@@ -166,6 +166,38 @@ when the check could not be made at all — no workspace to check against, or an
 endpoint that did not answer. The split matters in CI: only `1` is fixed by
 logging in again.
 
+## Choosing an integration credential
+
+Your Sim login controls which workspaces and operations you can access. A tool's
+selected provider credential controls its external identity and grants. A workflow
+and a direct tool call can use different provider credentials under the same Sim login.
+
+Discover the exact tool ID and its parameter schema, then inspect the connection
+you intend to use:
+
+```bash
+sim tools list --search slack
+sim tools get slack_message
+sim credentials list --provider-id slack
+sim --output json credentials get "$CREDENTIAL_ID"
+```
+
+Use the returned tool ID and argument names. For standalone OAuth execution, pass
+`--credential-id "$CREDENTIAL_ID"` to `sim tools execute`. HTTP and MCP callers
+supply the top-level `credentialId` field, outside `input`.
+
+`credentials get` reports the credential type/provider, stored identity metadata,
+and recorded scopes with their source. `diagnostics.identity.verifiedLive: false`
+means it has not contacted the provider or verified token validity or resource access.
+Display names are labels. A scopes source of `unknown` with an empty `values` array
+means the grants are unknown, not that no scopes were granted. Custom bots may have
+no separately stored identity metadata; inspection leaves it unknown without
+reading secret payloads.
+
+See [Slack credentials](/integrations/slack#standalone-tool-credentials) for
+OAuth versus bot-token selection and conversation-access limits. The
+[credentials command reference](/cli/credentials) lists connection-management commands.
+
 ## Signing out
 
 ```bash
 
@@ -12,8 +12,7 @@ move files, search knowledge bases, and read run logs from the terminal. Use
 pipelines. See [Output formats](/cli/output) for commands that emit raw content
 or local configuration.
 
-For safe edits, compact run diagnostics, and partial retries, see
-[Workflow operations](/cli/workflow-operations).
+For workflow editing and retry recipes, see [Scripting](/cli/scripting).
 
 ## Install
 
 
@@ -9,7 +9,6 @@
     "output",
     "scripting",
     "workflow-sync",
-    "workflow-operations",
     "troubleshooting",
     "usage-data",
     "---Commands---",
 
@@ -59,13 +59,66 @@ with span inputs, outputs, errors, timing, and cost:
 sim logs get 9c4f0b7e-2d81-4a35-b6e9-70f1c8a2d543 --trace
 ```
 
-`json` and `yaml` always carry the complete response, so `--trace` is a no-op
-there:
+By default, `json` and `yaml` carry the complete response, so `--trace` does not
+change their output:
 
 ```bash
 sim logs get 9c4f0b7e-2d81-4a35-b6e9-70f1c8a2d543 --output json | jq '.traceSpans'
 ```
 
+### Compact run summaries
+
+Use `--summary` to inspect a run without printing its full trace and workflow
+snapshot:
+
+```bash
+sim --output json logs get "$RUN_ID" --summary
+```
+
+The summary includes execution status, the workflow's existing `finalOutput`,
+recorded failures (including handled errors), compact failing inputs and outputs,
+observed block statuses, and file metadata. It bounds trace traversal and field
+sizes, reports `truncated` when detail is omitted, and omits binary fields and data
+URLs. Use `--trace` or [output selectors](/cli/scripting#selecting-workflow-output)
+when you need more detail.
+
+`--summary` asks the server to omit the saved workflow snapshot, then formats the
+remaining authorized log response locally; it still loads the trace. To omit
+only the snapshot, use `--no-include-workflow-state`. HTTP and hosted MCP callers
+can set `includeWorkflowState=false` on the log read.
+
+Execution status describes the run, not the quality of its output or whether an
+external delivery succeeded. Inspect `finalOutput` and recorded tool failures
+before treating a completed run as a successful result. Expired trace data can
+leave no block-level evidence. Find failures that a workflow recovered from with
+`sim logs list --level error --include-handled-errors`.
+
+The log's `cost` includes a reconciled total and itemized `fixed`, `model`, and
+`tool` charges when a ledger is available.
+
+## Downloading output files
+
+Tools that store files return descriptors containing file IDs and metadata,
+rather than inline base64. Download a personal output from a direct tool call
+(`context: copilot`) with:
+
+```bash
+sim tools files download "$FILE_ID" -o ./attachment.pdf
+```
+
+For a workflow output, use the workflow and run that produced it:
+
+```bash
+sim workflows runs files download "$WORKFLOW_ID" "$RUN_ID" "$FILE_ID" -o ./attachment.pdf
+```
+
+These commands authenticate with the configured Sim credential and stream to
+disk. Direct personal outputs require their original human owner and current
+workspace access; workflow outputs use the run's access checks. A descriptor's
+URL or storage key alone grants no access. Output files can expire; copy durable
+artifacts into workspace files. See the [tool file](/cli/tools#download-a-direct-tool-output-owned-by-the-current-user)
+and [run file](/cli/workflows#download-a-workflow-run-output-file) command references.
+
 ## Exceptions
 
 `sim configure` prints local configuration for humans. `sim profiles` honors `--output`.
 
@@ -222,6 +222,64 @@ case $? in
 esac
 ```
 
+## Inspecting and editing workflows
+
+Find the workflow in its workspace before reading its draft:
+
+```bash
+sim workspaces list --output json
+sim workflows list --workspace "$workspace_id" --search "Daily report" \
+  --folder Reports --deployed-only --output json
+```
+
+`--search` matches names; `--folder` and `--deployed-only` narrow the results.
+These lists [follow pages automatically](#pagination). There is no account-wide
+workflow-content search: use metadata to narrow candidates, then inspect them.
+
+Start with a compact diagnostic view, then fetch editable state when you need to
+change the saved workflow:
+
+```bash
+sim workflows inspect "$workflow_id" --output json
+sim workflows inspect "$workflow_id" --block-id "$block_id" --include-code --output json
+sim workflows state get "$workflow_id" --output json > state.json
+```
+
+Inspection includes block IDs, names, enabled states, parents, connections, and
+bounded inputs. It omits code by default and withholds credential fields and
+opaque credential values; check `omittedInputs` and `truncated` for missing detail.
+Redaction cannot recognize every secret embedded in arbitrary text or code.
+The diagnostic view is not a format to save back.
+
+A tool ID from `tools get` selects a standalone operation. A block type and its
+operation from `blocks get` define workflow behavior; a block ID identifies one
+instance in the saved workflow. These IDs are not interchangeable. Preserve the
+saved block type/version when editing; an unversioned catalog name can resolve
+to a newer definition with different fields.
+
+For in-place edits, preserve the IDs and credential/table references from
+`state get`, then validate with `state replace --dry-run` before saving.
+`workflows export` is a sanitized portable format with credential bindings cleared;
+use it for [import and sync](/cli/workflow-sync), not to replace editable state.
+Review validation coverage, skipped checks, warnings, and `removedBindings`.
+Static validation cannot prove provider access, model behavior, or runtime success.
+
+For a small change, use the existing operations command. An enablement-only batch
+needs no graph edit:
+
+```bash
+sim workflows operations apply "$workflow_id" --dry-run --atomic \
+  --set-block-enabled "[{\"block_id\":\"$block_id\",\"enabled\":false}]"
+```
+
+Inspect `applied`, `skipped`, and `inputValidationErrors` before committing with
+`--yes` in place of `--dry-run`. `--atomic` prevents the batch from saving if an
+edit is declined or an input would be dropped. When adding blocks, dry-run
+`previewBlockIds` are provisional and `mintedBlockIds` is empty; use the IDs from
+the committed response. Read the saved state before deploying. Validation executes
+no blocks; it is not a mode that suppresses external writes during a later run.
+See the [workflow command reference](/cli/workflows) for full edit and validation flags.
+
 ## Selecting workflow output
 
 `--select-output` returns the named values in `blockOutputs` on a sync run, or
@@ -242,9 +300,22 @@ sim workflows runs get "$run_id" --workflow 3a9e21d8-5f47-4c0b-b2ea-91d7c6034ef8
   --select-output 1d4c8f02-7b63-4a19-8e52-63f0a7c5d9b1.content --output json
 ```
 
+To inspect an intermediate result, combine a selector with `--stop-after`:
+
+```bash
+sim workflows run "$workflow_id" --stop-after "$block_id" \
+  --select-output "$block_id.result" --output json
+```
+
+This executes real actions and stops scheduling after the target finishes.
+Already-running parallel branches can still act; a condition that skips the
+target can let the remaining path complete. It does not edit the saved graph or
+suppress external writes. It cannot be used with `--async`, and a later explicit
+resume of a paused run does not inherit the limit.
+
 ## Polling a long run
 
-Start the run asynchronously, then use the CLI’s wait command:
+Start a deployed run asynchronously, then use the CLI’s wait command:
 
 ```bash
 run_id=$(sim workflows run 3a9e21d8-5f47-4c0b-b2ea-91d7c6034ef8 --async --output json | jq -r '.runId')
@@ -258,6 +329,55 @@ outcome; `--wait-timeout 0` waits indefinitely.
 Use `sim logs get "$run_id" --trace` for full diagnostics. A run paused for human
 input includes the context ID needed by `sim workflows runs resume`.
 
+Ordinary runs use the active deployment; `--manual`, `--trigger`, and `--from-block`
+use the current saved draft. Deployed runs support synchronous execution,
+`--follow`, or `--async`. Manual runs support synchronous execution or `--follow`;
+`--async` cannot be combined with manual execution or `--follow`.
+
+The CLI prints a run ID to stderr before sending a manual request. Use it with
+`workflows runs get` or `workflows runs wait` in another terminal. A status record
+appears only after server admission, so a rejected request may never have one.
+The ID is a one-shot identifier, not a replayable idempotency key. After an
+uncertain network failure, inspect that ID before starting another execution;
+a fresh ID can repeat external actions.
+
+Deployed runs retain the default API-compatible trigger priority. A deployment
+with one other runnable trigger can also run directly. If no API-compatible
+entry exists and multiple triggers remain, select the deployed entry through the
+API's `run.entry`; the CLI's `--trigger` instead selects an entry in the draft.
+See the [run command reference](/cli/workflows#run-a-deployed-workflow-or-execute-saved-state-manually)
+for all execution flags.
+
+## Previewing a partial retry
+
+Preview a retry using the source run's persisted upstream outputs before repeating
+external actions:
+
+```bash
+sim workflows runs preview "$workflow_id" \
+  --from-block "$block_id" --source-run "$source_run_id" --output json
+```
+
+Review `validation`, `rerunBlocks`, and `upstreamBlocks`. Preview reports cached-output
+availability without returning values, executing blocks, or reserving a run ID.
+Its rerun blocks are candidates, not an execution order: conditions, disabled
+blocks, loops, and failures still affect the path. Preview does not lock the draft;
+the subsequent manual run uses the draft saved at that time.
+
+After reviewing the preview, start the retry and use its printed run ID to
+[track it](#polling-a-long-run):
+
+```bash
+sim workflows run "$workflow_id" \
+  --from-block "$block_id" --source-run "$source_run_id" --follow
+```
+
+An error connection is an alternative path: a consumer reached through an error
+bypass may lack the successful path's parser output. Keep required data on the
+path that produces it or handle its absence. A disabled block stops its branch;
+it is not a pass-through mock. Replay can reuse recorded ancestor outputs from
+the selected source run, but cannot supply outputs that run never produced.
+
 ## Working with folders
 
 Every folder-backed resource — `workflows`, `tables`, `files`, `knowledge` —