done-done-axi 0.3.2 → 0.4.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { execFileSync, spawn, spawnSync } from 'node:child_process';
 import { createHash, randomBytes } from 'node:crypto';
-import { accessSync, appendFileSync, closeSync, constants, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { accessSync, appendFileSync, closeSync, constants, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readdirSync, readFileSync, realpathSync, renameSync, rmdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { homedir, tmpdir, userInfo } from 'node:os';
 import { basename, dirname, isAbsolute, join, matchesGlob, relative, resolve, sep } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
@@ -9,11 +9,11 @@ import { createInterface } from 'node:readline/promises';
 import { parseArgs } from 'node:util';
 import { encode } from '@toon-format/toon';
 import { Document, parseDocument } from 'yaml';
-import { ACPX_INSTALL, agentChoices, agentPath, agentRun, askAgent, editOnlyReason, findBin, JUDGES, modelFor, noAgent, noJudge, notStartable, routeOf, selectAgent, selectJudge } from './agents.js';
+import { ACPX_INSTALL, agentChoices, agentPath, agentRun, askAgent, editOnlyReason, findBin, JUDGES, modelFor, noAgent, noJudge, notStartable, routeOf, selectAgent, selectJudge, toollessReason } from './agents.js';
 import { AGENTS, CHEAP, globalConfigText, home, inputPattern, isAgent, loadConfig, parseDuration, UsageError } from './config.js';
 import { backend, judge, judgeable, onPath, quote, screen } from './judge.js';
 import { startInstance, stopInstance } from './instance.js';
-import { attemptProblem, changedSince, commitFix, dirtyTracked, FIX_SCHEMA, inWorktree, maintainSteps, named, pathspec, repoState, triage } from './maintain.js';
+import { attemptProblem, changedSince, commitFix, dirtyTracked, FIX_SCHEMA, inWorktree, maintainSteps, named, pathspec, readerProblem, repoState, triage } from './maintain.js';
 import { cellEnv, cellName, cellSuffix, hasMatrix, matrixManifest, splitMatrix } from './matrix.js';
 import { design, KINDS } from './design.js';
 import { checkMedia } from './media.js';
@@ -37,7 +37,7 @@ const CHECKS_TEXT = `Checks block (--from): the newest "## Checks" heading, then
   evidence: <the evidence file paths, or "not proven: <cause>">`;
 const RUNS_TEXT = `runs: each verify or maintain run lives in $DONE_DONE_HOME/runs/<app>/<run-id> (run.json, events.jsonl, logs/<step>.log,
   agents/<n>-<name>.json for each agent call) and goes on when the command that started it ends;
-  verify steps: resolve, drive, check, judge (skipped with --no-judge), triage and fix (only with auto_fix.verify above 0), gate, receipt, report;
+  verify steps: resolve, drive, check, judge (always; skipped only after a failed check), triage and fix (only with auto_fix.verify above 0), gate, receipt, report;
   maintain steps: locate, hygiene, source-wave, reconcile, triage and fix (only with auto_fix.maintain above 0), report
   drive: the journey when there is one; else the author agent (agent: in config) drives one feature of the verify skill the way a user
   does and saves captures into the run's evidence folder; it may run commands and edit files only in the repo and that folder where
@@ -45,9 +45,8 @@ const RUNS_TEXT = `runs: each verify or maintain run lives in $DONE_DONE_HOME/ru
   inputs (.done-done.yaml): repo-relative paths or globs the drive must leave alone (fixtures, data files);
   hashed before and after the drive; the check step fails naming each changed, appeared or
   disappeared path (never file contents), and the before/after hash lists go into the run record; no key: unchanged
-  gate: a judge fail or unsure (or an agent drive with no judged capture) parks the run as awaiting_approval (exit 4); answer it with
-  respond: approve or skip (each needs --reason) ends the run overridden, never pass, and its receipt says who and why, so
-  receipt --verify refuses it; fix ends the run fail
+  gate: a judge fail or unsure (or an agent drive with no judged capture) parks the run as awaiting_approval (exit 4); nothing moves it
+  past the judge: respond --action fix ends it fail, with no receipt (approve and skip answer only a spend gate)
   auto_fix: { verify: <n> } (config; 0, the default, reports only): the judge sorts each wrong screen (fix or ask; an ask, an unsure
   answer or a mixed result parks at the gate), then the agent the user set fixes the product in a done-done worktree with your
   ignored files copied in, and verify runs again there, up to n times. Result: changed (the fix on a done-done/verify-<run-id>
@@ -58,31 +57,32 @@ const MAINTAIN_TEXT = `maintain reads the verify skill and the source; HEAD, git
   source-wave: one fresh read-only reader per feature file at the configured agent (agent, agent_config) explains it from source
   reconcile: each file:line the skill or a reader cites must exist (a bare file name matches a tracked file); one tool-less call
   merges the recipes and names recently changed source (git log, 30 days) that no feature covers. Result: clean (exit 0),
-  drift with findings (exit 1), or blocked (no skill, a reader that did not answer, a repo that changed, or no agent: the
-  readers and the merge call do not run, the plain checks still do; exit 3)
+  drift with findings (exit 1), or blocked (no skill, a reader that did not answer, or a repo that changed; exit 3). maintain
+  never runs without its agent: none set, or one that cannot start or cannot read with its tools off, stops it first (exit 2)
   auto_fix: { maintain: <n> } (config, as no-mistakes; 0, the default, reports only) lets done-done fix drift up to n times:
-  triage: the judge the user set (never the agent that fixes) sorts each drift finding: the skill is out of date, or the product
+  triage: the judge the user set sorts each drift finding: the skill is out of date, or the product
   may be wrong; a product finding is ask-user, so the run ends blocked and the user decides (maintain never edits product code)
   fix: the agent the user set edits only the verify skill, in a done-done worktree at HEAD; a change outside the skill folder,
   a commit by the agent or a change to your checkout ends it blocked, and the worktree is dropped. maintain then runs again there.
   Result: changed (a clean re-run; one commit of the skill folder on a done-done/maintain-<run-id> branch, your branch and checkout
   untouched; exit 0), or blocked (ask-user findings, a guard, or every attempt used, with the findings that remain; no branch)`;
 const DOCTOR_TEXT = `doctor changes nothing except the --probe call record (the agent itself may keep its own session files) and exits 0 when every required item is ok, 2 otherwise.
-  required: git (inside a repository), config (a valid .done-done.yaml), evidence_root (writable).
-  optional: verify_skill (.agents/skills/verify-<app>/), agent (the agent the user set and its model; missing when none is
-  set, with the command that saves the user's choice), agent_settings (agent, model, effort,
-  args, path and agent_timeout, each with the file it came from: the global config, .done-done.yaml or default), judge (the judge route is ready: for claude-code an
-  executable claude binary and the judge kit (its sign-in is checked only when a capture is judged), for answerer:<agent> that agent's CLI and the kit, for openai:key
-  OPENAI_API_KEY and the kit; doctor does not call the model; missing when none is set, with the command that saves the user's choice),
+  required: git (inside a repository), config (a valid .done-done.yaml), evidence_root (writable), agent (the agent the user
+  set and its model; missing when none is set, with the command that saves the user's choice), judge (the judge route is ready:
+  for claude-code an executable claude binary and the judge kit, for answerer:<agent> that agent's CLI and the
+  kit, for openai:key OPENAI_API_KEY and the kit; doctor does not call the model; missing when none is set, with the command
+  that saves the user's choice).
+  also listed: verify_skill (.agents/skills/verify-<app>/), agent_settings (agent, model, effort,
+  args, path and agent_timeout, each with the file it came from: the global config, .done-done.yaml or default),
   judge_choice (the judge, and how far it is from the author: another agent, another model, or session-only), ffprobe (video evidence only).
   --probe also asks the agent one JSON-schema question (one call at the agent's model: its cheap default where it has one, else its own; set agent_config.<agent>.model to choose; its record goes to
   $DONE_DONE_HOME/agents/) and then requires a valid answer.
-  doctor lists every check; --full changes nothing. Missing optionals never fail the run.`;
+  doctor lists every check; --full changes nothing. A missing verify_skill or ffprobe, or a warning, never fails it.`;
 const CONFIG_TEXT = `config: ~/.done-done/config.yaml (global; DONE_DONE_HOME moves it) and .done-done.yaml (the repo), repo over global.
   agent (either file): claude, codex, opencode, pi, gemini or acp:<target>, set by the user (done-done init --agent); done-done never picks one.
   global only: agent_config.<agent>.{model,effort} (effort: minimal, low, medium, high, xhigh, max), agent_args_override.<agent>
   (extra flags), agent_path_override.<agent> (binary), acpx_path, agent_timeout (one agent call, default 30m; a streaming agent that prints nothing for 5m is stopped early),
-  evidence.local_root, judge.{route,model,allow_same} (the judge, set by the user with
+  evidence.local_root, judge.{route,model,floor} (the judge and shared confidence floor, set by the user with
   init --judge; never picked). done-done doctor shows where each agent setting came from.`;
 // One table drives `--help` and every `<command> --help`: each command's usage lines and the flags it takes.
 const FLAGS = {
@@ -95,8 +95,6 @@ const FLAGS = {
     '--trusted-ref <ref>': 'read .done-done.yaml from this git ref instead of the working tree (use in CI)',
     '--citation-base <dir>': 'resolve evidence citations against this directory (default: cwd); absolute citations stay unchanged; does not change repo, config or run storage',
     '--claim-id <id>': 'the claim the evidence proves; evidence already used for another claim id is reuse (default: the current branch, or the PR branch with --from <PR URL>; required on a detached HEAD)',
-    '--judge': 'the judge the user set (judge.route, never the agent and model that did the work) says whether each PNG/JPEG capture shows the outcome (verify does this by default; check and receipt only with --judge or judge.enabled: true)',
-    '--no-judge': 'skip the judge, only when the user chooses to (or judge.enabled: false in .done-done.yaml)',
     '--verify <head>': 'read-only: verify the receipt recorded for <head>',
     '--outcome "<what a user can now do>"': 'the outcome the run must prove',
     '--wait': 'wait until the run ends (the default)',
@@ -107,13 +105,13 @@ const FLAGS = {
     '--mock <screen>=<mock>': 'judge this screen next to its approved mock (repeat per screen; the screen is judged even when not listed)',
     '--step <name>': 'the step log to show (verify: resolve, drive, check, judge, gate, receipt, report; maintain: locate, hygiene, source-wave, reconcile, triage, fix, report)',
     '--feature <name>': 'with no journey, the author agent drives this feature of the verify skill (features/<name>.md); default: the only feature, else the agent picks the one the outcome is about',
-    '--action <approve|skip|fix>': 'approve: the captures do show the outcome; skip: go on without a judge pass; both end the run overridden; fix: end it fail, then fix the product or the verify skill (done-done maintain checks it against the source)',
-    '--reason "<why>"': 'why (required for approve and skip); kept in the run and its receipt with who answered',
+    '--action <approve|skip|fix>': 'at a spend gate, approve: spend and run the journey; skip: end the run with nothing spent. At the judge gate only fix: end it fail, then fix the product or the verify skill (done-done maintain checks it against the source)',
+    '--reason "<why>"': 'why (required for approve and skip at a spend gate); kept in the run with who answered',
     '--limit <n>': 'how many past runs to list (default all)',
     '--out <file.png>': 'where look writes the screenshot; its page-check record goes next to it as <file>.dom.json (default: look.png in $DONE_DONE_EVIDENCE_ROOT inside a journey, else in the current folder)',
     '--agent <agent>': 'the coding agent done-done starts (claude, codex, opencode, pi, gemini or acp:<target>), saved as agent in ~/.done-done/config.yaml; without it, init asks in a terminal',
     '--model <model>': 'with --agent: that agent\'s model, saved as agent_config.<agent>.model (opencode: provider/model)',
-    '--judge <agent>': `the judge done-done starts (${JUDGES.join(' or ')}), saved as judge.route in ~/.done-done/config.yaml; never the agent and model that did the work; without it, init asks in a terminal`,
+    '--judge <agent>': `the judge done-done starts (${JUDGES.join(' or ')}), saved as judge.route in ~/.done-done/config.yaml (any agent and model, the author's own too); without it, init asks in a terminal`,
     '--judge-model <model>': 'with --judge <agent>: the judge\'s model, saved as judge.model',
     '--hook <agent>': 'also add a SessionStart hook to .claude/settings.json (claude), .codex/hooks.json (codex) or .gemini/settings.json (gemini) that shows `done-done` to each session, or a plugin to .opencode/plugins (opencode) or an extension to .pi/extensions (pi) that adds it to the first message of each session (opt-in)',
 };
@@ -122,9 +120,9 @@ const COMMANDS = {
     init: {
         usage: [
             ['done-done init', 'write a minimal .done-done.yaml (evidence lives outside the repo) and, when absent, a commented ~/.done-done/config.yaml'],
-            ['done-done init', 'scaffold .agents/skills/verify-<app> from this repo (never overwrites)'],
+            ['done-done init', 'have the agent write .agents/skills/verify-<app> from this repo\'s own proof paths (never overwrites; no agent, no skill)'],
             ['done-done init --agent opencode --model opencode-go/muse-spark-1.3-contributor', 'set the coding agent done-done starts and its model (in a terminal, init asks when none is set)'],
-            ['done-done init --judge claude --judge-model claude-haiku-5-5', 'set the judge done-done starts and its model (in a terminal, init asks when none is set)'],
+            ['done-done init --judge pi --judge-model openai-codex/gpt-6-luna', 'set the judge done-done starts and its model (in a terminal, init asks when none is set)'],
             ['done-done init --hook claude', 'also show this repo\'s done-done state at each Claude Code session start'],
             ['done-done init --hook codex', 'also show this repo\'s done-done state at each Codex session start'],
             ['done-done init --hook opencode', 'also add this repo\'s done-done state to the first message of each opencode session'],
@@ -154,28 +152,28 @@ const COMMANDS = {
     },
     check: {
         usage: [
-            ['done-done check --outcome "<claim>" <files...> [--claim-id <id>] [--trusted-ref <ref>] [--citation-base <dir>] [--judge]', 'check evidence files against a claim'],
-            ['done-done check --from <file | - | PR URL> [--claim-id <id>] [--trusted-ref <ref>] [--citation-base <dir>] [--judge]', "check a claim's Checks block"],
+            ['done-done check --outcome "<claim>" <files...> [--claim-id <id>] [--trusted-ref <ref>] [--citation-base <dir>]', 'check evidence files against a claim'],
+            ['done-done check --from <file | - | PR URL> [--claim-id <id>] [--trusted-ref <ref>] [--citation-base <dir>]', "check a claim's Checks block"],
         ],
-        flags: ['--outcome "<claim>"', '--from <file | - | PR URL>', '--claim-id <id>', '--trusted-ref <ref>', '--citation-base <dir>', '--judge'],
+        flags: ['--outcome "<claim>"', '--from <file | - | PR URL>', '--claim-id <id>', '--trusted-ref <ref>', '--citation-base <dir>'],
         more: [CHECKS_TEXT],
     },
     receipt: {
         usage: [
-            ['done-done receipt --outcome "<claim>" <files...> [--claim-id <id>] [--trusted-ref <ref>] [--citation-base <dir>] [--judge]', 'record a passing check for HEAD'],
-            ['done-done receipt --from <file | - | PR URL> [--claim-id <id>] [--trusted-ref <ref>] [--citation-base <dir>] [--judge]', "record from a claim's Checks block"],
+            ['done-done receipt --outcome "<claim>" <files...> [--claim-id <id>] [--trusted-ref <ref>] [--citation-base <dir>]', 'record a passing check for HEAD'],
+            ['done-done receipt --from <file | - | PR URL> [--claim-id <id>] [--trusted-ref <ref>] [--citation-base <dir>]', "record from a claim's Checks block"],
             ['done-done receipt --verify <head>', 'read-only: verify a recorded receipt'],
         ],
-        flags: ['--outcome "<claim>"', '--from <file | - | PR URL>', '--claim-id <id>', '--trusted-ref <ref>', '--citation-base <dir>', '--judge', '--verify <head>'],
+        flags: ['--outcome "<claim>"', '--from <file | - | PR URL>', '--claim-id <id>', '--trusted-ref <ref>', '--citation-base <dir>', '--verify <head>'],
         more: [CHECKS_TEXT],
     },
     verify: {
         usage: [
-            ['done-done verify [<journey>] --outcome "<what a user can now do>" [--claim-id <id>] [--no-judge]', 'drive the journey in a run that outlives this command, check its evidence, judge each capture and record a receipt'],
-            ['done-done verify --outcome "<claim>" [--feature <name>]', 'with no journey, the author agent drives a verify skill feature and the judge (never the author) judges its captures'],
+            ['done-done verify [<journey>] --outcome "<what a user can now do>" [--claim-id <id>]', 'drive the journey in a run that outlives this command, check its evidence, judge each capture and record a receipt'],
+            ['done-done verify --outcome "<claim>" [--feature <name>]', 'with no journey, the author agent drives a verify skill feature and the judge the user set judges its captures'],
             ['done-done verify [<journey>] --outcome "<claim>" --no-wait | --wait | --foreground', 'return at once, wait until the run ends or waits at its gate (default), or run in this process (CI)'],
         ],
-        flags: ['--outcome "<what a user can now do>"', '--feature <name>', '--claim-id <id>', '--judge', '--no-judge', '--wait', '--no-wait', '--foreground'],
+        flags: ['--outcome "<what a user can now do>"', '--feature <name>', '--claim-id <id>', '--wait', '--no-wait', '--foreground'],
         more: [RUNS_TEXT],
     },
     maintain: {
@@ -186,7 +184,7 @@ const COMMANDS = {
     design: {
         usage: [['done-done design <screens...> [--mock <screen>=<mock>]', 'a judge looks at each PNG/JPEG screen, alone or next to its mock, and fails it on visual defects']],
         flags: ['--mock <screen>=<mock>'],
-        more: [`design: one judge request per screen (the judge the user set, never the author); it fails a screen on any defect it names:
+        more: [`design: one judge request per screen (the judge the user set); it fails a screen on any defect it names:
   ${Object.keys(KINDS).join(', ')}; capture each variant (dark, small width, large font) as its own screen; exit 0 every screen
   passed, 1 a screen failed, 3 none failed but one is unsure`],
     },
@@ -215,15 +213,15 @@ const COMMANDS = {
     },
     respond: {
         usage: [
-            ['done-done respond [--run <run-id>] --action approve|skip --reason "<why>"', 'move a run on past its gate; it ends overridden, never pass'],
-            ['done-done respond [--run <run-id>] --action fix', 'end a run waiting at its gate as fail'],
+            ['done-done respond [--run <run-id>] --action approve|skip --reason "<why>"', 'answer a spend gate: spend and run the journey, or end with nothing spent'],
+            ['done-done respond [--run <run-id>] --action fix', 'end a run waiting at its judge gate as fail (nothing moves it past the judge)'],
         ],
         flags: ['--run <run-id>', '--action <approve|skip|fix>', '--reason "<why>"'],
         more: [RUNS_TEXT],
     },
     rerun: {
-        usage: [['done-done rerun [--run <run-id>] [--wait | --no-wait] [--no-judge]', 'run again from the failed step, reusing steps whose inputs did not change; the judge runs as the source run did (--no-judge turns it off); wait (default) or return at once (exit 4)']],
-        flags: ['--run <run-id>', '--wait', '--no-wait', '--no-judge'],
+        usage: [['done-done rerun [--run <run-id>] [--wait | --no-wait]', 'run again from the failed step, reusing steps whose inputs did not change; the judge always runs; wait (default) or return at once (exit 4)']],
+        flags: ['--run <run-id>', '--wait', '--no-wait'],
         more: [RUNS_TEXT],
     },
     abort: {
@@ -244,18 +242,18 @@ const COMMANDS = {
 };
 const rows = (pairs, width = Math.max(...pairs.map(([a]) => a.length)) + 3) => pairs.map(([a, b]) => `  ${a}${' '.repeat(Math.max(3, width - a.length))}${b}`).join('\n');
 const GLOBAL_TEXT = `global flags: --json (JSON instead of TOON), --full (do not truncate lists), --help (this command's usage), --version (done-done's version)
-exit codes: 0 pass, 1 fail (also a run overridden at its gate), 2 usage or config error, 3 inconclusive, 4 the run is still running or a verify run waits at its gate (verify, maintain, rerun, status, respond)`;
+exit codes: 0 pass, 1 fail, 2 usage or config error, 3 inconclusive, 4 the run is still running or a verify run waits at its gate (verify, maintain, rerun, status, respond)`;
 const USAGE_TEXT = `install: npm install -g --prefix ~/.local done-done-axi (installs done-done-axi and done-done), or run npx -y done-done-axi <command>
 usage:
 ${rows([['done-done', "show this repo's config state and the next step"], ...Object.values(COMMANDS).flatMap((c) => c.usage)], 46)}
 ${GLOBAL_TEXT}
 judge: done-done's own agent, a fresh one on your own plan through BYOKit, says whether each PNG/JPEG capture shows
-  the outcome; a wrong screen fails, an unsure answer is inconclusive. verify judges by default (judge.enabled: false turns
-  that off; --judge turns it on for one run); rerun repeats its source run's judge choice (--no-judge turns it off for a run);
-  check and receipt start no model unless --judge or judge.enabled: true. The judge is the one the user set (judge.route:
-  claude-code; answerer:<agent> through the CLI of opencode, pi or gemini with every tool off; or openai:key with judge.model
-  on your own OPENAI_API_KEY), never the agent and model that did the work; with none set, done-done asks in a terminal or
-  stops (exit 2) with the command that saves it.
+  the outcome; a wrong screen fails, an unsure answer is inconclusive. check, receipt, verify, rerun and design always start
+  it, and there is no way to turn it off: a pass needs a judge pass on at least one capture. The judge is the one the user set
+  (judge.route: claude-code; answerer:<agent> through the CLI of opencode, pi or gemini with every tool off; or openai:key with
+  judge.model on your own OPENAI_API_KEY), whichever agent and model the user picks; with none set, done-done asks in a
+  terminal or stops (exit 2) with the command that saves it. A judge that fails or does not answer stops the command with its
+  cause (exit 2), never a result.
 
 ${JOURNEYS_TEXT}
 ${CHECKS_TEXT}
@@ -392,7 +390,8 @@ function closeRun(repo, cfg, rec, log) {
     const rows = cap(evidence);
     const result = {
         command: 'run',
-        result: reason ? 'fail' : 'pass',
+        // A capture that ran is recorded, never a pass: only the judged check decides whether it proves anything.
+        result: reason ? 'fail' : 'recorded',
         run_id: rec.run_id,
         commit: rec.commit,
         dirty: rec.dirty,
@@ -584,11 +583,13 @@ function loadRecords(cfg) {
     return readdirSync(dir).filter((n) => n.endsWith('.json')).map((n) => JSON.parse(readFileSync(join(dir, n), 'utf8'))).filter((r) => r.ended_at);
 }
 // Run a check and return its result without printing it, so `check` and `receipt` share one path.
+// The judge always runs: with no agent or judge set it asks (in a terminal) or stops before any result, and a judge that
+// does not answer stops it with its cause. The plain checks are steps of the judged result, never a result alone.
 // run: a verify run's folder (the judge's call records go to its agents/), its judge-step hook, and the checkout and config it checks.
 async function runCheck(argv, run) {
     const { values, positionals } = parseArgs({
         args: argv,
-        options: { outcome: { type: 'string' }, from: { type: 'string' }, 'claim-id': { type: 'string' }, 'trusted-ref': { type: 'string' }, 'citation-base': { type: 'string' }, judge: { type: 'boolean' } },
+        options: { outcome: { type: 'string' }, from: { type: 'string' }, 'claim-id': { type: 'string' }, 'trusted-ref': { type: 'string' }, 'citation-base': { type: 'string' } },
         allowPositionals: true,
     });
     if (values['citation-base']?.trim() === '')
@@ -629,12 +630,8 @@ async function runCheck(argv, run) {
         const title = src.title ?? git(repo, 'log', '-1', '--format=%s');
         claim = claimFromChecks(src.body, title, repo, cfg, findings);
     }
-    if (claim?.notProven) {
-        const allowed = cfg.checks.not_proven === 'allow' && cfg.trusted;
-        const all = findings.concat(allowed ? [] : [{ level: 'inconclusive', why: `not proven: ${claim.notProven}` }]);
-        const rep = report(all, [], { cfg, repo, claim: claim.outcome, source: values.from, citationBase: values['citation-base'], notProven: true }, allowed ? 'not proven (allowed by trusted config)' : '');
-        return { code: rep.code, result: rep.result, claim: claim?.outcome, files: [], cited: [], head: now, findings: all };
-    }
+    if (claim?.notProven)
+        throw new UsageError(`check: the judge was not asked, so there is no verdict: not proven: ${claim.notProven}`, 'Capture real proof, replace "not proven:" with its files, and re-run this check');
     const files = (claim?.files ?? []).map((name) => values['citation-base'] === undefined ? name : resolve(values['citation-base'], name));
     const records = loadRecords(cfg);
     const seen = new Map();
@@ -757,46 +754,43 @@ async function runCheck(argv, run) {
     const others = (h) => [...(used.get(h) ?? [])].filter((k) => k !== claimId);
     if (hashes.length && hashes.every((h) => others(h).length))
         findings.push({ level: 'fail', why: `every evidence file was already used as proof of a different claim (claim id ${[...new Set(hashes.flatMap(others))].join(', ')}), not this one (claim id ${claimId}, from ${idFrom}); if it is the same claim, pass --claim-id with its id` });
-    let judged;
+    // A failed plain check is no verdict: the judge is not asked, so the check stops with every cause and no result.
+    const failed = findings.filter((f) => f.level === 'fail');
+    if (failed.length || !claim) {
+        const ctx = { cfg, repo, claim: claim?.outcome, source: values.from, citationBase: values['citation-base'] };
+        throw new UsageError(`check: the judge was not asked, so there is no verdict: ${failed.map((f) => f.why).join('; ')}`, checkHelp(FAIL, findings, files, ctx)[0]);
+    }
     let judgeBlock;
     let judgeLevel;
-    // A verify run judges as the run says; check and receipt only with --judge or judge.enabled: true.
-    if ((run ? run.judge : values.judge || cfg.judge.enabled === true) && claim) {
-        // A judge pass never overrides a failed deterministic check: on a fail, no capture is judged.
-        if (findings.some((f) => f.level === 'fail'))
-            judged = { skipped: 'the check already failed, so no capture was judged' };
-        else {
-            // Only a capture the judge reads needs the user's agent (the judge is kept apart from it).
-            if (captures.some(judgeable))
-                await withChoice('agent', cfg);
-            if (captures.some(judgeable))
-                await withChoice('judge', cfg);
-            if (captures.some(judgeable))
-                run?.judging(findings.length ? INCONCLUSIVE : PASS, [...findings]);
-            const j = await judge(cfg, () => selectJudge(cfg, run?.author ? agentRun(cfg, run.author.agent, run.author.model) : selectAgent(cfg)), claim.outcome, captures, run ? join(run.dir, 'agents') : join(home(), 'agents'));
-            // The judge's next step leads the help when its verdict decides the result.
-            if (j.judged.some((r) => r.verdict === 'fail'))
-                judgeLevel = 'fail';
-            else if (!findings.length && j.judged.some((r) => r.verdict === 'unsure'))
-                judgeLevel = 'inconclusive';
-            const shots = new Set(captures.filter(screen).map((c) => c.name));
-            for (const r of j.judged.filter((r) => r.verdict !== 'pass'))
-                findings.push({ level: r.verdict === 'fail' ? 'fail' : 'inconclusive', why: `${r.path}: judge says ${r.verdict !== 'fail' ? 'unsure' : shots.has(r.path) ? 'wrong screen' : 'wrong output'}: ${r.reason}`, file: r.path });
-            const rows = cap(j.judged);
-            const { choice } = j;
-            judged = { ...(choice && { route: choice.route, model: choice.model, independence: choice.independence, author: `${choice.author.agent} (model ${choice.author.model || 'none'})` }), judged: rows.items.map(({ sha256, ...r }) => r) };
-            if (choice && j.judged.length) {
-                const byName = new Map(captures.map((c) => [c.name, receiptPath(repo, cfg, cite(c.name))]));
-                judgeBlock = { route: choice.route, model: choice.model, independence: choice.independence, author: choice.author, verdicts: j.judged.map((r) => ({ path: byName.get(r.path), sha256: r.sha256, verdict: r.verdict })) };
-            }
-            if (rows.omitted)
-                judged.judged_omitted = rows.omitted;
-            if (j.notJudged.length)
-                judged.not_judged = j.notJudged;
-            judged.note = 'PNG and JPEG screens and text captures (logs, JSON, CLI output) are judged; video and other files are not';
-        }
+    if (!captures.some(judgeable))
+        throw new UsageError(`check: the judge was not asked, so there is no verdict: ${[...findings.map((f) => f.why), 'no cited capture is one the judge reads (a PNG or JPEG screen, or a text capture, from a done-done run)'].join('; ')}`, 'Cite a screen or a text capture of the outcome from a done-done run, then re-run this check');
+    // No result without the judge: once the plain checks pass, with none set it asks the user, or stops with the command that saves one.
+    await withChoice('judge', cfg);
+    run?.judging(findings.length ? INCONCLUSIVE : PASS, [...findings]);
+    const j = await judge(cfg, () => selectJudge(cfg, run?.author ? agentRun(cfg, run.author.agent, run.author.model) : judgeAuthor(cfg)), claim.outcome, captures, run ? join(run.dir, 'agents') : join(home(), 'agents'));
+    // The judge's next step leads the help when its verdict decides the result.
+    if (j.judged.some((r) => r.verdict === 'fail'))
+        judgeLevel = 'fail';
+    else if (!findings.length && j.judged.some((r) => r.verdict === 'unsure'))
+        judgeLevel = 'inconclusive';
+    const shots = new Set(captures.filter(screen).map((c) => c.name));
+    for (const r of j.judged.filter((r) => r.verdict !== 'pass'))
+        findings.push({ level: r.verdict === 'fail' ? 'fail' : 'inconclusive', why: `${r.path}: judge says ${r.verdict !== 'fail' ? 'unsure' : shots.has(r.path) ? 'wrong screen' : 'wrong output'}: ${r.reason}`, file: r.path, ...(r.seen && { seen: r.seen }) });
+    for (const part of j.missing)
+        findings.push({ level: 'inconclusive', why: `the outcome names ${part}, but no passing capture shows it: capture ${part} and cite that capture` });
+    const rows = cap(j.judged);
+    const { choice } = j;
+    const judged = { ...(choice && { route: choice.route, model: choice.model, independence: choice.independence, author: choice.author.agent ? `${choice.author.agent} (model ${choice.author.model || 'none'})` : 'no agent set' }), judged: rows.items.map(({ sha256, ...r }) => r) };
+    if (choice) {
+        const byName = new Map(captures.map((c) => [c.name, receiptPath(repo, cfg, cite(c.name))]));
+        judgeBlock = { route: choice.route, model: choice.model, independence: choice.independence, author: choice.author, verdicts: j.judged.map((r) => ({ path: byName.get(r.path), sha256: r.sha256, verdict: r.verdict, ...(r.seen && { seen: r.seen }) })) };
     }
-    const rep = report(findings, files, { cfg, repo, claim: claim?.outcome, source: values.from, citationBase: values['citation-base'], judge: judged, judgeLevel });
+    if (rows.omitted)
+        judged.judged_omitted = rows.omitted;
+    if (j.notJudged.length)
+        judged.not_judged = j.notJudged;
+    judged.note = 'PNG and JPEG screens and text captures (logs, JSON, CLI output) are judged; video and other files are not';
+    const rep = report(findings, files, { cfg, repo, claim: claim.outcome, source: values.from, citationBase: values['citation-base'], judge: judged, judgeLevel });
     if (rep.code === PASS) {
         mkdirSync(dirname(ledger), { recursive: true });
         appendFileSync(ledger, hashes.filter((h) => !used.get(h)?.has(claimId)).map((h) => `${h} ${claimId}\n`).join(''));
@@ -848,25 +842,16 @@ function verifyReceipt(repo, cfg, headArg) {
     catch (e) {
         return fail(`receipt for ${short} is malformed (${e.message})`);
     }
-    if (!rec || typeof rec !== 'object' || (rec.schema !== 1 && rec.schema !== 2) || (rec.result !== 'pass' && rec.result !== 'overridden') || !Array.isArray(rec.files) || !rec.files.length)
+    if (!rec || typeof rec !== 'object' || rec.schema !== 2 || rec.result !== 'pass' || !Array.isArray(rec.files) || !rec.files.length)
         return fail(`receipt for ${short} is malformed`);
     if (!rec.files.every((f) => f && typeof f === 'object' && typeof f.path === 'string' && typeof f.sha256 === 'string'))
         return fail(`receipt for ${short} is malformed`);
-    // A schema 2 judge block must name its judge, and pass only captures this receipt cites. An overridden receipt keeps the
-    // verdicts that did not pass, or no block when the judge judged no capture.
+    // The judge block must name its judge, and pass only captures this receipt cites.
     const j = rec.judge;
-    const o = rec.override;
-    const overridden = rec.result === 'overridden';
     const badJudge = !j || typeof j !== 'object' || typeof j.route !== 'string' || typeof j.model !== 'string' || !['agent', 'model', 'session-only'].includes(j.independence) || !Array.isArray(j.verdicts) || !j.verdicts.length
-        || !j.verdicts.every((v) => v && (overridden ? ['pass', 'fail', 'unsure'] : ['pass']).includes(v.verdict) && rec.files.some((f) => f.path === v.path && f.sha256 === v.sha256));
-    if (overridden ? j !== undefined && badJudge : rec.schema === 2 && badJudge)
+        || !j.verdicts.every((v) => v && v.verdict === 'pass' && rec.files.some((f) => f.path === v.path && f.sha256 === v.sha256));
+    if (badJudge)
         return fail(`receipt for ${short} has a malformed judge block`);
-    // A caller can move a run past its gate, but never turn it into a pass: an overridden receipt always fails here.
-    if (overridden) {
-        if (rec.schema !== 2 || !o || typeof o !== 'object' || !['approve', 'skip'].includes(o.action) || typeof o.by !== 'string' || typeof o.reason !== 'string' || !o.reason)
-            return fail(`receipt for ${short} has a malformed override`);
-        return { code: FAIL, result: { command: 'receipt', result: 'overridden', head: commit, claim: rec.claim, override: o, judge: j, help: [`This head is not proven: the judge did not pass it, and ${o.by} chose ${o.action} (${o.reason})`, 'Capture proof the judge passes, then: done-done verify --outcome "<what a user can now do>"'] } };
-    }
     if (rec.head !== commit)
         return fail(`receipt records head ${String(rec.head).slice(0, 12)}, not ${short}`);
     const now = head(repo);
@@ -892,7 +877,7 @@ function verifyReceipt(repo, cfg, headArg) {
     }
     if (bad.length)
         return fail(`cited evidence no longer matches the receipt: ${bad.join('; ')}`);
-    return { code: PASS, result: { command: 'receipt', result: 'pass', head: commit, tree: rec.tree, claim: rec.claim, files: rec.files.length, at: rec.at, schema: rec.schema, ...(rec.schema === 2 && { judge: j }), help: ['This receipt is valid for this head.'] } };
+    return { code: PASS, result: { command: 'receipt', result: 'pass', head: commit, tree: rec.tree, claim: rec.claim, files: rec.files.length, at: rec.at, schema: rec.schema, judge: j, help: ['This receipt is valid for this head.'] } };
 }
 async function cmdReceipt(argv) {
     const vi = argv.indexOf('--verify');
@@ -913,17 +898,22 @@ async function cmdReceipt(argv) {
     }
     if (!rest.length)
         throw new UsageError('receipt needs a claim (--outcome "<claim>" <files...> or --from <file|->) or --verify <head>');
+    assertCleanForReceipt(repo);
     return emitted(recordReceipt(repo, cfg, await runCheck(rest)));
 }
+function assertCleanForReceipt(repo) {
+    if (head(repo).dirty)
+        throw new UsageError('receipt: tracked files have uncommitted changes, so no receipt was written; commit or revert them, then re-run receipt', 'Commit the tracked changes, then: done-done receipt --from <file|->');
+}
 // Write the receipt for a check that passed on a clean tree and cited evidence, or say why none was written.
 function recordReceipt(repo, cfg, r) {
-    if (r.code !== PASS)
-        return { code: r.code, result: { ...r.result, command: 'receipt', reason: 'the check did not pass, so no receipt was written' } };
-    if (r.head.dirty)
-        return { code: FAIL, result: { command: 'receipt', result: 'fail', head: r.head.commit, claim: r.claim, reason: 'tracked files have uncommitted changes; commit or revert them, then re-run receipt', help: ['Commit the tracked changes, then: done-done receipt --from <file|->'] } };
+    if (r.code !== PASS || !r.judgeBlock)
+        return { code: r.code === PASS ? INCONCLUSIVE : r.code, result: { ...r.result, command: 'receipt', reason: 'the check did not pass its judge, so no receipt was written' } };
+    assertCleanForReceipt(repo);
+    // A missing citation is not a verdict: the judge passed, but the receipt cannot bind it, so it stops like a judge error.
     if (!r.cited.length)
-        return { code: FAIL, result: { command: 'receipt', result: 'fail', head: r.head.commit, claim: r.claim, reason: 'the check cited no evidence files, so no receipt was written; a receipt must bind at least one cited evidence file', help: ['Cite real proof: done-done receipt --outcome "<claim>" <files...>'] } };
-    const rec = { schema: r.judgeBlock ? 2 : 1, repo: cfg.app, head: r.head.commit, tree: r.head.tree, claim: r.claim ?? '', result: 'pass', at: new Date().toISOString(), files: r.cited, ...(r.judgeBlock && { judge: r.judgeBlock }) };
+        throw new UsageError('receipt: the check cited no evidence files, so no receipt was written; a receipt must bind at least one cited evidence file', 'Cite real proof: done-done receipt --outcome "<claim>" <files...>');
+    const rec = { schema: 2, repo: cfg.app, head: r.head.commit, tree: r.head.tree, claim: r.claim ?? '', result: 'pass', at: new Date().toISOString(), files: r.cited, judge: r.judgeBlock };
     const path = writeReceipt(cfg, rec);
     const result = { command: 'receipt', result: 'pass', head: r.head.commit, tree: r.head.tree, claim: rec.claim, files: rec.files.length, receipt: shown(repo, path) };
     return { code: PASS, result: { ...result, ...(r.judge && { judge: r.judge }), help: [`Verify this receipt (CI or merge): done-done receipt --verify ${r.head.commit}`] } };
@@ -946,9 +936,7 @@ function staleness(repo, cfg, from, to) {
 }
 // Quote an argument only when a shell would split it.
 const arg = (a) => (/^[\w./@:+-]+$/.test(a) ? a : `'${a.replaceAll("'", `'\\''`)}'`);
-function checkHelp(code, findings, files, { cfg, repo, claim, source, citationBase, notProven, judgeLevel }) {
-    if (notProven)
-        return ['Capture real proof and replace "not proven:", or set checks.not_proven: allow and re-check from a trusted ref'];
+function checkHelp(code, findings, files, { cfg, repo, claim, source, citationBase, judgeLevel }) {
     if (judgeLevel === 'fail' && code === FAIL)
         return [`Capture the screen the outcome describes, then re-run this check: ${captureHint(cfg)}`];
     if (judgeLevel && code === INCONCLUSIVE)
@@ -977,7 +965,7 @@ function checkHelp(code, findings, files, { cfg, repo, claim, source, citationBa
         help.push(`Commit your change, re-capture with ${capture}, then check the new files`);
     return help;
 }
-function report(findings, files, ctx, note = '') {
+function report(findings, files, ctx) {
     const code = findings.some((f) => f.level === 'fail') ? FAIL : findings.length ? INCONCLUSIVE : PASS;
     const result = {
         command: 'check',
@@ -987,8 +975,6 @@ function report(findings, files, ctx, note = '') {
         result.claim = ctx.claim;
     if (ctx.source)
         result.source = ctx.source;
-    if (note)
-        result.note = note;
     if (files.length) {
         const ev = cap(files);
         result.files = files.length;
@@ -998,7 +984,7 @@ function report(findings, files, ctx, note = '') {
     }
     if (ctx.judge)
         result.judge = ctx.judge;
-    const rows = cap(findings.map((f) => ({ level: f.level, why: f.why })));
+    const rows = cap(findings.map((f) => ({ level: f.level, why: f.why, ...(f.seen && { seen: f.seen }) })));
     if (rows.items.length)
         result.findings = rows.items;
     if (rows.omitted)
@@ -1213,7 +1199,7 @@ async function agentDrive(repo, cfg, feature) {
 // With a verify skill and no journey, the next step can be an agent drive.
 const driveHint = (repo, cfg) => existsSync(join(repo, cfg.skill, 'SKILL.md'))
     ? ['Have your coding agent drive a verify skill feature: done-done verify --outcome "<what a user can now do>" [--feature <name>]'] : [];
-// The page-check record shape and how to collect it with chrome-devtools-axi, for the drive prompt and the verify skill scaffold.
+// The page-check record shape and how to collect it with chrome-devtools-axi, for the drive prompt.
 const DOM_RECORD = '{"url": "<page url>", "overflow": <true when content is wider than the viewport>, "overflowing": ["<element>", ...], "console_errors": ["<message>", ...], "failed_requests": [{"url": "<url>", "status": <HTTP status, 0 when none>}], "squashed_text": [{"element": "<element>", "text": "<text>", "chars": <width in characters>, "lines": <n>, "words": <n>}]}'
     + `; with your browser tool (for example chrome-devtools-axi): overflow from eval "() => { const w = document.documentElement.clientWidth; return { overflow: document.documentElement.scrollWidth > w, overflowing: [...document.querySelectorAll('body *')].filter((e) => e.getBoundingClientRect().right > w + 1).slice(0, 10).map((e) => e.tagName.toLowerCase() + (e.id ? '#' + e.id : '')) } }", console errors from console --type error, failed requests (status 400 or more, or no response) from network, squashed_text from eval "${SQUASHED_TEXT}" exactly as written (in every frame, an embedded one too)`;
 function drivePrompt(run, at, cfg, evidence, scratch, base = '') {
@@ -1311,7 +1297,7 @@ async function runSteps(dir) {
     // A fix's re-run (auto_fix.verify) is quiet: it leaves the run's steps as they are, and its step logs go to `quiet`.
     let quiet = null;
     const set = (s, status, extra = {}) => quiet ?? setStep(dir, run, s, status, extra);
-    // A step that starts skips the earlier steps still pending (the judge when it is off, a fix that was not needed).
+    // A step that starts skips the earlier steps still pending (the judge after a failed check, a fix that was not needed).
     const begin = (name) => {
         for (const s of quiet ? [] : run.steps.slice(0, run.steps.findIndex((s) => s.name === name)))
             if (s.status === 'pending')
@@ -1541,7 +1527,7 @@ async function runSteps(dir) {
                     return { end: { result: 'fail', reason: `check: input guard: ${diffs.map((d) => d.why).join('; ')}` }, asks: [], fixable: [] };
                 }
             }
-            // The check's own findings end the check step; the judge, when on and the check did not fail, is its own step.
+            // The check's own findings end the check step; the judge, when the check did not fail, is its own step.
             let checkFindings = 0;
             const judging = (code, findings) => {
                 checkFindings = findings.length;
@@ -1550,7 +1536,7 @@ async function runSteps(dir) {
             };
             // A fix worktree is detached, so it checks for the claim id of the user's branch.
             const claimId = run.claim_id ?? (fix ? git(run.repo, 'branch', '--show-current') : null);
-            const checked = await runCheck(['--outcome', run.claim, ...files, ...(claimId ? ['--claim-id', claimId] : [])], { dir, judge: !!run.judge, judging, author: run.author, repo: at, cfg });
+            const checked = await runCheck(['--outcome', run.claim, ...files, ...(claimId ? ['--claim-id', claimId] : [])], { dir, judging, author: run.author, repo: at, cfg });
             const logged = { ...checked.result, findings: checked.findings };
             delete logged.findings_omitted;
             log('check', logged);
@@ -1562,14 +1548,11 @@ async function runSteps(dir) {
             }
             else
                 set(step, checked.code === PASS ? 'completed' : 'failed', { exit: checked.code, findings: checked.findings });
-            // The gate: when the check itself is clean but the judge did not pass a capture (or judged none of an agent's), the run
-            // waits for the caller (respond), who can move it on but never make it a pass. The runner ends here.
-            const clean = judgeRan ? checkFindings === 0 : checked.code === PASS;
-            const notJudged = judgeRan && run.journey === null ? (checked.judge?.not_judged ?? []) : [];
-            const asks = !clean ? [] : judgeRan ? [...judgeFindings, ...notJudged.map((name) => ({ level: 'inconclusive', why: `${name}: the judge did not read this capture, and an agent drive passes only with a judge pass on every capture` }))]
-                : run.journey !== null ? []
-                    : run.judge ? [{ level: 'inconclusive', why: 'the judge judged no capture (only PNG, JPEG and text captures are judged), and an agent drive passes only with a judge pass' }]
-                        : [{ level: 'inconclusive', why: 'the judge is off (--no-judge), and an agent drive passes only with a judge pass' }];
+            // The gate: when the check itself is clean but the judge did not pass a capture (or read none, or not all of an agent's),
+            // the run waits for the caller (respond), who can move it on but never make it a pass. The runner ends here.
+            const clean = judgeRan && checkFindings === 0;
+            const notJudged = clean && run.journey === null ? (checked.judge?.not_judged ?? []) : [];
+            const asks = !clean ? [] : [...judgeFindings, ...notJudged.map((name) => ({ level: 'inconclusive', why: `${name}: the judge did not read this capture, and an agent drive passes only with a judge pass on every capture` }))];
             // With auto_fix.verify, screens the judge calls wrong (and nothing it was unsure of) are a product failure to fix.
             if (tries && asks.length && asks.every((f) => f.level === 'fail'))
                 return { checked, end: { result: 'fail', reason: `judge: ${asks[0].why}` }, asks: [], fixable: wrongScreens(asks) };
@@ -1588,8 +1571,6 @@ async function runSteps(dir) {
             p.end = { ...p.end, reason: `${p.end.reason}; auto_fix.verify does not re-run a spends journey` };
         if (tries && p.end && p.fixable.length && !journey?.spends) {
             const sorted = await sortJudged(run, cfg, failures(p.fixable), join(dir, 'agents', 'triage.json'), h);
-            if (typeof sorted === 'string')
-                return finish('blocked', `triage: ${sorted}`);
             if (sorted.length)
                 p = { checked: p.checked, asks: sorted, fixable: [] };
             else {
@@ -1616,8 +1597,7 @@ async function runSteps(dir) {
             const wrong = p.asks.filter((f) => f.level === 'fail');
             if (tries && wrong.length && wrong.length < p.asks.length) {
                 const sorted = await sortJudged(run, cfg, failures(wrongScreens(wrong)), join(dir, 'agents', `triage${fixed ? '-gate' : ''}.json`), h, true);
-                if (typeof sorted !== 'string')
-                    p.asks = [...sorted, ...p.asks.filter((f) => f.level !== 'fail')];
+                p.asks = [...sorted, ...p.asks.filter((f) => f.level !== 'fail')];
             }
             begin('gate');
             const findings = p.asks.map((f, i) => ({ id: `gate-${i + 1}`, severity: f.level === 'fail' ? 'error' : 'warning', what: f.why, action: 'ask-user' }));
@@ -1644,7 +1624,7 @@ async function runSteps(dir) {
                 s.status = 'skipped';
         const name = step?.name ?? 'setup';
         const text = errorText(e);
-        Object.assign(run, { status: 'failed', reason: text.startsWith(`${name}:`) ? text : `${name}: ${text}` });
+        Object.assign(run, { status: 'failed', reason: text.startsWith(`${name}:`) ? text : `${name}: ${text}`, ...(e instanceof UsageError && { stopped: true }) });
         if (step)
             set(step, 'failed');
         else {
@@ -1671,19 +1651,20 @@ const VERIFY_TRIAGE = {
     },
     fix: 'fix',
 };
-// The judge the user set (never the fixer's agent) sorts the judge's failures before each fix: [] sends them all to the fixer;
-// with any ask (or unsure answer), or `park`, every judge failure goes to the gate with its class. A string: why the judge did not answer.
+// The judge the user set sorts the judge's failures before each fix: [] sends them all to the fixer;
+// with any ask (or unsure answer), or `park`, every judge failure goes to the gate with its class. A judge that does not
+// answer throws, so the run fails with the cause.
 async function sortJudged(run, cfg, open, record, h, park = false) {
     const judged = open.filter((f) => f.kind === 'judge');
     if (!judged.length)
         return [];
     const step = h.begin('triage');
-    const choice = selectJudge(cfg, selectAgent(cfg), true);
+    const choice = selectJudge(cfg, selectAgent(cfg));
     const asks = await triage(cfg, choice, judged, VERIFY_TRIAGE, { app: cfg.app, outcome: run.claim, findings: judged }, record);
     h.log('triage', { judge: { route: choice.route, model: choice.model, independence: choice.independence }, ask_user: asks });
-    h.set(step, typeof asks === 'string' ? 'failed' : 'completed');
-    if (typeof asks === 'string' || !(asks.length || park))
-        return typeof asks === 'string' ? asks : [];
+    h.set(step, 'completed');
+    if (!(asks.length || park))
+        return [];
     return judged.map((f) => ({ level: 'fail', why: `${(asks.find((x) => x.id === f.id) ?? f).what}; triage: ${asks.some((x) => x.id === f.id) ? 'ask' : 'fix'}`, file: f.file }));
 }
 // auto_fix.verify: the user's agent fixes product code in a done-done worktree at the verified head, done-done commits it and
@@ -1769,8 +1750,6 @@ Answer with summary (what you changed, in one line) and blocker ("" when you fix
             if (next.end && !next.fixable.length)
                 return blocked(`the re-run after attempt ${k} did not pass: ${next.end.reason}`, []);
             const sorted = next.end ? await sortJudged(run, cfg, failures(next.fixable), join(dir, 'agents', `triage-fix${k}.json`), h).catch((e) => { close('failed'); throw e; }) : [];
-            if (typeof sorted === 'string')
-                return blocked(`triage: ${sorted}`, failures(next.fixable));
             if (!next.end || sorted.length) {
                 run.fix.branch = `done-done/verify-${run.run_id}`;
                 git(repo, 'branch', run.fix.branch, made.commit);
@@ -1827,11 +1806,9 @@ function showRun(dir, cfg, command, gone = false) {
         reason = `the runner died at step ${at?.name}${run.runner ? ` (pid ${run.runner.pid}, last heartbeat ${beat}s ago)` : ' before it started'}`;
         reapJourney(dir, run);
     }
-    // An overridden run is never a pass: it exits 1 like a fail.
-    const code = status === 'pending' || status === 'running' || status === 'awaiting_approval' ? WAITING : status === 'cancelled' || status === 'failed' || run.result === 'fail' || run.result === 'overridden' || run.result === 'drift' || (run.kind === 'verify' && (run.result === 'changed' || run.result === 'blocked')) ? FAIL : run.result === 'inconclusive' || run.result === 'blocked' ? INCONCLUSIVE : PASS;
+    const code = status === 'pending' || status === 'running' || status === 'awaiting_approval' ? WAITING : run.stopped && status === 'failed' ? USAGE : status === 'cancelled' || status === 'failed' || run.result === 'fail' || run.result === 'drift' || (run.kind === 'verify' && (run.result === 'changed' || run.result === 'blocked')) ? FAIL : run.result === 'inconclusive' || run.result === 'blocked' ? INCONCLUSIVE : PASS;
     const drive = run.journey ?? (run.feature ? `--feature ${arg(run.feature)}` : '');
-    const judgeFlag = run.judge === false && cfg.judge.enabled !== false ? ' --no-judge' : run.judge && cfg.judge.enabled === false ? ' --judge' : '';
-    const again = run.kind === 'maintain' ? 'done-done maintain' : `done-done verify ${drive ? `${drive} ` : ''}--outcome ${arg(run.claim)}${run.claim_id ? ` --claim-id ${arg(run.claim_id)}` : ''}${judgeFlag}`;
+    const again = run.kind === 'maintain' ? 'done-done maintain' : `done-done verify ${drive ? `${drive} ` : ''}--outcome ${arg(run.claim)}${run.claim_id ? ` --claim-id ${arg(run.claim_id)}` : ''}`;
     const findings = cap(run.findings ?? []);
     const ev = cap(rec ? evidenceOf(run.repo, cfg, rec) : []);
     const result = { command, run_id: run.run_id, kind: run.kind, status };
@@ -1883,25 +1860,22 @@ function showRun(dir, cfg, command, gone = false) {
             `Their no: done-done respond --run ${id} --action skip --reason "<why they said no>"   (ends fail, nothing spent)`,
         ]
             : status === 'awaiting_approval' ? [
-                'Read the findings and look at the captures (evidence above), then answer the gate:',
-                `done-done respond --run ${id} --action approve --reason "<why they do show the outcome>"   (ends overridden, never pass)`,
-                `done-done respond --run ${id} --action skip --reason "<why to go on without a judge pass>"   (ends overridden, never pass)`,
+                'The judge did not pass this run, and nothing moves a run past its judge. Read the findings and look at the captures (evidence above), then end it:',
                 `done-done respond --run ${id} --action fix   (ends fail; fix the product, or the verify skill's recipe (done-done maintain checks it against the source), commit, then: done-done rerun --run ${id})`,
             ]
-                : run.result === 'overridden' ? [`This head is not proven: ${run.response?.by} chose ${run.response?.action} past the judge, and receipt --verify refuses this receipt`, `Capture proof the judge passes: ${again}`]
-                    : code === WAITING ? [`The run goes on without this command; read it later: done-done status --run ${run.run_id}`]
-                        : run.kind === 'verify' && /^fix:/.test(run.reason ?? '') ? [`Read what each fix attempt did: done-done logs --step fix --run ${id}`, `Fix the product by hand, commit, then run again: ${again}`]
-                            : run.result === 'changed' ? [`Review the fix on its own branch (your branch is untouched): git show ${run.fix.branch}`, `Take it: git merge ${run.fix.branch}, or drop it: git branch -D ${run.fix.branch}`]
-                                : run.kind === 'maintain' && status === 'completed' ? (run.result === 'clean' ? [`The verify skill matches the source; read the readers' recipes: done-done logs --step reconcile --run ${run.run_id}`]
-                                    : run.result === 'drift' ? [`Fix the findings in ${cfg.skill} (--full lists them all), commit, then run again: ${again}`, `Or let done-done's agent fix them on a branch: set auto_fix: { maintain: 2 } in .done-done.yaml, then run again: ${again}`]
-                                        : /^ask-user:/.test(run.reason ?? '') ? ['Ask the user about each ask-user finding: is the product or the skill wrong? Never decide it for them', `Product wrong: fix the product (maintain never edits product code). Skill wrong: fix ${cfg.skill}, commit, then run again: ${again}`]
-                                            : /^fix:/.test(run.reason ?? '') ? [`Read what each fix attempt did: done-done logs --step fix --run ${run.run_id}`, `Fix the findings in ${cfg.skill} by hand, commit, then run again: ${again}`]
-                                                : /^locate: no verify skill/.test(run.reason ?? '') ? ['Create the verify skill: done-done init']
-                                                    : /^locate:/.test(run.reason ?? '') ? [`Make ${cfg.skill} a real folder inside the repository (not a link), commit, then run again: ${again}`]
-                                                        : [`Read the step logs in ${shown(run.repo, join(dir, 'logs'))}`, `Fix the cause, then run again: ${again}`])
-                                    : code === PASS ? [`Verify this receipt (CI or merge): done-done receipt --verify ${rec.commit}`]
-                                        : status === 'cancelled' ? [...(run.kind === 'maintain' ? [] : [`Start again from the failed step: done-done rerun --run ${run.run_id}`]), `List past runs: done-done history`]
-                                            : [`Read the step logs in ${shown(run.repo, join(dir, 'logs'))}`, ...(run.kind === 'maintain' ? [] : [`Fix the cause, commit, then run again from the failed step: done-done rerun --run ${run.run_id}`]), `Or start a new run: ${again}`];
+                : code === WAITING ? [`The run goes on without this command; read it later: done-done status --run ${run.run_id}`]
+                    : run.kind === 'verify' && /^fix:/.test(run.reason ?? '') ? [`Read what each fix attempt did: done-done logs --step fix --run ${id}`, `Fix the product by hand, commit, then run again: ${again}`]
+                        : run.result === 'changed' ? [`Review the fix on its own branch (your branch is untouched): git show ${run.fix.branch}`, `Take it: git merge ${run.fix.branch}, or drop it: git branch -D ${run.fix.branch}`]
+                            : run.kind === 'maintain' && status === 'completed' ? (run.result === 'clean' ? [`The verify skill matches the source; read the readers' recipes: done-done logs --step reconcile --run ${run.run_id}`]
+                                : run.result === 'drift' ? [`Fix the findings in ${cfg.skill} (--full lists them all), commit, then run again: ${again}`, `Or let done-done's agent fix them on a branch: set auto_fix: { maintain: 2 } in .done-done.yaml, then run again: ${again}`]
+                                    : /^ask-user:/.test(run.reason ?? '') ? ['Ask the user about each ask-user finding: is the product or the skill wrong? Never decide it for them', `Product wrong: fix the product (maintain never edits product code). Skill wrong: fix ${cfg.skill}, commit, then run again: ${again}`]
+                                        : /^fix:/.test(run.reason ?? '') ? [`Read what each fix attempt did: done-done logs --step fix --run ${run.run_id}`, `Fix the findings in ${cfg.skill} by hand, commit, then run again: ${again}`]
+                                            : /^locate: no verify skill/.test(run.reason ?? '') ? ['Create the verify skill: done-done init']
+                                                : /^locate:/.test(run.reason ?? '') ? [`Make ${cfg.skill} a real folder inside the repository (not a link), commit, then run again: ${again}`]
+                                                    : [`Read the step logs in ${shown(run.repo, join(dir, 'logs'))}`, `Fix the cause, then run again: ${again}`])
+                                : code === PASS ? [`Verify this receipt (CI or merge): done-done receipt --verify ${rec.commit}`]
+                                    : status === 'cancelled' ? [...(run.kind === 'maintain' ? [] : [`Start again from the failed step: done-done rerun --run ${run.run_id}`]), `List past runs: done-done history`]
+                                        : [`Read the step logs in ${shown(run.repo, join(dir, 'logs'))}`, ...(run.kind === 'maintain' ? [] : [`Fix the cause, commit, then run again from the failed step: done-done rerun --run ${run.run_id}`]), `Or start a new run: ${again}`];
     emit(result);
     return code;
 }
@@ -1909,12 +1883,15 @@ async function waitRun(dir, pid) {
     while (['pending', 'running'].includes(loadRun(dir).status) && alive(pid))
         await new Promise((r) => setTimeout(r, 200));
 }
-// The judge a command will start: the user's agent and judge (asked for when unset), refused when it is the author.
-async function preflightJudge(cfg, needsAgent = true, fix = false) {
+// The judge a command will start: the user's agent and judge, asked for when unset.
+async function preflightJudge(cfg, needsAgent = true) {
     if (needsAgent)
         await withChoice('agent', cfg);
     await withChoice('judge', cfg);
-    return selectJudge(cfg, cfg.agent ? selectAgent(cfg) : NO_AUTHOR, fix);
+    return selectJudge(cfg, judgeAuthor(cfg));
+}
+function judgeAuthor(cfg) {
+    return cfg.agent ? selectAgent(cfg) : NO_AUTHOR;
 }
 const NO_AUTHOR = { agent: '', model: '' };
 // A run waiting at its gate is the user's call, so a new verify or rerun is refused until the user answers that run or it is
@@ -1928,23 +1905,20 @@ function refuseParked(cfg, repo, claim) {
     if (!parked.length)
         return;
     const id = parked[0];
-    throw new UsageError(`run ${parked.join(', ')} waiting at its gate for the user's answer blocks this run, which would go around that gate`, `Show the user its findings and captures (done-done status --run ${id}), then answer with their choice: done-done respond --run ${id} --action approve|skip|fix [--reason "<why>"], or stop it: done-done abort --run ${id}`);
+    throw new UsageError(`run ${parked.join(', ')} waiting at its gate for the user's answer blocks this run, which would go around that gate`, `Show the user its findings and captures (done-done status --run ${id}), then answer with their choice: done-done respond --run ${id} --action fix (approve|skip --reason "<why>" at a spend gate), or stop it: done-done abort --run ${id}`);
 }
-// Before a verify starts: its judge, and with auto_fix.verify an agent that can edit and a judge that is never that agent.
-async function preflightVerify(cfg, judging) {
-    if (cfg.auto_fix.verify) {
+// Before a verify starts: its judge, plus the agent when it drives (no journey) or fixes (auto_fix.verify, an agent that can edit).
+async function preflightVerify(cfg, agentDrives) {
+    if (agentDrives || cfg.auto_fix.verify)
         await withChoice('agent', cfg);
-        if (cfg.agent.startsWith('acp:'))
-            throw new UsageError(`${cfg.agent} cannot fix the product: done-done runs ACP agents with every tool denied`, `Set auto_fix.verify: 0 to report only, or set agent: to one of ${AGENTS.join(', ')}`);
-    }
-    if (!judging)
-        return;
-    await preflightJudge(cfg, true, !!cfg.auto_fix.verify);
+    if (cfg.auto_fix.verify && cfg.agent.startsWith('acp:'))
+        throw new UsageError(`${cfg.agent} cannot fix the product: done-done runs ACP agents with every tool denied`, `Set auto_fix.verify: 0 to report only, or set agent: to one of ${AGENTS.join(', ')}`);
+    await preflightJudge(cfg, false);
 }
 async function cmdVerify(argv) {
     const { values, positionals } = parseArgs({
         args: argv,
-        options: { outcome: { type: 'string' }, feature: { type: 'string' }, 'claim-id': { type: 'string' }, judge: { type: 'boolean' }, 'no-judge': { type: 'boolean' }, wait: { type: 'boolean' }, 'no-wait': { type: 'boolean' }, foreground: { type: 'boolean' } },
+        options: { outcome: { type: 'string' }, feature: { type: 'string' }, 'claim-id': { type: 'string' }, wait: { type: 'boolean' }, 'no-wait': { type: 'boolean' }, foreground: { type: 'boolean' } },
         allowPositionals: true,
     });
     if (!values.outcome?.trim())
@@ -1953,8 +1927,6 @@ async function cmdVerify(argv) {
         throw new UsageError('verify takes at most one journey name');
     if (positionals.length && values.feature !== undefined)
         throw new UsageError('pass a journey or --feature, not both: a journey drives by its command, --feature by the author agent');
-    if (values.judge && values['no-judge'])
-        throw new UsageError('pass only one of --judge and --no-judge');
     if ([values.wait, values['no-wait'], values.foreground].filter(Boolean).length > 1)
         throw new UsageError('pass only one of --wait, --no-wait and --foreground');
     const repo = repoRoot();
@@ -1973,16 +1945,15 @@ async function cmdVerify(argv) {
         throw new UsageError('HEAD is detached, so no branch names this claim; pass --claim-id <id>');
     refuseParked(cfg, repo, values['claim-id'] ?? branch);
     const drive = journey === null ? await agentDrive(repo, cfg, values.feature) : undefined;
-    // verify starts done-done's own judge by default; --no-judge or judge.enabled: false turns it off. An agent drive is judged too, since the author never grades its own captures.
-    const judging = !values['no-judge'] && (!!drive || !!values.judge || cfg.judge.enabled !== false);
-    // No judge set, or one config forbids (the author's own agent and model), is a usage error now, not a failed run later.
-    await preflightVerify(cfg, judging);
+    // verify always runs the judge the user set, the author's own agent and model included; the judge is settled here, so a
+    // run never fails later for one it never had.
+    await preflightVerify(cfg, journey === null);
     const id = newRunId(git(repo, 'rev-parse', 'HEAD'));
     const dir = join(runsRoot(cfg.app), id);
     mkdirSync(join(dir, 'logs'), { recursive: true });
     const created = now();
     const run = {
-        schema: 2, run_id: id, kind: 'verify', app: cfg.app, repo, journey, ...drive, claim: values.outcome, claim_id: values['claim-id'] ?? null, branch, judge: judging, status: 'pending',
+        schema: 2, run_id: id, kind: 'verify', app: cfg.app, repo, journey, ...drive, claim: values.outcome, claim_id: values['claim-id'] ?? null, branch, status: 'pending',
         steps: verifySteps(cfg).map((name) => ({ name, status: 'pending' })), created, updated: created,
         inputs: inputsOf(repo, cfg, journey, drive?.author),
     };
@@ -2012,11 +1983,15 @@ async function cmdMaintain(argv) {
     const repo = repoRoot();
     const cfg = loadConfig(repo);
     await withChoice('agent', cfg);
-    // auto_fix: the agent the user set fixes the skill and the judge the user set (never that agent and model) triages, so both are set now.
+    // maintain never reports without its agent: one that cannot start or cannot read stops it here, before any run.
+    const why = readerProblem(selectAgent(cfg));
+    if (why)
+        throw new UsageError(`maintain: ${why.replace(/^source-wave: /, '')}`, 'Install the agent or ask the user for another and save it: done-done init --agent <agent>');
+    // auto_fix: the agent the user set fixes the skill and the judge the user set triages, so both are set now.
     if (cfg.auto_fix.maintain) {
         if (cfg.agent.startsWith('acp:'))
             throw new UsageError(`${cfg.agent} cannot fix the verify skill: done-done runs ACP agents with every tool denied`, `Set auto_fix.maintain: 0 to report only, or set agent: to one of ${AGENTS.join(', ')}`);
-        await preflightJudge(cfg, true, true);
+        await preflightJudge(cfg);
     }
     const id = newRunId(git(repo, 'rev-parse', 'HEAD'));
     const dir = join(runsRoot(cfg.app), id);
@@ -2105,7 +2080,7 @@ const drivesClean = (record, head) => {
     }
 };
 async function cmdRerun(argv) {
-    const { values } = parseArgs({ args: argv, options: { run: { type: 'string' }, wait: { type: 'boolean' }, 'no-wait': { type: 'boolean' }, 'no-judge': { type: 'boolean' } } });
+    const { values } = parseArgs({ args: argv, options: { run: { type: 'string' }, wait: { type: 'boolean' }, 'no-wait': { type: 'boolean' } } });
     if (values.wait && values['no-wait'])
         throw new UsageError('pass only one of --wait and --no-wait');
     const repo = repoRoot();
@@ -2132,10 +2107,8 @@ async function cmdRerun(argv) {
     // A reused drive keeps the guard it ran under, so it is only reused when the watched inputs are the same ones.
     const driveReuse = same && drivesClean(src.record, src.inputs?.head) && JSON.stringify(src.guarded?.patterns ?? []) === JSON.stringify(srcCfg.inputs);
     const reused = (name) => (name === 'resolve' && same) || (name === 'drive' && driveReuse);
-    // A rerun judges as its source did; --no-judge turns it off for this run. A missing or forbidden judge is a usage
-    // error here too.
-    const judging = !values['no-judge'] && !!src.judge;
-    await preflightVerify(cfg, judging);
+    // A rerun always judges, whatever its source run did. A missing or forbidden judge is a usage error here too.
+    await preflightVerify(cfg, src.journey === null);
     const id = newRunId(git(repo, 'rev-parse', 'HEAD'));
     const dir = join(root, id);
     mkdirSync(join(dir, 'logs'), { recursive: true });
@@ -2144,7 +2117,7 @@ async function cmdRerun(argv) {
         return s && reused(name) && s.status === 'completed' ? { ...s } : { name, status: 'pending' };
     });
     const created = now();
-    const run = { schema: 2, run_id: id, kind: src.kind, app: cfg.app, repo: src.repo, journey, ...drive, claim: src.claim, claim_id: src.claim_id, branch: src.branch, judge: judging, status: 'pending', inputs, steps, created, updated: created, ...(driveReuse && src.record && { record: src.record }), ...(driveReuse && src.guarded && { guarded: src.guarded }) };
+    const run = { schema: 2, run_id: id, kind: src.kind, app: cfg.app, repo: src.repo, journey, ...drive, claim: src.claim, claim_id: src.claim_id, branch: src.branch, status: 'pending', inputs, steps, created, updated: created, ...(driveReuse && src.record && { record: src.record }), ...(driveReuse && src.guarded && { guarded: src.guarded }) };
     saveRun(dir, run);
     for (const s of steps) {
         const f = join(root, srcId, 'logs', `${s.name}.log`);
@@ -2240,17 +2213,16 @@ function answeredBy(repo) {
         return userInfo().username;
     }
 }
-// Answer a run waiting at its gate. approve and skip write the receipt as overridden (with who and why) and end the run
-// overridden, never pass; fix ends it fail. The runner has exited, so this command finishes the run; the respond lock
-// lets only one answer (or an abort) close it.
+// Answer a run waiting at its gate. At a spend gate, approve runs the journey and skip ends the run with nothing spent. At
+// the judge gate only fix answers: it ends the run fail, since nothing moves a run past its judge and no receipt is ever
+// written without a judge pass. The runner has exited, so this command finishes the run; the respond lock lets only one
+// answer (or an abort) close it.
 async function cmdRespond(argv) {
     const { values } = parseArgs({ args: argv, options: { run: { type: 'string' }, action: { type: 'string' }, reason: { type: 'string' } } });
     const action = values.action;
     if (action !== 'approve' && action !== 'skip' && action !== 'fix')
         throw new UsageError('respond needs --action approve, skip or fix', 'Run: done-done respond --run <run-id> --action <approve|skip|fix> [--reason "<why>"]');
     const reason = values.reason?.replace(/\s+/g, ' ').trim() ?? '';
-    if (action !== 'fix' && !reason)
-        throw new UsageError(`respond --action ${action} needs --reason "<why>": moving past the judge is recorded with who and why`, `Run: done-done respond --run <run-id> --action ${action} --reason "<why>"`);
     const repo = repoRoot();
     const cfg = loadConfig(repo);
     const root = runsRoot(cfg.app);
@@ -2265,11 +2237,15 @@ async function cmdRespond(argv) {
             throw notAtGate(run);
         if (run.gate.spend && action === 'fix')
             throw new UsageError(`run ${id} is at a spend gate, which takes --action approve or skip`, `Run: done-done respond --run ${id} --action approve|skip --reason "<why>"`);
+        if (!run.gate.spend && action !== 'fix')
+            throw new UsageError(`run ${id} is at its judge gate, which takes only --action fix: done-done never moves a run past its judge, and writes no receipt without a judge pass`, `Run: done-done respond --run ${id} --action fix, then fix the product or the verify skill's recipe, commit, and run again`);
+        if (action !== 'fix' && !reason)
+            throw new UsageError(`respond --action ${action} needs --reason "<why>": the spend answer is recorded with who and why`, `Run: done-done respond --run ${id} --action ${action} --reason "<why>"`);
         const gate = run.steps.find((s) => s.name === 'gate');
         const by = answeredBy(repo);
         run.response = { action, by, ...(reason && { reason }), at: now() };
         logEvent(dir, { step: 'gate', response: action, by, ...(reason && { reason }) });
-        // The spend gate: approve runs the journey in a new runner; skip or fix ends the run with nothing spent.
+        // The spend gate: approve runs the journey in a new runner; skip ends the run with nothing spent.
         if (run.gate.spend) {
             const drive = run.steps.find((s) => s.name === 'drive');
             if (action !== 'approve') {
@@ -2283,19 +2259,8 @@ async function cmdRespond(argv) {
                 rmSync(join(dir, lock));
             return launch(dir, cfg, 'respond', {});
         }
-        if (action === 'fix') {
-            setStep(dir, run, gate, 'failed');
-            finishRun(dir, run, 'fail', `gate: ${by} chose fix: ${reason || run.gate.findings[0].what}`);
-            return showRun(dir, cfg, 'respond');
-        }
-        setStep(dir, run, gate, 'completed');
-        const step = run.steps.find((s) => s.name === 'receipt');
-        setStep(dir, run, step, 'running');
-        const { gate: g } = run;
-        const rec = { schema: 2, repo: cfg.app, head: g.head.commit, tree: g.head.tree, claim: run.claim, result: 'overridden', at: now(), files: g.cited, ...(g.judge && { judge: g.judge }), override: { action, by, reason, at: run.response.at } };
-        run.receipt = shown(repo, writeReceipt(cfg, rec));
-        setStep(dir, run, step, 'completed');
-        finishRun(dir, run, 'overridden', `gate: ${by} chose ${action}: ${reason}`);
+        setStep(dir, run, gate, 'failed');
+        finishRun(dir, run, 'fail', `gate: ${by} chose fix: ${reason || run.gate.findings[0].what}`);
         return showRun(dir, cfg, 'respond');
     }
     catch (e) {
@@ -2306,7 +2271,7 @@ async function cmdRespond(argv) {
 // sign-off's communication contract v1 (github.com/umeranjum17/sign-off, docs/contract.md): done-done sends `gate` and
 // `evidence`, schema 1. Each value is checked against the contract's limits first, so a run that cannot make a valid
 // message writes no file. done-done never posts it: sign-off is the user's choice, so the help line names the post command.
-const GATE_LABELS = { approve: 'Approve', skip: 'Skip the judge', fix: 'Fix first' };
+const GATE_LABELS = { approve: 'Approve the spend', skip: 'Skip the spend', fix: 'Fix first' };
 function cmdSignoff(argv) {
     const { values } = parseArgs({ args: argv, options: { run: { type: 'string' } } });
     const repo = repoRoot();
@@ -2336,11 +2301,11 @@ function cmdSignoff(argv) {
         const more = findings.length > 1 ? ` (and ${findings.length - 1} more)` : '';
         msg = {
             contract: 1, kind: 'gate', schema: 1, key: `dd-gate-${id}`, filer: 'done-done',
-            title: text('title', spend ? `Spend ${spend} on the ${cfg.app} ${drove} run?` : `Move the ${cfg.app} ${drove} run on past its judge?`, 160),
+            title: text('title', spend ? `Spend ${spend} on the ${cfg.app} ${drove} run?` : `End the ${cfg.app} ${drove} run its judge did not pass, to fix it?`, 160),
             about: text('about', `${bare(findings[0].what)}${more}`, 500), run: runRef(head.commit),
-            // A spend gate takes approve or skip only (respond refuses fix there).
-            options: (spend ? ['approve', 'skip'] : ['approve', 'skip', 'fix']).map((value) => ({ value, label: GATE_LABELS[value] })),
-            recommend_value: findings.some((f) => f.severity === 'error') ? 'fix' : 'approve', close: 'done',
+            // A spend gate takes approve or skip; the judge gate only fix, since nothing moves a run past its judge.
+            options: (spend ? ['approve', 'skip'] : ['fix']).map((value) => ({ value, label: GATE_LABELS[value] })),
+            recommend_value: spend ? 'approve' : 'fix', close: 'done',
         };
         file = join(root, id, 'signoff-gate.json');
     }
@@ -2432,197 +2397,176 @@ function ensureIgnored(repo, rel) {
     appendFileSync(file, `${text && !text.endsWith('\n') ? '\n' : ''}${entry}\n`);
     return true;
 }
-// `init` also scaffolds the project's verify skill from the repo's own files: a port of the
-// the create-verification-skill interview (surface, run, drive, observe, isolate).
-// Every line is an action: a detected handle gets concrete drive and capture steps, and a blank detection cannot
-// fill gets the steps to find it and record it there, never an invented command. An existing skill is never
-// overwritten, so re-run is idempotent.
-function headText(p, max = 12000) {
-    try {
-        if (!lstatSync(p).isFile())
-            return '';
-        return readFileSync(p, 'utf8').slice(0, max);
-    }
-    catch {
-        return '';
-    }
-}
-// Where a drive stops and how it records what it found, for every step that asks it to find something.
-const RECORD = 'once the drive works, write what you found here in place of this instruction (after the drive: a `done-done verify` drive changes no repo file)';
+const STR = { type: 'string' };
+const SCAFFOLD_SCHEMA = {
+    type: 'object',
+    properties: {
+        surface: STR,
+        launch: { type: 'object', properties: { steps: STR, source: STR, safe: { type: 'boolean' }, why: STR }, required: ['steps', 'source', 'safe', 'why'], additionalProperties: false },
+        ready: STR,
+        harness: STR,
+        observe: STR,
+        isolate: STR,
+        features: { type: 'array', minItems: 1, items: { type: 'object', properties: { title: STR, reach: STR, drive: STR, source: STR, capture: { type: 'string', enum: ['screenshot', 'text'] } }, required: ['title', 'reach', 'drive', 'source', 'capture'], additionalProperties: false } },
+    },
+    required: ['surface', 'launch', 'ready', 'harness', 'observe', 'isolate', 'features'],
+    additionalProperties: false,
+};
+const NO_EDIT = 'The drive changes no repo file: note findings in the run\'s report; after the drive, run done-done maintain to see what drifted, then fix the skill';
+const MAX_FEATURES = 5;
 const slug = (t) => t.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 40) || 'feature';
-const SKIP_DIRS = new Set(['node_modules', 'dist', 'build', 'out', 'vendor', 'coverage', 'target', 'venv', '__pycache__', 'bower_components']);
-const SOURCE_FILE = /\.(m?[jt]s|py|go|rb|rs|php)$/;
-// Source files under `dir`, skipping hidden dirs (.git, .venv, .next, ...) and dependency and build output. The cap
-// applies while walking, so a large vendored tree never fills the sample before the app's own files are reached.
-function sourceFiles(dir, max, out = []) {
+// The agent's text as one sentence: its own final period is dropped so the template adds exactly one.
+const clause = (s) => s.trim().replace(/\.+$/, '');
+// A cited path as the tracked file list spells it: no leading ./ and no :line suffix.
+const cited = (s) => s.trim().replace(/^\.\//, '').replace(/:\d+(-\d+)?$/, '');
+// ponytail: the agent sees at most CONTEXT_CHARS of file text, each file cut at FILE_CHARS, ranked by path only
+// (manifests, proof scripts, source); the prompt names what was left out. Rank by content when a repo needs more.
+const CONTEXT_CHARS = 150_000;
+const FILE_CHARS = 20_000;
+const LISTED = 500;
+const MANIFEST = /^(readme(\.\w+)?|package\.json|makefile|justfile|procfile|pyproject\.toml|cargo\.toml|go\.mod|docker-compose\.ya?ml|dockerfile|\.done-done\.yaml)$/i;
+const SECRET = /(^|\/)\.env(\.[^/]*)?$|secret|credential|token|password|\.(pem|key|p12)$/i;
+const DOCKERFILE = /(^|\/)dockerfile(\.[^/]*)?$/i;
+const PROOF = /(^|[/._-])(scripts?|verify|e2e|smoke|proof|stub|fake|demo)([/._-]|$)/i;
+const SOURCE_FILE = /\.([cm]?[jt]sx?|py|go|rb|rs|php|sh|vue|svelte|html|css|java|kt|swift|c|h|cpp|cs|dart|scala|ex)$/;
+const DATA_FILE = /\.(json|ya?ml|md)$/i;
+// A tracked regular file's text, or undefined for a symlink, a binary, a file over 1 MB or one that cannot be read.
+function repoText(p) {
     try {
-        for (const e of readdirSync(dir, { withFileTypes: true })) {
-            if (out.length >= max)
-                break;
-            const p = join(dir, e.name);
-            if (e.isDirectory()) {
-                if (!e.name.startsWith('.') && !SKIP_DIRS.has(e.name) && !(e.name === 'components' && dir.endsWith(`${sep}src`)))
-                    sourceFiles(p, max, out);
-            }
-            else if (e.isFile() && SOURCE_FILE.test(e.name))
-                out.push(p);
-        }
-    }
-    catch {
-        // An unreadable directory contributes nothing; the scan runs on the rest.
-    }
-    return out;
-}
-// Surface, run, drive, observe and features read from package.json, Makefile, routes,
-// CLI commands and docs: the repo's own files, never invention.
-function detectApp(repo) {
-    let pkg = {};
-    try {
-        pkg = JSON.parse(headText(join(repo, 'package.json'), Infinity) || '{}');
+        const st = lstatSync(p);
+        if (!st.isFile() || st.size > 1 << 20)
+            return undefined;
+        const text = readFileSync(p, 'utf8');
+        return text.includes('\0') ? undefined : text;
     }
     catch {
-        pkg = {};
-    }
-    if (!pkg || typeof pkg !== 'object' || Array.isArray(pkg))
-        pkg = {};
-    const scripts = pkg.scripts && typeof pkg.scripts === 'object' ? pkg.scripts : {};
-    const deps = Object.keys({ ...(pkg.dependencies ?? {}), ...(pkg.devDependencies ?? {}) });
-    const has = (...names) => names.some((n) => deps.includes(n));
-    const bins = typeof pkg.bin === 'string' ? [pkg.bin] : pkg.bin && typeof pkg.bin === 'object' ? Object.values(pkg.bin).filter((v) => typeof v === 'string') : [];
-    const make = headText(join(repo, 'Makefile'), 4000);
-    let text = `${scripts.dev ?? ''}\n${scripts.start ?? ''}\n${make}`;
-    for (const f of sourceFiles(repo, 40))
-        text += `\n${headText(f, 6000)}`;
-    const routes = [...text.matchAll(/\b(app|router|server|api|fastify|routes|r)\.(get|post|put|patch|delete|del)\(\s*['"`](\/[^'"`\s]*)/g)]
-        .map((m) => `${m[2] === 'del' ? 'DELETE' : m[2].toUpperCase()} ${m[3]}`)
-        .filter((r, i, a) => a.indexOf(r) === i);
-    const commands = [...text.matchAll(/\.command\(\s*['"`]([^'"`\s\]]+)/g)]
-        .map((m) => m[1])
-        .filter((c, i, a) => a.indexOf(c) === i);
-    const browserTests = has('playwright', '@playwright/test', 'cypress', 'puppeteer');
-    const web = browserTests || has('react', 'next', 'vue', 'nuxt', 'svelte', 'solid', 'vite', 'webpack');
-    const cliish = bins.length > 0 || commands.length > 0 || has('commander', 'yargs', 'oclif', 'cac');
-    const api = routes.length > 0 || has('express', 'fastify', 'koa', 'hono');
-    const surface = web ? 'web UI' : cliish ? 'CLI' : api ? 'API/service' : 'app (unrecognized surface)';
-    const launch = scripts.dev ? `npm run dev (${scripts.dev})`
-        : scripts.start ? `npm start (${scripts.start})`
-            : bins.length ? `node ${bins[0]} --help`
-                : make ? `Read the Makefile for the target that starts the app (dev, run, serve or start) and start it with \`make <target>\`; ${RECORD}.`
-                    : `No start script, bin or Makefile was found: read README.md and the entry file for how the app starts, and start it; ${RECORD}.`;
-    const port = `${scripts.dev ?? ''} ${scripts.start ?? ''}`.match(/(?:localhost:|--port[= ])(\d{4,5})/)?.[1];
-    const driver = browserTests ? 'browser' : cliish ? 'tty' : api ? 'curl' : web ? 'browser' : 'shell';
-    const ready = port && (driver === 'browser' || driver === 'curl')
-        ? `\`curl -sS -o /dev/null http://localhost:${port}/\` exits 0. BASE below is http://localhost:${port}`
-        : driver === 'browser' || driver === 'curl'
-            ? `the launch output prints the app URL and \`curl -sS -o /dev/null <that URL>\` exits 0. BASE below is that URL; ${RECORD}`
-            : 'the launch command runs with no error (exit 0, or a prompt waiting for input)';
-    const harness = browserTests ? 'browser/CDP (Playwright)' : {
-        tty: 'tmux/PTY',
-        curl: 'plain HTTP (curl)',
-        browser: 'a browser tool (for example chrome-devtools-axi)',
-        shell: 'a shell (run the launch command and read its output)',
-    }[driver];
-    const observe = web
-        ? 'screenshots of the resulting state the outcome is about'
-        : cliish
-            ? 'terminal transcripts, exit codes and side effects (files written, rows inserted)'
-            : api
-                ? 'response bodies, status codes and side effects (rows inserted, messages sent)'
-                : 'screenshots of a page it shows, or its output saved as text when the outcome is text';
-    const isolate = web || port
-        ? 'Drive one instance at a time unless .done-done.yaml has an instance block, which gives each run its own port and HOME'
-        : 'each run uses its own invocation; never drive a shared session the user owns';
-    const runCli = (args) => bins.length ? `\`node ${bins[0]} ${args}\``
-        : scripts.start ? `\`npm start -- ${args}\``
-            : `the launch command from Launch with \`${args}\``;
-    const shot = (s) => `screenshot the resulting page to $DONE_DONE_EVIDENCE_ROOT/${s}.png`;
-    const saved = (s) => `save the output and exit status to $DONE_DONE_EVIDENCE_ROOT/${s}.txt`;
-    const open = 'open BASE in the browser, take a snapshot and act on the page by its visible labels';
-    const params = 'replace each :param or ${...} in the path with a real value from the handler or seed data';
-    const spends = 'a route that charges money or calls a paid outside service must be declared under `spends:` and never sent without the user approval';
-    const found = [
-        ...(driver === 'browser' || driver === 'curl' ? routes : []).map((r) => {
-            const [method, path] = r.split(' ');
-            const writes = method === 'GET' ? '' : `; ${spends}`;
-            const drive = driver === 'curl' ? `send it with \`curl -sS -X ${method} -w '\\nstatus %{http_code}\\n' "BASE${path}"\`, with the body its handler reads; ${params} (search the source for "${path}")${writes}`
-                : method === 'GET' ? `${open.replace('BASE', `BASE${path}`)}; ${params}`
-                    : `find the form or button that sends ${r} (search the source for "${path}"), ${params}, then fill and submit it as a user does${writes}`;
-            return { base: slug(r), title: r, reach: `the ${r} route`, drive };
-        }),
-        ...(driver === 'tty' ? commands : []).map((c) => ({ base: slug(c), title: `\`${c}\` command`, reach: `the CLI run with \`${c}\``, drive: `run ${runCli(`${c} --help`)} to learn its arguments, then ${runCli(`${c} <arguments>`)} as a user does` })),
-    ];
-    const fallback = {
-        browser: { title: 'Main page', reach: 'BASE, the first page a user opens', drive: open },
-        curl: { title: 'Main request', reach: 'the first endpoint README.md shows a client calling', drive: `read README.md and the entry file for the first endpoint a client calls, then send it with \`curl -sS -X <METHOD> -w '\\nstatus %{http_code}\\n' "BASE<path>"\`, with the body its handler reads; ${spends}; ${RECORD}` },
-        tty: { title: 'Main command', reach: 'what README.md says a user runs first', drive: `read README.md for the first command a user runs, then run it with its arguments as a user does; ${RECORD}` },
-        shell: { title: 'Main journey', reach: 'what README.md says a user runs first', drive: `read README.md and the entry file for what a user runs first, then run it in a shell as a user does; ${RECORD}` },
-    }[driver];
-    if (!found.length)
-        found.push({ base: 'main', ...fallback });
-    const features = [];
-    for (const f of found) {
-        let s = f.base;
-        for (let n = 2; features.some((g) => g.slug === s); n++)
-            s = `${f.base}-${n}`;
-        features.push({ slug: s, title: f.title, reach: f.reach, drive: f.drive, capture: (driver === 'browser' ? shot : saved)(s) });
+        return undefined;
+    }
+}
+// The repo as the agent sees it: the tracked file list (without the skill folder) and the text of the files that
+// say how the app starts and how the repo proves it.
+function repoContext(repo, skill) {
+    const listed = execFileSync('git', ['ls-files', '-z'], { cwd: repo, encoding: 'utf8', maxBuffer: Infinity, stdio: ['ignore', 'pipe', 'pipe'] });
+    const own = `${skill.replace(/\\/g, '/').replace(/\/+$/, '')}/`;
+    const files = listed.split('\0').filter((f) => f && !f.startsWith(own));
+    const rank = (f) => (MANIFEST.test(f) ? 0 : DATA_FILE.test(f) ? 3 : PROOF.test(f) || /(^|\/)bin\//.test(f) || DOCKERFILE.test(f) ? 1 : SOURCE_FILE.test(f) ? 2 : 3);
+    const shown = (f) => !SECRET.test(f) && rank(f) < 3;
+    let total = 0;
+    const parts = [];
+    const read = new Set();
+    const left = [];
+    for (const f of files.filter(shown).sort((a, b) => rank(a) - rank(b))) {
+        const body = total < CONTEXT_CHARS ? repoText(join(repo, f)) : undefined;
+        const kept = body === undefined ? undefined : body.length > FILE_CHARS ? `${body.slice(0, FILE_CHARS)}\n[truncated after ${FILE_CHARS} characters]` : body;
+        if (kept === undefined || total + kept.length > CONTEXT_CHARS) {
+            left.push(f);
+            continue;
+        }
+        total += kept.length;
+        read.add(f);
+        parts.push(`File ${f}:\n${kept}`);
     }
-    const shown = features.slice(0, 5);
-    return { surface, launch, ready, harness, observe, isolate, features: shown, omitted: features.length - shown.length };
+    const list = `Tracked files (${files.length}${files.length > LISTED ? `, the first ${LISTED} shown` : ''}): ${files.slice(0, LISTED).join(', ') || 'none'}`;
+    const out = left.length ? `\n\n[left out: ${left.length} files cannot be read or pass the ${CONTEXT_CHARS}-character cap: ${left.slice(0, 20).join(', ')}${left.length > 20 ? `, +${left.length - 20} more` : ''}]` : '';
+    return { files: new Set(files), read, text: `${list}\n\n${parts.join('\n\n')}${out}` };
 }
-function verifySkillMd(app, d) {
+function scaffoldPrompt(cfg, context, toolless) {
+    return `You write the verify skill for the app ${cfg.app}, which \`done-done init\` saves at ${cfg.skill}: how an agent launches this repo's app safely, drives it the way a user does, and captures proof that it works. Do not edit, create or delete any file, and do not run the app or any command.
+${toolless ? "You have no tools: the repo's tracked file list and the text of its key files are below, and they are all you can read." : 'The repository is your working directory: read the files below first, then any other file you need.'} Use only what the repo shows: never invent a command, path, flag, route or label. Never open a secret-looking file: a .env or .env.* file, a path whose name contains secret, credential, token or password, or a *.pem, *.key or *.p12 file. Never write a secret value into steps or why; name the environment variable instead.
+
+- launch: how to start the app for a proof. Prefer the repo's own proof path: a verify, e2e, smoke or demo script, or a journey in .done-done.yaml, that runs the app with a stub, fake or demo engine and its own state (a temporary HOME or data folder), the way the repo proves itself; copy its exact command and environment flags. {steps: the exact command on one line, with every environment flag, whose first command runs source (or passes it to an interpreter such as bash, node or npx tsx), source: the repo file they come from (for a .done-done.yaml journey, the script or file that journey runs, never .done-done.yaml itself), safe: true only when these steps use a stub or demo mode or isolated state, so no real account, paid service or the owner's own state is touched, why: what makes it safe, or when safe is false what it would touch}. When the repo has no such path, give the closest launch with safe false; never present a command that uses real accounts or the owner's own state (for example a start script that runs the real engine) as safe.
+- surface: what a user drives: web UI, CLI, API/service, desktop app or other.
+- ready: the check that shows the launched app is ready to drive (a URL that answers, a line it prints, an exit code).
+- harness: what drives it: a browser tool, a terminal (tmux or PTY), curl, or a shell.
+- observe: the proof to capture: screenshots of the resulting state, terminal transcripts and exit codes, response bodies, files written.
+- isolate: how each run keeps its own instance and state, and never drives a session or account the user owns.
+- features: up to ${MAX_FEATURES} things a user does with the app, the most important first, each {title, reach: how a user gets there, drive: the concrete steps through the repo's real handles (the command and its arguments, the route, the page label, the journey name), source: the repo file that shows the feature, capture: screenshot for a screen, text for output}.
+Each source is one path exactly as the tracked file list spells it, with no other words (scripts/verify/drive.sh, never a list or a note); launch.source may be empty only when safe is false.
+
+${context}`;
+}
+// Why an answer cannot be rendered into the skill, or '' when it can. A citation must be a tracked file the agent was
+// shown: shown is every tracked file for claude, which reads the repo itself, and the text plain code gave a tool-less agent.
+function scaffoldProblem(a, tracked, shown) {
+    const s = a;
+    const text = (v) => typeof v === 'string' && clause(v) !== '';
+    const citation = (p) => {
+        const c = cited(p);
+        if (!tracked.has(c))
+            return `cites ${c}, which is not a tracked file`;
+        if (SECRET.test(c))
+            return `cites ${c}, a secret-looking file, which can not be a source`;
+        return shown.has(c) ? '' : `cites ${c}, whose text is not in the prompt`;
+    };
+    for (const k of ['surface', 'ready', 'harness', 'observe', 'isolate'])
+        if (!text(s[k]))
+            return `missing ${k}`;
+    if (!s.launch || typeof s.launch !== 'object' || !text(s.launch.steps) || !text(s.launch.why) || typeof s.launch.safe !== 'boolean' || typeof s.launch.source !== 'string')
+        return 'missing launch steps, source, safe or why';
+    const launchCite = cited(s.launch.source) ? citation(s.launch.source) : '';
+    if (launchCite)
+        return `the launch ${launchCite}`;
+    if (!Array.isArray(s.features) || !s.features.length)
+        return 'has no features';
+    for (const f of s.features) {
+        if (!f || typeof f !== 'object' || !text(f.title) || !text(f.reach) || !text(f.drive) || !text(f.source) || !['screenshot', 'text'].includes(f.capture))
+            return 'has a feature without a title, reach, drive, source or capture';
+        const why = citation(f.source);
+        if (why)
+            return `the feature "${f.title}" ${why}`;
+    }
+    return '';
+}
+function verifySkillMd(app, agent, s, isolated, features, omitted) {
     const name = `verify-${app}`;
+    const source = cited(s.launch.source);
+    const launch = isolated
+        ? `${s.launch.steps.trim()}\n\nSafe: ${clause(s.launch.why)} (from \`${source}\`).`
+        : `Not isolated: ${clause(s.launch.why)}. The launch below is not shown to use a stub or demo engine with its own state, so it may use real accounts or the owner's own state. ${NO_EDIT}.\n\n${s.launch.steps.trim()}${source ? `\n\nFrom \`${source}\`.` : ''}`;
     const found = [
-        ...d.features.map((f) => `- ${f.title}: ${f.reach}`),
-        ...(d.omitted ? [`- ${d.omitted} more found and not listed; add them by hand or run maintain later.`] : []),
+        ...features.map((f) => `- [${f.title}](features/${f.slug}.md): ${clause(f.reach)} (\`${cited(f.source)}\`)`),
+        ...(omitted ? [`- ${omitted} more found and not listed; add them by hand or run maintain later.`] : []),
     ];
     return `---
-name: ${name}
-description: Drive the ${app} ${d.surface} the way a user does and capture proof it works. Use when proving a ${app} change, capturing evidence, or keeping the feature map honest.
+name: ${JSON.stringify(name)}
+description: ${JSON.stringify(`Drive the ${app} ${s.surface} the way a user does and capture proof it works. Use when proving a ${app} change, capturing evidence, or keeping the feature map honest.`)}
 ---
 
 # ${name}
 
-Scaffolded by \`done-done init\` from this repo's own files (surface: ${d.surface}). Where a step says to find something, the first drive finds it and records it there.
+Written by \`done-done init\` through ${agent} from this repo's own files (surface: ${s.surface}). ${NO_EDIT}.
 
 ## Launch
 
-${d.launch}
+${launch}
 
-Ready when ${d.ready}. Tear down what you started; never kill by process name.
+Ready: ${clause(s.ready)}. Tear down what you started; never kill by process name.
+Isolation: ${clause(s.isolate)}.
 When the repo's .done-done.yaml has an instance block, done-done already runs the app at $DONE_DONE_BASE_URL (its own port and HOME): BASE is then that URL, never a hard-coded port.
 
-## Doctor
-
-Read-only: is this instance worth driving? Process up, right build, port owned by us, auth valid. ${d.isolate}.
-
 ## Drive
 
-Harness: ${d.harness}. Prefer the repo's real handles (routes, commands, labels) over coordinates:
+Harness: ${clause(s.harness)}. Drive through the repo's real handles that each feature file names:
 
 ${found.join('\n')}
 
 ## Evidence
 
-Capture ${d.observe}. Exercise the real user path, not internal setters; done-done's judge checks every capture in the run folder against the outcome, so save only captures of the resulting state there and keep any of earlier steps outside it; verify side effects alongside what is visible. Evidence goes to the run folder \`done-done run\` prints. Every drive uses these done-done primitives:
-
-- Matrix: when .done-done.yaml sets a matrix block, each journey runs once per theme x width x form cell with DONE_DONE_THEME, DONE_DONE_WIDTH, DONE_DONE_FORM and DONE_DONE_CELL set: name each capture with its cell suffix, so every cell is captured or skipped with a reason, never silently missing.
-- DOM: when .done-done.yaml sets a dom block, write next to each capture its page-check record, the capture's name with .dom.json for its extension (home.dark.390w.png -> home.dark.390w.dom.json): ${DOM_RECORD}.
-- Text: for a text outcome, save the CLI output, log or JSON itself as a .txt, .log or .json capture; the check needs it to hold text and JSON to parse.
-- Secrets: never write a secret (key, token, password, Bearer header) into evidence or logs; verify scans them and fails the run on a hit.
-- Spends: a journey with \`spends:\` runs only after the user approves the spend at verify's gate; never run it another way.
-- Before/after: with \`base_ref\` set, verify also drives the base ref into the run folder's before/; save the same captures under the same names there, so each pairs with its base capture.
+What to capture: ${clause(s.observe)}. Exercise the real user path, not internal setters; done-done's judge checks every capture in the run folder against the outcome, so save only captures of the resulting state there and keep any of earlier steps outside it; verify side effects alongside what is visible. Evidence goes to the run folder \`done-done run\` prints.
 
 ## Cleanup
 
 Stop the instances this run started and remove scratch state. Evidence survives cleanup: never delete the run folder.
 `;
 }
-function verifyFeatureMd(app, d, f) {
-    return `# ${f.title}\n\nPart of the ${app} verification map; reached at ${f.reach}.\n\n## Sub-features\n\nList each thing a user can do here; ${RECORD}.\n\n## How to get to it (user POV)\n\n${f.reach}.\n\n## Driving it with ${d.harness}\n\n1. Launch the app as SKILL.md says and wait until it is ready.\n2. ${f.drive[0].toUpperCase()}${f.drive.slice(1)}.\n3. Capture: ${f.capture}, as SKILL.md's Evidence section says.\n4. Stop what you started.\n\n## Gotchas\n\nWrite here what surprised a drive (a slow load, a login wall, a label that moved) and what worked instead, after the drive.\n`;
+function verifyFeatureMd(app, s, f) {
+    const capture = f.capture === 'screenshot' ? `screenshot the resulting page to $DONE_DONE_EVIDENCE_ROOT/${f.slug}.png` : `save the output and exit status to $DONE_DONE_EVIDENCE_ROOT/${f.slug}.txt`;
+    const drive = clause(f.drive);
+    return `# ${f.title}\n\nPart of the ${app} verification map. Source: \`${cited(f.source)}\`.\n\n## How to get to it (user POV)\n\n${clause(f.reach)}.\n\n## Driving it\n\nHarness: ${clause(s.harness)}.\n\n1. Launch the app as SKILL.md says and wait until it is ready.\n2. ${drive[0].toUpperCase()}${drive.slice(1)}.\n3. Capture: ${capture}, as SKILL.md's Evidence section says.\n4. Stop what you started.\n\n${NO_EDIT}.\n`;
 }
-function verifyFeaturesMd(app, d) {
-    const index = d.features.map((f) => `- [${f.title}](${f.slug}.md): ${f.reach}`).join('\n');
-    const more = d.omitted ? `\n\n${d.omitted} more found and not listed; add them by hand or run maintain later.` : '';
+function verifyFeaturesMd(app, features, omitted) {
+    const index = features.map((f) => `- [${f.title}](${f.slug}.md): ${clause(f.reach)}`).join('\n');
+    const more = omitted ? `\n\n${omitted} more found and not listed; add them by hand or run maintain later.` : '';
     return `# ${app} features\n\nThe repo's maintained verification map; a proof that drives one entry point is incomplete when this lists others.\n\n${index}${more}\n`;
 }
 // The first existing component on the way from the repo to `p` that is a symlink, if any: a cloned repo's symlink
@@ -2641,33 +2585,115 @@ function symlinkOnPath(repo, p) {
     }
     return undefined;
 }
-// Writes only missing files; an existing skill is left byte-identical. SKILL.md is written last, so it marks a
-// finished scaffold. Every write target is checked before the first write.
-function scaffoldVerify(repo, cfg) {
+const SCAFFOLD_HELP = 'The verify skill was not written: fix the cause verify_skill names, then re-run: done-done init';
+// All-or-nothing: when any target (SKILL.md, features/README.md, a features file) exists as a file or directory,
+// nothing is written and the paths are named; otherwise every file is written into a temp dir inside the skill's
+// parent and moved into place, so a failed write leaves no partial skill. SKILL.md is moved last, so it marks a
+// finished scaffold. The skill folder is checked for symlinks before the agent is asked, and every target before
+// the first write. failed: the agent or the write failed, so init fails and the user fixes the cause.
+async function scaffoldVerify(repo, cfg) {
     const dir = join(repo, cfg.skill);
+    const linked = (ps) => ps.map((p) => symlinkOnPath(repo, p)).find((l) => l !== undefined);
+    const skipLink = (link) => ({ status: `skipped, ${shown(repo, link)} is a symlink; write it by hand or remove the link` });
+    const blocked = (ps) => ({ status: `skipped: ${ps.map((p) => shown(repo, p)).join(', ')} already exist; delete the skill folder to regenerate` });
+    let link = linked([join(dir, 'features', 'README.md'), join(dir, 'SKILL.md')]);
+    if (link !== undefined)
+        return skipLink(link);
     if (existsSync(join(dir, 'SKILL.md')))
-        return 'unchanged';
-    const d = detectApp(repo);
-    const files = new Map([[join('features', 'README.md'), verifyFeaturesMd(cfg.app, d)]]);
-    for (const f of d.features)
-        files.set(join('features', `${f.slug}.md`), verifyFeatureMd(cfg.app, d, f));
-    files.set('SKILL.md', verifySkillMd(cfg.app, d));
-    const targets = [...files].map(([rel, body]) => ({ p: join(dir, rel), body }));
-    const link = targets.map(({ p }) => symlinkOnPath(repo, p)).find((l) => l !== undefined);
+        return blocked([join(dir, 'SKILL.md')]);
+    if (existsSync(join(dir, 'features', 'README.md')))
+        return blocked([join(dir, 'features', 'README.md')]);
+    // No agent: init's agent row already asks the user to set one.
+    if (!cfg.agent)
+        return { status: 'not written: no agent is set, and the agent writes the verify skill' };
+    const agent = selectAgent(cfg);
+    // As in maintain, only claude reads the repo with its own tools; every other agent gets the files from plain code.
+    const toolless = agent.agent !== 'claude';
+    if (toolless && toollessReason(agent.agent))
+        return { status: `not written: ${toollessReason(agent.agent)}; set the verify skill agent to claude, opencode, pi or acp with done-done init --agent <agent> --model <model>`, failed: true };
+    const context = repoContext(repo, cfg.skill);
+    // Every schema-valid answer cites tracked files, so with none there is nothing to ask for.
+    if (!context.files.size)
+        return { status: "not written: the repo has no tracked files to cite; commit the repo's files, then re-run init", failed: true };
+    const record = join(home(), 'agents', `init-${new Date().toISOString().replace(/[:.]/g, '-')}-${agent.agent.replace(/[^\w-]/g, '-')}.json`);
+    const a = await askAgent({ ...agent, prompt: scaffoldPrompt(cfg, context.text, toolless), schema: SCAFFOLD_SCHEMA, cwd: repo, tools: toolless ? 'none' : 'read', record });
+    const where = a.record ? `; record ${a.record}` : a.recordError ? `; the call record could not be written: ${a.recordError}` : '';
+    if (!a.ok)
+        return { status: `not written: ${agent.agent} did not answer: ${a.error}; done-done doctor --probe checks the agent${where}`, failed: true };
+    const problem = scaffoldProblem(a.answer, context.files, toolless ? context.read : context.files);
+    if (problem)
+        return { status: `not written: ${agent.agent}'s answer is unusable: ${problem}${where}`, failed: true };
+    const s = a.answer;
+    const source = cited(s.launch.source);
+    const isolated = s.launch.safe && source !== '' && !MANIFEST.test(basename(source));
+    const features = [];
+    for (const f of s.features.slice(0, MAX_FEATURES)) {
+        let n = slug(f.title);
+        for (let i = 2; n === 'readme' || features.some((g) => g.slug === n); i++)
+            n = `${slug(f.title)}-${i}`;
+        features.push({ ...f, slug: n });
+    }
+    const omitted = s.features.length - features.length;
+    const files = new Map([[join('features', 'README.md'), verifyFeaturesMd(cfg.app, features, omitted)]]);
+    for (const f of features)
+        files.set(join('features', `${f.slug}.md`), verifyFeatureMd(cfg.app, s, f));
+    files.set('SKILL.md', verifySkillMd(cfg.app, agent.agent, s, isolated, features, omitted));
+    const targets = [...files].map(([rel, body]) => ({ rel, p: join(dir, rel), body }));
+    link = linked(targets.map(({ p }) => p));
     if (link !== undefined)
-        return `skipped, ${shown(repo, link)} is a symlink; write it by hand or remove the link`;
-    for (const { p, body } of targets) {
-        if (existsSync(p))
-            continue;
-        try {
-            mkdirSync(dirname(p), { recursive: true });
-            writeFileSync(p, body);
+        return skipLink(link);
+    const parent = dirname(dir);
+    let tmp;
+    const moved = [];
+    const made = [];
+    const mk = (d) => {
+        const missing = [];
+        for (let c = d; !existsSync(c); c = dirname(c))
+            missing.unshift(c);
+        made.push(...missing);
+        mkdirSync(d, { recursive: true });
+    };
+    const undo = () => {
+        for (const p of [...moved, ...(tmp ? [tmp] : [])]) {
+            try {
+                rmSync(p, { recursive: true, force: true });
+            }
+            catch { }
         }
-        catch (e) {
-            return `skipped, ${shown(repo, p)} could not be written (${e.message}); fix it and re-run init`;
+        for (const d of made.reverse()) {
+            try {
+                rmdirSync(d);
+            }
+            catch { }
+        }
+    };
+    try {
+        mk(parent);
+        tmp = mkdtempSync(join(parent, `${basename(dir)}.tmp-`));
+        for (const { rel, body } of targets) {
+            mkdirSync(dirname(join(tmp, rel)), { recursive: true });
+            writeFileSync(join(tmp, rel), body);
         }
+        const have = targets.filter(({ p }) => existsSync(p)).map(({ p }) => p);
+        if (have.length) {
+            undo();
+            return blocked(have);
+        }
+        for (const { rel, p } of targets) {
+            mk(dirname(p));
+            renameSync(join(tmp, rel), p);
+            moved.push(p);
+        }
+    }
+    catch (e) {
+        undo();
+        return { status: `not written: the verify skill could not be written (${e.message}); nothing was left behind, so fix the cause and re-run init`, failed: true };
     }
-    return 'written';
+    try {
+        rmSync(tmp, { recursive: true, force: true });
+    }
+    catch { }
+    return { status: `written by ${agent.agent}${isolated ? '' : '; its launch is not isolated, so read Launch before a drive'}` };
 }
 // The session-start hook `init --hook <agent>` adds; the agent shows its stdout to the session.
 // Without done-done on PATH it prints nothing and exits 0, so it never breaks a session.
@@ -2878,8 +2904,7 @@ async function pick(kind, cfg) {
     try {
         const menu = kind === 'agent' ? [...AGENTS, ACP_TARGET] : JUDGES;
         const label = (a) => (a === ACP_TARGET ? `${a} (an agent your acpx bridge starts)` : a);
-        const doer = cfg.agent ? `the one that did the work (${cfg.agent})` : 'the agent that does the work';
-        const head = kind === 'agent' ? 'done-done starts a coding agent you choose, and none is set. Agents:' : `done-done judges each capture with an agent you choose, never ${doer}, and none is set. Judges:`;
+        const head = kind === 'agent' ? 'done-done starts a coding agent you choose, and none is set. Agents:' : 'done-done judges each capture with an agent you choose, and none is set. Judges:';
         process.stderr.write(`${head}\n${menu.map((a, i) => `  ${i + 1}) ${label(a)}\n`).join('')}`);
         for (;;) {
             let agent = '';
@@ -2966,8 +2991,7 @@ async function withChoice(kind, cfg) {
         cfg.judge.model = choice.model;
     }
 }
-// The user's judge choice, checked before anything is written: an agent that can judge, and never the author's own
-// agent and model (selectJudge refuses that pair) unless judge.allow_same.
+// The user's judge choice, checked before anything is written: an agent done-done can judge through, with a model.
 function checkJudge(cfg, agent, model) {
     if (!JUDGES.includes(agent))
         throw new UsageError(`done-done cannot judge through ${agent}; it judges through ${JUDGES.join(', ')}`, noJudge().help);
@@ -2975,8 +2999,6 @@ function checkJudge(cfg, agent, model) {
         throw new UsageError(`--judge-model ${model}: an opencode model is provider/model, e.g. ${CHEAP.opencode.model}`);
     if (!model && !modelFor(cfg, agent))
         throw new UsageError(`judge: ${agent} has no default model, so a judge needs one`, `Save the judge with its model: done-done init --judge ${agent} --judge-model <model>`);
-    if (cfg.agent)
-        selectJudge({ ...cfg, judge: { ...cfg.judge, route: routeOf(agent), model } }, selectAgent(cfg));
 }
 const commitFirst = (skill) => `.done-done.yaml and ${skill} before your first capture: check refuses proof from a tree with uncommitted changes`;
 // An absolute path inside the repo in a recipe: the recipe is committed, so it would name this checkout only.
@@ -3016,7 +3038,7 @@ async function cmdInit(argv) {
     const choice = values.agent !== undefined ? { agent: values.agent, model: values.model ?? '' } : !cfg.agent && interactive() ? await pick('agent', cfg) : undefined;
     if (choice)
         cfg.agent_config[choice.agent] = { ...cfg.agent_config[choice.agent], ...(choice.model && { model: choice.model }) };
-    // The judge likewise: --judge, else with none set the user's pick in a terminal; checked against the agent above.
+    // The judge likewise: --judge, else with none set the user's pick in a terminal; checked that done-done can judge through it.
     const judgeChoice = values.judge !== undefined ? { agent: values.judge, model: values['judge-model'] ?? (cfg.judge.route === routeOf(values.judge) ? cfg.judge.model : '') } : !cfg.judge.route && interactive() ? await pick('judge', { ...cfg, agent: choice?.agent ?? cfg.agent }) : undefined;
     if (judgeChoice)
         checkJudge({ ...cfg, agent: choice?.agent ?? cfg.agent }, judgeChoice.agent, judgeChoice.model);
@@ -3030,7 +3052,7 @@ async function cmdInit(argv) {
             return { out: { agent: `unchanged (${cfg.agent})` }, help: [], code: PASS };
         return { out: { agent: 'not set' }, help: [`${noAgent().message}. ${noAgent().help}`], code: USAGE };
     };
-    // A judge not set is not an init failure: verify asks for it when it needs one.
+    // A judge not set is not an init failure, since init gives no result: every command that does asks for it first.
     const writeJudge = () => judgeChoice ? { out: { judge: saveChoice('judge', judgeChoice) }, help: [] }
         : cfg.judge.route ? { out: { judge: `unchanged (${cfg.judge.route})` }, help: [] }
             : { out: { judge: 'not set' }, help: [`${noJudge().message}. ${noJudge().help}`] };
@@ -3069,14 +3091,15 @@ async function cmdInit(argv) {
         const added = !!rel && ensureIgnored(repo, rel);
         const root = shown(repo, fresh.evidence.root);
         const check = 'done-done check --outcome "<what you proved>" <files it recorded>';
-        const verify = scaffoldVerify(repo, fresh);
-        const agentHook = writeHook();
         const globalConfig = writeGlobal();
         const ag = writeAgent();
         const jg = writeJudge();
+        const verify = await scaffoldVerify(repo, loadConfig(repo));
+        const agentHook = writeHook();
+        const code = ag.code !== PASS ? ag.code : verify.failed ? FAIL : PASS;
         emit({
             command: 'init',
-            result: ag.code === PASS ? 'pass' : 'fail',
+            result: code === PASS ? 'pass' : 'fail',
             config: existed ? 'updated' : 'written',
             global_config: globalConfig,
             ...ag.out,
@@ -3085,11 +3108,11 @@ async function cmdInit(argv) {
             app: fresh.app,
             evidence_root: root,
             gitignore: added ? `added ${rel.replace(/\/+$/, '')}/` : 'unchanged',
-            verify_skill: verify,
+            verify_skill: verify.status,
             ...agentHook.out,
-            help: [`Capture proof: done-done run ${journey}, then: ${check}`, ...agentHook.help, ...ag.help, ...jg.help, `Commit ${commitFirst(fresh.skill)}`],
+            help: [`Capture proof: done-done run ${journey}, then: ${check}`, ...agentHook.help, ...ag.help, ...jg.help, ...(verify.failed ? [SCAFFOLD_HELP] : []), `Commit ${commitFirst(fresh.skill)}`],
         });
-        return ag.code;
+        return code;
     }
     if (!existed) {
         // No evidence.root: proof goes to <local_root>/<app>, outside the repo, so it outlives this checkout.
@@ -3108,14 +3131,15 @@ app: ${JSON.stringify(cfg.app)}
     const added = !!rel && ensureIgnored(repo, rel);
     const root = shown(repo, cfg.evidence.root);
     const check = 'done-done check --outcome "<what you proved>" <files it recorded>';
-    const verify = scaffoldVerify(repo, cfg);
-    const agentHook = writeHook();
     const globalConfig = writeGlobal();
     const ag = writeAgent();
     const jg = writeJudge();
+    const verify = await scaffoldVerify(repo, loadConfig(repo));
+    const agentHook = writeHook();
+    const code = ag.code !== PASS ? ag.code : verify.failed ? FAIL : PASS;
     emit({
         command: 'init',
-        result: ag.code === PASS ? 'pass' : 'fail',
+        result: code === PASS ? 'pass' : 'fail',
         config: existed ? 'unchanged' : 'written',
         global_config: globalConfig,
         ...ag.out,
@@ -3123,7 +3147,7 @@ app: ${JSON.stringify(cfg.app)}
         app: cfg.app,
         evidence_root: root,
         gitignore: added ? `added ${rel.replace(/\/+$/, '')}/` : 'unchanged',
-        verify_skill: verify,
+        verify_skill: verify.status,
         ...agentHook.out,
         help: [
             ...(Object.keys(cfg.journeys).length
@@ -3132,10 +3156,11 @@ app: ${JSON.stringify(cfg.app)}
             ...agentHook.help,
             ...ag.help,
             ...jg.help,
+            ...(verify.failed ? [SCAFFOLD_HELP] : []),
             `Commit ${commitFirst(cfg.skill)}`,
         ],
     });
-    return ag.code;
+    return code;
 }
 // The exact next command for a usage or config error, so an agent can recover without reading --help.
 function errorHelp(msg, cmd) {
@@ -3196,8 +3221,8 @@ function agentSettings(cfg, agent) {
     ].join('; ');
 }
 const modelPhrase = (agent, model) => (model ? `model ${model}` : `its own default model; set agent_config.${agent}.model to choose one`);
-// Is this repo worth driving: git, a valid config and a writable evidence root are
-// required; the verify skill, an agent CLI, the judge binary and ffprobe are optional.
+// Is this repo worth driving: git, a valid config, a writable evidence root, the agent and the judge are
+// required; the verify skill and ffprobe are listed but never fail it.
 // doctor changes nothing except the --probe call record (the agent itself may keep its own session files): a missing repo or config is a finding, never a crash.
 async function cmdDoctor(argv) {
     let values;
@@ -3301,12 +3326,12 @@ async function cmdDoctor(argv) {
         if (agent.agent === 'codex')
             checks.push({ check: 'tool_gate', status: 'warning', detail: "codex's drive sandbox lets its commands write only the repo, the run's evidence and scratch folders, $TMPDIR and /tmp; a tool that writes elsewhere needs its folder added with agent_args_override.codex: [--add-dir, <folder>] (see docs/reference.md, Drive by agent)", fix: '' });
     }
-    // The judge the user set (judge.route), kept apart from the agent.
+    // The judge the user set (judge.route).
     let choice;
     let choiceError;
     if (cfg)
         try {
-            choice = selectJudge(cfg, agent ?? NO_AUTHOR);
+            choice = selectJudge(cfg, judgeAuthor(cfg));
         }
         catch (e) {
             choiceError = e;
@@ -3331,24 +3356,16 @@ async function cmdDoctor(argv) {
     checks.push(ffprobe
         ? { check: 'ffprobe', status: 'ok', detail: `found at ${ffprobe}`, fix: '' }
         : { check: 'ffprobe', status: 'missing', detail: 'no ffprobe on PATH; video evidence is unverified, never a pass', fix: 'Install ffprobe (ffmpeg) to verify video evidence' });
-    // How far the judge is from the author, as selectJudge picks it: another agent is ok; the author's agent at another
-    // model or in a fresh session runs too, so it is a warning that never fails doctor.
+    // How far the judge is from the author: shown, never refused, since the user's choice runs whatever it is.
     if (!cfg || !agent) {
-        checks.push(unknownRow('judge_choice', cfg && agentCfg ? 'unknown until the agent is set, since the judge is kept apart from it' : undefined));
+        checks.push(unknownRow('judge_choice', cfg && agentCfg ? 'unknown until the agent is set' : undefined));
     }
     else if (!choice) {
         checks.push(choiceRow('judge_choice'));
     }
     else {
         const apart = { agent: 'a different agent from the author', model: 'the author\'s agent at a different model', 'session-only': 'the author\'s agent and model in a fresh session (session-only independence)' }[choice.independence];
-        const accepted = choice.independence === 'session-only' && cfg.judge.allow_same ? '; judge.allow_same accepts it' : '';
-        const apartOk = choice.independence === 'agent';
-        checks.push({
-            check: 'judge_choice',
-            status: apartOk ? 'ok' : 'warning',
-            detail: `${choice.route} (model ${choice.model}; from config) judges the author ${choice.author.agent} (model ${choice.author.model || 'none'}): ${apart}${accepted}`,
-            fix: apartOk ? '' : `Ask the user whether to judge with another agent or model (${JUDGES.join(' or ')}) and save it: done-done init --judge <agent> --judge-model <model>`,
-        });
+        checks.push({ check: 'judge_choice', status: 'ok', detail: `${choice.route} (model ${choice.model}; from config) judges the author ${choice.author.agent} (model ${choice.author.model || 'none'}): ${apart}`, fix: '' });
     }
     if (values.probe && !agent)
         checks.push(unknownRow('probe'));
@@ -3365,7 +3382,7 @@ async function cmdDoctor(argv) {
     }
     if (agent)
         checks.push({ check: 'agent_settings', status: 'ok', detail: agentSettings(agentCfg, agent.agent), fix: '' });
-    const required = ['git', 'config', 'evidence_root', ...(values.probe ? ['probe'] : [])];
+    const required = ['git', 'config', 'evidence_root', 'agent', 'judge', ...(values.probe ? ['probe'] : [])];
     const missingRequired = checks.filter((c) => c.status === 'missing' && required.includes(c.check));
     const result = { command: 'doctor', result: missingRequired.length ? 'fail' : 'pass', checks };
     // Several missing items can share one fix (set up the config once); name each fix only once.
@@ -3401,7 +3418,8 @@ async function cmdLook(argv) {
     const shown = cap(hits);
     emit({
         command: 'look',
-        result: hits.length ? 'fail' : 'pass',
+        // look measures the layout; it gives no verdict on the outcome, which only the judged check does.
+        result: hits.length ? 'fail' : 'clean',
         url,
         viewport: '390x844',
         capture,