done-done-axi 0.2.0 → 0.3.0

package/dist/cli.js

@@ -1,20 +1,24 @@
 #!/usr/bin/env node
 import { execFileSync, spawn, spawnSync } from 'node:child_process';
 import { createHash, randomBytes } from 'node:crypto';
-import { accessSync, appendFileSync, closeSync, constants, existsSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
-import { homedir, userInfo } from 'node:os';
-import { dirname, isAbsolute, join, matchesGlob, relative, resolve, sep } from 'node:path';
+import { accessSync, appendFileSync, closeSync, constants, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { homedir, tmpdir, userInfo } from 'node:os';
+import { basename, dirname, isAbsolute, join, matchesGlob, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { createInterface } from 'node:readline/promises';
 import { parseArgs } from 'node:util';
 import { encode } from '@toon-format/toon';
 import { Document, parseDocument } from 'yaml';
-import { ACPX_INSTALL, agentChoices, agentRun, askAgent, findBin, JUDGES, modelFor, noAgent, noJudge, notStartable, routeOf, selectAgent, selectJudge, supported } from './agents.js';
-import { AGENTS, CHEAP, globalConfigText, home, isAgent, loadConfig, parseDuration, UsageError } from './config.js';
-import { backend, judge, judgeable, onPath, quote } from './judge.js';
-import { maintainSteps, refuseSameSession } from './maintain.js';
+import { ACPX_INSTALL, agentChoices, agentPath, agentRun, askAgent, editOnlyReason, findBin, JUDGES, modelFor, noAgent, noJudge, notStartable, routeOf, selectAgent, selectJudge } from './agents.js';
+import { AGENTS, CHEAP, globalConfigText, home, inputPattern, isAgent, loadConfig, parseDuration, UsageError } from './config.js';
+import { backend, judge, judgeable, onPath, quote, screen } from './judge.js';
+import { startInstance, stopInstance } from './instance.js';
+import { attemptProblem, changedSince, commitFix, dirtyTracked, FIX_SCHEMA, inWorktree, maintainSteps, named, pathspec, repoState, triage } from './maintain.js';
+import { cellEnv, cellName, cellSuffix, hasMatrix, matrixManifest, splitMatrix } from './matrix.js';
 import { design, KINDS } from './design.js';
 import { checkMedia } from './media.js';
+import { domIssues, isDomRecord, SQUASHED_TEXT } from './dom.js';
+import { scanSecrets } from './secrets.js';
 const PASS = 0, FAIL = 1, USAGE = 2, INCONCLUSIVE = 3, WAITING = 4;
 // The shape of a journey, so a new user or agent can write one without opening the reference.
 // done-done sets DONE_DONE_EVIDENCE_ROOT (the run's own folder) and replaces ${RUN_ID}, so the example works for any evidence root.
@@ -22,7 +26,9 @@ const journeyExample = 'journeys: { smoke: { command: "<drive the real app> > $D
 const JOURNEYS_TEXT = `journeys (.done-done.yaml): the command runs with DONE_DONE_EVIDENCE_ROOT (this run's own new folder in the evidence
   root) and DONE_DONE_RUN_ID set, and \${RUN_ID} in it is replaced; it must write its files into that folder, e.g.
   ${journeyExample}
-  timeout (journeys.<name>.timeout): how long a verify run may drive the journey, e.g. 90s or 30m (default 30m); past it the journey is killed and the run is inconclusive`;
+  spends (journeys.<name>.spends): what a run spends, e.g. "one live generation"; verify parks the journey until the user approves that run (respond --action approve)
+  timeout (journeys.<name>.timeout): how long a verify run may drive the journey, e.g. 90s or 30m (default 30m); past it the journey is killed and the run is inconclusive
+  matrix (.done-done.yaml): with theme, width or form axes the journey runs once per required cell with DONE_DONE_THEME, DONE_DONE_WIDTH, DONE_DONE_FORM and DONE_DONE_CELL (the capture name suffix) set; name each capture with its suffix, so every cell is captured or skipped with a reason`;
 const CHECKS_TEXT = `Checks block (--from): the newest "## Checks" heading, then these four keys, each at the start of a line:
   outcome: <what a user can now do>
   repro: <command that failed before and passes now, or n/a; a fix PR needs one>
@@ -30,14 +36,21 @@ const CHECKS_TEXT = `Checks block (--from): the newest "## Checks" heading, then
   evidence: <the evidence file paths, or "not proven: <cause>">`;
 const RUNS_TEXT = `runs: each verify or maintain run lives in $DONE_DONE_HOME/runs/<app>/<run-id> (run.json, events.jsonl, logs/<step>.log,
   agents/<n>-<name>.json for each agent call) and goes on when the command that started it ends;
-  verify steps: resolve, drive, check, judge (unless --no-judge), gate, receipt, report;
+  verify steps: resolve, drive, check, judge (skipped with --no-judge), triage and fix (only with auto_fix.verify above 0), gate, receipt, report;
   maintain steps: locate, hygiene, source-wave, reconcile, triage and fix (only with auto_fix.maintain above 0), report
   drive: the journey when there is one; else the author agent (agent: in config) drives one feature of the verify skill the way a user
-  does and saves screenshots into the run's evidence folder; it may run commands and edit files only in the repo and that folder where
+  does and saves captures into the run's evidence folder; it may run commands and edit files only in the repo and that folder where
   its CLI can limit it (pi cannot), and a drive that changes a tracked file fails
+  inputs (.done-done.yaml): repo-relative paths or globs the drive must leave alone (fixtures, data files);
+  hashed before and after the drive; the check step fails naming each changed, appeared or
+  disappeared path (never file contents), and the before/after hash lists go into the run record; no key: unchanged
   gate: a judge fail or unsure (or an agent drive with no judged capture) parks the run as awaiting_approval (exit 4); answer it with
   respond: approve or skip (each needs --reason) ends the run overridden, never pass, and its receipt says who and why, so
-  receipt --verify refuses it; fix ends the run fail`;
+  receipt --verify refuses it; fix ends the run fail
+  auto_fix: { verify: <n> } (config; 0, the default, reports only): the judge sorts each wrong screen (fix or ask; an ask, an unsure
+  answer or a mixed result parks at the gate), then the agent the user set fixes the product in a done-done worktree with your
+  ignored files copied in, and verify runs again there, up to n times. Result: changed (the fix on a done-done/verify-<run-id>
+  branch, your HEAD still fails; exit 1) or blocked (dirty checkout, a guard, or every attempt used; exit 1)`;
 const MAINTAIN_TEXT = `maintain reads the verify skill and the source; HEAD, git status and the content of changed files must be the same before and after.
   locate: the verify skill (.agents/skills/verify-<app>/SKILL.md); none: blocked, create it with done-done init
   hygiene: every local link in the skill resolves; features/README.md lists each features/*.md file once
@@ -59,7 +72,7 @@ const DOCTOR_TEXT = `doctor changes nothing except the --probe call record (the
   set, with the command that saves the user's choice), agent_settings (agent, model, effort,
   args, path and agent_timeout, each with the file it came from: the global config, .done-done.yaml or default), judge (the judge route is ready: for claude-code an
   executable claude binary, a sign-in folder and the judge kit, for answerer:<agent> that agent's CLI and the kit, for openai:key
-  OPENAI_API_KEY and the kit; the model is never called; missing when none is set, with the command that saves the user's choice),
+  OPENAI_API_KEY and the kit; doctor does not call the model; missing when none is set, with the command that saves the user's choice),
   judge_choice (the judge, and how far it is from the author: another agent, another model, or session-only), ffprobe (video evidence only).
   --probe also asks the agent one JSON-schema question (one call at the agent's model: its cheap default where it has one, else its own; set agent_config.<agent>.model to choose; its record goes to
   $DONE_DONE_HOME/agents/) and then requires a valid answer.
@@ -95,7 +108,7 @@ const FLAGS = {
     '--action <approve|skip|fix>': 'approve: the captures do show the outcome; skip: go on without a judge pass; both end the run overridden; fix: end it fail, then fix the product or the verify skill (done-done maintain checks it against the source)',
     '--reason "<why>"': 'why (required for approve and skip); kept in the run and its receipt with who answered',
     '--limit <n>': 'how many past runs to list (default all)',
-    '--agent <agent>': 'the coding agent done-done starts (claude, opencode, pi, gemini or acp:<target>), saved as agent in ~/.done-done/config.yaml; without it, init asks in a terminal',
+    '--agent <agent>': 'the coding agent done-done starts (claude, codex, opencode, pi, gemini or acp:<target>), saved as agent in ~/.done-done/config.yaml; without it, init asks in a terminal',
     '--model <model>': 'with --agent: that agent\'s model, saved as agent_config.<agent>.model (opencode: provider/model)',
     '--judge <agent>': `the judge done-done starts (${JUDGES.join(' or ')}), saved as judge.route in ~/.done-done/config.yaml; never the agent and model that did the work; without it, init asks in a terminal`,
     '--judge-model <model>': 'with --judge <agent>: the judge\'s model, saved as judge.model',
@@ -155,7 +168,7 @@ const COMMANDS = {
     },
     verify: {
         usage: [
-            ['done-done verify [<journey>] --outcome "<what a user can now do>" [--claim-id <id>] [--no-judge]', 'drive the journey in a run that outlives this command, check its evidence, judge each screenshot and record a receipt'],
+            ['done-done verify [<journey>] --outcome "<what a user can now do>" [--claim-id <id>] [--no-judge]', 'drive the journey in a run that outlives this command, check its evidence, judge each capture and record a receipt'],
             ['done-done verify --outcome "<claim>" [--feature <name>]', 'with no journey, the author agent drives a verify skill feature and the judge (never the author) judges its captures'],
             ['done-done verify [<journey>] --outcome "<claim>" --no-wait | --wait | --foreground', 'return at once, wait until the run ends or waits at its gate (default), or run in this process (CI)'],
         ],
@@ -207,6 +220,11 @@ const COMMANDS = {
         flags: ['--run <run-id>'],
         more: [RUNS_TEXT],
     },
+    signoff: {
+        usage: [['done-done signoff [--run <run-id>]', "write the run's sign-off message (contract v1): a gate for a run waiting at its gate, evidence for a finished run; it prints the post command and never posts"]],
+        flags: ['--run <run-id>'],
+        more: [RUNS_TEXT],
+    },
     history: {
         usage: [['done-done history [--limit <n>]', 'list past runs, newest first']],
         flags: ['--limit <n>'],
@@ -214,9 +232,9 @@ const COMMANDS = {
     },
 };
 const rows = (pairs, width = Math.max(...pairs.map(([a]) => a.length)) + 3) => pairs.map(([a, b]) => `  ${a}${' '.repeat(Math.max(3, width - a.length))}${b}`).join('\n');
-const GLOBAL_TEXT = `global flags: --json (JSON instead of TOON), --full (do not truncate lists), --help (this command's usage)
+const GLOBAL_TEXT = `global flags: --json (JSON instead of TOON), --full (do not truncate lists), --help (this command's usage), --version (done-done's version)
 exit codes: 0 pass, 1 fail (also a run overridden at its gate), 2 usage or config error, 3 inconclusive, 4 the run is still running or a verify run waits at its gate (verify, maintain, rerun, status, respond)`;
-const USAGE_TEXT = `install: npm install -g --prefix ~/.local --allow-git=all github:umeranjum17/done-done-axi (installs done-done-axi and done-done), or run npx -y --allow-git=all github:umeranjum17/done-done-axi <command>
+const USAGE_TEXT = `install: npm install -g --prefix ~/.local done-done-axi (installs done-done-axi and done-done), or run npx -y done-done-axi <command>
 usage:
 ${rows([['done-done', "show this repo's config state and the next step"], ...Object.values(COMMANDS).flatMap((c) => c.usage)], 46)}
 ${GLOBAL_TEXT}
@@ -335,6 +353,8 @@ function closeRun(repo, cfg, rec) {
         return { path: p, sha256: sha256(b), bytes: b.length };
     });
     rec.ended_at = new Date().toISOString();
+    if (hasMatrix(cfg.matrix))
+        rec.matrix = matrixManifest(cfg.matrix, rec.files.map((f) => f.path));
     const record = writeRecord(cfg, rec);
     const rel = (p) => citable(repo, join(cfg.evidence.root, p));
     let reason = '';
@@ -360,6 +380,8 @@ function closeRun(repo, cfg, rec) {
     result.evidence = rows.items;
     if (rows.omitted)
         result.evidence_omitted = rows.omitted;
+    if (rec.matrix)
+        result.matrix = rec.matrix;
     result.help = [reason
             ? `Fix the capture, commit, then re-run: ${captureHint(cfg)}`
             : `Check this proof: done-done check --outcome "<what you proved>" ${rel(rec.files[0].path)}`];
@@ -373,7 +395,7 @@ function closeRun(repo, cfg, rec) {
     }
     return { code: reason ? FAIL : PASS, result, reason };
 }
-function cmdRun(argv) {
+async function cmdRun(argv) {
     const dash = argv.indexOf('--');
     const { values, positionals } = parseArgs({
         args: dash < 0 ? argv : argv.slice(0, dash),
@@ -394,6 +416,9 @@ function cmdRun(argv) {
     const journey = positionals[0] ?? null;
     if (positionals.length > 1)
         throw new UsageError('run takes at most one journey name');
+    const spends = journey ? cfg.journeys[journey]?.spends : undefined;
+    if (spends)
+        throw new UsageError(`journey ${journey} spends (${spends}), so run refuses it: nothing ran`, `Ask the user, then: done-done verify ${journey} --outcome "<what a user can now do>"`);
     let command = dash < 0 ? null : argv.slice(dash + 1).join(' ');
     if (journey && !command) {
         const j = cfg.journeys[journey];
@@ -420,14 +445,58 @@ function cmdRun(argv) {
         throw new UsageError('run needs a journey, a command after --, or --open');
     const expanded = command.replaceAll('${RUN_ID}', rec.run_id);
     rec.command = expanded;
-    // The journey's own stdout goes to our stderr, never our stdout: stdout carries only done-done's
-    // result document (TOON or --json), so a noisy journey cannot break `run --json | JSON.parse`.
-    const r = spawnSync(expanded, {
-        cwd: repo, shell: true, stdio: ['inherit', process.stderr, 'inherit'],
-        env: { ...process.env, DONE_DONE_RUN_ID: rec.run_id, DONE_DONE_EVIDENCE_ROOT: runDir(cfg, rec.run_id) },
-    });
-    rec.exit = r.status ?? 1;
-    return emitted(closeRun(repo, cfg, rec));
+    // With an instance block the app starts first on its own port, so the recipe uses
+    // $DONE_DONE_BASE_URL instead of a hard-coded port; without one this is today's behaviour.
+    let inst;
+    let scratch;
+    const SIGS = ['SIGINT', 'SIGTERM', 'SIGHUP'];
+    const reap = (sig) => {
+        if (inst)
+            stopInstance(inst.pgid);
+        if (scratch)
+            rmSync(scratch, { recursive: true, force: true });
+        if (sig)
+            process.kill(process.pid, sig);
+    };
+    if (cfg.instance) {
+        scratch = mkdtempSync(join(tmpdir(), 'done-done-instance-'));
+        try {
+            inst = await startInstance(repo, cfg.instance, rec.run_id, scratch, process.env, join(runsRoot(cfg.app), rec.run_id, 'logs', 'instance.log'));
+            for (const s of SIGS)
+                process.once(s, reap);
+        }
+        catch (e) {
+            rmSync(scratch, { recursive: true, force: true });
+            rec.exit = 1;
+            const closed = closeRun(repo, cfg, rec);
+            return emitted({ code: closed.code, result: { ...closed.result, reason: `instance: ${e.message}` } });
+        }
+    }
+    // With a matrix block the journey runs once per required cell with that cell in env.
+    const matrix = hasMatrix(cfg.matrix) ? splitMatrix(cfg.matrix) : null;
+    const failed = [];
+    rec.exit = 0;
+    for (const cell of matrix?.required ?? [{}]) {
+        // The journey's own stdout goes to our stderr, never our stdout: stdout carries only done-done's
+        // result document (TOON or --json), so a noisy journey cannot break `run --json | JSON.parse`.
+        const r = await new Promise((done) => {
+            spawn(expanded, {
+                cwd: repo, shell: true, stdio: ['inherit', process.stderr, 'inherit'],
+                env: { ...process.env, DONE_DONE_RUN_ID: rec.run_id, DONE_DONE_EVIDENCE_ROOT: runDir(cfg, rec.run_id), ...inst?.env, ...(matrix ? cellEnv(cell) : {}) },
+            }).on('error', () => done(null)).on('close', done);
+        });
+        const code = r ?? 1;
+        if (code !== 0) {
+            if (!failed.length)
+                rec.exit = code;
+            failed.push(`${cellName(cell)} (exit ${code})`);
+        }
+    }
+    reap();
+    const sealed = closeRun(repo, cfg, rec);
+    if (matrix && failed.length)
+        return emitted({ code: FAIL, result: { ...sealed.result, reason: `the run command failed for cell ${failed.join('; ')}` } });
+    return emitted(sealed);
 }
 // The newest "## Checks" block: outcome, repro, proof and evidence lines.
 function claimFromChecks(body, title, repo, cfg, out) {
@@ -463,7 +532,7 @@ function claimFromChecks(body, title, repo, cfg, out) {
 // A PR body also names its head branch, which is the claim a CI checkout (a detached HEAD) is checking.
 function readSource(from) {
     if (from === '-')
-        return { body: readFileSync(0, 'utf8'), title: '' };
+        return { body: readFileSync(0, 'utf8') };
     if (/^https?:\/\//.test(from)) {
         const r = spawnSync('gh', ['pr', 'view', from, '--json', 'body,title,headRefName'], { encoding: 'utf8' });
         if (r.error || r.status !== 0)
@@ -472,7 +541,7 @@ function readSource(from) {
         return { body: pr.body, title: pr.title, branch: pr.headRefName };
     }
     try {
-        return { body: readFileSync(from, 'utf8'), title: '' };
+        return { body: readFileSync(from, 'utf8') };
     }
     catch (e) {
         throw new UsageError(`cannot read ${from}: ${e.message}`);
@@ -485,7 +554,7 @@ function loadRecords(cfg) {
     return readdirSync(dir).filter((n) => n.endsWith('.json')).map((n) => JSON.parse(readFileSync(join(dir, n), 'utf8'))).filter((r) => r.ended_at);
 }
 // Run a check and return its result without printing it, so `check` and `receipt` share one path.
-// run: a verify run's folder (the judge's call records go to its agents/) and the hook that starts its judge step.
+// run: a verify run's folder (the judge's call records go to its agents/), its judge-step hook, and the checkout and config it checks.
 async function runCheck(argv, run) {
     const { values, positionals } = parseArgs({
         args: argv,
@@ -498,7 +567,7 @@ async function runCheck(argv, run) {
         throw new UsageError('--from takes no file arguments; the Checks block names them');
     if (values['claim-id']?.trim() === '')
         throw new UsageError('--claim-id needs a non-empty id');
-    const repo = repoRoot();
+    const repo = run?.repo ?? repoRoot();
     let projectText = null;
     if (values['trusted-ref']) {
         try {
@@ -511,7 +580,7 @@ async function runCheck(argv, run) {
             projectText = '';
         }
     }
-    const cfg = loadConfig(repo, projectText);
+    const cfg = run?.cfg ?? loadConfig(repo, projectText);
     const now = head(repo);
     const findings = [];
     let claim;
@@ -524,7 +593,9 @@ async function runCheck(argv, run) {
     else {
         const src = readSource(values.from);
         prBranch = src.branch;
-        claim = claimFromChecks(src.body, src.title, repo, cfg, findings);
+        // A local file or stdin has no PR title, so the HEAD commit subject is the title.
+        const title = src.title ?? git(repo, 'log', '-1', '--format=%s');
+        claim = claimFromChecks(src.body, title, repo, cfg, findings);
     }
     if (claim?.notProven) {
         const allowed = cfg.checks.not_proven === 'allow' && cfg.trusted;
@@ -538,6 +609,13 @@ async function runCheck(argv, run) {
     const hashes = [];
     const cited = [];
     const captures = [];
+    // base_ref: a capture in <run id>/before/ of a run that drove its base ref pairs with <run id>/<the same name>.
+    const pairOf = (inRoot) => {
+        const [id, dir, ...rest] = inRoot?.split(sep) ?? [];
+        return dir === BEFORE && rest.length && records.some((r) => r.run_id === id && r.base) ? join(id, ...rest) : null;
+    };
+    const befores = new Map();
+    const heads = [];
     for (const name of files) {
         const path = resolve(name);
         let bytes;
@@ -556,11 +634,19 @@ async function runCheck(argv, run) {
         const hash = sha256(bytes);
         hashes.push(hash);
         cited.push({ path: receiptPath(repo, cfg, path), sha256: hash });
-        if (seen.has(hash))
+        // A page-check record is a capture's companion: two clean cells of one page write the same bytes, and the judge never reads one.
+        const record = !!cfg.dom && isDomRecord(name);
+        const inRoot = under(cfg.evidence.root, path);
+        const pair = pairOf(inRoot);
+        if (cfg.dom && !pair && ['png', 'jpeg', 'webp', 'gif', 'mp4', 'webm'].includes(v.type))
+            for (const why of domIssues(cfg.dom, path))
+                findings.push({ level: 'fail', why: `${name}: ${why}` });
+        // A base capture may equal its head capture byte for byte: the pair's judge, not this check, says the screen did not change.
+        if (seen.has(hash) && !record && !pair)
             findings.push({ level: 'fail', why: `${name}: byte-identical to ${seen.get(hash)}` });
-        seen.set(hash, name);
+        if (!pair)
+            seen.set(hash, name);
         // A file in the evidence root is claimed by the record that lists its path; a copy elsewhere, by its bytes.
-        const inRoot = under(cfg.evidence.root, path);
         const claims = records.filter((r) => r.files.some((f) => f.sha256 === hash && (inRoot === null || f.path === inRoot)));
         if (!claims.length && inRoot !== null) {
             const edited = records.filter((r) => r.files.some((f) => f.path === inRoot));
@@ -582,8 +668,14 @@ async function runCheck(argv, run) {
         }
         const rec = claims[0];
         // Only a capture tied to a run record can reach the judge, so a stray cited file is never sent.
-        if (v.status === 'ok')
-            captures.push({ name, bytes, sha256: hash, media: v });
+        const c = { name, bytes, sha256: hash, media: v };
+        if (v.status === 'ok' && !record && pair)
+            befores.set(pair, c);
+        else if (v.status === 'ok' && !record) {
+            captures.push(c);
+            if (rec.base)
+                heads.push([c, inRoot, rec]);
+        }
         const stale = staleness(repo, cfg, rec.commit, now.commit);
         if (stale)
             findings.push({ level: 'fail', why: `${name}: ${stale} (run ${rec.run_id})` });
@@ -592,6 +684,14 @@ async function runCheck(argv, run) {
         if (rec.exit !== null && rec.exit !== 0)
             findings.push({ level: 'fail', why: `${name}: its run command exited ${rec.exit} (run ${rec.run_id})` });
     }
+    // A head capture of a base_ref run with no base capture of its name is reported, then judged alone.
+    for (const [c, inRoot, rec] of heads)
+        if (!(c.before = befores.get(inRoot ?? '')))
+            findings.push({ level: 'inconclusive', why: `${c.name}: no base capture to compare with: the drive at base_ref ${rec.base.ref} saved no ${join(BEFORE, inRoot ? relative(rec.run_id, inRoot) : c.name)}${rec.base.error ? ` (${rec.base.error})` : ''}`, file: c.name });
+    // The capture matrix: every required cell needs a capture named with its suffix, never silently missing.
+    if (hasMatrix(cfg.matrix))
+        for (const c of matrixManifest(cfg.matrix, files.filter((f) => (!cfg.dom || !isDomRecord(f)) && !pairOf(under(cfg.evidence.root, resolve(f))))).cells.filter((c) => !c.files.length))
+            findings.push({ level: 'fail', why: `cell ${c.cell} has no capture: name one file *${c.suffix}* (journeys name captures with DONE_DONE_CELL)` });
     // Reuse: fail only when every cited file was already used for a different claim id. The ledger lives in the
     // evidence root next to the run records it guards: one per app (repo), shared by every checkout of it, never in git.
     const ledger = join(cfg.evidence.root, '.done-done', 'ledger');
@@ -632,8 +732,9 @@ async function runCheck(argv, run) {
                 judgeLevel = 'fail';
             else if (!findings.length && j.judged.some((r) => r.verdict === 'unsure'))
                 judgeLevel = 'inconclusive';
+            const shots = new Set(captures.filter(screen).map((c) => c.name));
             for (const r of j.judged.filter((r) => r.verdict !== 'pass'))
-                findings.push({ level: r.verdict === 'fail' ? 'fail' : 'inconclusive', why: `${r.path}: judge says ${r.verdict === 'fail' ? 'wrong screen' : 'unsure'}: ${r.reason}` });
+                findings.push({ level: r.verdict === 'fail' ? 'fail' : 'inconclusive', why: `${r.path}: judge says ${r.verdict !== 'fail' ? 'unsure' : shots.has(r.path) ? 'wrong screen' : 'wrong output'}: ${r.reason}`, file: r.path });
             const rows = cap(j.judged);
             const { choice } = j;
             judged = { ...(choice && { route: choice.route, model: choice.model, independence: choice.independence, author: `${choice.author.agent} (model ${choice.author.model || 'none'})` }), judged: rows.items.map(({ sha256, ...r }) => r) };
@@ -645,7 +746,7 @@ async function runCheck(argv, run) {
                 judged.judged_omitted = rows.omitted;
             if (j.notJudged.length)
                 judged.not_judged = j.notJudged;
-            judged.note = 'only PNG and JPEG captures are judged; text, log and video evidence are not';
+            judged.note = 'PNG and JPEG screens and text captures (logs, JSON, CLI output) are judged; video and other files are not';
         }
     }
     const rep = report(findings, files, { cfg, repo, claim: claim?.outcome, source: values.from, judge: judged, judgeLevel });
@@ -690,10 +791,7 @@ function verifyReceipt(repo, cfg, headArg) {
     }
     const short = commit.slice(0, 12);
     const path = join(receiptsDir(cfg), `${commit}.json`);
-    const fail = (reason) => {
-        emit({ command: 'receipt', result: 'fail', head: commit, reason, help: ['Record a passing check for this head: done-done receipt --from <file|->'] });
-        return FAIL;
-    };
+    const fail = (reason) => ({ code: FAIL, result: { command: 'receipt', result: 'fail', head: commit, reason, help: ['Record a passing check for this head: done-done receipt --from <file|->'] } });
     if (!existsSync(path))
         return fail(`no receipt for ${short} in ${receiptsDir(cfg)}`);
     let rec;
@@ -720,8 +818,7 @@ function verifyReceipt(repo, cfg, headArg) {
     if (overridden) {
         if (rec.schema !== 2 || !o || typeof o !== 'object' || !['approve', 'skip'].includes(o.action) || typeof o.by !== 'string' || typeof o.reason !== 'string' || !o.reason)
             return fail(`receipt for ${short} has a malformed override`);
-        emit({ command: 'receipt', result: 'overridden', head: commit, claim: rec.claim, override: o, judge: j, help: [`This head is not proven: the judge did not pass it, and ${o.by} chose ${o.action} (${o.reason})`, 'Capture proof the judge passes, then: done-done verify --outcome "<what a user can now do>"'] });
-        return FAIL;
+        return { code: FAIL, result: { command: 'receipt', result: 'overridden', head: commit, claim: rec.claim, override: o, judge: j, help: [`This head is not proven: the judge did not pass it, and ${o.by} chose ${o.action} (${o.reason})`, 'Capture proof the judge passes, then: done-done verify --outcome "<what a user can now do>"'] } };
     }
     if (rec.head !== commit)
         return fail(`receipt records head ${String(rec.head).slice(0, 12)}, not ${short}`);
@@ -748,8 +845,7 @@ function verifyReceipt(repo, cfg, headArg) {
     }
     if (bad.length)
         return fail(`cited evidence no longer matches the receipt: ${bad.join('; ')}`);
-    emit({ command: 'receipt', result: 'pass', head: commit, tree: rec.tree, claim: rec.claim, files: rec.files.length, at: rec.at, schema: rec.schema, ...(rec.schema === 2 && { judge: j }), help: ['This receipt is valid for this head.'] });
-    return PASS;
+    return { code: PASS, result: { command: 'receipt', result: 'pass', head: commit, tree: rec.tree, claim: rec.claim, files: rec.files.length, at: rec.at, schema: rec.schema, ...(rec.schema === 2 && { judge: j }), help: ['This receipt is valid for this head.'] } };
 }
 async function cmdReceipt(argv) {
     const vi = argv.indexOf('--verify');
@@ -766,7 +862,7 @@ async function cmdReceipt(argv) {
     if (verifyHead) {
         if (rest.length)
             throw new UsageError('receipt --verify takes no other arguments');
-        return verifyReceipt(repo, cfg, verifyHead);
+        return emitted(verifyReceipt(repo, cfg, verifyHead));
     }
     if (!rest.length)
         throw new UsageError('receipt needs a claim (--outcome "<claim>" <files...> or --from <file|->) or --verify <head>');
@@ -856,7 +952,7 @@ const HEARTBEAT_MS = 5_000;
 // A run that never recorded its runner's pid this long after it was created has no runner.
 const STALE_MS = 60_000;
 const runsRoot = (app) => join(home(), 'runs', app);
-const STEPS = ['resolve', 'drive', 'check', 'judge', 'gate', 'receipt', 'report'];
+const verifySteps = (cfg) => ['resolve', 'drive', 'check', 'judge', ...(cfg.auto_fix.verify ? ['triage', 'fix'] : []), 'gate', 'receipt', 'report'];
 // Commands an agent drive must not run: they answer a gate, write a receipt or start a run that can write one.
 const DRIVE_REFUSED = ['respond', 'receipt', 'verify', 'rerun', 'maintain'];
 // One agent drive may launch the app, drive it and save captures; past this it is killed with everything it started.
@@ -885,9 +981,18 @@ const createOnce = (path) => {
     }
 };
 const evidenceOf = (repo, cfg, rec) => rec.files.map((f) => citable(repo, join(cfg.evidence.root, f.path)));
+// Every run of an app, from any checkout of it. A run.json that cannot be read stops the command, never skipped silently.
+const runsIn = (root) => (existsSync(root) ? readdirSync(root).filter((n) => existsSync(join(root, n, 'run.json'))).map((n) => {
+    try {
+        return loadRun(join(root, n));
+    }
+    catch (e) {
+        throw new UsageError(`cannot read the run record ${join(root, n, 'run.json')}: ${e.message}`, `Fix or remove ${join(root, n)}, then run this again`);
+    }
+}) : []);
 // Default run: the newest run of this checkout, as status does.
 function pickId(root, repo, cmd, cfg, id) {
-    const mine = existsSync(root) ? readdirSync(root).filter((n) => existsSync(join(root, n, 'run.json'))).map((n) => loadRun(join(root, n))).filter((r) => r.repo === repo) : [];
+    const mine = runsIn(root).filter((r) => r.repo === repo);
     const found = id ?? mine.sort((a, b) => a.created.localeCompare(b.created)).pop()?.run_id;
     if (!found)
         throw new UsageError(`no runs for ${cfg.app} in this checkout yet`, `Start one: done-done verify ${Object.keys(cfg.journeys).length > 1 ? '<journey> ' : ''}--outcome "<what a user can now do>"`);
@@ -910,6 +1015,106 @@ function skillHash(repo, cfg) {
         return '';
     }
 }
+// Every file the guard can see: tracked files plus untracked ones, git-ignored ones included.
+function guardCandidates(at) {
+    let listed;
+    try {
+        listed = execFileSync('git', ['ls-files', '-z', '--cached', '--others'], { cwd: at, encoding: 'utf8', maxBuffer: Infinity, stdio: ['ignore', 'pipe', 'pipe'] });
+    }
+    catch (e) {
+        throw new Error(`input guard: cannot list the repo files: ${e.message.split('\n')[0]}`);
+    }
+    return [...new Set(listed.split('\0').filter(Boolean))].sort();
+}
+// Node's matchesGlob skips dotfiles, so a watched glob matches them itself: '**' spans folders, '*' and '?' stay in one.
+const GLOB_TOKEN = /(\*\*\/|\*\*|\*|\?|\{[^}]*\}|\[[^\]]*\])/;
+const globEscape = (s) => s.replace(/[.+^$()|\\]/g, '\\$&');
+function guardGlob(p) {
+    const part = (t, i) => {
+        if (i % 2 === 0)
+            return globEscape(t);
+        if (t === '**/')
+            return '(?:.*/)?';
+        if (t === '**')
+            return '.*';
+        if (t === '*')
+            return '[^/]*';
+        if (t === '?')
+            return '[^/]';
+        return t[0] === '{' ? `(?:${t.slice(1, -1).split(',').map(globEscape).join('|')})` : t;
+    };
+    return new RegExp(`^${p.split(GLOB_TOKEN).map(part).join('')}$`);
+}
+function guardSnapshot(at, patterns) {
+    if (!patterns.length)
+        return [];
+    let candidates;
+    const listed = () => (candidates ??= guardCandidates(at));
+    let links;
+    const folderLinks = () => (links ??= listed().filter((c) => lstatSync(join(at, c), { throwIfNoEntry: false })?.isSymbolicLink() && statSync(join(at, c), { throwIfNoEntry: false })?.isDirectory()));
+    const paths = new Set();
+    for (const raw of patterns) {
+        const p = inputPattern(raw);
+        const glob = /[*?{\[]/.test(p);
+        const folder = !glob && existsSync(join(at, p)) && statSync(join(at, p)).isDirectory();
+        if (glob || folder) {
+            const base = glob ? p.slice(0, p.search(/[*?{\[]/)).replace(/\/[^/]*$/, '') : p;
+            const link = folderLinks().find((s) => base === '' || s === base || s.startsWith(`${base}/`) || base.startsWith(`${s}/`));
+            if (link)
+                throw new Error(`input guard: ${p} reaches ${link}, a symlink to a folder`);
+        }
+        if (glob) {
+            const re = guardGlob(p);
+            for (const c of listed())
+                if (c === p || c.startsWith(`${p}/`) || re.test(c))
+                    paths.add(c);
+        }
+        else if (folder) {
+            for (const c of listed())
+                if (c.startsWith(`${p}/`))
+                    paths.add(c);
+        }
+        else
+            paths.add(p);
+    }
+    const root = realpathSync(at);
+    return [...paths].sort().map((path) => {
+        const full = join(at, path);
+        const st = statSync(full, { throwIfNoEntry: false });
+        if (!st)
+            return { path, sha256: null };
+        if (!st.isFile())
+            throw new Error(`input guard: ${path} is not a plain file`);
+        if (!realpathSync(full).startsWith(`${root}${sep}`))
+            throw new Error(`input guard: ${path} links outside the repo`);
+        try {
+            return { path, sha256: sha256(readFileSync(full)) };
+        }
+        catch (e) {
+            throw new Error(`input guard: cannot read ${path}: ${e.message.split('\n')[0]}`);
+        }
+    });
+}
+// Each difference names only its path, never file contents.
+function guardDiff(before, after) {
+    const a = new Map(after.map((f) => [f.path, f.sha256]));
+    const b = new Map(before.map((f) => [f.path, f.sha256]));
+    const out = [];
+    const push = (path, verb) => out.push({ path, why: `${path}: ${verb} during the drive` });
+    for (const [path, h] of b) {
+        const g = a.get(path);
+        if (h === null && g !== null && g !== undefined)
+            push(path, 'appeared');
+        else if (h !== null && g !== null && g !== undefined && g !== h)
+            push(path, 'changed');
+        else if (h !== null && (g === null || g === undefined))
+            push(path, 'disappeared');
+    }
+    for (const [path, g] of a)
+        if (g !== null && !b.has(path))
+            push(path, 'appeared');
+    return out.sort((x, y) => (x.why < y.why ? -1 : 1));
+}
 // The drive's input is the journey command, or for an agent drive the author agent and model that drove it.
 function inputsOf(repo, cfg, journey, author) {
     const h = head(repo);
@@ -939,33 +1144,68 @@ async function agentDrive(repo, cfg, feature) {
     // The author is the agent the user set; with none, ask (in a terminal) or stop with the command that saves the answer.
     await withChoice('agent', cfg);
     const a = selectAgent(cfg);
-    if (!a.path || !supported(a.agent))
-        throw new UsageError(`verify needs an agent to drive the app: ${a.path ? `${a.agent} cannot be started by done-done yet` : notStartable(a.agent, a.override)}`, `Install ${a.agent}, or save the agent the user chooses: done-done init --agent <agent> --model <model>; or record a journey: done-done init --journey <name> -- <command>`);
+    if (!a.path)
+        throw new UsageError(`verify needs an agent to drive the app: ${notStartable(a.agent, a.override)}`, `Install ${a.agent}, or save the agent the user chooses: done-done init --agent <agent> --model <model>; or record a journey: done-done init --journey <name> -- <command>`);
     if (a.agent.startsWith('acp:'))
-        throw new UsageError(`${a.agent} cannot drive the app: done-done runs ACP agents with every tool denied`, `Set agent: to one of ${AGENTS.filter(supported).join(', ')}, or record a journey: done-done init --journey <name> -- <command>`);
+        throw new UsageError(`${a.agent} cannot drive the app: done-done runs ACP agents with every tool denied`, `Set agent: to one of ${AGENTS.join(', ')}, or record a journey: done-done init --journey <name> -- <command>`);
     return { author: { agent: a.agent, model: a.model }, feature: name ?? (features.length === 1 ? features[0] : undefined) };
 }
 // The drive prompt: the claim, where the verify skill and its feature recipe are, and where captures go. The judge never sees it.
 // With a verify skill and no journey, the next step can be an agent drive.
 const driveHint = (repo, cfg) => existsSync(join(repo, cfg.skill, 'SKILL.md'))
     ? ['Have your coding agent drive a verify skill feature: done-done verify --outcome "<what a user can now do>" [--feature <name>]'] : [];
-function drivePrompt(run, cfg, evidence, scratch) {
-    const skill = join(run.repo, cfg.skill);
+// The page-check record shape and how to collect it with chrome-devtools-axi, for the drive prompt and the verify skill scaffold.
+const DOM_RECORD = '{"url": "<page url>", "overflow": <true when content is wider than the viewport>, "overflowing": ["<element>", ...], "console_errors": ["<message>", ...], "failed_requests": [{"url": "<url>", "status": <HTTP status, 0 when none>}], "squashed_text": [{"element": "<element>", "text": "<text>", "chars": <width in characters>, "lines": <n>, "words": <n>}]}'
+    + `; with your browser tool (for example chrome-devtools-axi): overflow from eval "() => { const w = document.documentElement.clientWidth; return { overflow: document.documentElement.scrollWidth > w, overflowing: [...document.querySelectorAll('body *')].filter((e) => e.getBoundingClientRect().right > w + 1).slice(0, 10).map((e) => e.tagName.toLowerCase() + (e.id ? '#' + e.id : '')) } }", console errors from console --type error, failed requests (status 400 or more, or no response) from network, squashed_text from eval "${SQUASHED_TEXT}" exactly as written (in every frame, an embedded one too)`;
+function drivePrompt(run, at, cfg, evidence, scratch, base = '') {
+    const skill = join(at, cfg.skill);
     const recipe = run.feature ? `the feature recipe ${join(skill, 'features', `${run.feature}.md`)}` : `its feature map ${join(skill, 'features', 'README.md')}, then pick the one feature the outcome is about`;
+    const inst = cfg.instance ? `\n\nThe app is already running at $DONE_DONE_BASE_URL (started by done-done on its own port with its own HOME; DONE_DONE_PORT is its port). Drive that instance: do not start your own server or hard-code a port.` : '';
+    const matrix = hasMatrix(cfg.matrix) ? splitMatrix(cfg.matrix) : null;
+    const cells = !matrix ? '' : `\n\nThe repo asks for every theme x width x form cell below: drive each cell (theme and width are the recipe's job) and save one PNG per cell whose file name holds its suffix, e.g. ${evidence}/home.<suffix>.png:\n${matrix.required.map((c) => `- ${cellName(c)}: *${cellSuffix(c)}*`).join('\n')}${matrix.skipped.length ? `\nSkipped (capture nothing for these):\n${matrix.skipped.map((s) => `- ${cellName(s.cell)} (${s.reason})`).join('\n')}` : ''}`;
+    const dom = cfg.dom ? `\n\nThe repo checks each page: next to every capture write its page-check record, the capture's name with .dom.json for its extension (e.g. home.dom.json for home.png), as the verify skill's Evidence section says: ${DOM_RECORD}. Record what the page shows; never fix the page.` : '';
+    const before = base ? `\n\nYour working directory is the base ref ${base}, before the change, so the outcome is not expected to hold here and that is no blocker: drive the same path and save the same screens under the same file names, showing them as they are before the change.` : '';
     return `You drive the real ${run.app} app the way a user does, to capture proof of one outcome. Someone else judges your captures.
 
 Outcome to prove: ${run.claim}
-
+${inst}${cells}${dom}${before}
 1. Read the verify skill ${join(skill, 'SKILL.md')} (how to launch, check, drive, capture and clean up this app) and ${recipe}.
-2. Launch the app as the skill says, then drive that feature through the real user path, step by step as its recipe says.
+2. ${cfg.instance ? 'Drive that running instance' : 'Launch the app as the skill says, then drive'} that feature through the real user path, step by step as its recipe says.
    Never add steps or data to make the outcome look true: capture what that path shows, even when it contradicts the outcome.
-3. Save PNG screenshots of what a user sees, the action and the resulting state, into ${evidence} (also in $DONE_DONE_EVIDENCE_ROOT). Save nothing else there, and never edit a capture.
+3. Save PNG screenshots of what a user sees once the path is done (the resulting state the outcome is about) into ${evidence} (also in $DONE_DONE_EVIDENCE_ROOT); when the outcome shows in text (a CLI's output, a log or JSON), save that text there as a .txt, .log or .json file instead.
+   The judge checks every capture there against the outcome, so a capture of an earlier step (such as an empty or half-filled form, or text from before the outcome) fails the drive: keep those in ${scratch}. Save nothing else there, and never edit a capture.
 4. Stop everything you started.
 
 Do not change any file in the repository. Do not run done-done: it refuses inside a drive, and done-done answers the run after you stop. Put logs and other scratch files in ${scratch} (also in $TMPDIR), never in /tmp.
 Keep working until all four steps are done: your next message without a tool call ends the drive and must be the answer.
 If you cannot launch the app or reach the feature, say why in blocker and save no capture.
-Answer with feature (the feature file you drove, such as features/<name>.md), captures (the file names you saved) and blocker ("" when you drove it).`;
+Answer with feature (the feature file you drove, such as features/<name>.md), captures (the file names you saved) and blocker ("" when you drove it),
+for example {"feature":"features/<name>.md","captures":["<name>.png"],"blocker":""}.`;
+}
+// base_ref: the same drive at the base ref, in a done-done worktree removed after, with the same run id, instance and matrix env;
+// its captures go to the run folder's before/. A failed base drive is recorded, not the run's failure: the check reports each
+// head capture it left without a pair.
+const BEFORE = 'before';
+async function driveBase(run, cfg, dir, rec, fix, drive) {
+    const base = (rec.base = { ref: cfg.base_ref, commit: '' });
+    const evidence = join(runDir(cfg, rec.run_id), BEFORE);
+    const wt = join(dir, `${fix}base`);
+    try {
+        base.commit = git(run.repo, 'rev-parse', '--verify', '--end-of-options', `${cfg.base_ref}^{commit}`);
+        mkdirSync(evidence, { recursive: true });
+        const error = await inWorktree(run.repo, wt, async () => {
+            if (!cfg.instance)
+                return drive(wt, evidence, {});
+            const inst = await startInstance(wt, cfg.instance, rec.run_id, join(dir, `${fix}base-tmp`), process.env, join(dir, 'logs', `${fix}base-instance.log`));
+            run.runner.instance_pgid = inst.pgid;
+            return drive(wt, evidence, inst.env).finally(() => stopInstance(inst.pgid));
+        }, base.commit);
+        if (error)
+            Object.assign(base, { error });
+    }
+    catch (e) {
+        Object.assign(base, { error: base.commit ? errorText(e) : `base_ref ${cfg.base_ref} names no commit in this repo` });
+    }
 }
 function saveRun(dir, run) {
     run.updated = now();
@@ -1009,9 +1249,17 @@ async function runSteps(dir) {
         saveRun(dir, run);
     }, HEARTBEAT_MS);
     let step;
-    const set = (s, status, extra = {}) => setStep(dir, run, s, status, extra);
-    const begin = (name) => (set((step = run.steps.find((s) => s.name === name)), 'running'), step);
-    const log = (name, result) => writeFileSync(join(dir, 'logs', `${name}.log`), `${encode(result)}\n`);
+    // A fix's re-run (auto_fix.verify) is quiet: it leaves the run's steps as they are, and its step logs go to `quiet`.
+    let quiet = null;
+    const set = (s, status, extra = {}) => quiet ?? setStep(dir, run, s, status, extra);
+    // A step that starts skips the earlier steps still pending (the judge when it is off, a fix that was not needed).
+    const begin = (name) => {
+        for (const s of quiet ? [] : run.steps.slice(0, run.steps.findIndex((s) => s.name === name)))
+            if (s.status === 'pending')
+                s.status = 'skipped';
+        return (set((step = run.steps.find((s) => s.name === name)), 'running'), step);
+    };
+    const log = (name, result) => quiet ? void (quiet[name] = result) : writeFileSync(join(dir, 'logs', `${name}.log`), `${encode(result)}\n`);
     const finish = (result, reason) => {
         step = run.steps.find((s) => s.name === 'report');
         finishRun(dir, run, result, reason);
@@ -1040,116 +1288,296 @@ async function runSteps(dir) {
             throw new Error(`journeys.${run.journey}.timeout must be a duration such as 30m or 90s, not ${timeout}`);
         if (!reused)
             set(step, 'completed');
-        let rec;
-        if (done('drive') && run.record) {
-            begin('drive');
-            rec = JSON.parse(readFileSync(run.record, 'utf8'));
-            set(step, 'completed');
-        }
-        else if (run.journey === null) {
-            // The author agent drives the feature in its own process group, so a timeout, an abort or a dead runner stops it
-            // and the app it launched; a drive that changed tracked files would prove code that is not committed.
-            begin('drive');
-            const author = run.author;
-            rec = { ...openRun(run.repo, cfg, null, null, run.run_id), author };
-            const evidence = runDir(cfg, rec.run_id);
-            const tracked = () => sha256(execFileSync('git', ['diff', 'HEAD', '--binary'], { cwd: run.repo, maxBuffer: Infinity, stdio: ['ignore', 'pipe', 'pipe'] }));
-            const before = tracked();
-            const scratch = join(dir, 'tmp');
-            mkdirSync(scratch, { recursive: true });
-            const a = await askAgent({
-                ...agentRun(cfg, author.agent, author.model), prompt: drivePrompt(run, cfg, evidence, scratch), schema: DRIVE_SCHEMA, cwd: run.repo, tools: 'edit',
-                record: join(dir, 'agents', 'drive.json'), dirs: [evidence, scratch], env: { DONE_DONE_RUN_ID: rec.run_id, DONE_DONE_DRIVE: rec.run_id, DONE_DONE_EVIDENCE_ROOT: evidence, TMPDIR: scratch },
-                onSpawn: spawned,
-            });
-            const answer = a.answer;
-            const blocker = String(answer?.blocker ?? '').trim();
-            rec.exit = a.ok && !blocker ? 0 : 1;
-            const changed = tracked() !== before;
-            const sealed = closeRun(run.repo, cfg, rec);
-            run.record = join(recordsDir(cfg), `${rec.run_id}.json`);
-            const picked = typeof answer?.feature === 'string' ? answer.feature.replace(/^.*features\//, '').replace(/\.md$/, '') : '';
-            if (skillFeatures(run.repo, cfg).includes(picked))
-                run.feature ??= picked;
-            log('drive', { agent: author.agent, model: author.model, feature: run.feature ?? 'none', ...(a.ok ? { captures: answer?.captures, blocker } : { error: a.error }), record: a.record ?? a.recordError });
-            const why = !a.ok ? `${author.agent} did not finish the drive: ${a.error}`
-                : blocker ? `${author.agent} could not drive the feature: ${blocker}`
-                    : changed ? `${author.agent} changed tracked files in the repo during the drive (see git status), so its captures are not of the committed code`
-                        : sealed.code !== PASS ? sealed.reason : '';
-            set(step, why ? 'failed' : 'completed', { exit: rec.exit, outputs: evidenceOf(run.repo, cfg, rec) });
-            if (why)
-                return finish('fail', `drive: ${why}`);
+        // A journey that spends real money or credits never runs until the user approved spending for this run.
+        if (journey?.spends && !run.spend && !done('drive')) {
+            const cells = hasMatrix(cfg.matrix) ? splitMatrix(cfg.matrix).required.length : 0;
+            const what = `journey ${run.journey} spends (${journey.spends}), so it runs only once the user approves spending for this run` + (cells ? `; the approval covers every matrix cell, so it runs ${cells} times, once per cell` : '');
+            run.gate = { findings: [{ id: 'spend-1', severity: 'warning', what, action: 'ask-user' }], cited: [], head: head(run.repo), spend: journey.spends };
+            run.status = 'awaiting_approval';
+            set((step = run.steps.find((s) => s.name === 'drive')), 'awaiting_approval', { findings: run.gate.findings });
+            return;
         }
-        else {
+        // One drive, check and judge of the claim at `at`: the user's checkout, or (`fix` names the re-run) a fix worktree.
+        // With auto_fix.verify, a product failure (a drive the product stopped, a screen the judge calls wrong) may be fixed.
+        const tries = cfg.auto_fix.verify ?? 0;
+        const pass = async (at, fix = '') => {
+            const id = fix ? `${run.run_id}-${fix}` : run.run_id;
+            const fail = (reason, fixable = [], result = 'fail') => ({ end: { result, reason: `drive: ${reason}` }, asks: [], fixable });
+            const reusing = !fix && done('drive') && !!run.record;
             begin('drive');
-            rec = openRun(run.repo, cfg, run.journey, command.replaceAll('${RUN_ID}', run.run_id), run.run_id);
-            const fd = openSync(join(dir, 'logs', 'drive.log'), 'a');
-            // An async child keeps the heartbeat going while the journey runs. The journey gets its own process group, so a
-            // timeout or a dead runner can kill it and everything it started.
-            const child = spawn(rec.command, { cwd: run.repo, shell: true, detached: true, stdio: ['ignore', fd, fd], env: { ...process.env, DONE_DONE_RUN_ID: rec.run_id, DONE_DONE_EVIDENCE_ROOT: runDir(cfg, rec.run_id) } });
-            run.runner.journey_pgid = child.pid;
-            saveRun(dir, run);
-            let timedOut = false;
-            const timer = setTimeout(() => {
-                timedOut = true;
-                killGroup(child.pid);
-            }, limit);
-            rec.exit = await new Promise((done) => child.on('close', (code) => done(code ?? 1)));
-            clearTimeout(timer);
-            closeSync(fd);
-            const sealed = closeRun(run.repo, cfg, rec);
-            run.record = join(recordsDir(cfg), `${rec.run_id}.json`);
-            set(step, sealed.code === PASS ? 'completed' : 'failed', { exit: rec.exit, outputs: evidenceOf(run.repo, cfg, rec) });
-            if (timedOut)
-                return finish('inconclusive', `drive: journey timed out after ${timeout}`);
-            if (sealed.code !== PASS)
-                return finish('fail', `drive: ${sealed.reason}`);
-        }
-        begin('check');
-        const files = rec.files.map((f) => join(cfg.evidence.root, f.path));
-        // The check's own findings end the check step; the judge, when on and the check did not fail, is its own step.
-        let checkFindings = 0;
-        const judging = (code, findings) => {
-            checkFindings = findings.length;
-            set(step, code === PASS ? 'completed' : 'failed', { exit: code, findings });
-            begin('judge');
+            const guardBefore = reusing ? [] : guardSnapshot(at, cfg.inputs);
+            const scanRun = (files) => scanSecrets([...files, join(dir, 'logs'), join(dir, 'agents')], cfg.secrets);
+            const secretWhy = (l) => `${shown(run.repo, l.file)}:${l.line}: holds a secret (${l.pattern}); remove it, or allow a known-safe match with secrets.allow in .done-done.yaml`;
+            const evidenceFiles = () => rec.files.map((f) => join(cfg.evidence.root, f.path));
+            // Every failed drive is scanned too: a leak replaces the reason, so unscanned agent or instance text never echoes a secret, and a leaking log excerpt never reaches the fix agent.
+            const failScanned = (reason, files, fixable = [], result = 'fail') => {
+                const leak = scanRun(files)[0];
+                return leak ? fail(`secrets: ${secretWhy(leak)}`) : fail(reason, fixable, result);
+            };
+            let rec;
+            if (reusing) {
+                rec = JSON.parse(readFileSync(run.record, 'utf8'));
+                set(step, 'completed');
+            }
+            else if (run.journey === null) {
+                // The author agent drives the feature in its own process group, so a timeout, an abort or a dead runner stops it
+                // and the app it launched; a drive that changed tracked files would prove code that is not committed.
+                const author = run.author;
+                rec = { ...openRun(at, cfg, null, null, id), author };
+                const evidence = runDir(cfg, rec.run_id);
+                const tracked = () => sha256(execFileSync('git', ['diff', 'HEAD', '--binary'], { cwd: at, maxBuffer: Infinity, stdio: ['ignore', 'pipe', 'pipe'] }));
+                const before = tracked();
+                const scratch = join(dir, 'tmp');
+                mkdirSync(scratch, { recursive: true });
+                // With an instance block the app is already running at $DONE_DONE_BASE_URL; the drive uses it, never a fixed port.
+                // The agent keeps its own HOME and XDG folders (its login lives there); only the app runs isolated.
+                let instPort = {};
+                if (cfg.instance) {
+                    try {
+                        const inst = await startInstance(at, cfg.instance, rec.run_id, scratch, process.env, join(dir, 'logs', `${fix}instance.log`));
+                        run.runner.instance_pgid = inst.pgid;
+                        saveRun(dir, run);
+                        instPort = inst.env;
+                    }
+                    catch (e) {
+                        set(step, 'failed');
+                        return failScanned(`instance: ${e.message}`, []);
+                    }
+                }
+                const drive = (where, evidence, env, base = '') => askAgent({
+                    ...agentRun(cfg, author.agent, author.model), prompt: drivePrompt(run, where, cfg, evidence, scratch, base), schema: DRIVE_SCHEMA, cwd: where, tools: 'edit',
+                    record: join(dir, 'agents', `${fix}${base ? 'base-' : ''}drive.json`), dirs: [evidence, scratch], env: { DONE_DONE_RUN_ID: rec.run_id, DONE_DONE_DRIVE: rec.run_id, DONE_DONE_EVIDENCE_ROOT: evidence, TMPDIR: scratch, ...env },
+                    onSpawn: spawned,
+                });
+                const a = await drive(at, evidence, instPort);
+                if (run.runner?.instance_pgid)
+                    stopInstance(run.runner.instance_pgid);
+                const answer = a.answer;
+                const blocker = String(answer?.blocker ?? '').trim();
+                rec.exit = a.ok && !blocker ? 0 : 1;
+                const changed = tracked() !== before;
+                if (cfg.base_ref && !rec.exit && !changed)
+                    await driveBase(run, cfg, dir, rec, fix, async (where, evidence, env) => {
+                        // The same drive: the head's verify skill, copied into the base worktree, where the agent may read it.
+                        cpSync(join(at, cfg.skill), join(where, cfg.skill), { recursive: true, force: true });
+                        const b = await drive(where, evidence, env, cfg.base_ref);
+                        return b.ok ? String(b.answer?.blocker ?? '').trim() : `${author.agent} did not finish the drive: ${b.error}`;
+                    });
+                const sealed = closeRun(at, cfg, rec);
+                if (!fix)
+                    run.record = join(recordsDir(cfg), `${rec.run_id}.json`);
+                const picked = typeof answer?.feature === 'string' ? answer.feature.replace(/^.*features\//, '').replace(/\.md$/, '') : '';
+                if (skillFeatures(at, cfg).includes(picked))
+                    run.feature ??= picked;
+                log('drive', { agent: author.agent, model: author.model, feature: run.feature ?? 'none', ...(a.ok ? { captures: answer?.captures, blocker } : { error: a.error }), record: a.record ?? a.recordError });
+                const why = !a.ok ? `${author.agent} did not finish the drive: ${a.error}`
+                    : blocker ? `${author.agent} could not drive the feature: ${blocker}`
+                        : changed ? `${author.agent} changed tracked files in the repo during the drive (see git status), so its captures are not of the committed code`
+                            : sealed.code !== PASS ? sealed.reason : '';
+                set(step, why ? 'failed' : 'completed', { exit: rec.exit, outputs: evidenceOf(run.repo, cfg, rec) });
+                // Only a blocker says the product stopped the drive; a lost or bad answer is the agent's own failure.
+                if (why)
+                    return failScanned(why, evidenceFiles(), a.ok && blocker && !changed ? [{ kind: 'drive', file: `features/${run.feature || picked || 'README'}.md`, what: why }] : []);
+            }
+            else {
+                rec = openRun(at, cfg, run.journey, command.replaceAll('${RUN_ID}', id), id);
+                const logFile = join(dir, 'logs', `${fix}drive.log`);
+                const fd = openSync(logFile, 'a');
+                // With an instance block the app starts first on its own port; the journey talks to $DONE_DONE_BASE_URL.
+                let instEnv = {};
+                if (cfg.instance) {
+                    try {
+                        const scratch = join(dir, 'tmp');
+                        mkdirSync(scratch, { recursive: true });
+                        const inst = await startInstance(at, cfg.instance, rec.run_id, scratch, process.env, join(dir, 'logs', `${fix}instance.log`));
+                        run.runner.instance_pgid = inst.pgid;
+                        instEnv = inst.env;
+                    }
+                    catch (e) {
+                        closeSync(fd);
+                        set(step, 'failed');
+                        return failScanned(`instance: ${e.message}`, []);
+                    }
+                }
+                // With a matrix block the journey runs once per required cell with that cell in env.
+                const matrix = hasMatrix(cfg.matrix) ? splitMatrix(cfg.matrix).required : null;
+                const failed = [];
+                rec.exit = 0;
+                let timedOut = false;
+                let running;
+                // The timeout bounds the whole verify run's journey: it kills the cell running now and stops the loop.
+                const timer = setTimeout(() => {
+                    timedOut = true;
+                    if (running)
+                        killGroup(running);
+                }, limit);
+                for (const cell of matrix ?? [{}]) {
+                    // An async child keeps the heartbeat going while the journey runs. The journey gets its own process group, so a
+                    // timeout or a dead runner can kill it and everything it started.
+                    const child = spawn(rec.command, { cwd: at, shell: true, detached: true, stdio: ['ignore', fd, fd], env: { ...process.env, DONE_DONE_RUN_ID: rec.run_id, DONE_DONE_EVIDENCE_ROOT: runDir(cfg, rec.run_id), ...instEnv, ...(matrix ? cellEnv(cell) : {}) } });
+                    run.runner.journey_pgid = child.pid;
+                    running = child.pid;
+                    saveRun(dir, run);
+                    const code = await new Promise((done) => child.on('close', (c) => done(c ?? 1)));
+                    running = undefined;
+                    if (timedOut) {
+                        failed.push(`${cellName(cell)} (timed out after ${timeout})`);
+                        if (!rec.exit)
+                            rec.exit = 1;
+                        break;
+                    }
+                    if (code !== 0) {
+                        if (!rec.exit)
+                            rec.exit = code;
+                        failed.push(`${cellName(cell)} (exit ${code})`);
+                    }
+                }
+                clearTimeout(timer);
+                if (run.runner?.instance_pgid)
+                    stopInstance(run.runner.instance_pgid);
+                if (cfg.base_ref && !failed.length)
+                    await driveBase(run, cfg, dir, rec, fix, async (where, evidence, env) => {
+                        for (const cell of matrix ?? [{}]) {
+                            const child = spawn(rec.command, { cwd: where, shell: true, detached: true, stdio: ['ignore', fd, fd], env: { ...process.env, DONE_DONE_RUN_ID: rec.run_id, DONE_DONE_EVIDENCE_ROOT: evidence, ...env, ...(matrix ? cellEnv(cell) : {}) } });
+                            spawned(child.pid);
+                            const timer = setTimeout(() => killGroup(child.pid), limit);
+                            const code = await new Promise((done) => child.on('close', (c) => done(c ?? 1)));
+                            clearTimeout(timer);
+                            if (code)
+                                return `the journey exited ${code} for cell ${cellName(cell)}`;
+                        }
+                        return '';
+                    });
+                closeSync(fd);
+                const sealed = closeRun(at, cfg, rec);
+                if (!fix)
+                    run.record = join(recordsDir(cfg), `${rec.run_id}.json`);
+                set(step, failed.length || sealed.code !== PASS ? 'failed' : 'completed', { exit: rec.exit, outputs: evidenceOf(run.repo, cfg, rec) });
+                if (timedOut)
+                    return failScanned(`journey timed out after ${timeout}`, evidenceFiles(), [], 'inconclusive');
+                if (matrix && failed.length)
+                    return failScanned(`the journey command failed for cell ${failed.join('; ')}`, evidenceFiles());
+                if (sealed.code !== PASS)
+                    return failScanned(sealed.reason, evidenceFiles(), tries && /^the run command exited/.test(sealed.reason) ? [{ kind: 'drive', file: run.journey, what: `the journey ${sealed.reason}; the end of its output:\n${readFileSync(logFile, 'utf8').slice(-2000)}` }] : []);
+            }
+            if (!reusing && cfg.inputs.length)
+                run.guarded = { patterns: cfg.inputs, before: guardBefore, after: guardSnapshot(at, cfg.inputs) };
+            begin('check');
+            const files = evidenceFiles();
+            // No secret may sit in the evidence or the run's logs: a hit fails the run naming the file, line and pattern, never the value.
+            const leaks = scanRun(files).map((l) => ({ level: 'fail', why: secretWhy(l) }));
+            if (leaks.length) {
+                log('check', { result: 'fail', findings: leaks });
+                set(step, 'failed', { exit: FAIL, findings: leaks });
+                return { end: { result: 'fail', reason: `secrets: ${leaks[0].why}` }, asks: [], fixable: [] };
+            }
+            // The input guard: the drive must leave the watched inputs alone. A difference fails the check step,
+            // naming each path but never file contents; the before/after hash lists stay in the run record.
+            if (run.guarded) {
+                const diffs = guardDiff(run.guarded.before, run.guarded.after);
+                if (diffs.length) {
+                    const findings = diffs.map((d) => ({ level: 'fail', why: d.why }));
+                    set(step, 'failed', { exit: 1, findings });
+                    log('check', { result: 'fail', findings });
+                    return { end: { result: 'fail', reason: `check: input guard: ${diffs.map((d) => d.why).join('; ')}` }, asks: [], fixable: [] };
+                }
+            }
+            // The check's own findings end the check step; the judge, when on and the check did not fail, is its own step.
+            let checkFindings = 0;
+            const judging = (code, findings) => {
+                checkFindings = findings.length;
+                set(step, code === PASS ? 'completed' : 'failed', { exit: code, findings });
+                begin('judge');
+            };
+            // A fix worktree is detached, so it checks for the claim id of the user's branch.
+            const claimId = run.claim_id ?? (fix ? git(run.repo, 'branch', '--show-current') : null);
+            const checked = await runCheck(['--outcome', run.claim, ...files, ...(claimId ? ['--claim-id', claimId] : [])], { dir, judge: !!run.judge, judging, author: run.author, repo: at, cfg });
+            const logged = { ...checked.result, findings: checked.findings };
+            delete logged.findings_omitted;
+            log('check', logged);
+            const judgeRan = step.name === 'judge';
+            const judgeFindings = judgeRan ? checked.findings.slice(checkFindings) : [];
+            if (judgeRan) {
+                log('judge', checked.judge);
+                set(step, judgeFindings.length ? 'failed' : 'completed', { exit: judgeFindings.length ? checked.code : PASS, findings: judgeFindings });
+            }
+            else
+                set(step, checked.code === PASS ? 'completed' : 'failed', { exit: checked.code, findings: checked.findings });
+            // The gate: when the check itself is clean but the judge did not pass a capture (or judged none of an agent's), the run
+            // waits for the caller (respond), who can move it on but never make it a pass. The runner ends here.
+            const clean = judgeRan ? checkFindings === 0 : checked.code === PASS;
+            const notJudged = judgeRan && run.journey === null ? (checked.judge?.not_judged ?? []) : [];
+            const asks = !clean ? [] : judgeRan ? [...judgeFindings, ...notJudged.map((name) => ({ level: 'inconclusive', why: `${name}: the judge did not read this capture, and an agent drive passes only with a judge pass on every capture` }))]
+                : run.journey !== null ? []
+                    : run.judge ? [{ level: 'inconclusive', why: 'the judge judged no capture (only PNG, JPEG and text captures are judged), and an agent drive passes only with a judge pass' }]
+                        : [{ level: 'inconclusive', why: 'the judge is off (--no-judge), and an agent drive passes only with a judge pass' }];
+            // With auto_fix.verify, screens the judge calls wrong (and nothing it was unsure of) are a product failure to fix.
+            if (tries && asks.length && asks.every((f) => f.level === 'fail'))
+                return { checked, end: { result: 'fail', reason: `judge: ${asks[0].why}` }, asks: [], fixable: wrongScreens(asks) };
+            if (asks.length)
+                return { checked, asks, fixable: [] };
+            if (checked.code !== PASS)
+                return { checked, end: { result: checked.code === FAIL ? 'fail' : 'inconclusive', reason: `${judgeFindings.length ? 'judge' : 'check'}: ${(judgeFindings[0] ?? checked.findings[0])?.why ?? 'did not pass'}` }, asks: [], fixable: [] };
+            return { checked, asks: [], fixable: [] };
         };
-        const checked = await runCheck(['--outcome', run.claim, ...files, ...(run.claim_id ? ['--claim-id', run.claim_id] : [])], { dir, judge: !!run.judge, judging, author: run.author });
-        const logged = { ...checked.result, findings: checked.findings };
-        delete logged.findings_omitted;
-        log('check', logged);
-        const judgeRan = step.name === 'judge';
-        const judgeFindings = judgeRan ? checked.findings.slice(checkFindings) : [];
-        if (judgeRan) {
-            log('judge', checked.judge);
-            set(step, judgeFindings.length ? 'failed' : 'completed', { exit: judgeFindings.length ? checked.code : PASS, findings: judgeFindings });
+        const h = { begin, set, log, spawned };
+        let p = await pass(run.repo);
+        let fixed = false;
+        // auto_fix.verify: the judge sorts the product failures first (an ask parks the run at the gate); then a checkout with
+        // uncommitted tracked changes is never fixed, since the fix starts from the committed head.
+        if (tries && p.end && p.fixable.length && journey?.spends)
+            p.end = { ...p.end, reason: `${p.end.reason}; auto_fix.verify does not re-run a spends journey` };
+        if (tries && p.end && p.fixable.length && !journey?.spends) {
+            const sorted = await sortJudged(run, cfg, failures(p.fixable), join(dir, 'agents', 'triage.json'), h);
+            if (typeof sorted === 'string')
+                return finish('blocked', `triage: ${sorted}`);
+            if (sorted.length)
+                p = { checked: p.checked, asks: sorted, fixable: [] };
+            else {
+                const dirty = dirtyTracked(run.repo);
+                if (dirty.length) {
+                    run.findings = failures(p.fixable);
+                    return finish('blocked', `dirty: uncommitted changes to tracked files (${named(dirty)}), so done-done does not fix this run (${p.end.reason}); commit them, or set auto_fix: { verify: 0 }, then run again`);
+                }
+                const f = await fixVerify(run, cfg, dir, p, tries, h, async (at, fix) => { const logs = (quiet = {}); const fixStep = step; try {
+                    return { ...(await pass(at, fix)), logs };
+                }
+                finally {
+                    quiet = null;
+                    step = fixStep;
+                } });
+                if ('blocked' in f)
+                    return finish('blocked', `fix: ${f.blocked}`);
+                p = f;
+                fixed = true;
+            }
         }
-        else
-            set(step, checked.code === PASS ? 'completed' : 'failed', { exit: checked.code, findings: checked.findings });
-        // The gate: when the check itself is clean but the judge did not pass a capture (or judged none of an agent's), the run
-        // waits for the caller (respond), who can move it on but never make it a pass. The runner ends here.
-        const clean = judgeRan ? checkFindings === 0 : checked.code === PASS;
-        const notJudged = judgeRan && run.journey === null ? (checked.judge?.not_judged ?? []) : [];
-        const asks = !clean ? [] : judgeRan ? [...judgeFindings, ...notJudged.map((name) => ({ level: 'inconclusive', why: `${name}: the judge did not read this capture, and an agent drive passes only with a judge pass on every capture` }))]
-            : run.journey === null ? [{ level: 'inconclusive', why: 'the judge judged no capture (only PNG and JPEG captures are judged), and an agent drive passes only with a judge pass' }] : [];
-        if (asks.length) {
+        if (p.asks.length) {
+            // auto_fix.verify never fixes a mixed result (wrong screens and unsure ones): the judge sorts the wrong ones, then all park.
+            const wrong = p.asks.filter((f) => f.level === 'fail');
+            if (tries && wrong.length && wrong.length < p.asks.length) {
+                const sorted = await sortJudged(run, cfg, failures(wrongScreens(wrong)), join(dir, 'agents', `triage${fixed ? '-gate' : ''}.json`), h, true);
+                if (typeof sorted !== 'string')
+                    p.asks = [...sorted, ...p.asks.filter((f) => f.level !== 'fail')];
+            }
             begin('gate');
-            const findings = asks.map((f, i) => ({ id: `gate-${i + 1}`, severity: f.level === 'fail' ? 'error' : 'warning', what: f.why, action: 'ask-user' }));
+            const findings = p.asks.map((f, i) => ({ id: `gate-${i + 1}`, severity: f.level === 'fail' ? 'error' : 'warning', what: f.why, action: 'ask-user' }));
+            const checked = p.checked;
             run.gate = { findings, cited: checked.cited, head: { commit: checked.head.commit, tree: checked.head.tree }, ...(checked.judgeBlock && { judge: checked.judgeBlock }) };
             run.status = 'awaiting_approval';
             set(step, 'awaiting_approval', { findings });
             return;
         }
-        if (checked.code !== PASS)
-            return finish(checked.code === FAIL ? 'fail' : 'inconclusive', `${judgeFindings.length ? 'judge' : 'check'}: ${(judgeFindings[0] ?? checked.findings[0])?.why ?? 'did not pass'}`);
+        if (p.end)
+            return finish(p.end.result, p.end.reason);
         begin('receipt');
-        const receipt = recordReceipt(run.repo, cfg, checked);
+        const receipt = recordReceipt(run.repo, cfg, p.checked);
         log('receipt', receipt.result);
         run.receipt = receipt.result.receipt;
         set(step, receipt.code === PASS ? 'completed' : 'failed', { exit: receipt.code });
         if (receipt.code !== PASS)
             return finish('fail', `receipt: ${receipt.result.reason}`);
-        finish('pass');
+        finish(fixed ? 'changed' : 'pass', fixed ? `your HEAD failed; the fix passes, on ${run.fix.branch}` : undefined);
     }
     catch (e) {
         for (const s of run.steps)
@@ -1169,6 +1597,142 @@ async function runSteps(dir) {
         clearInterval(beat);
     }
 }
+const failures = (list) => list.map((f, i) => ({ id: `F${i + 1}`, ...f }));
+const wrongScreens = (asks) => asks.map((f) => ({ kind: 'judge', file: f.file ?? '', what: f.why }));
+// What a verify fix never changes: the verify skill, .done-done.yaml, tests, test-runner configs and the checkout's copied ignored files. Other files a
+// journey runs are not guarded, so review the fix branch.
+const TEST_FILE = /(^|\/)(test|tests|__tests__|e2e|spec)\/|\.(test|spec)\.[^/]*$|_test\.(go|py)$|(^|\/)test_[^/]*\.py$|(^|\/)((playwright|jest|vitest|cypress)\.config\.[^/]*|cypress\.json)$/;
+// The judge's question for a screen it called wrong: the claim is the truth unless it looks wrong or needs a decision.
+const VERIFY_TRIAGE = {
+    question: 'is a screen the judge called wrong for an outcome claim: the claim says what a user can now do, and the screen did not show it. Which side should change? The claim is the truth unless it looks wrong, ambiguous or in need of a product decision.',
+    options: {
+        fix: 'The product clearly misses a clear claim, so the product code should change to make the outcome hold.',
+        ask: 'The claim may be wrong, is ambiguous, or the change needs a product decision, so a person must decide.',
+        unclear: 'The text cannot settle which side should change.',
+    },
+    fix: 'fix',
+};
+// The judge the user set (never the fixer's agent) sorts the judge's failures before each fix: [] sends them all to the fixer;
+// with any ask (or unsure answer), or `park`, every judge failure goes to the gate with its class. A string: why the judge did not answer.
+async function sortJudged(run, cfg, open, record, h, park = false) {
+    const judged = open.filter((f) => f.kind === 'judge');
+    if (!judged.length)
+        return [];
+    const step = h.begin('triage');
+    const choice = selectJudge(cfg, selectAgent(cfg), true);
+    const asks = await triage(cfg, choice, judged, VERIFY_TRIAGE, { app: cfg.app, outcome: run.claim, findings: judged }, record);
+    h.log('triage', { judge: { route: choice.route, model: choice.model, independence: choice.independence }, ask_user: asks });
+    h.set(step, typeof asks === 'string' ? 'failed' : 'completed');
+    if (typeof asks === 'string' || !(asks.length || park))
+        return typeof asks === 'string' ? asks : [];
+    return judged.map((f) => ({ level: 'fail', why: `${(asks.find((x) => x.id === f.id) ?? f).what}; triage: ${asks.some((x) => x.id === f.id) ? 'ask' : 'fix'}`, file: f.file }));
+}
+// auto_fix.verify: the user's agent fixes product code in a done-done worktree at the verified head, done-done commits it and
+// `again` verifies there, up to `tries` times; a pass or a gate keeps a done-done/verify-<run-id> branch, never the user's.
+async function fixVerify(run, cfg, dir, first, tries, h, again) {
+    const fixStep = h.begin('fix');
+    const repo = run.repo;
+    const skill = relative(repo, join(repo, cfg.skill));
+    const agent = selectAgent(cfg);
+    // done-done's own folders in the repo (an evidence root, DONE_DONE_HOME): a re-run writes there, so they are never the user's checkout.
+    const own = [cfg.evidence.root, home()].map((p) => under(repo, p)).filter((p) => p !== null);
+    const checkout = repoState(repo, own);
+    const ignored = git(repo, 'ls-files', '-z', '--others', '--ignored', '--exclude-standard', '--directory', ...pathspec(own)).split('\0').filter(Boolean);
+    const carried = (p) => ignored.some((c) => p === c || (c.endsWith('/') && p.startsWith(c)));
+    const off = (p) => p === '.done-done.yaml' || p.startsWith(`${skill}/`) || TEST_FILE.test(p) || carried(p);
+    const wt = join(dir, 'fix');
+    const scratch = join(dir, 'tmp');
+    const rounds = [];
+    let open = failures(first.fixable);
+    const record = JSON.parse(readFileSync(run.record, 'utf8'));
+    // The checkout's ignored state (node_modules, .env.local) is copied, never linked, into the worktree, and copied again over
+    // whatever the fixer did to it before each re-run, so the re-run sees the fix commit with the user's own ignored files.
+    // ponytail: a full copy each round (a clone where the file system can); a huge node_modules on ext4 is slow, link read-only if it bites.
+    const carry = () => {
+        git(wt, 'clean', '-fdqX');
+        for (const p of ignored) {
+            try {
+                cpSync(join(repo, p), join(wt, p), { recursive: true, verbatimSymlinks: true, mode: constants.COPYFILE_FICLONE });
+            }
+            catch (e) {
+                return `copy of your ignored ${p} into the fix worktree failed: ${errorText(e)}`;
+            }
+        }
+    };
+    const attempts = async (start) => {
+        let base = start;
+        const copied = carry();
+        if (copied)
+            return (h.set(fixStep, 'failed'), run.findings = open, { blocked: copied });
+        for (let k = 1; k <= tries; k++) {
+            const step = h.begin('fix');
+            const round = { attempt: k, failures: open };
+            rounds.push(round);
+            const close = (status) => (h.log('fix', { agent: agent.agent, model: agent.model, worktree: wt, rounds }), h.set(step, status));
+            const blocked = (reason, findings = open) => (Object.assign(round, { blocked: reason }), close('failed'), (run.findings = findings), { blocked: reason });
+            const drive = run.journey === null ? `It drove the verify skill feature ${skill}/features/${run.feature ?? '<the one the outcome is about>'}.md the way a user does (${skill}/SKILL.md says how the app is launched).` : `It drove the app with this journey command: ${cfg.journeys[run.journey]?.command}`;
+            const prompt = `You fix the ${cfg.app} app in this checkout, your working directory. done-done verify drove the real app to prove the outcome below, and it failed.
+${drive}
+
+Outcome to prove: ${run.claim}
+
+Failures (JSON): ${JSON.stringify(open)}
+
+Change the product's code so the outcome holds when a user takes that path. Never change the verify skill (${skill}/), .done-done.yaml, a test file (test/, tests/, __tests__/, e2e/, spec/, *.test.*, *.spec.*, *_test.go, *_test.py, test_*.py) or a test-runner config, and never make the outcome only look true. Do not commit, and do not run done-done. Put scratch files in ${scratch} (also in $TMPDIR).
+
+Answer with summary (what you changed, in one line) and blocker ("" when you fixed it, else why you could not).`;
+            mkdirSync(scratch, { recursive: true });
+            // A re-run's edits and new files are not the fixer's to commit. Ignored ones (a build) stay.
+            git(wt, 'reset', '-q', '--hard');
+            git(wt, 'clean', '-fdq');
+            const a = await askAgent({ ...agent, prompt, schema: FIX_SCHEMA, cwd: wt, tools: 'edit', record: join(dir, 'agents', `fix-${k}.json`), dirs: [scratch], env: { DONE_DONE_DRIVE: run.run_id, TMPDIR: scratch }, onSpawn: h.spawned });
+            Object.assign(round, { record: a.record ?? a.recordError, ...(a.ok ? { summary: a.answer?.summary, blocker: a.answer?.blocker } : { error: a.error }) });
+            // The diff guard: product code only, in the worktree only; anything else drops the attempt with the worktree.
+            const changed = (round.changed = changedSince(wt, base, false));
+            const problem = attemptProblem(repo, checkout, wt, base, agent.agent, a, changed, changed.filter(off), 'the verify skill, .done-done.yaml, a test file, a test-runner config or a copied ignored file of your checkout, which a fix never changes', 'the product', own);
+            if (problem)
+                return blocked(problem);
+            if (!changed.length)
+                return blocked(`${agent.agent} changed nothing`);
+            const made = commitFix(wt, base, `fix: done-done verify fixes ${run.claim.slice(0, 60)}`, ['.']);
+            if (typeof made === 'string')
+                return blocked(made);
+            if (made.files.some(off))
+                return blocked('the commit holds the verify skill, .done-done.yaml, a test file, a test-runner config or a copied ignored file (a commit hook added them), so no branch is made');
+            base = round.commit = made.commit;
+            run.fix = { commit: made.commit, record: join(recordsDir(cfg), `${run.run_id}-fix${k}.json`) };
+            // Verify again at the fix commit; its records are named fix<k>-, and the judge sorts its failures before the next fix.
+            const recopied = carry();
+            if (recopied)
+                return blocked(recopied);
+            const next = await again(wt, `fix${k}`);
+            round.rerun = { result: next.end?.result ?? (next.asks.length ? 'gate' : 'pass'), reason: next.end?.reason, ...next.logs };
+            if (next.end && !next.fixable.length)
+                return blocked(`the re-run after attempt ${k} did not pass: ${next.end.reason}`, []);
+            const sorted = next.end ? await sortJudged(run, cfg, failures(next.fixable), join(dir, 'agents', `triage-fix${k}.json`), h).catch((e) => { close('failed'); throw e; }) : [];
+            if (typeof sorted === 'string')
+                return blocked(`triage: ${sorted}`, failures(next.fixable));
+            if (!next.end || sorted.length) {
+                run.fix.branch = `done-done/verify-${run.run_id}`;
+                git(repo, 'branch', run.fix.branch, made.commit);
+                close('completed');
+                return sorted.length ? { checked: next.checked, asks: sorted, fixable: [] } : next;
+            }
+            open = failures(next.fixable);
+            close('completed');
+        }
+        run.findings = open;
+        return { blocked: `auto_fix.verify allows ${tries} ${tries === 1 ? 'attempt' : 'attempts'}, and the re-run still fails after them` };
+    };
+    return inWorktree(repo, wt, async (start) => {
+        try {
+            return await attempts(start);
+        }
+        finally {
+            git(wt, 'clean', '-fdqX');
+        }
+    }, record.commit);
+}
 // EPERM: the pid is alive but not ours to signal. A pid reused by another process still reads as alive: the known limit of a pid check.
 const alive = (pid) => {
     try {
@@ -1187,6 +1751,8 @@ const shownStatus = (run) => ((run.status === 'pending' || run.status === 'runni
 const reapJourney = (dir, run) => {
     if (run.runner?.journey_pgid && createOnce(join(dir, 'journey.killed')))
         killGroup(run.runner.journey_pgid);
+    if (run.runner?.instance_pgid && createOnce(join(dir, 'instance.killed')))
+        killGroup(run.runner.instance_pgid);
 };
 // One run as status shows it. A run still marked running whose runner is gone is shown as failed at its step.
 // `gone`: the caller saw its runner child exit, which also covers a runner that died before it wrote its pid.
@@ -1203,7 +1769,7 @@ function showRun(dir, cfg, command, gone = false) {
         reapJourney(dir, run);
     }
     // An overridden run is never a pass: it exits 1 like a fail.
-    const code = status === 'pending' || status === 'running' || status === 'awaiting_approval' ? WAITING : status === 'cancelled' || status === 'failed' || run.result === 'fail' || run.result === 'overridden' || run.result === 'drift' ? FAIL : run.result === 'inconclusive' || run.result === 'blocked' ? INCONCLUSIVE : PASS;
+    const code = status === 'pending' || status === 'running' || status === 'awaiting_approval' ? WAITING : status === 'cancelled' || status === 'failed' || run.result === 'fail' || run.result === 'overridden' || run.result === 'drift' || (run.kind === 'verify' && (run.result === 'changed' || run.result === 'blocked')) ? FAIL : run.result === 'inconclusive' || run.result === 'blocked' ? INCONCLUSIVE : PASS;
     const drive = run.journey ?? (run.feature ? `--feature ${arg(run.feature)}` : '');
     const judgeFlag = run.judge === false && cfg.judge.enabled !== false ? ' --no-judge' : run.judge && cfg.judge.enabled === false ? ' --judge' : '';
     const again = run.kind === 'maintain' ? 'done-done maintain' : `done-done verify ${drive ? `${drive} ` : ''}--outcome ${arg(run.claim)}${run.claim_id ? ` --claim-id ${arg(run.claim_id)}` : ''}${judgeFlag}`;
@@ -1226,10 +1792,14 @@ function showRun(dir, cfg, command, gone = false) {
         result.findings = run.gate.findings;
     if (run.response)
         result.response = run.response;
+    if (run.spend)
+        result.spend = run.spend;
     if (ev.items.length)
         result.evidence = ev.items;
     if (ev.omitted)
         result.evidence_omitted = ev.omitted;
+    if (rec?.matrix)
+        result.matrix = rec.matrix;
     if (run.receipt)
         result.receipt = run.receipt;
     if (run.fix)
@@ -1248,25 +1818,31 @@ function showRun(dir, cfg, command, gone = false) {
     result.run = shown(run.repo, dir);
     const id = run.run_id;
     result.help =
-        status === 'awaiting_approval' ? [
-            'Read the findings and look at the captures (evidence above), then answer the gate:',
-            `done-done respond --run ${id} --action approve --reason "<why they do show the outcome>"   (ends overridden, never pass)`,
-            `done-done respond --run ${id} --action skip --reason "<why to go on without a judge pass>"   (ends overridden, never pass)`,
-            `done-done respond --run ${id} --action fix   (ends fail; fix the product, or the verify skill's recipe (done-done maintain checks it against the source), commit, then: done-done rerun --run ${id})`,
+        status === 'awaiting_approval' && run.gate?.spend ? [
+            `Ask the user whether to spend ${run.gate.spend} on this run; never decide it for them. Their yes runs the journey:`,
+            `done-done respond --run ${id} --action approve --reason "<who approved the spend>"`,
+            `Their no: done-done respond --run ${id} --action skip --reason "<why they said no>"   (ends fail, nothing spent)`,
         ]
-            : run.result === 'overridden' ? [`This head is not proven: ${run.response?.by} chose ${run.response?.action} past the judge, and receipt --verify refuses this receipt`, `Capture proof the judge passes: ${again}`]
-                : code === WAITING ? [`The run goes on without this command; read it later: done-done status --run ${run.run_id}`]
-                    : run.kind === 'maintain' && status === 'completed' ? (run.result === 'clean' ? [`The verify skill matches the source; read the readers' recipes: done-done logs --step reconcile --run ${run.run_id}`]
-                        : run.result === 'changed' ? [`Review the fix on its own branch (your branch is untouched): git show ${run.fix.branch}`, `Take it: git merge ${run.fix.branch}, or drop it: git branch -D ${run.fix.branch}`]
-                            : run.result === 'drift' ? [`Fix the findings in ${cfg.skill} (--full lists them all), commit, then run again: ${again}`, `Or let done-done's agent fix them on a branch: set auto_fix: { maintain: 2 } in .done-done.yaml, then run again: ${again}`]
-                                : /^ask-user:/.test(run.reason ?? '') ? ['Ask the user about each ask-user finding: is the product or the skill wrong? Never decide it for them', `Product wrong: fix the product (maintain never edits product code). Skill wrong: fix ${cfg.skill}, commit, then run again: ${again}`]
-                                    : /^fix:/.test(run.reason ?? '') ? [`Read what each fix attempt did: done-done logs --step fix --run ${run.run_id}`, `Fix the findings in ${cfg.skill} by hand, commit, then run again: ${again}`]
-                                        : /^locate: no verify skill/.test(run.reason ?? '') ? ['Create the verify skill: done-done init']
-                                            : /^locate:/.test(run.reason ?? '') ? [`Make ${cfg.skill} a real folder inside the repository (not a link), commit, then run again: ${again}`]
-                                                : [`Read the step logs in ${shown(run.repo, join(dir, 'logs'))}`, `Fix the cause, then run again: ${again}`])
-                        : code === PASS ? [`Verify this receipt (CI or merge): done-done receipt --verify ${rec.commit}`]
-                            : status === 'cancelled' ? [...(run.kind === 'maintain' ? [] : [`Start again from the failed step: done-done rerun --run ${run.run_id}`]), `List past runs: done-done history`]
-                                : [`Read the step logs in ${shown(run.repo, join(dir, 'logs'))}`, ...(run.kind === 'maintain' ? [] : [`Fix the cause, commit, then run again from the failed step: done-done rerun --run ${run.run_id}`]), `Or start a new run: ${again}`];
+            : status === 'awaiting_approval' ? [
+                'Read the findings and look at the captures (evidence above), then answer the gate:',
+                `done-done respond --run ${id} --action approve --reason "<why they do show the outcome>"   (ends overridden, never pass)`,
+                `done-done respond --run ${id} --action skip --reason "<why to go on without a judge pass>"   (ends overridden, never pass)`,
+                `done-done respond --run ${id} --action fix   (ends fail; fix the product, or the verify skill's recipe (done-done maintain checks it against the source), commit, then: done-done rerun --run ${id})`,
+            ]
+                : run.result === 'overridden' ? [`This head is not proven: ${run.response?.by} chose ${run.response?.action} past the judge, and receipt --verify refuses this receipt`, `Capture proof the judge passes: ${again}`]
+                    : code === WAITING ? [`The run goes on without this command; read it later: done-done status --run ${run.run_id}`]
+                        : run.kind === 'verify' && /^fix:/.test(run.reason ?? '') ? [`Read what each fix attempt did: done-done logs --step fix --run ${id}`, `Fix the product by hand, commit, then run again: ${again}`]
+                            : run.result === 'changed' ? [`Review the fix on its own branch (your branch is untouched): git show ${run.fix.branch}`, `Take it: git merge ${run.fix.branch}, or drop it: git branch -D ${run.fix.branch}`]
+                                : run.kind === 'maintain' && status === 'completed' ? (run.result === 'clean' ? [`The verify skill matches the source; read the readers' recipes: done-done logs --step reconcile --run ${run.run_id}`]
+                                    : run.result === 'drift' ? [`Fix the findings in ${cfg.skill} (--full lists them all), commit, then run again: ${again}`, `Or let done-done's agent fix them on a branch: set auto_fix: { maintain: 2 } in .done-done.yaml, then run again: ${again}`]
+                                        : /^ask-user:/.test(run.reason ?? '') ? ['Ask the user about each ask-user finding: is the product or the skill wrong? Never decide it for them', `Product wrong: fix the product (maintain never edits product code). Skill wrong: fix ${cfg.skill}, commit, then run again: ${again}`]
+                                            : /^fix:/.test(run.reason ?? '') ? [`Read what each fix attempt did: done-done logs --step fix --run ${run.run_id}`, `Fix the findings in ${cfg.skill} by hand, commit, then run again: ${again}`]
+                                                : /^locate: no verify skill/.test(run.reason ?? '') ? ['Create the verify skill: done-done init']
+                                                    : /^locate:/.test(run.reason ?? '') ? [`Make ${cfg.skill} a real folder inside the repository (not a link), commit, then run again: ${again}`]
+                                                        : [`Read the step logs in ${shown(run.repo, join(dir, 'logs'))}`, `Fix the cause, then run again: ${again}`])
+                                    : code === PASS ? [`Verify this receipt (CI or merge): done-done receipt --verify ${rec.commit}`]
+                                        : status === 'cancelled' ? [...(run.kind === 'maintain' ? [] : [`Start again from the failed step: done-done rerun --run ${run.run_id}`]), `List past runs: done-done history`]
+                                            : [`Read the step logs in ${shown(run.repo, join(dir, 'logs'))}`, ...(run.kind === 'maintain' ? [] : [`Fix the cause, commit, then run again from the failed step: done-done rerun --run ${run.run_id}`]), `Or start a new run: ${again}`];
     emit(result);
     return code;
 }
@@ -1275,10 +1851,36 @@ async function waitRun(dir, pid) {
         await new Promise((r) => setTimeout(r, 200));
 }
 // The judge a command will start: the user's agent and judge (asked for when unset), refused when it is the author.
-async function preflightJudge(cfg) {
-    await withChoice('agent', cfg);
+async function preflightJudge(cfg, needsAgent = true, fix = false) {
+    if (needsAgent)
+        await withChoice('agent', cfg);
     await withChoice('judge', cfg);
-    return selectJudge(cfg, selectAgent(cfg));
+    return selectJudge(cfg, cfg.agent ? selectAgent(cfg) : NO_AUTHOR, fix);
+}
+const NO_AUTHOR = { agent: '', model: '' };
+// A run waiting at its gate is the user's call, so a new verify or rerun is refused until the user answers that run or it is
+// aborted: starting another would go around its gate. Only a run of this checkout counts, keyed by its claim id, else the branch it
+// started on; a run with neither (recorded by an older build) blocks every new run in this checkout.
+function refuseParked(cfg, repo, claim) {
+    const parked = runsIn(runsRoot(cfg.app)).filter((r) => {
+        const key = r.claim_id ?? r.branch;
+        return r.kind === 'verify' && r.status === 'awaiting_approval' && r.repo === repo && (key === claim || key === undefined);
+    }).map((r) => r.run_id);
+    if (!parked.length)
+        return;
+    const id = parked[0];
+    throw new UsageError(`run ${parked.join(', ')} waiting at its gate for the user's answer blocks this run, which would go around that gate`, `Show the user its findings and captures (done-done status --run ${id}), then answer with their choice: done-done respond --run ${id} --action approve|skip|fix [--reason "<why>"], or stop it: done-done abort --run ${id}`);
+}
+// Before a verify starts: its judge, and with auto_fix.verify an agent that can edit and a judge that is never that agent.
+async function preflightVerify(cfg, judging) {
+    if (cfg.auto_fix.verify) {
+        await withChoice('agent', cfg);
+        if (cfg.agent.startsWith('acp:'))
+            throw new UsageError(`${cfg.agent} cannot fix the product: done-done runs ACP agents with every tool denied`, `Set auto_fix.verify: 0 to report only, or set agent: to one of ${AGENTS.join(', ')}`);
+    }
+    if (!judging)
+        return;
+    await preflightJudge(cfg, true, !!cfg.auto_fix.verify);
 }
 async function cmdVerify(argv) {
     const { values, positionals } = parseArgs({
@@ -1307,21 +1909,22 @@ async function cmdVerify(argv) {
         throw new UsageError(`unknown journey ${journey}; .done-done.yaml defines: ${names.join(', ') || 'none'}`);
     if (values['claim-id']?.trim() === '')
         throw new UsageError('--claim-id needs a non-empty id');
-    if (!values['claim-id'] && !git(repo, 'branch', '--show-current'))
+    const branch = git(repo, 'branch', '--show-current');
+    if (!values['claim-id'] && !branch)
         throw new UsageError('HEAD is detached, so no branch names this claim; pass --claim-id <id>');
+    refuseParked(cfg, repo, values['claim-id'] ?? branch);
     const drive = journey === null ? await agentDrive(repo, cfg, values.feature) : undefined;
     // verify starts done-done's own judge by default; --no-judge or judge.enabled: false turns it off. An agent drive is judged too, since the author never grades its own captures.
     const judging = !values['no-judge'] && (!!drive || !!values.judge || cfg.judge.enabled !== false);
     // No judge set, or one config forbids (the author's own agent and model), is a usage error now, not a failed run later.
-    if (judging)
-        await preflightJudge(cfg);
+    await preflightVerify(cfg, judging);
     const id = newRunId(git(repo, 'rev-parse', 'HEAD'));
     const dir = join(runsRoot(cfg.app), id);
     mkdirSync(join(dir, 'logs'), { recursive: true });
     const created = now();
     const run = {
-        schema: 2, run_id: id, kind: 'verify', app: cfg.app, repo, journey, ...drive, claim: values.outcome, claim_id: values['claim-id'] ?? null, judge: judging, status: 'pending',
-        steps: STEPS.map((name) => ({ name, status: 'pending' })), created, updated: created,
+        schema: 2, run_id: id, kind: 'verify', app: cfg.app, repo, journey, ...drive, claim: values.outcome, claim_id: values['claim-id'] ?? null, branch, judge: judging, status: 'pending',
+        steps: verifySteps(cfg).map((name) => ({ name, status: 'pending' })), created, updated: created,
         inputs: inputsOf(repo, cfg, journey, drive?.author),
     };
     saveRun(dir, run);
@@ -1353,8 +1956,8 @@ async function cmdMaintain(argv) {
     // auto_fix: the agent the user set fixes the skill and the judge the user set (never that agent and model) triages, so both are set now.
     if (cfg.auto_fix.maintain) {
         if (cfg.agent.startsWith('acp:'))
-            throw new UsageError(`${cfg.agent} cannot fix the verify skill: done-done runs ACP agents with every tool denied`, `Set auto_fix.maintain: 0 to report only, or set agent: to one of ${AGENTS.filter(supported).join(', ')}`);
-        refuseSameSession(await preflightJudge(cfg));
+            throw new UsageError(`${cfg.agent} cannot fix the verify skill: done-done runs ACP agents with every tool denied`, `Set auto_fix.maintain: 0 to report only, or set agent: to one of ${AGENTS.join(', ')}`);
+        await preflightJudge(cfg, true, true);
     }
     const id = newRunId(git(repo, 'rev-parse', 'HEAD'));
     const dir = join(runsRoot(cfg.app), id);
@@ -1434,30 +2037,33 @@ async function cmdRerun(argv) {
     const open = shownStatus(src);
     if (open === 'pending' || open === 'running')
         throw new UsageError(`run ${srcId} is still ${open}, so it cannot be rerun while its runner lives`, `Read it: done-done status --run ${srcId}; stop it first: done-done abort --run ${srcId}`);
-    const group = src.runner?.journey_pgid;
+    const group = src.runner?.journey_pgid ?? src.runner?.instance_pgid;
     if (['pending', 'running'].includes(src.status) && group && alive(-group))
         throw new UsageError(`the journey of run ${srcId} is still running, so it cannot be rerun yet`, `Read it: done-done status --run ${srcId}`);
+    // The rerun keeps its source's claim and branch, so the gate it is checked against is the source's.
+    refuseParked(cfg, src.repo, src.claim_id ?? src.branch);
     // A source run with no journey is driven again by the author agent config names now; schema 2 runs before PR 4 always had a journey.
     const journey = src.journey ?? null;
     const drive = journey === null ? await agentDrive(src.repo, cfg, src.feature) : undefined;
-    const inputs = inputsOf(src.repo, loadConfig(src.repo), journey, drive?.author);
+    const srcCfg = loadConfig(src.repo);
+    const inputs = inputsOf(src.repo, srcCfg, journey, drive?.author);
     const same = !!src.inputs && ['head', 'journey', 'skill'].every((k) => src.inputs[k] === inputs[k]);
-    const driveReuse = same && drivesClean(src.record, src.inputs?.head);
+    // A reused drive keeps the guard it ran under, so it is only reused when the watched inputs are the same ones.
+    const driveReuse = same && drivesClean(src.record, src.inputs?.head) && JSON.stringify(src.guarded?.patterns ?? []) === JSON.stringify(srcCfg.inputs);
     const reused = (name) => (name === 'resolve' && same) || (name === 'drive' && driveReuse);
     // A rerun judges as its source did; --no-judge turns it off for this run. A missing or forbidden judge is a usage
     // error here too.
     const judging = !values['no-judge'] && !!src.judge;
-    if (judging)
-        await preflightJudge(cfg);
+    await preflightVerify(cfg, judging);
     const id = newRunId(git(repo, 'rev-parse', 'HEAD'));
     const dir = join(root, id);
     mkdirSync(join(dir, 'logs'), { recursive: true });
-    const steps = STEPS.map((name) => {
+    const steps = verifySteps(cfg).map((name) => {
         const s = src.steps.find((x) => x.name === name);
         return s && reused(name) && s.status === 'completed' ? { ...s } : { name, status: 'pending' };
     });
     const created = now();
-    const run = { schema: 2, run_id: id, kind: src.kind, app: cfg.app, repo: src.repo, journey, ...drive, claim: src.claim, claim_id: src.claim_id, judge: judging, status: 'pending', inputs, steps, created, updated: created, ...(driveReuse && src.record && { record: src.record }) };
+    const run = { schema: 2, run_id: id, kind: src.kind, app: cfg.app, repo: src.repo, journey, ...drive, claim: src.claim, claim_id: src.claim_id, branch: src.branch, judge: judging, status: 'pending', inputs, steps, created, updated: created, ...(driveReuse && src.record && { record: src.record }), ...(driveReuse && src.guarded && { guarded: src.guarded }) };
     saveRun(dir, run);
     for (const s of steps) {
         const f = join(root, srcId, 'logs', `${s.name}.log`);
@@ -1490,28 +2096,43 @@ async function cmdAbort(argv) {
     if (closed(latest))
         return FAIL;
     // A run waiting at its gate has no runner left; the respond lock keeps abort and respond from both closing it.
-    const parked = latest.status === 'awaiting_approval';
-    if (parked && !createOnce(join(dir, 'respond.lock'))) {
+    const gated = latest.status === 'awaiting_approval';
+    const answering = () => {
         emit({ command: 'abort', run_id: id, status: latest.status, reason: `run ${id} is being answered at its gate, so it was not cancelled`, help: [`Read the run: done-done status --run ${id}`] });
         return FAIL;
+    };
+    if (gated && !createOnce(join(dir, 'respond.lock')))
+        return answering();
+    const read = () => { try {
+        return loadRun(dir);
     }
-    if (!parked && latest.runner && !isOurRunner(latest.runner.pid, dir)) {
-        emit({ command: 'abort', run_id: id, status: latest.status, reason: `could not confirm pid ${latest.runner.pid} is this run's runner, so nothing was killed or cancelled`, help: [`Read the run: done-done status --run ${id}`] });
+    catch (e) {
+        if (gated)
+            rmSync(join(dir, 'respond.lock'), { force: true });
+        throw e;
+    } };
+    const current = read();
+    if (gated && current.status !== 'awaiting_approval') {
+        rmSync(join(dir, 'respond.lock'), { force: true });
+        return answering();
+    }
+    if (!gated && current.runner && !isOurRunner(current.runner.pid, dir)) {
+        emit({ command: 'abort', run_id: id, status: current.status, reason: `could not confirm pid ${current.runner.pid} is this run's runner, so nothing was killed or cancelled`, help: [`Read the run: done-done status --run ${id}`] });
         return FAIL;
     }
-    if (!parked && latest.runner) {
+    if (!gated && current.runner) {
         try {
-            process.kill(-latest.runner.pid, 'SIGKILL');
+            process.kill(-current.runner.pid, 'SIGKILL');
         }
         catch {
             try {
-                process.kill(latest.runner.pid, 'SIGKILL');
+                process.kill(current.runner.pid, 'SIGKILL');
             }
             catch { /* exited since the check */ }
         }
-        await waitGone(latest.runner.pid);
+        await waitGone(current.runner.pid);
     }
-    const after = loadRun(dir);
+    const after = read();
     if (closed(after, after.status))
         return FAIL;
     try {
@@ -1522,7 +2143,8 @@ async function cmdAbort(argv) {
         saveRun(dir, after);
     }
     catch (e) {
-        rmSync(join(dir, 'respond.lock'), { force: true });
+        if (gated)
+            rmSync(join(dir, 'respond.lock'), { force: true });
         throw e;
     }
     emit({ command: 'abort', run_id: id, status: 'cancelled', reason: after.reason, help: [`Read the run: done-done status --run ${id}`, ...startAgain(after)] });
@@ -1540,7 +2162,7 @@ function answeredBy(repo) {
 // Answer a run waiting at its gate. approve and skip write the receipt as overridden (with who and why) and end the run
 // overridden, never pass; fix ends it fail. The runner has exited, so this command finishes the run; the respond lock
 // lets only one answer (or an abort) close it.
-function cmdRespond(argv) {
+async function cmdRespond(argv) {
     const { values } = parseArgs({ args: argv, options: { run: { type: 'string' }, action: { type: 'string' }, reason: { type: 'string' } } });
     const action = values.action;
     if (action !== 'approve' && action !== 'skip' && action !== 'fix')
@@ -1553,14 +2175,33 @@ function cmdRespond(argv) {
     const root = runsRoot(cfg.app);
     const id = pickId(root, repo, 'respond', cfg, values.run);
     const dir = join(root, id);
-    const run = loadRun(dir);
-    if (run.status !== 'awaiting_approval' || !run.gate || !createOnce(join(dir, 'respond.lock')))
-        throw new UsageError(`run ${id} is not waiting at its gate (it is ${run.status === 'awaiting_approval' ? 'being answered' : shownStatus(run)})`, `Read it: done-done status --run ${id}`);
+    const notAtGate = (r) => new UsageError(`run ${id} is not waiting at its gate (it is ${r.status === 'awaiting_approval' ? 'being answered' : shownStatus(r)})`, `Read it: done-done status --run ${id}`);
+    if (!createOnce(join(dir, 'respond.lock')))
+        throw notAtGate(loadRun(dir));
     try {
+        const run = loadRun(dir);
+        if (run.status !== 'awaiting_approval' || !run.gate)
+            throw notAtGate(run);
+        if (run.gate.spend && action === 'fix')
+            throw new UsageError(`run ${id} is at a spend gate, which takes --action approve or skip`, `Run: done-done respond --run ${id} --action approve|skip --reason "<why>"`);
         const gate = run.steps.find((s) => s.name === 'gate');
         const by = answeredBy(repo);
         run.response = { action, by, ...(reason && { reason }), at: now() };
         logEvent(dir, { step: 'gate', response: action, by, ...(reason && { reason }) });
+        // The spend gate: approve runs the journey in a new runner; skip or fix ends the run with nothing spent.
+        if (run.gate.spend) {
+            const drive = run.steps.find((s) => s.name === 'drive');
+            if (action !== 'approve') {
+                setStep(dir, run, drive, 'failed');
+                finishRun(dir, run, 'fail', `gate: ${by} chose ${action}: the journey was not run, so nothing was spent`);
+                return showRun(dir, cfg, 'respond');
+            }
+            Object.assign(run, { spend: { by, reason, at: run.response.at }, status: 'pending', gate: undefined, response: undefined, runner: undefined });
+            setStep(dir, run, drive, 'pending');
+            for (const lock of ['runner.lock', 'respond.lock'])
+                rmSync(join(dir, lock));
+            return launch(dir, cfg, 'respond', {});
+        }
         if (action === 'fix') {
             setStep(dir, run, gate, 'failed');
             finishRun(dir, run, 'fail', `gate: ${by} chose fix: ${reason || run.gate.findings[0].what}`);
@@ -1581,6 +2222,109 @@ function cmdRespond(argv) {
         throw e;
     }
 }
+// sign-off's communication contract v1 (github.com/umeranjum17/sign-off, docs/contract.md): done-done sends `gate` and
+// `evidence`, schema 1. Each value is checked against the contract's limits first, so a run that cannot make a valid
+// message writes no file. done-done never posts it: sign-off is the user's choice, so the help line names the post command.
+const GATE_LABELS = { approve: 'Approve', skip: 'Skip the judge', fix: 'Fix first' };
+function cmdSignoff(argv) {
+    const { values } = parseArgs({ args: argv, options: { run: { type: 'string' } } });
+    const repo = repoRoot();
+    const cfg = loadConfig(repo);
+    const root = runsRoot(cfg.app);
+    const id = pickId(root, repo, 'signoff', cfg, values.run);
+    const run = loadRun(join(root, id));
+    const refuse = (what, help) => { throw new UsageError(`run ${id} cannot make a valid sign-off message, so no file was written: ${what}`, help); };
+    const text = (field, v, max, help = `Read it: done-done status --run ${id}`) => {
+        const n = [...v].length;
+        if (!/\S/.test(v) || n > max)
+            refuse(`${field} is ${n} characters, and the contract takes 1-${max}`, help);
+        if (/[\u0000-\u0009\u000b-\u001f\u007f-\u009f]|\p{Cs}/u.test(v))
+            refuse(`${field} holds a control character or half of a character`, help);
+        return v;
+    };
+    // At most 116 characters, so dd-evidence-<run id> is still a key-set id (1-128).
+    const runRef = (commit) => /^[A-Za-z0-9._-]{1,116}$/.test(id) && /^[0-9a-f]{40}$/.test(commit) ? { run_id: id, commit } : refuse(`run_id ${id} or commit ${commit} is not in the contract's shape`, 'Start a new run: done-done verify --outcome "<what a user can now do>"');
+    const drove = run.journey ?? run.feature ?? 'agent drive';
+    // A finding names the folder that captured it (this run's, a -fixN pass's or a reused source run's), so the message
+    // names the capture file alone: strip any <evidence root>/<one run folder>/ prefix.
+    const esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const bare = (s) => s.replaceAll(new RegExp(`${esc(cfg.evidence.root)}${esc(sep)}[^${esc(sep)}]+${esc(sep)}`, 'g'), '');
+    let msg, file;
+    if (run.kind === 'verify' && run.status === 'awaiting_approval' && run.gate) {
+        const { findings, spend, head } = run.gate;
+        const more = findings.length > 1 ? ` (and ${findings.length - 1} more)` : '';
+        msg = {
+            contract: 1, kind: 'gate', schema: 1, key: `dd-gate-${id}`, filer: 'done-done',
+            title: text('title', spend ? `Spend ${spend} on the ${cfg.app} ${drove} run?` : `Move the ${cfg.app} ${drove} run on past its judge?`, 160),
+            about: text('about', `${bare(findings[0].what)}${more}`, 500), run: runRef(head.commit),
+            // A spend gate takes approve or skip only (respond refuses fix there).
+            options: (spend ? ['approve', 'skip'] : ['approve', 'skip', 'fix']).map((value) => ({ value, label: GATE_LABELS[value] })),
+            recommend_value: findings.some((f) => f.severity === 'error') ? 'fix' : 'approve', close: 'done',
+        };
+        file = join(root, id, 'signoff-gate.json');
+    }
+    else if (run.kind === 'verify' && run.status === 'completed' && run.record) {
+        // A run auto_fix.verify fixed proves the fix pass, never the first failing pass: the receipt is bound to the fix commit.
+        const fixed = run.result === 'changed' && run.fix?.record ? run.fix : undefined;
+        // The message sits in the folder of the run that made the captures (a rerun that reused its drive sends its source's),
+        // so each media path is relative to it and stays inside it.
+        const again = `Capture it again: done-done rerun --run ${id}`;
+        let rec, folder;
+        try {
+            rec = JSON.parse(readFileSync(fixed?.record ?? run.record, 'utf8'));
+        }
+        catch {
+            return refuse('its run record is missing or unreadable', again);
+        }
+        try {
+            folder = realpathSync(runDir(cfg, rec.run_id));
+        }
+        catch {
+            return refuse('its run folder is missing', again);
+        }
+        if (!under(realpathSync(cfg.evidence.root), folder))
+            refuse(`its run folder ${rec.run_id} is outside the evidence root`, again);
+        const names = rec.files.map((f) => {
+            let p, bytes;
+            try {
+                p = realpathSync(join(cfg.evidence.root, f.path));
+                bytes = readFileSync(p);
+            }
+            catch {
+                return refuse(`${f.path} is missing`, again);
+            }
+            if (!under(folder, p) || sha256(bytes) !== f.sha256)
+                refuse(`${f.path} left the run folder or changed after the run`, again);
+            return { name: relative(folder, p), media: /\.(png|jpe?g|webp|mp4|webm)$/i.test(p) && f.bytes <= 50_000_000 };
+        });
+        if (!names.length)
+            refuse('the run recorded no captures, so it has no evidence to send', `Read it: done-done status --run ${id}`);
+        const media = names.filter((f) => f.media).slice(0, 12).map((f) => f.name);
+        const shown = names.slice(0, 12).map((f) => f.name).join(', ') + (names.length > 12 ? `, and ${names.length - 12} more in the run folder` : '');
+        const redo = 'Start a run whose --outcome fits: done-done verify --outcome "<what a user can now do>"';
+        msg = {
+            contract: 1, kind: 'evidence', schema: 1, key: `dd-evidence-${id}`, filer: 'done-done',
+            title: text('title', `${cfg.app} ${drove}: verify ${run.result}`, 160), about: text('about (the outcome)', run.claim, 500, redo),
+            ...(media.length && { media }),
+            run: {
+                ...runRef(rec.commit), outcome: text('outcome', run.claim, 1000, redo),
+                repro: text('repro', [`done-done verify`, run.journey ?? (run.feature && `--feature ${run.feature}`), `--outcome "${run.claim}" at ${rec.commit}`].filter(Boolean).join(' ') + (fixed?.branch ? ` on branch ${fixed.branch}` : ''), 1000, redo),
+                proof: text('proof', `${existsSync(join(repo, cfg.skill)) ? basename(cfg.skill) : 'no verify skill'}: done-done verify ${drove}, run ${id}: ${run.result}${run.reason ? ` (${run.reason})` : ''}`, 1000),
+                evidence: text('evidence', shown, 1000),
+            },
+        };
+        file = join(folder, 'signoff-evidence.json');
+    }
+    else
+        return refuse(`it is ${shownStatus(run)}${run.kind === 'verify' ? '' : ` (a ${run.kind} run)`}; signoff writes a gate for a verify run waiting at its gate, or evidence for a finished verify run`, `Read it: done-done status --run ${id}`);
+    writeFileSync(file, `${JSON.stringify(msg, null, 2)}\n`);
+    const at = citable(repo, file);
+    emit({ command: 'signoff', run_id: id, kind: msg.kind, file: at, help: [`Post it to the sign-off board (done-done never posts): npx -y sign-off-axi post --kind ${msg.kind} --from ${arg(at)}`] });
+    return PASS;
+}
+function runsOf(repo, cfg) {
+    return runsIn(runsRoot(cfg.app)).filter((r) => r.repo === repo).sort((a, b) => b.created.localeCompare(a.created));
+}
 function cmdHistory(argv) {
     const { values } = parseArgs({ args: argv, options: { limit: { type: 'string' } } });
     if (values.limit !== undefined && (!/^\d+$/.test(values.limit) || Number(values.limit) <= 0))
@@ -1588,9 +2332,7 @@ function cmdHistory(argv) {
     const n = values.limit === undefined ? Infinity : Number(values.limit);
     const repo = repoRoot();
     const cfg = loadConfig(repo);
-    const root = runsRoot(cfg.app);
-    const mine = existsSync(root) ? readdirSync(root).filter((x) => existsSync(join(root, x, 'run.json'))).map((x) => loadRun(join(root, x))).filter((r) => r.repo === repo).sort((a, b) => b.created.localeCompare(a.created)) : [];
-    const matched = mine.slice(0, n);
+    const matched = runsOf(repo, cfg).slice(0, n);
     const rows = cap(matched.map((r) => ({ run_id: r.run_id, kind: r.kind, status: shownStatus(r), ...(r.result && { result: r.result }), ...(r.kind === 'verify' && { claim: r.claim, journey: r.journey }), created: r.created })));
     emit({ command: 'history', runs: matched.length, history: rows.items, ...(rows.omitted && { history_omitted: rows.omitted }), help: rows.items.length ? [`Read the newest run: done-done status --run ${rows.items[0].run_id}`] : ['Start one: done-done verify --outcome "<what a user can now do>"'] });
     return PASS;
@@ -1611,8 +2353,9 @@ function ensureIgnored(repo, rel) {
 }
 // `init` also scaffolds the project's verify skill from the repo's own files: a port of the
 // fleet create-verification-skill interview (surface, run, drive, observe, isolate).
-// Scaffold only: where only a live drive can fill a blank, a TODO marker stands in place of
-// an invented command. An existing skill is never overwritten, so re-run is idempotent.
+// Every line is an action: a detected handle gets concrete drive and capture steps, and a blank detection cannot
+// fill gets the steps to find it and record it there, never an invented command. An existing skill is never
+// overwritten, so re-run is idempotent.
 function headText(p, max = 12000) {
     try {
         if (!lstatSync(p).isFile())
@@ -1623,6 +2366,8 @@ function headText(p, max = 12000) {
         return '';
     }
 }
+// Where a drive stops and how it records what it found, for every step that asks it to find something.
+const RECORD = 'once the drive works, write what you found here in place of this instruction (after the drive: a `done-done verify` drive changes no repo file)';
 const slug = (t) => t.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 40) || 'feature';
 const SKIP_DIRS = new Set(['node_modules', 'dist', 'build', 'out', 'vendor', 'coverage', 'target', 'venv', '__pycache__', 'bower_components']);
 const SOURCE_FILE = /\.(m?[jt]s|py|go|rb|rs|php)$/;
@@ -1667,60 +2412,86 @@ function detectApp(repo) {
     let text = `${scripts.dev ?? ''}\n${scripts.start ?? ''}\n${make}`;
     for (const f of sourceFiles(repo, 40))
         text += `\n${headText(f, 6000)}`;
-    const routes = [...text.matchAll(/\b(app|router|server|api|fastify|routes|r)\.(get|post|put|patch|delete|del|use)\(\s*['"`](\/[^'"`\s]*)/g)]
-        .map((m) => `${m[2].toUpperCase()} ${m[3]}`)
+    const routes = [...text.matchAll(/\b(app|router|server|api|fastify|routes|r)\.(get|post|put|patch|delete|del)\(\s*['"`](\/[^'"`\s]*)/g)]
+        .map((m) => `${m[2] === 'del' ? 'DELETE' : m[2].toUpperCase()} ${m[3]}`)
         .filter((r, i, a) => a.indexOf(r) === i);
     const commands = [...text.matchAll(/\.command\(\s*['"`]([^'"`\s\]]+)/g)]
         .map((m) => m[1])
         .filter((c, i, a) => a.indexOf(c) === i);
-    const web = has('react', 'next', 'vue', 'nuxt', 'svelte', 'solid', 'vite', 'webpack', 'playwright', '@playwright/test', 'cypress', 'puppeteer');
+    const browserTests = has('playwright', '@playwright/test', 'cypress', 'puppeteer');
+    const web = browserTests || has('react', 'next', 'vue', 'nuxt', 'svelte', 'solid', 'vite', 'webpack');
     const cliish = bins.length > 0 || commands.length > 0 || has('commander', 'yargs', 'oclif', 'cac');
     const api = routes.length > 0 || has('express', 'fastify', 'koa', 'hono');
     const surface = web ? 'web UI' : cliish ? 'CLI' : api ? 'API/service' : 'app (unrecognized surface)';
     const launch = scripts.dev ? `npm run dev (${scripts.dev})`
         : scripts.start ? `npm start (${scripts.start})`
             : bins.length ? `node ${bins[0]} --help`
-                : make ? 'TODO(live drive): pick the dev target from the Makefile and record it here'
-                    : 'TODO(live drive): how the app starts locally (no npm script, bin or Makefile found)';
+                : make ? `Read the Makefile for the target that starts the app (dev, run, serve or start) and start it with \`make <target>\`; ${RECORD}.`
+                    : `No start script, bin or Makefile was found: read README.md and the entry file for how the app starts, and start it; ${RECORD}.`;
     const port = `${scripts.dev ?? ''} ${scripts.start ?? ''}`.match(/(?:localhost:|--port[= ])(\d{4,5})/)?.[1];
-    const ready = port
-        ? `http://localhost:${port} answers (TODO(live drive): confirm the ready log line)`
-        : web || api
-            ? 'TODO(live drive): the URL and ready log line the server prints'
-            : 'TODO(live drive): how to tell the app is ready (log line, port, prompt)';
-    const harness = has('playwright', '@playwright/test', 'cypress', 'puppeteer')
-        ? 'browser/CDP (Playwright)'
-        : cliish ? 'tmux/PTY'
-            : api ? 'plain HTTP (curl)'
-                : 'TODO(live drive)';
+    const driver = browserTests ? 'browser' : cliish ? 'tty' : api ? 'curl' : web ? 'browser' : 'shell';
+    const ready = port && (driver === 'browser' || driver === 'curl')
+        ? `\`curl -sS -o /dev/null http://localhost:${port}/\` exits 0. BASE below is http://localhost:${port}`
+        : driver === 'browser' || driver === 'curl'
+            ? `the launch output prints the app URL and \`curl -sS -o /dev/null <that URL>\` exits 0. BASE below is that URL; ${RECORD}`
+            : 'the launch command runs with no error (exit 0, or a prompt waiting for input)';
+    const harness = browserTests ? 'browser/CDP (Playwright)' : {
+        tty: 'tmux/PTY',
+        curl: 'plain HTTP (curl)',
+        browser: 'a browser tool (for example chrome-devtools-axi)',
+        shell: 'a shell (run the launch command and read its output)',
+    }[driver];
     const observe = web
-        ? 'screenshots of the action and the resulting state, plus the console log'
+        ? 'screenshots of the resulting state the outcome is about'
         : cliish
             ? 'terminal transcripts, exit codes and side effects (files written, rows inserted)'
             : api
                 ? 'response bodies, status codes and side effects (rows inserted, messages sent)'
-                : 'TODO(live drive): what evidence this surface can capture';
+                : 'screenshots of a page it shows, or its output saved as text when the outcome is text';
     const isolate = web || port
-        ? 'TODO(live drive): confirm two instances run side by side (ports, data dirs, profiles); until then drive one instance at a time'
+        ? 'Drive one instance at a time unless .done-done.yaml has an instance block, which gives each run its own port and HOME'
         : 'each run uses its own invocation; never drive a shared session the user owns';
+    const runCli = (args) => bins.length ? `\`node ${bins[0]} ${args}\``
+        : scripts.start ? `\`npm start -- ${args}\``
+            : `the launch command from Launch with \`${args}\``;
+    const shot = (s) => `screenshot the resulting page to $DONE_DONE_EVIDENCE_ROOT/${s}.png`;
+    const saved = (s) => `save the output and exit status to $DONE_DONE_EVIDENCE_ROOT/${s}.txt`;
+    const open = 'open BASE in the browser, take a snapshot and act on the page by its visible labels';
+    const params = 'replace each :param or ${...} in the path with a real value from the handler or seed data';
+    const spends = 'a route that charges money or calls a paid outside service must be declared under `spends:` and never sent without the user approval';
+    const found = [
+        ...(driver === 'browser' || driver === 'curl' ? routes : []).map((r) => {
+            const [method, path] = r.split(' ');
+            const writes = method === 'GET' ? '' : `; ${spends}`;
+            const drive = driver === 'curl' ? `send it with \`curl -sS -X ${method} -w '\\nstatus %{http_code}\\n' "BASE${path}"\`, with the body its handler reads; ${params} (search the source for "${path}")${writes}`
+                : method === 'GET' ? `${open.replace('BASE', `BASE${path}`)}; ${params}`
+                    : `find the form or button that sends ${r} (search the source for "${path}"), ${params}, then fill and submit it as a user does${writes}`;
+            return { base: slug(r), title: r, reach: `the ${r} route`, drive };
+        }),
+        ...(driver === 'tty' ? commands : []).map((c) => ({ base: slug(c), title: `\`${c}\` command`, reach: `the CLI run with \`${c}\``, drive: `run ${runCli(`${c} --help`)} to learn its arguments, then ${runCli(`${c} <arguments>`)} as a user does` })),
+    ];
+    const fallback = {
+        browser: { title: 'Main page', reach: 'BASE, the first page a user opens', drive: open },
+        curl: { title: 'Main request', reach: 'the first endpoint README.md shows a client calling', drive: `read README.md and the entry file for the first endpoint a client calls, then send it with \`curl -sS -X <METHOD> -w '\\nstatus %{http_code}\\n' "BASE<path>"\`, with the body its handler reads; ${spends}; ${RECORD}` },
+        tty: { title: 'Main command', reach: 'what README.md says a user runs first', drive: `read README.md for the first command a user runs, then run it with its arguments as a user does; ${RECORD}` },
+        shell: { title: 'Main journey', reach: 'what README.md says a user runs first', drive: `read README.md and the entry file for what a user runs first, then run it in a shell as a user does; ${RECORD}` },
+    }[driver];
+    if (!found.length)
+        found.push({ base: 'main', ...fallback });
     const features = [];
-    for (const f of [
-        ...routes.map((r) => ({ base: slug(r), title: r, reach: `the ${r} route`, command: false })),
-        ...commands.map((c) => ({ base: slug(c), title: `\`${c}\` command`, reach: `the CLI run with \`${c}\``, command: true })),
-    ]) {
+    for (const f of found) {
         let s = f.base;
         for (let n = 2; features.some((g) => g.slug === s); n++)
             s = `${f.base}-${n}`;
-        features.push({ slug: s, title: f.title, reach: f.reach, command: f.command });
+        features.push({ slug: s, title: f.title, reach: f.reach, drive: f.drive, capture: (driver === 'browser' ? shot : saved)(s) });
     }
-    const commandsFound = features.filter((f) => f.command);
-    const shown = [...features.filter((f) => !f.command).slice(0, commandsFound.length ? 4 : 5), ...commandsFound].slice(0, 5);
+    const shown = features.slice(0, 5);
     return { surface, launch, ready, harness, observe, isolate, features: shown, omitted: features.length - shown.length };
 }
 function verifySkillMd(app, d) {
     const name = `verify-${app}`;
     const found = [
-        ...(d.features.length ? d.features.map((f) => `- ${f.title}: ${f.reach}`) : ['- TODO(live drive): no routes or commands found; map the first feature on the first live drive']),
+        ...d.features.map((f) => `- ${f.title}: ${f.reach}`),
         ...(d.omitted ? [`- ${d.omitted} more found and not listed; add them by hand or run maintain later.`] : []),
     ];
     return `---
@@ -1730,13 +2501,14 @@ description: Drive the ${app} ${d.surface} the way a user does and capture proof
 
 # ${name}
 
-Scaffolded by \`done-done init\` from this repo's own files (surface: ${d.surface}). Lines marked TODO need one live drive before they can be trusted.
+Scaffolded by \`done-done init\` from this repo's own files (surface: ${d.surface}). Where a step says to find something, the first drive finds it and records it there.
 
 ## Launch
 
 ${d.launch}
 
 Ready when ${d.ready}. Tear down what you started; never kill by process name.
+When the repo's .done-done.yaml has an instance block, done-done already runs the app at $DONE_DONE_BASE_URL (its own port and HOME): BASE is then that URL, never a hard-coded port.
 
 ## Doctor
 
@@ -1750,7 +2522,14 @@ ${found.join('\n')}
 
 ## Evidence
 
-Capture ${d.observe}. Exercise the real user path, not internal setters; capture the action and the resulting state, not just the final screen; verify side effects alongside what is visible. Evidence goes to the run folder \`done-done run\` prints.
+Capture ${d.observe}. Exercise the real user path, not internal setters; done-done's judge checks every capture in the run folder against the outcome, so save only captures of the resulting state there and keep any of earlier steps outside it; verify side effects alongside what is visible. Evidence goes to the run folder \`done-done run\` prints. Every drive uses these done-done primitives:
+
+- Matrix: when .done-done.yaml sets a matrix block, each journey runs once per theme x width x form cell with DONE_DONE_THEME, DONE_DONE_WIDTH, DONE_DONE_FORM and DONE_DONE_CELL set: name each capture with its cell suffix, so every cell is captured or skipped with a reason, never silently missing.
+- DOM: when .done-done.yaml sets a dom block, write next to each capture its page-check record, the capture's name with .dom.json for its extension (home.dark.390w.png -> home.dark.390w.dom.json): ${DOM_RECORD}.
+- Text: for a text outcome, save the CLI output, log or JSON itself as a .txt, .log or .json capture; the check needs it to hold text and JSON to parse.
+- Secrets: never write a secret (key, token, password, Bearer header) into evidence or logs; verify scans them and fails the run on a hit.
+- Spends: a journey with \`spends:\` runs only after the user approves the spend at verify's gate; never run it another way.
+- Before/after: with \`base_ref\` set, verify also drives the base ref into the run folder's before/; save the same captures under the same names there, so each pairs with its base capture.
 
 ## Cleanup
 
@@ -1758,12 +2537,10 @@ Stop the instances this run started and remove scratch state. Evidence survives
 `;
 }
 function verifyFeatureMd(app, d, f) {
-    return `# ${f.title}\n\nPart of the ${app} verification map; reached at ${f.reach}.\n\n## Sub-features\n\nTODO(live drive): list what this covers.\n\n## How to get to it (user POV)\n\n${f.reach}.\n\n## Driving it with ${d.harness}\n\nTODO(live drive): the exact selectors or commands that drive it.\n\n## Gotchas\n\nTODO(live drive): what surprised the first live drive.\n`;
+    return `# ${f.title}\n\nPart of the ${app} verification map; reached at ${f.reach}.\n\n## Sub-features\n\nList each thing a user can do here; ${RECORD}.\n\n## How to get to it (user POV)\n\n${f.reach}.\n\n## Driving it with ${d.harness}\n\n1. Launch the app as SKILL.md says and wait until it is ready.\n2. ${f.drive[0].toUpperCase()}${f.drive.slice(1)}.\n3. Capture: ${f.capture}, as SKILL.md's Evidence section says.\n4. Stop what you started.\n\n## Gotchas\n\nWrite here what surprised a drive (a slow load, a login wall, a label that moved) and what worked instead, after the drive.\n`;
 }
 function verifyFeaturesMd(app, d) {
-    const index = d.features.length
-        ? d.features.map((f) => `- [${f.title}](${f.slug}.md): ${f.reach}`).join('\n')
-        : 'TODO(live drive): no features found in source; map the first one here.';
+    const index = d.features.map((f) => `- [${f.title}](${f.slug}.md): ${f.reach}`).join('\n');
     const more = d.omitted ? `\n\n${d.omitted} more found and not listed; add them by hand or run maintain later.` : '';
     return `# ${app} features\n\nThe repo's maintained verification map; a proof that drives one entry point is incomplete when this lists others.\n\n${index}${more}\n`;
 }
@@ -1950,7 +2727,7 @@ function writeGlobal() {
 }
 // The user's agent choice, checked before anything is written.
 function checkChoice(agent, model) {
-    if (!isAgent(agent) || !supported(agent))
+    if (!isAgent(agent))
         throw new UsageError(`done-done cannot start ${agent}; it starts ${agentChoices().join(', ')}`, noAgent().help);
     if (agent === 'opencode' && model && !model.includes('/'))
         throw new UsageError(`--model ${model}: an opencode model is provider/model, e.g. ${CHEAP.opencode.model}`);
@@ -1984,30 +2761,61 @@ function saveChoice(kind, { agent, model }) {
     renameSync(`${file}.tmp`, file);
     return `${kind === 'agent' ? agent : routeOf(agent)}${model ? ` (model ${model})` : ''} saved to ${file}`;
 }
+// Why a typed model is not one opencode lists, or '' when it is listed or unchecked (only opencode is checked; pi's list comes back cut short on a pipe).
+function unknownModel(agent, model, cfg) {
+    if (agent !== 'opencode')
+        return '';
+    const bin = agentPath(agent, cfg);
+    if (!bin) {
+        process.stderr.write(`${model} is saved unchecked because ${agent} is not on PATH; run 'done-done doctor --probe' to check it\n`);
+        return '';
+    }
+    const r = spawnSync(bin, ['models'], { encoding: 'utf8', timeout: 30_000 });
+    if (r.status !== 0) {
+        process.stderr.write(`${agent} models failed (${(r.error?.message || r.stderr || `exit ${r.status}`).trim().split('\n').at(-1)}), so ${model} is saved unchecked\n`);
+        return '';
+    }
+    // opencode prints one provider/model per line.
+    return r.stdout.split('\n').map((l) => l.trim()).includes(model) ? '' : `${model} is not a model ${agent} lists (${agent} models)`;
+}
 const interactive = () => !!process.stdin.isTTY && !!process.stderr.isTTY;
 const missing = (kind) => (kind === 'agent' ? noAgent() : noJudge());
 // In a terminal the user picks the agent (or the judge) and its model from a list; done-done never picks for them.
 async function pick(kind, cfg) {
     const rl = createInterface({ input: process.stdin, output: process.stderr });
-    const closed = new AbortController();
-    rl.on('close', () => closed.abort());
-    const ask = async (q) => (await rl.question(q, { signal: closed.signal })).trim();
+    // Lines are read in order, so an answer typed while done-done checks a model list is kept, not dropped.
+    // ponytail: each pick has its own interface, so answers typed ahead past the agent list into the judge list are dropped; share one interface if that matters.
+    const lines = rl[Symbol.asyncIterator]();
+    const ask = async (q) => {
+        rl.setPrompt(q);
+        rl.prompt();
+        const line = await lines.next();
+        if (line.done)
+            throw new Error('the terminal closed');
+        return line.value.trim();
+    };
     try {
-        const menu = kind === 'agent' ? [...AGENTS.filter(supported), ACP_TARGET] : JUDGES;
+        const menu = kind === 'agent' ? [...AGENTS, ACP_TARGET] : JUDGES;
         const label = (a) => (a === ACP_TARGET ? `${a} (an agent your acpx bridge starts)` : a);
-        const head = kind === 'agent' ? 'done-done starts a coding agent you choose, and none is set. Agents:' : `done-done judges each screenshot with an agent you choose, never the one that did the work (${cfg.agent || 'not set'}), and none is set. Judges:`;
+        const doer = cfg.agent ? `the one that did the work (${cfg.agent})` : 'the agent that does the work';
+        const head = kind === 'agent' ? 'done-done starts a coding agent you choose, and none is set. Agents:' : `done-done judges each capture with an agent you choose, never ${doer}, and none is set. Judges:`;
         process.stderr.write(`${head}\n${menu.map((a, i) => `  ${i + 1}) ${label(a)}\n`).join('')}`);
         for (;;) {
             let agent = '';
             while (!agent) {
-                const n = Number(await ask(`${kind} [1-${menu.length}]: `));
-                if (!Number.isInteger(n) || n < 1 || n > menu.length)
+                const said = await ask(`${kind} [1-${menu.length}]: `);
+                const n = Number(said);
+                if (!Number.isInteger(n) || n < 1 || n > menu.length) {
+                    process.stderr.write(`${said || 'nothing'} is not on the list; type a number from 1 to ${menu.length}\n`);
                     continue;
+                }
                 agent = menu[n - 1];
                 if (agent !== ACP_TARGET)
                     continue;
                 const target = await ask('acp target, e.g. claude-code: ');
                 agent = isAgent(`acp:${target}`) ? `acp:${target}` : '';
+                if (!agent)
+                    process.stderr.write(`${target || 'nothing'} is not an acp target name; pick again\n`);
             }
             const cheap = CHEAP[agent]?.model;
             const who = kind === 'agent' ? agent : `the ${agent} judge`;
@@ -2022,11 +2830,20 @@ async function pick(kind, cfg) {
                 const n = typed ? '2' : await ask('model [1-2]: ');
                 if (n === '1')
                     model = cheap ?? '';
-                else if (n === '2') {
-                    const typedModel = await ask('model: ');
-                    if (typedModel && (agent !== 'opencode' || typedModel.includes('/')))
-                        model = typedModel;
-                }
+                else if (n === '2')
+                    while (model === undefined) {
+                        const typedModel = await ask('model: ');
+                        const why = !typedModel ? 'no model typed' : agent === 'opencode' && !typedModel.includes('/') ? `${typedModel} is not provider/model` : unknownModel(agent, typedModel, cfg);
+                        if (why)
+                            process.stderr.write(`${why}; type it again\n`);
+                        else {
+                            model = typedModel;
+                            if (agent !== 'opencode')
+                                process.stderr.write(`the model was not checked because ${agent} has no model list; run 'done-done doctor --probe' to check it\n`);
+                        }
+                    }
+                else
+                    process.stderr.write(`${n || 'nothing'} is not 1 or 2\n`);
             }
             if (kind === 'agent')
                 return { agent, model };
@@ -2367,8 +3184,6 @@ async function cmdDoctor(argv) {
         }
     }
     const agent = agentCfg?.agent ? selectAgent(agentCfg) : null;
-    const startableList = AGENTS.filter(supported);
-    const startable = startableList.length > 1 ? `${startableList.slice(0, -1).join(', ')} and ${startableList.at(-1)}` : (startableList[0] ?? 'no agent');
     // An acp:<target> agent is missing when its acpx bridge is: say which, and how to install it.
     const acpx = agent?.agent.startsWith('acp:') ? findBin(agentCfg.acpx_path) : undefined;
     const override = agent && agentCfg.agent_path_override[agent.agent];
@@ -2376,7 +3191,6 @@ async function cmdDoctor(argv) {
         : notStartable(agent?.agent ?? '', override || '');
     const askFix = `ask the user which agent to use and save it: done-done init --agent <agent> --model <model>`;
     const installFix = acpx === undefined ? `Install ${agent?.agent}, or ${askFix}` : ACPX_INSTALL;
-    const switchFix = `done-done starts ${startable}: ${askFix}`;
     if (repoFileInvalid) {
         checks.push(unknownRow('agent'));
     }
@@ -2390,27 +3204,26 @@ async function cmdDoctor(argv) {
         const what = `${agent.agent} (${modelPhrase(agent.agent, agent.model)}; from config)`;
         checks.push(!agent.path
             ? { check: 'agent', status: 'missing', detail: `${what}: ${notFound}`, fix: installFix }
-            : !supported(agent.agent)
-                ? { check: 'agent', status: 'missing', detail: `${what} at ${agent.path}, but done-done cannot start ${agent.agent} yet (${startable} for now)`, fix: switchFix }
-                : { check: 'agent', status: 'ok', detail: `${what} at ${agent.path}`, fix: '' });
+            : { check: 'agent', status: 'ok', detail: `${what} at ${agent.path}`, fix: '' });
         if (agent.agent === 'pi')
             checks.push({ check: 'tool_gate', status: 'warning', detail: 'pi has no permission gate: every pi tool runs without approval', fix: '' });
+        // codex's sandbox covers its shell too, so a drive's recipe tool writes only where the drive may.
+        if (agent.agent === 'codex')
+            checks.push({ check: 'tool_gate', status: 'warning', detail: "codex's drive sandbox lets its commands write only the repo, the run's evidence and scratch folders, $TMPDIR and /tmp; a tool that writes elsewhere needs its folder added with agent_args_override.codex: [--add-dir, <folder>] (see docs/reference.md, Drive by agent)", fix: '' });
     }
     // The judge the user set (judge.route), kept apart from the agent.
     let choice;
     let choiceError;
-    if (cfg && agent)
+    if (cfg)
         try {
-            choice = selectJudge(cfg, agent);
+            choice = selectJudge(cfg, agent ?? NO_AUTHOR);
         }
         catch (e) {
             choiceError = e;
         }
-    // With no agent set the judge is unknown too: it is kept apart from that agent.
-    const noAuthorRow = (check) => (cfg && agentCfg && !agent ? unknownRow(check, 'unknown until the agent is set, since the judge is kept apart from it', noAgent().help) : unknownRow(check));
     const choiceRow = (check) => ({ check, status: 'missing', detail: choiceError.message, fix: choiceError.help ?? 'Fix the judge config, then re-run: done-done doctor' });
-    if (!cfg || !agent) {
-        checks.push(noAuthorRow('judge'));
+    if (!cfg) {
+        checks.push(unknownRow('judge'));
     }
     else if (!choice) {
         checks.push(choiceRow('judge'));
@@ -2418,7 +3231,7 @@ async function cmdDoctor(argv) {
     else {
         try {
             const { detail } = await backend(cfg, choice);
-            checks.push({ check: 'judge', status: 'ok', detail: `${choice.route} (model ${choice.model}): ${detail}; the model is never called`, fix: '' });
+            checks.push({ check: 'judge', status: 'ok', detail: `${choice.route} (model ${choice.model}): ${detail}; doctor does not call the model`, fix: '' });
         }
         catch (e) {
             checks.push({ check: 'judge', status: 'missing', detail: e.message, fix: e.help ?? 'Re-run done-done doctor after fixing the error above' });
@@ -2431,7 +3244,7 @@ async function cmdDoctor(argv) {
     // How far the judge is from the author, as selectJudge picks it: another agent is ok; the author's agent at another
     // model or in a fresh session runs too, so it is a warning that never fails doctor.
     if (!cfg || !agent) {
-        checks.push(noAuthorRow('judge_choice'));
+        checks.push(unknownRow('judge_choice', cfg && agentCfg ? 'unknown until the agent is set, since the judge is kept apart from it' : undefined));
     }
     else if (!choice) {
         checks.push(choiceRow('judge_choice'));
@@ -2449,11 +3262,13 @@ async function cmdDoctor(argv) {
     }
     if (values.probe && !agent)
         checks.push(unknownRow('probe'));
-    if (values.probe && agent) {
+    const toolless = agent?.path ? editOnlyReason(agent.agent) : '';
+    if (values.probe && agent && toolless)
+        checks.push({ check: 'probe', status: 'warning', detail: `${toolless}; ${agent.agent} is not probed, its edit steps run through verify`, fix: '' });
+    else if (values.probe && agent) {
         const record = join(home(), 'agents', `probe-${new Date().toISOString().replace(/[:.]/g, '-')}-${agent.agent}.json`);
         const probe = !agent.path ? { ok: false, error: notFound, fix: installFix }
-            : !supported(agent.agent) ? { ok: false, error: `done-done cannot start ${agent.agent} yet (${startable} for now)`, fix: switchFix }
-                : await askAgent({ ...agent, prompt: 'This is a connectivity probe from done-done doctor. Use no tools. Answer with ok set to true.', schema: PROBE_SCHEMA, cwd: repo ?? process.cwd(), tools: 'none', record });
+            : await askAgent({ ...agent, prompt: 'This is a connectivity probe from done-done doctor. Use no tools. Answer with ok set to true.', schema: PROBE_SCHEMA, cwd: repo ?? process.cwd(), tools: 'none', record });
         checks.push(probe.ok && probe.answer?.ok === true
             ? { check: 'probe', status: 'ok', detail: `${agent.agent} (${modelPhrase(agent.agent, agent.model)}) answered the schema question; ${probe.recordError ? `the call record could not be written: ${probe.recordError}` : `record ${record}`}`, fix: '' }
             : { check: 'probe', status: 'missing', detail: `${agent.agent} did not answer: ${probe.error ?? `answer ${JSON.stringify(probe.answer)}`}${probe.record ? `; record ${record}` : ''}${probe.recordError ? `; the call record could not be written: ${probe.recordError}` : ''}`, fix: probe.fix ?? `Check that ${agent.agent} is signed in${agent.model ? ` and can use model ${agent.model}` : ''}, or set agent_config.${agent.agent}.model` });
@@ -2512,7 +3327,7 @@ async function cmdDesign(argv) {
         repo = process.cwd();
     }
     const cfg = loadConfig(repo);
-    const choice = await preflightJudge(cfg);
+    const choice = await preflightJudge(cfg, false);
     const judged = await design(cfg, choice, screens, join(home(), 'agents'));
     const count = (v) => judged.filter((j) => j.verdict === v).length;
     const code = count('fail') ? FAIL : count('unsure') ? INCONCLUSIVE : PASS;
@@ -2522,7 +3337,7 @@ async function cmdDesign(argv) {
     emit({
         command: 'design',
         result: code === PASS ? 'pass' : code === FAIL ? 'fail' : 'inconclusive',
-        judge: { route: choice.route, model: choice.model, independence: choice.independence, author: `${choice.author.agent} (model ${choice.author.model || 'none'})` },
+        judge: { route: choice.route, model: choice.model, independence: choice.independence, author: choice.author.agent ? `${choice.author.agent} (model ${choice.author.model || 'none'})` : 'no agent set' },
         counts: { pass: count('pass'), fail: count('fail'), unsure: count('unsure') },
         screens: rows.items,
         ...(rows.omitted && { screens_omitted: rows.omitted }),
@@ -2552,12 +3367,16 @@ function cmdBare() {
         app: cfg.app,
         evidence_root: shown(repo, cfg.evidence.root),
         journeys,
-        runs: loadRecords(cfg).length,
+        runs: runsOf(repo, cfg).length,
     };
     const check = '`done-done check --outcome "<what you proved>" <files it recorded>`';
-    result.help = journeys.length
-        ? [`Capture proof with \`done-done run ${journeys[0]}\`, then check it with ${check}`]
-        : [...driveHint(repo, cfg), `Add a journey to .done-done.yaml (${journeyExample}), commit, then \`done-done run smoke\` and ${check}`];
+    const receipt = verifyReceipt(repo, cfg, 'HEAD');
+    result.receipt = receipt.code === PASS ? `valid for HEAD ${String(receipt.result.head).slice(0, 12)}` : receipt.result.reason ?? receipt.result.result;
+    result.help = receipt.code === PASS
+        ? [`HEAD has a valid receipt for "${receipt.result.claim}"; prove the next commit with done-done verify --outcome "<what a user can now do>"`]
+        : journeys.length
+            ? [`Capture proof with \`done-done run ${journeys[0]}\`, then check it with ${check}`]
+            : [...driveHint(repo, cfg), `Add a journey to .done-done.yaml (${journeyExample}), commit, then \`done-done run smoke\` and ${check}`];
     emit(result);
     return PASS;
 }
@@ -2581,13 +3400,13 @@ async function main(argv) {
     }
     try {
         if (process.env.DONE_DONE_DRIVE && DRIVE_REFUSED.includes(cmd))
-            throw new UsageError(`${cmd} cannot run inside an agent drive: the agent that did the work never answers a gate, writes a receipt or starts a run`, 'Stop the drive and report what you captured; done-done answers the run and writes the receipt');
+            throw new UsageError(`${cmd} refuses to run inside an agent drive (DONE_DONE_DRIVE is set), so the agent does not answer its own gate, write a receipt or start a run by accident; this guards against accidents and is not a sandbox`, 'Stop the drive and report what you captured; done-done answers the run and writes the receipt');
         if (cmd === 'init')
             return await cmdInit(rest);
         if (cmd === 'doctor')
             return await cmdDoctor(rest);
         if (cmd === 'run')
-            return cmdRun(rest);
+            return await cmdRun(rest);
         if (cmd === 'check')
             return await cmdCheck(rest);
         if (cmd === 'receipt')
@@ -2609,13 +3428,19 @@ async function main(argv) {
         if (cmd === 'abort')
             return cmdAbort(rest);
         if (cmd === 'respond')
-            return cmdRespond(rest);
+            return await cmdRespond(rest);
         if (cmd === 'history')
             return cmdHistory(rest);
+        if (cmd === 'signoff')
+            return cmdSignoff(rest);
         if (cmd === '__runner') {
             await runSteps(rest[0]);
             return PASS;
         }
+        if (cmd === '--version') {
+            console.log(JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version);
+            return PASS;
+        }
         if (cmd === '--help' || cmd === '-h' || cmd === 'help') {
             console.log(USAGE_TEXT);
             return PASS;