diff --git a/AGENTS.md b/AGENTS.md
index 58fcaa3..73a3d0e 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -33,6 +33,7 @@ npm run dev:cli -- memory reviewer-context
 ```
 
 The wrapper runs gsync with `HOME=./.dev/home`.
+Do not use plain `gsync ...` for local verification in this repo unless you intentionally want to hit your real global `~/.gsync` config and hosted backend.
 
 ## Smoke test the local setup
 
@@ -68,4 +69,6 @@ For local onboarding work, prefer `npm run dev:creds` after `npm run dev:up` so
 
 - Keep all sandbox work inside `./.dev/`.
 - Do not use the repo’s real `~/.gsync` data when testing local changes.
+- For repo-local emulator work, always use `npm run dev:cli -- ...` so commands run with `HOME=./.dev/home` and `useEmulators=true`.
+- Plain `gsync ...` remains global and should be treated as hosted unless you explicitly override `HOME`.
 - If the stack is already running, `npm run dev:status` will show the active pids and paths.
diff --git a/dashboard/src/firebase.js b/dashboard/src/firebase.js
index f359f40..d66b765 100644
--- a/dashboard/src/firebase.js
+++ b/dashboard/src/firebase.js
@@ -8,7 +8,9 @@ const firebaseConfig = {
   authDomain: `${import.meta.env.VITE_FIREBASE_PROJECT_ID || 'nomergeconflicts'}.firebaseapp.com`,
 };
 
-const useEmulators = import.meta.env.VITE_USE_FIREBASE_EMULATORS === 'true';
+// Never connect a production bundle to local emulators, even if a broad .env leaks
+// development defaults into the build environment.
+const useEmulators = import.meta.env.DEV && import.meta.env.VITE_USE_FIREBASE_EMULATORS === 'true';
 const firestoreHost = import.meta.env.VITE_FIRESTORE_EMULATOR_HOST || '127.0.0.1:8080';
 const authHost = import.meta.env.VITE_AUTH_EMULATOR_HOST || '127.0.0.1:9099';