@remits/remits-cli 0.1.135 → 0.1.137

package/index.js

@@ -4,18 +4,18 @@
 ## Table of Contents
 
 - L22  Runtime Bootstrap And Shared State
-- L119  Sessions, Account Resolution, And Production Guards
-- L603  Local State, Workspaces, And Verification Evidence
-- L2474  Account Repos, Guide Sync, And Platform Repo
-- L3282  Component Discovery And HTTP Logging
-- L3923  Skill Delivery And TOC Resolution
-- L4233  Auth And Component Staging
-- L4848  Component Summaries, Status, And Sync Gates
-- L6917  Branches, Promotion, Commit, And Test Runs
-- L8600  Tokens, Tools, Verification, And Config
-- L9980  Service Dashboard And WebSocket Listener
-- L12101  Agent And Ticket Workflows
-- L15573  Help, Auto Update, And Command Dispatch
+- L123  Sessions, Account Resolution, And Production Guards
+- L615  Local State, Workspaces, And Verification Evidence
+- L2652  Account Repos, Guide Sync, And Platform Repo
+- L3460  Component Discovery And HTTP Logging
+- L4107  Skill Delivery And TOC Resolution
+- L4417  Auth And Component Staging
+- L5032  Component Summaries, Status, And Sync Gates
+- L7104  Branches, Promotion, Commit, And Test Runs
+- L9193  Tokens, Tools, Verification, And Config
+- L10620  Service Dashboard And WebSocket Listener
+- L12742  Agent And Ticket Workflows
+- L16337  Help, Auto Update, And Command Dispatch
 */
 
 /*
@@ -58,6 +58,10 @@ const SERVICE_STATE_FILE = path.join(SESSION_DIR, 'service-state.json');
 const ISSUES_DIR = path.join(SESSION_DIR, 'issues');
 const WEBSOCKET_STATE_FILE = path.join(SESSION_DIR, 'websocket-state.json');
 const AUTO_UPDATE_LOCK_DIR = path.join(SESSION_DIR, 'auto-update.lock');
+const AUTO_UPDATE_STAMP_FILE = path.join(SESSION_DIR, 'auto-update-check.json');
+// `npm view` is a network round trip. It used to run on EVERY command, which is a per-command latency tax
+// on the agents that issue the most commands.
+const AUTO_UPDATE_CHECK_INTERVAL_MS = 6 * 60 * 60 * 1000;
 const AUTO_UPDATE_DISABLED_VALUES = new Set(['0', 'false', 'no', 'off']);
 const REMITS_CLI_PACKAGE_NAME = '@remits/remits-cli';
 const DEFAULT_DATA_MODE = 'test';
@@ -154,6 +158,14 @@ function flagEnabled(value) {
   return value === true || value === 'true' || value === '1' || value === 'yes';
 }
 
+function flagDisabled(value) {
+  return value === false || value === 'false' || value === '0' || value === 'no';
+}
+
+function waitForTestCompletion(flags = {}) {
+  return !(flagDisabled(flags.wait) || flagEnabled(flags['no-wait']) || flagEnabled(flags.noWait));
+}
+
 function withStdoutRoutedToStderr(enabled, fn) {
   if (!enabled) return fn();
   const originalLog = console.log;
@@ -626,6 +638,7 @@ function localStatePaths(cwd) {
     toolResponsesDir: path.join(actorDir, 'tool-responses'),
     verificationDir: path.join(actorDir, 'verification'),
     diagnosticsDir: path.join(actorDir, 'diagnostics'),
+    evidenceFile: path.join(actorDir, 'evidence.jsonl'),
     activeVerificationFile: path.join(actorDir, 'verification', 'active'),
     activeVerificationContextsFile: path.join(actorDir, 'verification', 'active-contexts.json'),
     currentSessionFile: path.join(actorDir, 'current-session.txt'),
@@ -897,6 +910,22 @@ function printLocalStateWarnings(cwd, flags = {}) {
   warnings.forEach((warning) => console.log('  - ' + warning));
 }
 
+/**
+ * "Your remits-cli is older than this platform's" - printed once per process, from ONE place.
+ *
+ * The platform attaches `cliAdvisory` to the two responses every working loop passes through (stage and
+ * test-run start) and returns nothing at all when the caller is current, so this renders only when there
+ * is something to act on. stderr, because a `--json` caller's stdout is a document.
+ */
+let cliAdvisoryPrinted = false;
+function printCliAdvisory(response) {
+  const advisory = response && response.cliAdvisory;
+  if (!advisory || cliAdvisoryPrinted) return;
+  cliAdvisoryPrinted = true;
+  console.error('');
+  console.error('[remits-cli ' + (advisory.current || '?') + ' -> ' + (advisory.expected || '?') + '] ' + advisory.message);
+}
+
 function printLocalCommandContext(cwd, flags = {}, context = {}) {
   const paths = localStatePaths(cwd);
   const branchName = context.branchName || flags.branch || safeGitValue(cwd, 'git rev-parse --abbrev-ref HEAD') || 'unknown';
@@ -1999,9 +2028,145 @@ async function printVerificationRunProbe(api, cwd, session, accountId, envelopeI
   return result;
 }
 
+/**
+ * The always-on evidence trail.
+ *
+ * <p>One world-stamped line per evidence-producing command, written whether or not any verification envelope
+ * exists. This is the answer to "what have I actually run, and in which world?" - the question agents were
+ * opening envelopes to answer, and an envelope is a far heavier instrument than that question needs. It is
+ * per-actor, so two agents in one checkout never read each other's trail, and it is append-only with a bounded
+ * tail so it cannot grow without limit.</p>
+ *
+ * <p>Recording is deliberately decision-free: there is no flag to remember, no state to start, and nothing an
+ * agent can fail to satisfy.</p>
+ */
+const EVIDENCE_TRAIL_MAX_LINES = 2000;
+
+function recordEvidenceEntry(cwd, packet, context = {}) {
+  try {
+    const paths = ensureLocalState(cwd);
+    const world = (packet && packet.world && typeof packet.world === 'object') ? packet.world : {};
+    const hasSuccess = packet && Object.prototype.hasOwnProperty.call(packet, 'success');
+    const entry = {
+      ts: new Date().toISOString(),
+      type: packet && packet.type || 'unknown',
+      claim: packet && packet.claim || null,
+      success: hasSuccess ? packet.success : true,
+      pending: packet && packet.pending === true || (hasSuccess && packet.success === null),
+      world: {
+        repoAccountId: world.repoAccountId != null ? world.repoAccountId : context.accountId || null,
+        executionAccountId: world.executionAccountId != null ? world.executionAccountId : (world.accountId != null ? world.accountId : null),
+        targetAccountId: world.targetAccountId != null ? world.targetAccountId : null,
+        dataMode: world.dataMode || context.dataMode || null,
+        branchName: world.branchName || world.gitBranch || context.branchName || null,
+        componentBranch: world.componentBranch || world.variantBranch || null,
+        workspace: world.workspace !== undefined ? world.workspace : (context.workspace !== undefined ? context.workspace : null),
+        sourceLayer: world.sourceLayer || null,
+        laneContentHash: world.laneContentHash || world.stagedOverlayHash || null,
+        host: world.host || context.baseUrl || null
+      },
+      ref: {
+        packetId: packet && packet.packetId || null,
+        taskId: (packet && packet.test && packet.test.taskId) || (packet && packet.status && packet.status.taskId) || null,
+        callId: (packet && packet.tool && packet.tool.callId) || null,
+        responseFile: (packet && packet.tool && packet.tool.responseFile) || null
+      },
+      // Present when an envelope happened to be active. Never required, and never something to chase.
+      envelopeId: context.envelopeId || null,
+      claims: Array.isArray(packet && packet.claims) ? packet.claims : undefined
+    };
+    fs.appendFileSync(paths.evidenceFile, JSON.stringify(entry) + '\n');
+    trimEvidenceTrail(paths.evidenceFile);
+    return entry;
+  } catch (_) {
+    // A trail write must never fail the command it is describing.
+    return null;
+  }
+}
+
+function evidenceOutcome(row) {
+  if (row && (row.pending === true || row.success === null)) return 'pending';
+  return row && row.success === false ? 'failed' : 'ok';
+}
+
+function evidenceOutcomeLabel(row) {
+  const outcome = evidenceOutcome(row);
+  if (outcome === 'failed') return 'FAILED ';
+  if (outcome === 'pending') return 'PENDING ';
+  return '';
+}
+
+function trimEvidenceTrail(file) {
+  try {
+    const lines = fs.readFileSync(file, 'utf8').split('\n').filter(Boolean);
+    if (lines.length <= EVIDENCE_TRAIL_MAX_LINES) return;
+    atomicWriteFile(file, lines.slice(lines.length - EVIDENCE_TRAIL_MAX_LINES).join('\n') + '\n');
+  } catch (_) { /* best effort */ }
+}
+
+function readEvidenceTrail(cwd, limit = 50) {
+  try {
+    const paths = localStatePaths(cwd);
+    if (!fs.existsSync(paths.evidenceFile)) return [];
+    const lines = fs.readFileSync(paths.evidenceFile, 'utf8').split('\n').filter(Boolean);
+    return lines.slice(Math.max(0, lines.length - limit)).map((line) => {
+      try { return JSON.parse(line); } catch (_) { return null; }
+    }).filter(Boolean);
+  } catch (_) {
+    return [];
+  }
+}
+
+/**
+ * WHERE a command ran: accounts, lane, branch, workspace. Deliberately NOT `sourceLayer` or
+ * `laneContentHash` - those legitimately differ between two commands in the same world (a stage is `staged`,
+ * the test that follows resolves `db`), so keying the grouping on them split one world into several and made
+ * two entries from the same context look like two different places. They belong on the entry.
+ */
+function describeEvidenceWorld(world) {
+  const w = world || {};
+  const accounts = w.executionAccountId && String(w.executionAccountId) !== String(w.repoAccountId)
+    ? 'account ' + w.repoAccountId + ' -> runs as ' + w.executionAccountId
+    : 'account ' + (w.repoAccountId == null ? '?' : w.repoAccountId);
+  return [
+    accounts,
+    w.targetAccountId && String(w.targetAccountId) !== String(w.executionAccountId) ? 'targets ' + w.targetAccountId : null,
+    w.dataMode ? w.dataMode + ' lane' : null,
+    w.branchName ? 'branch ' + w.branchName : null,
+    w.componentBranch ? 'components ' + w.componentBranch : null,
+    'ws:' + (w.workspace || 'shared')
+  ].filter(Boolean).join(' · ');
+}
+
+function claimIdsFromFlags(flags) {
+  return []
+    .concat((flags && flags.claim) || [])
+    .concat((flags && flags.claims) || [])
+    .filter(Boolean)
+    .flatMap((value) => String(value).split(','))
+    .map((value) => value.trim())
+    .filter(Boolean);
+}
+
+function stampPacketClaims(packet, flags) {
+  const claims = claimIdsFromFlags(flags);
+  if (!claims.length) return packet;
+  if (!Array.isArray(packet.evidenceCategories)) packet.evidenceCategories = [];
+  claims.forEach((claim) => {
+    if (!packet.evidenceCategories.includes(claim)) packet.evidenceCategories.push(claim);
+  });
+  packet.claims = claims;
+  return packet;
+}
+
 async function appendVerificationPacket(api, cwd, session, accountId, flags, packet, options = {}) {
   const context = activeVerificationContext(cwd, flags, session, accountId);
   const envelopeId = verificationEnvelopeIdForCommand(cwd, flags, context);
+  // The trail is written FIRST and unconditionally. Evidence recording must not depend on an agent having
+  // remembered to start anything: an envelope is an optional verdict on top of this, never the thing that
+  // makes a command's world durable.
+  stampPacketClaims(packet, flags);
+  recordEvidenceEntry(cwd, packet, Object.assign({}, context, { accountId, envelopeId }));
   if (!envelopeId) return null;
   const finalPacket = Object.assign({
     packetId: crypto.randomUUID(),
@@ -2067,7 +2232,7 @@ function printVerificationSummaryLine(env) {
   const health = env.health ? ' health=' + env.health : '';
   const failures = env.currentFailureCount ? ' currentFailures=' + env.currentFailureCount : (env.failedCount ? ' failed=' + env.failedCount : '');
   const required = ' required=' + (env.satisfiedCount || 0) + '/' + (env.requiredCount || 0);
-  const noManifest = env.noRequiredEvidence ? ' no-manifest' : '';
+  const noManifest = env.noRequiredEvidence ? ' evidence-log' : '';
   const stale = env.staleCount ? ' stale=' + env.staleCount : '';
   const changed = env.requirementsChangedAfterEvidence ? ' requirements-changed' : '';
   const lane = [env.branchName || 'unknown-branch', env.workspace ? 'ws:' + env.workspace : 'shared', env.dataMode || null, env.sourceLayer || null]
@@ -2084,7 +2249,7 @@ function printVerificationEnvelope(envelope, fallbackEnvelopeId) {
   const evaluation = envelope.evaluation || {};
   if (evaluation.health) console.log('Health:', evaluation.health);
   if (evaluation.noRequiredEvidence) {
-    console.log('Required evidence: none declared - evidence packets do not prove a complete acceptance contract.');
+    console.log('Required evidence: none declared - evidence log only; no verdict is outstanding.');
   } else {
     console.log('Required evidence:', (evaluation.satisfiedCount || 0) + '/' + (evaluation.requiredCount || 0));
   }
@@ -2143,7 +2308,7 @@ function compactVerificationEnvelope(envelope, fallbackEnvelopeId) {
   const nextActions = [];
 
   if (evaluation.noRequiredEvidence) {
-    nextActions.push('Attach a manifest or required evidence contract; packets are context, not proof of completion.');
+    nextActions.push('No verdict was requested. Leave this as an evidence log, or add `verify claim <id> --text "..."` only if someone needs a checkable verdict.');
   }
   if (failures.length) {
     nextActions.push('Inspect and replace the current failing evidence packet(s).');
@@ -2227,14 +2392,27 @@ function printEnvelopeWarnings(envelope) {
   console.log('Envelope warnings:');
   warnings.forEach((warning) => {
     console.log('- ' + (warning.message || warning.code || JSON.stringify(warning)));
+    if (warning.command) console.log('  ' + warning.command);
     if (Array.isArray(warning.envelopes) && warning.envelopes.length) {
       warning.envelopes.forEach((env) => {
-        console.log('  ' + (env.envelopeId || '(no id)') + (env.status ? ' ' + env.status : ''));
+        // Say whether the duplicate is in THIS world. A restart in a genuinely different lane or branch is
+        // sometimes exactly right; a second envelope for the same goal in the same world is the loop.
+        const world = env.world && typeof env.world === 'object'
+          ? Object.keys(env.world).map((key) => key + '=' + env.world[key]).join(' ')
+          : '';
+        console.log('  ' + (env.envelopeId || '(no id)') + (env.status ? ' ' + env.status : '') +
+          (env.sameWorld === true ? '  [same world]' : (world ? '  [' + world + ']' : '')));
       });
+      console.log('  Continue one of those with `remits-cli verify use <id>`, or supersede it once this one supersedes its goal.');
     }
   });
 }
 
+function manifestClaims(manifest) {
+  const claims = manifest && manifest.claims;
+  return Array.isArray(claims) ? claims.filter(Boolean) : [];
+}
+
 function manifestRequiredEvidence(manifest = {}) {
   const required = [];
   if (Array.isArray(manifest.requiredEvidence)) required.push(...manifest.requiredEvidence);
@@ -3684,6 +3862,12 @@ function stageTimeoutMs(components, flags = {}) {
 
 function buildAxios(baseUrl, token, timeoutMs = 60000) {
   const headers = token ? { Authorization: 'Bearer ' + token } : {};
+  // The CLI version on EVERY request, from the one place every request is built. It used to travel only on
+  // `agent register`, so the platform knew the version of the sessions that registered - and the agents that
+  // loop hardest are exactly the ones that never do. Without it the platform cannot tell an agent that the
+  // diagnostics it is missing exist, and every output improvement lands invisibly.
+  const cliVersion = readCliVersion();
+  if (cliVersion) headers['X-Remits-Cli-Version'] = cliVersion;
   return axios.create({ baseURL: baseUrl, timeout: parsePositiveInt(timeoutMs, 60000), headers });
 }
 
@@ -5082,6 +5266,9 @@ function printStageSummary(response, flags) {
   if (typeof printAccountLanes === 'function') {
     printAccountLanes(response);
   }
+  if (typeof printCliAdvisory === 'function') {
+    printCliAdvisory(response);
+  }
   printComponentCommandResponse('Components stage', response, flags);
 }
 
@@ -6933,6 +7120,10 @@ async function branchesComponentsCommand(flags) {
   // after the subcommand is the branch name when present.
   const positional = flags._ && flags._[2];
   const branchName = flags.branch || positional;
+  const copyToBranch = flags['copy-to'] || flags.copyTo;
+  if ((flags['copy-to'] !== undefined || flags.copyTo !== undefined) && !branchName) {
+    throw new Error('components branch <source> --copy-to <target> requires a source branch name');
+  }
 
   // Without a branch there is nothing to detail, so always list. With one, the mutating flags
   // (--subscribe/--unsubscribe/--retire) win, then the narrower read views, and the default is the
@@ -6942,10 +7133,14 @@ async function branchesComponentsCommand(flags) {
     if (flags.subscribe !== undefined) mode = 'subscribe';
     else if (flags.unsubscribe !== undefined) mode = 'unsubscribe';
     else if (flagEnabled(flags.retire)) mode = 'retire';
+    else if (flags['copy-to'] !== undefined || flags.copyTo !== undefined) mode = 'copy';
     else if (flags.diff !== undefined) mode = 'diff';
     else if (flagEnabled(flags.subscribers)) mode = 'subscribers';
     else mode = 'status';
   }
+  if (mode === 'copy' && (copyToBranch === true || !String(copyToBranch || '').trim())) {
+    throw new Error('components branch <source> --copy-to <target> requires a target branch name');
+  }
 
   // `--diff 42` carries the component id inline; a bare `--diff` falls back to --component-id/--name.
   const componentId = mode === 'diff'
@@ -6968,6 +7163,7 @@ async function branchesComponentsCommand(flags) {
     componentType: flags['component-type'] || flags.type,
     componentId,
     componentName: flags['component-name'] || flags.name,
+    targetBranchName: copyToBranch,
     subscribeAccountId,
     parentAccountId: flags['parent-account'],
     // Optional branch-scoped custom host set on the same edge as the subscription.
@@ -7091,6 +7287,33 @@ function printBranchesSummary(response) {
     return;
   }
 
+  if (response.mode === 'copy') {
+    console.log(response.message || ('Copied branch overlays to ' + response.targetBranch));
+    console.log('Source branch:', response.branch);
+    console.log('Target branch:', response.targetBranch);
+    // A dry run writes nothing, so `copied` is 0 by contract — printing it as "Copied overlays: 0"
+    // under a "Would copy 2" message reads as a failed copy. Name the plan instead.
+    if (response.dryRun) {
+      console.log('Plan only (dry run) — overlays that would be copied:', response.plannedCopies || 0);
+      if (response.existingCount) console.log('Existing overlays that would be replaced:', response.existingCount);
+    } else {
+      console.log('Copied overlays:', response.copied || 0);
+      if (response.overwritten) console.log('Replaced existing overlays:', response.overwritten);
+    }
+    // A source overlay that is identical to trunk in both content and metadata is sparse and is never
+    // stored, so it is named rather than silently missing from the count.
+    const skippedSparse = response.skippedIdenticalToTrunk || [];
+    if (skippedSparse.length) {
+      console.log('Skipped as identical to trunk:', skippedSparse.join(', '));
+    }
+    // The number an operator needs BEFORE deciding to pass --force: a target branch with live
+    // subscribers is code those accounts are running right now.
+    if (response.targetSubscriberCount) {
+      console.log('Live subscribers on the target branch:', response.targetSubscriberCount);
+    }
+    return;
+  }
+
   if (response.mode === 'subscribe' || response.mode === 'unsubscribe' || response.mode === 'retire') {
     console.log(response.message);
     if (response.requiresConfirmation) {
@@ -7702,7 +7925,7 @@ async function waitForStatus(api, cwd, accountId, branchName, taskId, token, dat
       dataMode
     }).then((r) => r.data);
 
-    if (status.status === 'completed' || status.status === 'failed') {
+    if (testStatusIsTerminal(status)) {
       return status;
     }
     await new Promise((r) => setTimeout(r, pollDelayMs));
@@ -7710,6 +7933,10 @@ async function waitForStatus(api, cwd, accountId, branchName, taskId, token, dat
   }
 }
 
+function testStatusIsTerminal(status = {}) {
+  return ['completed', 'failed', 'interrupted'].includes(String(status.status || '').toLowerCase());
+}
+
 function testEvidenceCategories(status = {}, selectedNames = []) {
   const categories = new Set(['test_run']);
   const test = status.test || {};
@@ -7839,6 +8066,108 @@ function detectNondeterministicTestRun(priorPackets, currentStatus, currentProve
   return null;
 }
 
+async function appendTerminalTestRunEvidence(options = {}) {
+  const {
+    api,
+    cwd,
+    session,
+    accountId,
+    flags,
+    status,
+    testRef,
+    selectedNames = [],
+    dataMode,
+    dataModeSource,
+    branchName,
+    workspace,
+    baseUrl,
+    activeEnvelopeId,
+    quiet
+  } = options;
+  const unmatched = (status.result && status.result.unmatchedTestNames) || [];
+  const componentProvenance = testComponentProvenance(status);
+  const sourceRevision = collectVerificationSource(cwd, flags);
+  const priorPackets = await readVerificationPacketsForDiagnostics(api, cwd, session, accountId, activeEnvelopeId, {
+    packetType: 'test_run',
+    suite: status.test && status.test.name,
+    max: 50
+  });
+  const nondeterminism = detectNondeterministicTestRun(priorPackets, status, componentProvenance, {
+    laneContentHash: status.staging && status.staging.laneSummary && status.staging.laneSummary.contentHash,
+    gitHead: sourceRevision.gitHead
+  });
+
+  await appendVerificationPacket(api, cwd, session, accountId, flags, {
+    type: 'test_run',
+    success: status.status === 'completed' && !(status.result && status.result.failed > 0) && !unmatched.length,
+    claim: 'Test run ' + String(testRef || (status.test && (status.test.name || status.test.id)) || status.taskId || 'unknown'),
+    world: buildCommandWorld(status, {
+      accountId,
+      dataMode: status.dataMode || dataMode,
+      dataModeSource,
+      branchName,
+      workspace,
+      host: normalizeBaseUrl(baseUrl),
+      sourceLayer: status.staging && status.staging.testComponentSource
+    }),
+    revision: Object.assign(sourceRevision, {
+      compileSignatures: testCompileSignatures(status),
+      componentProvenance
+    }),
+    nondeterministic: nondeterminism ? true : undefined,
+    nondeterminism: nondeterminism || undefined,
+    test: {
+      taskId: status.taskId || (status.result && status.result.taskId),
+      testId: status.test && status.test.id,
+      testName: status.test && status.test.name,
+      selectedCases: selectedNames,
+      passed: status.result && status.result.passed,
+      failed: status.result && status.result.failed,
+      tests: status.result && status.result.tests,
+      dataModeSource: status.dataModeSource || dataModeSource,
+      unmatchedTestNames: unmatched
+    },
+    evidenceCategories: testEvidenceCategories(status, selectedNames),
+    // What the run spent and whether that live AI was declared (withAiBudget), so an envelope can tell a
+    // measurement run from a suite with missing mocks without re-reading every case.
+    dependencies: testRunDependencies(status),
+    summary: status.result && status.result.summary,
+    limitations: []
+      .concat(unmatched.length ? ['One or more requested test case selectors matched no case.'] : [])
+      .concat(nondeterminism ? [nondeterminism.message] : []),
+    rawRefs: { testStatusKey: status.taskId, durableTestRun: status.result && status.result.durableRecord ? status.taskId : undefined },
+    status
+  }, { quiet });
+
+  return { unmatched, nondeterminism };
+}
+
+/**
+ * One failed case per distinct failure root, largest root first, capped.
+ *
+ * A pivot block per failed case is one problem stated N times: the thirty-three failures of a real suite
+ * are twenty-one roots, and the twelve repeats carry the same trace shape, the same components and the
+ * same error. The grouped roll-up above already names every case; this picks the ones worth a full block.
+ */
+/** Truncate, and SAY that it was truncated — a silent cut reads as the whole message. */
+function truncateForPivot(text, max) {
+  if (text.length <= max) return text;
+  return text.slice(0, max) + '… (truncated; --json for the full text)';
+}
+
+function selectPivotCases(tests, limit = 6) {
+  const failed = (tests || []).filter((test) => test && test.passed === false);
+  const seen = new Set();
+  const representatives = [];
+  failed.forEach((test) => {
+    const root = testFailureRoot(test);
+    if (seen.has(root)) return;
+    seen.add(root);
+    representatives.push(test);
+  });
+  return { shown: representatives.slice(0, limit), failedCount: failed.length, rootCount: representatives.length };
+}
+
 function printTestRunPivots(status = {}) {
   const tests = status.result && Array.isArray(status.result.tests) ? status.result.tests : [];
   if (!tests.length) return;
@@ -7846,7 +8175,8 @@ function printTestRunPivots(status = {}) {
   if (slowest && slowest.duration != null) {
     console.log('Slowest case:', (slowest.name || '(unnamed)') + ' in ' + formatDurationMs(slowest.duration));
   }
-  tests.filter((test) => test && test.passed === false).forEach((test) => {
+  const selection = selectPivotCases(tests);
+  selection.shown.forEach((test) => {
     console.log('Pivots for failed case:', test.name || '(unnamed)');
     if (test.outcome) console.log('  Outcome:', test.outcome + (test.outcomeReason && test.outcomeReason !== test.error ? ' - ' + String(test.outcomeReason).slice(0, 300) : ''));
     if (test.duration != null) console.log('  Duration:', formatDurationMs(test.duration));
@@ -7857,7 +8187,9 @@ function printTestRunPivots(status = {}) {
     if (test.threadGroupingId || test.threadGroupId || test.traceId) {
       console.log('  Trace:', test.traceId || test.threadGroupingId || test.threadGroupId);
     }
-    if (test.error) console.log('  Error:', String(test.error).slice(0, 500));
+    // 500 chars cut the replay diagnosis mid-sentence, losing the half that says what to DO. A pivot is the
+    // block a reader acts on; truncating its one actionable sentence to save four lines is a bad trade.
+    if (test.error) console.log('  Error:', truncateForPivot(String(test.error), 1200));
     const diagnostics = test.diagnostics && typeof test.diagnostics === 'object' ? test.diagnostics : null;
     if (diagnostics && Object.keys(diagnostics).length) {
       console.log('  Diagnostics:', JSON.stringify(diagnostics).slice(0, 1200));
@@ -7873,6 +8205,12 @@ function printTestRunPivots(status = {}) {
       console.log('  Live HTTP calls:', test.liveHttpCalls.length + (intentional ? ' (' + intentional + ' intentional, inside withAiBudget)' : ''));
     }
   });
+  // Named, not silently dropped: a reader must be able to tell "this is everything" from "this is a sample".
+  if (selection.rootCount > selection.shown.length) {
+    console.log('Pivots shown for ' + selection.shown.length + ' of ' + selection.rootCount +
+      ' failure root(s) (' + selection.failedCount + ' failed case(s)). Every root is listed above; ' +
+      'use --names "<case>" for one, or --json for all.');
+  }
 }
 
 function formatDurationMs(value) {
@@ -8086,6 +8424,114 @@ function stagedMaskedByVariantLines(masked, accountId) {
   return lines;
 }
 
+/**
+ * The assertion ROOT of one failed case: what broke, with the particulars of this case removed.
+ *
+ * Deliberately built only from properties of the JVM/Groovy failure format - a power-assert's
+ * `Expression:`/`Values:` decoration, an `assert <expr>` head, an exception class prefix - and never from
+ * any vocabulary a suite happens to use. Identifiers and numbers are replaced because two cases failing
+ * the same way differ exactly in those.
+ */
+function testFailureRoot(test = {}) {
+  let text = String(test.error || test.outcomeReason || test.outcome || 'failed').trim();
+  // Groovy's power assert appends the rendered expression and every intermediate value.
+  text = text.split(/\.\s+(?:Expression|Values):/)[0];
+  const assertion = text.match(/assert\s+(.+)$/);
+  if (assertion) text = 'assert ' + assertion[1];
+  text = text
+    .replace(/['"][0-9a-fA-F]{8}-[0-9a-fA-F-]{4,}['"]/g, "'<id>'")
+    .replace(/\b[0-9a-fA-F]{8}-[0-9a-fA-F-]{27,}\b/g, '<id>')
+    .replace(/\b\d[\d.,]*\b/g, '<n>')
+    .replace(/\s+/g, ' ')
+    .trim();
+  if (text.length <= FAILURE_ROOT_LABEL_CHARS) return text;
+  // Cut on a word boundary: "found no usable stored provid" reads as a different error than the one it is.
+  const cut = text.slice(0, FAILURE_ROOT_LABEL_CHARS);
+  const lastSpace = cut.lastIndexOf(' ');
+  return (lastSpace > FAILURE_ROOT_LABEL_CHARS * 0.6 ? cut.slice(0, lastSpace) : cut) + '\u2026';
+}
+
+/** Long enough to tell two failures apart, short enough that a root list stays a list. */
+const FAILURE_ROOT_LABEL_CHARS = 120;
+
+/**
+ * Failed cases grouped by that root, largest first.
+ *
+ * Thirty-three failures printed in run order read as thirty-three problems; the same run grouped is four.
+ * This is the line that decides whether the next move is a narrow root-cause pass or another broad rerun,
+ * so it is computed from the run itself rather than left to the reader.
+ */
+function testFailureGroups(status = {}) {
+  const tests = status.result && Array.isArray(status.result.tests) ? status.result.tests : [];
+  const groups = new Map();
+  tests.filter((test) => test && test.passed === false && !test.interrupted).forEach((test) => {
+    const root = testFailureRoot(test);
+    if (!groups.has(root)) groups.set(root, { root, count: 0, cases: [] });
+    const group = groups.get(root);
+    group.count += 1;
+    group.cases.push(test.name || '(unnamed)');
+  });
+  return Array.from(groups.values()).sort((left, right) => right.count - left.count || left.root.localeCompare(right.root));
+}
+
+const FAILURE_GROUPS_SHOWN = 8;
+
+function testFailureGroupLines(status = {}, options = {}) {
+  const groups = testFailureGroups(status);
+  if (!groups.length) return [];
+  const failed = groups.reduce((sum, group) => sum + group.count, 0);
+  const lines = [''];
+  lines.push('Failure roots (' + failed + ' failed case(s), ' + groups.length + ' distinct root(s)):');
+  groups.slice(0, FAILURE_GROUPS_SHOWN).forEach((group) => {
+    lines.push('  ' + String(group.count) + 'x  ' + group.root);
+    // The representative case is what `--names` takes, so the next command is a copy of this line.
+    lines.push('        e.g. ' + group.cases[0] + (group.count > 1 ? '  (+' + (group.count - 1) + ' more)' : ''));
+  });
+  if (groups.length > FAILURE_GROUPS_SHOWN) {
+    lines.push('  ...' + (groups.length - FAILURE_GROUPS_SHOWN) + ' more root(s); --json for all');
+  }
+  const testRef = options.testRef || (status.test && (status.test.id || status.test.name)) ||
+    (status.result && (status.result.testId || status.result.testName));
+  if (groups[0] && groups[0].count > 1 && testRef) {
+    lines.push('Largest root first: remits-cli test run --test ' + JSON.stringify(String(testRef)) +
+      ' --names ' + JSON.stringify(groups[0].cases[0]));
+  }
+  return lines;
+}
+
+/**
+ * The verdict of a run in four lines, shared by `test run` and `test status`.
+ *
+ * `test run` used to print the whole run object as pretty JSON before its human summary. Measured on one
+ * 92-case suite that is 220 KB - most of it per-case ids repeated once per case - spent by the command an
+ * agent runs most often, on the turn where it has the least room left to reason. Every byte is still one
+ * `--json` away.
+ */
+function testRunHeadlineLines(status = {}, options = {}) {
+  const result = status.result || {};
+  const lines = [];
+  lines.push('Test run status: ' + (status.status || 'unknown'));
+  if (options.taskId || status.taskId) lines.push('Task ID: ' + (options.taskId || status.taskId));
+  if (options.source) lines.push('Source: ' + options.source);
+  const actualDataMode = status.dataMode || result.dataMode || options.dataMode;
+  let dataModeLine = 'Data mode: ' + (actualDataMode || 'unknown');
+  // A durable run answers about the lane it RAN in, which need not be the lane this command asked for.
+  // Reporting only the run's own lane is correct and reads as if the request had been honoured.
+  if (options.requestedDataMode && actualDataMode && options.requestedDataMode !== actualDataMode) {
+    dataModeLine += '   (you asked for ' + options.requestedDataMode + '; this run was recorded in the ' +
+      actualDataMode + ' lane, and that is what it proves)';
+  }
+  lines.push(dataModeLine);
+  if (result.total != null || result.passed != null) {
+    lines.push('Cases: ' + (result.passed || 0) + ' passed, ' + (result.failed || 0) + ' failed, ' +
+      (result.total || 0) + ' total');
+  }
+  if (status.error || status.message || result.error) {
+    lines.push('Message: ' + (status.error || status.message || result.error));
+  }
+  return lines;
+}
+
 // The corpus-style roll-up printed after a run: outcome counts, case duration percentiles, AI usage split
 // live/mocked, and the durable record. Built only from the result the platform returned.
 function testRunSummaryLines(status = {}) {
@@ -8341,6 +8787,7 @@ async function testCommand(flags) {
     printLocalStateWarnings(cwd, flags);
     printStagingLane(branchName, workspace, workspaceSource(cwd, flags));
     printStagingLaneOwnerNotice(start.staging || {});
+    printCliAdvisory(start);
     if (start.staging && Array.isArray(start.staging.accountLanes)) {
       printOrphanedWorkspaceWarning(start.staging);
       printAccountLanes({ accountLanes: start.staging.accountLanes, branchName, workspace });
@@ -8356,6 +8803,48 @@ async function testCommand(flags) {
   });
   runtimeState.currentTestTaskId = start.taskId;
 
+  const waitForCompletion = waitForTestCompletion(flags);
+  if (!waitForCompletion) {
+    recordEvidenceEntry(cwd, {
+      type: 'test_run',
+      success: null,
+      pending: true,
+      claim: 'Test run ' + String(testRef),
+      world: buildCommandWorld(start, {
+        accountId,
+        dataMode,
+        dataModeSource,
+        branchName,
+        workspace,
+        host: normalizeBaseUrl(baseUrl),
+        sourceLayer: start.staging && start.staging.testComponentSource
+      }),
+      test: {
+        taskId: start.taskId,
+        testId: start.test && start.test.id,
+        testName: start.test && start.test.name,
+        selectedCases: names,
+        dataModeSource
+      },
+      evidenceCategories: testEvidenceCategories(start, names),
+      rawRefs: { testStatusKey: start.taskId },
+      status: start
+    }, { accountId, dataMode, branchName, workspace, baseUrl: normalizeBaseUrl(baseUrl), envelopeId: activeEnvelopeId });
+    runtimeState.currentTestTaskId = null;
+    if (jsonOutput) {
+      console.log(JSON.stringify(Object.assign({}, start, {
+        pending: true,
+        wait: false,
+        statusCommand: 'remits-cli test status --task-id ' + start.taskId
+      }), null, 2));
+    } else {
+      console.log('Not waiting (--wait false).');
+      console.log('Poll this run: remits-cli test status --task-id ' + start.taskId);
+      console.log('Terminal evidence attaches when `test status` reads a completed, failed or interrupted run.');
+    }
+    return;
+  }
+
   let stopWs = null;
   if (flags.watch !== 'false') {
     const topic = session.websocketTopic || start.websocketTopic || (session.user && String(session.user.uuid || '').replace(/-/g, ''));
@@ -8376,10 +8865,16 @@ async function testCommand(flags) {
   if (jsonOutput) {
     console.log(JSON.stringify(status, null, 2));
   } else {
-    console.log('Final status:', JSON.stringify(status, null, 2));
     printStagingLaneOwnerNotice(status.staging || {});
+    testRunHeadlineLines(status, { taskId: start.taskId, dataMode, requestedDataMode: dataMode })
+      .forEach((line) => console.log(line));
     testRunSummaryLines(status).forEach((line) => console.log(line));
+    testFailureGroupLines(status, { testRef }).forEach((line) => console.log(line));
     printTestRunPivots(status);
+    // The whole run object used to be printed here as pretty JSON. One 92-case suite measured 220 KB,
+    // most of it identifiers repeated once per case, spent on the turn with the least room left. It is
+    // still one flag away, and the durable record keeps it after the live status expires.
+    console.log('Full run payload: remits-cli test status --task-id ' + start.taskId + ' --json');
   }
 
   // A selector that matched no case is a mis-specified run, not a passing one. Say so in the terminal
@@ -8404,17 +8899,24 @@ async function testCommand(flags) {
     process.exitCode = 1;
   }
 
-  const componentProvenance = testComponentProvenance(status);
-  const sourceRevision = collectVerificationSource(cwd, flags);
-  const priorPackets = await readVerificationPacketsForDiagnostics(api, cwd, session, accountId, activeEnvelopeId, {
-    packetType: 'test_run',
-    suite: status.test && status.test.name,
-    max: 50
-  });
-  const nondeterminism = detectNondeterministicTestRun(priorPackets, status, componentProvenance, {
-    laneContentHash: status.staging && status.staging.laneSummary && status.staging.laneSummary.contentHash,
-    gitHead: sourceRevision.gitHead
+  const evidence = await appendTerminalTestRunEvidence({
+    api,
+    cwd,
+    session,
+    accountId,
+    flags: verification.evidenceFlags,
+    status,
+    testRef,
+    selectedNames: names,
+    dataMode,
+    dataModeSource,
+    branchName,
+    workspace,
+    baseUrl,
+    activeEnvelopeId,
+    quiet: jsonOutput
   });
+  const nondeterminism = evidence.nondeterminism;
   if (nondeterminism && !jsonOutput) {
     console.log('Nondeterministic signal:', nondeterminism.message);
     nondeterminism.flips.slice(0, 6).forEach((flip) => {
@@ -8422,40 +8924,6 @@ async function testCommand(flags) {
         ' (previous packet ' + (flip.previousPacketId || 'unknown') + ')');
     });
   }
-
-  await appendVerificationPacket(api, cwd, session, accountId, verification.evidenceFlags, {
-    type: 'test_run',
-    success: status.status === 'completed' && !(status.result && status.result.failed > 0) && !unmatched.length,
-    claim: 'Test run ' + String(testRef),
-    world: buildCommandWorld(status, { accountId, dataMode: status.dataMode || dataMode, dataModeSource, branchName, workspace, host: normalizeBaseUrl(baseUrl), sourceLayer: status.staging && status.staging.testComponentSource }),
-    revision: Object.assign(sourceRevision, {
-      compileSignatures: testCompileSignatures(status),
-      componentProvenance
-    }),
-    nondeterministic: nondeterminism ? true : undefined,
-    nondeterminism: nondeterminism || undefined,
-    test: {
-      taskId: start.taskId,
-      testId: status.test && status.test.id,
-      testName: status.test && status.test.name,
-      selectedCases: names,
-      passed: status.result && status.result.passed,
-      failed: status.result && status.result.failed,
-      tests: status.result && status.result.tests,
-      dataModeSource: status.dataModeSource || dataModeSource,
-      unmatchedTestNames: unmatched
-    },
-    evidenceCategories: testEvidenceCategories(status, names),
-    // What the run spent and whether that live AI was declared (withAiBudget), so an envelope can tell a
-    // measurement run from a suite with missing mocks without re-reading every case.
-    dependencies: testRunDependencies(status),
-    summary: status.result && status.result.summary,
-    limitations: []
-      .concat(unmatched.length ? ['One or more requested test case selectors matched no case.'] : [])
-      .concat(nondeterminism ? [nondeterminism.message] : []),
-    rawRefs: { testStatusKey: start.taskId, durableTestRun: status.result && status.result.durableRecord ? start.taskId : undefined },
-    status
-  }, { quiet: jsonOutput });
 }
 
 async function testStatusCommand(flags) {
@@ -8465,9 +8933,11 @@ async function testStatusCommand(flags) {
   const { session, accountId } = sessionContext;
   const baseUrl = flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL;
   const branchName = flags.branch || currentBranch(cwd);
+  const workspace = resolveWorkspace(cwd, flags);
   const dataMode = hasExplicitDataModeFlag(flags)
     ? resolveDataMode(flags, null)
     : DEFAULT_DATA_MODE;
+  const dataModeSource = dataModeFlagSource(flags);
   const taskId = flags['task-id'] || flags.taskId || flags.id || (flags._ && flags._[2]);
   const jsonOutput = flagEnabled(flags.json);
   if (!taskId) throw new Error('Missing --task-id <taskId>');
@@ -8481,31 +8951,94 @@ async function testStatusCommand(flags) {
     taskId,
     dataMode
   }).then((r) => r.data);
+  if (!status.taskId) status.taskId = taskId;
+
+  let statusVerification = { envelopeId: null, evidenceFlags: flags };
+  if (testStatusIsTerminal(status)) {
+    statusVerification = await verificationPreflight(api, cwd, session, accountId, flags, {
+      packetType: 'test_run',
+      world: buildCommandWorld(status, {
+        accountId,
+        dataMode: status.dataMode || dataMode,
+        dataModeSource,
+        branchName,
+        workspace,
+        host: normalizeBaseUrl(baseUrl),
+        sourceLayer: status.staging && status.staging.testComponentSource
+      }),
+      test: status.test && status.test.id !== undefined && status.test.id !== null
+        ? { testId: status.test.id, testName: status.test.name }
+        : { testName: status.test && status.test.name }
+    }, { command: 'test status', neverRefuse: true, quiet: jsonOutput });
+  }
 
   if (jsonOutput) {
+    if (testStatusIsTerminal(status)) {
+      await appendTerminalTestRunEvidence({
+        api,
+        cwd,
+        session,
+        accountId,
+        flags: statusVerification.evidenceFlags,
+        status,
+        testRef: status.test && (status.test.name || status.test.id) || taskId,
+        selectedNames: status.result && Array.isArray(status.result.tests) ? status.result.tests.map((t) => t && t.name).filter(Boolean) : [],
+        dataMode,
+        dataModeSource,
+        branchName,
+        workspace,
+        baseUrl,
+        activeEnvelopeId: statusVerification.envelopeId,
+        quiet: true
+      });
+    }
     console.log(JSON.stringify(status, null, 2));
     return status;
   }
   printSessionResolutionWarning(sessionContext);
   printResolvedBaseUrl(baseUrl);
-  console.log('Test run status:', status.status || 'unknown');
-  console.log('Task ID:', taskId);
   // Say where this answer came from. A durable record is a finished snapshot rebuilt from the database after the
   // live status was gone; without this line a reconstructed run is indistinguishable from one still being watched.
-  console.log('Source:', status.durable
-    ? 'durable run record (the live status has expired; this run is final)'
-    : 'live run status');
-  console.log('Data mode:', status.dataMode || dataMode);
-  if (status.result) {
-    console.log('Cases:', (status.result.passed || 0) + ' passed, ' + (status.result.failed || 0) + ' failed, ' + (status.result.total || 0) + ' total');
-  }
-  if (status.error || status.message) {
-    console.log('Message:', status.error || status.message);
-  }
+  testRunHeadlineLines(status, {
+    taskId,
+    source: status.durable
+      ? 'durable run record (the live status has expired; this run is final)'
+      : 'live run status',
+    dataMode,
+    // A durable run reports the lane it RAN in. When that differs from the lane this command asked for,
+    // say so: auditing prod activity and being handed a test-lane run is correct and reads as if it were not.
+    requestedDataMode: hasExplicitDataModeFlag(flags) ? dataMode : null
+  }).forEach((line) => console.log(line));
   if (status.world) runWorldLines(status.world, { host: normalizeBaseUrl(baseUrl) }).forEach((line) => console.log(line));
   testRunSummaryLines(status).forEach((line) => console.log(line));
+  testFailureGroupLines(status).forEach((line) => console.log(line));
   printTestRunPivots(status);
-  if (status.status === 'failed' || (status.result && status.result.failed > 0)) {
+  if (testStatusIsTerminal(status)) {
+    const evidence = await appendTerminalTestRunEvidence({
+      api,
+      cwd,
+      session,
+      accountId,
+      flags: statusVerification.evidenceFlags,
+      status,
+      testRef: status.test && (status.test.name || status.test.id) || taskId,
+      selectedNames: status.result && Array.isArray(status.result.tests) ? status.result.tests.map((t) => t && t.name).filter(Boolean) : [],
+      dataMode,
+      dataModeSource,
+      branchName,
+      workspace,
+      baseUrl,
+      activeEnvelopeId: statusVerification.envelopeId
+    });
+    if (evidence.nondeterminism) {
+      console.log('Nondeterministic signal:', evidence.nondeterminism.message);
+      evidence.nondeterminism.flips.slice(0, 6).forEach((flip) => {
+        console.log('  - ' + flip.caseName + ': ' + (flip.previousPassed ? 'passed' : 'failed') + ' -> ' + (flip.currentPassed ? 'passed' : 'failed') +
+          ' (previous packet ' + (flip.previousPacketId || 'unknown') + ')');
+      });
+    }
+  }
+  if (status.status === 'failed' || status.status === 'interrupted' || (status.result && status.result.failed > 0)) {
     process.exitCode = 1;
   }
   return status;
@@ -8521,10 +9054,13 @@ async function testRunsCommand(flags) {
   const baseUrl = flags['base-url'] || session.baseUrl || DEFAULT_BASE_URL;
   const api = buildAxios(baseUrl, session.token);
   const testRef = flags.test || flags['test-id'] || flags.name;
+  const allDataLanes = flagEnabled(flags['all-lanes']) || flagEnabled(flags['all-data-lanes']);
   const data = await loggedPost(api, cwd, '/cli/testRuns', {
     token: session.token,
     accountId,
     asAccountId: flags['as-account'] || flags['as-account-id'],
+    dataMode: resolveDataMode(flags, session),
+    allDataLanes: allDataLanes || undefined,
     testId: testRef && /^\d+$/.test(String(testRef)) ? Number(testRef) : undefined,
     testName: testRef && !/^\d+$/.test(String(testRef)) ? String(testRef) : undefined,
     max: flags.limit || flags.max || 20
@@ -8532,9 +9068,17 @@ async function testRunsCommand(flags) {
   if (!data.success) throw new Error(data.message || 'Could not list test runs');
 
   if (flagEnabled(flags.compare)) {
-    const runs = data.runs || [];
-    if (runs.length < 2) throw new Error('--compare needs at least two recorded runs' + (testRef ? ' of ' + testRef : '') + '; found ' + runs.length);
-    return testCompareCommand(Object.assign({}, flags, { base: runs[1].taskId, head: runs[0].taskId }));
+    const pair = selectComparableRuns(data.runs || []);
+    if (!pair) {
+      throw new Error('--compare needs two COMPARABLE recorded runs' + (testRef ? ' of ' + testRef : '') +
+        ' — same data lane, branch, workspace and case count. Found ' + (data.runs || []).length +
+        ' run(s); pick two explicitly with: remits-cli test compare --base <taskId> --head <taskId>');
+    }
+    if (pair.skipped) {
+      console.error('Comparing the latest two comparable runs (' + describeRunShape(pair.head) + '); ' +
+        pair.skipped + ' newer run(s) differ in lane, branch, workspace or case count and were skipped.');
+    }
+    return testCompareCommand(Object.assign({}, flags, { base: pair.base.taskId, head: pair.head.taskId }));
   }
   if (flagEnabled(flags.json)) {
     console.log(JSON.stringify(data, null, 2));
@@ -8543,6 +9087,9 @@ async function testRunsCommand(flags) {
   printSessionResolutionWarning(sessionContext);
   printResolvedBaseUrl(baseUrl);
   console.log('Recorded test runs' + (testRef ? ' for ' + testRef : '') + ' (account ' + data.accountId + '), newest first:');
+  // Which lane this list is, said once. Pass counts from two lanes are two different facts.
+  console.log('Data lane: ' + (data.dataLaneScope || 'all-data-lanes') +
+    (data.otherLaneCount ? '   (' + data.otherLaneCount + ' more run(s) in the other lane; --all-lanes to include)' : ''));
   (data.runs || []).forEach((run) => {
     console.log('- ' + run.taskId + '  ' + (run.status || 'unknown') + '  ' + (run.passed || 0) + '/' + (run.total || 0) + ' passed' +
       '  ' + corpusAiLabel(run) +
@@ -8555,6 +9102,40 @@ async function testRunsCommand(flags) {
   return data;
 }
 
+/** The world fields that decide whether two runs are the same experiment repeated. */
+function runShapeKey(run = {}) {
+  return [run.dataMode || '?', run.branchName || '?', run.workspace || 'shared',
+    run.variantBranch || 'none', run.total == null ? '?' : run.total].join('|');
+}
+
+function describeRunShape(run = {}) {
+  return [(run.dataMode || '?') + ' lane', run.branchName || '?',
+    run.workspace ? 'ws:' + run.workspace : 'shared lane',
+    (run.total == null ? '?' : run.total) + ' case(s)'].join(' · ');
+}
+
+/**
+ * The newest two runs that are actually comparable, and how many newer ones were passed over.
+ *
+ * `--compare` used to take runs[0] and runs[1] unconditionally. On a real history that pairs a 92-case
+ * suite with a 1-case `--names` probe, or a prod-lane run with a test-lane one, and reports the difference
+ * as regressions. A comparison across worlds is not a comparison.
+ */
+function selectComparableRuns(runs) {
+  const list = Array.isArray(runs) ? runs.filter(Boolean) : [];
+  for (let head = 0; head < list.length; head += 1) {
+    const key = runShapeKey(list[head]);
+    for (let base = head + 1; base < list.length; base += 1) {
+      if (runShapeKey(list[base]) === key) {
+        // Every run passed over, including the ones BETWEEN head and base — a 1-case probe sitting between
+        // two full suites is exactly the run whose absence from the comparison needs saying.
+        return { head: list[head], base: list[base], skipped: base - 1 };
+      }
+    }
+  }
+  return null;
+}
+
 // `test compare --base <taskId> --head <taskId>`: per-case outcome, cost and duration deltas between two runs,
 // read from the durable records.
 async function testCompareCommand(flags) {
@@ -8585,6 +9166,18 @@ async function testCompareCommand(flags) {
     .filter((key) => comparison.baseWorld && comparison.headWorld && String(comparison.baseWorld[key] || '') !== String(comparison.headWorld[key] || ''))
     .map((key) => key + ' ' + short(String(comparison.baseWorld[key] || 'none')) + ' -> ' + short(String(comparison.headWorld[key] || 'none')));
   if (worldDiff.length) console.log('World changed: ' + worldDiff.join('; '));
+  // A lane or case-count difference is not a delta to interpret, it is two different experiments. Say so
+  // rather than letting "regressed (33)" stand for "these runs never measured the same thing".
+  const baseLane = comparison.baseWorld && comparison.baseWorld.dataMode;
+  const headLane = comparison.headWorld && comparison.headWorld.dataMode;
+  if (baseLane && headLane && baseLane !== headLane) {
+    console.log('NOT COMPARABLE: these runs are in different DATA LANES (' + baseLane + ' vs ' + headLane +
+      '). A record\'s dataMode is the lane it was written in; the pass counts below are two different facts.');
+  }
+  if (comparison.base.total && comparison.head.total && comparison.base.total !== comparison.head.total) {
+    console.log('NOT COMPARABLE like-for-like: ' + comparison.base.total + ' case(s) vs ' + comparison.head.total +
+      '. One of these is a narrowed --names run; "absent" below means the case did not run, not that it broke.');
+  }
   if (comparison.improved.length) console.log('Improved (' + comparison.improved.length + '): ' + comparison.improved.join(', '));
   if (comparison.regressed.length) console.log('Regressed (' + comparison.regressed.length + '): ' + comparison.regressed.join(', '));
   comparison.changed.filter((c) => c.direction === 'changed').forEach((c) => console.log('Changed: ' + c.name + ' ' + c.base + ' -> ' + c.head));
@@ -9565,10 +10158,16 @@ async function verifyCommand(flags, subcommand) {
     if (flags.manifest || flags.file) {
       manifest = parseManifestFile(flags.manifest || flags.file);
     }
-    if (dataMode === 'prod' && !manifestRequiredEvidence(manifest).length && !flagEnabled(flags['no-contract'])) {
+    // PROD only, and framed as risk rather than as an unmet obligation. An envelope with no contract is an
+    // evidence log, which is the normal and complete mode; warning about it on every lane taught agents that
+    // their own record-keeping was an exam they were failing, and they responded by starting it over.
+    if (dataMode === 'prod' && !manifestRequiredEvidence(manifest).length && !manifestClaims(manifest).length &&
+        !flagEnabled(flags['no-contract'])) {
       console.error('');
-      console.error('Warning: starting a prod-data verification envelope with no required evidence contract.');
-      console.error('Attach a manifest with requiredEvidence before destructive work, or pass --no-contract when this is intentionally evidence-only.');
+      console.error('Note: this envelope records PRODUCTION-data evidence with no acceptance contract.');
+      console.error('That is fine for investigation. Before destructive or irreversible production work, name what');
+      console.error('must be true so the result is checkable by someone else:');
+      console.error('  remits-cli verify claim <id> --text "what must be true" [--test "<suite>"]');
       console.error('');
     }
     let statusResponse = null;
@@ -9598,12 +10197,17 @@ async function verifyCommand(flags, subcommand) {
       ticketId: flags.ticket,
       account: collectVerificationAccount(cwd, accountId, baseUrl, dataMode),
       source,
-      manifest
+      manifest,
+      noContract: flagEnabled(flags['no-contract']) || undefined
     });
     const envelope = response.envelope;
     writeLocalVerificationEnvelope(cwd, envelope);
     writeActiveVerificationEnvelope(cwd, envelope.envelopeId, activeContext);
     console.log('Verification envelope started:', envelope.envelopeId);
+    if (!manifestRequiredEvidence(manifest).length && !manifestClaims(manifest).length) {
+      console.log('Mode: evidence log (no acceptance contract asked for). Commands attach world-stamped evidence;');
+      console.log('      nothing is outstanding. Add `verify claim <id> --text "..."` only if someone needs a verdict.');
+    }
     printLocalCommandContext(cwd, flags, { accountId, branchName, workspace, dataMode });
     printLocalStateWarnings(cwd, flags);
     console.log('Target:', checkoutWorldLine + ', dataMode=' + dataMode +
@@ -9683,6 +10287,40 @@ async function verifyCommand(flags, subcommand) {
     return envelope;
   }
 
+  if (sub === 'claim' || sub === 'claims') {
+    const claimId = flags.id || (flags._ && flags._[2]);
+    const text = flags.text || flags.claim || flags.summary || flags.note;
+    if (!claimId) {
+      throw new Error('Usage: remits-cli verify claim <id> --text "what must be true" [--test "<suite>"] [--packet-type <type>]');
+    }
+    const claim = { id: String(claimId) };
+    if (text) claim.text = String(text);
+    // A claim may name the shape of evidence that proves it, so one line of contract can bind to a suite
+    // instead of needing a second parallel requiredEvidence list kept in sync by hand.
+    const suite = flags.test || flags.suite;
+    if (suite) {
+      claim.packetType = 'test_run';
+      claim.suite = String(suite);
+      if (flags.case || flags.cases) {
+        claim.cases = [].concat(flags.case || []).concat(flags.cases || [])
+          .flatMap((value) => String(value).split(',')).map((value) => value.trim()).filter(Boolean);
+      }
+    } else if (flags['packet-type'] || flags.packetType) {
+      claim.packetType = String(flags['packet-type'] || flags.packetType);
+    }
+    const response = await postVerificationCommand(api, cwd, session, accountId, 'claim', { envelopeId, claim });
+    writeLocalVerificationEnvelope(cwd, response.envelope);
+    const acceptance = (response.envelope || {}).acceptance || {};
+    console.log('Claim recorded on envelope ' + envelopeId + ': ' + claim.id);
+    console.log('Contract now requires ' + (acceptance.requiredEvidence || []).length + ' item(s).');
+    console.log('Prove it by adding --claim ' + claim.id + ' to the command that demonstrates it, e.g.');
+    console.log('  remits-cli verify test --test "<suite>" --claim ' + claim.id);
+    console.log('  remits-cli verify attach --claim ' + claim.id + ' --note "what you observed"');
+    printAcceptanceWarnings(response.envelope);
+    printEnvelopeWarnings(response.envelope);
+    return response.envelope;
+  }
+
   if (sub === 'attach') {
     const artifacts = [];
     let type = 'manual_observation';
@@ -9719,7 +10357,7 @@ async function verifyCommand(flags, subcommand) {
       artifacts,
       evidenceCategories
     };
-    const response = await appendVerificationPacket(api, cwd, session, accountId, { 'verify-envelope': envelopeId }, packet);
+    const response = await appendVerificationPacket(api, cwd, session, accountId, Object.assign({}, flags, { 'verify-envelope': envelopeId }), packet);
     console.log('Evidence attached:', (response.packet || packet).packetId);
     return response;
   }
@@ -9730,7 +10368,9 @@ async function verifyCommand(flags, subcommand) {
     const packet = {
       type: sub === 'browser-start' ? 'browser_session' : (sub === 'browser-snapshot' ? 'browser_snapshot' : 'browser_step'),
       success: !flagEnabled(flags.failed),
-      claim: flags.claim || flags.label || action,
+      // `--claim` now names a declared acceptance claim id, so the free-text label for a browser step is
+      // `--label`. Reading both from one flag made the id double as prose and the prose double as an id.
+      claim: flags.label || flags.text || action,
       world: buildCommandWorld(null, { accountId, dataMode, branchName, workspace, host: normalizeBaseUrl(baseUrl) }),
       browser: {
         action,
@@ -9743,7 +10383,7 @@ async function verifyCommand(flags, subcommand) {
       evidenceCategories: [sub, action === 'upload' ? 'browser_session.actual_upload' : null, action === 'click' ? 'browser_session.actual_clicks' : null]
         .filter(Boolean)
     };
-    const response = await appendVerificationPacket(api, cwd, session, accountId, { 'verify-envelope': envelopeId }, packet);
+    const response = await appendVerificationPacket(api, cwd, session, accountId, Object.assign({}, flags, { 'verify-envelope': envelopeId }), packet);
     console.log('Browser evidence attached:', (response.packet || packet).packetId);
     return response;
   }
@@ -10701,6 +11341,7 @@ function buildRepoSnapshot(entry) {
   const repoFiles = [
     { label: 'account-info.json', path: entry.accountInfoPath || path.join(directory, 'account-info.json'), mode: 'json' },
     { label: 'account-hierarchy.json', path: path.join(directory, 'account-hierarchy.json'), mode: 'json' },
+    { label: 'account-analytics.json', path: path.join(directory, 'account-analytics.json'), mode: 'json' },
     { label: '.remits-cli/active-actor/current-session.txt', path: localPaths.currentSessionFile, mode: 'text' },
     { label: '.remits-cli/shared/tools/tools.json', path: path.join(localPaths.toolsDir, 'tools.json'), mode: 'json' },
     { label: '.remits-cli/active-actor/session log (tail)', path: currentSessionLog, mode: 'tail' },
@@ -14708,23 +15349,57 @@ function slimActivitySmell(smell) {
     testName: s.testName || null,
     branchName: s.branchName || null,
     workspace: s.workspace || null,
+    packetCount: s.packetCount == null ? null : s.packetCount,
+    requiredCount: s.requiredCount == null ? null : s.requiredCount,
+    openCount: s.openCount == null ? null : s.openCount,
+    command: s.command || null,
     updatedAt: formatTime(s.updatedAtMs || s.updatedAt || s.at || s.createdAt)
   };
 }
 
+/**
+ * The next COMMAND, not the smell restated. This list previously mapped each signal to its own summary
+ * sentence, so "Next actions" contained no action; and it filtered on severity <= 2, which permanently
+ * excluded `no_required_evidence` - the one signal that explains why an envelope never closes.
+ * A signal that knows its own fix is actionable at any severity.
+ */
+function buildActivityNextActions(smells) {
+  const seen = new Set();
+  return (smells || [])
+    .filter((smell) => smell && (smell.command || smellSeverityRank(smell) <= 2))
+    .sort((left, right) => {
+      const command = (right.command ? 1 : 0) - (left.command ? 1 : 0);
+      if (command) return command;
+      return smellSeverityRank(left) - smellSeverityRank(right);
+    })
+    .map((smell) => {
+      const title = smell.title || smell.envelopeSummary || smell.testName ||
+        (Array.isArray(smell.workspaces) ? smell.workspaces.join(', ') : null);
+      return {
+        type: smell.type || 'signal',
+        severity: smell.severity || 'info',
+        why: (title ? title + ' — ' : '') + (smell.summary || 'inspect this signal'),
+        command: smell.command || null
+      };
+    })
+    .filter((action) => {
+      // Dedupe on the COMMAND when there is one: two different signals about one envelope that resolve to
+      // the same next move are one next move.
+      const key = action.command ? 'cmd|' + action.command : action.type + '|' + action.why;
+      if (seen.has(key)) return false;
+      seen.add(key);
+      return true;
+    })
+    .slice(0, 6);
+}
+
 function compactActivityInspect(response) {
   const counts = response.counts || {};
   const smells = sortedActivitySmells(response.smells);
   const lanes = Array.isArray(response.lanes) ? response.lanes : [];
   const envelopes = Array.isArray(response.envelopes) ? response.envelopes : [];
   const testRuns = Array.isArray(response.testRuns) ? response.testRuns : [];
-  const nextActions = smells
-    .filter((smell) => smellSeverityRank(smell) <= 2)
-    .slice(0, 5)
-    .map((smell) => {
-      const title = smell.title || smell.envelopeSummary || smell.testName;
-      return (smell.type || 'signal') + (title ? ' (' + title + ')' : '') + ': ' + (smell.summary || 'inspect this signal');
-    });
+  const nextActions = buildActivityNextActions(smells);
 
   return {
     success: response.success,
@@ -14809,7 +15484,14 @@ function printActivityInspectSummary(response) {
     (counts.lanes || 0) + ' lane(s), ' +
     (counts.verificationEnvelopes || 0) + ' envelope(s), ' +
     (counts.testRuns || 0) + ' test run(s), ' +
-    (counts.corpusResults || 0) + ' corpus result(s)');
+    (counts.corpusResults || 0) + ' corpus result(s)' +
+    (counts.distinctStagedEntries != null && counts.distinctStagedEntries !== counts.stagedEntries
+      ? ', ' + counts.stagedEntries + ' staged entries across lanes (' + counts.distinctStagedEntries + ' distinct)'
+      : (counts.stagedEntries ? ', ' + counts.stagedEntries + ' staged entries' : '')));
+  if (response.envelopeScope === 'all-data-lanes') {
+    console.log('Note: test runs and corpus results are narrowed to the ' + response.dataMode +
+      ' lane; envelopes are listed across BOTH lanes (stage/sync evidence is lane-independent).');
+  }
 
   const smells = sortedActivitySmells(response.smells);
   console.log('');
@@ -14819,6 +15501,18 @@ function printActivityInspectSummary(response) {
     console.log('Top smells (' + smells.length + '):');
     smells.slice(0, 20).forEach((smell) => {
       console.log('  [' + (smell.severity || 'info') + '] ' + (smell.type || 'signal') + ': ' + smell.summary);
+      // The numbers were in the JSON and not on the line, so twenty signals read as three sentences repeated.
+      const facts = [
+        smell.packetCount != null ? smell.packetCount + ' packet(s)' : null,
+        smell.currentFailureCount != null ? smell.currentFailureCount + ' current failure(s)' : null,
+        smell.requiredCount != null ? smell.requiredCount + ' requirement(s)' : null,
+        smell.openCount != null ? smell.openCount + ' open' : null,
+        smell.recentRuns != null ? smell.recentRuns + ' recent run(s)' : null,
+        smell.failedRuns != null ? smell.failedRuns + ' failed' : null,
+        smell.stagedCount != null ? smell.stagedCount + ' staged' : null,
+        Array.isArray(smell.workspaces) ? smell.workspaces.join(', ') : null
+      ].filter(Boolean);
+      if (facts.length) console.log('       ' + facts.join(' · '));
       const pivots = [
         smell.accountId ? 'account ' + smell.accountId : null,
         smell.laneId ? 'lane ' + smell.laneId : null,
@@ -14831,12 +15525,15 @@ function printActivityInspectSummary(response) {
       if (pivots.length) console.log('       ' + pivots.join(' · '));
     });
     if (smells.length > 20) console.log('  ...' + (smells.length - 20) + ' more; rerun with --json');
-    const actions = compactActivityInspect(response).nextActions;
-    if (actions.length) {
-      console.log('');
-      console.log('Next actions:');
-      actions.forEach((action) => console.log('  - ' + action));
-    }
+  }
+  const actions = buildActivityNextActions(smells);
+  if (actions.length) {
+    console.log('');
+    console.log('Next actions:');
+    actions.forEach((action) => {
+      console.log('  - ' + action.why);
+      if (action.command) console.log('      ' + action.command);
+    });
   }
 
   // "2 agent(s)" with no names is the shape of the question, not the answer: an agent asking who else is in
@@ -14882,9 +15579,20 @@ function printActivityInspectSummary(response) {
     console.log('');
     console.log('Recent verification envelopes:');
     envelopes.slice(0, 8).forEach((env) => {
+      const world = [env.branchName || null, env.workspace ? 'ws:' + env.workspace : null, env.dataMode || null]
+        .filter(Boolean).join('/');
       console.log('  - ' + (env.status || 'unknown') + ' · ' + (env.packetCount || 0) + ' packet(s) · ' +
+        (world ? '[' + world + '] · ' : '') +
         (env.summary || env.envelopeId) + ' · ' + formatTime(env.updatedAtMs || env.lastPacketAtMs || env.createdAt));
-      if (env.currentFailureCount) console.log('      current failures: ' + env.currentFailureCount);
+      if (env.noRequiredEvidence) {
+        console.log('      evidence log — no verdict requested; add a claim only if someone needs one: remits-cli verify claim <id> --text "..." --envelope ' + env.envelopeId);
+      }
+      // A failure recorded in an envelope that promised nothing is HISTORY, not an outstanding task — the
+      // same rule the smells already apply (`promises` in activitySmells). Printing it as "current failures"
+      // re-created, one line lower, exactly the unfinishable-looking work the evidence/verdict split removed.
+      if (env.currentFailureCount) {
+        console.log('      ' + (env.noRequiredEvidence ? 'failed evidence recorded: ' : 'current failures: ') + env.currentFailureCount);
+      }
     });
   }
 
@@ -14946,6 +15654,62 @@ function listWorkstreamIndexes(cwd) {
     .sort((a, b) => String(b.updatedAt || '').localeCompare(String(a.updatedAt || '')));
 }
 
+async function evidenceCommand(flags) {
+  const cwd = process.cwd();
+  ensureLocalState(cwd);
+  const limit = Math.max(1, Math.min(parseInt(flags.limit || flags.max || '40', 10) || 40, 500));
+  const entries = readEvidenceTrail(cwd, limit);
+  if (flagEnabled(flags.json)) {
+    console.log(JSON.stringify({ success: true, actor: resolveLocalActor().id, count: entries.length, entries }, null, 2));
+    return entries;
+  }
+  const paths = localStatePaths(cwd);
+  console.log('Evidence trail for actor ' + paths.actor.id + '  (' + paths.evidenceFile + ')');
+  if (!entries.length) {
+    console.log('Nothing recorded yet. Every stage, test, token, tool and sync appends one world-stamped line here,');
+    console.log('with no envelope and nothing to start.');
+    return entries;
+  }
+  // Grouped by WORLD, because "what have I proven" is only answerable per world. An agent that ran the same
+  // suite in two lanes has two different facts, and a flat list hides exactly that.
+  const groups = new Map();
+  entries.forEach((entry) => {
+    const key = describeEvidenceWorld(entry.world);
+    if (!groups.has(key)) groups.set(key, []);
+    groups.get(key).push(entry);
+  });
+  groups.forEach((rows, world) => {
+    console.log('');
+    console.log(world);
+    const byClaim = new Map();
+    rows.forEach((row) => {
+      const key = (row.type || 'unknown') + '|' + (row.claim || row.type || 'evidence') + '|' + evidenceOutcome(row);
+      if (!byClaim.has(key)) byClaim.set(key, { row, count: 0 });
+      const bucket = byClaim.get(key);
+      bucket.count += 1;
+      bucket.row = row;
+    });
+    Array.from(byClaim.values())
+      .sort((left, right) => right.count - left.count)
+      .slice(0, 15)
+      .forEach((bucket) => {
+        const row = bucket.row;
+        const layer = row.world && row.world.sourceLayer ? '  source ' + row.world.sourceLayer : '';
+        console.log('  ' + (bucket.count > 1 ? bucket.count + ' x ' : '') +
+          evidenceOutcomeLabel(row) + (row.type || 'unknown') + ': ' + (row.claim || '(no claim)') +
+          '   ' + formatTime(row.ts) + layer +
+          (Array.isArray(row.claims) && row.claims.length ? '  [claims ' + row.claims.join(', ') + ']' : '') +
+          (row.envelopeId ? '  [envelope ' + row.envelopeId.slice(0, 8) + ']' : ''));
+      });
+    if (byClaim.size > 15) console.log('  ...' + (byClaim.size - 15) + ' more distinct entries; --json for all');
+  });
+  console.log('');
+  console.log(entries.length + ' entry(s) shown. This is a log, not a verdict: nothing here is outstanding.');
+  console.log('If someone needs a checkable verdict, start an envelope and name what must be true:');
+  console.log('  remits-cli verify start --summary "..." && remits-cli verify claim <id> --text "..."');
+  return entries;
+}
+
 async function workstreamCommand(flags, subcommand) {
   const cwd = process.cwd();
   ensureLocalState(cwd);
@@ -15653,10 +16417,18 @@ function releaseAutoUpdateLock() {
   } catch (_) {}
 }
 
+/**
+ * May this invocation check for, and install, a newer CLI?
+ *
+ * `--json` used to disable it outright, to keep update chatter out of a document a program is parsing.
+ * The effect was that the callers who pass `--json` on every command - which is every AI agent - never
+ * upgraded at all, so each release of better diagnostics reached the population that needed it least.
+ * The chatter now goes to stderr (see `autoUpdateIfNeeded`), which is where a program's stdout contract
+ * says it belongs, and the check stays on.
+ */
 function shouldAutoUpdate(command, flags) {
   if (!command || command === 'help' || command === '--help') return false;
   if (flags && flags['no-auto-update']) return false;
-  if (flags && flagEnabled(flags.json)) return false;
   if (process.env.REMITS_CLI_AUTO_UPDATE && AUTO_UPDATE_DISABLED_VALUES.has(String(process.env.REMITS_CLI_AUTO_UPDATE).toLowerCase())) {
     return false;
   }
@@ -15664,10 +16436,31 @@ function shouldAutoUpdate(command, flags) {
   return true;
 }
 
+/** True when the last registry check is recent enough that another one would only cost latency. */
+function autoUpdateCheckedRecently() {
+  try {
+    const stamp = JSON.parse(fs.readFileSync(AUTO_UPDATE_STAMP_FILE, 'utf8'));
+    return Number(stamp.checkedAtMs) > Date.now() - AUTO_UPDATE_CHECK_INTERVAL_MS;
+  } catch (_) {
+    return false;
+  }
+}
+
+function recordAutoUpdateCheck(latest) {
+  try {
+    ensureSessionDir();
+    fs.writeFileSync(AUTO_UPDATE_STAMP_FILE,
+      JSON.stringify({ checkedAtMs: Date.now(), latest: latest || null }, null, 2));
+  } catch (_) {}
+}
+
 function autoUpdateIfNeeded(originalArgv, options = {}) {
   const requireSuccess = Boolean(options.requireSuccess);
+  // Update chatter is diagnostics, never part of a `--json` document. stderr keeps both promises at once.
+  const note = (line) => console.error(line);
   let lockAcquired = false;
   try {
+    if (!requireSuccess && autoUpdateCheckedRecently()) return false;
     lockAcquired = acquireAutoUpdateLock();
     if (!lockAcquired) {
       if (requireSuccess) {
@@ -15681,20 +16474,22 @@ function autoUpdateIfNeeded(originalArgv, options = {}) {
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'ignore']
     }).trim();
+    recordAutoUpdateCheck(latest);
     if (latest && compareSemver(latest, currentVersion) > 0) {
-      console.log('[update] New version available: ' + currentVersion + ' -> ' + latest + '. Installing...');
+      note('[update] New version available: ' + currentVersion + ' -> ' + latest + '. Installing...');
+      // npm's own progress output goes to stderr too: a `--json` caller's stdout must stay one document.
       const install = spawnSync(npmCommand(), ['install', '-g', REMITS_CLI_PACKAGE_NAME + '@latest'], {
-        stdio: 'inherit',
+        stdio: ['ignore', process.stderr, process.stderr],
         env: process.env
       });
       if (install.error || install.status !== 0) {
         if (requireSuccess) {
           throw new Error('Auto-update failed; remits-cli start requires the latest published version before continuing.');
         }
-        console.log('[update] Update failed; continuing with version ' + currentVersion + '.');
+        note('[update] Update failed; continuing with version ' + currentVersion + '.');
         return false;
       }
-      console.log('[update] Updated to ' + latest + '. Re-running command...');
+      note('[update] Updated to ' + latest + '. Re-running command...');
       const rerun = spawnSync(remitsCliCommand(), originalArgv, {
         stdio: 'inherit',
         env: Object.assign({}, process.env, { REMITS_CLI_AUTO_UPDATED: '1' })
@@ -15703,7 +16498,7 @@ function autoUpdateIfNeeded(originalArgv, options = {}) {
         if (requireSuccess) {
           throw new Error('Auto-update succeeded but re-running the updated remits-cli command failed.');
         }
-        console.log('[update] Re-run failed; continuing with version ' + currentVersion + '.');
+        note('[update] Re-run failed; continuing with version ' + currentVersion + '.');
         return false;
       }
       process.exitCode = rerun.status === null ? 1 : rerun.status;
@@ -15862,13 +16657,14 @@ function printComponentsHelp(subcommand) {
   console.log('  remits-cli components branch <name> [--json]                       # overridden/added/removed + drift');
   console.log('  remits-cli components branch <name> --diff <componentId> --component-type <kind> [--json]');
   console.log('  remits-cli components branch <name> --subscribers [--json]');
+  console.log('  remits-cli components branch <name> --copy-to <newBranch> [--dry-run] [--force] [--json]');
   console.log('  remits-cli components branch <name> --subscribe <accountId> [--parent-account <id>] [--domain <host>] [--dry-run] [--confirm-primary-edge]');
   console.log('  remits-cli components branch <name> --unsubscribe <accountId>');
   console.log('  remits-cli components branch <name> --retire [--force]');
 }
 
 function printTestHelp() {
-  console.log('Usage: remits-cli test run --test <id|name> [--base-url URL] [--branch stagingScope] [--names "a|b"] [--watch true|false] [--data-mode test|prod] [--as-account ID] [--variant-branch NAME|none] [--json]');
+  console.log('Usage: remits-cli test run --test <id|name> [--base-url URL] [--branch stagingScope] [--names "a|b"] [--watch true|false] [--wait true|false] [--data-mode test|prod] [--as-account ID] [--variant-branch NAME|none] [--json]');
   console.log('       remits-cli test status --task-id <taskId> [--base-url URL] [--account-id ID] [--branch stagingScope] [--data-mode test|prod] [--json]');
   console.log('       remits-cli test runs [--test <id|name>] [--limit 20] [--compare] [--json]   # durable run history');
   console.log('       remits-cli test compare --base <taskId> --head <taskId> [--json]            # per-case outcome/cost deltas');
@@ -15887,6 +16683,8 @@ function printTestHelp() {
   console.log('       to force production/subscription semantics from a variant checkout.');
   console.log('  --branch changes only the CLI staging namespace for test execution. Pair an unused');
   console.log('       value with --variant-branch none when existing staged entries would shadow DB rows.');
+  console.log('  --watch false disables websocket progress streaming; the CLI still waits for final status.');
+  console.log('  --wait false returns after launch with a task id; test status attaches terminal evidence.');
   console.log('  --json prints only the final status JSON to stdout; banners and progress go to stderr.');
   console.log('  --data-mode prod intentionally targets live production data.');
   console.log('  Every finished run is recorded durably: test status keeps working after the live status');
@@ -16021,6 +16819,9 @@ function printVerifyHelp() {
   console.log('  remits-cli verify use <envelopeId>');
   console.log('  remits-cli verify current');
   console.log('  remits-cli verify clear [--all]');
+  console.log('  remits-cli verify claim <id> --text "what must be true" [--test "<suite>"] [--packet-type TYPE]');
+  console.log('      # declares a contract in ONE command when someone needs a verdict; no-contract envelopes are evidence logs');
+  console.log('      # prove it by adding --claim <id> to any verify test/token/tool/stage/attach command');
   console.log('  remits-cli verify show [--envelope ID] [--summary|--compact] [--json]');
   console.log('  remits-cli verify status [--envelope ID]');
   console.log('  remits-cli verify report [--envelope ID]');
@@ -16142,8 +16943,9 @@ async function main() {
     console.log('  remits-cli tool --name <toolName> [--base-url URL] [--account-id ID] [--as-account ID] [--target-account ID] [--branch BRANCH] [--input \"{...}\"|--input-file file.json] [--data-mode test|prod] [--scope self|children|hierarchy] [--account-ids 1,2,3] [--variant-branch NAME|none] [--timeout-ms 60000] [--async true --wait true]');
     console.log('  remits-cli tool status --call-id <callId> [--base-url URL] [--account-id ID] [--data-mode test|prod]');
     console.log('  remits-cli workspace [show|use <name>|use --auto|clear]        # isolate staging when several agents share a repo');
-    console.log('  remits-cli verify start --summary "..." [--manifest file.json]  # start a verification envelope');
-    console.log('  remits-cli verify [current|list|use|clear|show|status|report|attach|abandon|supersede|test|token|stage|sync|tool]');
+    console.log('  remits-cli evidence [--limit N] [--json]   # what you have run and in which world (always recorded)');
+  console.log('  remits-cli verify start --summary "..." [--manifest file.json]  # OPTIONAL: ask for a checkable verdict');
+    console.log('  remits-cli verify [current|list|use|clear|show|status|report|claim|attach|abandon|supersede|test|token|stage|sync|tool]');
     console.log('  remits-cli components stage [--workset|--changed-only] [--base-url URL] [--account-id ID] [--branch BRANCH] [--workspace NAME] [--data-mode test|prod] [--json|--verbose]');
     console.log('  remits-cli components status [--base-url URL] [--account-id ID] [--branch BRANCH] [--workspace NAME] [--component-type TYPE --component-id ID] [--json|--verbose]');
     console.log('  remits-cli components lanes [--base-url URL] [--account-id ID] [--json]');
@@ -16154,10 +16956,11 @@ async function main() {
     console.log('  remits-cli components promotion [<branch>] [--json] [--no-fail]  # promotion readiness + ordered next steps');
     console.log('  remits-cli components branches [--json]                     # committed branch variants for this account');
     console.log('  remits-cli components branch <name> [--diff <componentId> --component-type <kind>] [--subscribers] [--json]');
+    console.log('  remits-cli components branch <name> --copy-to <newBranch> [--dry-run] [--force] [--json]');
     console.log('  remits-cli components branch <name> --subscribe <accountId> [--dry-run] [--confirm-primary-edge]');
     console.log('  remits-cli components branch <name> --unsubscribe <accountId>    # return that account to trunk');
     console.log('  remits-cli components branch <name> --retire [--force]           # delete the branch\'s overlays');
-    console.log('  remits-cli test run --test <id|name> [--base-url URL] [--branch stagingScope] [--names "a|b"] [--watch true|false] [--data-mode test|prod] [--as-account ID] [--variant-branch NAME|none] [--json]');
+    console.log('  remits-cli test run --test <id|name> [--base-url URL] [--branch stagingScope] [--names "a|b"] [--watch true|false] [--wait true|false] [--data-mode test|prod] [--as-account ID] [--variant-branch NAME|none] [--json]');
     console.log('  remits-cli test runs [--test <id|name>] [--compare]                 # durable run history; compare latest two');
     console.log('  remits-cli test compare --base <taskId> --head <taskId>');
     console.log('  remits-cli corpus import --manifest corpus-manifest.json             # seed a test corpus: cases + artifacts');
@@ -16383,6 +17186,22 @@ async function main() {
     throw new Error('Unknown activity subcommand: ' + subcommand);
   }
 
+  if (command === 'evidence') {
+    if (wantsHelp) {
+      console.log('Usage: remits-cli evidence [--limit N] [--json]');
+      console.log('');
+      console.log('What you have actually run, and in which world. Every stage, test, token, tool and sync');
+      console.log('appends one world-stamped line automatically - there is nothing to start and nothing to');
+      console.log('satisfy. Grouped by world, because the same suite run in two lanes is two different facts.');
+      console.log('');
+      console.log('This is per-actor, so agents sharing a checkout never read each other\'s trail.');
+      console.log('Use `remits-cli verify` only when someone needs a checkable VERDICT on top of this.');
+      return;
+    }
+    await evidenceCommand(args);
+    return;
+  }
+
   if (command === 'workstream') {
     if (wantsHelp) {
       console.log('Usage: remits-cli workstream status [--workstream ID|--workspace NAME] [--json]');