@remits/remits-cli 0.1.133 → 0.1.135

package/index.js

@@ -6,16 +6,16 @@
 - L22  Runtime Bootstrap And Shared State
 - L119  Sessions, Account Resolution, And Production Guards
 - L603  Local State, Workspaces, And Verification Evidence
-- L2255  Account Repos, Guide Sync, And Platform Repo
-- L2949  Component Discovery And HTTP Logging
-- L3525  Skill Delivery And TOC Resolution
-- L3835  Auth And Component Staging
-- L4449  Component Summaries, Status, And Sync Gates
-- L6518  Branches, Promotion, Commit, And Test Runs
-- L8183  Tokens, Tools, Verification, And Config
-- L9405  Service Dashboard And WebSocket Listener
-- L11521  Agent And Ticket Workflows
-- L14815  Help, Auto Update, And Command Dispatch
+- L2474  Account Repos, Guide Sync, And Platform Repo
+- L3282  Component Discovery And HTTP Logging
+- L3923  Skill Delivery And TOC Resolution
+- L4233  Auth And Component Staging
+- L4848  Component Summaries, Status, And Sync Gates
+- L6917  Branches, Promotion, Commit, And Test Runs
+- L8600  Tokens, Tools, Verification, And Config
+- L9980  Service Dashboard And WebSocket Listener
+- L12101  Agent And Ticket Workflows
+- L15573  Help, Auto Update, And Command Dispatch
 */
 
 /*
@@ -621,6 +621,7 @@ function localStatePaths(cwd) {
     actorDir,
     sharedDir: path.join(base, 'shared'),
     toolsDir: path.join(base, 'shared', 'tools'),
+    workstreamsDir: path.join(base, 'shared', 'workstreams'),
     sessionsDir: path.join(actorDir, 'sessions'),
     toolResponsesDir: path.join(actorDir, 'tool-responses'),
     verificationDir: path.join(actorDir, 'verification'),
@@ -924,6 +925,112 @@ function localStateSummary(cwd, flags = {}) {
   };
 }
 
+function normalizeWorkstreamId(value) {
+  if (value === undefined || value === null) return null;
+  const trimmed = String(value).trim();
+  if (!trimmed) return null;
+  let normalized = trimmed
+    .toLowerCase()
+    .replace(/[^a-z0-9._-]/g, '-')
+    .replace(/-+/g, '-')
+    .replace(/^[-.]+/, '')
+    .replace(/[-.]+$/, '');
+  return normalized ? normalized.slice(0, 96).replace(/[-.]+$/, '') : null;
+}
+
+// The LOCAL proof-campaign id: the thing that groups several actor directories working one goal. It is not
+// the same `workstream` a support ticket carries — that one is an account's own routing label, matched by
+// `agent serve --serves`. They share a flag name and nothing else; keep the distinction in any text that
+// mentions either.
+function resolveWorkstreamId(cwd, flags = {}, context = {}) {
+  return normalizeWorkstreamId(flags.workstream || flags['workstream-id'] || process.env.REMITS_WORKSTREAM_ID ||
+    context.workstream || context.workspace || resolveWorkspace(cwd, flags));
+}
+
+const WORKSTREAM_ROLE_KEYS = ['repoAccountId', 'accountId', 'executionAccountId', 'targetAccountId',
+  'branchName', 'componentBranch', 'workspace', 'dataMode'];
+
+function workstreamRoleSignature(world) {
+  if (!world || typeof world !== 'object') return null;
+  const signature = {};
+  WORKSTREAM_ROLE_KEYS.forEach((key) => {
+    if (world[key] !== undefined && world[key] !== null) signature[key] = world[key];
+  });
+  return Object.keys(signature).length ? signature : null;
+}
+
+function workstreamWorldParts(world) {
+  const roles = world || {};
+  return [
+    roles.repoAccountId ? 'repo ' + roles.repoAccountId : null,
+    roles.accountId ? 'account ' + roles.accountId : null,
+    roles.executionAccountId ? 'exec ' + roles.executionAccountId : null,
+    roles.targetAccountId ? 'target ' + roles.targetAccountId : null,
+    roles.branchName ? 'branch ' + roles.branchName : null,
+    roles.componentBranch ? 'componentBranch ' + roles.componentBranch : null,
+    roles.workspace ? 'ws:' + roles.workspace : null,
+    roles.dataMode ? 'data ' + roles.dataMode : null
+  ].filter(Boolean);
+}
+
+function dedupeWorkstreamWorlds(worlds) {
+  const seen = new Set();
+  const out = [];
+  (worlds || []).forEach((world) => {
+    if (!world || !Object.keys(world).length) return;
+    const key = JSON.stringify(WORKSTREAM_ROLE_KEYS.map((k) => world[k] === undefined ? null : world[k]));
+    if (seen.has(key)) return;
+    seen.add(key);
+    out.push(world);
+  });
+  return out.slice(-12);
+}
+
+function workstreamFile(cwd, workstreamId) {
+  const paths = ensureLocalState(cwd);
+  ensureDir(paths.workstreamsDir);
+  return path.join(paths.workstreamsDir, normalizeWorkstreamId(workstreamId) + '.json');
+}
+
+function recordWorkstreamArtifact(cwd, flags = {}, artifact = {}) {
+  const workstreamId = resolveWorkstreamId(cwd, flags, artifact);
+  if (!workstreamId) return null;
+  const file = workstreamFile(cwd, workstreamId);
+  let existing = {};
+  try {
+    if (fs.existsSync(file)) existing = JSON.parse(fs.readFileSync(file, 'utf8')) || {};
+  } catch (_) {
+    existing = {};
+  }
+  const now = new Date().toISOString();
+  const actor = localStatePaths(cwd).actor.id;
+  const item = Object.assign({
+    actor,
+    recordedAt: now
+  }, artifact || {});
+  const artifacts = Array.isArray(existing.artifacts) ? existing.artifacts : [];
+  const dedupeKey = [item.type, item.callId, item.envelopeId, item.packetId, item.path].filter(Boolean).join('|');
+  const filtered = dedupeKey
+    ? artifacts.filter((row) => [row.type, row.callId, row.envelopeId, row.packetId, row.path].filter(Boolean).join('|') !== dedupeKey)
+    : artifacts;
+  // The LAST world, never a merge of all of them. Merging produced a "World:" line that no single run ever
+  // executed in — a leftover targetAccountId from one command printed next to the executionAccountId of
+  // another. A campaign that legitimately spans worlds is reported as several worlds, not as one blend.
+  const roles = workstreamRoleSignature(artifact.world) || existing.roles || {};
+  const priorWorlds = Array.isArray(existing.worlds) ? existing.worlds : (existing.roles ? [existing.roles] : []);
+  const worlds = dedupeWorkstreamWorlds(priorWorlds.concat([roles]));
+  const next = Object.assign({}, existing, {
+    workstreamId,
+    updatedAt: now,
+    actors: Array.from(new Set([].concat(existing.actors || [], actor))).sort(),
+    roles,
+    worlds,
+    artifacts: filtered.concat([item]).slice(-200)
+  });
+  atomicWriteFile(file, JSON.stringify(next, null, 2));
+  return file;
+}
+
 // ---------------------------------------------------------------------------------------------------
 // Staging workspace
 // ---------------------------------------------------------------------------------------------------
@@ -1463,6 +1570,40 @@ function writeActiveVerificationContexts(cwd, contexts) {
   atomicWriteFile(paths.activeVerificationContextsFile, JSON.stringify(contexts || {}, null, 2));
 }
 
+function describeVerificationWorld(context = {}) {
+  return ['account ' + (context.accountId != null ? context.accountId : '?'),
+    'branch ' + (context.branchName || context.branch || '?'),
+    'workspace ' + (normalizeWorkspace(context.workspace) || 'shared'),
+    context.dataMode ? 'data ' + context.dataMode : null].filter(Boolean).join(', ');
+}
+
+/**
+ * Active envelope pointers this actor holds for a DIFFERENT checkout world than the one running now. Used
+ * only to explain a silence: an agent that started an envelope on `main` and then worked `--branch forked`
+ * otherwise gets no envelope, no detach message, and no reason.
+ */
+function otherWorldVerificationEnvelopes(cwd, context) {
+  try {
+    const currentKey = verificationContextKey(context);
+    const contexts = readActiveVerificationContexts(cwd);
+    return Object.keys(contexts)
+      .filter((key) => key !== currentKey && !legacyVerificationContextKeys(currentKey).includes(key))
+      .map((key) => {
+        const entry = typeof contexts[key] === 'string' ? { envelopeId: contexts[key] } : contexts[key];
+        if (!entry || !entry.envelopeId) return null;
+        return { envelopeId: String(entry.envelopeId), updatedAt: entry.updatedAt, context: entry.context || {} };
+      })
+      .filter(Boolean)
+      // Only pointers for THIS host and account: an envelope for another account is not a missing binding,
+      // it is different work.
+      .filter((entry) => String(entry.context.accountId) === String(context.accountId) &&
+        normalizeBaseUrl(entry.context.baseUrl || '') === normalizeBaseUrl(context.baseUrl || ''))
+      .sort((left, right) => String(right.updatedAt || '').localeCompare(String(left.updatedAt || '')));
+  } catch (_) {
+    return [];
+  }
+}
+
 function activeVerificationContext(cwd, flags = {}, session = null, accountId = null) {
   return {
     baseUrl: normalizeBaseUrl(flags['base-url'] || (session && session.baseUrl) || DEFAULT_BASE_URL),
@@ -1768,7 +1909,25 @@ async function verificationPreflight(api, cwd, session, accountId, flags = {}, p
   const label = options.command || 'this command';
   const context = activeVerificationContext(cwd, flags, session, accountId);
   const envelopeId = verificationEnvelopeIdForCommand(cwd, flags, context);
-  if (!envelopeId) return { envelopeId: null, verdict: 'none', evidenceFlags: flags };
+  if (!envelopeId) {
+    // An envelope is bound per CHECKOUT WORLD, so `verify start` on one branch/workspace and the work on
+    // another leaves the agent with an active envelope it cannot see and a command that says nothing at all:
+    // it did the work, attached no evidence, and reported neither. Silence is only correct when there is no
+    // envelope to speak of.
+    if (!options.quiet) {
+      const orphan = otherWorldVerificationEnvelopes(cwd, context);
+      if (orphan.length) {
+        console.error('No verification envelope is active for this world (' + describeVerificationWorld(context) + '), ' +
+          'so ' + label + ' attaches no evidence. You have ' + orphan.length + ' active envelope(s) bound to other worlds:');
+        orphan.slice(0, 3).forEach((entry) => {
+          console.error('  - ' + entry.envelopeId + '  ' + describeVerificationWorld(entry.context));
+        });
+        console.error('  Start one here with `remits-cli verify start --summary "..."`, adopt one with ' +
+          '`remits-cli verify use <id>`, or re-run in the world that envelope was started in.');
+      }
+    }
+    return { envelopeId: null, verdict: 'none', evidenceFlags: flags };
+  }
   const pinned = Object.assign({}, flags, { 'verify-envelope': envelopeId });
   let result;
   try {
@@ -1851,7 +2010,23 @@ async function appendVerificationPacket(api, cwd, session, accountId, flags, pac
   }, packet || {});
   finalPacket.envelopeId = envelopeId;
   stampPacketRepoAccount(finalPacket, accountId);
+  // The workstream id travels WITH the evidence. Without it the local index and the platform's
+  // `activity inspect --scope related` share no identifier, so two agents on one campaign — the case this
+  // whole surface exists for — could never be shown the same set of work.
+  const packetWorkstreamId = resolveWorkstreamId(cwd, flags, finalPacket.world || {});
+  if (packetWorkstreamId) {
+    if (!finalPacket.world || typeof finalPacket.world !== 'object') finalPacket.world = {};
+    if (!finalPacket.world.workstreamId) finalPacket.world.workstreamId = packetWorkstreamId;
+  }
   writeLocalVerificationPacket(cwd, envelopeId, finalPacket);
+  recordWorkstreamArtifact(cwd, flags, {
+    type: 'verification_packet',
+    envelopeId,
+    packetId: finalPacket.packetId,
+    packetType: finalPacket.type,
+    world: finalPacket.world || {},
+    workspace: finalPacket.world && finalPacket.world.workspace
+  });
   try {
     const response = await postVerificationCommand(api, cwd, session, accountId, 'packet', {
       envelopeId,
@@ -1934,13 +2109,14 @@ function printVerificationEnvelope(envelope, fallbackEnvelopeId) {
   }
 }
 
-function slimVerificationPacket(packet) {
+function slimVerificationPacket(packet, options = {}) {
   const p = packet || {};
   const world = p.world || {};
+  const hasSuccess = Object.prototype.hasOwnProperty.call(p, 'success');
   return {
     packetId: p.packetId || p.id || null,
     type: p.type || 'unknown',
-    success: p.success !== false,
+    success: hasSuccess ? p.success !== false : options.defaultSuccess !== false,
     stale: Boolean(p.stale),
     claim: p.claim || p.summary || null,
     taskId: p.taskId || (p.testRun && p.testRun.taskId) || null,
@@ -2002,7 +2178,7 @@ function compactVerificationEnvelope(envelope, fallbackEnvelopeId) {
       recent: packets.slice(-5).map(slimVerificationPacket)
     },
     latestByType,
-    currentFailures: failures.slice(0, 10).map(slimVerificationPacket),
+    currentFailures: failures.slice(0, 10).map((packet) => slimVerificationPacket(packet, { defaultSuccess: false })),
     stale: stale.slice(0, 10).map(slimVerificationPacket),
     warnings: (env.warnings || []).slice(0, 10),
     nextActions
@@ -2096,16 +2272,35 @@ async function readVerificationPacketsForDiagnostics(api, cwd, session, accountI
 }
 
 function buildCommandWorld(response, fallback = {}) {
+  if (response && response.world && typeof response.world === 'object') {
+    return Object.assign({}, response.world, {
+      host: response.world.host || fallback.host,
+      dataMode: response.world.dataMode || response.dataMode || fallback.dataMode,
+      branchName: response.world.branchName || response.branchName || fallback.branchName,
+      workspace: response.world.workspace !== undefined ? response.world.workspace : fallback.workspace
+    });
+  }
   const source = (response && response.staging) || {};
   const resolution = (response && response.resolution) || {};
   const result = (response && response.result) || {};
   const laneHash = laneContentHashFrom(response) || fallback.laneContentHash || fallback.stagedOverlayHash;
-  const executionAccountId = response && (response.executionAccountId || result.accountId || source.executionAccountId || response.accountId) ||
+  const addressedAccountId = response && (response.repoAccountId || response.checkoutAccountId || response.scopeRootAccountId ||
+    response.accountId || response.ownerAccountId) ||
+    fallback.repoAccountId || fallback.checkoutAccountId || fallback.scopeRootAccountId || fallback.addressedAccountId || fallback.accountId;
+  const executionAccountId = response && (response.executionAccountId || result.accountId || source.executionAccountId) ||
     resolution.executionAccountId ||
-    fallback.executionAccountId;
+    fallback.executionAccountId ||
+    // Legacy/fallback callers historically supplied only `accountId`, and for all non-split worlds that
+    // value is both repo and execution. Never let a top-level response.accountId (usually addressed/repo) be
+    // the execution account unless the caller intentionally passed it as the fallback.
+    fallback.accountId;
   return {
-    accountId: response && (response.accountId || response.ownerAccountId) || fallback.accountId,
+    accountId: executionAccountId,
+    repoAccountId: response && response.repoAccountId || fallback.repoAccountId || addressedAccountId,
+    scopeRootAccountId: response && response.scopeRootAccountId || fallback.scopeRootAccountId,
+    checkoutAccountId: response && response.checkoutAccountId || fallback.checkoutAccountId || addressedAccountId,
     executionAccountId,
+    targetAccountId: response && response.targetAccountId || fallback.targetAccountId,
     addressedAccountId: resolution.addressedAccountId || fallback.addressedAccountId,
     host: fallback.host,
     dataMode: response && response.dataMode || fallback.dataMode,
@@ -2122,10 +2317,34 @@ function buildCommandWorld(response, fallback = {}) {
       fallback.componentBranch,
     variantBranchSource: response && (response.variantBranchSource || (response.variantWorld && response.variantWorld.variantBranchSource)) || fallback.variantBranchSource,
     variantId: resolution.variantId || fallback.variantId,
+    componentSource: response && response.componentSource || fallback.componentSource,
+    componentSignature: response && response.componentSignature || fallback.componentSignature,
     sourceLayer: fallback.sourceLayer || (source.testComponentSource === 'staged' ? 'staged' : undefined)
   };
 }
 
+function buildToolStatusWorld(data, stored = {}, fallback = {}) {
+  const response = data && typeof data === 'object' ? data : {};
+  const previous = stored && typeof stored === 'object' ? stored : {};
+  return buildCommandWorld(response, {
+    repoAccountId: response.repoAccountId || previous.repoAccountId || fallback.repoAccountId || previous.checkoutAccountId || previous.accountId || fallback.accountId,
+    scopeRootAccountId: response.scopeRootAccountId || previous.scopeRootAccountId || fallback.scopeRootAccountId,
+    checkoutAccountId: response.checkoutAccountId || previous.checkoutAccountId || fallback.checkoutAccountId,
+    accountId: response.executionAccountId || previous.executionAccountId || fallback.executionAccountId || fallback.accountId,
+    executionAccountId: response.executionAccountId || previous.executionAccountId || fallback.executionAccountId,
+    targetAccountId: response.targetAccountId || previous.targetAccountId || fallback.targetAccountId,
+    dataMode: response.dataMode || previous.dataMode || fallback.dataMode,
+    branchName: response.branchName || previous.branchName || fallback.branchName,
+    workspace: response.workspace !== undefined ? response.workspace : (previous.workspace !== undefined ? previous.workspace : fallback.workspace),
+    host: fallback.host,
+    componentSource: response.componentSource || previous.componentSource || fallback.componentSource,
+    componentSignature: response.componentSignature || previous.componentSignature || fallback.componentSignature,
+    componentBranch: response.componentBranch || previous.componentBranch || fallback.componentBranch,
+    variantBranch: response.variantBranch || previous.variantBranch || fallback.variantBranch,
+    variantBranchSource: response.variantBranchSource || previous.variantBranchSource || fallback.variantBranchSource
+  });
+}
+
 // A variant sync writes overlays on exactly one component branch; say so in the packet world, where a manifest's
 // componentBranch is compared. Without it no sync_mutation could satisfy a manifest that declares one.
 function syncPacketWorld(response, world, branchName) {
@@ -2444,6 +2663,120 @@ async function downloadAndSyncGuides(cwd, ctx) {
   return writeGuidePayloadIntoRepo(cwd, payload);
 }
 
+function guideSyncSummaryLine(summary) {
+  if (!summary) {
+    return 'guide sync skipped';
+  }
+  const repoCount = Number(summary.repoCount || 0);
+  const updatedRepos = Number(summary.updatedRepos || 0);
+  const updatedFiles = Number(summary.updatedFiles || 0);
+  const skipped = (summary.skipped || []).length;
+  return updatedRepos + '/' + repoCount + ' repo(s) updated, ' + updatedFiles +
+    ' file(s) changed' + (skipped ? ', ' + skipped + ' skipped' : '');
+}
+
+function guideSyncSessions(requestedBaseUrl = null) {
+  return listSessionsFromStore(readAllSessions()).filter((session) => {
+    if (!session || !session.token) return false;
+    if (!requestedBaseUrl) return true;
+    return normalizeBaseUrl(session.baseUrl || DEFAULT_BASE_URL) === normalizeBaseUrl(requestedBaseUrl);
+  });
+}
+
+function guideSessionForRepo(entry, sessions) {
+  const accountId = Number(entry && entry.accountId);
+  return sessions.find((session) => Number(session.accountId) === accountId) || sessions[0] || null;
+}
+
+// Refresh every indexed account checkout from the authenticated platform guide payload. This is the
+// operator-level repair path for "agents are reading stale front-stage docs": it does not wait for each
+// checkout to happen to run a component command.
+async function syncGuidesAcrossIndexedRepos(options = {}) {
+  if (options.rescan !== false) {
+    try { discoverAccountRepos(); } catch (_) { /* use the current index */ }
+  }
+
+  const sessions = guideSyncSessions(options.baseUrl || null);
+  const entries = listAccountRepoEntries(readAccountRepoIndex())
+    .sort((a, b) => Number(a.accountId) - Number(b.accountId));
+  const result = {
+    repoCount: entries.length,
+    updatedRepos: 0,
+    unchangedRepos: 0,
+    updatedFiles: 0,
+    removedFiles: 0,
+    skipped: [],
+    repos: []
+  };
+
+  if (!sessions.length) {
+    result.skipped.push({
+      reason: 'no_authenticated_session',
+      message: 'Run remits-cli auth before syncing guides.'
+    });
+    return result;
+  }
+
+  for (const entry of entries) {
+    const repo = {
+      accountId: Number(entry.accountId),
+      name: entry.name || '',
+      directory: entry.directory,
+      updated: [],
+      removed: []
+    };
+    if (!entry.directory || !isAccountCheckout(entry.directory)) {
+      repo.skipped = true;
+      repo.reason = 'not_a_git_checkout';
+      result.skipped.push(repo);
+      result.repos.push(repo);
+      continue;
+    }
+
+    const session = guideSessionForRepo(entry, sessions);
+    if (!session) {
+      repo.skipped = true;
+      repo.reason = 'no_session_for_repo';
+      result.skipped.push(repo);
+      result.repos.push(repo);
+      continue;
+    }
+
+    const baseUrl = normalizeBaseUrl(session.baseUrl || options.baseUrl || DEFAULT_BASE_URL);
+    const summary = await downloadAndSyncGuides(entry.directory, {
+      session,
+      baseUrl,
+      accountId: Number(entry.accountId) || session.accountId
+    });
+    if (!summary) {
+      repo.skipped = true;
+      repo.reason = 'guide_payload_unavailable';
+      result.skipped.push(repo);
+      result.repos.push(repo);
+      continue;
+    }
+
+    repo.updated = summary.updated || [];
+    repo.removed = summary.removed || [];
+    result.updatedFiles += repo.updated.length;
+    result.removedFiles += repo.removed.length;
+    if (repo.updated.length || repo.removed.length) {
+      result.updatedRepos += 1;
+    } else {
+      result.unchangedRepos += 1;
+    }
+    result.repos.push(repo);
+  }
+
+  appendGlobalActivityLog('guides', 'sync_all', {
+    repoCount: result.repoCount,
+    updatedRepos: result.updatedRepos,
+    updatedFiles: result.updatedFiles,
+    skipped: result.skipped.length
+  });
+  return result;
+}
+
 // Ensure the current account repo has the latest guides. Authenticates first
 // (interactive terminals only) so guides are only ever delivered to users who
 // can authenticate to the platform.
@@ -3435,11 +3768,76 @@ function sandboxNetworkHint(err) {
   return ' Network access to ' + baseUrl + ' appears unavailable from the current sandbox. If remits-cli is being run by a local AI agent (for example Codex or Claude Code), retry the command with escalated permissions or outside the sandbox.';
 }
 
+// The tool inventory is ONE file per checkout, shared by every actor in it, and every refresh replaces it
+// wholesale. That is fine for one agent and wrong for several: `--as-account`, `--branch` and `--data-mode`
+// each produce a different inventory, so a second agent's refresh silently becomes the first agent's
+// "current tools". The file cannot be per-world without breaking the documented path, so instead: write it
+// atomically (a concurrent reader never sees a half-written file) and return the world it REPLACED, so the
+// caller can say out loud that it just overwrote somebody else's.
+function toolsSnapshotWorldSignature(snapshot) {
+  if (!snapshot || typeof snapshot !== 'object') return null;
+  return {
+    accountId: snapshot.accountId,
+    executionAccountId: snapshot.executionAccountId,
+    branchName: snapshot.branchName,
+    variantBranch: snapshot.variantBranch || null,
+    dataMode: snapshot.dataMode
+  };
+}
+
 function saveToolsSnapshot(cwd, data) {
   const paths = ensureLocalState(cwd);
   const file = path.join(paths.toolsDir, 'tools.json');
-  fs.writeFileSync(file, JSON.stringify(data, null, 2));
-  return file;
+  let previous = null;
+  try {
+    if (fs.existsSync(file)) previous = JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch (_) {
+    previous = null;
+  }
+  atomicWriteFile(file, JSON.stringify(data, null, 2));
+  const before = toolsSnapshotWorldSignature(previous);
+  const after = toolsSnapshotWorldSignature(data);
+  const replaced = before && JSON.stringify(before) !== JSON.stringify(after) ? before : null;
+  return { file, replaced };
+}
+
+// The other half of the shared-snapshot problem: the writer is warned, but the agent that READS
+// .remits-cli/shared/tools/tools.json — to pick a tool name, or an input shape — gets no signal that the
+// file describes somebody else's account, branch or data lane. Answered at the moment it matters: the call.
+function staleToolsSnapshotWarning(cwd, world) {
+  try {
+    const file = path.join(localStatePaths(cwd).toolsDir, 'tools.json');
+    if (!fs.existsSync(file)) return null;
+    const snapshot = JSON.parse(fs.readFileSync(file, 'utf8'));
+    const snapshotExec = snapshot.executionAccountId || snapshot.accountId;
+    const mismatch = [];
+    if (snapshotExec != null && String(snapshotExec) !== String(world.executionAccountId)) {
+      mismatch.push('account ' + snapshotExec + ' (this call: ' + world.executionAccountId + ')');
+    }
+    if (snapshot.branchName && String(snapshot.branchName) !== String(world.branchName)) {
+      mismatch.push('branch ' + snapshot.branchName + ' (this call: ' + world.branchName + ')');
+    }
+    if (snapshot.dataMode && String(snapshot.dataMode) !== String(world.dataMode)) {
+      mismatch.push('data ' + snapshot.dataMode + ' (this call: ' + world.dataMode + ')');
+    }
+    if (!mismatch.length) return null;
+    return {
+      code: 'tools_snapshot_other_world',
+      message: '.remits-cli/shared/tools/tools.json was last refreshed for ' + mismatch.join(', ') +
+        '. It is one file per checkout, so it may be another agent\'s. Run `remits-cli tools` with your own ' +
+        'flags before trusting the tool list or an input schema read from it.'
+    };
+  } catch (_) {
+    return null;
+  }
+}
+
+function describeToolsSnapshotWorld(world) {
+  if (!world) return 'unknown world';
+  return ['account ' + (world.executionAccountId || world.accountId || '?'),
+    'branch ' + (world.branchName || '?'),
+    world.variantBranch ? "variant '" + world.variantBranch + "'" : null,
+    'data ' + (world.dataMode || '?')].filter(Boolean).join(', ');
 }
 
 async function loggedPost(api, cwd, endpoint, payload, options = {}) {
@@ -3979,14 +4377,15 @@ async function authCommand(flags) {
       dataMode: session.dataMode
     }).then((r) => r.data);
     if (toolsData && toolsData.success) {
-      const toolsFile = saveToolsSnapshot(cwd, {
+      const toolsSnapshot = saveToolsSnapshot(cwd, {
         accountId: session.accountId,
+        executionAccountId: session.accountId,
         branchName,
         dataMode: toolsData.dataMode || session.dataMode,
         fetchedAt: new Date().toISOString(),
         tools: toolsData.tools || []
       });
-      console.log('Tools cached at:', toolsFile);
+      console.log('Tools cached at:', toolsSnapshot.file);
     }
   } catch (err) {
     console.log('Warning: failed to refresh tools after auth:', err.message);
@@ -4152,7 +4551,7 @@ async function pushComponentsCommand(flags) {
   const api = buildAxios(baseUrl, session.token, stageTimeoutMs(components, flags));
   const verification = await verificationPreflight(api, cwd, session, accountId, flags, {
     packetType: 'stage',
-    world: { accountId, dataMode, branchName, workspace }
+    world: { repoAccountId: accountId, accountId, executionAccountId: accountId, dataMode, branchName, workspace }
   }, { command: 'components stage' });
   const stagePayload = {
     token: session.token,
@@ -5434,7 +5833,7 @@ async function syncComponentsCommand(rawFlags) {
 
   const verification = await verificationPreflight(api, cwd, session, accountId, flags, {
     packetType: dryRun || namesOnly ? 'sync_dry_run' : 'sync_mutation',
-    world: { accountId, dataMode, branchName, workspace }
+    world: { repoAccountId: accountId, accountId, executionAccountId: accountId, dataMode, branchName, workspace }
   }, { command: 'components sync' });
 
   printProdDataBanner({
@@ -6911,7 +7310,7 @@ async function commitComponentsCommand(flags) {
     buildAxios(flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL, session.token),
     cwd, session, accountId, Object.assign({}, flags, { branch: branchName }), {
       packetType: 'sync_mutation',
-      world: { accountId, dataMode: resolveDataMode(flags, session), branchName, workspace: resolveWorkspace(cwd, flags) }
+      world: { repoAccountId: accountId, accountId, executionAccountId: accountId, dataMode: resolveDataMode(flags, session), branchName, workspace: resolveWorkspace(cwd, flags) }
     }, { command: 'components commit' });
 
   // Landing is serial and nothing can make it concurrent: `git add -A` sweeps a shared checkout, and the
@@ -7614,17 +8013,31 @@ function runWorldLines(world, context = {}) {
   if (!world || typeof world !== 'object') return [];
   const lines = ['World:'];
   if (context.host) lines.push('  host:            ' + context.host);
+  const scopeAccount = world.scopeRootAccountId || world.repoAccountId || world.checkoutAccountId || context.scopeRootAccountId;
+  if (scopeAccount) lines.push('  scoped from:     account ' + scopeAccount);
   const accounts = ['account ' + (world.executionAccountId || context.accountId || 'unknown')];
   if (world.checkoutAccountId && world.checkoutAccountId !== world.executionAccountId) accounts.push('checkout ' + world.checkoutAccountId);
   if (world.componentOwnerAccountId && world.componentOwnerAccountId !== world.executionAccountId) accounts.push('component owner ' + world.componentOwnerAccountId);
   lines.push('  runs as:         ' + accounts.join(', '));
+  if (world.targetAccountId && world.targetAccountId !== world.executionAccountId) {
+    lines.push('  targets:         account ' + world.targetAccountId);
+  }
   lines.push('  data lane:       ' + (world.dataMode || context.dataMode || 'unknown'));
   const contextVariantWorld = context.variantWorld && typeof context.variantWorld === 'object' ? context.variantWorld : {};
   const subscribedComponentBranch = world.subscribedComponentBranch || contextVariantWorld.subscribedComponentBranch;
   const componentBranch = world.componentBranch || subscribedComponentBranch || contextVariantWorld.componentBranch || world.variantBranch;
-  const branchSource = componentBranch && subscribedComponentBranch && String(componentBranch) === String(subscribedComponentBranch)
-    ? 'subscription'
-    : (world.componentBranchSource || contextVariantWorld.componentBranchSource || world.variantBranchSource || contextVariantWorld.variantBranchSource);
+  // The platform owns this answer (remits.cli.CliVariantWorld). Reporting a locally re-derived source is how
+  // a line ends up contradicting itself: an --variant-branch probe REPLACES the subscription, and a variant
+  // branch's working tree decides the world before any edge is consulted, but both resolve to a branch the
+  // account often also subscribes to — so "componentBranch == subscribedComponentBranch" cannot mean
+  // "the subscription chose it". Only fill the source in when the platform reports the TRUNK case (the git
+  // branch named no world, so the account's own subscription decided) or reports nothing at all.
+  const resolvedBranchSource = world.componentBranchSource || contextVariantWorld.componentBranchSource ||
+    world.variantBranchSource || contextVariantWorld.variantBranchSource;
+  const subscriptionDecided = componentBranch && subscribedComponentBranch &&
+    String(componentBranch) === String(subscribedComponentBranch) &&
+    (!resolvedBranchSource || resolvedBranchSource === 'trunk' || resolvedBranchSource === 'no-branch');
+  const branchSource = subscriptionDecided ? 'subscription' : resolvedBranchSource;
   const branchLabel = componentBranch
     ? "componentBranch=" + componentBranch + (branchSource ? ' via ' + branchSource : '')
     : (branchSource || '');
@@ -7649,6 +8062,9 @@ function runWorldLines(world, context = {}) {
     lines.push('  test component:  ' + world.testComponentSource + (world.testComponentSignature ? ' ' + shortSignature(world.testComponentSignature) : '') +
       (world.testComponentBranch ? "  variant '" + world.testComponentBranch + "'" : ''));
   }
+  if (world.componentSource) {
+    lines.push('  component:       ' + world.componentSource + (world.componentSignature ? ' ' + shortSignature(world.componentSignature) : ''));
+  }
   lines.push(...stagedMaskedByVariantLines(world.stagedMaskedByVariant, world.executionAccountId || context.accountId));
   return lines;
 }
@@ -7878,7 +8294,8 @@ async function testCommand(flags) {
   const verification = await verificationPreflight(api, cwd, session, accountId, flags, {
     packetType: 'test_run',
     world: {
-      accountId,
+      repoAccountId: accountId,
+      accountId: asAccountId ? Number(asAccountId) : Number(accountId),
       executionAccountId: asAccountId ? Number(asAccountId) : Number(accountId),
       dataMode,
       branchName,
@@ -8208,7 +8625,8 @@ async function tokenCommand(flags) {
   const verification = await verificationPreflight(api, cwd, session, accountId, flags, {
     packetType: 'token_inspect',
     world: {
-      accountId,
+      repoAccountId: accountId,
+      accountId: tokenAsAccountId ? Number(tokenAsAccountId) : Number(accountId),
       executionAccountId: tokenAsAccountId ? Number(tokenAsAccountId) : Number(accountId),
       dataMode,
       branchName,
@@ -8250,6 +8668,12 @@ async function tokenCommand(flags) {
     baseUrl: normalizeBaseUrl(baseUrl),
     tokenKey: data.tokenKey,
     accountId: data.accountId,
+    executionAccountId: data.accountId,
+    // The account the command was addressed to, i.e. the repo/checkout account. Distinct from `accountId`
+    // (which account the URL EXECUTES as, moved by --as-account) and from
+    // `resolution.componentOwnerAccountId` (whose components run). Three different accounts on a subscriber
+    // token, and the response used to carry only one of them.
+    repoAccountId: data.ownerAccountId,
     branchName: data.branchName,
     variantBranch: data.variantBranch,
     // Why the variant branch is (or is not) set — the platform's one rule, so a null is explainable.
@@ -8293,6 +8717,29 @@ async function tokenCommand(flags) {
     printSessionResolutionWarning(sessionContext);
     printLocalCommandContext(cwd, flags, { accountId: output.accountId || accountId, branchName, workspace: output.workspace, dataMode: output.dataMode || dataMode });
     printLocalStateWarnings(cwd, flags);
+    // The same World block `tools`, `tool` and `test run` print. A token is the surface that hands a browser
+    // a whole resolved world, and it was the one that made the reader dig it out of a JSON dump — including
+    // the `resolution.summary` sentence that says, in words, which account's components the page will run.
+    runWorldLines({
+      accountId: output.accountId,
+      executionAccountId: output.accountId,
+      checkoutAccountId: output.repoAccountId,
+      repoAccountId: output.repoAccountId,
+      componentOwnerAccountId: output.resolution && output.resolution.componentOwnerAccountId,
+      dataMode: output.dataMode || dataMode,
+      branchName: output.branchName || branchName,
+      workspace: output.workspace,
+      stagingLane: output.stagingLane,
+      componentBranch: output.variantWorld && output.variantWorld.componentBranch,
+      subscribedComponentBranch: output.variantWorld && output.variantWorld.subscribedComponentBranch,
+      variantBranch: output.variantBranch,
+      variantBranchSource: output.variantBranchSource,
+      resolves: output.variantWorld && output.variantWorld.resolves,
+      stagedMaskedByVariant: output.stagedMaskedByVariant
+    }, { host: normalizeBaseUrl(baseUrl) }).forEach((line) => console.log(line));
+    if (output.resolution && output.resolution.summary) {
+      console.log('  resolves as:     ' + output.resolution.summary);
+    }
   }
   console.log(JSON.stringify(output, null, 2));
 
@@ -8300,7 +8747,16 @@ async function tokenCommand(flags) {
     type: 'token_inspect',
     success: true,
     claim: 'Verification token minted',
-    world: buildCommandWorld(output, { accountId: output.accountId || accountId, dataMode: output.dataMode || dataMode, branchName, workspace: output.workspace, host: normalizeBaseUrl(baseUrl) }),
+    world: buildCommandWorld(output, {
+      repoAccountId: output.repoAccountId || accountId,
+      checkoutAccountId: output.repoAccountId || accountId,
+      accountId: output.executionAccountId || output.accountId || accountId,
+      executionAccountId: output.executionAccountId || output.accountId || accountId,
+      dataMode: output.dataMode || dataMode,
+      branchName,
+      workspace: output.workspace,
+      host: normalizeBaseUrl(baseUrl)
+    }),
     revision: collectVerificationSource(cwd, flags),
     browser: {
       tokenKeyHash: output.tokenKey ? sha256(String(output.tokenKey)) : null,
@@ -8369,6 +8825,7 @@ async function toolsCommand(flags) {
   const data = await loggedPost(api, cwd, '/cli/tools', {
     token: session.token,
     accountId,
+    asAccountId: flags['as-account'] || flags['as-account-id'],
     variantBranch,
     branchName,
     workspace,
@@ -8379,12 +8836,17 @@ async function toolsCommand(flags) {
     throw new Error('Failed to fetch tools');
   }
 
-  const toolsFile = saveToolsSnapshot(cwd, {
-    accountId,
+  const toolsSnapshot = saveToolsSnapshot(cwd, {
+    accountId: data.accountId || accountId,
+    repoAccountId: data.repoAccountId || accountId,
+    checkoutAccountId: data.checkoutAccountId || accountId,
+    executionAccountId: data.executionAccountId || data.accountId || accountId,
     baseUrl: normalizeBaseUrl(baseUrl),
-    branchName,
+    branchName: data.branchName || branchName,
     variantBranch: data.variantBranch || variantBranch,
     dataMode: data.dataMode || dataMode,
+    world: data.world,
+    staging: data.staging,
     fetchedAt: new Date().toISOString(),
     tools: data.tools || []
   });
@@ -8392,10 +8854,17 @@ async function toolsCommand(flags) {
   printSessionResolutionWarning(sessionContext);
   printResolvedBaseUrl(baseUrl);
   console.log('Tools refreshed.');
+  if (data.world) runWorldLines(data.world, { host: normalizeBaseUrl(baseUrl), gitHead: safeGitValue(cwd, 'git rev-parse HEAD') }).forEach((line) => console.log(line));
   console.log('Data mode:', data.dataMode || dataMode);
   if (data.variantBranch || variantBranch) console.log('Variant branch:', data.variantBranch || variantBranch);
-  console.log('Tools file:', toolsFile);
+  console.log('Tools file:', toolsSnapshot.file);
   console.log('Tool count:', (data.tools || []).length);
+  if (toolsSnapshot.replaced) {
+    console.error('Shared snapshot warning: this refresh replaced the tool inventory for ' +
+      describeToolsSnapshotWorld(toolsSnapshot.replaced) + '. ' +
+      '.remits-cli/shared/tools/tools.json is one file per checkout, so another agent reading it now sees ' +
+      'YOUR world. Re-run `remits-cli tools` with your own flags before trusting it.');
+  }
 }
 
 function parseToolInput(flags) {
@@ -8429,10 +8898,18 @@ function applyScopeFlags(input, flags) {
     merged.scope = normalized;
   }
 
-  const targetAccountId = flags && (flags['target-account-id'] || flags.targetAccountId);
+  const targetAccountId = flags && (flags['target-account'] || flags.targetAccount || flags['target-account-id'] || flags.targetAccountId);
   if (targetAccountId && merged.targetAccountId === undefined) {
     merged.targetAccountId = String(targetAccountId).trim();
   }
+  // ...and as `accountId`, because that is the key the platform's account-targeting tools actually read
+  // (mcp_run_action resolves `input.accountId`, falling back to the RUN SCOPE when it is absent). Without
+  // this, `--target-account 36` printed "targets: account 36" in the World block while the tool ran against
+  // the scope account — a flag that reads like a target and silently is not. An explicit `accountId` in
+  // --input still wins, like every other scope flag.
+  if (targetAccountId && merged.accountId === undefined && merged.account_id === undefined) {
+    merged.accountId = String(targetAccountId).trim();
+  }
 
   const anchorAccountId = flags && (flags['anchor-account-id'] || flags.anchorAccountId);
   if (anchorAccountId && merged.anchorAccountId === undefined) {
@@ -8477,6 +8954,8 @@ async function toolCommand(flags) {
   const branchName = flags.branch || currentBranch(cwd);
   const dataMode = resolveDataMode(flags, session);
   const variantBranch = flags['variant-branch'];
+  const asAccountId = flags['as-account'] || flags['as-account-id'] || flags.asAccountId;
+  const targetAccountId = flags['target-account'] || flags.targetAccount || flags['target-account-id'] || flags.targetAccountId;
   const timeoutMs = parsePositiveInt(flags['timeout-ms'] || flags.timeoutMs, 60000);
   const callId = String(flags['call-id'] || flags.callId || crypto.randomUUID());
   const asyncMode = flagEnabled(flags.async) || flagEnabled(input.async);
@@ -8512,6 +8991,24 @@ async function toolCommand(flags) {
     data.responseFile = statusResponse.responseFile;
     data.sessionLog = sessionJsonlFile(cwd);
     data.localState = localStateSummary(cwd, flags);
+    const statusBranchName = flags.branch || data.branchName || (stored && stored.branchName) || branchName;
+    const statusWorkspace = data.workspace !== undefined ? data.workspace : resolveWorkspace(cwd, flags);
+    const statusWorld = buildToolStatusWorld(data, stored, {
+      repoAccountId: accountId,
+      accountId: statusAccountId,
+      checkoutAccountId: accountId,
+      dataMode: data.dataMode || dataMode,
+      branchName: statusBranchName,
+      workspace: statusWorkspace,
+      host: normalizeBaseUrl(baseUrl)
+    });
+    recordWorkstreamArtifact(cwd, flags, {
+      type: 'tool_status',
+      callId: requestedCallId,
+      path: statusResponse.responseFile,
+      world: statusWorld,
+      workspace: data.workspace
+    });
     // A completed run can still carry a tool-level refusal — see toolResultFailed.
     const polledFailed = data.toolSuccess === false || toolResultFailed(data.result);
     if (polledFailed) {
@@ -8521,13 +9018,13 @@ async function toolCommand(flags) {
     // Same question as the call that started it: a poll must not attach where the call itself would not.
     const statusVerification = await verificationPreflight(api, cwd, session, accountId, flags, {
       packetType: 'tool_call',
-      world: { accountId: statusAccountId, dataMode: data.dataMode || dataMode, branchName: flags.branch || (stored && stored.branchName) || branchName, workspace: resolveWorkspace(cwd, flags) }
+      world: statusWorld
     }, { command: 'tool status', neverRefuse: true, quiet: jsonOutput });
     await appendVerificationPacket(api, cwd, session, accountId, statusVerification.evidenceFlags, {
       type: 'tool_call',
       success: data.status !== 'failed' && !polledFailed,
       claim: 'Tool status ' + requestedCallId,
-      world: buildCommandWorld(data, { accountId: statusAccountId, dataMode: data.dataMode || dataMode, branchName: flags.branch || (stored && stored.branchName) || branchName, host: normalizeBaseUrl(baseUrl) }),
+      world: statusWorld,
       revision: collectVerificationSource(cwd, flags),
       evidenceCategories: ['tool_call'],
       rawRefs: { toolResponsePath: statusResponse.responseFile, callId: requestedCallId },
@@ -8542,6 +9039,7 @@ async function toolCommand(flags) {
     printLocalCommandContext(cwd, flags, { accountId: statusAccountId, branchName: flags.branch || (stored && stored.branchName) || branchName, dataMode: data.dataMode || dataMode });
     printLocalStateWarnings(cwd, flags);
     console.log('Tool call status:', data.status);
+    if (data.world) runWorldLines(data.world, { host: normalizeBaseUrl(baseUrl) }).forEach((line) => console.log(line));
     console.log('Call ID:', requestedCallId);
     console.log('Data mode:', data.dataMode || dataMode);
     if (data.threadGroupingId) console.log('Thread grouping ID:', data.threadGroupingId);
@@ -8564,15 +9062,49 @@ async function toolCommand(flags) {
   });
 
   const toolWorkspace = resolveWorkspace(cwd, flags);
+  const legacyInputAccountId = input && (input.accountId || input.account_id);
+  // A STRUCTURED warning, not only a printed one: agents run with --json, and `input.accountId` no longer
+  // decides the execution account, so the one signal that the command's component resolution belongs to a
+  // different account than the tool's data must survive into the payload the agent actually reads.
+  const toolWarnings = [];
+  if (legacyInputAccountId && !asAccountId && !targetAccountId && String(legacyInputAccountId) !== String(accountId)) {
+    toolWarnings.push({
+      code: 'legacy_input_account_id',
+      inputAccountId: String(legacyInputAccountId),
+      scopeAccountId: String(accountId),
+      message: 'input.accountId=' + legacyInputAccountId +
+        ' is treated as a tool target while the command stays scoped from account ' + accountId +
+        '. Use --as-account ' + legacyInputAccountId + ' for execution-account semantics, or --target-account ' + legacyInputAccountId + ' to make the target explicit.'
+    });
+  }
+  const snapshotWarning = staleToolsSnapshotWarning(cwd, {
+    executionAccountId: asAccountId || accountId,
+    branchName,
+    dataMode
+  });
+  if (snapshotWarning) toolWarnings.push(snapshotWarning);
+  // stderr always: it never corrupts --json stdout, and suppressing it there hid the warning from exactly
+  // the callers that cannot see the human output.
+  toolWarnings.forEach((warning) => console.error('Warning: ' + warning.message));
   const verification = await verificationPreflight(api, cwd, session, accountId, flags, {
     packetType: 'tool_call',
-    world: { accountId, dataMode, branchName, workspace: toolWorkspace }
+    world: {
+      repoAccountId: accountId,
+      accountId: asAccountId || accountId,
+      executionAccountId: asAccountId || accountId,
+      targetAccountId: targetAccountId || legacyInputAccountId,
+      dataMode,
+      branchName,
+      workspace: toolWorkspace
+    }
   }, { command: 'tool --name ' + String(toolName) });
 
   const response = await loggedPost(api, cwd, '/cli/tool', {
     token: session.token,
     accountId,
     accountIdExplicit,
+    asAccountId,
+    targetAccountId: targetAccountId || undefined,
     // The repo/session account, sent as a FIRST-CLASS value rather than left to be inferred from
     // `accountId`: a read tool may reinterpret its own `input.accountId`, and the scope root — what bounds
     // what the call may discover — has to survive that. The server validates it; it is never authorization.
@@ -8602,6 +9134,15 @@ async function toolCommand(flags) {
   data.responseFile = response.responseFile;
   data.sessionLog = sessionJsonlFile(cwd);
   data.localState = localStateSummary(cwd, flags);
+  if (toolWarnings.length) data.warnings = (data.warnings || []).concat(toolWarnings);
+  recordWorkstreamArtifact(cwd, flags, {
+    type: asyncMode ? 'tool_async_start' : 'tool_call',
+    callId,
+    path: response.responseFile,
+    tool: String(toolName),
+    world: buildCommandWorld(data, { repoAccountId: accountId, accountId: data.executionAccountId || asAccountId || accountId, dataMode: data.dataMode || dataMode, branchName, workspace: toolWorkspace, host: normalizeBaseUrl(baseUrl) }),
+    workspace: data.workspace || toolWorkspace
+  });
   if (toolFailureMessage && !data.toolMessage) data.toolMessage = toolFailureMessage;
 
   let evidenceData = data;
@@ -8614,6 +9155,7 @@ async function toolCommand(flags) {
     printLocalStateWarnings(cwd, flags);
     console.log(asyncMode ? 'Tool call started.'
       : (toolFailed ? 'Tool call FAILED — the tool ran and returned an error.' : 'Tool call succeeded.'));
+    if (data.world) runWorldLines(data.world, { host: normalizeBaseUrl(baseUrl), gitHead: safeGitValue(cwd, 'git rev-parse HEAD') }).forEach((line) => console.log(line));
     if (toolFailed && toolFailureMessage) console.log('Tool error:', toolFailureMessage);
     console.log('Call ID:', callId);
     console.log('Data mode:', data.dataMode || dataMode);
@@ -8646,10 +9188,26 @@ async function toolCommand(flags) {
 
     finalStatus.data.responseFile = finalStatus.responseFile;
     finalStatus.data.sessionLog = sessionJsonlFile(cwd);
+    recordWorkstreamArtifact(cwd, flags, {
+      type: 'tool_async_final',
+      callId,
+      path: finalStatus.responseFile,
+      tool: String(toolName),
+      world: buildCommandWorld(finalStatus.data, { repoAccountId: accountId, accountId: finalStatus.data.executionAccountId || asAccountId || accountId, dataMode: finalStatus.data.dataMode || dataMode, branchName: finalStatus.data.branchName || branchName, workspace: toolWorkspace, host: normalizeBaseUrl(baseUrl) }),
+      workspace: finalStatus.data.workspace || toolWorkspace
+    });
     evidenceData = finalStatus.data;
     evidenceResponseFile = finalStatus.responseFile;
     if (!jsonOutput) {
       console.log('Final status:', finalStatus.data.status);
+      if (finalStatus.data.world) {
+        runWorldLines(finalStatus.data.world, { host: normalizeBaseUrl(baseUrl), gitHead: safeGitValue(cwd, 'git rev-parse HEAD') }).forEach((line) => console.log(line));
+        const startWorldText = JSON.stringify(data.world || {});
+        const finalWorldText = JSON.stringify(finalStatus.data.world || {});
+        if (data.world && startWorldText !== finalWorldText) {
+          console.log('World changed since start: inspect the final response file for the exact resolved execution world.');
+        }
+      }
       printToolResponseFileLine('Tool response file', finalStatus.responseFile);
     }
     if (finalStatus.data.status !== 'completed') {
@@ -8663,7 +9221,20 @@ async function toolCommand(flags) {
     success: asyncMode && !waitForAsync ? null : (!toolFailed && (!asyncMode || process.exitCode !== 1)),
     pending: asyncMode && !waitForAsync,
     claim: 'Tool call ' + String(toolName),
-    world: buildCommandWorld(evidenceData, { accountId: evidenceData.accountId || accountId, dataMode: evidenceData.dataMode || dataMode, branchName: evidenceData.branchName || branchName, workspace: resolveWorkspace(cwd, flags), host: normalizeBaseUrl(baseUrl), sourceLayer: evidenceData.componentSource }),
+    world: buildCommandWorld(evidenceData, {
+      accountId: evidenceData.executionAccountId || asAccountId || evidenceData.accountId || accountId,
+      repoAccountId: accountId,
+      checkoutAccountId: accountId,
+      executionAccountId: evidenceData.executionAccountId || asAccountId || accountId,
+      targetAccountId: evidenceData.targetAccountId || targetAccountId || legacyInputAccountId,
+      dataMode: evidenceData.dataMode || dataMode,
+      branchName: evidenceData.branchName || branchName,
+      workspace: resolveWorkspace(cwd, flags),
+      host: normalizeBaseUrl(baseUrl),
+      componentSource: evidenceData.componentSource,
+      componentSignature: evidenceData.componentSignature,
+      sourceLayer: evidenceData.componentSource
+    }),
     revision: Object.assign(collectVerificationSource(cwd, flags), {
       compileSignatures: evidenceData.componentSignature ? [evidenceData.componentSignature] : []
     }),
@@ -9063,7 +9634,11 @@ async function verifyCommand(flags, subcommand) {
     return response;
   }
 
-  const envelopeId = flags.envelope || flags['verify-envelope'] || flags.id || readActiveVerificationEnvelope(cwd, activeContext);
+  const positionalEnvelopeId = flags._ && flags._[2];
+  const showLikeSubcommands = ['show', 'read', 'get', 'packets', 'status', 'report'];
+  const explicitEnvelopeId = flags.envelope || flags['verify-envelope'] || flags.id ||
+    (showLikeSubcommands.includes(sub) ? positionalEnvelopeId : null);
+  const envelopeId = explicitEnvelopeId || readActiveVerificationEnvelope(cwd, activeContext);
   if (!envelopeId) {
     throw new Error('No verification envelope selected. Run `remits-cli verify start --summary "..."` or pass --envelope <id>.');
   }
@@ -9222,7 +9797,7 @@ async function verifyCommand(flags, subcommand) {
       // report would list as wrong-world evidence on every status check.
       const statusVerification = await verificationPreflight(api, cwd, session, accountId, { 'verify-envelope': envelopeId }, {
         packetType: 'component_status',
-        world: { accountId, dataMode, branchName, workspace }
+        world: { repoAccountId: accountId, accountId, executionAccountId: accountId, dataMode, branchName, workspace }
       }, { command: 'verify status', quiet: true, neverRefuse: true });
       const componentStatus = await loggedPost(api, cwd, '/cli/components', {
         token: session.token,
@@ -10591,6 +11166,7 @@ function renderDashboardHtml(snapshot) {
         '<div class="action-row">' +
           '<button class="action-btn" data-action="export-issues">Export Issue Bundle</button>' +
           '<button class="action-btn" data-action="rescan-repos">Rescan Account Repos</button>' +
+          '<button class="action-btn" data-action="sync-guides">Update Guides In All Repos</button>' +
           '<button class="action-btn" data-action="reconnect-websockets">Reconnect Websockets</button>' +
           '<button class="action-btn" data-action="refresh-agents">Refresh Agents</button>' +
         '</div>' +
@@ -10663,7 +11239,7 @@ function renderDashboardHtml(snapshot) {
           'summaryItem("Available Agents",String(agentList.length)),' +
           'summaryItem("Routed Tickets",String(ticketCounts.routed||0))' +
         '].join("");}' +
-        'function renderLastAction(state){const target=document.getElementById("last-action");if(!state.lastAction){target.className="empty";target.textContent="No dashboard actions have been triggered yet.";return;}target.className="summary-item";target.innerHTML=\'<span class="k">Last Action</span><span class="v">\'+escapeHtml(state.lastAction.action||"unknown")+\'</span><div class="muted" style="margin-top:8px;">\'+escapeHtml(formatTime(state.lastAction.at))+\'</div>\'+(state.lastAction.bundlePath?\'<div class="muted" style="margin-top:8px;word-break:break-word;"><strong>Bundle:</strong> \'+escapeHtml(state.lastAction.bundlePath)+\'</div>\':"");}' +
+        'function renderLastAction(state){const target=document.getElementById("last-action");if(!state.lastAction){target.className="empty";target.textContent="No dashboard actions have been triggered yet.";return;}target.className="summary-item";target.innerHTML=\'<span class="k">Last Action</span><span class="v">\'+escapeHtml(state.lastAction.action||"unknown")+\'</span><div class="muted" style="margin-top:8px;">\'+escapeHtml(formatTime(state.lastAction.at))+\'</div>\'+(state.lastAction.summary?\'<div class="muted" style="margin-top:8px;">\'+escapeHtml(state.lastAction.summary)+\'</div>\':"")+(state.lastAction.bundlePath?\'<div class="muted" style="margin-top:8px;word-break:break-word;"><strong>Bundle:</strong> \'+escapeHtml(state.lastAction.bundlePath)+\'</div>\':"");}' +
         'function renderIssues(state){const target=document.getElementById("issues-section");const issues=state.issues||[];if(!issues.length){target.innerHTML=\'<div class="empty">No automatic issue signals are currently detected. If something still feels wrong, you can still click "Export Issue Bundle" to prepare a package for a Remits system admin.</div>\';return;}target.innerHTML=issues.map(function(issue,index){const tone=issue.severity==="bad"?"bad":"warn";const meta=badge(issue.severity==="bad"?"critical":"warning",tone)+\' <span class="muted">\'+escapeHtml(issue.scope+(issue.repoAccountId?(" account "+issue.repoAccountId):""))+\'</span>\';const evidence=(issue.evidence||[]).map(function(line){return "<li>"+escapeHtml(line)+"</li>";}).join("");const body=\'<div class="stack"><div class="muted">\'+escapeHtml(issue.summary||"")+\'</div><div class="mini-card"><strong>Recommendation</strong>\'+escapeHtml(issue.recommendation||"") + \'</div><div><strong style="display:block;margin-bottom:8px;">Evidence</strong><ul style="margin:0;padding-left:18px;display:grid;gap:8px;">\'+(evidence||"<li>No evidence lines captured.</li>")+\'</ul></div></div>\';return detailsBlock("issue:"+issue.id,(index+1)+". "+issue.title,meta,body,index===0);}).join("");}' +
         'function renderSupportTickets(state){const target=document.getElementById("support-ticket-section");const support=state.supportTickets||{};const parts=support.compartments||[];const errors=support.errors||[];let html="";if(errors.length){html+=detailsBlock("support:errors","Queue fetch errors",badge(String(errors.length)+" error(s)","warn"),codeBlock("support-errors",JSON.stringify(errors,null,2),"log"),false);}if(!parts.length&&!errors.length){target.innerHTML=html+\'<div class="empty">No authenticated support-ticket queue is available yet.</div>\';return;}html+=parts.map(function(part,pi){const lane=(part.dataMode||"prod");const meta=badge(lane+" lane",lane==="test"?"warn":"ok")+\' \'+badge(String(part.open||0)+" open","ok")+\' <span class="muted">\'+escapeHtml(String(part.queueCount||0))+\' account queue(s)\'+(part.overlappingQueuesDropped?", "+part.overlappingQueuesDropped+" overlapping dropped":"")+\'</span>\';const caveat=part.scopeUnknown?\'<div class="mini-card"><strong>Note</strong>A queue did not report which accounts it scanned, so this total may count a ticket more than once.</div>\':"";const cards=\'<div class="mini-grid"><div class="mini-card"><strong>Open</strong>\'+escapeHtml(String(part.open||0))+\'</div><div class="mini-card"><strong>Routed To An Agent</strong>\'+escapeHtml(String(part.routed||0))+\'</div><div class="mini-card"><strong>Unrouted</strong>\'+escapeHtml(String(part.unrouted||0))+\'</div><div class="mini-card"><strong>Awaiting A Reply</strong>\'+escapeHtml(String(part.awaitingReplyOnPage||0))+\' <span class="muted">of \'+escapeHtml(String((part.tickets||[]).length))+\' shown</span></div></div>\'+caveat;const rows=(part.tickets||[]).length?(part.tickets||[]).map(function(ticket,index){const routed=!!ticket.routedAgentId;const waiting=!!ticket.awaitingResponseSince;const meta2=badge(ticket.priority||"priority",ticket.priority==="critical"||ticket.priority==="high"?"bad":"warn")+\' \'+badge(ticket.status||"status",ticket.status==="open"?"ok":"warn")+\' \'+badge(routed?("routed: "+(ticket.routedAgentLabel||ticket.routedAgentId)):"unrouted",routed?"ok":"warn")+(waiting?\' \'+badge("awaiting reply","warn"):"")+\' <span class="muted">\'+escapeHtml(ticket.accountName||ticket.accountId||"unknown account")+\'</span>\';return detailsBlock("support-ticket:"+pi+":"+ticket.ticketId,String(ticket.ticketId||"ticket")+" "+(ticket.subject||""),meta2,supportTicketDetails(state,ticket,"support-ticket:"+pi+":"+index),false);}).join(""):\'<div class="empty">No open support tickets in this compartment.</div>\';return detailsBlock("compartment:"+part.compartment,part.baseUrl||part.compartment,meta,cards+\'<div class="accordion">\'+rows+\'</div>\',pi===0);}).join("");html+=\'<div class="muted" style="margin-top:10px;">Each platform and data lane is counted separately. A localhost test-lane queue is full of suite fixtures and is not comparable to a production queue — summing them is what made this panel report 583 open tickets against a production queue of 24.</div>\';target.innerHTML=html;}' +
         'function supportTicketDetails(state,ticket,key){const agents=((state.agents||{}).registered)||[];const ticketAccountId=String(ticket.accountId||"");const eligible=agents.filter(function(a){if(ticket.baseUrl&&a.baseUrl&&a.baseUrl!==ticket.baseUrl)return false;if(ticket.dataMode&&a.dataMode&&a.dataMode!==ticket.dataMode)return false;return (a.accounts||[]).some(function(acc){return String(acc.accountId)===ticketAccountId||acc.routingScope==="self_and_descendants";});});const options=[\'<option value="">- unrouted -</option>\'].concat(eligible.map(function(a){const sel=a.agentId===ticket.routedAgentId?" selected":"";return \'<option value="\'+escapeHtml(a.agentId)+\'"\'+sel+\'>\'+escapeHtml((a.label||a.userName||a.agentId)+" - "+(a.state||"idle")+(a.activity?" ("+a.activity+")":""))+\'</option>\';})).join("");const routeControl=eligible.length?(\'<div class="mini-card"><strong>Route To Agent</strong><div style="display:flex;gap:8px;margin-top:6px;"><select data-route-ticket="\'+escapeHtml(String(ticket.ticketId||""))+\'" data-route-account="\'+escapeHtml(ticketAccountId)+\'" data-route-base="\'+escapeHtml(ticket.baseUrl||"")+\'" data-route-mode="\'+escapeHtml(ticket.dataMode||"")+\'" style="flex:1;min-width:0;">\'+options+\'</select><button class="action-btn" data-action="route-ticket" data-ticket="\'+escapeHtml(String(ticket.ticketId||""))+\'">Route</button></div></div>\'):\'<div class="mini-card"><strong>Route To Agent</strong>No registered agent covers this account.</div>\';const lane=ticket.dataMode||"prod";const planning=[ticket.workstream?("Workstream "+ticket.workstream):"",ticket.plannedIn?("Planned "+ticket.plannedIn):"",ticket.boardStage?("Board "+ticket.boardStage):"",ticket.rank!==undefined&&ticket.rank!==null&&ticket.rank!==""?("Rank "+ticket.rank):"",ticket.size?("Size "+ticket.size):"",ticket.blockedBy?("Blocked by "+ticket.blockedBy):""].filter(Boolean).join(" / ");const command="remits-cli ticket read --ticket "+String(ticket.ticketId||"")+" --data-mode "+lane+"\\nremits-cli ticket accept --ticket "+String(ticket.ticketId||"")+" --data-mode "+lane;return \'<div class="stack"><div class="mini-grid"><div class="mini-card"><strong>Ticket</strong>\'+escapeHtml(ticket.ticketId||"n/a")+\'</div><div class="mini-card"><strong>Account</strong>\'+escapeHtml((ticket.accountName||"n/a")+" ("+(ticket.accountId||"n/a")+")")+\'</div><div class="mini-card"><strong>Type</strong>\'+escapeHtml(ticket.type||"n/a")+\'</div><div class="mini-card"><strong>Owned By</strong>\'+escapeHtml(ticket.assignedTo||"unassigned")+\'</div><div class="mini-card"><strong>Routed To</strong>\'+escapeHtml(ticket.routedAgentLabel||ticket.routedAgentId||"nobody")+\'</div><div class="mini-card"><strong>Implementation</strong>\'+escapeHtml((ticket.implementationAccountName||"n/a")+" ("+(ticket.implementationAccountId||"n/a")+")")+\'</div><div class="mini-card"><strong>Planning</strong>\'+escapeHtml(planning||"No planning fields")+\'</div></div>\'+routeControl+\'<div class="muted">\'+escapeHtml(ticket.affectedComponent||"No affected component recorded.")+\'</div>\'+codeBlock(key+":cmd",command)+\'</div>\';}' +
@@ -11054,6 +11630,10 @@ function startDashboardServer(preferredPort) {
             } else if (action === 'rescan-repos') {
               recordDiscoverySummary(discoverAccountRepos());
               supportTicketSnapshotCache = { fetchedAtMs: 0, value: null };
+            } else if (action === 'sync-guides') {
+              actionResult = await syncGuidesAcrossIndexedRepos({ rescan: true });
+              runtimeState.lastAction.summary = guideSyncSummaryLine(actionResult);
+              recordDiscoverySummary(discoverAccountRepos());
             } else if (action === 'refresh-agents') {
               agentSnapshotCache = { fetchedAtMs: 0, value: null };
               supportTicketSnapshotCache = { fetchedAtMs: 0, value: null };
@@ -12151,6 +12731,11 @@ function resolveAgentId(flags, options = {}) {
  * agent is silently useless for support: it registers, appears online, and can never be routed a
  * production ticket. Ask for `--data-mode test` when you want a fixture agent.
  */
+/**
+ * The host and lane an agent command runs against: the flag, then this agent's own prior registration, then
+ * the PRODUCTION platform and lane. That last default is deliberate — `agent register` joins the support
+ * fleet, and a fleet member on a test lane appears online and can never be routed a real ticket.
+ */
 function agentDefaults(flags, entry) {
   return {
     baseUrl: normalizeBaseUrl(
@@ -12163,10 +12748,29 @@ function agentDefaults(flags, entry) {
 function agentSessionFor(flags, entry) {
   const cwd = (entry && entry.cwd) || process.cwd();
   const defaults = agentDefaults(flags, entry);
-  const context = resolveSessionContext(cwd, Object.assign({}, flags, {
-    'base-url': defaults.baseUrl,
-    'data-mode': defaults.dataMode
-  }));
+  const pinnedByCaller = Boolean((flags && flags['base-url']) || (entry && entry.baseUrl));
+  let context;
+  try {
+    context = resolveSessionContext(cwd, Object.assign({}, flags, {
+      'base-url': defaults.baseUrl,
+      'data-mode': defaults.dataMode
+    }));
+  } catch (err) {
+    // The prod default is intentional, and invisible: every OTHER command in this checkout follows the
+    // active session, so "not authenticated at <some prod url>" reads as a broken session rather than as
+    // "this command deliberately went somewhere else". Say which host it chose and why.
+    if (!pinnedByCaller) {
+      const local = readSession({}) || {};
+      const refusal = new Error('Agent commands join the SUPPORT FLEET, which lives on the production ' +
+        'platform, so this one targeted ' + defaults.baseUrl + ' — not the session this checkout uses' +
+        (local.baseUrl ? ' (' + normalizeBaseUrl(local.baseUrl) + ')' : '') + '. ' +
+        'Authenticate there with `remits-cli auth --base-url ' + defaults.baseUrl + '`, or point this ' +
+        'command at another platform with `--base-url <url>`.');
+      refusal.cause = err;
+      throw refusal;
+    }
+    throw err;
+  }
   if (!context.session || !context.session.token) {
     throw new Error('No authenticated session for ' + defaults.baseUrl +
       '. Run: remits-cli auth --base-url ' + defaults.baseUrl);
@@ -12747,7 +13351,7 @@ async function postAgentStatus(context, agentId, update) {
  * the same thing. Only the local supervisor can add machine-local repository hints; the worker owns the
  * final grounding step, including creating or choosing a git worktree before it edits.
  */
-function spawnTicketWorker(context, ctx, ticket) {
+async function spawnTicketWorker(context, ctx, ticket) {
   const { spawn } = require('child_process');
   const agentId = ctx.agentId;
   const ticketId = String(ticket.id || ticket.ticketId);
@@ -12766,6 +13370,32 @@ function spawnTicketWorker(context, ctx, ticket) {
   const targetBranch = repositoryWork ? ticketTargetBranch(ticket, baseWorkingDirectory) : gitBranchNameInDirectory(baseWorkingDirectory);
   const suggestedWorktree = repositoryWork && baseWorkingDirectory ? ticketWorktreePath(baseWorkingDirectory, ticketId) : null;
   const workingDirectory = baseWorkingDirectory;
+  if (workingDirectory) {
+    try {
+      const guideSummary = await downloadAndSyncGuides(workingDirectory, {
+        session: context.session,
+        baseUrl: context.baseUrl,
+        accountId: Number(ticket.accountId) || context.accountId
+      });
+      if (guideSummary && ((guideSummary.updated || []).length || (guideSummary.removed || []).length)) {
+        appendGlobalActivityLog('guides', 'worker_repo_synced', {
+          agentId,
+          ticketId,
+          accountId: Number(ticket.accountId) || null,
+          directory: workingDirectory,
+          updated: (guideSummary.updated || []).length,
+          removed: (guideSummary.removed || []).length
+        });
+      }
+    } catch (err) {
+      appendGlobalActivityLog('guides', 'worker_repo_sync_failed', {
+        agentId,
+        ticketId,
+        directory: workingDirectory,
+        error: describeError(err)
+      }, 'error');
+    }
+  }
   // The brief is rendered server-side without the local path (the platform cannot know it), so the
   // resolved local repository hint is appended here. When nothing resolved, the server-rendered brief already
   // tells the worker to find it rather than guess — do not paper over that with a default.
@@ -12796,6 +13426,7 @@ function spawnTicketWorker(context, ctx, ticket) {
       'git -C ' + shellQuote(workingDirectory) + ' worktree add --force ' + shellQuote(suggestedWorktree) +
         (targetBranch ? ' ' + targetBranch : ' <branch>') + '\n' +
       'cd ' + shellQuote(suggestedWorktree) + '\n' +
+      'remits-cli guides sync\n' +
       (targetBranch
         ? 'git pull --ff-only origin ' + shellQuote(targetBranch) + '\n' +
           'git rev-list --left-right --count HEAD...origin/' + shellQuote(targetBranch) + '   # must print: 0  0\n'
@@ -13169,7 +13800,7 @@ async function agentHeartbeatDaemonCommand(flags) {
           if (!ticketId || inFlight.has(ticketId)) {
             continue;
           }
-          const started = spawnTicketWorker(context, ctx, ticket);
+          const started = await spawnTicketWorker(context, ctx, ticket);
           inFlight.set(ticketId, { pid: started.pid, accountId: ticket.accountId });
           started.done.then(() => {
             inFlight.delete(ticketId);
@@ -14018,6 +14649,13 @@ async function activityInspectCommand(flags) {
     dataMode: resolveDataMode(flags, session),
     userId: flags['user-id'] || flags.userId || flags['cli-user-id'],
     userEmail: flags['user-email'] || flags.email,
+    workspace: flags.workspace,
+    branchName: flags.branch || flags['branch-name'],
+    variantBranch: flags['variant-branch'],
+    // The local proof-campaign id, so the platform-side related view and `workstream status` can be asked
+    // the same question. Never defaulted from the workspace here: an unasked-for filter that silently
+    // narrows an investigation is worse than no filter.
+    workstreamId: normalizeWorkstreamId(flags.workstream || flags['workstream-id']),
     limit: flags.limit || flags.max || 20,
     envelopeLimit: flags['envelope-limit'] || flags.envelopeLimit
   }).then((r) => r.data);
@@ -14059,13 +14697,18 @@ function slimActivitySmell(smell) {
   return {
     severity: s.severity || 'info',
     type: s.type || 'signal',
+    title: s.title || s.envelopeSummary || s.testName || null,
     summary: s.summary || null,
+    status: s.status || s.health || null,
+    currentFailureCount: s.currentFailureCount == null ? null : s.currentFailureCount,
     accountId: s.accountId || null,
     laneId: s.laneId || null,
     envelopeId: s.envelopeId || null,
     taskId: s.taskId || null,
+    testName: s.testName || null,
     branchName: s.branchName || null,
-    workspace: s.workspace || null
+    workspace: s.workspace || null,
+    updatedAt: formatTime(s.updatedAtMs || s.updatedAt || s.at || s.createdAt)
   };
 }
 
@@ -14078,7 +14721,10 @@ function compactActivityInspect(response) {
   const nextActions = smells
     .filter((smell) => smellSeverityRank(smell) <= 2)
     .slice(0, 5)
-    .map((smell) => (smell.type || 'signal') + ': ' + (smell.summary || 'inspect this signal'));
+    .map((smell) => {
+      const title = smell.title || smell.envelopeSummary || smell.testName;
+      return (smell.type || 'signal') + (title ? ' (' + title + ')' : '') + ': ' + (smell.summary || 'inspect this signal');
+    });
 
   return {
     success: response.success,
@@ -14134,9 +14780,29 @@ function printActivityInspectSummary(response) {
     ? ' for ' + (response.subjectUser.email || response.subjectUser.name || ('user ' + response.subjectUser.id))
     : '';
   console.log('Activity inspection' + subject + ' — ' + response.dataMode + ' lane');
+  // A scope of several hundred accounts printed as one line is not a scope statement, it is a wall. Say how
+  // many, show the head, and point at --json for the rest.
+  const scopeIds = response.accountIds || [];
+  const scopeIdText = scopeIds.length > 12
+    ? scopeIds.slice(0, 12).join(', ') + ' … (+' + (scopeIds.length - 12) + ' more, --json for all)'
+    : (scopeIds.join(', ') || String(response.accountId));
   console.log('Scope: ' + (response.accountName || ('account ' + response.accountId)) +
     ' (' + response.accountId + '), ' + (response.scope || 'self') +
-    ' · accounts ' + ((response.accountIds || []).join(', ') || response.accountId));
+    ' · ' + (scopeIds.length || 1) + ' account(s): ' + scopeIdText);
+  if (response.filters && (response.filters.workspace || response.filters.branchName || response.filters.workstreamId)) {
+    console.log('Filters: ' + [
+      response.filters.workspace ? 'workspace ' + response.filters.workspace : null,
+      response.filters.branchName ? 'branch ' + response.filters.branchName : null,
+      response.filters.workstreamId ? 'workstream ' + response.filters.workstreamId : null
+    ].filter(Boolean).join(' · ') + '   (evidence below is narrowed to it)');
+  }
+  if (Array.isArray(response.relatedAccounts) && response.relatedAccounts.length) {
+    const related = response.relatedAccounts;
+    const shown = related.slice(0, 12).map((row) =>
+      row.id + ' ' + (row.name || '') + (row.role ? ' (' + row.role + ')' : '')).join('; ');
+    console.log('Related accounts: ' + shown +
+      (related.length > 12 ? '; … (+' + (related.length - 12) + ' more, --json for all)' : ''));
+  }
   const counts = response.counts || {};
   console.log('Counts: ' +
     (counts.agents || 0) + ' agent(s), ' +
@@ -14173,6 +14839,27 @@ function printActivityInspectSummary(response) {
     }
   }
 
+  // "2 agent(s)" with no names is the shape of the question, not the answer: an agent asking who else is in
+  // this repo right now could read the count and still have to go find them. The payload already carries the
+  // directory, branch, workspace and last-seen of each.
+  const liveAgents = response.agents || [];
+  if (liveAgents.length) {
+    console.log('');
+    console.log('Live agents here:');
+    liveAgents.slice(0, 10).forEach((agent) => {
+      const who = agent.label || agent.userEmail || agent.agentId || 'unknown agent';
+      const where = [agent.branch ? 'branch ' + agent.branch : null,
+        'workspace ' + (agent.workspace || 'shared'),
+        agent.dataMode ? 'data ' + agent.dataMode : null].filter(Boolean).join(' · ');
+      const seen = agent.lastSeenAtMs ? ' · seen ' + formatTime(agent.lastSeenAtMs) : '';
+      console.log('  - ' + who + '  [' + (agent.state || 'unknown') + ']' +
+        (agent.source === 'implicit' ? ' (implicit)' : '') + seen);
+      console.log('      ' + where);
+      if (agent.workingDirectory) console.log('      ' + agent.workingDirectory);
+    });
+    if (liveAgents.length > 10) console.log('  ...' + (liveAgents.length - 10) + ' more agent(s)');
+  }
+
   const lanes = response.lanes || [];
   if (lanes.length) {
     console.log('');
@@ -14237,6 +14924,77 @@ function printActivityInspectSummary(response) {
   console.log('Full structured payload: remits-cli activity inspect --json');
 }
 
+function readWorkstreamIndex(cwd, workstreamId) {
+  const id = normalizeWorkstreamId(workstreamId);
+  if (!id) return null;
+  const file = workstreamFile(cwd, id);
+  if (!fs.existsSync(file)) return null;
+  try {
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch (_) {
+    return null;
+  }
+}
+
+function listWorkstreamIndexes(cwd) {
+  const paths = ensureLocalState(cwd);
+  if (!fs.existsSync(paths.workstreamsDir)) return [];
+  return fs.readdirSync(paths.workstreamsDir, { withFileTypes: true })
+    .filter((entry) => entry.isFile() && entry.name.endsWith('.json'))
+    .map((entry) => readWorkstreamIndex(cwd, entry.name.replace(/\.json$/, '')))
+    .filter(Boolean)
+    .sort((a, b) => String(b.updatedAt || '').localeCompare(String(a.updatedAt || '')));
+}
+
+async function workstreamCommand(flags, subcommand) {
+  const cwd = process.cwd();
+  ensureLocalState(cwd);
+  const action = subcommand || 'status';
+  if (action !== 'status') throw new Error('Unknown workstream subcommand: ' + action);
+  const requested = resolveWorkstreamId(cwd, flags, { workspace: flags.workspace });
+  let rows = requested ? [readWorkstreamIndex(cwd, requested)].filter(Boolean) : listWorkstreamIndexes(cwd);
+  if (flags.workspace) {
+    const normalizedWorkspace = normalizeWorkspace(flags.workspace);
+    rows = rows.filter((row) => {
+      if (normalizeWorkspace(row.roles && row.roles.workspace) === normalizedWorkspace) return true;
+      return (row.artifacts || []).some((artifact) => normalizeWorkspace(artifact.workspace || (artifact.world && artifact.world.workspace)) === normalizedWorkspace);
+    });
+  }
+  if (flagEnabled(flags.json)) {
+    console.log(JSON.stringify({ success: true, workstreams: rows }, null, 2));
+    return;
+  }
+  if (!rows.length) {
+    console.log('No local workstream index found.');
+    console.log('Start one implicitly with a workspace, or pass --workstream <id> / REMITS_WORKSTREAM_ID while running tool or verify commands.');
+    return;
+  }
+  rows.forEach((row) => {
+    console.log('Workstream:', row.workstreamId);
+    console.log('Updated:', row.updatedAt || 'unknown');
+    console.log('Actors:', (row.actors || []).join(', ') || 'none recorded');
+    const roleParts = workstreamWorldParts(row.roles);
+    if (roleParts.length) console.log('Latest world:', roleParts.join(' · '));
+    // A campaign that spanned several worlds says so. One blended line would describe a run that never
+    // happened, and "which world proved this?" is the question the whole surface exists to answer.
+    const worlds = Array.isArray(row.worlds) ? row.worlds : [];
+    if (worlds.length > 1) {
+      console.log('Worlds in this workstream: ' + worlds.length);
+      worlds.slice(-6).forEach((world) => {
+        const parts = workstreamWorldParts(world);
+        if (parts.length) console.log('  - ' + parts.join(' · '));
+      });
+    }
+    const artifacts = Array.isArray(row.artifacts) ? row.artifacts.slice(-12) : [];
+    console.log('Artifacts:', artifacts.length ? '' : 'none recorded');
+    artifacts.forEach((artifact) => {
+      const label = [artifact.type, artifact.tool, artifact.callId, artifact.envelopeId, artifact.packetType].filter(Boolean).join(' ');
+      console.log('  - ' + (artifact.recordedAt || '') + ' ' + label);
+      if (artifact.path) console.log('      ' + artifact.path);
+    });
+  });
+}
+
 /**
  * The live work map: which repositories are being edited, by whom, and who else is around.
  *
@@ -15166,12 +15924,16 @@ function printCorpusHelp() {
 }
 
 function printToolHelp() {
-  console.log('Usage: remits-cli tool --name <toolName> [--base-url URL] [--account-id ID] [--branch BRANCH] [--input "{...}"|--input-file file.json] [--data-mode test|prod] [--variant-branch NAME|none] [--timeout-ms 60000] [--async true --wait true]');
+  console.log('Usage: remits-cli tool --name <toolName> [--base-url URL] [--account-id ID] [--as-account ID] [--target-account ID] [--branch BRANCH] [--input "{...}"|--input-file file.json] [--data-mode test|prod] [--variant-branch NAME|none] [--timeout-ms 60000] [--async true --wait true]');
   console.log('       remits-cli tool status --call-id <callId> [--base-url URL] [--account-id ID] [--data-mode test|prod]');
   console.log('');
   console.log('Hierarchy scope (read/discovery tools) — you do NOT need the owning child account id:');
   console.log('  --scope self|children|hierarchy   expand from the repo account when searching');
   console.log('  --target-account-id ID            the exact account to act on (required by writes)');
+  console.log('  --as-account ID                   execute as this reachable account; subscriber branch edges apply');
+  console.log('  --target-account ID               the account the tool acts ON (sent as input.accountId and');
+  console.log('                                    input.targetAccountId when --input omits them). It does NOT change');
+  console.log('                                    component resolution — add --as-account ID for that.');
   console.log('  --account-ids 1,2,3               an explicit bounded list of owner accounts');
   console.log('  --anchor-account-id ID            disambiguate the path for a multi-parent account');
   console.log('  These are merged into --input; a value already in --input wins.');
@@ -15179,17 +15941,68 @@ function printToolHelp() {
   console.log('Examples:');
   console.log('  remits-cli tool --name mcp_firestore_search --input-file query.json --data-mode prod');
   console.log('  remits-cli tool --name mcp_firestore_search --input \'{"collection":"statements","documentId":"1234"}\' --scope children');
-  console.log('  remits-cli tool --name mcp_run_action --input \'{"accountId":49,"actionId":200,"executionMode":"async"}\' --data-mode prod');
+  console.log('  remits-cli tool --name mcp_run_action --account-id 21 --as-account 36 --target-account 36 --input \'{"actionId":200,"executionMode":"async"}\' --data-mode prod');
   console.log('');
   console.log('For mcp_run_action and mcp_run_agent, prefer the tool\'s own executionMode:"async" and poll with that tool\'s controlAction:"status".');
 }
 
 function printToolsHelp() {
-  console.log('Usage: remits-cli tools [--base-url URL] [--account-id ID] [--branch BRANCH] [--data-mode test|prod] [--variant-branch NAME|none]');
+  console.log('Usage: remits-cli tools [--base-url URL] [--account-id ID] [--as-account ID] [--branch BRANCH] [--data-mode test|prod] [--variant-branch NAME|none]');
   console.log('');
   console.log('Refreshes .remits-cli/tools/tools.json for the current account/branch/data-mode context.');
 }
 
+function printGuidesHelp() {
+  console.log('Usage: remits-cli guides sync [--all] [--base-url URL] [--json]');
+  console.log('');
+  console.log('Refreshes front-stage guides from the authenticated platform.');
+  console.log('  --all updates every indexed account checkout on this machine.');
+  console.log('  without --all, run from an account repo to refresh only that checkout.');
+}
+
+async function guidesCommand(flags, subcommand) {
+  const mode = subcommand || 'sync';
+  if (mode === 'help' || mode === '--help' || flagEnabled(flags.help)) {
+    printGuidesHelp();
+    return;
+  }
+  if (mode !== 'sync' && mode !== 'refresh' && mode !== 'update') {
+    throw new Error('Unknown guides command: ' + mode + '. Use: remits-cli guides sync [--all]');
+  }
+
+  if (flagEnabled(flags.all)) {
+    const result = await syncGuidesAcrossIndexedRepos({
+      baseUrl: flags['base-url'] || null,
+      rescan: !flagEnabled(flags['no-rescan'])
+    });
+    if (flagEnabled(flags.json)) {
+      console.log(JSON.stringify(result, null, 2));
+      return;
+    }
+    console.log('Guides sync: ' + guideSyncSummaryLine(result));
+    for (const repo of result.repos || []) {
+      if (repo.skipped) {
+        console.log('  skipped account ' + (repo.accountId || '?') + ': ' + repo.reason + '  ' + repo.directory);
+      } else if ((repo.updated || []).length || (repo.removed || []).length) {
+        console.log('  updated account ' + repo.accountId + ': ' +
+          ((repo.updated || []).length + (repo.removed || []).length) + ' file(s)  ' + repo.directory);
+      }
+    }
+    return;
+  }
+
+  if (!loadAccountInfo(process.cwd())) {
+    throw new Error('Run `remits-cli guides sync` from an account repo, or pass --all.');
+  }
+  const before = Date.now();
+  await ensureGuidesSynced(process.cwd(), flags);
+  if (flagEnabled(flags.json)) {
+    console.log(JSON.stringify({ success: true, directory: process.cwd(), elapsedMs: Date.now() - before }, null, 2));
+    return;
+  }
+  console.log('Guides synced for ' + process.cwd());
+}
+
 function printTokenHelp() {
   console.log('Usage: remits-cli token [--base-url URL] [--branch BRANCH] [--path embeddable/path] [--data-mode test|prod] [--as-account ID] [--variant-branch NAME|none]');
   console.log('       remits-cli token inspect --token <token|tokenKey|URL> [--base-url URL] [--account-id ID]');
@@ -15276,7 +16089,7 @@ async function main() {
   try { updateAccountRepoIndex(process.cwd()); } catch (_) { /* not in account repo */ }
   // Auto-start the background service if not already running.
   // Skip for lifecycle subcommands and help.
-  const isLifecycleCmd = command === 'listen' || command === 'start' || command === 'stop' || command === 'status' || command === 'whoami' || command === 'doctor' || command === 'agent' || command === 'ticket';
+  const isLifecycleCmd = command === 'listen' || command === 'start' || command === 'stop' || command === 'status' || command === 'whoami' || command === 'doctor' || command === 'agent' || command === 'ticket' || command === 'guides';
   const isHelpCmd = !command || command === 'help' || command === '--help' || wantsHelp;
   if (!wantsJson && !isHelpCmd && command === 'components') {
     const commandName = 'components ' + (subcommand || 'command');
@@ -15313,18 +16126,20 @@ async function main() {
     console.log('  remits-cli agent status [--state idle|working|paused] [--ticket ID] [--activity "..."]');
     console.log('  remits-cli agent list [--account-id ID]                             # who else is available');
     console.log('  remits-cli agent map [--account-ids 1,4] [--json]                   # who is EDITING what, where, right now');
-    console.log('  remits-cli activity inspect [--account-id ID] [--scope self|children] [--user-email E] [--summary|--compact] [--json]');
+    console.log('  remits-cli activity inspect [--account-id ID] [--scope self|children|related] [--workspace NAME] [--workstream ID] [--user-email E] [--summary|--compact] [--json]');
+    console.log('  remits-cli workstream status [--workstream ID|--workspace NAME] [--json]');
     console.log('  remits-cli agent release                                            # stop receiving tickets now');
     console.log('  remits-cli start [--foreground true] [--port 8787]                  # human dashboard in the browser');
     console.log('  remits-cli stop');
     console.log('  remits-cli status [--base-url URL] [--account-id ID] [--data-mode test|prod] [--json]');
     console.log('  remits-cli doctor local-state [--json]                         # actor/workspace/local state hygiene');
     console.log('  remits-cli whoami [--base-url URL] [--account-id ID] [--data-mode test|prod] [--json]');
+    console.log('  remits-cli guides sync [--all] [--base-url URL] [--json]       # refresh front-stage guides');
     console.log('  remits-cli listen [stop|status] [--foreground true]  # compatibility alias');
     console.log('  remits-cli data-mode [set test|prod]');
     console.log('  remits-cli install --skills [--target codex|claude|gemini|all] [--overwrite true]');
-    console.log('  remits-cli tools [--base-url URL] [--account-id ID] [--branch BRANCH] [--data-mode test|prod] [--variant-branch NAME|none]');
-    console.log('  remits-cli tool --name <toolName> [--base-url URL] [--branch BRANCH] [--input \"{...}\"|--input-file file.json] [--data-mode test|prod] [--scope self|children|hierarchy] [--target-account-id ID] [--account-ids 1,2,3] [--variant-branch NAME|none] [--timeout-ms 60000] [--async true --wait true]');
+    console.log('  remits-cli tools [--base-url URL] [--account-id ID] [--as-account ID] [--branch BRANCH] [--data-mode test|prod] [--variant-branch NAME|none]');
+    console.log('  remits-cli tool --name <toolName> [--base-url URL] [--account-id ID] [--as-account ID] [--target-account ID] [--branch BRANCH] [--input \"{...}\"|--input-file file.json] [--data-mode test|prod] [--scope self|children|hierarchy] [--account-ids 1,2,3] [--variant-branch NAME|none] [--timeout-ms 60000] [--async true --wait true]');
     console.log('  remits-cli tool status --call-id <callId> [--base-url URL] [--account-id ID] [--data-mode test|prod]');
     console.log('  remits-cli workspace [show|use <name>|use --auto|clear]        # isolate staging when several agents share a repo');
     console.log('  remits-cli verify start --summary "..." [--manifest file.json]  # start a verification envelope');
@@ -15407,6 +16222,11 @@ async function main() {
     process.exit(0);
   }
 
+  if (wantsHelp && command === 'guides') {
+    printGuidesHelp();
+    process.exit(0);
+  }
+
   if (wantsHelp && command === 'token') {
     printTokenHelp();
     process.exit(0);
@@ -15427,6 +16247,11 @@ async function main() {
     return;
   }
 
+  if (command === 'guides') {
+    await guidesCommand(args, subcommand);
+    return;
+  }
+
   if (command === 'components' && (subcommand === 'push' || subcommand === 'stage')) {
     if (subcommand === 'push' && !args.mode) {
       args.mode = 'push';
@@ -15539,11 +16364,16 @@ async function main() {
 
   if (command === 'activity') {
     if (wantsHelp || !subcommand) {
-      console.log('Usage: remits-cli activity inspect [--account-id ID] [--scope self|children] [--user-id ID|--user-email EMAIL] [--limit N] [--summary|--compact] [--json]');
+      console.log('Usage: remits-cli activity inspect [--account-id ID] [--scope self|children|related] [--workspace NAME] [--branch NAME] [--workstream ID] [--user-id ID|--user-email EMAIL] [--limit N] [--summary|--compact] [--json]');
       console.log('');
       console.log('Read-only workstream inspection for agent/operator review. Joins current staging lanes,');
       console.log('verification envelopes, durable test runs, corpus measurements, live agent presence,');
       console.log('and heuristic smell signals without changing any lane or checkout.');
+      console.log('');
+      console.log('--scope related also follows component owners, staging lanes and verification packet worlds');
+      console.log('out of the hierarchy. --workspace / --branch / --workstream NARROW it: the account set becomes');
+      console.log('the accounts with matching evidence (plus this account and its component owners), and the');
+      console.log('lanes, envelopes, test runs and corpus results are filtered to that workstream.');
       return;
     }
     if (subcommand === 'inspect') {
@@ -15553,6 +16383,23 @@ async function main() {
     throw new Error('Unknown activity subcommand: ' + subcommand);
   }
 
+  if (command === 'workstream') {
+    if (wantsHelp) {
+      console.log('Usage: remits-cli workstream status [--workstream ID|--workspace NAME] [--json]');
+      console.log('');
+      console.log('Shows the local logical proof campaign index across actor-scoped state. It references');
+      console.log('tool response files, verification packets, actors and account/world roles without copying payloads.');
+      console.log('');
+      console.log('The id is stamped onto every verification packet world, so the same value works server-side:');
+      console.log('  remits-cli activity inspect --scope related --workstream <id>');
+      console.log('This is NOT a support ticket\'s --workstream, which is an account\'s own routing label matched');
+      console.log('by `agent serve --serves`. Same flag name, unrelated namespaces.');
+      return;
+    }
+    await workstreamCommand(args, subcommand);
+    return;
+  }
+
   if (command === 'ticket') {
     if (wantsHelp || !subcommand) {
       printTicketHelp();