' + branchSource : '')
+    : (branchSource || '');
+  const branchSuffix = branchLabel ? '  [' + branchLabel + ']' : '';
+  lines.push('  component world: ' + (world.resolves || (componentBranch ? "trunk + the '" + componentBranch + "' variant overlays" : 'trunk')) + branchSuffix);
   const laneParts = [world.stagingLane || (world.branchName ? world.branchName + (world.workspace ? ' [ws:' + world.workspace + ']' : '') : 'none')];
   if (world.sharedLane) laneParts.push('(shared lane)');
   if (world.laneContentHash) laneParts.push('content ' + String(world.laneContentHash).slice(0, 12));
@@ -7312,6 +7649,24 @@ function runWorldLines(world, context = {}) {
     lines.push('  test component:  ' + world.testComponentSource + (world.testComponentSignature ? ' ' + shortSignature(world.testComponentSignature) : '') +
       (world.testComponentBranch ? "  variant '" + world.testComponentBranch + "'" : ''));
   }
+  lines.push(...stagedMaskedByVariantLines(world.stagedMaskedByVariant, world.executionAccountId || context.accountId));
+  return lines;
+}
+
+// Staged edits from a TRUNK lane that the execution account will not run, because its branch overrides those
+// components with committed variants. Production behaves the same way (the variant keeps shadowing trunk), so this
+// is drift to report, not a bug to route around. Pure.
+function stagedMaskedByVariantLines(masked, accountId) {
+  if (!Array.isArray(masked) || !masked.length) return [];
+  const lines = ['  NOT RUN FOR THIS ACCOUNT: ' + masked.length + ' staged trunk edit(s) are shadowed by account ' +
+    (accountId || '?') + "'s committed variant, exactly as in production:"];
+  masked.slice(0, 10).forEach((entry) => {
+    lines.push('    - ' + entry.type + ' ' + (entry.componentId != null ? entry.componentId + ' ' : '') + (entry.componentName || '') +
+      "  (variant " + (entry.variantId || '?') + " on '" + entry.branch + "')");
+  });
+  if (masked.length > 10) lines.push('    ...' + (masked.length - 10) + ' more');
+  lines.push("    To change what this account runs, edit the component on its variant branch ('" + masked[0].branch +
+    "') or promote the trunk change to that branch.");
   return lines;
 }
 
@@ -7517,6 +7872,22 @@ async function testCommand(flags) {
   // --variant-branch explicitly probes a committed variant branch. Normally omitted: variants resolve
   // from the account's subscription edge, which is what production does.
   const variantBranch = flags['variant-branch'];
+  // Asked BEFORE the run: a run whose evidence could only fail the envelope's contract is refused here, not
+  // discovered at `verify report` after the minutes it took.
+  const numericTestRef = /^\d+$/.test(String(testRef));
+  const verification = await verificationPreflight(api, cwd, session, accountId, flags, {
+    packetType: 'test_run',
+    world: {
+      accountId,
+      executionAccountId: asAccountId ? Number(asAccountId) : Number(accountId),
+      dataMode,
+      branchName,
+      workspace,
+      componentBranch: variantBranch || undefined
+    },
+    test: numericTestRef ? { testId: Number(testRef) } : { testName: String(testRef) }
+  }, { command: 'test run' });
+  const activeEnvelopeId = verification.envelopeId;
 
   withStdoutRoutedToStderr(jsonOutput, () => {
     printProdDataBanner({
@@ -7561,6 +7932,7 @@ async function testCommand(flags) {
       host: normalizeBaseUrl(baseUrl),
       accountId: asAccountId || accountId,
       dataMode,
+      variantWorld: start.variantWorld,
       gitHead: safeGitValue(cwd, 'git rev-parse HEAD')
     }).forEach((line) => console.log(line));
     console.log('Test run started:', start.taskId);
@@ -7615,8 +7987,6 @@ async function testCommand(flags) {
     process.exitCode = 1;
   }
 
-  const verificationContext = activeVerificationContext(cwd, flags, session, accountId);
-  const activeEnvelopeId = verificationEnvelopeIdForCommand(cwd, flags, verificationContext);
   const componentProvenance = testComponentProvenance(status);
   const sourceRevision = collectVerificationSource(cwd, flags);
   const priorPackets = await readVerificationPacketsForDiagnostics(api, cwd, session, accountId, activeEnvelopeId, {
@@ -7636,7 +8006,7 @@ async function testCommand(flags) {
     });
   }
 
-  await appendVerificationPacket(api, cwd, session, accountId, flags, {
+  await appendVerificationPacket(api, cwd, session, accountId, verification.evidenceFlags, {
     type: 'test_run',
     success: status.status === 'completed' && !(status.result && status.result.failed > 0) && !unmatched.length,
     claim: 'Test run ' + String(testRef),
@@ -7834,6 +8204,18 @@ async function tokenCommand(flags) {
   // Embeddable resolves that account's branch variants rather than the owner's trunk.
   // --variant-branch explicitly probes a committed variant branch before any edge subscribes.
   const variantBranch = flags['variant-branch'];
+  const tokenAsAccountId = flags['as-account'] || flags['as-account-id'];
+  const verification = await verificationPreflight(api, cwd, session, accountId, flags, {
+    packetType: 'token_inspect',
+    world: {
+      accountId,
+      executionAccountId: tokenAsAccountId ? Number(tokenAsAccountId) : Number(accountId),
+      dataMode,
+      branchName,
+      workspace,
+      componentBranch: variantBranch || undefined
+    }
+  }, { command: 'token' });
   // Send the path so the server can also mint the EMBEDDABLE-SCOPED token key. `tokenKey` opens a
   // tokenized URL in a browser; `embedTokenKey` lets the `<script>` embed loader resolve the component
   // from persisted token context because the loader request sends no path.
@@ -7889,6 +8271,11 @@ async function tokenCommand(flags) {
   if (data.resolution) {
     output.resolution = data.resolution;
   }
+  if (Array.isArray(data.stagedMaskedByVariant) && data.stagedMaskedByVariant.length) {
+    output.stagedMaskedByVariant = data.stagedMaskedByVariant;
+    // stderr: stdout is the JSON document. Said before the URL is opened, not discovered from what renders.
+    stagedMaskedByVariantLines(data.stagedMaskedByVariant, data.accountId).forEach((line) => console.error(line.replace(/^  /, '')));
+  }
 
   // Present only when the path resolved to an Embeddable. `embedTokenKey` is what a host site pastes
   // into the loader snippet; the render shape is echoed because it decides what that host receives.
@@ -7909,7 +8296,7 @@ async function tokenCommand(flags) {
   }
   console.log(JSON.stringify(output, null, 2));
 
-  await appendVerificationPacket(api, cwd, session, accountId, flags, {
+  await appendVerificationPacket(api, cwd, session, accountId, verification.evidenceFlags, {
     type: 'token_inspect',
     success: true,
     claim: 'Verification token minted',
@@ -8131,7 +8518,12 @@ async function toolCommand(flags) {
       data.toolMessage = data.toolMessage || toolResultMessage(data.result);
     }
     if (data.status === 'failed' || polledFailed) process.exitCode = 1;
-    await appendVerificationPacket(api, cwd, session, accountId, flags, {
+    // Same question as the call that started it: a poll must not attach where the call itself would not.
+    const statusVerification = await verificationPreflight(api, cwd, session, accountId, flags, {
+      packetType: 'tool_call',
+      world: { accountId: statusAccountId, dataMode: data.dataMode || dataMode, branchName: flags.branch || (stored && stored.branchName) || branchName, workspace: resolveWorkspace(cwd, flags) }
+    }, { command: 'tool status', neverRefuse: true, quiet: jsonOutput });
+    await appendVerificationPacket(api, cwd, session, accountId, statusVerification.evidenceFlags, {
       type: 'tool_call',
       success: data.status !== 'failed' && !polledFailed,
       claim: 'Tool status ' + requestedCallId,
@@ -8171,6 +8563,12 @@ async function toolCommand(flags) {
     stderr: jsonOutput
   });
 
+  const toolWorkspace = resolveWorkspace(cwd, flags);
+  const verification = await verificationPreflight(api, cwd, session, accountId, flags, {
+    packetType: 'tool_call',
+    world: { accountId, dataMode, branchName, workspace: toolWorkspace }
+  }, { command: 'tool --name ' + String(toolName) });
+
   const response = await loggedPost(api, cwd, '/cli/tool', {
     token: session.token,
     accountId,
@@ -8180,7 +8578,7 @@ async function toolCommand(flags) {
     // what the call may discover — has to survive that. The server validates it; it is never authorization.
     scopeRootAccountId: accountId,
     branchName,
-    workspace: resolveWorkspace(cwd, flags),
+    workspace: toolWorkspace,
     dataMode,
     variantBranch,
     name: String(toolName),
@@ -8260,7 +8658,7 @@ async function toolCommand(flags) {
     if (jsonOutput) Object.assign(data, { finalStatus: finalStatus.data });
   }
 
-  await appendVerificationPacket(api, cwd, session, accountId, flags, {
+  await appendVerificationPacket(api, cwd, session, accountId, verification.evidenceFlags, {
     type: 'tool_call',
     success: asyncMode && !waitForAsync ? null : (!toolFailed && (!asyncMode || process.exitCode !== 1)),
     pending: asyncMode && !waitForAsync,
@@ -8478,6 +8876,29 @@ async function corpusCommand(flags, subcommand) {
   return data;
 }
 
+// `verify token` / `verify tool` say "prove this for the envelope", so without an explicit --data-mode they run
+// in the envelope's lane when that lane is TEST. A plain `token`/`tool` follows the session, and a session parked
+// on prod otherwise refuses (or silently detaches) against the test envelope the agent just started. Never
+// adopts PROD: production proof keeps requiring an explicit --data-mode prod, which the refusal names.
+async function verifyWrapperFlags(api, cwd, session, accountId, flags, envelopeId) {
+  const pinned = Object.assign({}, flags, { 'verify-envelope': envelopeId });
+  if (hasExplicitDataModeFlag(flags)) return pinned;
+  try {
+    const result = await postVerificationCommand(api, cwd, session, accountId, 'compatibility', {
+      envelopeId,
+      probe: { packetType: 'manual_observation', world: {} }
+    });
+    const lane = result.comparisonWorld && result.comparisonWorld.dataMode;
+    if (lane && normalizeDataMode(lane) === 'test' && resolveDataMode(flags, session) !== 'test') {
+      console.error('Data lane: test (the lane envelope ' + envelopeId + ' proves; your session is on ' + resolveDataMode(flags, session) + ')');
+      return Object.assign(pinned, { 'data-mode': 'test' });
+    }
+  } catch (_) {
+    // The command's own preflight still answers; this only saves a turn.
+  }
+  return pinned;
+}
+
 async function verifyCommand(flags, subcommand) {
   const cwd = process.cwd();
   ensureLocalState(cwd);
@@ -8486,11 +8907,26 @@ async function verifyCommand(flags, subcommand) {
   const sessionContext = resolveSessionContext(cwd, flags);
   const { session, accountId } = sessionContext;
   const baseUrl = flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL;
-  const dataMode = resolveDataMode(flags, session);
+  // `verify start` proves in the TEST lane unless told otherwise, for the reason `test run` does: production
+  // proof needs explicit provenance. It used to inherit the session's lane, so a session parked on prod started
+  // prod envelopes that every default `test run` then contradicted.
+  const dataMode = sub === 'start' && !hasExplicitDataModeFlag(flags)
+    ? DEFAULT_DATA_MODE
+    : resolveDataMode(flags, session);
   const branchName = flags.branch || currentBranch(cwd);
   const workspace = resolveWorkspace(cwd, flags);
   const api = buildAxios(baseUrl, session.token);
+  // Selection is by checkout world only (no data lane) - see verificationContextKey.
   const activeContext = activeVerificationContext(cwd, flags, session, accountId);
+  const checkoutWorldLine = 'account=' + accountId + ', branch=' + branchName + ', workspace=' + (workspace || 'shared');
+  // What a plain `test run` from here would record, for the "would it count" probe.
+  const testRunWorld = {
+    accountId,
+    executionAccountId: Number(accountId),
+    dataMode: hasExplicitDataModeFlag(flags) ? resolveDataMode(flags, null) : DEFAULT_DATA_MODE,
+    branchName,
+    workspace
+  };
 
   if (sub === 'current') {
     const active = readActiveVerificationEnvelope(cwd, activeContext);
@@ -8498,18 +8934,30 @@ async function verifyCommand(flags, subcommand) {
     printResolvedBaseUrl(baseUrl);
     printLocalCommandContext(cwd, flags, { accountId, branchName, workspace, dataMode });
     printLocalStateWarnings(cwd, flags);
-    console.log('Context:', 'account=' + accountId + ', branch=' + branchName + ', workspace=' + (workspace || 'shared') + ', dataMode=' + dataMode);
+    console.log('Checkout world:', checkoutWorldLine);
     if (!active) {
-      const legacy = readActiveVerificationEnvelope(cwd);
-      console.log('No active verification envelope for this context.');
-      if (legacy) {
-        console.log('Legacy active envelope ignored for this context:', legacy);
+      console.log('No active verification envelope for this checkout world.');
+      // Name the envelopes selected in SIBLING worlds (another workspace/branch of this checkout): the usual
+      // cause is a workspace or branch switch, and "start a new one" is the wrong next step for that.
+      const siblings = Object.values(readActiveVerificationContexts(cwd))
+        .filter((entry) => entry && typeof entry === 'object' && entry.envelopeId && entry.context &&
+          String(entry.context.accountId) === String(accountId))
+        .sort((left, right) => String(right.updatedAt || '').localeCompare(String(left.updatedAt || '')))
+        .filter((entry, index, all) => all.findIndex((other) => other.envelopeId === entry.envelopeId) === index)
+        .slice(0, 3);
+      siblings.forEach((entry) => {
+        console.log('  selected in another world: ' + entry.envelopeId + '  (branch=' + (entry.context.branchName || '?') +
+          ', workspace=' + (entry.context.workspace || 'shared') + ')');
+      });
+      if (siblings.length) {
+        console.log('  Switch back to that workspace/branch, or `remits-cli verify use <id>` to select one here.');
       }
       return;
     }
     console.log('Active verification envelope:', active);
     const local = readLocalVerificationEnvelope(cwd, active);
     if (local && local.summary) console.log('Summary:', local.summary);
+    await printVerificationRunProbe(api, cwd, session, accountId, active, testRunWorld);
     return;
   }
 
@@ -8520,7 +8968,8 @@ async function verifyCommand(flags, subcommand) {
     console.log('Active verification envelope:', envelopeId);
     printLocalCommandContext(cwd, flags, { accountId, branchName, workspace, dataMode });
     printLocalStateWarnings(cwd, flags);
-    console.log('Context:', 'account=' + accountId + ', branch=' + branchName + ', workspace=' + (workspace || 'shared') + ', dataMode=' + dataMode);
+    console.log('Checkout world:', checkoutWorldLine);
+    await printVerificationRunProbe(api, cwd, session, accountId, String(envelopeId), testRunWorld);
     return;
   }
 
@@ -8531,9 +8980,9 @@ async function verifyCommand(flags, subcommand) {
       console.log('All active verification envelope pointers cleared for this checkout.');
     } else {
       writeActiveVerificationEnvelope(cwd, null, activeContext);
-      console.log('Verification envelope cleared for this context.');
+      console.log('Verification envelope cleared for this checkout world.');
       printLocalCommandContext(cwd, flags, { accountId, branchName, workspace, dataMode });
-      console.log('Context:', 'account=' + accountId + ', branch=' + branchName + ', workspace=' + (workspace || 'shared') + ', dataMode=' + dataMode);
+      console.log('Checkout world:', checkoutWorldLine);
     }
     return;
   }
@@ -8586,7 +9035,13 @@ async function verifyCommand(flags, subcommand) {
     console.log('Verification envelope started:', envelope.envelopeId);
     printLocalCommandContext(cwd, flags, { accountId, branchName, workspace, dataMode });
     printLocalStateWarnings(cwd, flags);
-    console.log('Target:', 'account=' + accountId + ', branch=' + branchName + ', workspace=' + (workspace || 'shared') + ', dataMode=' + dataMode);
+    console.log('Target:', checkoutWorldLine + ', dataMode=' + dataMode +
+      (hasExplicitDataModeFlag(flags) ? '' : '  (verify start default; pass --data-mode prod to prove against production data)'));
+    // Say NOW whether a plain `test run` from here will count - a prod lane or a manifest world elsewhere both
+    // mean it will not - rather than after the first refusal. A PLAIN run: `--data-mode prod` on `verify start`
+    // names the envelope's lane, not the run's. Silent when it attaches.
+    await printVerificationRunProbe(api, cwd, session, accountId, envelope.envelopeId,
+      Object.assign({}, testRunWorld, { dataMode: DEFAULT_DATA_MODE }), { onlyMismatch: true });
     printAcceptanceWarnings(envelope);
     printEnvelopeWarnings(envelope);
     console.log('Local mirror:', verificationPaths(cwd, envelope.envelopeId).base);
@@ -8637,11 +9092,18 @@ async function verifyCommand(flags, subcommand) {
   if (sub === 'show' || sub === 'read' || sub === 'get' || sub === 'packets') {
     const response = await postVerificationCommand(api, cwd, session, accountId, 'show', { envelopeId });
     if (response.envelope) writeLocalVerificationEnvelope(cwd, response.envelope);
+    const envelope = response.envelope || {};
+    const compact = flagEnabled(flags.summary) || flagEnabled(flags.compact);
     if (flagEnabled(flags.json)) {
-      console.log(JSON.stringify(response.envelope || response, null, 2));
-      return response.envelope || response;
+      const payload = compact ? compactVerificationEnvelope(envelope, envelopeId) : (response.envelope || response);
+      console.log(JSON.stringify(payload, null, 2));
+      return payload;
+    }
+    if (compact) {
+      const payload = compactVerificationEnvelope(envelope, envelopeId);
+      printCompactVerificationEnvelope(payload);
+      return payload;
     }
-    const envelope = response.envelope || {};
     printVerificationEnvelope(envelope, envelopeId);
     return envelope;
   }
@@ -8715,7 +9177,7 @@ async function verifyCommand(flags, subcommand) {
     return await testCommand(Object.assign({}, flags, { 'verify-envelope': envelopeId }));
   }
   if (sub === 'token') {
-    return await tokenCommand(Object.assign({}, flags, { 'verify-envelope': envelopeId }));
+    return await tokenCommand(await verifyWrapperFlags(api, cwd, session, accountId, flags, envelopeId));
   }
   if (sub === 'stage') {
     return await pushComponentsCommand(Object.assign({}, flags, { 'verify-envelope': envelopeId }));
@@ -8724,7 +9186,7 @@ async function verifyCommand(flags, subcommand) {
     return await syncComponentsCommand(Object.assign({}, flags, { 'verify-envelope': envelopeId }));
   }
   if (sub === 'tool') {
-    return await toolCommand(Object.assign({}, flags, { 'verify-envelope': envelopeId }));
+    return await toolCommand(await verifyWrapperFlags(api, cwd, session, accountId, flags, envelopeId));
   }
 
   if (sub === 'invalidate') {
@@ -8756,6 +9218,12 @@ async function verifyCommand(flags, subcommand) {
   if (sub === 'status' || sub === 'report') {
     let statusPacket = null;
     try {
+      // Only attach the status observation when it is from the envelope's world; otherwise it is noise the
+      // report would list as wrong-world evidence on every status check.
+      const statusVerification = await verificationPreflight(api, cwd, session, accountId, { 'verify-envelope': envelopeId }, {
+        packetType: 'component_status',
+        world: { accountId, dataMode, branchName, workspace }
+      }, { command: 'verify status', quiet: true, neverRefuse: true });
       const componentStatus = await loggedPost(api, cwd, '/cli/components', {
         token: session.token,
         accountId,
@@ -8774,22 +9242,16 @@ async function verifyCommand(flags, subcommand) {
         rawRefs: { command: 'components status' },
         componentStatus
       };
-      await appendVerificationPacket(api, cwd, session, accountId, { 'verify-envelope': envelopeId }, statusPacket, { quiet: true });
+      await appendVerificationPacket(api, cwd, session, accountId, statusVerification.evidenceFlags, statusPacket, { quiet: true });
     } catch (err) {
       if (!flagEnabled(flags.json)) {
         console.error('Warning: could not attach component_status packet before rendering report:', describeError(err));
       }
     }
-    const response = await postVerificationCommand(api, cwd, session, accountId, sub, {
-      envelopeId,
-      currentWorld: buildCommandWorld(statusPacket && statusPacket.componentStatus, {
-        accountId,
-        dataMode,
-        branchName,
-        workspace,
-        host: normalizeBaseUrl(baseUrl)
-      })
-    });
+    // No `currentWorld`: status and report judge the SAME world (manifest, else the envelope's start world), so
+    // they cannot give two verdicts on one envelope. Sending the session's world made every --as-account packet
+    // wrong-world under `status` while `report` verified it, and made the verdict depend on the session lane.
+    const response = await postVerificationCommand(api, cwd, session, accountId, sub, { envelopeId });
     if (response.envelope) writeLocalVerificationEnvelope(cwd, response.envelope);
     if (response.report) {
       console.log(response.report);
@@ -13542,6 +14004,239 @@ function describeRunLocation(record) {
   return parts.join('  ');
 }
 
+async function activityInspectCommand(flags) {
+  const cwd = process.cwd();
+  ensureLocalState(cwd);
+  const sessionContext = resolveSessionContext(cwd, flags);
+  const { session, accountId } = sessionContext;
+  const baseUrl = flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL;
+  const api = buildAxios(baseUrl, session.token, 30000);
+  const response = await loggedPost(api, cwd, '/cli/activityInspect', {
+    token: session.token,
+    accountId,
+    scope: flags.scope || 'self',
+    dataMode: resolveDataMode(flags, session),
+    userId: flags['user-id'] || flags.userId || flags['cli-user-id'],
+    userEmail: flags['user-email'] || flags.email,
+    limit: flags.limit || flags.max || 20,
+    envelopeLimit: flags['envelope-limit'] || flags.envelopeLimit
+  }).then((r) => r.data);
+
+  if (!response.success) throw new Error(response.message || 'Activity inspection failed');
+  if (flagEnabled(flags.json)) {
+    const payload = (flagEnabled(flags.summary) || flagEnabled(flags.compact))
+      ? compactActivityInspect(response)
+      : response;
+    console.log(JSON.stringify(payload, null, 2));
+    return payload;
+  }
+
+  printSessionResolutionWarning(sessionContext);
+  printResolvedBaseUrl(baseUrl);
+  printActivityInspectSummary(response);
+  return response;
+}
+
+function smellSeverityRank(smell) {
+  const severity = String((smell && smell.severity) || 'info').toLowerCase();
+  if (severity === 'critical') return 0;
+  if (severity === 'high') return 1;
+  if (severity === 'medium') return 2;
+  if (severity === 'low') return 3;
+  return 4;
+}
+
+function sortedActivitySmells(smells) {
+  return (Array.isArray(smells) ? smells.slice() : []).sort((left, right) => {
+    const severity = smellSeverityRank(left) - smellSeverityRank(right);
+    if (severity) return severity;
+    return String(right.updatedAt || right.at || '').localeCompare(String(left.updatedAt || left.at || ''));
+  });
+}
+
+function slimActivitySmell(smell) {
+  const s = smell || {};
+  return {
+    severity: s.severity || 'info',
+    type: s.type || 'signal',
+    summary: s.summary || null,
+    accountId: s.accountId || null,
+    laneId: s.laneId || null,
+    envelopeId: s.envelopeId || null,
+    taskId: s.taskId || null,
+    branchName: s.branchName || null,
+    workspace: s.workspace || null
+  };
+}
+
+function compactActivityInspect(response) {
+  const counts = response.counts || {};
+  const smells = sortedActivitySmells(response.smells);
+  const lanes = Array.isArray(response.lanes) ? response.lanes : [];
+  const envelopes = Array.isArray(response.envelopes) ? response.envelopes : [];
+  const testRuns = Array.isArray(response.testRuns) ? response.testRuns : [];
+  const nextActions = smells
+    .filter((smell) => smellSeverityRank(smell) <= 2)
+    .slice(0, 5)
+    .map((smell) => (smell.type || 'signal') + ': ' + (smell.summary || 'inspect this signal'));
+
+  return {
+    success: response.success,
+    accountId: response.accountId,
+    accountName: response.accountName || null,
+    scope: response.scope || 'self',
+    dataMode: response.dataMode,
+    accounts: response.accountIds || [],
+    counts: {
+      agents: counts.agents || 0,
+      lanes: counts.lanes || lanes.length || 0,
+      verificationEnvelopes: counts.verificationEnvelopes || envelopes.length || 0,
+      testRuns: counts.testRuns || testRuns.length || 0,
+      corpusResults: counts.corpusResults || 0,
+      smells: smells.length
+    },
+    topSmells: smells.slice(0, 10).map(slimActivitySmell),
+    currentLanes: lanes.slice(0, 10).map((lane) => ({
+      laneId: lane.laneId || null,
+      accountId: lane.accountId || null,
+      branchName: lane.branchName || null,
+      workspace: lane.workspace || null,
+      stagedCount: lane.stagedCountAsOf || lane.stagedCount || 0,
+      worksetCount: lane.worksetCountAsOf == null ? null : lane.worksetCountAsOf,
+      userEmail: lane.userEmail || null,
+      expiresInSeconds: lane.expiresInSeconds == null ? null : lane.expiresInSeconds
+    })),
+    recentEnvelopes: envelopes.slice(0, 8).map((env) => ({
+      envelopeId: env.envelopeId || null,
+      status: env.status || 'unknown',
+      summary: env.summary || null,
+      packetCount: env.packetCount || 0,
+      currentFailureCount: env.currentFailureCount || 0,
+      health: env.health || null,
+      updatedAt: formatTime(env.updatedAtMs || env.lastPacketAtMs || env.createdAt)
+    })),
+    recentTestRuns: testRuns.slice(0, 8).map((run) => ({
+      taskId: run.taskId || null,
+      testName: run.testName || null,
+      passed: run.passed || 0,
+      total: run.total || 0,
+      branchName: run.branchName || null,
+      workspace: run.workspace || null,
+      ai: corpusAiLabel(run),
+      completedAt: formatTime(run.completedAt || run.startedAt)
+    })),
+    nextActions
+  };
+}
+
+function printActivityInspectSummary(response) {
+  const subject = response.subjectUser
+    ? ' for ' + (response.subjectUser.email || response.subjectUser.name || ('user ' + response.subjectUser.id))
+    : '';
+  console.log('Activity inspection' + subject + ' — ' + response.dataMode + ' lane');
+  console.log('Scope: ' + (response.accountName || ('account ' + response.accountId)) +
+    ' (' + response.accountId + '), ' + (response.scope || 'self') +
+    ' · accounts ' + ((response.accountIds || []).join(', ') || response.accountId));
+  const counts = response.counts || {};
+  console.log('Counts: ' +
+    (counts.agents || 0) + ' agent(s), ' +
+    (counts.lanes || 0) + ' lane(s), ' +
+    (counts.verificationEnvelopes || 0) + ' envelope(s), ' +
+    (counts.testRuns || 0) + ' test run(s), ' +
+    (counts.corpusResults || 0) + ' corpus result(s)');
+
+  const smells = sortedActivitySmells(response.smells);
+  console.log('');
+  if (!smells.length) {
+    console.log('Smells: none detected in this slice.');
+  } else {
+    console.log('Top smells (' + smells.length + '):');
+    smells.slice(0, 20).forEach((smell) => {
+      console.log('  [' + (smell.severity || 'info') + '] ' + (smell.type || 'signal') + ': ' + smell.summary);
+      const pivots = [
+        smell.accountId ? 'account ' + smell.accountId : null,
+        smell.laneId ? 'lane ' + smell.laneId : null,
+        smell.envelopeId ? 'envelope ' + smell.envelopeId : null,
+        smell.taskId ? 'task ' + smell.taskId : null,
+        smell.testName || null,
+        smell.branchName ? 'branch ' + smell.branchName : null,
+        smell.workspace ? 'ws:' + smell.workspace : null
+      ].filter(Boolean);
+      if (pivots.length) console.log('       ' + pivots.join(' · '));
+    });
+    if (smells.length > 20) console.log('  ...' + (smells.length - 20) + ' more; rerun with --json');
+    const actions = compactActivityInspect(response).nextActions;
+    if (actions.length) {
+      console.log('');
+      console.log('Next actions:');
+      actions.forEach((action) => console.log('  - ' + action));
+    }
+  }
+
+  const lanes = response.lanes || [];
+  if (lanes.length) {
+    console.log('');
+    console.log('Current staging lanes:');
+    lanes.slice(0, 12).forEach((lane) => {
+      const ws = lane.workspace ? ' [ws:' + lane.workspace + ']' : ' [shared]';
+      const workset = lane.worksetKnown && lane.worksetCountAsOf != null
+        ? ' workset ' + lane.worksetCountAsOf
+        : ' workset unknown';
+      console.log('  - account ' + lane.accountId + ' ' + (lane.branchName || '?') + ws +
+        ' overlay ' + (lane.stagedCountAsOf || 0) + workset +
+        (lane.userEmail ? ' · ' + lane.userEmail : '') +
+        (lane.expiresInSeconds != null ? ' · expires ~' + Math.round(lane.expiresInSeconds / 60) + 'm' : ''));
+    });
+    if (lanes.length > 12) console.log('  ...' + (lanes.length - 12) + ' more lane(s)');
+  }
+
+  const envelopes = response.envelopes || [];
+  if (envelopes.length) {
+    console.log('');
+    console.log('Recent verification envelopes:');
+    envelopes.slice(0, 8).forEach((env) => {
+      console.log('  - ' + (env.status || 'unknown') + ' · ' + (env.packetCount || 0) + ' packet(s) · ' +
+        (env.summary || env.envelopeId) + ' · ' + formatTime(env.updatedAtMs || env.lastPacketAtMs || env.createdAt));
+      if (env.currentFailureCount) console.log('      current failures: ' + env.currentFailureCount);
+    });
+  }
+
+  const runs = response.testRuns || [];
+  if (runs.length) {
+    console.log('');
+    console.log('Recent test runs:');
+    runs.slice(0, 8).forEach((run) => {
+      console.log('  - ' + (run.testName || run.taskId) + ' · ' + (run.passed || 0) + '/' + (run.total || 0) +
+        ' passed · ' + (run.branchName || '?') + (run.workspace ? ' [ws:' + run.workspace + ']' : '') +
+        ' · ' + corpusAiLabel(run) + ' · ' + formatTime(run.completedAt || run.startedAt));
+    });
+  }
+
+  const corpus = response.corpusResults || [];
+  if (corpus.length) {
+    console.log('');
+    console.log('Recent corpus measurements:');
+    corpus.slice(0, 6).forEach((row) => {
+      console.log('  - ' + (row.corpus || '?') + '/' + (row.caseKey || '?') + ' · ' +
+        (row.outcome || 'unknown') + ' · ' + (row.testName || row.taskId) +
+        ' · ' + formatTime(row.recordedAt));
+    });
+  }
+
+  const timeline = response.timeline || [];
+  if (timeline.length) {
+    console.log('');
+    console.log('Timeline:');
+    timeline.slice(0, 12).forEach((item) => {
+      console.log('  - ' + formatTime(item.at) + ' · ' + item.type + ' · ' +
+        (item.label || '') + (item.detail ? ' · ' + item.detail : ''));
+    });
+  }
+  console.log('');
+  console.log('Compact JSON: remits-cli activity inspect --summary --json');
+  console.log('Full structured payload: remits-cli activity inspect --json');
+}
+
 /**
  * The live work map: which repositories are being edited, by whom, and who else is around.
  *
@@ -13815,6 +14510,7 @@ async function agentCommand(flags, subcommand) {
     case 'work': return agentWorkCommand(flags);
     case 'list': case 'ls': return agentListCommand(flags);
     case 'map': case 'work-map': case 'workmap': return agentWorkMapCommand(flags);
+    case 'inspect': case 'activity': return activityInspectCommand(flags);
     case 'repos': case 'repo': return agentReposCommand(flags);
     case 'release': case 'deregister': case 'stop': return agentReleaseCommand(flags);
     case 'heartbeat-daemon': return agentHeartbeatDaemonCommand(flags);
@@ -13867,6 +14563,8 @@ function printAgentHelp() {
   console.log('');
   console.log('  list [--account-id ID] [--json]      Who else is available for an account.');
   console.log('  map  [--account-ids 1,4] [--json]    Who is EDITING which repository right now.');
+  console.log('  inspect [--account-id ID] [--scope self|children] [--user-email E] [--json]');
+  console.log('      Read-only workstream story + smell signals for another CLI user or agent fleet.');
   console.log('      One agent at a time may edit an account\'s repo (the edit lease); everyone else');
   console.log('      investigates read-only. Check this before starting work that changes files.');
   console.log('  repos [--rescan] [--json]            WHERE each account is checked out on this machine —');
@@ -14505,17 +15203,18 @@ function printVerifyHelp() {
   console.log('Usage: remits-cli verify <subcommand>');
   console.log('');
   console.log('Envelope lifecycle:');
-  console.log('  remits-cli verify start --summary "..." [--manifest file.json] [--ticket ID]');
+  console.log('  remits-cli verify start --summary "..." [--manifest file.json] [--ticket ID] [--data-mode test|prod]');
   console.log('  remits-cli verify list [--max 50] [--json]');
   console.log('  remits-cli verify use <envelopeId>');
   console.log('  remits-cli verify current');
   console.log('  remits-cli verify clear [--all]');
-  console.log('  remits-cli verify show [--envelope ID] [--json]');
+  console.log('  remits-cli verify show [--envelope ID] [--summary|--compact] [--json]');
   console.log('  remits-cli verify status [--envelope ID]');
   console.log('  remits-cli verify report [--envelope ID]');
   console.log('  remits-cli verify abandon --envelope ID --reason "..."');
   console.log('  remits-cli verify supersede --envelope ID --superseded-by ID [--reason "..."]');
-  console.log('  Active envelopes are scoped by host, account, branch, workspace, and data mode.');
+  console.log('  One active envelope per checkout world: host, account, git branch, workspace (not data lane).');
+  console.log('  verify start proves in the test lane unless you pass --data-mode prod.');
   console.log('');
   console.log('Manifest and manual evidence:');
   console.log('  remits-cli verify manifest --file file.json [--envelope ID]');
@@ -14531,6 +15230,14 @@ function printVerifyHelp() {
   console.log('  remits-cli verify sync --safe');
   console.log('  remits-cli verify tool --name mcp_tool --input \'{...}\'');
   console.log('');
+  console.log('World check (asked of the platform before stage, test run, token, tool, sync, and commit run):');
+  console.log('  attach  same world as the envelope requires - evidence attaches.');
+  console.log('  refuse  different world AND a requirement could use this evidence - nothing runs; the');
+  console.log('          refusal names the flag that fixes it (e.g. --data-mode prod, --as-account 21).');
+  console.log('  detach  different world, nothing in the manifest could use it - runs, attaches nothing, says so.');
+  console.log('  --allow-wrong-world-evidence attaches anyway as context (the report lists it wrong-world).');
+  console.log('  verify token / verify tool run in the envelope\'s lane when it is test.');
+  console.log('');
   console.log('Existing commands also accept --verify-envelope <id> and --no-verify-envelope.');
 }
 
@@ -14571,6 +15278,11 @@ async function main() {
   // Skip for lifecycle subcommands and help.
   const isLifecycleCmd = command === 'listen' || command === 'start' || command === 'stop' || command === 'status' || command === 'whoami' || command === 'doctor' || command === 'agent' || command === 'ticket';
   const isHelpCmd = !command || command === 'help' || command === '--help' || wantsHelp;
+  if (!wantsJson && !isHelpCmd && command === 'components') {
+    const commandName = 'components ' + (subcommand || 'command');
+    const problem = platformRepoAccountCommandProblem(process.cwd(), args, commandName, null);
+    if (problem) throw new Error(problem);
+  }
   if (!wantsJson && !isHelpCmd && !isLifecycleCmd && !isListenerRunning()) {
     try {
       const dashboardUrl = await autoStartServiceIfNeeded();
@@ -14601,6 +15313,7 @@ async function main() {
     console.log('  remits-cli agent status [--state idle|working|paused] [--ticket ID] [--activity "..."]');
     console.log('  remits-cli agent list [--account-id ID]                             # who else is available');
     console.log('  remits-cli agent map [--account-ids 1,4] [--json]                   # who is EDITING what, where, right now');
+    console.log('  remits-cli activity inspect [--account-id ID] [--scope self|children] [--user-email E] [--summary|--compact] [--json]');
     console.log('  remits-cli agent release                                            # stop receiving tickets now');
     console.log('  remits-cli start [--foreground true] [--port 8787]                  # human dashboard in the browser');
     console.log('  remits-cli stop');
@@ -14651,7 +15364,7 @@ async function main() {
     console.log('A WORKSPACE is an optional second isolation axis for staging, alongside the git branch.');
     console.log('Staging is keyed by (account, cli user, branch, workspace) — and account and user are fixed');
     console.log('for a given repo, so without a workspace the branch is the ONLY axis. That is why two coding');
-    console.log('agents in two worktrees of the same branch overwrite each other: `components stage` uploads');
+    console.log('agents in two checkouts without their own workspace overwrite each other: `components stage` uploads');
     console.log('the whole repo and replaces the lane wholesale.');
     console.log('');
     console.log('A workspace isolates staging WITHOUT changing anything else:');
@@ -14659,13 +15372,13 @@ async function main() {
     console.log('  - the run still resolves whatever committed ComponentVariant branch the account subscribes to');
     console.log('  - only which staged entries shadow them changes');
     console.log('');
-    console.log('Typical setup, one worktree per agent, all on the same branch:');
-    console.log('  git fetch origin');
+    console.log('Typical setup, one clone per agent, all on the same branch:');
+    console.log('  git clone <repo-url> ../ms-agent-a');
+    console.log('  cd ../ms-agent-a');
     console.log('  git switch forked');
     console.log('  git pull --ff-only origin forked');
     console.log('  git rev-list --left-right --count HEAD...origin/forked   # must print: 0  0');
-    console.log('  git worktree add --force ../ms-agent-a forked');
-    console.log('  cd ../ms-agent-a && remits-cli workspace use --auto');
+    console.log('  remits-cli workspace use --auto');
     console.log('  remits-cli components status      # branch world + staging lane + other lanes');
     console.log('  remits-cli components stage          # isolated lane; nobody else sees it');
     console.log('  remits-cli test run --test 42        # resolves this lane over the forked variants');
@@ -14674,7 +15387,8 @@ async function main() {
     console.log('Precedence: --workspace  >  REMITS_WORKSPACE  >  .remits-cli/workspace  >  shared default lane');
     console.log('Use --no-workspace on a single command to target the shared lane without clearing the file.');
     console.log('');
-    console.log('`.remits-cli/workspace` is per-checkout and gitignored, so a worktree keeps its own lane.');
+    console.log('`.remits-cli/workspace` is per-checkout and gitignored, so each clone keeps its own lane.');
+    console.log('Avoid same-branch worktrees for concurrent agents: they share the branch ref, so one pull moves HEAD under the others, and `components commit` refuses there.');
     process.exit(0);
   }
 
@@ -14823,6 +15537,22 @@ async function main() {
     return;
   }
 
+  if (command === 'activity') {
+    if (wantsHelp || !subcommand) {
+      console.log('Usage: remits-cli activity inspect [--account-id ID] [--scope self|children] [--user-id ID|--user-email EMAIL] [--limit N] [--summary|--compact] [--json]');
+      console.log('');
+      console.log('Read-only workstream inspection for agent/operator review. Joins current staging lanes,');
+      console.log('verification envelopes, durable test runs, corpus measurements, live agent presence,');
+      console.log('and heuristic smell signals without changing any lane or checkout.');
+      return;
+    }
+    if (subcommand === 'inspect') {
+      await activityInspectCommand(args);
+      return;
+    }
+    throw new Error('Unknown activity subcommand: ' + subcommand);
+  }
+
   if (command === 'ticket') {
     if (wantsHelp || !subcommand) {
       printTicketHelp();