From b582725df3e51b5988cb99e6d71db77a12770649 Mon Sep 17 00:00:00 2001
From: Transaction Science <hello@transaction.science>
Date: Wed, 4 Nov 2026 23:29:20 -0500
Subject: [PATCH 1/4] wai/conform-output, converted to the layout of the fix:
 no shared append point

The change of wai/conform-output (69f88e62f..ce85900ca, 11 commits), on the fix branch: its
changelog entries as files of wai/changes/, and every other file as the branch has it, its
conflicts with main resolved (the sink kind and the native sink suite, the {case}
placeholder, the entry files and the wasmtime pin check landed since its base).

Its table of independent verifiers is no hand-kept list: wai-rs/build.rs reads it from the
`# independent:` lines of the step files (.github/wai-conformance/verifiers/), which
take the verifiers' command lines out of the steps' bodies; a step with only verifiers to
run keeps its file as a declaration. scripts/wai-conformance-lists.py reads and checks the
same lines, and the table's tests read the step files instead of the workflow.

- 0b653a415 wai conform: JUnit and HTML reports, the independent verifiers beside an implementation or alone, and the corpus union as one command; wai doctor
- c37330ac8 wai-release: the quickstart from every archive, as a new user runs it, and its PowerShell twin for Windows
- 0e1f3eb8a wai conform: the union's rule reads the workflow's commands, not its comments
- 741bd2bd1 wai: the README names wai doctor, toolchain_doctor and wai conform's independent verifiers
- ba302c439 wai doctor: a shim is the program its .shim file names, and 0.3.0 is WAI's
- bb7451190 wai conform: two passing answers that differ are a disagreement, each record digests what its run reads, and the rules are held
- a60f59c8f wai mcp: conformance_run on a corpus's directory runs its own verifier, as before the claims runs joined the table
- 710490dfa check-wai-ops-doors: the verbs and their near-synonyms are the catalogue's, read from it
- fb0ae3151 check-wai-release-quickstart: the release's quickstart is held in the repository checks, gated and ordered too
- 7fa7b506d wai/quickstart/test/clean-machine: the help is the header, its first line to its last
- ce85900ca wai: the README says a run beside the independent verifier passes only when the two agree

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/wai-conformance/README.md             |   9 +-
 .../verifiers/access-services.sh              |   5 +-
 .../verifiers/ad-presentation.sh              |   5 +-
 .../verifiers/age-assurance.sh                |   5 +-
 .github/wai-conformance/verifiers/ai-usage.sh |   7 +-
 .../wai-conformance/verifiers/avatar-face.sh  |   5 +-
 .../verifiers/bearer-receipts.sh              |   7 +-
 .../wai-conformance/verifiers/browser-sink.sh |   5 +-
 .../wai-conformance/verifiers/capture-take.sh |   5 +-
 .github/wai-conformance/verifiers/carousel.sh |   7 +-
 .../verifiers/catalogue-prior.sh              |   2 +-
 .../verifiers/channel-lineup.sh               |   5 +-
 .../verifiers/claims-jwp-signers.sh           |  17 +-
 .../wai-conformance/verifiers/cmsd-read.sh    |   2 +-
 .../verifiers/co-performance.sh               |   5 +-
 .github/wai-conformance/verifiers/co-watch.sh |   5 +-
 .../verifiers/conformance-results.sh          |   9 +-
 .../wai-conformance/verifiers/contribution.sh |   5 +-
 .../verifiers/cue-injection-ertmp.sh          |   5 +-
 .../wai-conformance/verifiers/delivery-sim.sh |   2 +-
 .../verifiers/deriving-edge.sh                |   5 +-
 .../verifiers/determinism-cost.sh             |  17 +-
 .../wai-conformance/verifiers/direction.sh    |   5 +-
 .github/wai-conformance/verifiers/e2ee.sh     |   2 +-
 .../verifiers/energy-steering.sh              |   5 +-
 .../wai-conformance/verifiers/exact-splats.sh |   5 +-
 .../verifiers/exact-tonemap.sh                |   5 +-
 .../verifiers/exact-upscale.sh                |   5 +-
 .../wai-conformance/verifiers/exploration.sh  |   5 +-
 .github/wai-conformance/verifiers/fleet.sh    |   5 +-
 .../verifiers/forensic-watermark.sh           |   5 +-
 .github/wai-conformance/verifiers/holdings.sh |   5 +-
 .github/wai-conformance/verifiers/http.sh     |   2 +-
 .../verifiers/hybrid-signatures.sh            |   5 +-
 .../wai-conformance/verifiers/influence.sh    |   5 +-
 .../wai-conformance/verifiers/int-payload.sh  |   2 +-
 .../wai-conformance/verifiers/key-release.sh  |   5 +-
 .github/wai-conformance/verifiers/live-ads.sh |   5 +-
 .../wai-conformance/verifiers/live-compose.sh |   5 +-
 .../verifiers/live-contribution.sh            |   3 +-
 .../wai-conformance/verifiers/live-events.sh  |   5 +-
 .../verifiers/live-messaging.sh               |   5 +-
 .../verifiers/live-metering.sh                |   9 +-
 .../verifiers/live-moderation.sh              |   5 +-
 .../verifiers/live-provenance.sh              |   5 +-
 .../verifiers/live-recording.sh               |   5 +-
 .../wai-conformance/verifiers/live-rooms.sh   |  12 +-
 .../wai-conformance/verifiers/live-worlds.sh  |   5 +-
 .github/wai-conformance/verifiers/loc.sh      |   2 +-
 .../verifiers/media-identification.sh         |   5 +-
 .../wai-conformance/verifiers/native-sink.sh  |   5 +-
 .github/wai-conformance/verifiers/oer.sh      |  11 +
 .../verifiers/opportunity-report.sh           |   5 +-
 .github/wai-conformance/verifiers/pin.sh      |   8 +
 .../verifiers/platform-encode.sh              |   5 +-
 .../wai-conformance/verifiers/prior-forms.sh  |   5 +-
 .../verifiers/qoe-aggregation.sh              |   5 +-
 .../verifiers/quantum-referee.sh              |   3 +-
 .../verifiers/receipt-ledger.sh               |   8 +-
 .../verifiers/remote-desktop.sh               |   5 +-
 .../verifiers/revenue-share.sh                |   5 +-
 .../wai-conformance/verifiers/robustness.sh   |   5 +-
 .../wai-conformance/verifiers/route-record.sh |   5 +-
 .../verifiers/scene-carriage.sh               |   5 +-
 .../wai-conformance/verifiers/settlement.sh   |   5 +-
 .../wai-conformance/verifiers/sink-energy.sh  |   5 +-
 .../verifiers/staged-measure.sh               |   2 +-
 .github/wai-conformance/verifiers/staged.sh   |   2 +-
 .../verifiers/stitched-presentation.sh        |   5 +-
 .../wai-conformance/verifiers/stream-audit.sh |   5 +-
 .../verifiers/stream-termination.sh           |   5 +-
 .../verifiers/synthesis-mark.sh               |   5 +-
 .../wai-conformance/verifiers/synthesis.sh    |   5 +-
 .github/wai-conformance/verifiers/takedown.sh |   5 +-
 .../wai-conformance/verifiers/timed-text.sh   |   5 +-
 .github/workflows/repo-checks.yml             |  10 +
 .github/workflows/wai-breaking.yml            |  16 +-
 .github/workflows/wai-conformance.yml         |  57 +-
 .github/workflows/wai-release.yml             |  64 +-
 scripts/check-wai-ops-doors-selftest.sh       |  36 +-
 scripts/check-wai-ops-doors.py                |  47 +-
 .../check-wai-release-quickstart-selftest.sh  | 151 ++++
 scripts/check-wai-release-quickstart.py       | 258 ++++++
 scripts/wai-conformance-lists-selftest.sh     |  15 +
 scripts/wai-conformance-lists.py              | 148 +++-
 wai/CONTRIBUTING.md                           |  10 +-
 wai/README.md                                 |  12 +-
 wai/catalogue/README.md                       |  10 +-
 wai/catalogue/ops.json                        | 106 ++-
 ...pendent-verifiers-table-from-step-files.md |  21 +
 ...lease-runs-quickstart-from-each-archive.md |  12 +
 ...-04-wai-conform-reports-ci-system-reads.md |  35 +
 ...026-11-04-wai-doctor-which-wai-runs-you.md |  14 +
 wai/quickstart/README.md                      |   5 +-
 wai/quickstart/test/clean-machine.ps1         | 107 +++
 wai/quickstart/test/clean-machine.sh          |   3 +-
 wai/wai-rs/build.rs                           |  32 +
 wai/wai-rs/src/bin/wai_cli/dx/conform/mod.rs  | 657 ++++++++++++--
 .../src/bin/wai_cli/dx/conform/report.rs      | 264 ++++++
 .../src/bin/wai_cli/dx/conform/suites.rs      |  69 +-
 wai/wai-rs/src/bin/wai_cli/dx/dev.rs          |  12 +-
 wai/wai-rs/src/bin/wai_cli/dx/doctor.rs       | 815 ++++++++++++++++++
 wai/wai-rs/src/bin/wai_cli/dx/independent.rs  | 625 ++++++++++++++
 .../src/bin/wai_cli/dx/independent_table.rs   | 211 +++++
 wai/wai-rs/src/bin/wai_cli/dx/mod.rs          |  11 +-
 wai/wai-rs/src/bin/wai_cli/mcp/tools.rs       | 158 ++--
 wai/wai-rs/src/catalogue.rs                   |  50 +-
 wai/wai-rs/tests/cli_conform.rs               | 306 ++++++-
 wai/wai-rs/tests/cli_doctor.rs                | 152 ++++
 wai/wai-rs/tests/cli_mcp.rs                   |  34 +-
 wai/wai-studio/src/actions.generated.js       |   7 +-
 111 files changed, 4510 insertions(+), 435 deletions(-)
 create mode 100644 .github/wai-conformance/verifiers/oer.sh
 create mode 100644 .github/wai-conformance/verifiers/pin.sh
 create mode 100755 scripts/check-wai-release-quickstart-selftest.sh
 create mode 100755 scripts/check-wai-release-quickstart.py
 create mode 100644 wai/changes/2026-11-04-independent-verifiers-table-from-step-files.md
 create mode 100644 wai/changes/2026-11-04-release-runs-quickstart-from-each-archive.md
 create mode 100644 wai/changes/2026-11-04-wai-conform-reports-ci-system-reads.md
 create mode 100644 wai/changes/2026-11-04-wai-doctor-which-wai-runs-you.md
 create mode 100644 wai/quickstart/test/clean-machine.ps1
 create mode 100644 wai/wai-rs/src/bin/wai_cli/dx/conform/report.rs
 create mode 100644 wai/wai-rs/src/bin/wai_cli/dx/doctor.rs
 create mode 100644 wai/wai-rs/src/bin/wai_cli/dx/independent.rs
 create mode 100644 wai/wai-rs/src/bin/wai_cli/dx/independent_table.rs
 create mode 100644 wai/wai-rs/tests/cli_doctor.rs

diff --git a/.github/wai-conformance/README.md b/.github/wai-conformance/README.md
index df6975db0..bf2fb678c 100644
--- a/.github/wai-conformance/README.md
+++ b/.github/wai-conformance/README.md
@@ -16,8 +16,13 @@ a file, or a line to a file of its own, and edits no line of the workflow, unles
   run in ascending order, a tie by file name), `features:` (each list compiles alone in
   `features-alone`, and every feature joins `WAI_FEATURES`), and where it needs them `alone:`,
   `build: pq`, `release-features:`, `bins:`, `pq-bins:`, `paths:` (the extension texts it
-  reads, which the workflow's gate then runs on) and `working-directory:`. Prose comments
-  follow the header, after a `#` line.
+  reads, which the workflow's gate then runs on) and `working-directory:`. Its corpus's
+  independent verifier is an `independent:` line, `<name> <area> [needs=<packages>]
+  [verdicts=<file>] [dir=<dir>] python3 [-I] <script> <args>`, the command line its README
+  gives, run in `wai/` by the job's one step `wai conform --independent` and never by the body;
+  `wai-rs/build.rs` reads the binary's table of independent verifiers from these lines. A file
+  with such lines and no body is a declaration: its verifiers run in that step alone. Prose
+  comments follow the header, after a `#` line.
 - `corpora/<name>.txt`: one cargo-class corpus, verified by its own tool on every leg of
   `cargo-classes` (`corpus:`, `order:`, `bin:`, `dir:`).
 - A test file of `wai/wai-rs/tests/` whose first line is `// wai-conformance: int-kernels`
diff --git a/.github/wai-conformance/verifiers/access-services.sh b/.github/wai-conformance/verifiers/access-services.sh
index 8d883103a..174f9f3b0 100644
--- a/.github/wai-conformance/verifiers/access-services.sh
+++ b/.github/wai-conformance/verifiers/access-services.sh
@@ -2,13 +2,15 @@
 # order: 160
 # features: access_services
 # paths: wai/extensions/access-services.md
+# independent: access-services live python3 -I live-conformance/access_services_verify.py live-conformance/access
 #
 # wai.access.services (extensions/access-services.md): the reference module's unit tests
 # (words, full and prefix alignment with their walk back, signed integers, gains) and
 # tests/access_services.rs (vectors.json and each DAPT document regenerate byte for byte
 # from their fixed seeds and no other file is there, wai-rs gives every vector and
 # document its stated outcome and figures, every reason of §10 refuses a case, and §10
-# lists exactly the reference's codes); then the corpus's second implementation,
+# lists exactly the reference's codes); and, in the step of every independent verifier
+# above, the corpus's second implementation,
 # access_services_verify.py, written from the extension's text and sharing no code with
 # wai-rs, which verifies events and captions with timed_text_verify.py and every record
 # with WAI's strict Ed25519 rule, computes every figure and writes every DAPT document
@@ -22,4 +24,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib access_services::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test access_services)
-python3 -I live-conformance/access_services_verify.py live-conformance/access
diff --git a/.github/wai-conformance/verifiers/ad-presentation.sh b/.github/wai-conformance/verifiers/ad-presentation.sh
index 548f1e8cb..e335cef4f 100644
--- a/.github/wai-conformance/verifiers/ad-presentation.sh
+++ b/.github/wai-conformance/verifiers/ad-presentation.sh
@@ -2,6 +2,7 @@
 # order: 250
 # features: live_ads
 # paths: wai/extensions/ad-presentation.md
+# independent: ad-presentation live python3 -I live-conformance/ad_presentation_verify.py live-conformance/presentation
 #
 # wai.live.ad_presentation (extensions/ad-presentation.md): the reference module's unit
 # tests (claims round-trip and their rules refuse, the quartile, the qualifying run, the
@@ -9,7 +10,8 @@
 # tests/ad_presentation.rs (every file of the committed corpus regenerates byte for byte
 # from its fixed seeds and no other file is there, RFC 9578's own token verifies under its
 # key, wai-rs gives every room its outcome and every claim its verdict, and §11 lists
-# exactly the reference's codes); then the corpus's second implementation,
+# exactly the reference's codes); and, in the step of every independent verifier above,
+# the corpus's second implementation,
 # ad_presentation_verify.py, written from the extension's text and sharing no code with
 # wai-rs, which verifies each room with live_ads_verify.py, judges every claim and its
 # RSASSA-PSS itself, requires every mutated copy of the corpus to fail and catches each of
@@ -24,5 +26,4 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib live_ads::presentation::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test ad_presentation)
-python3 -I live-conformance/ad_presentation_verify.py live-conformance/presentation
 node --test ../joule-code/joule-code-rs/crates/joule-moq-web/web/ads/presentation.test.mjs
diff --git a/.github/wai-conformance/verifiers/age-assurance.sh b/.github/wai-conformance/verifiers/age-assurance.sh
index 217b1b7df..cb067fa05 100644
--- a/.github/wai-conformance/verifiers/age-assurance.sh
+++ b/.github/wai-conformance/verifiers/age-assurance.sh
@@ -2,13 +2,15 @@
 # order: 520
 # features: age_assurance
 # paths: wai/extensions/age-assurance.md
+# independent: age-assurance live python3 -I live-conformance/age_assurance_verify.py live-conformance/age
 #
 # wai.age.assurance (extensions/age-assurance.md): the reference module's unit tests (the
 # pinned AlgorithmIdentifier and RFC 9578's first vector through this module, the
 # TokenChallenge read exactly, the suppression floor, the grant attribute `age`, a span's
 # coverage) and tests/age_assurance.rs (vectors.json regenerates byte for byte from its
 # fixed seeds and no other file is there, wai-rs gives every case its stated outcome, and
-# §11 lists exactly the reference's codes, each of which the corpus gives); then the
+# §11 lists exactly the reference's codes, each of which the corpus gives); and, in the
+# step of every independent verifier above, the
 # corpus's second implementation, age_assurance_verify.py, written from the extension's
 # text and sharing no code with wai-rs, which reads every record, writes JCS and verifies
 # every token's RSASSA-PSS itself, reads rooms with live_rooms_verify.py, checks signatures
@@ -24,4 +26,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib age_assurance::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test age_assurance)
-python3 -I live-conformance/age_assurance_verify.py live-conformance/age
diff --git a/.github/wai-conformance/verifiers/ai-usage.sh b/.github/wai-conformance/verifiers/ai-usage.sh
index 59a9645c1..c2e04e1eb 100644
--- a/.github/wai-conformance/verifiers/ai-usage.sh
+++ b/.github/wai-conformance/verifiers/ai-usage.sh
@@ -2,6 +2,8 @@
 # order: 360
 # features: ai_usage
 # paths: wai/extensions/ai-usage.md
+# independent: ai-usage live python3 -I live-conformance/ai_usage_verify.py live-conformance/usage
+# independent: ai-usage-claims live needs=cryptography python3 -I claim-conformance/claim_verify.py consumption live-conformance/usage/vectors.json
 #
 # wai.ai.usage (extensions/ai-usage.md): the reference module's unit tests (RFC 9651's
 # Dictionary parser against the vocabulary's examples and the RFC's edges, statements
@@ -10,7 +12,8 @@
 # tests/ai_usage.rs (vectors.json regenerates byte for byte from its fixed seeds and no
 # other file is there, wai-rs gives every statement, object, room, response, catalog,
 # claim and gate its stated outcome, §9 lists exactly the reference's codes, each of which
-# the corpus gives, and jwp-receipts §3.1 lists the class rules); then the corpus's second
+# the corpus gives, and jwp-receipts §3.1 lists the class rules); and, in the step of every
+# independent verifier above, the corpus's second
 # implementation, ai_usage_verify.py, written from the extension's text and sharing no
 # code with wai-rs, which parses Structured Fields, canonical forms, receipts and claims
 # itself, reads rooms with live_rooms_verify.py, checks signatures with WAI's strict
@@ -28,5 +31,3 @@ set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib ai_usage::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib claim_receipt::consumption::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test ai_usage)
-python3 -I live-conformance/ai_usage_verify.py live-conformance/usage
-python3 -I claim-conformance/claim_verify.py consumption live-conformance/usage/vectors.json
diff --git a/.github/wai-conformance/verifiers/avatar-face.sh b/.github/wai-conformance/verifiers/avatar-face.sh
index dbd0fa33f..21cb72c2f 100644
--- a/.github/wai-conformance/verifiers/avatar-face.sh
+++ b/.github/wai-conformance/verifiers/avatar-face.sh
@@ -3,6 +3,7 @@
 # features: avatar_face
 # release-features: avatar_face
 # paths: wai/extensions/avatars.md
+# independent: avatar-face live python3 -I live-conformance/avatar_face_verify.py live-conformance/avatar-face
 #
 # wai.avatar.face (extensions/avatars.md §6 to §13): the module's unit tests (the
 # generator's wai-ops/1 graph against §7.6's arithmetic written out loop by loop; the warp
@@ -10,7 +11,8 @@
 # and tests/avatar_face.rs (the committed corpus regenerates byte for byte from its fixed
 # seeds and its pinned inputs, and no other file is there; wai-rs gives every form, frame
 # and case what it states; §10 lists exactly the reference's codes; §7.9's figures are
-# training.json's; the registered generator meets acc64 and not acc32); then the corpus's
+# training.json's; the registered generator meets acc64 and not acc32); and, in the step
+# of every independent verifier above, the corpus's
 # second implementation, avatar_face_verify.py, written from the extension's text and
 # sharing no code with wai-rs, which runs the driver and the generator's arithmetic in
 # Python's integers, verifies the claims, the log and the label policy with
@@ -25,4 +27,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib avatar_face::)
 (cd wai-rs && cargo test --release --no-default-features --features "$WAI_RELEASE_FEATURES" --test avatar_face)
-python3 -I live-conformance/avatar_face_verify.py live-conformance/avatar-face
diff --git a/.github/wai-conformance/verifiers/bearer-receipts.sh b/.github/wai-conformance/verifiers/bearer-receipts.sh
index fe7f1c3c9..5eda75188 100644
--- a/.github/wai-conformance/verifiers/bearer-receipts.sh
+++ b/.github/wai-conformance/verifiers/bearer-receipts.sh
@@ -2,6 +2,8 @@
 # order: 530
 # features: bearer_receipts
 # paths: wai/extensions/bearer-receipts.md
+# independent: bearer live needs=cryptography python3 -I live-conformance/bearer_verify.py live-conformance/bearers
+# independent: bearer-claims live needs=cryptography python3 -I claim-conformance/claim_verify.py bearer live-conformance/bearers/vectors.json
 #
 # wai.bearer.receipts (extensions/bearer-receipts.md): the reference module's unit tests
 # (the bound, the bitmap rules, the bearer classes, and the corpus reaching every stated
@@ -10,7 +12,8 @@
 # every case its stated outcome, the cases that carry one receipt on every bearer class
 # carry the same bytes with the same object verdicts, §10 lists exactly the reference's
 # codes, each of which the corpus gives, and jwp-receipts §3.1 lists the class codes at
-# their steps); then the corpus's second implementation, bearer_verify.py, written from
+# their steps); and, in the step of every independent verifier above, the corpus's second
+# implementation, bearer_verify.py, written from
 # the extension's text and sharing no code with wai-rs, which verifies groups and objects
 # with jwp_verify.py, claims through jwp-receipts §3.1 steps 1-5 with claim_verify.py and
 # confirmations with signer_verify.py (each needs the `cryptography` package installed
@@ -27,5 +30,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib bearer)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test bearer_receipts)
-python3 -I live-conformance/bearer_verify.py live-conformance/bearers
-python3 -I claim-conformance/claim_verify.py bearer live-conformance/bearers/vectors.json
diff --git a/.github/wai-conformance/verifiers/browser-sink.sh b/.github/wai-conformance/verifiers/browser-sink.sh
index 6a4806112..2aef9017b 100644
--- a/.github/wai-conformance/verifiers/browser-sink.sh
+++ b/.github/wai-conformance/verifiers/browser-sink.sh
@@ -2,6 +2,7 @@
 # order: 470
 # features: browser_sink browser_sink,receipt_claims
 # paths: wai/extensions/browser-sink.md
+# independent: browser-sink live python3 -I live-conformance/browser_sink_verify.py live-conformance/browser
 #
 # The browser sink (extensions/browser-sink.md): the reference module's unit tests (the
 # registry gate's rows, registered tiers, integers as §5 reads them, a binding's
@@ -12,7 +13,8 @@
 # §11 appears in the corpus and §11 lists exactly the reference's codes, and the chain
 # the generator signs by hand verifies under jwp_delivery); wai-live-web's browser
 # functions held to the same corpus natively, and its wasm-route decoder verifying,
-# decoding and binding every chain object to the published frame digests; then the
+# decoding and binding every chain object to the published frame digests; and, in the
+# step of every independent verifier above, the
 # corpus's second implementation, browser_sink_verify.py, written from the extension's
 # text and sharing no code with wai-rs, which reads the registry export for each
 # capability's class, recomputes every route, evaluation, energy entry, binding, chain
@@ -31,4 +33,3 @@ set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test browser_sink)
 (cd wai-rs && "$RUNNER_TEMP/wai-bins/union/wai_browser_sink_vectors" verify ../live-conformance/browser)
 (cd wai-live-web && cargo test --locked --features int_video --lib browser_tests)
-python3 -I live-conformance/browser_sink_verify.py live-conformance/browser
diff --git a/.github/wai-conformance/verifiers/capture-take.sh b/.github/wai-conformance/verifiers/capture-take.sh
index 9e2e70abb..e6d1a015b 100644
--- a/.github/wai-conformance/verifiers/capture-take.sh
+++ b/.github/wai-conformance/verifiers/capture-take.sh
@@ -2,12 +2,14 @@
 # order: 120
 # features: capture_take
 # paths: wai/extensions/capture-binding.md
+# independent: capture-take live python3 -I live-conformance/capture_take_verify.py live-conformance/takes
 #
 # wai.capture.take (extensions/capture-binding.md): the reference module's unit tests,
 # the output tree's (whose RFC 6962 hash and RFC 9162 consistency proofs the take tree
 # reuses), and tests/capture_take.rs (the committed corpus regenerates byte for byte
 # from its fixed seeds, wai-rs gives every vector its stated outcome, every reason of
-# §12 appears in it, and §12 lists exactly the reference's codes); then the corpus's
+# §12 appears in it, and §12 lists exactly the reference's codes); and, in the step of
+# every independent verifier above, the corpus's
 # second implementation, capture_take_verify.py, written from the extension's text and
 # sharing no code with wai-rs, which verifies each room with live_rooms_verify.py and
 # every signature with WAI's strict Ed25519 (claim-conformance/_ed25519.py), and
@@ -20,4 +22,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib -- capture_take:: output_tree::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test capture_take)
-python3 -I live-conformance/capture_take_verify.py live-conformance/takes
diff --git a/.github/wai-conformance/verifiers/carousel.sh b/.github/wai-conformance/verifiers/carousel.sh
index 075cec977..2f0acf8ee 100644
--- a/.github/wai-conformance/verifiers/carousel.sh
+++ b/.github/wai-conformance/verifiers/carousel.sh
@@ -2,6 +2,8 @@
 # order: 540
 # features: carousel
 # paths: wai/extensions/carousel.md
+# independent: carousel live needs=cryptography python3 -I live-conformance/carousel_verify.py live-conformance/carousel
+# independent: carousel-claims live needs=cryptography python3 -I claim-conformance/claim_verify.py carousel live-conformance/carousel/vectors.json
 #
 # wai.bearer.carousel (extensions/carousel.md): the reference module's unit tests (each code's
 # bounds and division into source blocks, K', the passes of advance and repeat, plans, and the
@@ -11,7 +13,8 @@
 # jwp-receipts §3.1 lists the class codes at their steps, K' and Partition[] agree with an
 # independent RFC 6330 implementation for every block size, and each RaptorQ object a case
 # holds available decodes with that implementation from what a receiver within the case's
-# loss bound holds); then the corpus's second implementation, carousel_verify.py, written
+# loss bound holds); and, in the step of every independent verifier above, the corpus's second
+# implementation, carousel_verify.py, written
 # from the extension's text and sharing no code with wai-rs, which verifies groups and
 # objects with jwp_verify.py and claims through steps 1-5 with claim_verify.py, writes the
 # context checks, the availability and the plans itself, reads §9 and Appendix A, requires
@@ -25,5 +28,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib -- carousel:: claim_receipt::schedule::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test carousel)
-python3 -I live-conformance/carousel_verify.py live-conformance/carousel
-python3 -I claim-conformance/claim_verify.py carousel live-conformance/carousel/vectors.json
diff --git a/.github/wai-conformance/verifiers/catalogue-prior.sh b/.github/wai-conformance/verifiers/catalogue-prior.sh
index baf7b855e..059498fba 100644
--- a/.github/wai-conformance/verifiers/catalogue-prior.sh
+++ b/.github/wai-conformance/verifiers/catalogue-prior.sh
@@ -1,5 +1,6 @@
 # step: catalogue prior · the record and the text quoting it
 # order: 30
+# independent: catalogue-prior trust python3 -I tools/wai_catalogue_prior_verify.py research/catalogue-prior research/catalogue-prior.md
 #
 # The catalogue-prior record (research/catalogue-prior.md): each reading checked against
 # the SHA-256 its run.json states; every BD-rate the run stored recomputed from the
@@ -8,4 +9,3 @@
 # scripts that took them (tools/wai_catalogue_prior_verify.py, standard library only,
 # run isolated); and every figure the page quotes checked (each is followed by a `cat`
 # marker naming its value).
-python3 -I tools/wai_catalogue_prior_verify.py research/catalogue-prior research/catalogue-prior.md
diff --git a/.github/wai-conformance/verifiers/channel-lineup.sh b/.github/wai-conformance/verifiers/channel-lineup.sh
index 707bf318d..89e4b626f 100644
--- a/.github/wai-conformance/verifiers/channel-lineup.sh
+++ b/.github/wai-conformance/verifiers/channel-lineup.sh
@@ -2,6 +2,7 @@
 # order: 270
 # features: channel_lineup
 # paths: wai/extensions/channel-lineup.md
+# independent: channel-lineup live needs=cryptography python3 -I live-conformance/channel_lineup_verify.py live-conformance/channels
 #
 # wai.video.lineup (extensions/channel-lineup.md): the reference module's unit tests (times,
 # the document type declaration, the reasons) and tests/channel_lineup.rs (every file of the
@@ -9,7 +10,8 @@
 # there; wai-rs gives every import and every verification its outcome; §10 lists exactly
 # the reference's codes; §9's commands, run as the text writes them through `wai`, yield
 # the corpus's receipt, lineup, cues and guides, and a refusal is its reason with exit 1);
-# then the corpus's second implementation, channel_lineup_verify.py, written from the
+# and, in the step of every independent verifier above, the corpus's second implementation,
+# channel_lineup_verify.py, written from the
 # extension's text and sharing no code with wai-rs, which reimports every vector, requires
 # every outcome and fact, and requires every mutated copy of the corpus to fail and every
 # check it drops to be caught.
@@ -23,4 +25,3 @@ set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib channel_lineup::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test channel_lineup)
 (cd wai-rs && "$RUNNER_TEMP/wai-bins/union/wai_channel_lineup_vectors" verify ../live-conformance/channels)
-python3 -I live-conformance/channel_lineup_verify.py live-conformance/channels
diff --git a/.github/wai-conformance/verifiers/claims-jwp-signers.sh b/.github/wai-conformance/verifiers/claims-jwp-signers.sh
index 9216879ea..b02635e6f 100644
--- a/.github/wai-conformance/verifiers/claims-jwp-signers.sh
+++ b/.github/wai-conformance/verifiers/claims-jwp-signers.sh
@@ -3,17 +3,22 @@
 # features: key_discovery
 # bins: wai_claim_vectors wai_jwp_vectors wai_signer_vectors
 # pq-bins: wai_claim_vectors wai_jwp_vectors wai_signer_vectors
+# independent: claim trust needs=cryptography verdicts=claim-conformance/vectors.json python3 claim-conformance/claim_verify.py claim-conformance/vectors.json
+# independent: jwp trust needs=cryptography verdicts=jwp-conformance/vectors.json python3 jwp-conformance/jwp_verify.py jwp-conformance/vectors.json
+# independent: signer trust needs=cryptography verdicts=signer-conformance/vectors.json python3 signer-conformance/signer_verify.py signer-conformance/vectors.json
 #
-# chain_differential.py signs receipt chains around jwp-receipts §3 step 3 and §6.1
-# (two keys, two tracks, both payloads, replays, forks, gaps, the guard and the
+# The claim, JWP and key-discovery verifiers (claim_verify.py, jwp_verify.py and
+# signer_verify.py) run over their corpora in the step of every independent verifier
+# above; here, against wai-rs, beyond the corpora: differential.py gives seeded inputs
+# the corpus does not hold to wai_claim_vectors and claim_verify.py and requires the
+# same verdict; chain_differential.py signs receipt chains around jwp-receipts §3 step 3
+# and §6.1 (two keys, two tracks, both payloads, replays, forks, gaps, the guard and the
 # freshness bound), and chain_gap_differential.py genuine chains up to 90 groups
 # delivered shuffled, withheld and walked back with rewritten links and forks; both
 # require wai_jwp_vectors and jwp_verify.py to give every chain the same verdict. Two
-# fixed seeds each, so a run is reproducible.
+# fixed seeds each, so a run is reproducible. Last, signer_verify.py's key-discovery
+# verdicts equal wai_signer_vectors'.
 set -euo pipefail
-python3 claim-conformance/claim_verify.py claim-conformance/vectors.json
-python3 jwp-conformance/jwp_verify.py jwp-conformance/vectors.json
-python3 signer-conformance/signer_verify.py signer-conformance/vectors.json
 python3 signer-conformance/signer_verify.py verdicts signer-conformance/vectors.json > "$RUNNER_TEMP/signer-py.tsv"
 # Each differential against both builds the first step copied (see its comment).
 for build in union pq; do
diff --git a/.github/wai-conformance/verifiers/cmsd-read.sh b/.github/wai-conformance/verifiers/cmsd-read.sh
index dab58d4c6..4feadc701 100644
--- a/.github/wai-conformance/verifiers/cmsd-read.sh
+++ b/.github/wai-conformance/verifiers/cmsd-read.sh
@@ -1,8 +1,8 @@
 # step: cmsd_read_verify.py
 # order: 750
+# independent: cmsd-read delivery python3 -I telemetry-conformance/cmsd_read_verify.py telemetry-conformance
 #
 # CMSD reading (extensions/delivery-telemetry.md §6.6): the second implementation, written
 # from that text and RFC 9651 with its own field parser, reads every field of
 # telemetry-conformance/cmsd-read/ and every field expected/cmsd.json states, and requires
 # every mutated copy to fail. wai-rs's reading is checked by wai_telemetry verify above.
-python3 -I telemetry-conformance/cmsd_read_verify.py telemetry-conformance
diff --git a/.github/wai-conformance/verifiers/co-performance.sh b/.github/wai-conformance/verifiers/co-performance.sh
index 111117a3e..a7a363d4d 100644
--- a/.github/wai-conformance/verifiers/co-performance.sh
+++ b/.github/wai-conformance/verifiers/co-performance.sh
@@ -2,13 +2,15 @@
 # order: 510
 # features: co_performance
 # paths: wai/extensions/co-performance.md
+# independent: co-performance live python3 -I live-conformance/co_performance_verify.py live-conformance/coperformance
 #
 # wai.live.coperformance (extensions/co-performance.md): the reference module's unit tests
 # (the policy and every statement round-trip and their rules refuse, the attributes'
 # decimal integers, a schedule's turns in bars and microseconds, the symbolic bodies read
 # whole) and tests/co_performance.rs (vectors.json regenerates byte for byte from its fixed
 # seeds and no other file is there, wai-rs gives every room its stated outcome, and §10
-# lists exactly the reference's codes, each of which the corpus gives); then the corpus's
+# lists exactly the reference's codes, each of which the corpus gives); and, in the step of
+# every independent verifier above, the corpus's
 # second implementation, co_performance_verify.py, written from the extension's text and
 # sharing no code with wai-rs, which verifies each room with live_rooms_verify.py and every
 # signature with WAI's strict Ed25519 rule from claim-conformance, recomputes every intent,
@@ -24,4 +26,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib co_performance::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test co_performance)
-python3 -I live-conformance/co_performance_verify.py live-conformance/coperformance
diff --git a/.github/wai-conformance/verifiers/co-watch.sh b/.github/wai-conformance/verifiers/co-watch.sh
index 949b6db3e..1f66f3323 100644
--- a/.github/wai-conformance/verifiers/co-watch.sh
+++ b/.github/wai-conformance/verifiers/co-watch.sh
@@ -2,13 +2,15 @@
 # order: 580
 # features: co_watch
 # paths: wai/extensions/co-watch.md
+# independent: co-watch live python3 -I live-conformance/co_watch_verify.py live-conformance/cowatch
 #
 # wai.live.cowatch (extensions/co-watch.md): the reference module's unit tests (the policy
 # and its rules, statements read back and refused, the controlled position in the order of
 # §5.4, each branch of the catch-up rule, percentiles by nearest rank, the control attribute)
 # and tests/co_watch.rs (vectors.json regenerates byte for byte from its fixed seeds and no
 # other file is there, wai-rs gives every room and catch-up case its stated outcome, and §12
-# lists exactly the reference's codes, each of which the corpus gives); then the corpus's
+# lists exactly the reference's codes, each of which the corpus gives); and, in the step of
+# every independent verifier above, the corpus's
 # second implementation, co_watch_verify.py, written from the extension's text and sharing
 # no code with wai-rs, which verifies each room with live_rooms_verify.py and every
 # signature with WAI's strict Ed25519 rule, recomputes the controlled position, every
@@ -26,5 +28,4 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib co_watch::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test co_watch)
-python3 -I live-conformance/co_watch_verify.py live-conformance/cowatch
 node --test ../joule-code/joule-code-rs/crates/joule-moq-web/web/room/cowatch.test.mjs
diff --git a/.github/wai-conformance/verifiers/conformance-results.sh b/.github/wai-conformance/verifiers/conformance-results.sh
index a1fbaca30..3c2882571 100644
--- a/.github/wai-conformance/verifiers/conformance-results.sh
+++ b/.github/wai-conformance/verifiers/conformance-results.sh
@@ -2,17 +2,19 @@
 # order: 170
 # features: conform_result
 # paths: wai/extensions/conformance-results.md
+# independent: conform-result trust verdicts=conform-result-conformance/vectors.json python3 -I conform-result-conformance/conform_result_verify.py conform-result-conformance
 #
 # conform-result/1 (extensions/conformance-results.md): the reference module's unit tests
 # (a signed record accepted and every member covered, the strict rule's small-order forgery
 # refused, the date form, a vector for every reason) and tests/conform_result.rs (the
 # committed corpus regenerates byte for byte, wai-rs gives every vector its stated outcome,
 # every reason of §5 refuses a vector, §5 lists exactly the reference's codes, and no leaf
-# of a record survives a change after signing); then wai_conform_result_vectors verify, and
+# of a record survives a change after signing); then wai_conform_result_vectors verify;
+# and, with each check of §4 left out in turn (--skip), the corpus must fail
 # the corpus's second implementation, conform_result_verify.py, written from the
 # extension's text and sharing no code with wai-rs (WAI's strict Ed25519 rule from
-# claim-conformance/_ed25519.py), which reads the extension's reason table; and with each
-# check of §4 left out in turn (--skip), the corpus must fail it. Standard library only,
+# claim-conformance/_ed25519.py), which reads the extension's reason table and runs whole
+# in the step of every independent verifier above. Standard library only,
 # run isolated (-I).
 #
 # The paths this step brings to the workflow's trigger, and why:
@@ -23,7 +25,6 @@ set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib conform_result::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test conform_result)
 "$RUNNER_TEMP/wai-bins/union/wai_conform_result_vectors" verify conform-result-conformance
-python3 -I conform-result-conformance/conform_result_verify.py conform-result-conformance
 for c in duplicates format members signature summary verdict; do
   python3 -I conform-result-conformance/conform_result_verify.py --skip "$c" conform-result-conformance | tail -1
 done
diff --git a/.github/wai-conformance/verifiers/contribution.sh b/.github/wai-conformance/verifiers/contribution.sh
index c21c0087e..661ec0f2f 100644
--- a/.github/wai-conformance/verifiers/contribution.sh
+++ b/.github/wai-conformance/verifiers/contribution.sh
@@ -2,6 +2,7 @@
 # order: 370
 # features: contribution
 # paths: wai/extensions/contribution.md
+# independent: contribution live python3 -I live-conformance/contribution_verify.py live-conformance/contribution
 #
 # wai.media.contribution (extensions/contribution.md): the reference module's unit tests
 # (every proof of the steps' tree walks to its root, the copying operations follow their
@@ -9,7 +10,8 @@
 # regenerates byte for byte from its fixed seeds and no other file is there, wai-rs gives
 # every case its stated outcome and statements, §11 lists exactly the reference's codes,
 # each of which the corpus gives, and the corpus generates with the model file of
-# wai.generate.spectral's conformance vector); then the corpus's second implementation,
+# wai.generate.spectral's conformance vector); and, in the step of every independent
+# verifier above, the corpus's second implementation,
 # contribution_verify.py, written from the extension's text and sharing no code with
 # wai-rs, which evaluates every pinned operation, runs the generator in its own arithmetic
 # after checking it against the generator's conformance vector, computes every map, share
@@ -25,4 +27,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib contribution::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test contribution)
-python3 -I live-conformance/contribution_verify.py live-conformance/contribution
diff --git a/.github/wai-conformance/verifiers/cue-injection-ertmp.sh b/.github/wai-conformance/verifiers/cue-injection-ertmp.sh
index 7e29b9e2b..ddeeed9dd 100644
--- a/.github/wai-conformance/verifiers/cue-injection-ertmp.sh
+++ b/.github/wai-conformance/verifiers/cue-injection-ertmp.sh
@@ -1,5 +1,7 @@
 # step: cue injection and Enhanced RTMP · injection_verify.py and ertmp_verify.py
 # order: 690
+# independent: injection live python3 -I live-conformance/injection_verify.py --self-test live-conformance/injection
+# independent: ertmp live python3 -I live-conformance/ertmp_verify.py --self-test live-conformance/ertmp
 #
 # wai.live.injection (extensions/cue-injection.md) and Enhanced RTMP ingest
 # (extensions/live-ingest.md §12): both corpora are generated through joule-moq-ingest,
@@ -13,6 +15,3 @@
 # RTMP message of every session and requires every object of every room track and what
 # was not carried. Each then requires every mutated copy of its corpus to fail
 # (--self-test). Standard library only, run isolated (-I).
-set -euo pipefail
-python3 -I live-conformance/injection_verify.py --self-test live-conformance/injection
-python3 -I live-conformance/ertmp_verify.py --self-test live-conformance/ertmp
diff --git a/.github/wai-conformance/verifiers/delivery-sim.sh b/.github/wai-conformance/verifiers/delivery-sim.sh
index 8cc7ec662..49cbce1c2 100644
--- a/.github/wai-conformance/verifiers/delivery-sim.sh
+++ b/.github/wai-conformance/verifiers/delivery-sim.sh
@@ -1,7 +1,7 @@
 # step: sim_verify.py
 # order: 80
+# independent: delivery-sim delivery python3 staged-measure-conformance/sim_verify.py staged-measure-conformance
 #
 # The delivery simulator's second implementation: Appendix B from the text, every case
 # of staged-measure-conformance/sim/ reproduced and its claim checked, with a
 # counter-case required for each part of the stall bound a schedule can lose.
-python3 staged-measure-conformance/sim_verify.py staged-measure-conformance
diff --git a/.github/wai-conformance/verifiers/deriving-edge.sh b/.github/wai-conformance/verifiers/deriving-edge.sh
index e0278f76c..1bef19b5b 100644
--- a/.github/wai-conformance/verifiers/deriving-edge.sh
+++ b/.github/wai-conformance/verifiers/deriving-edge.sh
@@ -2,6 +2,7 @@
 # order: 680
 # features: derive_edge
 # paths: wai/extensions/deriving-edge.md
+# independent: edge delivery python3 -I edge-conformance/edge_verify.py edge-conformance
 #
 # wai.edge.derivation (extensions/deriving-edge.md): the reference module's unit tests
 # (the operations pixel by pixel, which operations the registry's composition rule makes
@@ -12,7 +13,8 @@
 # byte for byte from its fixed seeds and no other file is there, wai-rs gives every vector
 # its stated outcome, §9 lists exactly the reference's codes and §4 its derivations, and
 # the reference edge wai_edge, run twice over a clip, makes a chain of two hops that
-# verifies and is refused once a byte changes); then the corpus's second implementation,
+# verifies and is refused once a byte changes); and, in the step of every independent
+# verifier above, the corpus's second implementation,
 # edge_verify.py, written from the extension's text and sharing no code with wai-rs,
 # which reads receipts and writes stills itself, re-executes every replicate hop,
 # requires every mutated copy of the corpus to fail, and drops each of its own checks in
@@ -27,4 +29,3 @@ set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib derive_edge::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib png_still::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test derive_edge)
-python3 -I edge-conformance/edge_verify.py edge-conformance
diff --git a/.github/wai-conformance/verifiers/determinism-cost.sh b/.github/wai-conformance/verifiers/determinism-cost.sh
index 81df4f2ad..fd1d66cb3 100644
--- a/.github/wai-conformance/verifiers/determinism-cost.sh
+++ b/.github/wai-conformance/verifiers/determinism-cost.sh
@@ -1,15 +1,16 @@
 # step: determinism cost · the record, the text quoting it, and wai_det_cost
 # order: 20
 # features: neural_int
+# independent: determinism-cost trust python3 -I tools/wai_determinism_cost_verify.py research/determinism-cost/record.json research/determinism-cost.md extensions/determinism-tiers.md
 #
-# The determinism-cost record (research/determinism-cost.md): its summary recomputed
-# from its readings by a second implementation that shares no code with the tool that
-# wrote it (tools/wai_determinism_cost_verify.py, standard library only, run isolated),
+# The determinism-cost record (research/determinism-cost.md): wai_det_cost, the decoder
+# the record ran, held to the committed int_hyper vector and every WIH1 refusal fixture
+# of int-payload-conformance/. The record itself, its summary recomputed from its
+# readings by a second implementation that shares no code with the tool that
+# wrote it (tools/wai_determinism_cost_verify.py, standard library only, run isolated)
 # and every figure the research page and determinism-tiers §7 quote from it checked
-# against it (each is followed by a `det` marker naming its place in the record). Then
-# wai_det_cost, the decoder the record ran, held to the committed int_hyper vector and
-# every WIH1 refusal fixture of int-payload-conformance/.
+# against it (each is followed by a `det` marker naming its place in the record), is
+# checked in the step of
+# every independent verifier above.
 set -euo pipefail
-python3 -I tools/wai_determinism_cost_verify.py research/determinism-cost/record.json \
-  research/determinism-cost.md extensions/determinism-tiers.md
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test det_cost_bin)
diff --git a/.github/wai-conformance/verifiers/direction.sh b/.github/wai-conformance/verifiers/direction.sh
index f4f78b6fb..5e5d87c23 100644
--- a/.github/wai-conformance/verifiers/direction.sh
+++ b/.github/wai-conformance/verifiers/direction.sh
@@ -2,6 +2,7 @@
 # order: 500
 # features: direction
 # paths: wai/extensions/direction.md
+# independent: direction live python3 -I live-conformance/direction_verify.py live-conformance/direction
 #
 # wai.media.direction (extensions/direction.md): the reference module's unit tests (the
 # interpolations reach both keys and stay between them, the framing measure at its bounds,
@@ -10,7 +11,8 @@
 # fixed seeds and no other file is there, wai-rs gives every case its stated outcome and
 # statements, §13 lists exactly the reference's codes, each of which the corpus gives, and
 # the corpus generates with the model file of wai.generate.spectral's conformance vector);
-# then the corpus's second implementation, direction_verify.py, written from the
+# and, in the step of every independent verifier above, the corpus's second implementation,
+# direction_verify.py, written from the
 # extension's text and sharing no code with wai-rs, which runs the generator in its own
 # arithmetic after checking it against the generator's conformance vector, renders every
 # frame, interpolates every track, measures every box and writes every statement and C2PA
@@ -26,4 +28,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib direction::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test direction)
-python3 -I live-conformance/direction_verify.py live-conformance/direction
diff --git a/.github/wai-conformance/verifiers/e2ee.sh b/.github/wai-conformance/verifiers/e2ee.sh
index 9020d0ddb..bb70ad5dd 100644
--- a/.github/wai-conformance/verifiers/e2ee.sh
+++ b/.github/wai-conformance/verifiers/e2ee.sh
@@ -1,6 +1,7 @@
 # step: end-to-end encrypted rooms · e2ee_verify.py
 # order: 650
 # paths: wai/extensions/confidentiality.md
+# independent: e2ee live python3 -I live-conformance/e2ee_verify.py live-conformance/e2ee
 #
 # wai.live.e2ee (extensions/confidentiality.md): the corpus's second implementation,
 # e2ee_verify.py, written from the extension's text and the documents it reads and
@@ -16,4 +17,3 @@
 # The paths this step brings to the workflow's trigger, and why:
 # wai/extensions/confidentiality.md: e2ee_verify.py reads this extension's §13 table, and the
 #   registry's wire identifiers test reads its sections.
-python3 -I live-conformance/e2ee_verify.py live-conformance/e2ee
diff --git a/.github/wai-conformance/verifiers/energy-steering.sh b/.github/wai-conformance/verifiers/energy-steering.sh
index 8a1ccbed8..e8a417b5e 100644
--- a/.github/wai-conformance/verifiers/energy-steering.sh
+++ b/.github/wai-conformance/verifiers/energy-steering.sh
@@ -2,6 +2,7 @@
 # order: 190
 # features: energy_steering
 # paths: wai/extensions/energy-steering.md
+# independent: energy-steering live python3 -I live-conformance/energy_steering_verify.py live-conformance/steering
 #
 # wai.live.steering (extensions/energy-steering.md): the reference module's unit tests
 # (policies and decisions round-trip and their rules refuse, the window, the request
@@ -10,7 +11,8 @@
 # no figure never placed first by its rank while one with a figure is within the
 # limits) and tests/energy_steering.rs (the committed corpus regenerates byte for byte
 # from its fixed seeds, wai-rs gives every request and vector its stated outcome, every
-# reason of §10 refuses a vector, and §10 lists exactly the reference's codes); then the
+# reason of §10 refuses a vector, and §10 lists exactly the reference's codes); and, in
+# the step of every independent verifier above, the
 # corpus's second implementation, energy_steering_verify.py, written from the
 # extension's text and sharing no code with wai-rs, which reads the room with
 # live_rooms_verify.py and the per-hop records with live_metering_verify.py, parses RFC
@@ -24,4 +26,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib energy_steering::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test energy_steering)
-python3 -I live-conformance/energy_steering_verify.py live-conformance/steering
diff --git a/.github/wai-conformance/verifiers/exact-splats.sh b/.github/wai-conformance/verifiers/exact-splats.sh
index a6d4a813f..6dca1255f 100644
--- a/.github/wai-conformance/verifiers/exact-splats.sh
+++ b/.github/wai-conformance/verifiers/exact-splats.sh
@@ -2,6 +2,7 @@
 # order: 620
 # features: splat_exact
 # paths: wai/extensions/splat-exact.md wai/extensions/gltf/**
+# independent: splat-exact live python3 -I live-conformance/splat_exact_verify.py live-conformance/splat
 #
 # wai.splat.exact (extensions/splat-exact.md): the reference module's unit tests
 # (exp_neg_q16 against the exponential, binary32 ranges rounded half up exactly, the
@@ -9,7 +10,8 @@
 # frame unchanged) and tests/splat_exact.rs (live-conformance/splat/ regenerates byte for
 # byte and no other file is there, every case gets its stated outcome, §10 lists exactly the
 # reference's codes, the tiles leave every view of every scene unchanged, and the draft
-# schema names §3.2's members); then the corpus's second implementation,
+# schema names §3.2's members); and, in the step of every independent verifier above, the
+# corpus's second implementation,
 # splat_exact_verify.py, written from the extension's text and sharing no code with wai-rs:
 # it reads each glTF asset, decodes each payload with int_payload_verify.py's parser and
 # rANS decoder and tools/wai_ops_check.py's whm1/1 interpreter, renders every view with its
@@ -27,4 +29,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib splat_exact::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test splat_exact)
-python3 -I live-conformance/splat_exact_verify.py live-conformance/splat
diff --git a/.github/wai-conformance/verifiers/exact-tonemap.sh b/.github/wai-conformance/verifiers/exact-tonemap.sh
index 6b8a36417..672a8953d 100644
--- a/.github/wai-conformance/verifiers/exact-tonemap.sh
+++ b/.github/wai-conformance/verifiers/exact-tonemap.sh
@@ -2,6 +2,7 @@
 # order: 610
 # features: exact_tonemap
 # paths: wai/extensions/exact-tonemap.md
+# independent: tonemap live python3 -I live-conformance/tonemap_verify.py live-conformance/tonemap
 #
 # wai.media.tonemap, wai.meta.gainmap and wai.meta.st2094_50 (extensions/exact-tonemap.md):
 # the reference module's unit tests (the fixed-point log2 and exp2 at known points, the
@@ -10,7 +11,8 @@
 # (the committed corpus regenerates byte for byte, no other file is there, every case and
 # envelope gets its stated outcome, §9 lists exactly the reference's codes, §6 states the
 # corpus's measurement against binary64, and frames.rgb8 is the int_video clip's decode
-# whose digests its sidecar publishes); then the corpus's second implementation,
+# whose digests its sidecar publishes); and, in the step of every independent verifier
+# above, the corpus's second implementation,
 # tonemap_verify.py, written from the extension's text and sharing no code with wai-rs,
 # which computes both derivations in integer arithmetic of its own, reads PNG, envelopes
 # (with staged_verify.py) and both companions itself, recomputes §6's measurement, verifies
@@ -27,4 +29,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib -- exact_tonemap:: png_still::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test exact_tonemap)
-python3 -I live-conformance/tonemap_verify.py live-conformance/tonemap
diff --git a/.github/wai-conformance/verifiers/exact-upscale.sh b/.github/wai-conformance/verifiers/exact-upscale.sh
index bc2d9ceed..df2ec5029 100644
--- a/.github/wai-conformance/verifiers/exact-upscale.sh
+++ b/.github/wai-conformance/verifiers/exact-upscale.sh
@@ -2,6 +2,7 @@
 # order: 310
 # features: exact_upscale neural_int
 # paths: wai/extensions/exact-upscale.md
+# independent: upscale live python3 -I live-conformance/upscale_verify.py live-conformance/upscale
 #
 # wai.media.upscale (extensions/exact-upscale.md): the integer super-resolution
 # derivations' unit tests (the wai-ops/1 graph against the arithmetic of §3.2 written out
@@ -12,7 +13,8 @@
 # byte from its fixed seeds and its two pinned trained priors, and no other file is there;
 # wai-rs gives every case its stated outcome and statements; §8 lists exactly the
 # reference's codes, each of which the corpus gives; sha256.json names every accepted
-# output); then the corpus's second implementation, upscale_verify.py, written from the
+# output); and, in the step of every independent verifier above, the corpus's second
+# implementation, upscale_verify.py, written from the
 # extension's text and sharing no code with wai-rs, which runs the derivations with
 # _int_sr.py, verifies the claims with synthesis_verify.py and the residuals with
 # staged_verify.py, and requires every mutated copy of the corpus to fail; standard
@@ -27,4 +29,3 @@ set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib exact_upscale::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test exact_upscale)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test cli_derive)
-python3 -I live-conformance/upscale_verify.py live-conformance/upscale
diff --git a/.github/wai-conformance/verifiers/exploration.sh b/.github/wai-conformance/verifiers/exploration.sh
index 570078031..62c5cedb1 100644
--- a/.github/wai-conformance/verifiers/exploration.sh
+++ b/.github/wai-conformance/verifiers/exploration.sh
@@ -2,6 +2,7 @@
 # order: 560
 # features: exploration
 # paths: wai/extensions/exploration.md
+# independent: exploration live python3 -I live-conformance/exploration_verify.py live-conformance/exploration
 #
 # wai.media.exploration (extensions/exploration.md): the reference module's unit tests (the
 # descriptors of flat, single-row and checkerboard pictures, grid bins at both ends, the
@@ -10,7 +11,8 @@
 # regenerates byte for byte from its fixed seeds and no other file is there, wai-rs gives
 # every generation, descriptor vector and case its stated outcome, §13 lists exactly the
 # reference's codes, each of which the corpus gives, and §3.2 names the reference's
-# descriptors); then the corpus's second implementation, exploration_verify.py, written from
+# descriptors); and, in the step of every independent verifier above, the corpus's second
+# implementation, exploration_verify.py, written from
 # the extension's text and sharing no code with wai-rs, which makes every picture with the
 # generator as the extension's Appendix A restates it, computes the descriptors, replays
 # every archive's schedule, reads usage statements with ai_usage_verify.py, verifies every
@@ -26,4 +28,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib exploration::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test exploration)
-python3 -I live-conformance/exploration_verify.py live-conformance/exploration
diff --git a/.github/wai-conformance/verifiers/fleet.sh b/.github/wai-conformance/verifiers/fleet.sh
index 6fa355fb6..8a0a3ba32 100644
--- a/.github/wai-conformance/verifiers/fleet.sh
+++ b/.github/wai-conformance/verifiers/fleet.sh
@@ -2,6 +2,7 @@
 # order: 440
 # features: fleet
 # paths: wai/extensions/fleet.md
+# independent: fleet live python3 -I live-conformance/fleet_verify.py live-conformance/fleet
 #
 # wai.delivery.fleet (extensions/fleet.md): the reference module's unit tests (the enrolment's
 # rules, a summary line split only in the relay's form, a row summed across classes told from
@@ -10,7 +11,8 @@
 # vector its stated outcome; every reason of §10 and every reused code refuses a vector; the
 # accepted vectors state measured, unmetered and partial energy as §5.4 does; the week's
 # records held as a service holds them sign the corpus's report byte for byte; §10 lists
-# exactly the reference's codes); then the corpus's second implementation, fleet_verify.py,
+# exactly the reference's codes); and, in the step of every independent verifier above, the
+# corpus's second implementation, fleet_verify.py,
 # written from the extension's text and sharing no code with wai-rs, which reads per-hop
 # records with live_metering_verify.py, checks every signature with WAI's strict Ed25519
 # rule, recomputes every line, row, unmetered count and citation, requires every mutated
@@ -25,4 +27,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib fleet::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test fleet)
-python3 -I live-conformance/fleet_verify.py live-conformance/fleet
diff --git a/.github/wai-conformance/verifiers/forensic-watermark.sh b/.github/wai-conformance/verifiers/forensic-watermark.sh
index 47da6ccfd..18b003a9e 100644
--- a/.github/wai-conformance/verifiers/forensic-watermark.sh
+++ b/.github/wai-conformance/verifiers/forensic-watermark.sh
@@ -2,6 +2,7 @@
 # order: 670
 # features: live_watermark
 # paths: wai/extensions/forensic-watermark.md
+# independent: live-watermark live python3 -I live-conformance/live_watermark_verify.py live-conformance/watermark
 #
 # wai.live.watermark (extensions/forensic-watermark.md): the reference module's unit tests
 # (the CBOR reader's deterministic-encoding rules, tokens of both COSE structures and
@@ -9,7 +10,8 @@
 # the exact match and the binding) and tests/live_watermark.rs (vectors.json regenerates
 # byte for byte from its fixed seeds and no other file is there, wai-rs gives every
 # token, session list, match and disclosure its stated outcome, and §11 lists exactly the
-# reference's codes, each of which the corpus gives); then the corpus's second
+# reference's codes, each of which the corpus gives); and, in the step of every
+# independent verifier above, the corpus's second
 # implementation, live_watermark_verify.py, written from the extension's text and sharing
 # no code with wai-rs, which reads rooms with live_rooms_verify.py and tokens with a CBOR
 # reader of its own, requires every mutated copy of the corpus to fail, and drops each of
@@ -23,4 +25,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib live_watermark::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test live_watermark)
-python3 -I live-conformance/live_watermark_verify.py live-conformance/watermark
diff --git a/.github/wai-conformance/verifiers/holdings.sh b/.github/wai-conformance/verifiers/holdings.sh
index 16804314f..68abf79e7 100644
--- a/.github/wai-conformance/verifiers/holdings.sh
+++ b/.github/wai-conformance/verifiers/holdings.sh
@@ -2,12 +2,14 @@
 # order: 550
 # features: holdings
 # paths: wai/extensions/holdings.md
+# independent: holdings live needs=cryptography python3 -I live-conformance/holdings_verify.py live-conformance/holdings
 #
 # wai.delivery.holdings (extensions/holdings.md): the reference module's unit tests (an entry's
 # one form, a record read back and every rule refusing, queries and a plan, and the corpus
 # reaching every stated outcome and failing a changed one) and tests/holdings.rs (vectors.json
 # regenerates byte for byte from its fixed seeds, wai-rs gives every case its stated outcome,
-# and §7 lists exactly the reference's codes); then the corpus's second implementation,
+# and §7 lists exactly the reference's codes); and, in the step of every independent verifier
+# above, the corpus's second implementation,
 # holdings_verify.py, written from the extension's text and sharing no code with wai-rs, which
 # verifies group receipts with jwp_verify.py and signatures with the shared _ed25519.py, writes
 # the record, its verdict, queries and plans itself, reads §7, requires every mutated copy of
@@ -19,4 +21,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib -- holdings::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test holdings)
-python3 -I live-conformance/holdings_verify.py live-conformance/holdings
diff --git a/.github/wai-conformance/verifiers/http.sh b/.github/wai-conformance/verifiers/http.sh
index 5e7937695..96ad691f3 100644
--- a/.github/wai-conformance/verifiers/http.sh
+++ b/.github/wai-conformance/verifiers/http.sh
@@ -1,5 +1,6 @@
 # step: http_verify.py
 # order: 50
+# independent: http delivery needs=cryptography python3 http-conformance/http_verify.py http-conformance
 #
 # The HTTP delivery corpus's second implementation (http-conformance/README): the head,
 # the head proof (every committed proof rebuilt from the text), response checks, plans,
@@ -12,4 +13,3 @@
 # `cryptography` package installed above (without it those cases fail, never skip).
 # Its mutations and the differential against wai-rs run in wai-http.yml's falsify
 # job.
-python3 http-conformance/http_verify.py http-conformance
diff --git a/.github/wai-conformance/verifiers/hybrid-signatures.sh b/.github/wai-conformance/verifiers/hybrid-signatures.sh
index 3279f8b93..74207d525 100644
--- a/.github/wai-conformance/verifiers/hybrid-signatures.sh
+++ b/.github/wai-conformance/verifiers/hybrid-signatures.sh
@@ -3,13 +3,15 @@
 # build: pq
 # features: pq_signatures synthesis,pq_signatures
 # paths: wai/extensions/pq-signatures.md
+# independent: pq trust needs=cryptography python3 -I pq-conformance/pq_verify.py pq-conformance
 #
 # Hybrid signatures (extensions/pq-signatures.md): the reference module's unit tests (its
 # ML-DSA-65 against FIPS 204's ACVP vectors — keyGen, deterministic sigGen and sigVer —
 # vendored in pq-conformance/acvp and pinned by SHA-256, and the composite against the
 # draft's own vector, before anything is built on them), the synthesis reader's hybrid
 # records, and tests/pq_signatures.rs (vectors.json regenerates byte for byte, every case
-# reaches its verdict, §8 lists exactly the reference's codes, each given); then the
+# reaches its verdict, §8 lists exactly the reference's codes, each given); and, in the
+# step of every independent verifier above, the
 # corpus's second implementation, pq_verify.py, written from the extension's text and
 # sharing no code with wai-rs, which verifies ML-DSA-65 from FIPS 204's text in pure
 # Python (_mldsa.py), checks every ACVP verification vector and signature and the draft's
@@ -25,7 +27,6 @@ set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_PQ_FEATURES" --lib pq_sig::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_PQ_FEATURES" --lib synthesis::pq_tests)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_PQ_FEATURES" --test pq_signatures)
-python3 -I pq-conformance/pq_verify.py pq-conformance
 python3 -I pq-conformance/pq_verify.py verdicts pq-conformance/vectors.json > "$RUNNER_TEMP/pq-py.tsv"
 (cd wai-rs && "$RUNNER_TEMP/wai-bins/pq/wai_pq_vectors" verdicts ../pq-conformance/vectors.json) > "$RUNNER_TEMP/pq-rs.tsv"
 diff "$RUNNER_TEMP/pq-py.tsv" "$RUNNER_TEMP/pq-rs.tsv"
diff --git a/.github/wai-conformance/verifiers/influence.sh b/.github/wai-conformance/verifiers/influence.sh
index 843e672e8..4d4aa853e 100644
--- a/.github/wai-conformance/verifiers/influence.sh
+++ b/.github/wai-conformance/verifiers/influence.sh
@@ -2,6 +2,7 @@
 # order: 490
 # features: influence
 # paths: wai/extensions/influence.md
+# independent: influence live python3 -I live-conformance/influence_verify.py live-conformance/influence
 #
 # wai.media.influence (extensions/influence.md): the reference module's unit tests (the
 # blend keeps its base and its references by weight, the makers' split is whole, an
@@ -9,7 +10,8 @@
 # committed corpus regenerates byte for byte from its fixed seeds and no other file is
 # there, wai-rs gives every case, statement and report its stated outcome, every reason of
 # §9 and every code it reuses refuses a vector, and §9 lists exactly the reference's codes);
-# then the corpus's second implementation, influence_verify.py, written from the
+# and, in the step of every independent verifier above, the corpus's second implementation,
+# influence_verify.py, written from the
 # extension's text and sharing no code with wai-rs, which verifies each session with
 # contribution_verify.py, regenerates every conditioned step with that implementation's
 # arithmetic of the generator, reads usage statements with ai_usage_verify.py and
@@ -25,4 +27,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib influence::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test influence)
-python3 -I live-conformance/influence_verify.py live-conformance/influence
diff --git a/.github/wai-conformance/verifiers/int-payload.sh b/.github/wai-conformance/verifiers/int-payload.sh
index b80b73a1d..542e0bc58 100644
--- a/.github/wai-conformance/verifiers/int-payload.sh
+++ b/.github/wai-conformance/verifiers/int-payload.sh
@@ -1,9 +1,9 @@
 # step: int_payload_verify.py
 # order: 10
+# independent: int-payload trust python3 int-payload-conformance/int_payload_verify.py int-payload-conformance
 #
 # The integer payload corpus's second implementation (int-payload-conformance/README):
 # it parses every payload with the extension's rules and check order, converts every
 # JSON source independently and requires the committed bytes, decodes the WIV1
 # keyframe-0 payloads in full to their sidecars' SHA-256, and checks every refusal
 # fixture. Standard library only, so it needs nothing installed.
-python3 int-payload-conformance/int_payload_verify.py int-payload-conformance
diff --git a/.github/wai-conformance/verifiers/key-release.sh b/.github/wai-conformance/verifiers/key-release.sh
index c0684a4ac..d228744eb 100644
--- a/.github/wai-conformance/verifiers/key-release.sh
+++ b/.github/wai-conformance/verifiers/key-release.sh
@@ -2,6 +2,7 @@
 # order: 240
 # features: key_release
 # paths: wai/extensions/key-release.md
+# independent: key-release live python3 -I live-conformance/key_release_verify.py live-conformance/keys
 #
 # The proxy form of wai.video.keys (extensions/key-release.md): the reference module's unit
 # tests (the commitment list, the entitlement and the ticket round-trip and their rules
@@ -10,7 +11,8 @@
 # from a CPIX document), form 1's unit tests (its legacy pin unchanged), and
 # tests/key_release.rs (every file of the committed corpus regenerates byte for byte from
 # its fixed seeds and no other file is there, every log gets its stated outcome, and the
-# extension's tables are the reference's codes); then the corpus's second implementation,
+# extension's tables are the reference's codes); and, in the step of every independent
+# verifier above, the corpus's second implementation,
 # key_release_verify.py, written from the extension's text and sharing no code with wai-rs,
 # which reads the extension's tables, derives every list from its CPIX document with the
 # standard library's XML parser, recomputes every decision of every log, verifies every
@@ -25,4 +27,3 @@ set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib key_release::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib wai_video_keys::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test key_release)
-python3 -I live-conformance/key_release_verify.py live-conformance/keys
diff --git a/.github/wai-conformance/verifiers/live-ads.sh b/.github/wai-conformance/verifiers/live-ads.sh
index 36147566e..927ec8b34 100644
--- a/.github/wai-conformance/verifiers/live-ads.sh
+++ b/.github/wai-conformance/verifiers/live-ads.sh
@@ -2,6 +2,7 @@
 # order: 230
 # features: live_ads
 # paths: wai/extensions/live-ads.md
+# independent: live-ads live python3 -I live-conformance/live_ads_verify.py live-conformance/ads
 #
 # wai.live.ads (extensions/live-ads.md): the reference module's unit tests (policies and
 # annotations round-trip and their rules refuse, a break's identity, tags, events and
@@ -10,7 +11,8 @@
 # unchanged), and tests/live_ads.rs (every file of the committed corpus, vectors.json and
 # each room's HLS tags, regenerates byte for byte from its fixed seeds and no other file
 # is there, wai-rs gives every room its stated outcome, and §10 lists exactly the
-# reference's codes, each of which the corpus gives); then the corpus's second
+# reference's codes, each of which the corpus gives); and, in the step of every
+# independent verifier above, the corpus's second
 # implementation, live_ads_verify.py, written from the extension's text and sharing no
 # code with wai-rs, which verifies each room with live_rooms_verify.py, writes every tag,
 # event and asset list byte for byte, verifies every receipt with WAI's strict Ed25519
@@ -26,4 +28,3 @@ set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib live_ads::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib wai_video_ssai::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test live_ads)
-python3 -I live-conformance/live_ads_verify.py live-conformance/ads
diff --git a/.github/wai-conformance/verifiers/live-compose.sh b/.github/wai-conformance/verifiers/live-compose.sh
index 1ef18f2eb..4b973c01b 100644
--- a/.github/wai-conformance/verifiers/live-compose.sh
+++ b/.github/wai-conformance/verifiers/live-compose.sh
@@ -2,13 +2,15 @@
 # order: 130
 # features: live_compose
 # paths: wai/extensions/live-compose.md
+# independent: live-compose live python3 -I live-conformance/live_compose_verify.py live-conformance/compose
 #
 # wai.live.compose (extensions/live-compose.md): the reference module's unit tests (the
 # layout over every grid of 1 to 64 tiles stays on its canvas with no tile overlapping
 # another, the fill modes, the attributes, the mixer) and tests/live_compose.rs (the
 # committed corpus regenerates byte for byte from its fixed seeds, wai-rs gives every
 # case its stated outcome, every reason of §10 refuses a case, and §10 lists exactly
-# the reference's codes); then the corpus's second implementation,
+# the reference's codes); and, in the step of every independent verifier above, the
+# corpus's second implementation,
 # live_compose_verify.py, written from the extension's text and sharing no code with
 # wai-rs, which verifies each room with live_rooms_verify.py, steps through its
 # lifecycle replay to each instant itself, gives every layout, mix, descriptor,
@@ -22,4 +24,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib live_compose::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test live_compose)
-python3 -I live-conformance/live_compose_verify.py live-conformance/compose
diff --git a/.github/wai-conformance/verifiers/live-contribution.sh b/.github/wai-conformance/verifiers/live-contribution.sh
index 176573612..889c6df40 100644
--- a/.github/wai-conformance/verifiers/live-contribution.sh
+++ b/.github/wai-conformance/verifiers/live-contribution.sh
@@ -1,6 +1,7 @@
 # step: live contribution · live_contribution_verify.py
 # order: 380
 # paths: wai/extensions/live-contribution.md
+# independent: live-contribution live python3 -I live-conformance/live_contribution_verify.py live-conformance/links
 #
 # wai.live.contribution (extensions/live-contribution.md): the link records' corpus
 # under live-conformance/links/, which joule-moq-ingest's reference generates and its
@@ -15,5 +16,3 @@
 # The paths this step brings to the workflow's trigger, and why:
 # wai/extensions/live-contribution.md: live_contribution_verify.py reads this extension's §7 list
 #   of the link record's reasons and requires the corpus to raise each one.
-set -euo pipefail
-python3 -I live-conformance/live_contribution_verify.py live-conformance/links
diff --git a/.github/wai-conformance/verifiers/live-events.sh b/.github/wai-conformance/verifiers/live-events.sh
index 5643a9efc..4928b644f 100644
--- a/.github/wai-conformance/verifiers/live-events.sh
+++ b/.github/wai-conformance/verifiers/live-events.sh
@@ -2,12 +2,14 @@
 # order: 100
 # features: live_events
 # paths: wai/extensions/live-events.md
+# independent: live-events live python3 -I live-conformance/live_events_verify.py live-conformance/events
 #
 # wai.live.events (extensions/live-events.md): the reference module's unit tests and
 # tests/live_events.rs (the committed corpus regenerates byte for byte from its fixed
 # seeds, wai-rs gives every vector, policy case and binding case its stated outcome,
 # the corpus covers every kind and reason, and §9 lists exactly the reference's
-# codes); then the corpus's second implementation, live_events_verify.py, written
+# codes); and, in the step of every independent verifier above, the corpus's second
+# implementation, live_events_verify.py, written
 # from the extension's text and sharing no code with wai-rs, which verifies the same
 # cases with WAI's strict Ed25519 (claim-conformance/_ed25519.py) and BLAKE3
 # (claim-conformance/_blake3.py), standard library only, run isolated (-I).
@@ -18,4 +20,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib live_events::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test live_events)
-python3 -I live-conformance/live_events_verify.py live-conformance/events
diff --git a/.github/wai-conformance/verifiers/live-messaging.sh b/.github/wai-conformance/verifiers/live-messaging.sh
index 95eef65ed..35a8abb46 100644
--- a/.github/wai-conformance/verifiers/live-messaging.sh
+++ b/.github/wai-conformance/verifiers/live-messaging.sh
@@ -2,11 +2,13 @@
 # order: 660
 # features: live_messaging
 # paths: wai/extensions/live-messaging.md
+# independent: live-messaging live python3 -I live-conformance/live_messaging_verify.py live-conformance/messaging
 #
 # wai.live.message and wai.live.call (extensions/live-messaging.md): tests/live_messaging.rs
 # (vectors.json regenerates byte for byte from its fixed seeds and no other file is there,
 # wai-rs gives every conversation, history request, call and record its stated outcome, and
-# §12 lists exactly the reference's codes, each of which the corpus gives); then the corpus's
+# §12 lists exactly the reference's codes, each of which the corpus gives); and, in the step
+# of every independent verifier above, the corpus's
 # second implementation, live_messaging_verify.py, written from the extension's text and
 # sharing no code with wai-rs, which reads descriptors with live_rooms_verify.py and Key IDs,
 # keys, AES-GCM and plaintexts with e2ee_verify.py, implements the receipts' binary form and
@@ -21,4 +23,3 @@
 #   wire identifiers test reads its sections.
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test live_messaging)
-python3 -I live-conformance/live_messaging_verify.py live-conformance/messaging
diff --git a/.github/wai-conformance/verifiers/live-metering.sh b/.github/wai-conformance/verifiers/live-metering.sh
index 3426730f9..f58d73c4f 100644
--- a/.github/wai-conformance/verifiers/live-metering.sh
+++ b/.github/wai-conformance/verifiers/live-metering.sh
@@ -2,6 +2,7 @@
 # order: 180
 # features: live_metering
 # paths: wai/extensions/live-metering.md
+# independent: live-metering live python3 -I live-conformance/live_metering_verify.py live-conformance/metering
 #
 # wai.live.metering (extensions/live-metering.md): the reference module's unit tests
 # (records and ledgers round-trip, the energy rules, the size bound at its limit, a
@@ -10,9 +11,10 @@
 # tests/live_metering.rs (the committed corpus regenerates byte for byte from its fixed
 # seeds and the reference relay's recorded record, wai-rs gives every vector its stated
 # outcome, every reason of §9 refuses a vector, the large audience's relay record is the
-# lesson's size, and §9 lists exactly the reference's codes); then the corpus's second
-# implementation, live_metering_verify.py, written from the extension's text and sharing
-# no code with wai-rs, which verifies each room with live_rooms_verify.py, each take with
+# lesson's size, and §9 lists exactly the reference's codes); and, in the step of every
+# independent verifier above, the corpus's second implementation,
+# live_metering_verify.py, written from the extension's text and sharing no code with
+# wai-rs, which verifies each room with live_rooms_verify.py, each take with
 # capture_take_verify.py and each composition receipt with live_compose_verify.py,
 # recomputes every unit, total and grant's consumption itself, and requires every
 # mutated copy of the corpus to fail; standard library only, run isolated (-I).
@@ -24,4 +26,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib live_metering::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test live_metering)
-python3 -I live-conformance/live_metering_verify.py live-conformance/metering
diff --git a/.github/wai-conformance/verifiers/live-moderation.sh b/.github/wai-conformance/verifiers/live-moderation.sh
index c11dbb285..ebd985b01 100644
--- a/.github/wai-conformance/verifiers/live-moderation.sh
+++ b/.github/wai-conformance/verifiers/live-moderation.sh
@@ -2,6 +2,7 @@
 # order: 210
 # features: live_moderation
 # paths: wai/extensions/live-moderation.md
+# independent: live-moderation live python3 -I live-conformance/live_moderation_verify.py live-conformance/moderation
 #
 # wai.live.moderation (extensions/live-moderation.md): the reference module's unit tests
 # (policies, statements and notices round-trip and their rules refuse, the export's
@@ -9,7 +10,8 @@
 # tests/live_moderation.rs (every file of the committed corpus, vectors.json and each
 # statement-of-reasons export, regenerates byte for byte from its fixed seeds and no
 # other file is there, wai-rs gives every room, export and clip its stated outcome, and
-# §10 lists exactly the reference's codes, each of which the corpus gives); then the
+# §10 lists exactly the reference's codes, each of which the corpus gives); and, in the
+# step of every independent verifier above, the
 # corpus's second implementation, live_moderation_verify.py, written from the
 # extension's text and sharing no code with wai-rs, which verifies each room with
 # live_rooms_verify.py and each clip with live_record_verify.py, writes every export
@@ -24,4 +26,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib live_moderation::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test live_moderation)
-python3 -I live-conformance/live_moderation_verify.py live-conformance/moderation
diff --git a/.github/wai-conformance/verifiers/live-provenance.sh b/.github/wai-conformance/verifiers/live-provenance.sh
index 32cbcf98e..ac8ee4b41 100644
--- a/.github/wai-conformance/verifiers/live-provenance.sh
+++ b/.github/wai-conformance/verifiers/live-provenance.sh
@@ -2,6 +2,7 @@
 # order: 280
 # features: live_provenance
 # paths: wai/extensions/live-provenance.md
+# independent: live-provenance live python3 -I live-conformance/c2pa_live_verify.py live-conformance/c2pa-live
 #
 # wai.live.provenance (extensions/live-provenance.md): the reference module's unit tests
 # (boxes, chunks, emsg and the BMFF hash; the JUMBF store; COSE_Sign1 and the OKP key;
@@ -10,7 +11,8 @@
 # committed corpus regenerates byte for byte from its fixed seeds and the packaging
 # corpus's AV1 floor, and no other file is there; wai-rs gives every vector its stated
 # outcome; every reason of §12 refuses a vector; §12 lists exactly the reference's codes
-# with the two C2PA codes it reports); then the corpus's second implementation,
+# with the two C2PA codes it reports); and, in the step of every independent verifier
+# above, the corpus's second implementation,
 # c2pa_live_verify.py, written from the extension's text and sharing no code with
 # wai-rs, which reads CBOR, ISO BMFF, JUMBF, COSE and X.509 DER itself, verifies every
 # signature with WAI's strict Ed25519 rule and every receipt with BLAKE3 from
@@ -24,4 +26,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib live_provenance::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test live_provenance)
-python3 -I live-conformance/c2pa_live_verify.py live-conformance/c2pa-live
diff --git a/.github/wai-conformance/verifiers/live-recording.sh b/.github/wai-conformance/verifiers/live-recording.sh
index f2132c4f1..8b319cd79 100644
--- a/.github/wai-conformance/verifiers/live-recording.sh
+++ b/.github/wai-conformance/verifiers/live-recording.sh
@@ -2,13 +2,15 @@
 # order: 140
 # features: live_record
 # paths: wai/extensions/live-recording.md
+# independent: live-recording live python3 -I live-conformance/live_record_verify.py live-conformance/recordings
 #
 # wai.live.recording (extensions/live-recording.md): the reference module's unit tests,
 # the output tree's (whose range proofs it adds, tested against RFC 9162 §2.1.3.2's
 # check), and tests/live_record.rs (the committed corpus regenerates byte for byte from
 # its fixed seeds, wai-rs gives every recording and clip its stated outcome, every reason
 # of §9 appears in it, every take it says it reuses is capture binding's byte for byte,
-# and §9 lists exactly the reference's codes); then the corpus's second implementation,
+# and §9 lists exactly the reference's codes); and, in the step of every independent
+# verifier above, the corpus's second implementation,
 # live_record_verify.py, written from the extension's text and sharing no code with
 # wai-rs, which checks range proofs by the extension's recursion and by RFC 9162
 # §2.1.3.2's own algorithm, verifies each take with capture_take_verify.py and every
@@ -21,4 +23,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib -- live_record:: output_tree::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test live_record)
-python3 -I live-conformance/live_record_verify.py live-conformance/recordings
diff --git a/.github/wai-conformance/verifiers/live-rooms.sh b/.github/wai-conformance/verifiers/live-rooms.sh
index 751cb970b..853e546bb 100644
--- a/.github/wai-conformance/verifiers/live-rooms.sh
+++ b/.github/wai-conformance/verifiers/live-rooms.sh
@@ -2,15 +2,16 @@
 # order: 110
 # features: live_room
 # paths: wai/extensions/live-rooms.md
+# independent: live-rooms live python3 -I live-conformance/live_rooms_verify.py live-conformance/rooms
 #
 # wai.live.room (extensions/live-rooms.md): the reference module's unit tests and
 # tests/live_room.rs (the committed corpus regenerates byte for byte from its fixed
 # seeds, wai-rs gives every vector its stated outcome, every reason of §11 refuses a
-# vector, and §11 lists exactly the reference's codes); then the corpus's second
-# implementation, live_rooms_verify.py, written from the extension's text and sharing
-# no code with wai-rs, which verifies every event with live_events_verify.py and every
-# signature with WAI's strict Ed25519 (claim-conformance/_ed25519.py), standard
-# library only, run isolated (-I).
+# vector, and §11 lists exactly the reference's codes); and, in the step of every
+# independent verifier above, the corpus's second implementation, live_rooms_verify.py,
+# written from the extension's text and sharing no code with wai-rs, which verifies
+# every event with live_events_verify.py and every signature with WAI's strict Ed25519
+# (claim-conformance/_ed25519.py), standard library only, run isolated (-I).
 #
 # The paths this step brings to the workflow's trigger, and why:
 # wai/extensions/live-rooms.md: tests/live_room.rs requires this extension's §11 to list the codes
@@ -18,4 +19,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib live_room::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test live_room)
-python3 -I live-conformance/live_rooms_verify.py live-conformance/rooms
diff --git a/.github/wai-conformance/verifiers/live-worlds.sh b/.github/wai-conformance/verifiers/live-worlds.sh
index be243a24b..7ff266ab2 100644
--- a/.github/wai-conformance/verifiers/live-worlds.sh
+++ b/.github/wai-conformance/verifiers/live-worlds.sh
@@ -2,12 +2,14 @@
 # order: 640
 # features: live_world
 # paths: wai/extensions/live-worlds.md
+# independent: live-worlds live python3 -I live-conformance/live_worlds_verify.py live-conformance/worlds
 #
 # wai.live.world (extensions/live-worlds.md): the reference module's unit tests (the
 # statement and its rules, the grant attribute) and tests/live_world.rs (vectors.json
 # regenerates byte for byte from its fixed seeds and no other file is there, wai-rs gives
 # every world its stated outcome, and §11 lists exactly the reference's codes, each of which
-# a verifier raises the corpus gives); then the corpus's second implementation,
+# a verifier raises the corpus gives); and, in the step of every independent verifier above,
+# the corpus's second implementation,
 # live_worlds_verify.py, written from the extension's text and the sections it cites and
 # sharing no code with wai-rs: the statement, each grant's signature and attributes, each
 # receipt in its binary form under the owner's chain, each op's signature, owner, kind,
@@ -19,4 +21,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib live_world::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test live_world)
-python3 -I live-conformance/live_worlds_verify.py live-conformance/worlds
diff --git a/.github/wai-conformance/verifiers/loc.sh b/.github/wai-conformance/verifiers/loc.sh
index c6b826aa5..564b70ccc 100644
--- a/.github/wai-conformance/verifiers/loc.sh
+++ b/.github/wai-conformance/verifiers/loc.sh
@@ -1,5 +1,6 @@
 # step: loc_verify.py
 # order: 760
+# independent: loc live python3 -I live-conformance/loc_verify.py live-conformance/loc
 #
 # LOC carriage (extensions/loc-carriage.md): the second implementation of joule-moq's loc
 # module (whose tests/loc_vectors.rs runs in joule-code-conformance), written from the text,
@@ -7,4 +8,3 @@
 # every object back to its envelope, writes it again byte for byte, gives every refused
 # object and envelope its code, and requires every mutated copy, and the corpus under a
 # copy of itself with a check dropped, to fail.
-python3 -I live-conformance/loc_verify.py live-conformance/loc
diff --git a/.github/wai-conformance/verifiers/media-identification.sh b/.github/wai-conformance/verifiers/media-identification.sh
index ee1f9a226..1bc727e65 100644
--- a/.github/wai-conformance/verifiers/media-identification.sh
+++ b/.github/wai-conformance/verifiers/media-identification.sh
@@ -3,10 +3,12 @@
 # features: identify
 # alone: -
 # paths: wai/extensions/media-identify.md
+# independent: identify delivery python3 -I identify-conformance/identify_verify.py identify-conformance
 #
 # Media identification (extensions/media-identify.md): wai-rs's unit tests (hostile bytes
 # through every walk, what a file reads as its bytes) and tests/identify.rs (the corpus
-# regenerates byte for byte with every result; the extension's tables; `wai identify`); then
+# regenerates byte for byte with every result; the extension's tables; `wai identify`); and,
+# in the step of every independent verifier above,
 # identify_verify.py, written from the text and sharing no code with wai-rs but
 # format_probe_verify.py's probes, which gives every file its whole result, holds ext/ to
 # what an independent prober read of it, and requires every mutated copy to fail.
@@ -19,4 +21,3 @@ set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib identify::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test identify)
 (cd wai-rs && "$RUNNER_TEMP/wai-bins/union/wai_identify_vectors" verify ../identify-conformance)
-python3 -I identify-conformance/identify_verify.py identify-conformance
diff --git a/.github/wai-conformance/verifiers/native-sink.sh b/.github/wai-conformance/verifiers/native-sink.sh
index 68f053f39..e66a323a3 100644
--- a/.github/wai-conformance/verifiers/native-sink.sh
+++ b/.github/wai-conformance/verifiers/native-sink.sh
@@ -2,6 +2,7 @@
 # order: 460
 # features: native_sink
 # paths: wai/extensions/native-sink.md
+# independent: native-sink live needs=cryptography python3 -I live-conformance/native_sink_verify.py live-conformance/native-sink
 #
 # The native sink (extensions/native-sink.md): the reference module's unit tests (dates,
 # durations and attribute lists read as a player reads them, origins serialized as RFC 6454
@@ -10,7 +11,8 @@
 # one refused for another owner or channel) and tests/native_sink.rs (vectors.json
 # regenerates byte for byte from its seeds and no other file is there, every call gets the
 # answer it states, §8 lists exactly the reasons the corpus reaches, and every case run
-# through the C interface's symbols gets the same answers); then the corpus's second
+# through the C interface's symbols gets the same answers); and, in the step of every
+# independent verifier above, the corpus's second
 # implementation, native_sink_verify.py, written from the extension's text and sharing no
 # code with wai-rs, which replays every case, reads playlist receipts and their chain with
 # http_verify.py, holds every bundle to its own session field by field and verifies it with
@@ -24,4 +26,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib native_sink::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test native_sink)
-python3 -I live-conformance/native_sink_verify.py live-conformance/native-sink
diff --git a/.github/wai-conformance/verifiers/oer.sh b/.github/wai-conformance/verifiers/oer.sh
new file mode 100644
index 000000000..9dfbe6c04
--- /dev/null
+++ b/.github/wai-conformance/verifiers/oer.sh
@@ -0,0 +1,11 @@
+# step: oer2_verify.py
+# order: 780
+# independent: oer trust needs=cryptography python3 oer-conformance/oer2_verify.py oer-conformance/vectors.json
+# independent: oer-firmware trust needs=cryptography python3 oer-conformance/oer2_verify.py oer-conformance/firmware_vectors.json
+# independent: oer-edge trust needs=cryptography python3 oer-conformance/oer2_verify.py oer-conformance/edge_vectors.json
+# independent: oer-job trust needs=cryptography python3 oer-conformance/oer2_verify.py oer-conformance/job_vectors.json
+# independent: oer-unreadable trust python3 oer-conformance/oer2_verify.py --unreadable oer-conformance/unreadable
+#
+# The OER corpus's second implementation (oer-conformance/README): oer2_verify.py over each
+# of the corpus's four vectors files, each a run and a record of its own, and over its
+# unreadable documents (--unreadable). No workflow ran it before the union.
diff --git a/.github/wai-conformance/verifiers/opportunity-report.sh b/.github/wai-conformance/verifiers/opportunity-report.sh
index 8991d3d0b..f42206989 100644
--- a/.github/wai-conformance/verifiers/opportunity-report.sh
+++ b/.github/wai-conformance/verifiers/opportunity-report.sh
@@ -2,6 +2,7 @@
 # order: 420
 # features: opportunity_report
 # paths: wai/extensions/opportunity-report.md
+# independent: opportunity-report live needs=cryptography python3 -I live-conformance/opportunity_report_verify.py live-conformance/opportunity
 #
 # wai.delivery.opportunity (extensions/opportunity-report.md): the reference module's unit
 # tests (the SCTE 35 subset reader against the standard's sample and damaged sections, the
@@ -11,7 +12,8 @@
 # outcome; every reason of §13 and every reused code refuses a vector; §13 lists exactly the
 # reference's codes; the worked example, a channel's day whose reported statement
 # under-reports one owner's programme, and the check that shows it, recomputed from the
-# public records alone); then the corpus's second implementation, opportunity_report_verify.py,
+# public records alone); and, in the step of every independent verifier above, the corpus's
+# second implementation, opportunity_report_verify.py,
 # written from the extension's text and sharing no code with wai-rs, which verifies rooms
 # with live_ads_verify.py and contracts, runs and signed statements with
 # revenue_share_verify.py, reads every report, check, section and reported statement itself,
@@ -27,4 +29,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib opportunity_report::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test opportunity_report)
-python3 -I live-conformance/opportunity_report_verify.py live-conformance/opportunity
diff --git a/.github/wai-conformance/verifiers/pin.sh b/.github/wai-conformance/verifiers/pin.sh
new file mode 100644
index 000000000..a2b53b688
--- /dev/null
+++ b/.github/wai-conformance/verifiers/pin.sh
@@ -0,0 +1,8 @@
+# step: pin_verify.py
+# order: 770
+# independent: pin trust python3 pin-conformance/pin_verify.py pin-conformance
+#
+# The pin corpus's second implementation: Python standard library only, sharing no
+# code with wai-rs. It checks digests and listing rules, which do not depend on the
+# architecture, so one run is enough: it ran on cargo-classes' macOS leg, and runs in the
+# union now.
diff --git a/.github/wai-conformance/verifiers/platform-encode.sh b/.github/wai-conformance/verifiers/platform-encode.sh
index 83bc4ebce..9dded4b0a 100644
--- a/.github/wai-conformance/verifiers/platform-encode.sh
+++ b/.github/wai-conformance/verifiers/platform-encode.sh
@@ -2,13 +2,15 @@
 # order: 570
 # features: platform_encode
 # paths: wai/extensions/platform-encode.md
+# independent: encode delivery python3 -I encode-conformance/encode_verify.py encode-conformance
 #
 # wai.video.encode (extensions/platform-encode.md): the reference module's unit tests (the
 # Exp-Golomb reader, emulation prevention, NAL splitting, length-prefixed samples, the
 # resampler, the source reader, the strict JSON scan and the date-time) and
 # tests/platform_encode.rs (the fixture streams are the pinned bytes, every generated file
 # regenerates byte for byte, every case gets its outcome, every record reason has a case, and
-# §12 lists exactly the reference's reasons); then the corpus's second implementation,
+# §12 lists exactly the reference's reasons); and, in the step of every independent verifier
+# above, the corpus's second implementation,
 # encode_verify.py, written from the extension's text and sharing no code with wai-rs or
 # wai-pack, which reads every Annex B stream, its access units and parameter sets itself,
 # verifies every record with WAI's strict Ed25519 rule and every object with BLAKE3 from
@@ -23,4 +25,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --locked --no-default-features --features "$WAI_FEATURES" --lib platform_encode::)
 (cd wai-rs && cargo test --locked --no-default-features --features "$WAI_FEATURES" --test platform_encode)
-python3 -I encode-conformance/encode_verify.py encode-conformance
diff --git a/.github/wai-conformance/verifiers/prior-forms.sh b/.github/wai-conformance/verifiers/prior-forms.sh
index 7f3d9e38b..1e8beed4d 100644
--- a/.github/wai-conformance/verifiers/prior-forms.sh
+++ b/.github/wai-conformance/verifiers/prior-forms.sh
@@ -2,6 +2,7 @@
 # order: 330
 # features: prior_wire prior_wire,neural_int
 # paths: wai/extensions/prior-carriage.md
+# independent: prior-forms live python3 -I live-conformance/prior_forms_verify.py live-conformance/prior-forms
 #
 # Tensor files as prior forms (extensions/prior-carriage.md §9 to §14): the module's unit
 # tests (each layout read strictly and written canonically, the arithmetic coder's integers
@@ -9,7 +10,8 @@
 # bindings through every form) and tests/prior_wire.rs (the committed corpus regenerates
 # byte for byte from its pinned native artifacts; §13 lists exactly the reference's codes;
 # every corpus prior in every form loads to its native bytes, and the two trained WSR1
-# priors give the same upscaled picture as their native files); then the corpus's second
+# priors give the same upscaled picture as their native files); and, in the step of every
+# independent verifier above, the corpus's second
 # implementation, prior_forms_verify.py, written from the extension's text and sharing no
 # code with wai-rs, which also requires every byte-flipped copy of an accepted file to be
 # caught; standard library only, run isolated (-I).
@@ -21,4 +23,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib -- prior_wire:: strict_json:: codecs::prior_form)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test prior_wire)
-python3 -I live-conformance/prior_forms_verify.py live-conformance/prior-forms
diff --git a/.github/wai-conformance/verifiers/qoe-aggregation.sh b/.github/wai-conformance/verifiers/qoe-aggregation.sh
index 45fd777a0..ce5e16585 100644
--- a/.github/wai-conformance/verifiers/qoe-aggregation.sh
+++ b/.github/wai-conformance/verifiers/qoe-aggregation.sh
@@ -2,6 +2,7 @@
 # order: 600
 # features: telemetry_aggregate
 # paths: wai/extensions/telemetry-aggregation.md
+# independent: telemetry-aggregate live python3 -I live-conformance/telemetry_aggregate_verify.py live-conformance/aggregate
 #
 # wai.telemetry.aggregate (extensions/telemetry-aggregation.md): the reference module's unit
 # tests (the fields against a wide-arithmetic-free product, the generators' orders,
@@ -11,7 +12,8 @@
 # no other file is there, vdaf-22/ is the draft's test vectors as published and wai-rs passes
 # every one, every receipt, cell and delivery-only report gets its stated outcome, every
 # reason of §11 and every reused code refuses a vector, §11 lists exactly the reference's
-# codes, delivery-telemetry §3.4 classes exactly the reference's keys); then the corpus's
+# codes, delivery-telemetry §3.4 classes exactly the reference's keys); and, in the step of
+# every independent verifier above, the corpus's
 # second implementation, telemetry_aggregate_verify.py, written from the extension's text and
 # the drafts it cites and sharing no code with wai-rs, which evaluates Prio3 itself and passes
 # the draft's vectors, opens every report with its own X25519, HKDF, AES-128-GCM and HPKE,
@@ -29,4 +31,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib -- telemetry_aggregate:: telemetry::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test telemetry_aggregate)
-python3 -I live-conformance/telemetry_aggregate_verify.py live-conformance/aggregate
diff --git a/.github/wai-conformance/verifiers/quantum-referee.sh b/.github/wai-conformance/verifiers/quantum-referee.sh
index 8b4f6e191..92d2c5fda 100644
--- a/.github/wai-conformance/verifiers/quantum-referee.sh
+++ b/.github/wai-conformance/verifiers/quantum-referee.sh
@@ -1,6 +1,6 @@
 # step: quantum referee.py
 # order: 700
-# working-directory: .
+# independent: quantum media python3 -I quantum-conformance/tools/referee.py quantum-conformance
 #
 # The quantum corpus's second implementation (quantum-sim extension), integers only:
 # it derives the circuit/1 phase table by its recurrence and the circuit2 table by an
@@ -12,4 +12,3 @@
 # to see every ±1 change of every P(k) under both tables. Standard library only, run
 # isolated (-I), so no module from the working directory, the environment or the
 # user's site-packages is imported.
-python3 -I wai/quantum-conformance/tools/referee.py wai/quantum-conformance
diff --git a/.github/wai-conformance/verifiers/receipt-ledger.sh b/.github/wai-conformance/verifiers/receipt-ledger.sh
index 350e8cfd6..36bc87f46 100644
--- a/.github/wai-conformance/verifiers/receipt-ledger.sh
+++ b/.github/wai-conformance/verifiers/receipt-ledger.sh
@@ -2,6 +2,7 @@
 # order: 400
 # features: receipt_ledger
 # paths: wai/extensions/receipt-ledger.md
+# independent: receipt-ledger live needs=cryptography python3 -I live-conformance/receipt_ledger_verify.py live-conformance/ledger
 #
 # wai.delivery.ledger (extensions/receipt-ledger.md): the reference module's unit tests and
 # tests/receipt_ledger.rs (vectors.json regenerates byte for byte from its fixed seeds and
@@ -10,9 +11,9 @@
 # stated outcome; every reason of §10 and every reused code refuses a vector, and so does
 # each source kind's own extension; §10 lists exactly the reference's codes; under a tariff
 # of version 3, jobs priced per operation and a chain that bills a job's work once, its
-# output's receipt cited again by a re-run, with version 2 billing as before); then the
-# corpus's second implementation, receipt_ledger_verify.py, written from the extension's
-# text and sharing no code with wai-rs, which verifies each source with that corpus's own
+# output's receipt cited again by a re-run, with version 2 billing as before); and, in the step of every
+# independent verifier above, the corpus's second implementation, receipt_ledger_verify.py, written from the
+# extension's text and sharing no code with wai-rs, which verifies each source with that corpus's own
 # second implementation (live_metering_verify.py, settlement_verify.py, live_ads_verify.py
 # with ad_presentation_verify.py, stitched_presentation_verify.py, pack_verify.py, and for a
 # media job route_record_verify.py and _int_motion_receipt.py) and
@@ -31,4 +32,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib receipt_ledger::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test receipt_ledger)
-python3 -I live-conformance/receipt_ledger_verify.py live-conformance/ledger
diff --git a/.github/wai-conformance/verifiers/remote-desktop.sh b/.github/wai-conformance/verifiers/remote-desktop.sh
index 92d7a5848..dd0bc887e 100644
--- a/.github/wai-conformance/verifiers/remote-desktop.sh
+++ b/.github/wai-conformance/verifiers/remote-desktop.sh
@@ -2,6 +2,7 @@
 # order: 590
 # features: remote_desktop
 # paths: wai/extensions/remote-desktop.md
+# independent: remote-desktop live python3 -I live-conformance/remote_desktop_verify.py live-conformance/remote
 #
 # wai.live.remote (extensions/remote-desktop.md): the reference module's unit tests (every
 # statement read back and refused when a byte is short or over, the screen statement's
@@ -13,7 +14,8 @@
 # wai-rs gives every room its stated outcome at the commitment level and at the opened
 # level, and §12 lists exactly the reference's codes, host refusals, floor refusals and
 # the reasons a seal is not opened, each of which the corpus gives);
-# then the corpus's second implementation, remote_desktop_verify.py, written from the
+# and, in the step of every independent verifier above, the corpus's second implementation,
+# remote_desktop_verify.py, written from the
 # extension's text and sharing no code with wai-rs, which verifies each room with
 # live_rooms_verify.py, every signature with WAI's strict Ed25519 rule and every seal with
 # the aggregation verifier's HPKE, recomputes every outcome from the rules, the floor and
@@ -31,5 +33,4 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib -- remote_desktop:: hpke::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test remote_desktop)
-python3 -I live-conformance/remote_desktop_verify.py live-conformance/remote
 node --test ../joule-code/joule-code-rs/crates/joule-moq-web/web/room/remote.test.mjs
diff --git a/.github/wai-conformance/verifiers/revenue-share.sh b/.github/wai-conformance/verifiers/revenue-share.sh
index 8cbbf1390..2c0a5ea0d 100644
--- a/.github/wai-conformance/verifiers/revenue-share.sh
+++ b/.github/wai-conformance/verifiers/revenue-share.sh
@@ -2,6 +2,7 @@
 # order: 410
 # features: revenue_share
 # paths: wai/extensions/revenue-share.md
+# independent: revenue-share live needs=cryptography python3 -I live-conformance/revenue_share_verify.py live-conformance/share
 #
 # wai.delivery.revenue_share (extensions/revenue-share.md): the reference module's unit tests
 # (the largest-remainder division and its ties, the date-time a marker states, the contract's
@@ -10,7 +11,8 @@
 # seeds and the ledger corpus, and no other file is there; wai-rs gives every vector its
 # stated outcome; every reason of §11 and every reused code refuses a vector; §11 lists exactly
 # the reference's codes; the worked example, three statements of one month computed and then
-# recomputed from the public records alone; the four operations from the command line); then
+# recomputed from the public records alone; the four operations from the command line); and, in
+# the step of every independent verifier above,
 # the corpus's second implementation, revenue_share_verify.py, written from the extension's
 # text and sharing no code with wai-rs, which verifies each ledger document with
 # receipt_ledger_verify.py, reads every contract, run, marker and statement itself,
@@ -27,4 +29,3 @@ set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib revenue_share::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib wai_video_channel::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test revenue_share)
-python3 -I live-conformance/revenue_share_verify.py live-conformance/share
diff --git a/.github/wai-conformance/verifiers/robustness.sh b/.github/wai-conformance/verifiers/robustness.sh
index ade4fc600..7fce2e5ca 100644
--- a/.github/wai-conformance/verifiers/robustness.sh
+++ b/.github/wai-conformance/verifiers/robustness.sh
@@ -3,6 +3,7 @@
 # features: robustness
 # release-features: robustness
 # paths: wai/extensions/robustness-evidence.md
+# independent: robustness live python3 -I live-conformance/robustness_verify.py live-conformance/robustness
 #
 # Robustness evidence for soft bindings (extensions/robustness-evidence.md): the
 # reference's unit tests (gamma is the rounded power, rates are exact and reduced, every
@@ -13,7 +14,8 @@
 # is there; every case gets what it states; §12 lists exactly the reference's codes and
 # the corpus refuses a case for each; §4 registers exactly the reference's transforms;
 # the tent64 records' tables are the synthesis corpus's battery.json; the tent64 claim is
-# synthesis §7.5.8's list; jwp-receipts §3.1 lists the span reasons); then the second
+# synthesis §7.5.8's list; jwp-receipts §3.1 lists the span reasons); and, in the step of
+# every independent verifier above, the second
 # implementation, robustness_verify.py with _wai_mark.py, written from the extension's
 # text and sharing no code with wai-rs, which reruns the conformance record's battery end
 # to end and requires the same table, checks the tent64 records against battery.json and
@@ -27,4 +29,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib robustness::)
 (cd wai-rs && cargo test --release --no-default-features --features "$WAI_RELEASE_FEATURES" --test robustness)
-python3 -I live-conformance/robustness_verify.py live-conformance/robustness
diff --git a/.github/wai-conformance/verifiers/route-record.sh b/.github/wai-conformance/verifiers/route-record.sh
index 42e744451..f3d623c11 100644
--- a/.github/wai-conformance/verifiers/route-record.sh
+++ b/.github/wai-conformance/verifiers/route-record.sh
@@ -2,6 +2,7 @@
 # order: 450
 # features: route_record
 # paths: wai/extensions/route-record.md
+# independent: route-record live needs=cryptography python3 -I live-conformance/route_record_verify.py live-conformance/routes
 #
 # wai.route.record (extensions/route-record.md): the reference module's unit tests (a
 # document read strictly and held to the subset, §2's encodings, an estimate past the subset
@@ -11,7 +12,8 @@
 # file is there; wai-rs gives every vector its stated outcome; every reason of §8 and every
 # reused code refuses a vector; the accepted vectors are §10's, of version 1 and of version 2,
 # every limit removing a candidate; a record is bound to each of its documents; `wai route
-# verify` prints the outcome and exits by it); then the corpus's second implementation,
+# verify` prints the outcome and exits by it); and, in the step of every independent verifier
+# above, the corpus's second implementation,
 # route_record_verify.py, written from the extension's text and sharing no code with wai-rs,
 # which checks the router's signature with WAI's strict Ed25519 rule and the hop receipts
 # with the OER/2 reference verifier (the `cryptography` package, installed above), computes
@@ -27,4 +29,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib route_record::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test route_record)
-python3 -I live-conformance/route_record_verify.py live-conformance/routes
diff --git a/.github/wai-conformance/verifiers/scene-carriage.sh b/.github/wai-conformance/verifiers/scene-carriage.sh
index b76097fc4..aaafd529a 100644
--- a/.github/wai-conformance/verifiers/scene-carriage.sh
+++ b/.github/wai-conformance/verifiers/scene-carriage.sh
@@ -2,13 +2,15 @@
 # order: 340
 # features: scene_map
 # paths: wai/extensions/scene-carriage.md
+# independent: scene live python3 -I live-conformance/scene_verify.py live-conformance/scene
 #
 # Scene carriage (extensions/scene-carriage.md): the module's unit tests (the conversions
 # and spellings of §3 against fixed values, the containers an import builds equal to the
 # ones wai-rs's world and audio-scene modules write, base64 and the USD subset's reader)
 # and tests/scene_map.rs (the committed corpus regenerates byte for byte: every bundle
 # written as glTF and USD and read back, every refusal reached; §8 lists exactly the
-# reference's codes); then the corpus's second implementation, scene_verify.py, written
+# reference's codes); and, in the step of every independent verifier above, the corpus's
+# second implementation, scene_verify.py, written
 # from the extension's text and sharing no code with wai-rs, which also requires every
 # byte-flipped copy of an exported document to be caught; standard library only, run
 # isolated (-I).
@@ -20,4 +22,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib -- scene_map:: strict_json::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test scene_map)
-python3 -I live-conformance/scene_verify.py live-conformance/scene
diff --git a/.github/wai-conformance/verifiers/settlement.sh b/.github/wai-conformance/verifiers/settlement.sh
index 5aae0dd73..6da82a88c 100644
--- a/.github/wai-conformance/verifiers/settlement.sh
+++ b/.github/wai-conformance/verifiers/settlement.sh
@@ -2,6 +2,7 @@
 # order: 390
 # features: settlement
 # paths: wai/extensions/settlement.md
+# independent: settlement live python3 -I live-conformance/settlement_verify.py live-conformance/settlement
 #
 # wai.delivery.settlement (extensions/settlement.md): the reference module's unit tests
 # (range proofs over every range around every chunk boundary of objects of many lengths
@@ -10,7 +11,8 @@
 # tests/settlement.rs (vectors.json regenerates byte for byte from its fixed seeds and no
 # other file is there, wai-rs gives every statement and range proof its stated outcome, §11
 # lists exactly the reference's codes, each of which the corpus gives, beside every code it
-# reuses); then the corpus's second implementation, settlement_verify.py, written from the
+# reuses); and, in the step of every independent verifier above, the corpus's second
+# implementation, settlement_verify.py, written from the
 # extension's text and sharing no code with wai-rs, which verifies range proofs over
 # BLAKE3's chunk tree with claim-conformance's BLAKE3, reads rooms, grants and proofs with
 # live_rooms_verify.py and per-hop records with live_metering_verify.py, checks signatures
@@ -26,4 +28,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib settlement::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test settlement)
-python3 -I live-conformance/settlement_verify.py live-conformance/settlement
diff --git a/.github/wai-conformance/verifiers/sink-energy.sh b/.github/wai-conformance/verifiers/sink-energy.sh
index a1292164a..36c9228e4 100644
--- a/.github/wai-conformance/verifiers/sink-energy.sh
+++ b/.github/wai-conformance/verifiers/sink-energy.sh
@@ -2,6 +2,7 @@
 # order: 200
 # features: sink_energy
 # paths: wai/extensions/sink-energy.md
+# independent: sink-energy live python3 -I live-conformance/sink_energy_verify.py live-conformance/sink-energy
 #
 # wai.sink.energy (extensions/sink-energy.md): the reference module's unit tests (a
 # bracket summary is its intervals in integers, a round's figure and least declaration
@@ -13,7 +14,8 @@
 # the wrap; on macOS, the per-process counter reads this process) and
 # tests/sink_energy.rs (the committed corpus regenerates byte for byte from its fixed
 # seeds, every case gets its stated outcome, every reason of §8 refuses a case, and every
-# measured table under tables/ is accepted with its readings and procedure); then the
+# measured table under tables/ is accepted with its readings and procedure); and, in the
+# step of every independent verifier above, the
 # corpus's second implementation, sink_energy_verify.py, written from the extension's text
 # and sharing no code with wai-rs, which recomputes every round, row, segment and split in
 # integers and requires every mutated copy of the corpus to fail; standard library only,
@@ -28,4 +30,3 @@ set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib sink_meter::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test sink_energy)
 (cd wai-rs && "$RUNNER_TEMP/wai-bins/union/wai_sink_energy_vectors" verify ../live-conformance/sink-energy)
-python3 -I live-conformance/sink_energy_verify.py live-conformance/sink-energy
diff --git a/.github/wai-conformance/verifiers/staged-measure.sh b/.github/wai-conformance/verifiers/staged-measure.sh
index 940eebb65..b22ae20c4 100644
--- a/.github/wai-conformance/verifiers/staged-measure.sh
+++ b/.github/wai-conformance/verifiers/staged-measure.sh
@@ -1,9 +1,9 @@
 # step: measure_verify.py
 # order: 70
+# independent: staged-measure delivery python3 staged-measure-conformance/measure_verify.py staged-measure-conformance
 #
 # The staged-measurement corpus's second implementation (staged-measure-conformance/README):
 # it counts every object, applies every layer from its base's stage 0, computes the quality
 # integers, the output tree, the prefixes, the overhead points and the dedup totals itself,
 # and requires its decode to be the fixture tool's and its figures to be goldens.json's.
 # Standard library only.
-python3 staged-measure-conformance/measure_verify.py staged-measure-conformance
diff --git a/.github/wai-conformance/verifiers/staged.sh b/.github/wai-conformance/verifiers/staged.sh
index e3ca85ae5..35db5c19b 100644
--- a/.github/wai-conformance/verifiers/staged.sh
+++ b/.github/wai-conformance/verifiers/staged.sh
@@ -1,9 +1,9 @@
 # step: staged_verify.py
 # order: 40
+# independent: staged delivery python3 staged-conformance/staged_verify.py staged-conformance
 #
 # The staged-delivery corpus's second implementation (staged-conformance/README): it
 # replays every case from its stage-0 buffers through its own reading of the
 # extension (refines, WIR1, the sink's steps, holds, batches, conflicts, deadlines,
 # tiers, stage hashes), decodes the WIV1 keyframe-0, PNG and FLAC bases, explodes the
 # WAI2 files, and replays the schedule. Standard library only.
-python3 staged-conformance/staged_verify.py staged-conformance
diff --git a/.github/wai-conformance/verifiers/stitched-presentation.sh b/.github/wai-conformance/verifiers/stitched-presentation.sh
index be1282255..2d68d987a 100644
--- a/.github/wai-conformance/verifiers/stitched-presentation.sh
+++ b/.github/wai-conformance/verifiers/stitched-presentation.sh
@@ -2,6 +2,7 @@
 # order: 260
 # features: stitched_presentation
 # paths: wai/extensions/stitched-presentation.md
+# independent: stitched-presentation live python3 -I live-conformance/stitched_presentation_verify.py live-conformance/stitched
 #
 # wai.video.stitched_presentation (extensions/stitched-presentation.md): the reference
 # module's unit tests (claims and pod-input records round-trip and their rules refuse,
@@ -11,7 +12,8 @@
 # regenerates byte for byte from its fixed seeds and no other file is there, wai-rs gives
 # every record, claim and ad its stated facts and every vector its spend by currency, and
 # §9 lists exactly the codes the reference adds); then the tool's own check of the corpus
-# through its binary; then the corpus's second implementation,
+# through its binary; and, in the step of every independent verifier above, the corpus's
+# second implementation,
 # stitched_presentation_verify.py, written from the extension's text and sharing no code
 # with wai-rs, which reads every playlist, asset list, MPD, VAST document, form-1 receipt,
 # record and claim itself, requires every mutated copy of the corpus to fail and catches
@@ -29,5 +31,4 @@ set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib live_compose::layout::frame_tests)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test stitched_presentation)
 (cd wai-rs && "$RUNNER_TEMP/wai-bins/union/wai_stitched_presentation" vectors verify ../live-conformance/stitched)
-python3 -I live-conformance/stitched_presentation_verify.py live-conformance/stitched
 node --test ../joule-code/joule-code-rs/crates/joule-moq-web/web/ads/stitched.test.mjs
diff --git a/.github/wai-conformance/verifiers/stream-audit.sh b/.github/wai-conformance/verifiers/stream-audit.sh
index e02577c28..f1442afed 100644
--- a/.github/wai-conformance/verifiers/stream-audit.sh
+++ b/.github/wai-conformance/verifiers/stream-audit.sh
@@ -2,13 +2,15 @@
 # order: 430
 # features: stream_audit
 # paths: wai/extensions/stream-audit.md
+# independent: stream-audit live python3 -I live-conformance/stream_audit_verify.py live-conformance/audit
 #
 # wai.delivery.audit (extensions/stream-audit.md): the reference module's unit tests (the
 # acknowledgement windows, chains and repeats of §4.2, the origin rule, the report's bytes,
 # channel names) and tests/stream_audit.rs (vectors.json regenerates byte for byte from its
 # fixed seeds and no other file is there, wai-rs gives every session and report its stated
 # outcome, §14 lists exactly the reference's codes, each of which the corpus gives, beside
-# every code it borrows); then the corpus's second implementation, stream_audit_verify.py,
+# every code it borrows); and, in the step of every independent verifier above, the corpus's
+# second implementation, stream_audit_verify.py,
 # written from the extension's text and sharing no code with wai-rs, which reads
 # acknowledgements with settlement_verify.py, claims with ad_presentation_verify.py and logs
 # and energy classes with live_metering_verify.py, checks every signature with WAI's strict
@@ -24,4 +26,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib stream_audit::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test stream_audit)
-python3 -I live-conformance/stream_audit_verify.py live-conformance/audit
diff --git a/.github/wai-conformance/verifiers/stream-termination.sh b/.github/wai-conformance/verifiers/stream-termination.sh
index 552dfbfbc..48997a90f 100644
--- a/.github/wai-conformance/verifiers/stream-termination.sh
+++ b/.github/wai-conformance/verifiers/stream-termination.sh
@@ -2,6 +2,7 @@
 # order: 630
 # features: stream_termination
 # paths: wai/extensions/stream-termination.md
+# independent: stream-termination live python3 -I live-conformance/stream_termination_verify.py live-conformance/termination
 #
 # wai.live.termination (extensions/stream-termination.md) and the display match of
 # capability-constraints §4: the reference module's unit tests (sides without orientation,
@@ -10,7 +11,8 @@
 # regenerates byte for byte from its fixed seeds, wai-rs gives every match and log its
 # stated outcome and facts, every reason refuses a log, §7 lists exactly the reference's
 # codes and capability-constraints §4.2 its match bits); wai-live-web's functions for a
-# page held to the same corpus natively, a page's log written through them verified; then
+# page held to the same corpus natively, a page's log written through them verified; and,
+# in the step of every independent verifier above,
 # the corpus's second implementation, stream_termination_verify.py, written from the two
 # extensions' text and sharing no code with wai-rs, which recomputes every match and every
 # log's outcome and facts and requires every mutated copy of the corpus to fail; standard
@@ -27,4 +29,3 @@ set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test stream_termination)
 (cd wai-rs && "$RUNNER_TEMP/wai-bins/union/wai_stream_termination_vectors" verify ../live-conformance/termination)
 (cd wai-live-web && cargo test --locked --features int_video --lib termination_tests)
-python3 -I live-conformance/stream_termination_verify.py live-conformance/termination
diff --git a/.github/wai-conformance/verifiers/synthesis-mark.sh b/.github/wai-conformance/verifiers/synthesis-mark.sh
index b86f5ebfd..e75378093 100644
--- a/.github/wai-conformance/verifiers/synthesis-mark.sh
+++ b/.github/wai-conformance/verifiers/synthesis-mark.sh
@@ -3,6 +3,7 @@
 # features: synthesis_mark
 # release-features: synthesis_mark
 # paths: wai/extensions/synthesis.md
+# independent: synthesis-mark live python3 -I live-conformance/synthesis_mark_verify.py live-conformance/synthesis-mark
 #
 # The registered watermark schemes wai-mark:tent64 and wai-mark:tent64s
 # (extensions/synthesis.md §7.4 to §7.9): the reference's unit tests (the code corrects 29
@@ -15,7 +16,8 @@
 # every embedding, detection and case gets what it states; the extension's definitions,
 # generator polynomial and shuffles are the reference's; §7.5.8 and §7.9.7 claim only
 # attacks the measurements show survived, and §7.5.6's and §7.9.5's figures are the
-# measurements'); then the second implementation, synthesis_mark_verify.py with
+# measurements'); and, in the step of every independent verifier above, the second
+# implementation, synthesis_mark_verify.py with
 # _wai_mark.py, written from the extension's text and sharing no code with wai-rs, which
 # embeds, detects and decodes itself, both stages of the tiled detector among them, runs
 # the battery's picture attacks, derives the frames the vectors name, verifies every case
@@ -31,4 +33,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib -- synthesis::mark synthesis_mark::)
 (cd wai-rs && cargo test --release --no-default-features --features "$WAI_RELEASE_FEATURES" --test synthesis_mark)
-python3 -I live-conformance/synthesis_mark_verify.py live-conformance/synthesis-mark
diff --git a/.github/wai-conformance/verifiers/synthesis.sh b/.github/wai-conformance/verifiers/synthesis.sh
index d9ff64b87..ac571b149 100644
--- a/.github/wai-conformance/verifiers/synthesis.sh
+++ b/.github/wai-conformance/verifiers/synthesis.sh
@@ -2,13 +2,15 @@
 # order: 290
 # features: synthesis
 # paths: wai/extensions/synthesis.md
+# independent: synthesis live python3 -I live-conformance/synthesis_verify.py live-conformance/synthesis
 #
 # wai.media.synthesis (extensions/synthesis.md): the reference module's unit tests (the
 # pinned derivations by their rules, the class lattice, a generator's envelope) and
 # tests/synthesis.rs (the committed corpus regenerates byte for byte from its fixed seeds
 # and no other file is there, wai-rs gives every case its stated outcome and statements,
 # §12 lists exactly the reference's codes, each of which the corpus gives, and §10.2's
-# table pins exactly the reference's icons); then the corpus's second implementation,
+# table pins exactly the reference's icons); and, in the step of every independent
+# verifier above, the corpus's second implementation,
 # synthesis_verify.py, written from the extension's text and sharing no code with wai-rs,
 # which runs the pinned derivations and writes each digital source type and C2PA
 # statement itself, verifies each room with live_rooms_verify.py and every record with
@@ -25,4 +27,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib synthesis::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test synthesis)
-python3 -I live-conformance/synthesis_verify.py live-conformance/synthesis
diff --git a/.github/wai-conformance/verifiers/takedown.sh b/.github/wai-conformance/verifiers/takedown.sh
index b35cf1888..f980f1d0e 100644
--- a/.github/wai-conformance/verifiers/takedown.sh
+++ b/.github/wai-conformance/verifiers/takedown.sh
@@ -2,6 +2,7 @@
 # order: 480
 # features: takedown
 # paths: wai/extensions/takedown.md
+# independent: takedown live python3 -I live-conformance/takedown_verify.py live-conformance/takedown
 #
 # wai.media.takedown (extensions/takedown.md): the reference module's unit tests (times,
 # clock identifiers, the published registry, the order of subjects, the lower median) and
@@ -9,7 +10,8 @@
 # and no other file is there, wai-rs gives every case its stated outcome and facts and
 # every counts entry its rows, §11 lists exactly the reference's codes, each of which the
 # corpus gives, and the registry the module carries is registry/takedown-clocks.json);
-# then the corpus's second implementation, takedown_verify.py, written from the
+# and, in the step of every independent verifier above, the corpus's second
+# implementation, takedown_verify.py, written from the
 # extension's text and sharing no code with wai-rs, which computes every closure, holder,
 # purge time, clock verdict and counts row itself, reads derivation records and delivery
 # receipts with edge_verify.py, origin claims with synthesis_verify.py, acknowledgements
@@ -27,4 +29,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib takedown::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test takedown)
-python3 -I live-conformance/takedown_verify.py live-conformance/takedown
diff --git a/.github/wai-conformance/verifiers/timed-text.sh b/.github/wai-conformance/verifiers/timed-text.sh
index 907ddfc7b..da9514af3 100644
--- a/.github/wai-conformance/verifiers/timed-text.sh
+++ b/.github/wai-conformance/verifiers/timed-text.sh
@@ -2,6 +2,7 @@
 # order: 150
 # features: timed_text
 # paths: wai/extensions/timed-text.md
+# independent: timed-text live python3 -I live-conformance/timed_text_verify.py live-conformance/captions
 #
 # wai.text.timed (extensions/timed-text.md): the reference module's unit tests (cue model,
 # annotation, WebVTT, IMSC1 and its render-model bound, timelines, disclosure, and the
@@ -9,7 +10,8 @@
 # vectors.json and each expected .vtt, .ttml and .608.hex, regenerates byte for byte
 # from its fixed seeds and no other file is there, wai-rs gives every case its stated
 # outcome, the corpus covers every 608 code path, and §12 lists exactly the reference's
-# codes); then the corpus's second implementation, timed_text_verify.py, written from
+# codes); and, in the step of every independent verifier above, the corpus's second
+# implementation, timed_text_verify.py, written from
 # the extension's text and sharing no code with wai-rs, which verifies every event with
 # live_events_verify.py, writes every output byte for byte from the text, parses each
 # IMSC1 document with xml.etree, and requires every mutated copy of the corpus to fail;
@@ -21,4 +23,3 @@
 set -euo pipefail
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib timed_text::)
 (cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test timed_text)
-python3 -I live-conformance/timed_text_verify.py live-conformance/captions
diff --git a/.github/workflows/repo-checks.yml b/.github/workflows/repo-checks.yml
index 7df9bf358..680aaeb6b 100644
--- a/.github/workflows/repo-checks.yml
+++ b/.github/workflows/repo-checks.yml
@@ -100,6 +100,16 @@ jobs:
       - name: "workflow hygiene: every wasmtime is the pinned release, run with both determinism settings"
         if: ${{ !cancelled() }}
         run: python3 -I scripts/check-wasmtime-pin.py
+      # ── The release runs the quickstart from each archive it attaches ───────
+      # wai-release.yml runs only on a tag, so a change that stops it running the
+      # quickstart, or lets it fail, would first be seen at a release. This reads the
+      # workflow and the two scripts on every change, for the cost of a few lines of text.
+      - name: "release quickstart: the check fails closed (self-test)"
+        if: ${{ !cancelled() }}
+        run: bash scripts/check-wai-release-quickstart-selftest.sh
+      - name: "release quickstart: each archive runs it before it is attached, and the twin keeps its steps"
+        if: ${{ !cancelled() }}
+        run: python3 -I scripts/check-wai-release-quickstart.py
 
       # ── Code cites no section its SPEC lacks; WAI's cited sections exist ────
       - name: "spec references: the check can fail (self-test)"
diff --git a/.github/workflows/wai-breaking.yml b/.github/workflows/wai-breaking.yml
index 09e419be0..9c1bd12e8 100644
--- a/.github/workflows/wai-breaking.yml
+++ b/.github/workflows/wai-breaking.yml
@@ -13,11 +13,14 @@ name: WAI breaking changes and the conformance runner
 #   changelog entry names it) and of `wai conform` (the reference implementations conform, a
 #   changed verdict or output byte fails, a changed record is refused by `wai verify`, and
 #   `wai verify --conformant` admits a passing run of the native sink and refuses a planted
-#   failing one); then `wai conform` runs the corpora's independent Python verifiers and the
-#   reference packager, and `wai verify` checks every record those runs wrote; and it runs the
-#   native sink, through its module and its C interface, and the score decoder, each record
-#   admitted against this checkout's corpus and a planted failing sink refused
-#   (conformance-results §4.1).
+#   failing one; the JUnit and HTML reports are the records'; `--independent` holds the
+#   corpus's independent verifier to the same cases and fails on a disagreement, and alone
+#   runs the verifiers it names); then `wai conform` runs the corpora's independent Python
+#   verifiers and the reference packager, and `wai verify` checks every record those runs
+#   wrote; and it runs the native sink, through its module and its C interface, and the score
+#   decoder, each record admitted against this checkout's corpus and a planted failing sink
+#   refused (conformance-results §4.1). The corpus union itself, every independent verifier
+#   through `wai conform --independent`, runs in wai-conformance.yml.
 #
 # Push filters match the push's delta, and the `relevant` job gates the work from the pull
 # request's own diff (scripts/pr-touches-paths.py, reading the list below), as wai-pack.yml
@@ -36,6 +39,9 @@ on:
       # The toolchain pin decides which compiler documents both sides of the Rust API.
       - 'rust-toolchain.toml'
       - 'scripts/pr-touches-paths.py'
+      # wai-rs/build.rs reads `wai conform`'s table of independent verifiers from the step files
+      # of wai-conformance.yml, and the runner's tests below hold the table to them.
+      - '.github/wai-conformance/verifiers/**'
       - '.github/workflows/wai-breaking.yml'
 
 jobs:
diff --git a/.github/workflows/wai-conformance.yml b/.github/workflows/wai-conformance.yml
index 650393dfb..a48b39cb3 100644
--- a/.github/workflows/wai-conformance.yml
+++ b/.github/workflows/wai-conformance.yml
@@ -438,12 +438,16 @@ jobs:
       # outside its roots; WAI Studio at /_wai/, its API to this origin alone) and the project
       # file's reader. tests/cli_studio.rs: `wai dev` against a stand-in relay and room service
       # serves Studio at /_wai/, every socket the stack listens on is on loopback, and the
-      # local wai runs an operation for the page.
-      - name: The floor build, and wai hello, create, dev and verify
+      # local wai runs an operation for the page. tests/cli_doctor.rs: `wai doctor` with PATH,
+      # cargo's home and the install laid out by the test: this wai first holds, another
+      # program called wai first fails and is named (the crates.io package wai-cli's as that),
+      # and an install with nothing for `wai dev` to run fails; on each leg's own system, for
+      # the ports, browsers and keychain it reads.
+      - name: The floor build, and wai hello, create, dev, verify and doctor
         working-directory: wai/wai-rs
         run: |
           cargo test --no-default-features --features floor --test floor
-          cargo test --no-default-features --features quickstart --bin wai --test floor --test cli_dx --test cli_fleet --test cli_studio
+          cargo test --no-default-features --features quickstart --bin wai --test floor --test cli_dx --test cli_fleet --test cli_studio --test cli_doctor
       # tests/cli_http.rs runs `wai http publish`, `codecs`, `origin` and `bench` as a user
       # does: objects named by their content hash with their head proofs, a sequence's union
       # and floor, the origin's headers, ranges and If-Range on loopback, and a fetch by
@@ -586,14 +590,6 @@ jobs:
       - name: Every cargo-class corpus reproduces its frozen hashes
         working-directory: wai/wai-rs
         run: python3 ../../scripts/wai-conformance-lists.py corpora --verify --extra-features provenance,video_manifest
-      # The pin corpus's second implementation: Python standard library only, sharing no
-      # code with wai-rs. One leg is enough — it checks digests and listing rules, which
-      # do not depend on the architecture — and the macOS host has python3.
-      - name: The pin corpus checks against an independent verifier (macOS)
-        if: matrix.os == 'macos'
-        shell: bash
-        working-directory: wai
-        run: python3 pin-conformance/pin_verify.py pin-conformance
       # Every committed audio vector must come from a seeded generator. This check reads
       # each one to PCM (each audio base's stage 0 in the staged corpus, each measured
       # source over one, each spatial-audio source, every audio file under wai/) and
@@ -1038,8 +1034,45 @@ jobs:
           python3 ../../scripts/wai-conformance-lists.py prebuild > "$RUNNER_TEMP/wai-prebuild.sh"
           cat "$RUNNER_TEMP/wai-prebuild.sh"
           bash --noprofile --norc -eo pipefail "$RUNNER_TEMP/wai-prebuild.sh"
+      # The corpus union, one command: every corpus's independent verifier, its second
+      # implementation, written from the extension's text and sharing no code with wai-rs, run
+      # by `wai conform --independent` in wai/ with the command line its README gives. The list
+      # is the table `wai conform` holds (`wai conform --list` prints it), which build.rs reads
+      # from the `# independent:` lines of the step files below, so a corpus's verifier joins it
+      # in its own step's file; the table's tests require every *_verify.py of the tree to be in
+      # it or to say where it runs instead, and no step to run one of them by hand. What each
+      # verifier checks is in its corpus's README and its own header; those of the claim, JWP,
+      # key-discovery, HTTP, ledger, route and post-quantum corpora, and the ones that read
+      # them, check Ed25519's equation with the `cryptography` package installed above (without
+      # it their cases fail, never skip). Each run is a signed result record, which `wai verify`
+      # checks; the JUnit report goes with the records, and a failed verifier's output is in the
+      # log. `wai` is built with the feature quickstart into a target directory of its own, so
+      # the union's builds above stay as they are. The steps below are each corpus's Rust side.
+      - name: Every corpus's independent verifier, through wai conform --independent
+        working-directory: wai
+        shell: bash
+        run: |
+          set -euo pipefail
+          (cd wai-rs && cargo build --locked --no-default-features --features quickstart --bin wai --target-dir "$RUNNER_TEMP/wai-cli-target")
+          w="$RUNNER_TEMP/wai-cli-target/debug/wai"
+          d="$RUNNER_TEMP/independent"
+          mkdir -p "$d"
+          status=0
+          "$w" conform --independent --root . --out "$d/records" --format junit > "$d/junit.xml" || status=$?
+          "$w" verify "$d/records"
+          exit "$status"
+      # An upload this forge cannot take must not decide the job: the verdict is the step above.
+      - name: Upload the independent verifiers' records and report
+        if: always()
+        continue-on-error: true
+        uses: actions/upload-artifact@v3
+        with:
+          name: independent-verifiers
+          path: ${{ runner.temp }}/independent
+
       # Every step, in its order, each in a group of the log; the first that fails stops the
-      # job, as a failed step did, and is named in an error line with its file.
+      # job, as a failed step did, and is named in an error line with its file. A file that
+      # declares verifiers and runs nothing itself (no body) is no step: the union ran them.
       - name: Every verifier step (.github/wai-conformance/verifiers/)
         shell: bash
         run: python3 scripts/wai-conformance-lists.py run
diff --git a/.github/workflows/wai-release.yml b/.github/workflows/wai-release.yml
index 85adabe29..a5975fcad 100644
--- a/.github/workflows/wai-release.yml
+++ b/.github/workflows/wai-release.yml
@@ -12,10 +12,19 @@ name: wai command line release
 # The first job checks the tag against the crate's version and the installer's, and that each
 # project file schema (wai/schema/) is served at its $id as committed: every project file the
 # release writes names its schema there, so a tag does not build until the site serves it.
-# Each archive's own `wai` runs before it is attached (create --list, hello, verify, and on
-# the hosts that run it, dev --check). A last job writes the Homebrew formula and the Scoop
-# manifest for the archives attached and attaches them too; they go into the tap and the bucket
-# by hand.
+# Before it is attached, each archive runs the quickstart as a new user runs it, from the
+# archive alone on a fresh home directory and a PATH of the system's own directories
+# (wai/quickstart/test/clean-machine.sh; on Windows its PowerShell twin, clean-machine.ps1):
+# the archive checked against its SHA-256 and unpacked, then wai hello, wai verify,
+# wai create my-room --template video-room and wai dev --check in the project; and on the
+# Apple-silicon Mac, the project's page joined in two browser pages, each decoding the other.
+# clean-machine.sh also checks what the archive holds (every binary, each of which runs, the
+# room client and WAI Studio) and that wai dev --check serves Studio at /_wai/; on Windows the
+# packaging step runs wai create --list and wai-quantum --version from the staged archive.
+# A cross-built archive, whose binaries this host cannot run, is not run. The Windows leg has
+# not run yet: its runner is down, so no Windows archive has been through clean-machine.ps1.
+# A last job writes the Homebrew formula and the Scoop manifest for the archives attached and
+# attaches them too; they go into the tap and the bucket by hand.
 #
 # Uploads go to the forge directly over the private network (FORGE_API), never through the
 # public tunnel. A runner that is down leaves its platform's archive missing: the release lists
@@ -115,9 +124,12 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
+        # `browser`: whether the host has the browser and the automation package the
+        # quickstart's two-page step drives (the Apple-silicon runner does, as wai-examples.yml
+        # uses them; the Intel Mac is not set up for it).
         include:
-          - { triple: aarch64-apple-darwin, runner: macos }
-          - { triple: x86_64-apple-darwin, runner: macos-x86_64 }
+          - { triple: aarch64-apple-darwin, runner: macos, browser: true }
+          - { triple: x86_64-apple-darwin, runner: macos-x86_64, browser: false }
     steps:
       - uses: actions/checkout@v5
       - name: Put cargo on PATH
@@ -132,11 +144,27 @@ jobs:
           curl -fsS -o "$RUNNER_TEMP/web.tar.gz" "${FORGE_API%/api/v1}/$FORGE_REPO/releases/download/$GITHUB_REF_NAME/wai-web-$v.tar.gz"
           tar -C "$RUNNER_TEMP" -xzf "$RUNNER_TEMP/web.tar.gz"
           nice -n 10 bash wai/quickstart/build.sh "$RUNNER_TEMP/dist" --web "$RUNNER_TEMP/web" --studio "$RUNNER_TEMP/studio" --target "${{ matrix.triple }}" --version "$v"
-          if [ "${{ matrix.triple }}" = "$(rustc -vV | sed -n 's/^host: //p')" ]; then
-            t="$RUNNER_TEMP/try"; mkdir -p "$t"; tar -C "$t" -xzf "$RUNNER_TEMP/dist/wai-$v-${{ matrix.triple }}.tar.gz"
-            b="$t/wai-$v-${{ matrix.triple }}/bin"
-            (cd "$t" && "$b/wai" hello h >/dev/null && "$b/wai" verify h >/dev/null && mkdir p && cd p && "$b/wai" dev --check --port 0)
+      - name: The quickstart from the archive, as a new user runs it
+        shell: bash
+        env:
+          BROWSER_BIN: /Applications/Google Chrome.app/Contents/MacOS/Google Chrome  # allow-name: the macOS runner's browser executable, a file path
+        run: |
+          set -euo pipefail
+          v="${{ needs.version.outputs.version }}"
+          if [ "${{ matrix.triple }}" != "$(rustc -vV | sed -n 's/^host: //p')" ]; then
+            echo "cross-built for ${{ matrix.triple }}: this host cannot run it"
+            exit 0
           fi
+          flag=""
+          if [ "${{ matrix.browser }}" = true ]; then
+            test -x "$BROWSER_BIN" || { echo "::error::this runner has no browser at $BROWSER_BIN"; exit 1; }
+            pw="$RUNNER_TEMP/automation"; mkdir -p "$pw"
+            cp wai/quickstart/test/package.json wai/quickstart/test/package-lock.json "$pw/"
+            (cd "$pw" && npm ci --ignore-scripts --no-audit --no-fund > /dev/null)
+            export PLAYWRIGHT_HOST="$pw/node_modules"
+            flag=--browser
+          fi
+          bash wai/quickstart/test/clean-machine.sh "$RUNNER_TEMP/dist/wai-$v-${{ matrix.triple }}.tar.gz" $flag
       - name: Attach to the release
         shell: bash
         env:
@@ -184,9 +212,9 @@ jobs:
           curl -fsS -o "$RUNNER_TEMP/web.tar.gz" "${FORGE_API%/api/v1}/$FORGE_REPO/releases/download/$GITHUB_REF_NAME/wai-web-$v.tar.gz"
           tar -C "$RUNNER_TEMP" -xzf "$RUNNER_TEMP/web.tar.gz"
           bash wai/quickstart/build.sh "$RUNNER_TEMP/dist" --web "$RUNNER_TEMP/web" --studio "$RUNNER_TEMP/studio" --target "$t" --version "$v"
-          d="$RUNNER_TEMP/try"; mkdir -p "$d"; tar -C "$d" -xzf "$RUNNER_TEMP/dist/wai-$v-$t.tar.gz"
-          b="$d/wai-$v-$t/bin"
-          (cd "$d" && "$b/wai" hello h >/dev/null && "$b/wai" verify h >/dev/null && mkdir p && cd p && "$b/wai" dev --check --port 0)
+      - name: The quickstart from the archive, as a new user runs it
+        shell: bash
+        run: bash wai/quickstart/test/clean-machine.sh "$RUNNER_TEMP/dist/wai-${{ needs.version.outputs.version }}-${{ matrix.triple }}.tar.gz"
       - name: Attach to the release
         shell: bash
         env:
@@ -244,6 +272,16 @@ jobs:
           Compress-Archive -Path $stage -DestinationPath (Join-Path $dist "$name.zip") -Force
           $h = (Get-FileHash (Join-Path $dist "$name.zip") -Algorithm SHA256).Hash.ToLower()
           Set-Content -NoNewline -Path (Join-Path $dist "$name.zip.sha256") -Value "$h  $name.zip`n"
+      # Not yet run: the Windows runner is down, so this step has never run on a Windows archive.
+      # The script's steps have run under PowerShell 7 on a macOS archive.
+      - name: The quickstart from the archive, as a new user runs it
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          Remove-Item Env:CI -ErrorAction SilentlyContinue
+          $name = "wai-${{ needs.version.outputs.version }}-x86_64-pc-windows-msvc"
+          pwsh -NoProfile -File wai\quickstart\test\clean-machine.ps1 (Join-Path $env:RUNNER_TEMP "dist\$name.zip")
+          if ($LASTEXITCODE -ne 0) { throw "the quickstart failed from $name.zip" }
       - name: Attach to the release
         shell: pwsh
         env:
diff --git a/scripts/check-wai-ops-doors-selftest.sh b/scripts/check-wai-ops-doors-selftest.sh
index 5fd1af386..99cef8925 100755
--- a/scripts/check-wai-ops-doors-selftest.sh
+++ b/scripts/check-wai-ops-doors-selftest.sh
@@ -3,10 +3,10 @@
 # check-wai-ops-doors-selftest.sh — check-wai-ops-doors.py can fail.
 #
 # A check that cannot fail is decoration. This builds a scratch tree shaped like the
-# repository (a catalogue export, an MCP tool table, an OpenAPI document, the C header and a
-# Swift and a Kotlin source) whose every door names its operations as the catalogue does, and
-# asserts that the check passes it and fails each way a door can misname an operation,
-# saying which.
+# repository (a catalogue export, the catalogue's source with its verbs, copied from this
+# repository, an MCP tool table, an OpenAPI document, the C header and a Swift and a Kotlin
+# source) whose every door names its operations as the catalogue does, and asserts that the
+# check passes it and fails each way a door can misname an operation, saying which.
 set -uo pipefail
 
 here=$(cd "$(dirname "$0")" && pwd)
@@ -19,6 +19,7 @@ mk() {
   mkdir -p "$tmp/wai/catalogue" "$tmp/wai/wai-rs/src/bin/wai_cli/mcp" "$tmp/wai/wai-rs/include" \
     "$tmp/joule-code/joule-code-rs/crates/svc" "$tmp/wai/wai-sink-swift/Sources/WaiSink" \
     "$tmp/wai/wai-sink-android/core/src/main/kotlin/wai/sink"
+  cp "$here/../wai/wai-rs/src/catalogue.rs" "$tmp/wai/wai-rs/src/catalogue.rs"
   cat > "$tmp/wai/catalogue/ops.json" <<'J'
 {"format": "wai.ops/1", "operations": [
  {"id": "envelope.inspect", "placement": "local", "route": null},
@@ -164,6 +165,33 @@ expect fail "a Kotlin companion method with a near-synonym verb" "WaiReceipt.des
 mk; sub "$tmp/wai/wai-sink-android/core/src/main/kotlin/wai/sink/WaiReceipt.kt" 'private fun checkQuietly' 'fun checkQuietly'
 expect fail "a private Kotlin method made public under an operation verb" "WaiReceipt.checkQuietly names receipt.check"
 
+# The verbs are the catalogue's own list, read from its source: each verb it has added since
+# naming rule N3 was approved is held, and a near-synonym it lists is refused.
+mk; printf 'int32_t wai_envelope_doctor(const uint8_t *p);\n' >> "$tmp/wai/wai-rs/include/wai.h"
+expect fail "a C function under the catalogue's verb doctor" "wai_envelope_doctor names envelope.doctor, which the catalogue does not hold"
+
+mk; printf 'int32_t wai_envelope_upscale(const uint8_t *p);\n' >> "$tmp/wai/wai-rs/include/wai.h"
+expect fail "a C function under the catalogue's verb upscale" "wai_envelope_upscale names envelope.upscale"
+
+mk; sub "$tmp/wai/wai-sink-swift/Sources/WaiSink/Envelope.swift" 'public func pack() {}' 'public func tonemap() {}'
+expect fail "a Swift method under the catalogue's verb tonemap" "WaiEnvelope.tonemap names envelope.tonemap"
+
+mk; printf 'int32_t wai_receipt_up(const uint8_t *p);\n' >> "$tmp/wai/wai-rs/include/wai.h"
+expect fail "a C function under the catalogue's near-synonym up" "wai_receipt_up: the verb up is a near-synonym"
+
+mk; sub "$tmp/wai/wai-rs/src/catalogue.rs" '"tonemap", "doctor",' '"tonemap",'
+printf 'int32_t wai_envelope_doctor(const uint8_t *p);\n' >> "$tmp/wai/wai-rs/include/wai.h"
+expect pass "a verb the catalogue does not list is library API: the list is the catalogue's" "C: 1 functions name operations of the catalogue, each held; 4 are library API"
+
+mk; sub "$tmp/wai/wai-rs/src/catalogue.rs" 'pub const VERBS:' 'pub const RETIRED_VERBS:'
+expect fail "a catalogue whose verbs cannot be read" "no operation verbs could be read"
+
+mk; sub "$tmp/wai/wai-rs/src/catalogue.rs" 'pub const NEAR_SYNONYMS:' 'pub const RETIRED_NEAR:'
+expect fail "a catalogue whose near-synonyms cannot be read" "no near-synonyms could be read"
+
+mk; rm "$tmp/wai/wai-rs/src/catalogue.rs"
+expect fail "no catalogue source to read the verbs from" "catalogue.rs"
+
 if [ "$fails" -ne 0 ]; then
   echo "check-wai-ops-doors-selftest: $fails case(s) failed"
   exit 1
diff --git a/scripts/check-wai-ops-doors.py b/scripts/check-wai-ops-doors.py
index bf8b75dba..25dbf8d20 100755
--- a/scripts/check-wai-ops-doors.py
+++ b/scripts/check-wai-ops-doors.py
@@ -19,10 +19,13 @@ What each door is held to:
 - HTTP API: every operationId is an operation of the catalogue that runs on a service
   (placement `service` or `both`), at the route the catalogue gives it.
 - C, Swift, Kotlin: a name in a catalogue noun's namespace whose verb is an operation verb
-  (the closed list below) names an operation, and that operation must be in the catalogue;
-  a near-synonym verb (`get`, `describe`, `info`, `keygen`, `init`, `new`, `up`) in a catalogue
+  (naming rule N3's closed list) names an operation, and that operation must be in the
+  catalogue; a near-synonym verb (`get` for `show`, `init` for `create`, …) in a catalogue
   noun's namespace is refused. Any other name is library API the catalogue does not list
   (the C ABI's codec and sink functions, the native sinks' classes), and is reported as such.
+  The verbs and their near-synonyms are the catalogue's own lists, `VERBS` and
+  `NEAR_SYNONYMS` in wai/wai-rs/src/catalogue.rs, read from it: there is one list, and a verb
+  the catalogue gains is held here from the change that adds it.
 
 A door that has no operation of the catalogue yet is reported as such; that is not a
 failure. A wrong name is.
@@ -37,19 +40,12 @@ import os
 import re
 import sys
 
-# The operation verbs: the closed list of WAI toolchain v1 (naming rule N3), with the two it
-# gained after its approval, upscale and tonemap (wai/catalogue/README.md). The catalogue's
-# own copy is wai/wai-rs/src/catalogue.rs's VERBS; a test there holds this one to it.
-VERBS = {
-    "create", "list", "show", "update", "delete", "check", "verify", "run", "build", "export",
-    "import", "start", "stop", "join", "leave", "grant", "invite", "revoke", "rotate", "tail",
-    "search", "test", "load", "encode", "decode", "inspect", "wrap", "unwrap", "fetch",
-    "generate", "promote", "rollback", "lock", "upgrade", "setup", "guide", "stream",
-    "upscale", "tonemap",
-}
-# Near-synonyms of an operation verb, and the verb to use: the catalogue's NEAR_SYNONYMS
-# (wai/wai-rs/src/catalogue.rs), which a test there holds this one to.
-NEAR = {"get": "show", "describe": "show", "info": "show", "keygen": "create", "init": "create", "new": "create", "up": "start"}
+# The catalogue's source: its closed list of operation verbs (naming rule N3) and their
+# near-synonyms, each with the verb to use.
+CATALOGUE = "wai/wai-rs/src/catalogue.rs"
+# Read from CATALOGUE by main().
+VERBS = set()
+NEAR = {}
 
 MCP_TABLE = "wai/wai-rs/src/bin/wai_cli/mcp/tools.rs"
 OPENAPI_GLOBS = ["joule-code/joule-code-rs/crates/*/openapi.json", "wai/*/openapi.json", "wai/wai-rs/openapi.json"]
@@ -66,6 +62,23 @@ def load_ops(path):
     return {o["id"]: o for o in doc["operations"]}
 
 
+def load_verbs(path):
+    """(verbs, near-synonyms) from the catalogue's source: `pub const VERBS: &[&str] = &[…];`
+    and `pub const NEAR_SYNONYMS: &[(&str, &str)] = &[(…), …];`. A source either list cannot be
+    read from stops the check: a door held to no verb would hold nothing."""
+    with open(path, encoding="utf-8") as f:
+        src = f.read()
+    m = re.search(r"pub const VERBS: &\[&str\] = &\[(.*?)\];", src, re.S)
+    verbs = set(re.findall(r'"([a-z0-9_]+)"', m.group(1))) if m else set()
+    if not verbs:
+        raise SystemExit(f"{path}: no operation verbs could be read (`pub const VERBS: &[&str] = &[...];`)")
+    m = re.search(r"pub const NEAR_SYNONYMS: &\[\(&str, &str\)\] = &\[(.*?)\];", src, re.S)
+    near = dict(re.findall(r'\(\s*"([^"]+)"\s*,\s*"([^"]+)"\s*\)', m.group(1))) if m else {}
+    if not near:
+        raise SystemExit(f"{path}: no near-synonyms could be read (`pub const NEAR_SYNONYMS: &[(&str, &str)] = &[...];`)")
+    return verbs, near
+
+
 def split_id(i):
     n, _, v = i.partition(".")
     return n, v
@@ -277,6 +290,8 @@ def main(argv):
             print("usage: check-wai-ops-doors.py [--root DIR] [--ops FILE]", file=sys.stderr)
             return 2
     ops = load_ops(ops_path or os.path.join(root, "wai/catalogue/ops.json"))
+    global VERBS, NEAR
+    VERBS, NEAR = load_verbs(os.path.join(root, CATALOGUE))
     nouns = {split_id(i)[0] for i in ops}
     findings, notes = [], []
     check_mcp(root, ops, findings, notes)
@@ -288,7 +303,7 @@ def main(argv):
         print(f"ok    {n}")
     for f in findings:
         print(f"FAIL  {f}")
-    print(f"check-wai-ops-doors: {len(ops)} operations; {len(findings)} finding(s)")
+    print(f"check-wai-ops-doors: {len(ops)} operations, {len(VERBS)} verbs; {len(findings)} finding(s)")
     return 1 if findings else 0
 
 
diff --git a/scripts/check-wai-release-quickstart-selftest.sh b/scripts/check-wai-release-quickstart-selftest.sh
new file mode 100755
index 000000000..22d615d24
--- /dev/null
+++ b/scripts/check-wai-release-quickstart-selftest.sh
@@ -0,0 +1,151 @@
+#!/usr/bin/env bash
+#
+# check-wai-release-quickstart-selftest.sh — check-wai-release-quickstart.py can fail.
+#
+# A check that cannot fail is decoration. This copies the release workflow and the two
+# quickstart scripts into a scratch tree, asserts that the check passes them as they are, then
+# breaks each rule in a fresh copy and asserts that the check fails, saying which: a job that
+# does not run its script, or runs it only in a comment; a step that runs it gated by `if:` or
+# allowed to fail by `continue-on-error:`, or a job that is; the archive attached before it is
+# run; the twin's steps or commands not the script's; and either unpack step that no longer
+# checks the archive's SHA-256, or checks it after unpacking.
+set -uo pipefail
+
+here=$(cd "$(dirname "$0")" && pwd)
+repo=$(cd "$here/.." && pwd)
+check="$here/check-wai-release-quickstart.py"
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+wf="$tmp/.github/workflows/wai-release.yml"
+sh="$tmp/wai/quickstart/test/clean-machine.sh"
+ps="$tmp/wai/quickstart/test/clean-machine.ps1"
+
+mk() {
+  rm -rf "$tmp/.github" "$tmp/wai"
+  mkdir -p "$tmp/.github/workflows" "$tmp/wai/quickstart/test"
+  cp "$repo/.github/workflows/wai-release.yml" "$wf"
+  cp "$repo/wai/quickstart/test/clean-machine.sh" "$sh"
+  cp "$repo/wai/quickstart/test/clean-machine.ps1" "$ps"
+}
+
+fails=0
+expect() { # expect <pass|fail> <what> [text the output must hold]
+  local want=$1 what=$2 needle=${3:-} out rc
+  out=$(python3 -I "$check" --root "$tmp" 2>&1); rc=$?
+  if [ "$want" = pass ] && [ $rc -ne 0 ]; then echo "FAIL  $what: the check failed"; printf '%s\n' "$out" | sed 's/^/      /'; fails=$((fails+1)); return; fi
+  if [ "$want" = fail ] && [ $rc -eq 0 ]; then echo "FAIL  $what: the check passed"; printf '%s\n' "$out" | sed 's/^/      /'; fails=$((fails+1)); return; fi
+  if [ -n "$needle" ] && ! grep -qF -- "$needle" <<<"$out"; then echo "FAIL  $what: the output does not say '$needle'"; printf '%s\n' "$out" | sed 's/^/      /'; fails=$((fails+1)); return; fi
+  echo "ok    $what"
+}
+# sub <file> <from> <to> [n]: replace the n-th (default the only) occurrence, which must exist.
+sub() {
+  python3 - "$@" <<'P' || { echo "FAIL  the fixture edit did not apply: $2"; fails=$((fails+1)); }
+import sys
+p, a, b = sys.argv[1:4]
+n = int(sys.argv[4]) if len(sys.argv) > 4 else 0
+s = open(p, encoding="utf-8").read()
+if n == 0 and s.count(a) != 1 or s.count(a) < max(n, 1):
+    sys.exit(1)
+i = -1
+for _ in range(max(n, 1)):
+    i = s.index(a, i + 1)
+open(p, "w", encoding="utf-8").write(s[:i] + b + s[i + len(a):])
+P
+}
+
+mk; expect pass "the release and the two scripts as they are" "run the quickstart from the archive before attaching it"
+
+# The jobs: each runs its script, in a step's command, ungated, before it attaches.
+mk; sub "$wf" '        run: bash wai/quickstart/test/clean-machine.sh "$RUNNER_TEMP/dist/wai-${{ needs.version.outputs.version }}-${{ matrix.triple }}.tar.gz"' '        run: echo the quickstart is not run'
+expect fail "the linux job runs no quickstart" "the linux job runs clean-machine.sh in no step's command"
+
+mk; sub "$wf" '          bash wai/quickstart/test/clean-machine.sh "$RUNNER_TEMP/dist/wai-$v-${{ matrix.triple }}.tar.gz" $flag' '          # bash wai/quickstart/test/clean-machine.sh "$RUNNER_TEMP/dist/wai-$v-${{ matrix.triple }}.tar.gz" $flag'
+expect fail "the macos job names the script in a comment alone" "the macos job runs clean-machine.sh in no step's command"
+
+mk; sub "$wf" '          pwsh -NoProfile -File wai\quickstart\test\clean-machine.ps1' '          pwsh -NoProfile -File wai\quickstart\test\clean-machine-other.ps1'
+expect fail "the windows job runs another script" "the windows job runs clean-machine.ps1 in no step's command"
+
+mk; sub "$wf" '      - name: The quickstart from the archive, as a new user runs it
+        shell: bash
+        env:' '      - name: The quickstart from the archive, as a new user runs it
+        continue-on-error: true
+        shell: bash
+        env:'
+expect fail "the macos step may fail without failing the job" "has \`continue-on-error:\`: it can be skipped or fail"
+
+mk; sub "$wf" '      - name: The quickstart from the archive, as a new user runs it
+        shell: pwsh' '      - name: The quickstart from the archive, as a new user runs it
+        if: false
+        shell: pwsh'
+expect fail "the windows step is skipped" "which runs clean-machine.ps1, has \`if:\`"
+
+mk; sub "$wf" '    name: Linux · ${{ matrix.triple }}
+' '    name: Linux · ${{ matrix.triple }}
+    continue-on-error: true
+'
+expect fail "the linux job may fail without failing the release" "the linux job has \`continue-on-error:\`"
+
+mk; sub "$wf" '      - name: The quickstart from the archive, as a new user runs it
+        shell: bash
+        run: bash' '      - name: Attach first
+        shell: bash
+        run: bash wai/quickstart/publish.sh "$GITHUB_REF_NAME" "wai" "$RUNNER_TEMP"/dist/*
+      - name: The quickstart from the archive, as a new user runs it
+        shell: bash
+        run: bash'
+expect fail "the linux job attaches the archive before running it" "comes after 'Attach first', which attaches the archive"
+
+mk; sub "$wf" '      - name: Attach to the release
+        shell: pwsh' '      - name: Upload it
+        shell: pwsh
+        run: Invoke-RestMethod -Method Post -Uri "$env:FORGE_API/repos/x/releases/1/assets?name=a.zip"
+      - name: Attach to the release
+        shell: pwsh'
+expect pass "an upload after the quickstart is in order"
+mk; python3 - "$wf" <<'P'
+import sys
+p = sys.argv[1]
+s = open(p, encoding="utf-8").read()
+q = s.index("      - name: The quickstart from the archive, as a new user runs it\n        shell: pwsh")
+a = s.index("      - name: Attach to the release\n        shell: pwsh")
+e = s.index("\n  formulae:", a)
+open(p, "w", encoding="utf-8").write(s[:q] + s[a:e] + s[q:a] + s[e:])
+P
+expect fail "the windows job attaches its archive before it runs it" "which runs clean-machine.ps1, comes after 'Attach to the release'"
+
+# The twin keeps the script's steps and commands.
+mk; sub "$ps" "Step 'create' { wai create my-room --template video-room }" "Step 'create' { wai create my-room }"
+expect fail "the twin runs another command" "the twin runs clean-machine.sh's"
+
+mk; sub "$ps" "if (-not \$Failed) { Step 'verify' { wai verify wai-hello } }" ""
+expect fail "the twin drops a step" "the twin runs clean-machine.sh's"
+
+mk; sub "$sh" '[ -z "$failed" ] && step verify wai verify wai-hello' '[ -z "$failed" ] && step check wai verify wai-hello'
+expect fail "the script's steps change" "its steps are"
+
+# Each unpack step checks the archive's SHA-256, before it unpacks.
+mk; sub "$sh" '  [ "$got" = "$want" ] || { echo "SHA-256 $got, not $want"; return 1; }' '  [ "$got" = "$want" ] || echo "SHA-256 $got, not $want"'
+expect fail "the script's unpack step does not fail on a SHA-256 that differs" "clean-machine.sh: the unpack step does not fail when"
+
+mk; sub "$sh" 'want=$(cut -d'"' '"' -f1 "$ARCHIVE.sha256")' 'want=$got'
+expect fail "the script's unpack step does not read the SHA-256 beside the archive" 'clean-machine.sh: the unpack step does not read the SHA-256 beside the archive ("$ARCHIVE.sha256")'
+
+mk; sub "$ps" '  if ($got -ne $want) { throw "SHA-256 $got, not $want" }' '  if ($got -ne $want) { Write-Output "SHA-256 $got, not $want" }'
+expect fail "the twin's unpack step does not fail on a SHA-256 that differs" "clean-machine.ps1: the unpack step does not fail when"
+
+mk; python3 - "$ps" <<'P'
+import sys
+p = sys.argv[1]
+s = open(p, encoding="utf-8").read()
+c = '  if ($got -ne $want) { throw "SHA-256 $got, not $want" }\n'
+s = s.replace(c, "")
+s = s.replace("    tar -xzf $Archive -C $Work\n  }\n", "    tar -xzf $Archive -C $Work\n  }\n" + c, 1)
+open(p, "w", encoding="utf-8").write(s)
+P
+expect fail "the twin checks the SHA-256 after unpacking" "clean-machine.ps1: the unpack step unpacks the archive before it checks its SHA-256"
+
+if [ "$fails" -ne 0 ]; then
+  echo "check-wai-release-quickstart-selftest: $fails case(s) failed"
+  exit 1
+fi
+echo "check-wai-release-quickstart-selftest: every case held"
diff --git a/scripts/check-wai-release-quickstart.py b/scripts/check-wai-release-quickstart.py
new file mode 100755
index 000000000..8288fd33d
--- /dev/null
+++ b/scripts/check-wai-release-quickstart.py
@@ -0,0 +1,258 @@
+#!/usr/bin/env python3
+"""check-wai-release-quickstart.py: the release runs the quickstart from each archive before it
+attaches it, and the Windows twin keeps the script's steps.
+
+wai-release.yml builds the quickstart archive on each platform and attaches it to the release.
+Before it is attached, each archive runs the quickstart as a new user runs it, from the archive
+alone: wai/quickstart/test/clean-machine.sh on macOS and Linux, its PowerShell twin
+clean-machine.ps1 on Windows. Each step of the twin is a step of the script, with the same
+`wai` command. This holds the three files to that:
+
+- each of the jobs macos, linux and windows runs its script in a step's command (a comment or
+  a step's name that names it is not a run of it); that step has no `if:` and no
+  `continue-on-error:`, and neither has its job, so it can neither be skipped nor fail without
+  failing the job; and it comes before the job's first step that attaches anything to the
+  release (one that runs wai/quickstart/publish.sh or uploads to a release's assets);
+- clean-machine.sh's steps are unpack, hello, verify, create, dev-check and two-tabs (the
+  browser's), and clean-machine.ps1's are the same steps in the same order, the browser's
+  aside, each running the same `wai` command;
+- the unpack step of each checks the archive against the SHA-256 beside it ("$ARCHIVE.sha256",
+  "$Archive.sha256") and fails when they differ, before it unpacks anything.
+
+    check-wai-release-quickstart.py [--root DIR]
+
+Exit 0 when all of it holds, 1 with one line a finding otherwise. Standard library only. The
+selftest (check-wai-release-quickstart-selftest.sh) breaks each rule in a copy and requires a
+finding.
+"""
+import os
+import re
+import sys
+
+WORKFLOW = ".github/workflows/wai-release.yml"
+SH = "wai/quickstart/test/clean-machine.sh"
+PS = "wai/quickstart/test/clean-machine.ps1"
+# The job, and the script it runs on its archive.
+JOBS = [("macos", "clean-machine.sh"), ("linux", "clean-machine.sh"), ("windows", "clean-machine.ps1")]
+SH_STEPS = ["unpack", "hello", "verify", "create", "dev-check", "two-tabs"]
+BROWSER_STEP = "two-tabs"
+
+
+def indent(line):
+    return len(line) - len(line.lstrip(" "))
+
+
+def is_comment(line):
+    return line.strip().startswith("#")
+
+
+def jobs(text):
+    """{job name: its lines}, the jobs under the top-level `jobs:` key."""
+    out = {}
+    lines = text.splitlines()
+    try:
+        start = next(i for i, l in enumerate(lines) if l.rstrip() == "jobs:")
+    except StopIteration:
+        return out
+    name = None
+    for l in lines[start + 1:]:
+        if l.strip() and not is_comment(l) and indent(l) == 0:
+            break
+        m = re.match(r"^  ([A-Za-z0-9_-]+):\s*$", l)
+        if m:
+            name = m.group(1)
+            out[name] = []
+        elif name is not None:
+            out[name].append(l)
+    return out
+
+
+def job_keys(lines):
+    """The job's own keys (indented four spaces), comments aside."""
+    return [re.match(r"^\s*([A-Za-z0-9_-]+):", l).group(1) for l in lines if indent(l) == 4 and not is_comment(l) and re.match(r"^\s*([A-Za-z0-9_-]+):", l)]
+
+
+def steps(lines):
+    """The job's steps, in order: each {"keys": [its keys], "name": …, "run": [its command's
+    lines, comments aside]}. A step is a list item of `steps:`; its keys are the item's first
+    key and those at the indent of the item's content."""
+    out = []
+    in_steps = False
+    item_indent = None
+    cur = None
+    run_indent = None
+    for l in lines:
+        if not l.strip():
+            continue
+        if indent(l) == 4 and not is_comment(l):
+            in_steps = l.strip() == "steps:"
+            cur = None
+            continue
+        if not in_steps:
+            continue
+        s = l.lstrip(" ")
+        if s.startswith("- ") and not is_comment(l) and (item_indent is None or indent(l) == item_indent):
+            item_indent = indent(l)
+            cur = {"keys": [], "name": "", "run": []}
+            out.append(cur)
+            run_indent = None
+            l = " " * (item_indent + 2) + s[2:]
+        if cur is None:
+            continue
+        key_indent = item_indent + 2
+        if run_indent is not None:
+            if indent(l) > key_indent:
+                if not is_comment(l):
+                    cur["run"].append(l.strip())
+                continue
+            run_indent = None
+        if is_comment(l) or indent(l) != key_indent:
+            continue
+        m = re.match(r"^\s*([A-Za-z0-9_-]+):\s*(.*)$", l)
+        if not m:
+            continue
+        key, value = m.group(1), m.group(2).strip()
+        cur["keys"].append(key)
+        if key == "name":
+            cur["name"] = value.strip("'\"")
+        elif key == "run":
+            if value in ("|", ">", "|-", ">-", "|+", ">+"):
+                run_indent = key_indent
+            elif value and not value.startswith("#"):
+                cur["run"].append(value)
+    return out
+
+
+def runs_script(step, script):
+    """Whether the step's command runs `script` (wai/quickstart/test/<script>, either slash)."""
+    want = (f"wai/quickstart/test/{script}", f"wai\\quickstart\\test\\{script}")
+    return any(w in l.split(" #")[0] for l in step["run"] for w in want)
+
+
+def attaches(step):
+    """Whether the step attaches something to the release."""
+    return any("wai/quickstart/publish.sh" in l or re.search(r"/assets\b", l) for l in step["run"])
+
+
+def check_workflow(text, findings):
+    js = jobs(text)
+    for job, script in JOBS:
+        if job not in js:
+            findings.append(f"{WORKFLOW}: no job {job}, which runs {script} on the archive it attaches")
+            continue
+        where = f"{WORKFLOW}: the {job} job"
+        for k in ("if", "continue-on-error"):
+            if k in job_keys(js[job]):
+                findings.append(f"{where} has `{k}:`, so the quickstart from its archive can be skipped or fail without failing it")
+        st = steps(js[job])
+        running = [i for i, s in enumerate(st) if runs_script(s, script)]
+        if not running:
+            findings.append(f"{where} runs {script} in no step's command: the archive it attaches is not run as a new user runs it")
+            continue
+        attach = next((i for i, s in enumerate(st) if attaches(s)), None)
+        if attach is None:
+            findings.append(f"{where} has no step that attaches its archive to the release (wai/quickstart/publish.sh, or an upload to the release's assets)")
+        for i in running:
+            s = st[i]
+            what = f"{where}'s step {s['name']!r}, which runs {script},"
+            for k in ("if", "continue-on-error"):
+                if k in s["keys"]:
+                    findings.append(f"{what} has `{k}:`: it can be skipped or fail without failing the job")
+            if attach is not None and i > attach:
+                findings.append(f"{what} comes after {st[attach]['name']!r}, which attaches the archive: the archive is attached before it is run")
+
+
+def sh_steps(text):
+    """clean-machine.sh's steps: (name, the `wai` command it runs, or None)."""
+    out = []
+    for l in text.splitlines():
+        t = l.strip()
+        m = re.match(r"^(?:\[[^]]*\]\s*&&\s*)*step ([A-Za-z0-9-]+)(?: (.*))?$", t)
+        if not m:
+            continue
+        rest = m.group(2) or ""
+        i = rest.find("wai ")
+        out.append((m.group(1), rest[i:].split("'")[0].strip() if i >= 0 else None))
+    return out
+
+
+def ps_steps(text):
+    """clean-machine.ps1's steps: (name, the `wai` command its block runs, or None)."""
+    out = []
+    for l in text.splitlines():
+        m = re.search(r"\bStep '([A-Za-z0-9-]+)' \{(.*)$", l.strip())
+        if not m:
+            continue
+        rest = m.group(2)
+        i = rest.find("wai ")
+        out.append((m.group(1), re.split(r"[};]", rest[i:])[0].strip() if i >= 0 else None))
+    return out
+
+
+def block(text, start_re):
+    """The lines of the block that starts on the line matching `start_re` and ends at the next
+    line that is `}` alone at the start of a line."""
+    lines = text.splitlines()
+    for i, l in enumerate(lines):
+        if re.search(start_re, l):
+            for j in range(i + 1, len(lines)):
+                if lines[j].rstrip() == "}":
+                    return lines[i + 1:j]
+            return lines[i + 1:]
+    return None
+
+
+def check_unpack(name, body, sums, compare, unpack, findings):
+    """The unpack step's body reads the SHA-256 from `sums`, fails when it differs (`compare`),
+    and does both before it unpacks (`unpack`)."""
+    if body is None:
+        findings.append(f"{name}: no unpack step")
+        return
+    code = [l.strip() for l in body if not l.strip().startswith("#")]
+    reads = next((i for i, l in enumerate(code) if sums in l), None)
+    fails = next((i for i, l in enumerate(code) if re.search(compare, l)), None)
+    opens = next((i for i, l in enumerate(code) if re.search(unpack, l)), None)
+    if reads is None:
+        findings.append(f"{name}: the unpack step does not read the SHA-256 beside the archive ({sums})")
+    if fails is None:
+        findings.append(f"{name}: the unpack step does not fail when the archive's SHA-256 is not the one beside it")
+    if opens is None:
+        findings.append(f"{name}: the unpack step unpacks nothing")
+    elif any(x is not None and x > opens for x in (reads, fails)):
+        findings.append(f"{name}: the unpack step unpacks the archive before it checks its SHA-256")
+
+
+def check_scripts(sh, ps, findings):
+    s, p = sh_steps(sh), ps_steps(ps)
+    names = [n for n, _ in s]
+    if names != SH_STEPS:
+        findings.append(f"{SH}: its steps are {names}, not {SH_STEPS}")
+    want = [x for x in s if x[0] != BROWSER_STEP]
+    if p != want:
+        findings.append(f"{PS}: its steps are {p}; the twin runs clean-machine.sh's, the browser's aside: {want}")
+    check_unpack(SH, block(sh, r"^unpack\(\)\s*\{"), '"$ARCHIVE.sha256"', r'\[ "\$got" = "\$want" \] \|\| \{.*\breturn 1', r"\btar -x", findings)
+    check_unpack(PS, block(ps, r"^Step 'unpack' \{"), '"$Archive.sha256"', r"if \(\$got -ne \$want\) \{\s*throw\b", r"\bExpand-Archive\b|\btar -x", findings)
+
+
+def main(argv):
+    root = "."
+    if argv[:1] == ["--root"] and len(argv) == 2:
+        root = argv[1]
+    elif argv:
+        print("usage: check-wai-release-quickstart.py [--root DIR]", file=sys.stderr)
+        return 2
+    read = lambda p: open(os.path.join(root, p), encoding="utf-8").read()
+    findings = []
+    check_workflow(read(WORKFLOW), findings)
+    check_scripts(read(SH), read(PS), findings)
+    for f in findings:
+        print(f"FAIL  {f}")
+    if not findings:
+        print(f"ok    {WORKFLOW}: the macos, linux and windows jobs run the quickstart from the archive before attaching it")
+        print(f"ok    {PS} keeps {SH}'s steps, and both check the archive's SHA-256 before unpacking it")
+    print(f"check-wai-release-quickstart: {len(findings)} finding(s)")
+    return 1 if findings else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))
diff --git a/scripts/wai-conformance-lists-selftest.sh b/scripts/wai-conformance-lists-selftest.sh
index 83b35f18c..43e20a7ab 100755
--- a/scripts/wai-conformance-lists-selftest.sh
+++ b/scripts/wai-conformance-lists-selftest.sh
@@ -206,6 +206,21 @@ expect 1 "a step file with no body" "no body" -- check
 mk; printf '# corpus: x\n# order: 1\n# bin: wai_world_vectors\n' > "$T/.github/wai-conformance/corpora/x.txt"
 expect 1 "a corpus file with no directory" "no \`dir:\` line" -- check
 
+# The independent verifiers: one `independent:` line an entry, run by the union step alone.
+mk
+expect 0 "a declaration, entries and no body, is no step" "a declaration; its verifiers run in the union step" -- run --only loc
+expect 0 "the entries print in order, each with its command line" "loc live python3 -I live-conformance/loc_verify.py live-conformance/loc" -- independent
+mk; ed "$V/loc.sh" 's/^# independent: loc live /# independent: loc nowhere /'
+expect 1 "an entry of no area" "is none of trust, media, delivery, live" -- check
+mk; ed "$V/loc.sh" 's/^# independent: loc live python3 /# independent: loc live /'
+expect 1 "an entry with no command line" "before \`python3\`" -- check
+mk; ed "$V/loc.sh" 's/^# independent: loc live /# independent: e2ee live /'
+expect 1 "an entry's name another file gives" "is also" -- check
+mk; printf 'python3 -I live-conformance/loc_verify.py live-conformance/loc\n' >> "$V/loc.sh"
+expect 1 "a body that runs an entry's command line itself" "itself; the union step runs it" -- check
+mk; perl -ni -e 'print unless /^# independent: /' "$V/loc.sh"
+expect 1 "a declaration whose entries are taken away" "no body" -- check
+
 # The commands refuse what they cannot answer, rather than answering with nothing.
 mk
 expect 1 "a tag no step takes, asked for" "a tag is one of" -- tests int-kernel
diff --git a/scripts/wai-conformance-lists.py b/scripts/wai-conformance-lists.py
index 2f36e769c..f1c585a6f 100755
--- a/scripts/wai-conformance-lists.py
+++ b/scripts/wai-conformance-lists.py
@@ -38,6 +38,13 @@ A verifier file's header (the leading `# key: value` lines; the first other line
                      /pq, beside every `wai-bins/union/NAME` and `wai-bins/pq/NAME` the body names
   paths              globs whose change runs the workflow (each under one of its `paths:` globs)
   working-directory  where the body runs, from the repository root (default wai)
+  independent        one line an entry: a corpus's independent verifier, which the job runs with
+                     every other in one step, `wai conform --independent`, and never in a body:
+                     `<name> <area> [needs=<packages>] [verdicts=<file>] [dir=<dir>] python3 [-I]
+                     <script> <args>`, the command line run in wai/ as the corpus's README gives
+                     it. `wai` builds its table of independent verifiers from these lines
+                     (wai-rs/build.rs). A file whose header holds entries and that has no body is a
+                     declaration: its verifiers run in the union alone, and it is no step of its own.
 
 The tests the job builds first are the `--test NAME` of the body's lines that build with
 "$WAI_FEATURES", and with "$WAI_RELEASE_FEATURES" for the optimised build.
@@ -47,7 +54,8 @@ Commands (the workflow runs the first group):
   env                      WAI_FEATURES=..., WAI_PQ_FEATURES=..., WAI_RELEASE_FEATURES=...
   prebuild                 the shell script that builds the binaries and tests first
   run [--only SLUG]...     every verifier step in order, each in a log group; the first that
-                           fails stops the run with its exit status
+                           fails stops the run with its exit status (a declaration has no step)
+  independent              the independent verifiers' entries, in order: `name area command` a line
   alone                    the feature lists features-alone checks, one a line
   paths                    the paths the verifier files bring to the gate, one a line
   tests TAG...             `--test NAME` for every test file that carries one of the tags
@@ -103,7 +111,7 @@ TAGS = ("int-kernels", "int-kernels-release", "int-kernels-amd")
 VERIFIER_KEYS = {
     "step": "one", "order": "one", "features": "many", "alone": "many", "build": "one",
     "release-features": "many", "bins": "many", "pq-bins": "many", "paths": "many",
-    "working-directory": "one",
+    "working-directory": "one", "independent": "lines",
 }
 CORPUS_KEYS = {"corpus": "one", "order": "one", "bin": "one", "dir": "one"}
 HEADER = re.compile(r"^# ([a-z][a-z-]*): ?(.*)$")
@@ -155,6 +163,8 @@ def read_header(path, keys, label):
             if k in head:
                 errs.append(f"{label}: line {i + 1}: `{k}` is given twice")
             head[k] = v
+        elif keys[k] == "lines":
+            head.setdefault(k, []).append(v)
         else:
             head.setdefault(k, []).extend(v.split())
         i += 1
@@ -164,6 +174,77 @@ def read_header(path, keys, label):
     return head, body, errs
 
 
+AREAS = ("trust", "media", "delivery", "live")
+ENTRY_NAME = re.compile(r"^[a-z0-9]+(?:-[a-z0-9]+)*$")
+
+
+def independent_entry(line):
+    """(entry, None) of an `independent:` line, or (None, why it is not one). The same reading
+    as wai-rs/src/bin/wai_cli/dx/independent_table.rs, which build.rs runs."""
+    w = line.split()
+    if len(w) < 4:
+        return None, "an entry is `<name> <area> [key=value]... python3 [-I] <script> <args>`"
+    name, area, rest = w[0], w[1], w[2:]
+    if not ENTRY_NAME.match(name) or name in AREAS:
+        return None, f"the name `{name}` is lowercase words joined by hyphens, and no area's"
+    if area not in AREAS:
+        return None, f"the area `{area}` is none of {', '.join(AREAS)}"
+    opts = {}
+    while rest and rest[0] != "python3":
+        k, eq, v = rest[0].partition("=")
+        if not eq or k not in ("needs", "verdicts", "dir") or not v or k in opts:
+            return None, f"`{rest[0]}`: an option is needs=, verdicts= or dir=, each once, before `python3`"
+        opts[k] = v
+        rest = rest[1:]
+    if not rest:
+        return None, "no command line: it starts with `python3`"
+    rest = rest[1:]
+    isolated = bool(rest) and rest[0] == "-I"
+    if isolated:
+        rest = rest[1:]
+    if not rest:
+        return None, "the command line names no script"
+    return {"name": name, "area": area, "needs": opts.get("needs", "").split(",") if "needs" in opts else [],
+            "verdicts": opts.get("verdicts"), "dir": opts.get("dir"), "isolated": isolated,
+            "script": rest[0], "args": rest[1:],
+            "command": " ".join(["python3"] + (["-I"] if isolated else []) + rest)}, None
+
+
+def entry_dir(e, wai):
+    """The corpus directory of an entry: its `dir=`, or the first argument that names a
+    directory under wai/, or the directory of the first that names a file."""
+    if e["dir"]:
+        return e["dir"]
+    for a in e["args"]:
+        if a.startswith("-"):
+            continue
+        p = os.path.join(wai, a)
+        if os.path.isdir(p):
+            return a
+        if os.path.isfile(p):
+            return posix_dirname(a)
+    return None
+
+
+def posix_dirname(p):
+    return p.rsplit("/", 1)[0] if "/" in p else ""
+
+
+def runs_entry(line, e):
+    """Whether a body's line runs an entry's command line itself (from wai/ or the root)."""
+    w = line.strip().split()
+    if not w or not w[0].startswith("python"):
+        return False
+    w = w[1:]
+    if w and w[0] == "-I":
+        w = w[1:]
+    norm = lambda x: x[4:] if x.startswith("wai/") else x
+    if not w or norm(w[0]) != e["script"]:
+        return False
+    args = [norm(x) for x in w[1:]]
+    return args[:len(e["args"])] == e["args"] and (len(args) == len(e["args"]) or args[len(e["args"])] in (">", "|", ">>", "2>&1", "&&", ";"))
+
+
 def joined(body):
     """The body's lines with `\\` continuations joined."""
     return re.sub(r"\\\n\s*", " ", body).split("\n")
@@ -196,7 +277,14 @@ def verifiers(root):
             alone = []
         elif alone is not None and "-" in alone:
             errs.append(f"{rel}: alone `-` stands alone")
-        if not body.strip():
+        entries = []
+        for line in h.get("independent", []):
+            e, why = independent_entry(line)
+            if why:
+                errs.append(f"{rel}: independent `{line}`: {why}")
+            else:
+                entries.append(e)
+        if not body.strip() and not entries:
             errs.append(f"{rel}: no body: the step would run nothing")
         mods.append({
             "slug": f[:-3], "file": rel, "step": h.get("step", ""), "order": order,
@@ -204,6 +292,7 @@ def verifiers(root):
             "release": h.get("release-features", []), "bins": h.get("bins", []),
             "pq_bins": h.get("pq-bins", []), "paths": h.get("paths", []),
             "wd": h.get("working-directory", "wai"), "body": body,
+            "independent": entries, "declaration": not body.strip(),
         })
     mods.sort(key=lambda m: (m["order"], m["slug"]))
     seen = {}
@@ -391,7 +480,9 @@ def from_tree(root):
         "union_bins": d["union_bins"], "pq_bins": d["pq_bins"],
         "union_tests": d["union_tests"], "release_tests": d["release_tests"],
         "alone": d["alone"],
-        "steps": [{"step": m["step"], "wd": m["wd"], "body": m["body"]} for m in mods],
+        "steps": [{"step": m["step"], "wd": m["wd"], "body": m["body"]} for m in mods if not m["declaration"]],
+        "declarations": [m["step"] for m in mods if m["declaration"]],
+        "independent": [f"{e['name']} {e['area']} {e['command']}" for m in mods for e in m["independent"]],
         "int_kernels_debug_features": tagged_features(root, ["int-kernels"], x.get("test-tagged int-kernels", [])),
         "int_kernels_debug_tests": dbg,
         "int_kernels_release_features": tagged_features(root, ["int-kernels", "int-kernels-release"], x.get("test-tagged int-kernels int-kernels-release", [])),
@@ -789,6 +880,12 @@ def dry_run(L, C):
         out.append(f"{k}: {' '.join(norm_list(k, L[k]))}")
     out.append("corpora (in order):")
     out += [f"  {c}" for c in L["corpora"]]
+    if L.get("independent"):
+        out.append("independent verifiers, run by one step as `wai conform --independent` (in order):")
+        out += [f"  {x}" for x in L["independent"]]
+    if L.get("declarations"):
+        out.append("declarations (step files whose verifiers run in the union alone):")
+        out += [f"  {x}" for x in L["declarations"]]
     out.append("independent-verifiers steps (in order):")
     for s in L["steps"]:
         out.append(f"  - step: {s['step']}  (working-directory: {s['wd']})")
@@ -844,6 +941,30 @@ def check(root):
                 errs.append(f"{m['file']}: path `{p}` is under none of {WORKFLOW}'s paths, so the forge would never start the workflow for it")
         if full and not os.path.isdir(os.path.join(root, m["wd"])):
             errs.append(f"{m['file']}: working-directory `{m['wd']}` does not exist")
+    seen = {}
+    every = [(m, e) for m in mods for e in m["independent"]]
+    for m, e in every:
+        if e["name"] in seen:
+            errs.append(f"{m['file']}: independent `{e['name']}` is also {seen[e['name']]}'s")
+        seen.setdefault(e["name"], m["file"])
+        if full:
+            wai = os.path.join(root, "wai")
+            if not os.path.isfile(os.path.join(wai, e["script"])):
+                errs.append(f"{m['file']}: independent `{e['name']}`: wai/{e['script']} is not there")
+            for a in e["args"]:
+                if "/" in a and not a.startswith("-") and not os.path.exists(os.path.join(wai, a)):
+                    errs.append(f"{m['file']}: independent `{e['name']}`: wai/{a} is not there")
+            d = entry_dir(e, wai)
+            if not d or not os.path.isdir(os.path.join(wai, d)):
+                errs.append(f"{m['file']}: independent `{e['name']}`: no corpus directory (give dir=)")
+            if e["verdicts"] and not os.path.isfile(os.path.join(wai, e["verdicts"])):
+                errs.append(f"{m['file']}: independent `{e['name']}`: verdicts file wai/{e['verdicts']} is not there")
+    for m in mods:
+        for line in joined(m["body"]):
+            for o, e in every:
+                if runs_entry(line, e):
+                    errs.append(f"{m['file']}: runs the independent verifier `{e['name']}` ({o['file']}) itself; "
+                                f"the union step runs it, `wai conform --independent`")
     for c in cs:
         if c["bin"] not in bins:
             errs.append(f"{c['file']}: binary `{c['bin']}` is not a [[bin]] of {CRATE}/Cargo.toml")
@@ -881,8 +1002,9 @@ def selftest(root, exact):
         else:
             print(f"ok    {k}: the hand list's {len(want)}{' and ' + str(len(more)) + ' more' if more else ''}")
     names = [s["step"] for s in L["steps"]]
+    declared = L.get("declarations", [])
     for s in base["steps"]:
-        if s["step"] not in names:
+        if s["step"] not in names and s["step"] not in declared:
             print(f"FAIL  step `{s['step']}` no longer runs")
             bad += 1
     if exact:
@@ -905,7 +1027,9 @@ def selftest(root, exact):
         if [c for c in L["corpora"] if c in base["corpora"]] != [c for c in base["corpora"] if c in L["corpora"]]:
             print("FAIL  the corpora both lists hold run in another order than the hand list's")
             bad += 1
-    print(f"ok    {len(base['steps'])} steps of the hand list run" if not bad else f"wai-conformance-lists selftest: {bad} failure(s)")
+    through = sum(1 for s in base["steps"] if s["step"] in declared)
+    print(f"ok    {len(base['steps'])} steps of the hand list run" + (f" ({through} of them as declarations whose verifiers the union runs)" if through else "")
+          if not bad else f"wai-conformance-lists selftest: {bad} failure(s)")
     return 1 if bad else 0
 
 
@@ -929,7 +1053,7 @@ def main(argv):
         return 2
     cmd, rest = args[0], args[1:]
     try:
-        if cmd in ("env", "prebuild", "run", "alone", "paths"):
+        if cmd in ("env", "prebuild", "run", "alone", "paths", "independent"):
             mods, errs = verifiers(root)
             if errs:
                 raise Bad("\n".join(errs))
@@ -943,6 +1067,10 @@ def main(argv):
                 print("\n".join(d["alone"]))
             elif cmd == "paths":
                 print("\n".join(d["paths"]))
+            elif cmd == "independent":
+                for m in mods:
+                    for e in m["independent"]:
+                        print(f"{e['name']} {e['area']} {e['command']}")
             else:
                 only = [rest[i + 1] for i, a in enumerate(rest) if a == "--only"]
                 env = dict(os.environ)
@@ -952,6 +1080,10 @@ def main(argv):
                 todo = [m for m in mods if not only or m["slug"] in only]
                 if only and len(todo) != len(set(only)):
                     raise Bad(f"--only names a step no file holds: {' '.join(sorted(set(only) - {m['slug'] for m in mods}))}")
+                for m in [m for m in todo if m["declaration"]]:
+                    print(f"{m['step']} ({m['file']}): a declaration; its verifiers run in the union step, "
+                          f"`wai conform --independent`: {', '.join(e['name'] for e in m['independent'])}", flush=True)
+                todo = [m for m in todo if not m["declaration"]]
                 for m in todo:
                     print(f"::group::{m['step']}  ({m['file']})", flush=True)
                     rc = subprocess.call(["bash", "--noprofile", "--norc", "-eo", "pipefail", os.path.join(root, m["file"])],
@@ -960,7 +1092,7 @@ def main(argv):
                     if rc:
                         print(f"::error::{m['step']} failed with exit status {rc} ({m['file']})", flush=True)
                         return rc
-                print(f"every step ran and passed: {len(todo)} of {len(mods)}")
+                print(f"every step ran and passed: {len(todo)} of {sum(1 for m in mods if not m['declaration'])}")
         elif cmd in ("tests", "features"):
             print(script_value(root, [cmd] + rest))
         elif cmd == "test-tagged":
diff --git a/wai/CONTRIBUTING.md b/wai/CONTRIBUTING.md
index dd9deb494..f93de86a2 100644
--- a/wai/CONTRIBUTING.md
+++ b/wai/CONTRIBUTING.md
@@ -116,9 +116,13 @@ inserts beside the entry it builds on:
   workflow's gate runs on (the trigger takes all of `extensions/`; a path under none of the
   trigger's paths still needs a line there, which `check` names); `# bins:` and
   `# release-features:` cover the rest, and every `--test` it runs with `"$WAI_FEATURES"`
-  joins the job's first build. `scripts/wai-conformance-lists.py`
-  states every key; `python3 scripts/wai-conformance-lists.py dry-run` prints every list
-  and step the workflow runs, and `run --only <name>` runs one step.
+  joins the job's first build. A corpus's independent verifier is an `# independent:` line
+  of its step's file (its name, its area, and the command line its README gives), never a
+  line of the body: one step runs every one of them as `wai conform --independent`, whose
+  table `wai-rs/build.rs` reads from those lines. A step that has only verifiers to run is
+  a file with that header and no body. `scripts/wai-conformance-lists.py` states every key;
+  `python3 scripts/wai-conformance-lists.py dry-run` prints every list and step the
+  workflow runs, and `run --only <name>` runs one step.
 - **A cargo-class corpus** is a new file of `.github/wai-conformance/corpora/`, naming
   its tool and directory. **A test of the fast integer kernels** carries the first line
   `// wai-conformance: int-kernels` (with `int-kernels-amd` when the AVX-512 host runs it
diff --git a/wai/README.md b/wai/README.md
index 883cd18eb..89f26cdbf 100644
--- a/wai/README.md
+++ b/wai/README.md
@@ -75,6 +75,7 @@ wai hello                                   # name, dispatch, rebuild and receip
 wai create my-room --template video-room    # a project from one of the examples (examples/)
 cd my-room && wai dev                       # the relay, the room service and your page, on 127.0.0.1:8080
 wai verify ../wai-hello                     # the receipts hello wrote, checked offline
+wai doctor                                  # which wai runs when you type it, and what wai dev needs
 ```
 
 [`examples/`](examples/README.md) holds each template, with a test that runs it.
@@ -103,14 +104,19 @@ to WAI's corpora:
 wai breaking --against origin/main     # what this tree breaks: wire, record and API (CI runs it on every pull request)
 wai conform verifier --suite claim --impl "my-verifier verdicts {corpus}"   # a corpus run against your implementation
 wai verify claim.wai-conform.json      # the signed result, checked
+wai conform --independent --out records --format junit   # every corpus's independent verifier, a record each
 ```
 
 A break passes only when the changelog names it: an entry this change adds, as a file of
 [`changes/`](changes/) or to [`CHANGELOG.md`](CHANGELOG.md), that says **Breaking** and gives the
 finding's id in backticks. `wai conform --list` names every kind
 (verifier, decoder, packager, origin, sink) and suite, with its adapters: a command line, or an
-`http://` URL. `wai verify --conformant` admits a result only for a run that passed, against the
-corpus of the checkout it runs in.
+`http://` URL; and every corpus's independent verifier, its second implementation, with the
+command line it runs. `--independent` beside a kind runs the corpus's independent verifier on
+the same cases, and the run passes only when both conform and agree on every case. `--format
+junit` or `--format html` prints a report made from the signed records. `wai verify
+--conformant` admits a result only for a run that passed, against the corpus of the checkout it
+runs in.
 
 With the `codecs` feature, `wai-rs/build.rs` finds libFLAC through pkg-config
 and, on macOS without pkg-config, in the Homebrew "flac" formula prefix
@@ -135,7 +141,7 @@ operation of the toolchain, named by it with `_` for the dot, and the tools come
 
 | Toolset | Tools |
 |---|---|
-| `core` (the default) | `envelope_inspect`, `media_inspect`, `registry_list`, `registry_show`, `receipt_verify`, `envelope_wrap`, `conformance_list`, `conformance_run`, `docs_search` |
+| `core` (the default) | `envelope_inspect`, `media_inspect`, `registry_list`, `registry_show`, `receipt_verify`, `envelope_wrap`, `conformance_list`, `conformance_run`, `toolchain_doctor`, `docs_search` |
 | `dev` | `dev_start`, `dev_stop`, `room_grant`, `room_join`, `room_leave`, `session_show` |
 | `app` (a build with the feature `app`) | `app_guide`, `app_check`, `app_stream`, `app_export`: Create's, below |
 
diff --git a/wai/catalogue/README.md b/wai/catalogue/README.md
index 8a6c334be..822aaf197 100644
--- a/wai/catalogue/README.md
+++ b/wai/catalogue/README.md
@@ -14,7 +14,7 @@ An operation is named `noun.verb`: lowercase ASCII, a singular noun, and a verb
 rule N3's closed list (create, list, show, update, delete, check, verify, run, build, export,
 import, start, stop, join, leave, grant, invite, revoke, rotate, tail, search, test, load, encode,
 decode, inspect, wrap, unwrap, fetch, generate, promote, rollback, lock, upgrade, setup, guide,
-stream, upscale, tonemap), never a near-synonym (`get`, `describe` and `info` are `show`; `keygen`, `init` and
+stream, upscale, tonemap, doctor), never a near-synonym (`get`, `describe` and `info` are `show`; `keygen`, `init` and
 `new` are `create`; `up` is `start`, as in `wai dev`). A command a person already types keeps its spelling as the operation's
 command line: `wai hello` is `toolchain.test`, `wai stage refine` is `stage.encode`.
 
@@ -23,9 +23,11 @@ The list as approved with WAI toolchain v1 ended at `stream`. Two verbs joined i
 exact derivation, an output any verifier recomputes bit for bit from the input and the parameters
 its record names (extensions/exact-upscale.md, extensions/exact-tonemap.md), and no approved verb
 names that: `encode` and `decode` run a codec, and `generate` makes media from a description. A
-verb joins the list the same way: in `VERBS` (wai-rs/src/catalogue.rs), this paragraph and the
-list above, and the doors' check (`scripts/check-wai-ops-doors.py`), which a test of the catalogue
-holds to `VERBS`.
+third, `doctor`, joined with `toolchain.doctor` (`wai doctor`), which the specification's own
+operation table names. A verb joins the list the same way: in `VERBS` (wai-rs/src/catalogue.rs),
+this paragraph and the list above. The doors' check (`scripts/check-wai-ops-doors.py`) keeps no
+list of its own: it reads `VERBS` and `NEAR_SYNONYMS` from that file, and a test of the
+catalogue holds this paragraph's lists to them.
 
 An entry (format `wai.ops/1`) carries:
 
diff --git a/wai/catalogue/ops.json b/wai/catalogue/ops.json
index f70d733c8..1055455b0 100644
--- a/wai/catalogue/ops.json
+++ b/wai/catalogue/ops.json
@@ -130,6 +130,57 @@
         "sdk": "wai.toolchain.test"
       }
     },
+    {
+      "id": "toolchain.doctor",
+      "summary": "Which wai runs when you type wai, this install and what wai dev runs beside it, the loopback ports, browsers and the keychain, checked",
+      "cli": "wai doctor",
+      "aliases": [],
+      "usage": [
+        "wai doctor   which `wai` runs when you type wai (first: another program of that name on PATH, such as the one",
+        "    the crates.io package wai-cli installs), this install and what `wai dev` runs beside it, the loopback ports it",
+        "    listens on, the browsers registered to open web pages, and where a credential is kept; exit 1 when a check fails"
+      ],
+      "placement": "local",
+      "effect": "reads",
+      "dry_run": false,
+      "confirm": "never",
+      "route": null,
+      "doors": {
+        "cli": true,
+        "mcp": true,
+        "http": false
+      },
+      "toolset": "core",
+      "stability": "preview",
+      "input": {
+        "type": "object",
+        "properties": {},
+        "required": [],
+        "additionalProperties": false
+      },
+      "output": {
+        "type": "object",
+        "required": [
+          "wai",
+          "checks",
+          "failed",
+          "warnings"
+        ],
+        "description": "Each check in order (path, install, ports, browsers, keychain) with its status (ok, warn or fail), what it found and what to do"
+      },
+      "stream": null,
+      "since": "0.3.0",
+      "deprecated": null,
+      "receipt": false,
+      "needs": null,
+      "names": {
+        "cli": "wai toolchain doctor",
+        "mcp": "toolchain_doctor",
+        "c": "wai_toolchain_doctor",
+        "rust": "wai::toolchain::doctor",
+        "sdk": "wai.toolchain.doctor"
+      }
+    },
     {
       "id": "project.create",
       "summary": "A new project from one of the examples, written into a new or empty directory; --list names the templates",
@@ -3457,13 +3508,18 @@
     },
     {
       "id": "conformance.run",
-      "summary": "WAI's conformance corpus run against another implementation, through a command or an HTTP adapter, its result a signed record wai verify checks",
+      "summary": "WAI's conformance corpus run against another implementation, through a command or an HTTP adapter, or every corpus's independent verifier; each result a signed record wai verify checks",
       "cli": "wai conform",
       "aliases": [],
       "usage": [
-        "wai conform <kind> --suite <suite> --impl <command or URL> [--key <file>] [--out <file>] [--root <wai-dir>]",
-        "    [--timeout <seconds>] [--name <text>] [--version <text>] [--all] [--yes]   `wai conformance list` names",
-        "    the kinds and suites; a record that exists is replaced only with --yes (--confirm, deprecated, is the same)"
+        "wai conform <kind> --suite <suite> --impl <command or URL> [--independent] [--key <file>] [--out <file>]",
+        "    [--root <wai-dir>] [--timeout <seconds>] [--name <text>] [--version <text>] [--python <program>] [--all]",
+        "    [--format text|json|junit|html] [--yes]   `wai conformance list` names the kinds and suites; --independent",
+        "    runs the corpus's independent verifier beside the implementation, and both must conform",
+        "wai conform --independent [--suite <area|name>[,...]] [--out <dir>] [--key <file>] [--root <wai-dir>]",
+        "    [--timeout <seconds>] [--python <program>] [--format text|json|junit|html] [--yes]   every corpus's",
+        "    independent verifier (or those named), a record each in <dir>; a record that exists is replaced only with",
+        "    --yes (--confirm, deprecated, is the same)"
       ],
       "placement": "local",
       "effect": "writes-project",
@@ -3482,29 +3538,36 @@
         "properties": {
           "kind": {
             "type": "string",
-            "description": "The kind of implementation (wai conformance list): a decoder, a verifier, an origin, a packager, a sink.",
+            "description": "The kind of implementation (wai conformance list): a decoder, a verifier, an origin, a packager, a sink; none with --independent alone.",
             "x-cli": {
               "positional": true
             }
           },
           "suite": {
             "type": "string",
-            "description": "The suite (wai conformance list).",
+            "description": "The suite (wai conformance list); with --independent alone, areas and independent verifiers, comma-separated.",
             "x-cli": {
               "flag": "--suite"
             }
           },
           "impl": {
             "type": "string",
-            "description": "The implementation: a command with {case}/{in}/{out}/{corpus} placeholders, or a URL.",
+            "description": "The implementation: a command with {case}/{in}/{out}/{corpus} placeholders, or a URL; required with a kind.",
             "x-cli": {
               "flag": "--impl"
             }
           },
+          "independent": {
+            "type": "boolean",
+            "description": "Run the corpus's independent verifier beside the implementation, held to the same cases; without a kind, every independent verifier.",
+            "x-cli": {
+              "flag": "--independent"
+            }
+          },
           "key": {
             "type": "string",
             "format": "path",
-            "description": "The seed the record is signed with.",
+            "description": "The seed the records are signed with.",
             "x-cli": {
               "flag": "--key"
             }
@@ -3512,7 +3575,7 @@
           "out": {
             "type": "string",
             "format": "path",
-            "description": "The record (<suite>.wai-conform.json).",
+            "description": "The record (<suite>.wai-conform.json); with --independent alone, a directory for a record a corpus.",
             "x-cli": {
               "flag": "--out"
             }
@@ -3527,7 +3590,7 @@
           },
           "timeout": {
             "type": "integer",
-            "description": "Seconds a case may take.",
+            "description": "Seconds a case may take (60), or an independent verifier its whole corpus (1800).",
             "x-cli": {
               "flag": "--timeout"
             }
@@ -3546,6 +3609,20 @@
               "flag": "--version"
             }
           },
+          "python": {
+            "type": "string",
+            "description": "The Python the independent verifiers run with (python3).",
+            "x-cli": {
+              "flag": "--python"
+            }
+          },
+          "format": {
+            "type": "string",
+            "description": "What is printed: text, json (the envelope, as --json), junit (JUnit XML) or html, the last two from the records.",
+            "x-cli": {
+              "flag": "--format"
+            }
+          },
           "all": {
             "type": "boolean",
             "description": "List every case, passed ones too.",
@@ -3554,10 +3631,7 @@
             }
           }
         },
-        "required": [
-          "kind",
-          "impl"
-        ],
+        "required": [],
         "additionalProperties": false
       },
       "output": {
@@ -3588,11 +3662,11 @@
     },
     {
       "id": "conformance.list",
-      "summary": "The kinds and suites wai conform runs, each suite's corpus and its cases",
+      "summary": "The kinds and suites wai conform runs, each suite's corpus and its cases, and every corpus's independent verifier",
       "cli": "wai conformance list",
       "aliases": [],
       "usage": [
-        "wai conformance list [--root <wai-dir>]   (also wai conform --list)"
+        "wai conformance list [--root <wai-dir>]   the kinds and suites, and the independent verifiers (also wai conform --list)"
       ],
       "placement": "local",
       "effect": "reads",
diff --git a/wai/changes/2026-11-04-independent-verifiers-table-from-step-files.md b/wai/changes/2026-11-04-independent-verifiers-table-from-step-files.md
new file mode 100644
index 000000000..86cf89791
--- /dev/null
+++ b/wai/changes/2026-11-04-independent-verifiers-table-from-step-files.md
@@ -0,0 +1,21 @@
+### The table of independent verifiers is read from the conformance workflow's step files
+
+- **No list to append to.** `wai conform --independent`'s table is not kept by hand in `dx/independent.rs`:
+  `wai-rs/build.rs` reads it from the `# independent:` lines of the step files of `wai-conformance.yml`'s independent
+  verifiers (`.github/wai-conformance/verifiers/*.sh`), one line an entry, `<name> <area> [needs=<packages>]
+  [verdicts=<file>] [dir=<dir>] python3 [-I] <script> <args>`: the command line the corpus's README gives. A corpus's
+  verifier joins the union by a line in its own step's file, which no other change edits, and the entries run in the
+  files' order. A step file whose verifiers run in the union alone keeps its header and prose and has no body (a
+  declaration). `scripts/wai-conformance-lists.py` reads the same lines: `check` refuses a line it cannot read, a name
+  given twice, a script or corpus that is not there and a step that runs an entry itself, and `dry-run` and
+  `independent` print the entries.
+- **A build without the step files has no table, and says so.** A `wai` built outside the repository, or from step
+  files it could not read, refuses `wai conform --independent` and `--independent` beside a kind with the reason
+  (`no-independent-table`), and `wai conform --list` says it has none, rather than running nothing and passing.
+- The table's tests read the step files, and `wai-breaking.yml`, which runs them, runs on a change to one: the table
+  compiled in is their lines as they are now, and no step file's body runs an entry's command line. A verifier that a step's body runs itself is covered by that step, as the opus deep
+  redundancy and header probe steps run theirs over the inputs they fetch; a step whose verifier has no
+  `# independent:` line keeps running it in its body, so a change that adds one merges with this one in either order,
+  and the verifier joins the union by that line. The catalogue-prior record's verifier,
+  `wai_catalogue_prior_verify.py`, joins the union as the determinism-cost record's did, and the native sink suite names
+  its corpus's verifier for `--independent`.
diff --git a/wai/changes/2026-11-04-release-runs-quickstart-from-each-archive.md b/wai/changes/2026-11-04-release-runs-quickstart-from-each-archive.md
new file mode 100644
index 000000000..212b6f91d
--- /dev/null
+++ b/wai/changes/2026-11-04-release-runs-quickstart-from-each-archive.md
@@ -0,0 +1,12 @@
+### The release runs the quickstart from each archive as a new user runs it
+
+- `wai-release.yml` runs `wai/quickstart/test/clean-machine.sh` on each macOS and Linux archive before attaching it: the
+  archive checked against its SHA-256 and unpacked on a fresh home directory and a PATH of the system's own directories,
+  then `wai hello`, `wai verify`, `wai create my-room --template video-room` and `wai dev --check` in the project; on the
+  Apple-silicon Mac, also the project's page joined in two browser pages, each decoding the other.
+- `clean-machine.ps1` is its PowerShell twin for the Windows archive, step for step.
+  `scripts/check-wai-release-quickstart.py`, in the repository checks every change runs, holds each leg to running its
+  script before the archive is attached, in a step that is neither skipped (`if:`) nor allowed to fail
+  (`continue-on-error:`), the twin to the script's steps and commands, and both unpack steps to checking the archive's
+  SHA-256 before unpacking it. **The Windows leg has not run yet**: its runner is down, so no Windows archive has been
+  through it. Its steps have run under PowerShell 7 on a macOS archive.
diff --git a/wai/changes/2026-11-04-wai-conform-reports-ci-system-reads.md b/wai/changes/2026-11-04-wai-conform-reports-ci-system-reads.md
new file mode 100644
index 000000000..a9c08b049
--- /dev/null
+++ b/wai/changes/2026-11-04-wai-conform-reports-ci-system-reads.md
@@ -0,0 +1,35 @@
+### `wai conform`: reports a CI system reads, the independent verifiers beside an implementation, and the corpus union as one command
+
+- **`--format text|json|junit|html`** (operation `conformance.run`). `junit` prints a JUnit XML report, a test suite a
+  signed record and a test case a case, a failure exactly where a case failed, with the record's corpus digest,
+  implementation and signing key as its properties; `html` prints one page with the same. Both are made from the signed
+  records alone, so they say what the records say; `json` is the envelope `--json` prints, and with `junit` or `html` the
+  progress goes to standard error.
+- **`--independent`** beside a kind (`wai conform <kind> --suite <s> --impl <i> --independent`) runs the corpus's
+  independent verifier, its second implementation written from the extension's text, on the same cases: the claim, JWP,
+  key-discovery and conformance-result suites case by case through each verifier's `verdicts` mode, the HTTP origin
+  suite over its whole corpus. Its outcome is a second signed record beside the implementation's
+  (`<suite>.independent.wai-conform.json`), named `independent verifier`, so a report tells its test suite from the
+  implementation's. The run passes only when both conform and the two agree: every case on which they came to different
+  outcomes, or which both passed with different answers (a case the corpus states only the start of, such as an accepted
+  claim whose link hash it does not pin), is named and fails the run. The score and packaging policy suites have none
+  here, and say so; a test holds every suite to naming its corpus's verifier where the table has one.
+- **`wai conform --independent`** alone runs every corpus's independent verifier (or those `--suite` names, by area,
+  `trust`, `media`, `delivery` or `live`, or by name), each in `wai/` with the command line its README gives, from one
+  table in the `wai` binary that `wai conform --list` prints; with `--out <dir>`, a signed record a corpus, which
+  `wai verify <dir>` checks. A verifier that fails shows the end of its output, and the Python package it needs, where
+  that is missing. `--python` names the interpreter (`python3`).
+- **The corpus union is one command.** `wai-conformance.yml` ran each corpus's Python verifier in a step of its own, a
+  list kept by hand; it now runs them all as `wai conform --independent --format junit`, uploads the records and the
+  report, and checks the records with `wai verify`. The steps keep each corpus's Rust side. The table's tests require
+  every `*_verify.py` in the tree to be in it or to say where it runs instead (the opus deep redundancy and header probe
+  verifiers need fetched inputs and run in their steps, and `pack_verify.py` in `wai-pack.yml`), each run in a step's
+  command of the workflow it names, and `wai-conformance.yml` to run none of the table's by hand. A record's corpus digest
+  is of the files the run reads: a run given one vectors file digests that file (each of the OER corpus's four runs, and
+  the claims runs over the bearer, usage and carousel corpora), and one given a directory, every file in it. The union
+  gains the pin corpus's verifier, which ran on the macOS leg alone, and the OER corpus's, `oer2_verify.py`, over its
+  four vector files and its unreadable documents, which no workflow ran.
+- `wai mcp`'s `conformance_list` and `conformance_run` read the same table: each corpus with its command line, and a
+  corpus run by its directory or by its verifier's name. A directory the claim verifier also runs over
+  (`live-conformance/bearers`, `usage`, `carousel`) runs its corpus's own verifier, as it did before the claims runs were
+  in the table; one with several of its own (`oer-conformance`) names them.
diff --git a/wai/changes/2026-11-04-wai-doctor-which-wai-runs-you.md b/wai/changes/2026-11-04-wai-doctor-which-wai-runs-you.md
new file mode 100644
index 000000000..43c1609db
--- /dev/null
+++ b/wai/changes/2026-11-04-wai-doctor-which-wai-runs-you.md
@@ -0,0 +1,14 @@
+### `wai doctor`: which `wai` runs when you type it, and what the quickstart needs
+
+- **`wai doctor`** (operation `toolchain.doctor`, preview; in the agent door as `toolchain_doctor`) checks, in order:
+  which program runs when a person types `wai` (another program of that name first on `PATH` fails, and the one the
+  crates.io package `wai-cli` installs, which `cargo`'s own list of what it installed names, is named as that, with
+  `cargo uninstall wai-cli`); this install, how it was installed, and the relay, the room service and the room client's
+  files `wai dev` runs, found as `wai dev` finds them; whether loopback can be listened on and the ports `wai dev` and
+  `wai http origin` take by default are free; the browsers the system has registered to open web pages; and where a
+  credential is kept (the keychain, the desktop secret service, or a file only its owner can read). Exit 1 when a check
+  fails; warnings do not. A package manager's shim first on `PATH`, as WAI's bucket installs, is the program its `.shim`
+  file names; and a release from before the catalogue (0.3.0) is another copy of WAI's command line, not another
+  program. The catalogue's verbs gain `doctor`, which the toolchain specification's operation table names; the check of
+  every door's names (`scripts/check-wai-ops-doors.py`) now reads the verbs and their near-synonyms from the catalogue
+  itself, so it holds `doctor`, `upscale` and `tonemap` too.
diff --git a/wai/quickstart/README.md b/wai/quickstart/README.md
index f3709c84b..1f4ab9312 100644
--- a/wai/quickstart/README.md
+++ b/wai/quickstart/README.md
@@ -26,8 +26,9 @@ wai dev                                     # the relay, the room service and yo
 wai verify ../wai-hello                     # the receipts hello wrote, checked offline
 ```
 
-`wai create --list` names every template. `wai dev --help` gives its options. Nothing here
-needs an account, and nothing is sent off your machine.
+`wai create --list` names every template. `wai dev --help` gives its options. `wai doctor` says
+which `wai` runs when you type it and whether `wai dev` finds what it runs. Nothing here needs an
+account, and nothing is sent off your machine.
 
 Keep `bin/` and `share/` side by side: `wai dev` finds the relay, the room service, the room
 client and Studio beside itself. Homebrew and Scoop install `wai-quantum` as a package of its own,
diff --git a/wai/quickstart/test/clean-machine.ps1 b/wai/quickstart/test/clean-machine.ps1
new file mode 100644
index 000000000..c68424d4f
--- /dev/null
+++ b/wai/quickstart/test/clean-machine.ps1
@@ -0,0 +1,107 @@
+# The quickstart as a new user runs it on Windows, from the archive alone, timed step by step:
+#
+#   pwsh -File wai/quickstart/test/clean-machine.ps1 <archive.zip>
+#
+# The twin of clean-machine.sh, step for step. A machine with nothing of WAI on it: a fresh
+# profile (USERPROFILE, HOME, APPDATA, LOCALAPPDATA, TEMP and TMP) and working directory, a PATH
+# of the system's own directories, no cargo and no repository. The steps are the quickstart's:
+#   1. check the archive against its .sha256 beside it, and unpack it;
+#   2. wai hello;  3. wai verify;  4. wai create my-room --template video-room;
+#   5. wai dev --check in the project: the relay, the room service and the page on one origin,
+#      each checked through it.
+# It prints each step's time, the total, and a JSON line; it exits non-zero when a step fails,
+# naming it. Downloading the archive is not timed: the archive is given. It needs PowerShell 7
+# and runs on any system it runs on (a .tar.gz archive elsewhere than Windows), so its steps can
+# be checked off Windows too.
+param([string]$Archive)
+$ErrorActionPreference = 'Stop'
+if (-not $Archive) {
+  Get-Content $PSCommandPath | Select-Object -First 15 | ForEach-Object { $_ -replace '^# ?', '' }
+  exit 2
+}
+$Archive = (Resolve-Path $Archive).Path
+# The system's temporary directory, read before TEMP, TMP and TMPDIR point into the run's own.
+$SystemTmp = [IO.Path]::GetTempPath()
+$Root = Join-Path $SystemTmp ("wai-clean-" + [guid]::NewGuid().ToString('N'))
+$HomeDir = Join-Path $Root 'home'
+$Tmp = Join-Path $Root 'tmp'
+$Work = Join-Path $Root 'work'
+New-Item -ItemType Directory -Force -Path $HomeDir, $Tmp, $Work | Out-Null
+$env:HOME = $HomeDir
+$env:USERPROFILE = $HomeDir
+$env:APPDATA = Join-Path $HomeDir 'AppData\Roaming'
+$env:LOCALAPPDATA = Join-Path $HomeDir 'AppData\Local'
+$env:TEMP = $Tmp
+$env:TMP = $Tmp
+$env:TMPDIR = $Tmp
+New-Item -ItemType Directory -Force -Path $env:APPDATA, $env:LOCALAPPDATA | Out-Null
+$Sep = [IO.Path]::PathSeparator
+if ($IsWindows) {
+  $System = @("$env:SystemRoot\System32", $env:SystemRoot, "$env:SystemRoot\System32\Wbem", "$env:SystemRoot\System32\WindowsPowerShell\v1.0") -join $Sep
+} else {
+  $System = '/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin'
+}
+$env:PATH = $System
+Set-Location $Work
+
+$T0 = [Diagnostics.Stopwatch]::StartNew()
+$Steps = [ordered]@{}
+$Failed = ''
+
+# Run one step, its output to <name>.log: its time, or FAILED and the log's tail.
+function Step([string]$Name, [scriptblock]$Do) {
+  $log = Join-Path $Root "$Name.log"
+  $w = [Diagnostics.Stopwatch]::StartNew()
+  $ok = $true
+  try {
+    $global:LASTEXITCODE = 0
+    & $Do *> $log
+    if ($LASTEXITCODE -ne 0) { $ok = $false }
+  } catch {
+    $_ | Out-File -Append $log
+    $ok = $false
+  }
+  if ($ok) {
+    $script:Steps[$Name] = [math]::Round($w.Elapsed.TotalSeconds, 2).ToString([Globalization.CultureInfo]::InvariantCulture)
+  } else {
+    $script:Steps[$Name] = 'FAILED'
+    $script:Failed = $Name
+    Write-Output "FAIL ${Name}:"
+    if (Test-Path $log) { Get-Content $log -Tail 15 }
+  }
+}
+
+Step 'unpack' {
+  $want = ((Get-Content "$Archive.sha256" -Raw).Trim() -split '\s+')[0].ToLower()
+  $got = (Get-FileHash $Archive -Algorithm SHA256).Hash.ToLower()
+  if ($got -ne $want) { throw "SHA-256 $got, not $want" }
+  if ($Archive.EndsWith('.zip')) {
+    Expand-Archive -Path $Archive -DestinationPath $Work
+  } else {
+    tar -xzf $Archive -C $Work
+  }
+}
+$Bin = Get-ChildItem -Path $Work -Directory -Filter 'wai-*' | Select-Object -First 1 | ForEach-Object { Join-Path $_.FullName 'bin' }
+if ($Bin) { $env:PATH = "$Bin$Sep$env:PATH" }
+if (-not $Failed) { Step 'hello' { wai hello } }
+if (-not $Failed) { Step 'verify' { wai verify wai-hello } }
+if (-not $Failed) { Step 'create' { wai create my-room --template video-room } }
+if (-not $Failed) { Step 'dev-check' { Push-Location my-room; try { wai dev --check --port 0 } finally { Pop-Location } } }
+
+$Total = [math]::Round($T0.Elapsed.TotalSeconds, 2).ToString([Globalization.CultureInfo]::InvariantCulture)
+$Os = [Runtime.InteropServices.RuntimeInformation]::OSDescription
+$Arch = [Runtime.InteropServices.RuntimeInformation]::OSArchitecture
+Write-Output "the quickstart from $(Split-Path $Archive -Leaf) on $Os $Arch, a fresh profile and directory:"
+foreach ($k in $Steps.Keys) {
+  if ($Steps[$k] -eq 'FAILED') { Write-Output ("  {0,-10} FAILED" -f $k) } else { Write-Output ("  {0,-10} {1} s" -f $k, $Steps[$k]) }
+}
+$devLog = Join-Path $Root 'dev-check.log'
+if (Test-Path $devLog) { Select-String -Path $devLog -Pattern 'checks held' | ForEach-Object { "  $($_.Line)" } }
+Write-Output ("  total      $Total s" + $(if ($Failed) { " (stopped at $Failed)" } else { '' }))
+$stepsOut = [ordered]@{}
+foreach ($k in $Steps.Keys) { $stepsOut[$k] = $Steps[$k] }
+[ordered]@{ archive = (Split-Path $Archive -Leaf); total_s = [double]$Total; steps = $stepsOut; ok = (-not $Failed) } | ConvertTo-Json -Compress
+Set-Location $SystemTmp
+Remove-Item -Recurse -Force $Root -ErrorAction SilentlyContinue
+if ($Failed) { exit 1 }
+exit 0
diff --git a/wai/quickstart/test/clean-machine.sh b/wai/quickstart/test/clean-machine.sh
index 5fd3cddaa..84e23cf27 100755
--- a/wai/quickstart/test/clean-machine.sh
+++ b/wai/quickstart/test/clean-machine.sh
@@ -15,7 +15,8 @@
 #   7. with --browser (BROWSER_BIN and PLAYWRIGHT_HOST set): the project's page joined in two
 #      browser pages, each decoding the other (the video-room example's test).
 # It prints each step's time, the total, and a JSON line; it exits non-zero when a step fails,
-# naming it. Downloading the archive is not timed: the archive is given.
+# naming it. Downloading the archive is not timed: the archive is given. Its PowerShell twin,
+# clean-machine.ps1, runs the same steps from the Windows archive.
 set -uo pipefail
 [ $# -ge 1 ] || { sed -n '2,19p' "$0"; exit 2; }
 ARCHIVE=$(cd "$(dirname "$1")" && pwd)/$(basename "$1")
diff --git a/wai/wai-rs/build.rs b/wai/wai-rs/build.rs
index 014f3b7fc..439fc839f 100644
--- a/wai/wai-rs/build.rs
+++ b/wai/wai-rs/build.rs
@@ -13,9 +13,13 @@
 #[path = "src/build_info.rs"]
 mod build_info;
 
+#[path = "src/bin/wai_cli/dx/independent_table.rs"]
+mod independent_table;
+
 fn main() {
     generate_c_header();
     record_build();
+    independent_verifiers();
     // Only the `codecs` feature compiles flac-bound — and pkg-config's
     // probe() emits a `cargo:rustc-link-lib=flac` of its own, so running
     // it unconditionally makes every consumer (e.g. the wasm32 world
@@ -51,6 +55,34 @@ fn record_build() {
     }
 }
 
+/// The `wai` binary's table of independent verifiers (`dx/independent.rs`), written to
+/// `$OUT_DIR/independent_verifiers.rs` from the `# independent:` lines of the conformance
+/// workflow's step files (`.github/wai-conformance/verifiers/*.sh`), which hold no list a change
+/// appends to. A build outside the repository, which has no step files, gets an empty table
+/// and the reason (`TABLE_ABSENT`), so `wai conform --independent` refuses to run rather than
+/// pass on nothing; so does a build whose step files cannot be read, with the reason.
+fn independent_verifiers() {
+    let manifest = std::path::PathBuf::from(std::env::var("CARGO_MANIFEST_DIR").unwrap());
+    let repo = manifest.join("../..");
+    let steps = repo.join(independent_table::STEPS);
+    println!("cargo:rerun-if-changed={}", steps.display());
+    let text = match independent_table::entries(&repo) {
+        Ok(Some(e)) => independent_table::render(&e),
+        Ok(None) => independent_table::render_absent(&format!(
+            "this wai was built without {}/, the conformance workflow's step files whose `# independent:` lines are the table of independent verifiers, so it has none to run; build it from a checkout of the repository",
+            independent_table::STEPS
+        )),
+        Err(why) => {
+            println!("cargo:warning=the table of independent verifiers: {why}");
+            independent_table::render_absent(&format!("this wai was built from step files it could not read: {why}"))
+        }
+    };
+    let out = std::path::PathBuf::from(std::env::var("OUT_DIR").unwrap()).join("independent_verifiers.rs");
+    if std::fs::read_to_string(&out).ok().as_deref() != Some(text.as_str()) {
+        std::fs::write(&out, text).expect("write the table of independent verifiers");
+    }
+}
+
 /// Regenerate `include/wai.h` from the FFI surface so SDK consumers can
 /// always grab a typed header that matches the shipped binary. Only
 /// regenerates when source files actually change (cargo handles this
diff --git a/wai/wai-rs/src/bin/wai_cli/dx/conform/mod.rs b/wai/wai-rs/src/bin/wai_cli/dx/conform/mod.rs
index 6b2809ae3..a5c3f57dc 100644
--- a/wai/wai-rs/src/bin/wai_cli/dx/conform/mod.rs
+++ b/wai/wai-rs/src/bin/wai_cli/dx/conform/mod.rs
@@ -9,6 +9,21 @@
 //! implementation it ran (the command and the SHA-256 of every file it names, or the URL),
 //! each case's outcome, and the standard's version.
 //!
+//! `--independent` runs the corpus's independent verifier (`dx::independent`: its second
+//! implementation, written from the text and sharing no code with wai-rs) beside the
+//! implementation, held to the same cases, its outcome a second record; the run passes only
+//! when both conform and the two agree on every case. A case on which they disagree is named:
+//! one passes it and the other does not, or both pass it with different answers (a case the
+//! corpus states only the start of, such as an accepted claim whose link hash it does not pin).
+//! Without a kind,
+//! `wai conform --independent [--suite <area|name>[,…]]` runs every independent verifier (or
+//! those named) over its corpus: the corpus union CI runs as this one command, a signed record
+//! a corpus with `--out <dir>`.
+//!
+//! `--format` says what is printed: `text` (the default), `json` (the envelope, as `--json`),
+//! `junit` (JUnit XML, a test suite a record) or `html` (one page); the last two are made from
+//! the signed records alone (`report`), and progress then goes to standard error.
+//!
 //! Exit status: 0 when every case passed, 1 when one did not, 2 for a usage error, 4 when
 //! the record would replace a file and `--yes` was not given, 5 when the suite, corpus
 //! or program is not found, 6 when the implementation's URL does not answer, 7 otherwise.
@@ -16,9 +31,11 @@
 mod adapter;
 mod http;
 pub mod record;
+mod report;
 pub mod suites;
 
 use super::envelope::{self, EXIT_FAILED, EXIT_INTERNAL, EXIT_NOT_FOUND, EXIT_UNAVAILABLE, OpError};
+use super::independent::{self, Verifier};
 use serde_json::{Map, Value, json};
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
@@ -27,10 +44,48 @@ use suites::{Case, Expect, Input, SUITES, Suite};
 
 pub const OP: &str = "conformance.run";
 
-const USAGE: &str = "wai conform <kind> --suite <suite> --impl <command or URL> [--key <file>] [--out <file>] [--yes]\n\
-    [--root <wai-dir>] [--timeout <seconds>] [--name <text>] [--version <text>] [--dry-run] [--all] [--json|--text]\n\
+const USAGE: &str = "wai conform <kind> --suite <suite> --impl <command or URL> [--independent] [--key <file>] [--out <file>] [--yes]\n\
+    [--root <wai-dir>] [--timeout <seconds>] [--name <text>] [--version <text>] [--python <program>] [--dry-run] [--all]\n\
+    [--format text|json|junit|html]\n\
+    wai conform --independent [--suite <area|name>[,...]] [--out <dir>] [--key <file>] [--root <wai-dir>] [--timeout <seconds>]\n\
+    [--python <program>] [--format text|json|junit|html] [--dry-run] [--yes]\n\
     wai conform --list";
 
+/// What a run prints on standard output.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Format {
+    Text,
+    /// The JSON envelope (`--json`).
+    Json,
+    /// JUnit XML, from the records.
+    Junit,
+    /// One HTML page, from the records.
+    Html,
+}
+
+/// The output `--format` (or `--json`, or `--text`) asks for; two that disagree are a usage error.
+pub fn format_of(args: &[String]) -> Result<Format, OpError> {
+    let json = envelope::json_wanted(args);
+    let named = match envelope::value(args, "--format", USAGE)? {
+        None => return Ok(if json { Format::Json } else { Format::Text }),
+        Some("text") => Format::Text,
+        Some("json") => Format::Json,
+        Some("junit") => Format::Junit,
+        Some("html") => Format::Html,
+        Some(x) => return Err(OpError::usage(format!("--format {x}: text, json, junit or html"), USAGE)),
+    };
+    if json && named != Format::Json {
+        return Err(OpError::usage("--json and --format name two outputs; give one", USAGE));
+    }
+    Ok(named)
+}
+
+/// The seconds an independent verifier may take over its whole corpus, unless `--timeout` says.
+const INDEPENDENT_TIMEOUT: u64 = 1800;
+
+/// What an independent run's one case expects.
+const WHOLE_CORPUS: &str = "exit 0: every case reaches the outcome the corpus states";
+
 /// How the implementation is reached.
 enum Impl {
     Command(String),
@@ -365,18 +420,28 @@ impl Run<'_> {
     }
 }
 
-fn list(json_mode: bool, root: Option<&Path>) {
+fn list(json_mode: bool, root: Option<&Path>, python: &str) {
     let rows: Vec<Value> = SUITES
         .iter()
         .map(|s| {
             let n = root.and_then(|r| (s.load)(&r.join(s.dir)).ok()).map(|l| l.cases.len());
             let adapters: Vec<&str> = [s.command.then_some("command"), s.http.then_some("http")].into_iter().flatten().collect();
-            json!({"kind": s.kind, "suite": s.name, "corpus": s.dir, "cases": n, "adapters": adapters, "about": s.about})
+            json!({"kind": s.kind, "suite": s.name, "corpus": s.dir, "cases": n, "adapters": adapters, "about": s.about, "independent": s.independent})
         })
         .collect();
+    let ind: Vec<Value> = independent::VERIFIERS
+        .iter()
+        .map(|v| json!({"name": v.name, "area": v.area, "corpus": v.dir, "command": independent::command_line(v, python, false), "verdicts": v.verdicts.is_some(), "needs": v.needs, "step_file": v.file}))
+        .collect();
+    let elsewhere: Vec<Value> = independent::NOT_HERE.iter().map(|(s, why)| json!({"verifier": s, "why": why})).collect();
     if json_mode {
         let mut m = Map::new();
         m.insert("suites".into(), Value::Array(rows));
+        m.insert("independent".into(), Value::Array(ind));
+        m.insert("independent_elsewhere".into(), Value::Array(elsewhere));
+        if let Some(why) = independent::TABLE_ABSENT {
+            m.insert("independent_absent".into(), json!(why));
+        }
         println!("{}", envelope::envelope("conformance.list", true, m));
         return;
     }
@@ -391,28 +456,228 @@ fn list(json_mode: bool, root: Option<&Path>) {
             r["about"].as_str().unwrap_or("")
         );
     }
+    println!("\nindependent verifiers, run in wai/ by `wai conform --independent [--suite <area|name>,...]`:");
+    if let Some(why) = independent::TABLE_ABSENT {
+        println!("  none: {why}");
+    }
+    for r in ind {
+        println!("{:<9} {:<22} {}", r["area"].as_str().unwrap_or(""), r["name"].as_str().unwrap_or(""), r["command"].as_str().unwrap_or(""));
+    }
+    println!("\nrun elsewhere, not by --independent:");
+    for r in elsewhere {
+        println!("  {}: {}", r["verifier"].as_str().unwrap_or(""), r["why"].as_str().unwrap_or(""));
+    }
 }
 
 pub fn main(args: &[String]) -> Result<bool, String> {
-    let json_mode = envelope::json_wanted(args);
-    match run(args, json_mode) {
+    let json_mode = matches!(format_of(args), Ok(Format::Json)) || envelope::json_wanted(args);
+    match run(args) {
         Ok(true) => Ok(true),
         Ok(false) => envelope::exit(EXIT_FAILED),
         Err(e) => envelope::fail(OP, json_mode, &e),
     }
 }
 
-fn run(args: &[String], json_mode: bool) -> Result<bool, OpError> {
-    let flags = ["--suite", "--impl", "--key", "--out", "--root", "--timeout", "--name", "--version", "--dry-run", "--all", "--json", "--text", "--list"];
-    let with_value = ["--suite", "--impl", "--key", "--out", "--root", "--timeout", "--name", "--version"];
+/// The parts of a record but its outcomes and signature.
+struct Head<'a> {
+    kind: &'a str,
+    suite: &'a str,
+    corpus_dir: &'a str,
+    corpus_files: usize,
+    digest: String,
+    adapter: &'a str,
+    imp: String,
+    name: Option<&'a str>,
+    version: Option<&'a str>,
+    files: Vec<Value>,
+    started: String,
+}
+
+/// A record (conformance-results §2) of `outcomes`, signed with `key` (§3).
+fn record_of(root: &Path, h: Head, outcomes: &[Outcome], key: &(ed25519_dalek::SigningKey, &str)) -> Result<Map<String, Value>, OpError> {
+    let passed = outcomes.iter().filter(|o| o.pass).count();
+    let mut rec = Map::new();
+    rec.insert("wai".into(), json!(record::FORMAT));
+    rec.insert("kind".into(), json!(h.kind));
+    rec.insert("suite".into(), json!(h.suite));
+    rec.insert("standard".into(), json!(standard_version(root)));
+    rec.insert("toolchain".into(), json!({"name": "wai", "version": env!("CARGO_PKG_VERSION")}));
+    rec.insert("corpus".into(), json!({"dir": h.corpus_dir, "files": h.corpus_files, "digest": h.digest}));
+    rec.insert("implementation".into(), json!({"adapter": h.adapter, "impl": h.imp, "name": h.name, "version": h.version, "files": h.files}));
+    rec.insert("started_at".into(), json!(h.started));
+    rec.insert("cases".into(), Value::Array(outcomes.iter().map(|o| json!({"name": o.name, "pass": o.pass, "expected": o.expected, "got": o.got})).collect()));
+    rec.insert("summary".into(), json!({"cases": outcomes.len(), "passed": passed, "failed": outcomes.len() - passed}));
+    rec.insert("conformant".into(), json!(!outcomes.is_empty() && passed == outcomes.len()));
+    rec.insert("key".into(), json!(key.1));
+    record::sign(rec, &key.0).map_err(|e| OpError::new(EXIT_INTERNAL, "internal", e, ""))
+}
+
+fn write_record(path: &Path, rec: &Map<String, Value>) -> Result<(), OpError> {
+    let text = serde_json::to_string_pretty(&Value::Object(rec.clone())).map_err(|e| OpError::new(EXIT_INTERNAL, "internal", e.to_string(), ""))?;
+    crate::out::write(path, format!("{text}\n")).map_err(|e| OpError::new(EXIT_INTERNAL, "internal", format!("{}: {e}", path.display()), ""))
+}
+
+/// The key a run signs with: `--key`'s file, or one made for the run.
+fn run_key(given: Option<&str>) -> Result<(ed25519_dalek::SigningKey, &'static str), OpError> {
+    match given {
+        Some(p) => Ok((record::key_from_file(Path::new(p)).map_err(|e| OpError::new(EXIT_NOT_FOUND, "key-not-read", e, "--key names a file holding a 32-byte Ed25519 seed in hexadecimal"))?, "supplied")),
+        None => Ok((record::ephemeral_key().map_err(|e| OpError::new(EXIT_INTERNAL, "internal", e, ""))?, "ephemeral")),
+    }
+}
+
+/// The files an independent verifier's command line names, with their SHA-256 (§2.2): the
+/// interpreter as found on `PATH`, the script, and every argument that is a file.
+fn verifier_files(v: &Verifier, root: &Path, python: &str, verdicts: bool) -> Vec<Value> {
+    let mut out = Vec::new();
+    let python_path = if python.contains('/') || python.contains('\\') {
+        Some(PathBuf::from(python))
+    } else {
+        std::env::var_os("PATH").and_then(|p| std::env::split_paths(&p).map(|d| d.join(python)).find(|p| p.is_file()))
+    };
+    if let Some(p) = python_path
+        && let Ok(b) = std::fs::read(&p)
+    {
+        out.push(json!({"path": p.to_string_lossy(), "sha256": adapter::sha256_hex(&b)}));
+    }
+    for w in independent::argv(v, verdicts) {
+        if let Ok(b) = std::fs::read(root.join(w))
+            && root.join(w).is_file()
+        {
+            out.push(json!({"path": w, "sha256": adapter::sha256_hex(&b)}));
+        }
+    }
+    out
+}
+
+/// A failed independent verifier's answer: how it ended, and a package it needs that is missing.
+fn independent_got(v: &Verifier, ran: &independent::Ran, python: &str) -> String {
+    let mut got = ran.verdict();
+    if !ran.passed() {
+        let missing = independent::missing_needs(v, python);
+        if !missing.is_empty() {
+            got.push_str(&format!(" (it needs the Python package {}: {python} -m pip install {})", missing.join(", "), missing.join(" ")));
+        }
+    }
+    cut(&got)
+}
+
+/// The corpus's independent verifier, run beside an implementation's run of `suite`.
+struct Beside {
+    verifier: &'static Verifier,
+    command: String,
+    record: Map<String, Value>,
+    conformant: bool,
+    /// Cases where the implementation and the independent verifier disagree ([`disagreements`]).
+    disagreements: Vec<Value>,
+}
+
+/// What an independent verifier's record beside an implementation's names it, so the two are
+/// told apart in a report (`implementation.name`).
+const INDEPENDENT_NAME: &str = "independent verifier";
+
+/// The cases, held case by case, on which the implementation (`imp`) and the independent
+/// verifier (`ind`) disagree: one passes and the other does not, or both pass with different
+/// answers, which a case the corpus states only the start of allows.
+fn disagreements(imp: &[Outcome], ind: &[Outcome]) -> Vec<Value> {
+    imp.iter()
+        .zip(ind)
+        .filter(|(a, b)| a.pass != b.pass || (a.pass && a.got != b.got))
+        .map(|(a, b)| json!({"name": a.name, "expected": a.expected, "implementation": a.got, "independent": b.got}))
+        .collect()
+}
+
+#[allow(clippy::too_many_arguments)]
+fn beside(root: &Path, kind: &str, suite: &Suite, loaded: &suites::Loaded, imp: &[Outcome], digest: &str, python: &str, timeout: Duration, key: &(ed25519_dalek::SigningKey, &str)) -> Result<Option<Beside>, OpError> {
+    let Some(name) = suite.independent else { return Ok(None) };
+    let v = independent::named(name).ok_or_else(|| OpError::internal(format!("{kind} {}: the independent verifier {name} is not in the table", suite.name)))?;
+    let verdicts = v.verdicts.is_some() && loaded.corpus_file.is_some();
+    let command = independent::command_line(v, python, verdicts);
+    let started = now_rfc3339();
+    eprintln!("wai conform: the independent verifier, {command}");
+    let ran = independent::run(v, root, python, verdicts, timeout).map_err(|e| OpError::new(EXIT_NOT_FOUND, "program-not-found", e, "install Python 3, or give --python <program>"))?;
+    let (outcomes, head) = if verdicts {
+        let mut got: HashMap<String, String> = HashMap::new();
+        for l in ran.stdout.lines() {
+            if let Some((n, g)) = l.split_once('\t') {
+                got.entry(n.to_string()).or_insert_with(|| g.trim().to_string());
+            }
+        }
+        let missing = if ran.timed_out { "timed out".to_string() } else { format!("no verdict ({})", independent_got(v, &ran, python)) };
+        let o: Vec<Outcome> = loaded
+            .cases
+            .iter()
+            .map(|c| {
+                let g = got.get(&c.name).cloned().unwrap_or_else(|| missing.clone());
+                Outcome { name: c.name.clone(), pass: judge(&c.expect, &g, None), expected: cut(&expected_text(&c.expect)), got: cut(&g) }
+            })
+            .collect();
+        let head = Head {
+            kind,
+            suite: suite.name,
+            corpus_dir: suite.dir,
+            corpus_files: loaded.files.len(),
+            digest: digest.to_string(),
+            adapter: "command",
+            imp: command.clone(),
+            name: Some(INDEPENDENT_NAME),
+            version: None,
+            files: verifier_files(v, root, python, true),
+            started,
+        };
+        (o, head)
+    } else {
+        let files = independent::corpus_files(v, root);
+        let head = Head {
+            kind: "verifier",
+            suite: v.name,
+            corpus_dir: v.dir,
+            corpus_files: files.len(),
+            digest: corpus_digest(root, &files)?,
+            adapter: "command",
+            imp: command.clone(),
+            name: Some(INDEPENDENT_NAME),
+            version: None,
+            files: verifier_files(v, root, python, false),
+            started,
+        };
+        (vec![Outcome { name: v.dir.to_string(), pass: ran.passed(), expected: WHOLE_CORPUS.into(), got: independent_got(v, &ran, python) }], head)
+    };
+    let disagreements: Vec<Value> = if verdicts { disagreements(imp, &outcomes) } else { Vec::new() };
+    let record = record_of(root, head, &outcomes, key)?;
+    let conformant = record.get("conformant") == Some(&Value::Bool(true));
+    Ok(Some(Beside { verifier: v, command, record, conformant, disagreements }))
+}
+
+/// Where the independent verifier's record goes beside the implementation's record `out`.
+fn beside_path(out: &Path) -> PathBuf {
+    let s = out.to_string_lossy();
+    PathBuf::from(match s.strip_suffix(record::SUFFIX) {
+        Some(stem) => format!("{stem}.independent{}", record::SUFFIX),
+        None => format!("{s}.independent{}", record::SUFFIX),
+    })
+}
+
+fn run(args: &[String]) -> Result<bool, OpError> {
+    let flags = [
+        "--suite", "--impl", "--key", "--out", "--root", "--timeout", "--name", "--version", "--dry-run", "--all", "--json", "--text", "--list", "--independent", "--format", "--python",
+    ];
+    let with_value = ["--suite", "--impl", "--key", "--out", "--root", "--timeout", "--name", "--version", "--format", "--python"];
     let pos = envelope::check_args(args, &flags, &with_value, 1, USAGE)?;
     let v = |f: &str| envelope::value(args, f, USAGE);
+    let fmt = format_of(args)?;
+    let python = v("--python")?.unwrap_or("python3").to_string();
     if args.iter().any(|a| a == "--list") {
         let root = wai_root(v("--root")?).ok();
-        list(json_mode, root.as_deref());
+        list(fmt == Format::Json, root.as_deref(), &python);
         return Ok(true);
     }
-    let kind = *pos.first().ok_or_else(|| OpError::usage(format!("name a kind: {}", suites::KINDS.join(", ")), USAGE))?;
+    let with_independent = args.iter().any(|a| a == "--independent");
+    let Some(kind) = pos.first().copied() else {
+        if with_independent {
+            return run_independent(args, fmt, &python);
+        }
+        return Err(OpError::usage(format!("name a kind ({}), or --independent for the corpora's own verifiers", suites::KINDS.join(", ")), USAGE));
+    };
     if !suites::KINDS.contains(&kind) {
         return Err(OpError::new(EXIT_NOT_FOUND, "kind-not-found", format!("{kind}: no suite of that kind; the kinds are {}", suites::KINDS.join(", ")), "wai conform --list names every kind and suite"));
     }
@@ -439,7 +704,8 @@ fn run(args: &[String], json_mode: bool) -> Result<bool, OpError> {
         }
         Impl::Command(imp_text.clone())
     };
-    let timeout = Duration::from_secs(v("--timeout")?.map(|t| t.parse::<u64>().map_err(|_| OpError::usage("--timeout takes whole seconds", USAGE))).transpose()?.unwrap_or(60));
+    let timeout_given = v("--timeout")?.map(|t| t.parse::<u64>().map_err(|_| OpError::usage("--timeout takes whole seconds", USAGE))).transpose()?;
+    let timeout = Duration::from_secs(timeout_given.unwrap_or(60));
     let root = wai_root(v("--root")?)?;
     let loaded = (suite.load)(&root.join(suite.dir)).map_err(|e| OpError::new(EXIT_NOT_FOUND, "corpus-not-read", e, "the corpus is incomplete; check out the standard again"))?;
     if loaded.cases.is_empty() {
@@ -450,9 +716,20 @@ fn run(args: &[String], json_mode: bool) -> Result<bool, OpError> {
         return Err(OpError::usage(format!("{kind} {}: {{corpus}} is for a verifier suite; this suite gives its cases one at a time", suite.name), USAGE));
     }
     let out = PathBuf::from(v("--out")?.map(String::from).unwrap_or_else(|| format!("{}{}", suite.name, record::SUFFIX)));
+    if with_independent && let Some(why) = independent::TABLE_ABSENT {
+        return Err(OpError::new(EXIT_NOT_FOUND, "no-independent-table", why, NO_TABLE_HINT));
+    }
+    let independent_entry = suite.independent.and_then(independent::named);
+    let out_beside = (with_independent && independent_entry.is_some()).then(|| beside_path(&out));
+    if with_independent && independent_entry.is_some() && !independent::program_found(&python) {
+        return Err(OpError::new(EXIT_NOT_FOUND, "program-not-found", format!("{python}: not found, and --independent runs the corpus's verifier with it"), "install Python 3, or give --python <program>"));
+    }
     if args.iter().any(|a| a == "--dry-run") {
-        // The record it would write, in the envelope's plan.
+        // The records it would write, in the envelope's plan.
         crate::out::would_write(&out);
+        if let Some(b) = &out_beside {
+            crate::out::would_write(b);
+        }
         let first = &loaded.cases[0];
         let plan = match &imp {
             Impl::Command(c) if whole => adapter::fill(c, &[("corpus", loaded.corpus_file.as_deref().unwrap_or(Path::new("")))]),
@@ -462,30 +739,36 @@ fn run(args: &[String], json_mode: bool) -> Result<bool, OpError> {
             }), ("out", Path::new("<out>"))]),
             Impl::Http(u) => format!("{} {}", if matches!(first.expect, Expect::Object { .. }) { "GET, HEAD and OPTIONS below" } else { "POST each case to" }, u.join("")),
         };
-        if json_mode {
+        let beside_plan = independent_entry.filter(|_| with_independent).map(|e| independent::command_line(e, &python, e.verdicts.is_some() && loaded.corpus_file.is_some()));
+        if fmt == Format::Json {
             let mut m = Map::new();
             m.insert("kind".into(), json!(kind));
             m.insert("suite".into(), json!(suite.name));
             m.insert("dry_run".into(), json!(true));
             m.insert("cases".into(), json!(loaded.cases.iter().map(|c| c.name.clone()).collect::<Vec<_>>()));
             m.insert("runs".into(), json!(plan));
+            m.insert("independent".into(), json!(beside_plan));
             m.insert("record".into(), json!(out.display().to_string()));
             println!("{}", envelope::envelope(OP, true, m));
         } else {
             println!("wai conform {kind} {}: {} cases from {}; would run: {plan}", suite.name, loaded.cases.len(), suite.dir);
+            if let Some(b) = &beside_plan {
+                println!("and beside it, in {}: {b}", root.display());
+            } else if with_independent {
+                println!("the {} corpus has no independent verifier to run beside it", suite.dir);
+            }
             println!("dry run: nothing was run and nothing written; the record would be written to {}", out.display());
         }
         return Ok(true);
     }
-    if out.exists() {
+    let replaced: Vec<&PathBuf> = std::iter::once(&out).chain(out_beside.as_ref()).filter(|p| p.exists()).collect();
+    if !replaced.is_empty() {
         // `--yes` (or its deprecated spelling `--confirm`), or yes at a terminal; otherwise exit 4
         // with the proposal and the confirming command.
-        envelope::confirm(&format!("{} exists, and the record would replace it", out.display()), vec![json!({"write": out.display().to_string(), "replaces": true})])?;
+        let names: Vec<String> = replaced.iter().map(|p| p.display().to_string()).collect();
+        envelope::confirm(&format!("{} exist{}, and the record would replace {}", names.join(" and "), if names.len() == 1 { "s" } else { "" }, if names.len() == 1 { "it" } else { "them" }), replaced.iter().map(|p| json!({"write": p.display().to_string(), "replaces": true})).collect())?;
     }
-    let key = match v("--key")? {
-        Some(p) => (record::key_from_file(Path::new(p)).map_err(|e| OpError::new(EXIT_NOT_FOUND, "key-not-read", e, "--key names a file holding a 32-byte Ed25519 seed in hexadecimal"))?, "supplied"),
-        None => (record::ephemeral_key().map_err(|e| OpError::new(EXIT_INTERNAL, "internal", e, ""))?, "ephemeral"),
-    };
+    let key = run_key(v("--key")?)?;
     let digest = corpus_digest(&root, &loaded.files)?;
     let started = now_rfc3339();
     let scratch = std::env::temp_dir().join(format!("wai-conform-{}-{}", std::process::id(), std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map(|d| d.as_nanos()).unwrap_or(0)));
@@ -516,65 +799,293 @@ fn run(args: &[String], json_mode: bool) -> Result<bool, OpError> {
         Impl::Command(c) => ("command", adapter::identity(c).into_iter().map(|(p, h)| json!({"path": p, "sha256": h})).collect::<Vec<_>>()),
         Impl::Http(_) => ("http", Vec::new()),
     };
-    let mut rec = Map::new();
-    rec.insert("wai".into(), json!(record::FORMAT));
-    rec.insert("kind".into(), json!(kind));
-    rec.insert("suite".into(), json!(suite.name));
-    rec.insert("standard".into(), json!(standard_version(&root)));
-    rec.insert("toolchain".into(), json!({"name": "wai", "version": env!("CARGO_PKG_VERSION")}));
-    rec.insert("corpus".into(), json!({"dir": suite.dir, "files": loaded.files.len(), "digest": digest}));
-    rec.insert("implementation".into(), json!({"adapter": adapter_name, "impl": imp_text, "name": v("--name")?, "version": v("--version")?, "files": files}));
-    rec.insert("started_at".into(), json!(started));
-    rec.insert("cases".into(), Value::Array(outcomes.iter().map(|o| json!({"name": o.name, "pass": o.pass, "expected": o.expected, "got": o.got})).collect()));
-    rec.insert("summary".into(), json!({"cases": outcomes.len(), "passed": passed, "failed": failed}));
-    rec.insert("conformant".into(), json!(conformant));
-    rec.insert("key".into(), json!(key.1));
-    let rec = record::sign(rec, &key.0).map_err(|e| OpError::new(EXIT_INTERNAL, "internal", e, ""))?;
-    let text = serde_json::to_string_pretty(&Value::Object(rec.clone())).map_err(|e| OpError::new(EXIT_INTERNAL, "internal", e.to_string(), ""))?;
-    crate::out::write(&out, format!("{text}\n")).map_err(|e| OpError::new(EXIT_INTERNAL, "internal", format!("{}: {e}", out.display()), ""))?;
-    let pubkey = rec.get("signer_pubkey").and_then(Value::as_str).unwrap_or("").to_string();
-    if json_mode {
-        let mut m = Map::new();
-        m.insert("kind".into(), json!(kind));
-        m.insert("suite".into(), json!(suite.name));
-        m.insert("cases".into(), json!(outcomes.len()));
-        m.insert("passed".into(), json!(passed));
-        m.insert("failed".into(), json!(failed));
-        m.insert("conformant".into(), json!(conformant));
-        m.insert("failures".into(), Value::Array(outcomes.iter().filter(|o| !o.pass).take(200).map(|o| json!({"name": o.name, "expected": o.expected, "got": o.got})).collect()));
-        m.insert("record".into(), json!(out.display().to_string()));
-        m.insert("corpus_digest".into(), json!(rec["corpus"]["digest"]));
-        m.insert("signer_pubkey".into(), json!(pubkey));
-        println!("{}", envelope::envelope(OP, conformant, m));
+    let head = Head { kind, suite: suite.name, corpus_dir: suite.dir, corpus_files: loaded.files.len(), digest: digest.clone(), adapter: adapter_name, imp: imp_text.clone(), name: v("--name")?, version: v("--version")?, files, started };
+    let rec = record_of(&root, head, &outcomes, &key)?;
+    write_record(&out, &rec)?;
+    let indep = if with_independent {
+        let t = Duration::from_secs(timeout_given.unwrap_or(INDEPENDENT_TIMEOUT));
+        let b = beside(&root, kind, suite, &loaded, &outcomes, &digest, &python, t, &key)?;
+        if let (Some(b), Some(p)) = (&b, &out_beside) {
+            write_record(p, &b.record)?;
+        }
+        b
     } else {
-        let all = args.iter().any(|a| a == "--all");
-        let mut shown = 0;
-        for o in &outcomes {
-            if o.pass && !all {
-                continue;
+        None
+    };
+    let all_ok = conformant && indep.as_ref().is_none_or(|b| b.conformant && b.disagreements.is_empty());
+    let pubkey = rec.get("signer_pubkey").and_then(Value::as_str).unwrap_or("").to_string();
+    let mut records = vec![rec.clone()];
+    if let Some(b) = &indep {
+        records.push(b.record.clone());
+    }
+    let say = |line: String| if fmt == Format::Text { println!("{line}") } else { eprintln!("{line}") };
+    match fmt {
+        Format::Json => {
+            let mut m = Map::new();
+            m.insert("kind".into(), json!(kind));
+            m.insert("suite".into(), json!(suite.name));
+            m.insert("cases".into(), json!(outcomes.len()));
+            m.insert("passed".into(), json!(passed));
+            m.insert("failed".into(), json!(failed));
+            m.insert("conformant".into(), json!(conformant));
+            m.insert("failures".into(), Value::Array(outcomes.iter().filter(|o| !o.pass).take(200).map(|o| json!({"name": o.name, "expected": o.expected, "got": o.got})).collect()));
+            m.insert("record".into(), json!(out.display().to_string()));
+            m.insert("corpus_digest".into(), json!(rec["corpus"]["digest"]));
+            m.insert("signer_pubkey".into(), json!(pubkey));
+            if with_independent {
+                m.insert(
+                    "independent".into(),
+                    match &indep {
+                        None => Value::Null,
+                        Some(b) => json!({
+                            "verifier": b.verifier.name,
+                            "command": b.command,
+                            "conformant": b.conformant,
+                            "cases": b.record["summary"]["cases"],
+                            "passed": b.record["summary"]["passed"],
+                            "failed": b.record["summary"]["failed"],
+                            "failures": b.record["cases"].as_array().map(|c| c.iter().filter(|x| x["pass"] != true).take(200).cloned().collect::<Vec<_>>()).unwrap_or_default(),
+                            "disagreements": b.disagreements,
+                            "record": out_beside.as_ref().map(|p| p.display().to_string()),
+                        }),
+                    },
+                );
             }
-            if !o.pass {
-                shown += 1;
-                if shown > 40 && !all {
+            println!("{}", envelope::envelope(OP, all_ok, m));
+        }
+        _ => {
+            let all = args.iter().any(|a| a == "--all");
+            let mut shown = 0;
+            for o in &outcomes {
+                if o.pass && !all {
                     continue;
                 }
+                if !o.pass {
+                    shown += 1;
+                    if shown > 40 && !all {
+                        continue;
+                    }
+                }
+                say(format!("{} {}", if o.pass { "PASS" } else { "FAIL" }, o.name));
+                if !o.pass {
+                    say(format!("     expected: {}", o.expected));
+                    say(format!("     got:      {}", o.got));
+                }
             }
-            println!("{} {}", if o.pass { "PASS" } else { "FAIL" }, o.name);
-            if !o.pass {
-                println!("     expected: {}", o.expected);
-                println!("     got:      {}", o.got);
+            if shown > 40 && !all {
+                say(format!("… and {} more failures (--all lists every case)", shown - 40));
+            }
+            say(format!("wai conform {kind} {}: {passed} of {} cases passed: {}", suite.name, outcomes.len(), if conformant { "conformant" } else { "not conformant" }));
+            say(format!("record: {} (signed by {}…, {} key); `wai verify {}` checks it", out.display(), pubkey.get(..16).unwrap_or(""), key.1, out.display()));
+            if with_independent {
+                match &indep {
+                    None => say(format!("independent: the {} corpus has no independent verifier", suite.dir)),
+                    Some(b) => {
+                        let s = &b.record["summary"];
+                        say(format!(
+                            "independent: {}: {} of {} cases passed: {}",
+                            b.command,
+                            s["passed"],
+                            s["cases"],
+                            if b.conformant { "it reaches every outcome the corpus states" } else { "it does not reach every outcome the corpus states" }
+                        ));
+                        for c in b.record["cases"].as_array().into_iter().flatten().filter(|c| c["pass"] != true).take(40) {
+                            say(format!("FAIL {} (independent)", c["name"].as_str().unwrap_or("")));
+                            say(format!("     expected: {}", c["expected"].as_str().unwrap_or("")));
+                            say(format!("     got:      {}", c["got"].as_str().unwrap_or("")));
+                        }
+                        if b.disagreements.is_empty() {
+                            if b.verifier.verdicts.is_some() {
+                                say("independent: it and the implementation agree on every case".into());
+                            }
+                        } else {
+                            say(format!("independent: it and the implementation disagree on {} case{}:", b.disagreements.len(), if b.disagreements.len() == 1 { "" } else { "s" }));
+                            for d in b.disagreements.iter().take(40) {
+                                say(format!("  {}: the implementation answered {}; the independent verifier {}; the corpus states {}", d["name"].as_str().unwrap_or(""), d["implementation"], d["independent"], d["expected"]));
+                            }
+                        }
+                        if let Some(p) = &out_beside {
+                            say(format!("record: {} (the independent verifier's)", p.display()));
+                        }
+                    }
+                }
+            }
+            match fmt {
+                Format::Junit => print!("{}", report::junit(&records)),
+                Format::Html => print!("{}", report::html(&records)),
+                _ => {}
             }
         }
-        if shown > 40 && !all {
-            println!("… and {} more failures (--all lists every case)", shown - 40);
-        }
-        println!(
-            "wai conform {kind} {}: {passed} of {} cases passed: {}",
-            suite.name,
-            outcomes.len(),
-            if conformant { "conformant" } else { "not conformant" }
-        );
-        println!("record: {} (signed by {}…, {} key); `wai verify {}` checks it", out.display(), pubkey.get(..16).unwrap_or(""), key.1, out.display());
     }
-    Ok(conformant)
+    Ok(all_ok)
+}
+
+/// What a build without the table of independent verifiers is told to do.
+const NO_TABLE_HINT: &str = "build wai from a checkout of the repository: build.rs reads the table from .github/wai-conformance/verifiers/";
+
+/// `wai conform --independent`: every independent verifier `--suite` selects (all of them
+/// without it), each over its corpus, in `wai/`; a record each, written to `--out <dir>`.
+fn run_independent(args: &[String], fmt: Format, python: &str) -> Result<bool, OpError> {
+    let v = |f: &str| envelope::value(args, f, USAGE);
+    for f in ["--impl", "--name", "--version"] {
+        if v(f)?.is_some() {
+            return Err(OpError::usage(format!("{f} names an implementation of a kind; --independent alone runs the corpora's own verifiers (give a kind to run both)"), USAGE));
+        }
+    }
+    let chosen = independent::select(v("--suite")?).map_err(|e| match independent::TABLE_ABSENT {
+        Some(_) => OpError::new(EXIT_NOT_FOUND, "no-independent-table", e, NO_TABLE_HINT),
+        None => OpError::new(EXIT_NOT_FOUND, "suite-not-found", e, "wai conform --list names every area and independent verifier"),
+    })?;
+    let timeout = Duration::from_secs(v("--timeout")?.map(|t| t.parse::<u64>().map_err(|_| OpError::usage("--timeout takes whole seconds", USAGE))).transpose()?.unwrap_or(INDEPENDENT_TIMEOUT));
+    let root = wai_root(v("--root")?)?;
+    let out_dir = v("--out")?.map(PathBuf::from);
+    if out_dir.as_ref().is_some_and(|d| d.exists() && !d.is_dir()) {
+        return Err(OpError::usage("--out with --independent alone names a directory, for a record a corpus", USAGE));
+    }
+    let record_path = |n: &str| out_dir.as_ref().map(|d| d.join(format!("{n}{}", record::SUFFIX)));
+    if args.iter().any(|a| a == "--dry-run") {
+        let commands: Vec<Value> = chosen.iter().map(|e| json!({"name": e.name, "area": e.area, "command": independent::command_line(e, python, false)})).collect();
+        if let Some(d) = &out_dir {
+            crate::out::create_dir_all(d).map_err(|e| OpError::internal(e.to_string()))?;
+        }
+        for e in &chosen {
+            if let Some(p) = record_path(e.name) {
+                crate::out::would_write(p);
+            }
+        }
+        if fmt == Format::Json {
+            let mut m = Map::new();
+            m.insert("dry_run".into(), json!(true));
+            m.insert("independent".into(), Value::Array(commands));
+            m.insert("root".into(), json!(root.display().to_string()));
+            println!("{}", envelope::envelope(OP, true, m));
+        } else {
+            println!("wai conform --independent: {} verifier{}, each run in {}; would run:", chosen.len(), if chosen.len() == 1 { "" } else { "s" }, root.display());
+            for c in &commands {
+                println!("  {}", c["command"].as_str().unwrap_or(""));
+            }
+            println!("dry run: nothing was run and nothing written{}", out_dir.as_ref().map(|d| format!("; the records would be written to {}", d.display())).unwrap_or_default());
+        }
+        return Ok(true);
+    }
+    if !independent::program_found(python) {
+        return Err(OpError::new(EXIT_NOT_FOUND, "program-not-found", format!("{python}: not found; the independent verifiers are Python programs"), "install Python 3, or give --python <program>"));
+    }
+    let replaced: Vec<PathBuf> = chosen.iter().filter_map(|e| record_path(e.name)).filter(|p| p.exists()).collect();
+    if !replaced.is_empty() {
+        envelope::confirm(
+            &format!("{} record{} in {} exist{}, and this run would replace {}", replaced.len(), if replaced.len() == 1 { "" } else { "s" }, out_dir.as_ref().map(|d| d.display().to_string()).unwrap_or_default(), if replaced.len() == 1 { "s" } else { "" }, if replaced.len() == 1 { "it" } else { "them" }),
+            replaced.iter().map(|p| json!({"write": p.display().to_string(), "replaces": true})).collect(),
+        )?;
+    }
+    let key = run_key(v("--key")?)?;
+    let say = |line: String| if fmt == Format::Text { println!("{line}") } else { eprintln!("{line}") };
+    say(format!("wai conform --independent: {} verifier{}, each run in {}", chosen.len(), if chosen.len() == 1 { "" } else { "s" }, root.display()));
+    let mut records = Vec::new();
+    let mut rows = Vec::new();
+    for e in &chosen {
+        let command = independent::command_line(e, python, false);
+        let started = now_rfc3339();
+        let ran = independent::run(e, &root, python, false, timeout).map_err(|x| OpError::new(EXIT_NOT_FOUND, "program-not-found", x, "install Python 3, or give --python <program>"))?;
+        let pass = ran.passed();
+        let got = independent_got(e, &ran, python);
+        if pass {
+            say(format!("PASS {:<22} {:>7.1} s  {command}", e.name, ran.seconds));
+        } else {
+            say(format!("FAIL {:<22} {:>7.1} s  {command}", e.name, ran.seconds));
+            say(format!("     {got}"));
+            for l in ran.tail(40).lines() {
+                say(format!("     | {l}"));
+            }
+        }
+        let files = independent::corpus_files(e, &root);
+        let head = Head {
+            kind: "verifier",
+            suite: e.name,
+            corpus_dir: e.dir,
+            corpus_files: files.len(),
+            digest: corpus_digest(&root, &files)?,
+            adapter: "command",
+            imp: command.clone(),
+            name: None,
+            version: None,
+            files: verifier_files(e, &root, python, false),
+            started,
+        };
+        let rec = record_of(&root, head, &[Outcome { name: e.dir.to_string(), pass, expected: WHOLE_CORPUS.into(), got: got.clone() }], &key)?;
+        rows.push(json!({"name": e.name, "area": e.area, "corpus": e.dir, "command": command, "pass": pass, "exit_code": ran.code, "timed_out": ran.timed_out, "seconds": (ran.seconds * 10.0).round() / 10.0, "got": got, "output_tail": if pass { Value::Null } else { json!(ran.tail(40)) }}));
+        records.push(rec);
+    }
+    if let Some(d) = &out_dir {
+        crate::out::create_dir_all(d).map_err(|e| OpError::internal(format!("{}: {e}", d.display())))?;
+        for (e, r) in chosen.iter().zip(&records) {
+            write_record(&d.join(format!("{}{}", e.name, record::SUFFIX)), r)?;
+        }
+    }
+    let passed = rows.iter().filter(|r| r["pass"] == true).count();
+    let failed = rows.len() - passed;
+    let pubkey = records.first().and_then(|r| r.get("signer_pubkey")).and_then(Value::as_str).unwrap_or("").to_string();
+    let summary = format!(
+        "wai conform --independent: {passed} of {} independent verifiers passed{}",
+        rows.len(),
+        if failed == 0 { String::new() } else { format!("; failed: {}", rows.iter().filter(|r| r["pass"] != true).filter_map(|r| r["name"].as_str()).collect::<Vec<_>>().join(", ")) }
+    );
+    match fmt {
+        Format::Json => {
+            let mut m = Map::new();
+            m.insert("independent".into(), Value::Array(rows));
+            m.insert("cases".into(), json!(passed + failed));
+            m.insert("passed".into(), json!(passed));
+            m.insert("failed".into(), json!(failed));
+            m.insert("conformant".into(), json!(failed == 0));
+            m.insert("records".into(), json!(out_dir.as_ref().map(|d| d.display().to_string())));
+            m.insert("signer_pubkey".into(), json!(pubkey));
+            println!("{}", envelope::envelope(OP, failed == 0, m));
+        }
+        _ => {
+            say(summary);
+            if let Some(d) = &out_dir {
+                say(format!("records: {} ({} of them, signed by {}…, {} key); `wai verify {}` checks them", d.display(), records.len(), pubkey.get(..16).unwrap_or(""), key.1, d.display()));
+            }
+            match fmt {
+                Format::Junit => print!("{}", report::junit(&records)),
+                Format::Html => print!("{}", report::html(&records)),
+                _ => {}
+            }
+        }
+    }
+    Ok(failed == 0)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn o(name: &str, pass: bool, got: &str) -> Outcome {
+        Outcome { name: name.into(), pass, expected: "accept link_hash=…".into(), got: got.into() }
+    }
+
+    #[test]
+    fn two_answers_that_both_pass_but_differ_are_a_disagreement() {
+        let imp = [o("a", true, "accept link_hash=aa"), o("b", true, "accept link_hash=aa"), o("c", false, "reject"), o("d", true, "x"), o("e", false, "y")];
+        let ind = [o("a", true, "accept link_hash=aa"), o("b", true, "accept link_hash=bb"), o("c", true, "accept link_hash=cc"), o("d", false, "z"), o("e", false, "w")];
+        let d = disagreements(&imp, &ind);
+        let names: Vec<&str> = d.iter().map(|x| x["name"].as_str().unwrap()).collect();
+        // b: both pass a case the corpus states only the start of, with two link hashes.
+        assert_eq!(names, vec!["b", "c", "d"], "{d:#?}");
+        assert_eq!((d[0]["implementation"].as_str(), d[0]["independent"].as_str()), (Some("accept link_hash=aa"), Some("accept link_hash=bb")));
+    }
+
+    #[test]
+    fn each_oer_runs_record_digests_the_file_it_reads() {
+        let root = Path::new(env!("CARGO_MANIFEST_DIR")).parent().unwrap();
+        let digest = |n: &str| corpus_digest(root, &independent::corpus_files(independent::named(n).unwrap(), root)).unwrap();
+        let d: Vec<String> = ["oer", "oer-firmware", "oer-edge", "oer-job"].iter().map(|n| digest(n)).collect();
+        for i in 0..d.len() {
+            for j in 0..i {
+                assert_ne!(d[i], d[j], "two OER runs over different vectors files have different corpus digests");
+            }
+        }
+        assert_eq!(d[0], corpus_digest(root, &[root.join("oer-conformance/vectors.json")]).unwrap(), "the digest of the one file it reads");
+    }
 }
diff --git a/wai/wai-rs/src/bin/wai_cli/dx/conform/report.rs b/wai/wai-rs/src/bin/wai_cli/dx/conform/report.rs
new file mode 100644
index 000000000..12f61464f
--- /dev/null
+++ b/wai/wai-rs/src/bin/wai_cli/dx/conform/report.rs
@@ -0,0 +1,264 @@
+//! A run's result records (`conform-result/1`) written for a reader other than `wai verify`:
+//! JUnit XML for a CI system's test report, and one HTML page for a person. Both are made from
+//! the signed records alone, so they say what the records say: a suite a record, a test case a
+//! case, a failure exactly where a case did not pass, with what the corpus states and what the
+//! implementation answered. A record's corpus digest, implementation, standard and signing key
+//! go with it, so a reader can find the record a report came from.
+
+use serde_json::{Map, Value};
+
+/// Text made safe for XML 1.0 character data and attribute values: the five markup
+/// characters escaped, and every character XML 1.0 does not allow (C0 controls but tab, line
+/// feed and carriage return) replaced by U+FFFD.
+pub fn xml_escape(s: &str) -> String {
+    let mut out = String::with_capacity(s.len());
+    for c in s.chars() {
+        match c {
+            '&' => out.push_str("&amp;"),
+            '<' => out.push_str("&lt;"),
+            '>' => out.push_str("&gt;"),
+            '"' => out.push_str("&quot;"),
+            '\'' => out.push_str("&apos;"),
+            '\t' | '\n' | '\r' => out.push(c),
+            c if (c as u32) < 0x20 || c == '\u{FFFE}' || c == '\u{FFFF}' => out.push('\u{FFFD}'),
+            c => out.push(c),
+        }
+    }
+    out
+}
+
+/// Text made safe for HTML: the five markup characters escaped, control characters replaced.
+pub fn html_escape(s: &str) -> String {
+    xml_escape(s).replace("&apos;", "&#39;")
+}
+
+fn s<'a>(r: &'a Map<String, Value>, k: &str) -> &'a str {
+    r.get(k).and_then(Value::as_str).unwrap_or("")
+}
+
+fn sub<'a>(r: &'a Map<String, Value>, k: &str, m: &str) -> &'a str {
+    r.get(k).and_then(|v| v.get(m)).and_then(Value::as_str).unwrap_or("")
+}
+
+fn cases(r: &Map<String, Value>) -> &[Value] {
+    r.get("cases").and_then(Value::as_array).map(Vec::as_slice).unwrap_or(&[])
+}
+
+fn failed(r: &Map<String, Value>) -> usize {
+    cases(r).iter().filter(|c| c["pass"] != Value::Bool(true)).count()
+}
+
+/// A record's name in a report: its kind and its suite, and the implementation's name where the
+/// record gives one (an independent verifier's record beside an implementation's gives
+/// `independent verifier`), so two records of one suite are told apart.
+pub fn title(r: &Map<String, Value>) -> String {
+    match sub(r, "implementation", "name") {
+        "" => format!("{} {}", s(r, "kind"), s(r, "suite")),
+        n => format!("{} {} ({n})", s(r, "kind"), s(r, "suite")),
+    }
+}
+
+/// A record's JUnit class name: `<kind>.<suite>`, then the implementation's name where the record
+/// gives one, as one more component (`verifier.signer.independent_verifier`): a character other
+/// than a letter, a digit, `-` or `_` becomes `_`, so the name adds one component and no more.
+pub fn classname(r: &Map<String, Value>) -> String {
+    let mut c = format!("{}.{}", s(r, "kind"), s(r, "suite"));
+    let n = sub(r, "implementation", "name");
+    if !n.is_empty() {
+        c.push('.');
+        c.extend(n.chars().map(|ch| if ch.is_alphanumeric() || ch == '-' || ch == '_' { ch } else { '_' }));
+    }
+    c
+}
+
+/// The JUnit XML report of `records`: one `testsuite` a record, one `testcase` a case, and a
+/// `failure` on each case that did not pass.
+pub fn junit(records: &[Map<String, Value>]) -> String {
+    let total: usize = records.iter().map(|r| cases(r).len()).sum();
+    let fails: usize = records.iter().map(failed).sum();
+    let mut x = String::from("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n");
+    x += &format!("<testsuites name=\"wai conform\" tests=\"{total}\" failures=\"{fails}\" errors=\"0\">\n");
+    for r in records {
+        let class = xml_escape(&classname(r));
+        x += &format!(
+            "  <testsuite name=\"{}\" tests=\"{}\" failures=\"{}\" errors=\"0\" skipped=\"0\" timestamp=\"{}\">\n",
+            xml_escape(&title(r)),
+            cases(r).len(),
+            failed(r),
+            xml_escape(s(r, "started_at").trim_end_matches('Z'))
+        );
+        x += "    <properties>\n";
+        let props = [
+            ("standard", s(r, "standard").to_string()),
+            ("toolchain", format!("{} {}", sub(r, "toolchain", "name"), sub(r, "toolchain", "version"))),
+            ("corpus", sub(r, "corpus", "dir").to_string()),
+            ("corpus_digest", sub(r, "corpus", "digest").to_string()),
+            ("adapter", sub(r, "implementation", "adapter").to_string()),
+            ("implementation", sub(r, "implementation", "impl").to_string()),
+            ("conformant", r.get("conformant").map(Value::to_string).unwrap_or_default()),
+            ("key", s(r, "key").to_string()),
+            ("signer_pubkey", s(r, "signer_pubkey").to_string()),
+        ];
+        for (k, v) in props {
+            x += &format!("      <property name=\"{k}\" value=\"{}\"/>\n", xml_escape(&v));
+        }
+        x += "    </properties>\n";
+        for c in cases(r) {
+            let name = xml_escape(c["name"].as_str().unwrap_or(""));
+            if c["pass"] == Value::Bool(true) {
+                x += &format!("    <testcase classname=\"{class}\" name=\"{name}\"/>\n");
+            } else {
+                let (e, g) = (c["expected"].as_str().unwrap_or(""), c["got"].as_str().unwrap_or(""));
+                x += &format!("    <testcase classname=\"{class}\" name=\"{name}\">\n");
+                x += &format!(
+                    "      <failure message=\"{}\" type=\"not-as-the-corpus-states\">expected: {}\ngot: {}</failure>\n",
+                    xml_escape(&format!("expected {e}; got {g}")),
+                    xml_escape(e),
+                    xml_escape(g)
+                );
+                x += "    </testcase>\n";
+            }
+        }
+        x += "  </testsuite>\n";
+    }
+    x += "</testsuites>\n";
+    x
+}
+
+/// The HTML report of `records`: one page, a section a record, its facts and every case, the
+/// failed ones marked.
+pub fn html(records: &[Map<String, Value>]) -> String {
+    let total: usize = records.iter().map(|r| cases(r).len()).sum();
+    let fails: usize = records.iter().map(failed).sum();
+    let conformant = records.iter().filter(|r| r.get("conformant") == Some(&Value::Bool(true))).count();
+    let mut h = String::from("<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>WAI conformance report</title>\n<style>\n");
+    h += ":root{--bg:#fff;--fg:#1b1b1b;--muted:#5d5d5d;--line:#d9d9d9;--pass:#1f6f3f;--fail:#a4262c;--fail-bg:#fdf0f0}\n";
+    h += "@media (prefers-color-scheme: dark){:root{--bg:#141414;--fg:#e8e8e8;--muted:#a3a3a3;--line:#333;--pass:#6fcf97;--fail:#ff8a8a;--fail-bg:#2a1717}}\n";
+    h += "body{margin:0 auto;max-width:72rem;padding:1.5rem 1rem;background:var(--bg);color:var(--fg);font:15px/1.5 system-ui,sans-serif}\n";
+    h += "h1{font-size:1.4rem;margin:0 0 .25rem}h2{font-size:1.1rem;margin:2rem 0 .5rem}p{margin:.25rem 0}\n";
+    h += "dl{display:grid;grid-template-columns:max-content 1fr;gap:.15rem 1rem;margin:.5rem 0;color:var(--muted)}dd{margin:0;overflow-wrap:anywhere;color:var(--fg)}\n";
+    h += "table{border-collapse:collapse;width:100%;font-size:.9rem}th,td{text-align:left;vertical-align:top;padding:.3rem .5rem;border-bottom:1px solid var(--line);overflow-wrap:anywhere}\n";
+    h += "code{font:.85rem ui-monospace,monospace}.pass{color:var(--pass)}.fail{color:var(--fail);font-weight:600}tr.fail td{background:var(--fail-bg)}\n";
+    h += "</style>\n</head>\n<body>\n<h1>WAI conformance report</h1>\n";
+    h += &format!(
+        "<p>{} of {} case{} passed in {} run{}; {} of {} conformant. Each section is one signed record, which <code>wai verify</code> checks.</p>\n",
+        total - fails,
+        total,
+        if total == 1 { "" } else { "s" },
+        records.len(),
+        if records.len() == 1 { "" } else { "s" },
+        conformant,
+        records.len()
+    );
+    for r in records {
+        let ok = r.get("conformant") == Some(&Value::Bool(true));
+        let n = cases(r).len();
+        h += &format!(
+            "<section>\n<h2>{} — <span class=\"{}\">{}</span></h2>\n<p>{} of {} case{} passed.</p>\n<dl>\n",
+            html_escape(&title(r)),
+            if ok { "pass" } else { "fail" },
+            if ok { "conformant" } else { "not conformant" },
+            n - failed(r),
+            n,
+            if n == 1 { "" } else { "s" }
+        );
+        let facts = [
+            ("implementation", sub(r, "implementation", "impl").to_string()),
+            ("corpus", format!("{} ({})", sub(r, "corpus", "dir"), sub(r, "corpus", "digest"))),
+            ("standard", s(r, "standard").to_string()),
+            ("toolchain", format!("{} {}", sub(r, "toolchain", "name"), sub(r, "toolchain", "version"))),
+            ("started", s(r, "started_at").to_string()),
+            ("signed by", format!("{} ({} key)", s(r, "signer_pubkey"), s(r, "key"))),
+        ];
+        for (k, v) in facts {
+            h += &format!("<dt>{k}</dt><dd><code>{}</code></dd>\n", html_escape(&v));
+        }
+        h += "</dl>\n<table>\n<thead><tr><th>case</th><th>outcome</th><th>expected</th><th>got</th></tr></thead>\n<tbody>\n";
+        for c in cases(r) {
+            let pass = c["pass"] == Value::Bool(true);
+            h += &format!(
+                "<tr class=\"{}\"><td><code>{}</code></td><td class=\"{}\">{}</td><td><code>{}</code></td><td><code>{}</code></td></tr>\n",
+                if pass { "pass" } else { "fail" },
+                html_escape(c["name"].as_str().unwrap_or("")),
+                if pass { "pass" } else { "fail" },
+                if pass { "pass" } else { "FAIL" },
+                html_escape(c["expected"].as_str().unwrap_or("")),
+                html_escape(c["got"].as_str().unwrap_or(""))
+            );
+        }
+        h += "</tbody>\n</table>\n</section>\n";
+    }
+    h += "</body>\n</html>\n";
+    h
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    fn record(cases: Value, conformant: bool) -> Map<String, Value> {
+        json!({
+            "wai": "conform-result/1", "kind": "verifier", "suite": "claim", "standard": "v0.4.0",
+            "toolchain": {"name": "wai", "version": "0.4.0"},
+            "corpus": {"dir": "claim-conformance", "files": 1, "digest": "sha256:00"},
+            "implementation": {"adapter": "command", "impl": "v <x> & 'y'", "name": null, "version": null, "files": []},
+            "started_at": "2026-11-04T10:00:00Z", "cases": cases,
+            "summary": {}, "conformant": conformant, "key": "ephemeral", "signer_pubkey": "ab", "sig": "cd"
+        })
+        .as_object()
+        .unwrap()
+        .clone()
+    }
+
+    #[test]
+    fn markup_and_characters_xml_refuses_are_escaped() {
+        assert_eq!(xml_escape("a<b>&\"c'"), "a&lt;b&gt;&amp;&quot;c&apos;");
+        assert_eq!(xml_escape("x\u{0}y\u{1b}z\tw\n"), "x\u{FFFD}y\u{FFFD}z\tw\n");
+        assert_eq!(html_escape("'"), "&#39;");
+    }
+
+    #[test]
+    fn junit_has_a_failure_exactly_where_a_case_failed() {
+        let r = record(json!([{"name": "ok", "pass": true, "expected": "a", "got": "a"}, {"name": "<bad>", "pass": false, "expected": "accept", "got": "reject \u{0} & more"}]), false);
+        let x = junit(&[r.clone(), r]);
+        assert!(x.starts_with("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<testsuites name=\"wai conform\" tests=\"4\" failures=\"2\""), "{x}");
+        assert_eq!(x.matches("<testsuite ").count(), 2);
+        assert_eq!(x.matches("<testcase ").count(), 4);
+        assert_eq!(x.matches("<failure ").count(), 2);
+        assert!(x.contains("name=\"&lt;bad&gt;\""), "{x}");
+        assert!(x.contains("got: reject \u{FFFD} &amp; more</failure>"), "{x}");
+        assert!(x.contains("<property name=\"implementation\" value=\"v &lt;x&gt; &amp; &apos;y&apos;\"/>"), "{x}");
+        assert!(!x.contains('\u{0}'));
+        // Every element opened is closed: the counts balance.
+        for t in ["testsuites", "testsuite", "properties", "failure"] {
+            assert_eq!(x.matches(&format!("<{t} ")).count() + x.matches(&format!("<{t}>")).count(), x.matches(&format!("</{t}>")).count(), "{t}");
+        }
+    }
+
+    #[test]
+    fn a_record_with_an_implementations_name_is_told_apart() {
+        let plain = record(json!([{"name": "ok", "pass": true, "expected": "a", "got": "a"}]), true);
+        let mut named = plain.clone();
+        named["implementation"]["name"] = json!("independent verifier");
+        assert_eq!((title(&plain), classname(&plain)), ("verifier claim".to_string(), "verifier.claim".to_string()));
+        assert_eq!((title(&named), classname(&named)), ("verifier claim (independent verifier)".to_string(), "verifier.claim.independent_verifier".to_string()));
+        let x = junit(&[plain.clone(), named.clone()]);
+        assert!(x.contains("<testsuite name=\"verifier claim\" ") && x.contains("<testsuite name=\"verifier claim (independent verifier)\" "), "{x}");
+        assert!(x.contains("classname=\"verifier.claim\" ") && x.contains("classname=\"verifier.claim.independent_verifier\" "), "{x}");
+        let h = html(&[plain, named]);
+        assert!(h.contains("<h2>verifier claim (independent verifier) — "), "{h}");
+    }
+
+    #[test]
+    fn html_names_every_case_and_marks_the_failed_ones() {
+        let r = record(json!([{"name": "ok", "pass": true, "expected": "a", "got": "a"}, {"name": "<script>", "pass": false, "expected": "x", "got": "y"}]), false);
+        let h = html(&[r]);
+        assert!(h.starts_with("<!doctype html>") && h.contains("<title>WAI conformance report</title>"));
+        assert!(h.contains("1 of 2 cases passed in 1 run; 0 of 1 conformant"), "{h}");
+        assert_eq!(h.matches("<tr class=\"fail\">").count(), 1);
+        assert_eq!(h.matches("<tr class=\"pass\">").count(), 1);
+        assert!(h.contains("&lt;script&gt;") && !h.contains("<script>"), "{h}");
+        assert!(h.contains("not conformant"));
+    }
+}
diff --git a/wai/wai-rs/src/bin/wai_cli/dx/conform/suites.rs b/wai/wai-rs/src/bin/wai_cli/dx/conform/suites.rs
index 798e83ddb..8333d9cdb 100644
--- a/wai/wai-rs/src/bin/wai_cli/dx/conform/suites.rs
+++ b/wai/wai-rs/src/bin/wai_cli/dx/conform/suites.rs
@@ -12,6 +12,11 @@
 //! | packager | `policy` | `pack-conformance/` | a policy file | it is admitted with the declared digest, or refused with the declared reason (packaging §3, §12) |
 //! | origin | `http` | `http-conformance/objects/` | an object | it is served as http-delivery §5.3 and §6.2 require: bytes, headers, ranges, head proof, preflight |
 //! | sink | `native-sink` | `live-conformance/native-sink/vectors.json` | one session, its answers withheld, or one configuration | the answers the sink writes, one a line in RFC 8785 form, have the SHA-256 of the answers the corpus states (native-sink §10) |
+//!
+//! Each suite names its corpus's independent verifier where there is one (`claim`, `jwp`,
+//! `signer` and `conform-result` case by case, through their `verdicts` mode; `http` and
+//! `native-sink` over the whole corpus); the score and policy corpora have none here (the packaging corpus's,
+//! `pack_verify.py`, runs in wai-pack.yml beside the reference packager).
 
 use serde_json::Value;
 use std::path::{Path, PathBuf};
@@ -65,19 +70,23 @@ pub struct Suite {
     pub http: bool,
     pub command: bool,
     pub load: fn(&Path) -> Result<Loaded, String>,
+    /// The corpus's independent verifier (`dx::independent`), which `--independent` runs beside
+    /// the implementation: case by case where it has a `verdicts` mode, over the whole corpus
+    /// otherwise; none where the corpus has no second implementation.
+    pub independent: Option<&'static str>,
 }
 
 pub const KINDS: &[&str] = &["verifier", "decoder", "packager", "origin", "sink"];
 
 pub const SUITES: &[Suite] = &[
-    Suite { kind: "verifier", name: "claim", dir: "claim-conformance", about: "typed claim receipts (jwp-receipts §3.1): accept with the link hash, or reject at a step with a reason", http: true, command: true, load: claim },
-    Suite { kind: "verifier", name: "jwp", dir: "jwp-conformance", about: "labelled leaves, group receipts, totals, chains and the binary form (jwp-receipts §2–§6)", http: true, command: true, load: jwp },
-    Suite { kind: "verifier", name: "signer", dir: "signer-conformance", about: "key discovery, signing authority and module authorisation (jwp-receipts §7)", http: true, command: true, load: stated_lines },
-    Suite { kind: "verifier", name: "conform-result", dir: "conform-result-conformance", about: "conformance results, the signed record of a run (conformance-results §4)", http: true, command: true, load: stated_lines },
-    Suite { kind: "decoder", name: "score", dir: "score-conformance", about: "a WSCR score rendered to its canonical i16le PCM (the score extension's mixdown-equivalence)", http: true, command: true, load: score },
-    Suite { kind: "packager", name: "policy", dir: "pack-conformance", about: "packaging policies admitted with their digest, or refused with their reason (packaging §3, §12)", http: true, command: true, load: policy },
-    Suite { kind: "origin", name: "http", dir: "http-conformance", about: "objects, head proofs, ranges and headers as an origin serves them (http-delivery §5.3, §6.2)", http: true, command: false, load: http_origin },
-    Suite { kind: "sink", name: "native-sink", dir: "live-conformance/native-sink", about: "a native sink's answer to every call of a session, byte for byte, and its refusal of a configuration (native-sink §10)", http: true, command: true, load: native_sink },
+    Suite { kind: "verifier", name: "claim", dir: "claim-conformance", about: "typed claim receipts (jwp-receipts §3.1): accept with the link hash, or reject at a step with a reason", http: true, command: true, load: claim, independent: Some("claim") },
+    Suite { kind: "verifier", name: "jwp", dir: "jwp-conformance", about: "labelled leaves, group receipts, totals, chains and the binary form (jwp-receipts §2–§6)", http: true, command: true, load: jwp, independent: Some("jwp") },
+    Suite { kind: "verifier", name: "signer", dir: "signer-conformance", about: "key discovery, signing authority and module authorisation (jwp-receipts §7)", http: true, command: true, load: stated_lines, independent: Some("signer") },
+    Suite { kind: "verifier", name: "conform-result", dir: "conform-result-conformance", about: "conformance results, the signed record of a run (conformance-results §4)", http: true, command: true, load: stated_lines, independent: Some("conform-result") },
+    Suite { kind: "decoder", name: "score", dir: "score-conformance", about: "a WSCR score rendered to its canonical i16le PCM (the score extension's mixdown-equivalence)", http: true, command: true, load: score, independent: None },
+    Suite { kind: "packager", name: "policy", dir: "pack-conformance", about: "packaging policies admitted with their digest, or refused with their reason (packaging §3, §12)", http: true, command: true, load: policy, independent: None },
+    Suite { kind: "origin", name: "http", dir: "http-conformance", about: "objects, head proofs, ranges and headers as an origin serves them (http-delivery §5.3, §6.2)", http: true, command: false, load: http_origin, independent: Some("http") },
+    Suite { kind: "sink", name: "native-sink", dir: "live-conformance/native-sink", about: "a native sink's answer to every call of a session, byte for byte, and its refusal of a configuration (native-sink §10)", http: true, command: true, load: native_sink, independent: Some("native-sink") },
 ];
 
 fn read_json(p: &Path) -> Result<Value, String> {
@@ -297,6 +306,50 @@ mod tests {
     use super::*;
     use serde_json::json;
 
+    /// The rule `independent` follows: a suite names its corpus's own verifier where the table
+    /// holds one ([`crate::dx::independent::own_verifiers`]), and none where it holds none. The
+    /// findings, for a table of suites.
+    fn unnamed_verifiers(suites: &[Suite]) -> Vec<String> {
+        let mut out = Vec::new();
+        for s in suites {
+            let own: Vec<&str> = crate::dx::independent::own_verifiers(s.dir).iter().map(|v| v.name).collect();
+            match s.independent {
+                None if !own.is_empty() => out.push(format!("{}: its corpus {} has an independent verifier ({}), and the suite names none", s.name, s.dir, own.join(", "))),
+                Some(n) if !own.contains(&n) => out.push(format!("{}: {n} is not {}'s own verifier (the table's are: {})", s.name, s.dir, own.join(", "))),
+                _ => {}
+            }
+        }
+        out
+    }
+
+    #[test]
+    fn every_suite_names_its_corpuss_verifier_where_there_is_one() {
+        let found = unnamed_verifiers(SUITES);
+        assert!(found.is_empty(), "{found:#?}");
+        // The suites with one and without, as the module's text says.
+        let with: Vec<&str> = SUITES.iter().filter(|s| s.independent.is_some()).map(|s| s.name).collect();
+        assert_eq!(with, vec!["claim", "jwp", "signer", "conform-result", "http", "native-sink"]);
+        // The rule finds a suite that names none where its corpus has one.
+        let mut without: Vec<Suite> = SUITES.iter().map(|s| Suite { independent: s.independent, ..*s }).collect();
+        without.iter_mut().find(|s| s.name == "http").unwrap().independent = None;
+        assert_eq!(unnamed_verifiers(&without).len(), 1, "{:?}", unnamed_verifiers(&without));
+    }
+
+    #[test]
+    fn every_suites_independent_verifier_is_an_entry_with_the_mode_it_needs() {
+        for s in SUITES {
+            if let Some(n) = s.independent {
+                let v = crate::dx::independent::named(n).unwrap_or_else(|| panic!("{}: {n} is not an independent verifier", s.name));
+                // A verifier suite is held case by case: its corpus file is the verdicts mode's.
+                if s.kind == "verifier" {
+                    let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).parent().unwrap();
+                    let loaded = (s.load)(&root.join(s.dir)).unwrap();
+                    assert_eq!(v.verdicts.map(|f| root.join(f)), loaded.corpus_file, "{}: the independent verifier reads the corpus file the suite gives", s.name);
+                }
+            }
+        }
+    }
+
     #[test]
     fn verdict_lines_follow_the_corpora() {
         assert_eq!(claim_expected(&json!({"outcome": "reject", "step": 3, "reason": "signature_invalid"})).0, "reject step=3 reason=signature_invalid");
diff --git a/wai/wai-rs/src/bin/wai_cli/dx/dev.rs b/wai/wai-rs/src/bin/wai_cli/dx/dev.rs
index 53ac52e38..6496e7274 100644
--- a/wai/wai-rs/src/bin/wai_cli/dx/dev.rs
+++ b/wai/wai-rs/src/bin/wai_cli/dx/dev.rs
@@ -234,9 +234,15 @@ fn wav_ms(path: &Path) -> Result<u64, String> {
     }
 }
 
+/// Studio's files, as `wai dev` finds them ([`studio::find`]); `wai doctor` reports them.
+pub(super) fn studio_dir(exe_dir: Option<&Path>) -> Option<PathBuf> {
+    studio::find(exe_dir)
+}
+
 /// The room client's files: the flag, `$WAI_WEB`, or `share/wai/web` beside the binary's
-/// directory (an installed archive's layout), checked for the room page.
-fn find_web(flag_value: Option<&str>, exe_dir: Option<&Path>) -> Result<PathBuf, String> {
+/// directory (an installed archive's layout), checked for the room page. `wai doctor` finds
+/// them the same way.
+pub(super) fn find_web(flag_value: Option<&str>, exe_dir: Option<&Path>) -> Result<PathBuf, String> {
     let candidates: Vec<PathBuf> = match flag_value.map(PathBuf::from).or_else(|| std::env::var_os("WAI_WEB").map(PathBuf::from)) {
         Some(p) => vec![p],
         None => exe_dir.map(|d| vec![d.join("../share/wai/web"), d.join("share/wai/web")]).unwrap_or_default(),
@@ -253,7 +259,7 @@ fn find_web(flag_value: Option<&str>, exe_dir: Option<&Path>) -> Result<PathBuf,
 }
 
 /// A binary: the flag, the environment variable, beside this binary, then `$PATH`. `wai mcp`'s
-/// development room finds the room service the same way.
+/// development room finds the room service the same way, and `wai doctor` every binary.
 pub(super) fn find_bin(name: &str, flag_value: Option<&str>, env: &str, exe_dir: Option<&Path>) -> Result<PathBuf, String> {
     if let Some(p) = flag_value.map(PathBuf::from).or_else(|| std::env::var_os(env).map(PathBuf::from)) {
         return if p.is_file() { Ok(p) } else { Err(format!("{name}: {} is not a file", p.display())) };
diff --git a/wai/wai-rs/src/bin/wai_cli/dx/doctor.rs b/wai/wai-rs/src/bin/wai_cli/dx/doctor.rs
new file mode 100644
index 000000000..cfe43fcb8
--- /dev/null
+++ b/wai/wai-rs/src/bin/wai_cli/dx/doctor.rs
@@ -0,0 +1,815 @@
+//! `wai doctor` (operation `toolchain.doctor`): what stands between this machine and the
+//! quickstart, each check read-only and in this order:
+//!
+//! 1. **path**: which program runs when a person types `wai`. The first `wai` on `PATH` is this
+//!    one; or another copy of WAI's command line, which runs instead of it; or another
+//!    project's program of the same name. The crates.io package `wai-cli` installs one, which
+//!    `cargo`'s own list of what it installed names; WAI's command line is not published there.
+//!    A package manager's shim (a generic program beside a `.shim` file that names the program
+//!    it runs, as WAI's bucket installs `wai`) is the program its `.shim` file names. Every
+//!    `wai` after the first is listed too.
+//! 2. **install**: this binary, its version, how it was installed (from its path), its build
+//!    features, and what `wai dev` runs beside it, found as `wai dev` finds them: the relay
+//!    (`wai-relay`), the room service (`wai-room`) and the room client's files; then
+//!    `wai-pack` and `wai-remote-host`, and Studio's files.
+//! 3. **ports**: whether a program can listen on loopback at all, and whether the ports
+//!    `wai dev` (8080) and `wai http origin` (8380) listen on by default are free.
+//! 4. **browsers**: the browsers this system has registered to open web pages, found by the
+//!    system's own record of them (an application's declared URL schemes on macOS, a desktop
+//!    entry's `x-scheme-handler/http` on Linux, `StartMenuInternet` on Windows), and
+//!    `BROWSER_BIN`, which WAI's browser tests read.
+//! 5. **keychain**: where a credential is kept (the provider registry of `wai-quantum`): the
+//!    macOS keychain through the system `security` tool, the desktop secret service through
+//!    `secret-tool`, or a file only its owner can read.
+//!
+//! Each check is `ok`, `warn` or `fail`. A failure is what stops the quickstart: another
+//! program answering to `wai`, or `wai dev` missing what it runs, or nothing able to listen on
+//! loopback. Exit 0 when no check fails (warnings or not), 1 when one does. `--json` prints the
+//! envelope, each check with its status, what it found and what to do.
+
+use super::envelope::{self, OpError};
+use serde_json::{Map, Value, json};
+use std::ffi::OsStr;
+use std::path::{Path, PathBuf};
+
+const OP: &str = "toolchain.doctor";
+const USAGE: &str = "wai doctor [--json]";
+
+/// What WAI's command line holds and another program does not, any one of them: the catalogue's
+/// format id, and the line `wai hello` begins with, which every release holds (0.3.0, the first,
+/// came before the catalogue and holds this alone).
+const MARKS: &[&[u8]] = &[wai::catalogue::FORMAT.as_bytes(), b"wai hello: WAI's four steps, on this machine"];
+
+/// The ports commands listen on by default, and the command.
+const PORTS: &[(u16, &str)] = &[(8080, "wai dev"), (8380, "wai http origin")];
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
+pub enum Status {
+    Ok,
+    Warn,
+    Fail,
+}
+
+impl Status {
+    pub fn label(self) -> &'static str {
+        match self {
+            Status::Ok => "ok",
+            Status::Warn => "warn",
+            Status::Fail => "fail",
+        }
+    }
+}
+
+/// One check's outcome.
+#[derive(Clone, Debug)]
+pub struct Check {
+    pub check: &'static str,
+    pub status: Status,
+    pub message: String,
+    pub hint: String,
+    pub detail: Value,
+}
+
+impl Check {
+    fn new(check: &'static str, status: Status, message: impl Into<String>, hint: impl Into<String>, detail: Value) -> Check {
+        Check { check, status, message: message.into(), hint: hint.into(), detail }
+    }
+
+    pub fn to_json(&self) -> Value {
+        json!({"check": self.check, "status": self.status.label(), "message": self.message, "hint": (!self.hint.is_empty()).then_some(&self.hint), "detail": self.detail})
+    }
+}
+
+// ─────────────────────────────── 1. path ───────────────────────────────
+
+/// The names a program called `wai` has on this system.
+fn wai_names() -> Vec<String> {
+    if cfg!(windows) { vec!["wai.exe".into(), "wai.cmd".into(), "wai.bat".into()] } else { vec!["wai".into()] }
+}
+
+/// Every `wai` on `path` (a `PATH` value), in the order a shell finds them; a directory listed
+/// twice is read once.
+pub fn wai_on_path(path: &OsStr) -> Vec<PathBuf> {
+    let mut out: Vec<PathBuf> = Vec::new();
+    let mut seen: Vec<PathBuf> = Vec::new();
+    for d in std::env::split_paths(path) {
+        if d.as_os_str().is_empty() || seen.contains(&d) {
+            continue;
+        }
+        seen.push(d.clone());
+        for n in wai_names() {
+            let p = d.join(n);
+            if p.is_file() {
+                out.push(p);
+                break;
+            }
+        }
+    }
+    out
+}
+
+/// What `cargo install` put in its bin directory: each package's id (`name version (source)`)
+/// and the programs it installed. From `$CARGO_HOME/.crates2.json`, else `.crates.toml`.
+pub fn cargo_installs(cargo_home: &Path) -> Vec<(String, Vec<String>)> {
+    if let Ok(b) = std::fs::read(cargo_home.join(".crates2.json"))
+        && let Ok(v) = serde_json::from_slice::<Value>(&b)
+        && let Some(m) = v.get("installs").and_then(Value::as_object)
+    {
+        return m.iter().map(|(k, x)| (k.clone(), x.get("bins").and_then(Value::as_array).map(|a| a.iter().filter_map(Value::as_str).map(String::from).collect()).unwrap_or_default())).collect();
+    }
+    let Ok(t) = std::fs::read_to_string(cargo_home.join(".crates.toml")) else { return Vec::new() };
+    // `"name version (source)" = ["bin", ...]`, one a line under [v1].
+    t.lines()
+        .filter_map(|l| {
+            let (k, v) = l.split_once(" = ")?;
+            let k = k.trim().trim_matches('"').to_string();
+            let bins = v.trim().trim_start_matches('[').trim_end_matches(']').split(',').map(|b| b.trim().trim_matches('"').to_string()).filter(|b| !b.is_empty()).collect();
+            Some((k, bins))
+        })
+        .collect()
+}
+
+/// `cargo`'s home: `$CARGO_HOME`, else `.cargo` in the home directory.
+fn cargo_home() -> Option<PathBuf> {
+    std::env::var_os("CARGO_HOME").map(PathBuf::from).or_else(|| home().map(|h| h.join(".cargo")))
+}
+
+fn home() -> Option<PathBuf> {
+    std::env::var_os("HOME").or_else(|| std::env::var_os("USERPROFILE")).map(PathBuf::from)
+}
+
+/// Who a `wai` is.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum Who {
+    /// This binary.
+    This,
+    /// Another copy of WAI's command line.
+    Wai,
+    /// A program a crates.io package installed (its id), not WAI's.
+    CratesIo(String),
+    /// Some other program called `wai`.
+    Other,
+}
+
+fn same_file(a: &Path, b: &Path) -> bool {
+    match (std::fs::canonicalize(a), std::fs::canonicalize(b)) {
+        (Ok(x), Ok(y)) => x == y,
+        _ => false,
+    }
+}
+
+/// The program a shim at `p` runs: the `path = "…"` line of the `.shim` file beside it
+/// (`<dir>/wai.shim` beside `<dir>/wai.exe`), which a package manager's generic shim reads to
+/// find the program it starts; a relative path is from the shim's directory. None when no such
+/// file is there.
+pub fn shim_target(p: &Path) -> Option<PathBuf> {
+    let text = std::fs::read_to_string(p.with_extension("shim")).ok()?;
+    let target = text.lines().find_map(|l| {
+        let (k, v) = l.split_once('=')?;
+        (k.trim() == "path").then(|| v.trim().trim_matches('"').trim().to_string())
+    })?;
+    if target.is_empty() {
+        return None;
+    }
+    let t = PathBuf::from(target);
+    Some(if t.is_absolute() { t } else { p.parent()?.join(t) })
+}
+
+/// Who the `wai` at `p` is: this binary; a program `cargo install` put there from crates.io
+/// that is not WAI's; WAI's (its bytes hold one of [`MARKS`]); or another. A shim is who the
+/// program it runs is ([`shim_target`]).
+pub fn who(p: &Path, this: Option<&Path>, cargo: Option<&Path>, installs: &[(String, Vec<String>)]) -> Who {
+    match shim_target(p) {
+        Some(t) => who_is(&t, this, cargo, installs),
+        None => who_is(p, this, cargo, installs),
+    }
+}
+
+fn who_is(p: &Path, this: Option<&Path>, cargo: Option<&Path>, installs: &[(String, Vec<String>)]) -> Who {
+    if this.is_some_and(|t| same_file(p, t)) {
+        return Who::This;
+    }
+    let ours = std::fs::read(p).is_ok_and(|b| MARKS.iter().any(|m| b.windows(m.len()).any(|w| w == *m)));
+    if let Some(c) = cargo
+        && p.parent().is_some_and(|d| same_file(d, &c.join("bin")))
+        && let Some((id, _)) = installs.iter().find(|(id, bins)| bins.iter().any(|b| b == "wai" || b == "wai.exe") && id.contains("(registry+"))
+        && !ours
+    {
+        let mut w = id.split_whitespace();
+        return Who::CratesIo(format!("{} {}", w.next().unwrap_or(""), w.next().unwrap_or("")));
+    }
+    if ours { Who::Wai } else { Who::Other }
+}
+
+/// The path check, from what is on `PATH` and who each is.
+pub fn path_check(found: &[(PathBuf, Who)], this: Option<&Path>) -> Check {
+    let this_s = this.map(|p| p.display().to_string()).unwrap_or_else(|| "this binary".into());
+    let this_dir = this.and_then(Path::parent).map(|d| d.display().to_string()).unwrap_or_default();
+    let detail = json!({
+        "this": this.map(|p| p.display().to_string()),
+        "on_path": found.iter().map(|(p, w)| json!({"path": p.display().to_string(), "is": match w {
+            Who::This => "this binary".to_string(),
+            Who::Wai => "another copy of WAI's command line".to_string(),
+            Who::CratesIo(id) => format!("{id} from crates.io, another project's program"),
+            Who::Other => "another program, not WAI's".to_string(),
+        }})).collect::<Vec<_>>(),
+    });
+    let package = |id: &str| id.split_whitespace().next().unwrap_or("wai-cli").to_string();
+    let later_crates: Vec<(String, String)> = found.iter().skip(1).filter_map(|(p, w)| if let Who::CratesIo(id) = w { Some((p.display().to_string(), package(id))) } else { None }).collect();
+    let Some((first, who_first)) = found.first() else {
+        return Check::new("path", Status::Warn, format!("no `wai` is on PATH: this one runs only by its path, {this_s}"), format!("put its directory on PATH: export PATH=\"{this_dir}:$PATH\""), detail);
+    };
+    let first_s = first.display().to_string();
+    match who_first {
+        Who::This if later_crates.is_empty() => Check::new("path", Status::Ok, format!("`wai` on PATH is this one, {this_s}"), "", detail),
+        Who::This => Check::new(
+            "path",
+            Status::Warn,
+            format!(
+                "`wai` on PATH is this one; a program crates.io's package {} installed, another project's, is also on PATH at {}",
+                later_crates[0].1,
+                later_crates.iter().map(|(p, _)| p.as_str()).collect::<Vec<_>>().join(", ")
+            ),
+            format!("cargo uninstall {} removes it: WAI's command line is not published on crates.io", later_crates[0].1),
+            detail,
+        ),
+        Who::CratesIo(id) => Check::new(
+            "path",
+            Status::Fail,
+            format!("`wai` on PATH is {first_s}, which `cargo install` put there from crates.io ({id}): another project's program, not WAI's, and it runs when you type wai"),
+            format!("cargo uninstall {} (WAI's command line is not published on crates.io), or put {this_dir} before it on PATH", package(id)),
+            detail,
+        ),
+        Who::Other => Check::new(
+            "path",
+            Status::Fail,
+            format!("`wai` on PATH is {first_s}, a program that is not WAI's command line, and it runs when you type wai"),
+            format!("remove or rename it, or put {this_dir} before it on PATH"),
+            detail,
+        ),
+        Who::Wai => Check::new(
+            "path",
+            Status::Warn,
+            format!("`wai` on PATH is {first_s}, another copy of WAI's command line, which runs instead of this one ({this_s})"),
+            format!("keep one install: remove the other, or put {this_dir} before it on PATH"),
+            detail,
+        ),
+    }
+}
+
+// ─────────────────────────────── 2. install ───────────────────────────────
+
+/// A program beside this binary, or on `PATH`.
+fn beside_or_on_path(name: &str, exe_dir: Option<&Path>) -> Option<PathBuf> {
+    let file = format!("{name}{}", std::env::consts::EXE_SUFFIX);
+    let mut dirs: Vec<PathBuf> = exe_dir.map(|d| vec![d.to_path_buf()]).unwrap_or_default();
+    if let Some(p) = std::env::var_os("PATH") {
+        dirs.extend(std::env::split_paths(&p));
+    }
+    dirs.iter().map(|d| d.join(&file)).find(|p| p.is_file())
+}
+
+/// How a binary at `p` was installed, from its path.
+pub fn channel(p: &Path) -> &'static str {
+    let s = p.to_string_lossy().replace('\\', "/");
+    let wai_home = std::env::var_os("WAI_HOME").map(PathBuf::from).or_else(|| home().map(|h| h.join(".wai")));
+    if s.contains("/Cellar/") {
+        "WAI's tap"
+    } else if s.to_ascii_lowercase().contains("/scoop/") {
+        "WAI's bucket"
+    } else if wai_home.is_some_and(|h| p.starts_with(h.join("bin"))) {
+        "the install script"
+    } else if s.contains("/target/debug/") || s.contains("/target/release/") {
+        "a build from source"
+    } else if s.contains("/.cargo/bin/") {
+        "cargo install"
+    } else {
+        "an archive unpacked by hand, or another way"
+    }
+}
+
+/// The install check: this binary and what `wai dev` runs beside it.
+fn install_check(this: Option<&Path>) -> Check {
+    let exe_dir = this.and_then(|t| std::fs::canonicalize(t).ok()).and_then(|t| t.parent().map(Path::to_path_buf));
+    let features: Vec<&str> = ["quickstart", "floor", "codecs", "http", "mcp", "app", "generate", "score"].into_iter().filter(|f| wai::catalogue::feature_on(f) == Some(true)).collect();
+    let mut parts = Vec::new();
+    let mut status = Status::Ok;
+    let mut missing_dev = Vec::new();
+    let mut found = Map::new();
+    for (name, env) in [("wai-relay", "WAI_RELAY_BIN"), ("wai-room", "WAI_ROOM_BIN")] {
+        match super::dev::find_bin(name, None, env, exe_dir.as_deref()) {
+            Ok(p) => {
+                found.insert(name.into(), json!(p.display().to_string()));
+            }
+            Err(_) => missing_dev.push(name.to_string()),
+        }
+    }
+    match super::dev::find_web(None, exe_dir.as_deref()) {
+        Ok(p) => {
+            found.insert("web".into(), json!(p.display().to_string()));
+        }
+        Err(_) => missing_dev.push("the room client's files (share/wai/web)".into()),
+    }
+    if !missing_dev.is_empty() {
+        status = Status::Fail;
+        parts.push(format!("`wai dev` cannot start: {} not found beside this binary or on PATH", missing_dev.join(", ")));
+    }
+    let mut missing_other = Vec::new();
+    // `wai package` finds wai-pack as `wai dev` finds the relay; the remote desktop's host is run
+    // by hand, as `wai dev --remote` says, from beside wai or from PATH.
+    let pack = super::dev::find_bin("wai-pack", None, "WAI_PACK_BIN", exe_dir.as_deref()).ok();
+    let host = beside_or_on_path("wai-remote-host", exe_dir.as_deref());
+    for (name, p, what) in [("wai-pack", pack, "wai package"), ("wai-remote-host", host, "the remote desktop's host, which wai dev --remote names")] {
+        match p {
+            Some(p) => {
+                found.insert(name.into(), json!(p.display().to_string()));
+            }
+            None => missing_other.push(format!("{name} (for {what})")),
+        }
+    }
+    if !missing_other.is_empty() {
+        status = status.max(Status::Warn);
+        parts.push(format!("not found: {}", missing_other.join(", ")));
+    }
+    let studio = super::dev::studio_dir(exe_dir.as_deref());
+    found.insert("studio".into(), json!(studio.as_ref().map(|p| p.display().to_string())));
+    let how = this.map(channel).unwrap_or("unknown");
+    let head = format!(
+        "wai {} at {}, from {how}; built with {}",
+        env!("CARGO_PKG_VERSION"),
+        this.map(|p| p.display().to_string()).unwrap_or_else(|| "an unknown path".into()),
+        if features.is_empty() { "no optional feature".to_string() } else { features.join(", ") }
+    );
+    let tail = if studio.is_none() { "; Studio's files are not here, so `wai dev` serves no /_wai/" } else { "" };
+    let message = if parts.is_empty() { format!("{head}; wai-relay, wai-room and the room client's files are where `wai dev` finds them{tail}") } else { format!("{head}; {}{tail}", parts.join("; ")) };
+    let hint = match status {
+        Status::Fail => "install the archive (https://wai.transaction.science/install.sh), which holds them beside wai; or give wai dev --relay, --room and --web",
+        Status::Warn => "the release archive holds them beside wai",
+        Status::Ok => "",
+    };
+    Check::new("install", status, message, hint, json!({"version": env!("CARGO_PKG_VERSION"), "installed_by": how, "features": features, "found": found}))
+}
+
+// ─────────────────────────────── 3. ports ───────────────────────────────
+
+/// The ports check: loopback can be listened on, and each of `ports` is free.
+pub fn ports_check(ports: &[(u16, &str)]) -> Check {
+    ports_check_by(ports, |p| std::net::TcpListener::bind(("127.0.0.1", p)).map(drop))
+}
+
+/// [`ports_check`], with `listen` saying whether a port of 127.0.0.1 can be listened on (0: any).
+fn ports_check_by(ports: &[(u16, &str)], listen: impl Fn(u16) -> std::io::Result<()>) -> Check {
+    if let Err(e) = listen(0) {
+        return Check::new("ports", Status::Fail, format!("nothing can listen on loopback (127.0.0.1): {e}"), "`wai dev` serves on loopback; a sandbox or a firewall rule refuses it", json!({}));
+    }
+    let mut busy = Vec::new();
+    let mut detail = Map::new();
+    for (port, who) in ports {
+        match listen(*port) {
+            Ok(_) => {
+                detail.insert(port.to_string(), json!({"for": who, "free": true}));
+            }
+            Err(e) => {
+                detail.insert(port.to_string(), json!({"for": who, "free": false, "error": e.to_string()}));
+                busy.push(format!("127.0.0.1:{port}, which `{who}` listens on by default"));
+            }
+        }
+    }
+    if busy.is_empty() {
+        let list: Vec<String> = ports.iter().map(|(p, w)| format!("{p} ({w})")).collect();
+        Check::new("ports", Status::Ok, format!("loopback can be listened on, and {} {} free", list.join(" and "), if ports.len() == 1 { "is" } else { "are" }), "", Value::Object(detail))
+    } else {
+        Check::new("ports", Status::Warn, format!("in use: {}", busy.join("; ")), "another program holds it (another `wai dev`?): stop it, or give --port", Value::Object(detail))
+    }
+}
+
+// ─────────────────────────────── 4. browsers ───────────────────────────────
+
+/// Whether an application's `Info.plist` declares the `http` URL scheme: XML, or binary
+/// (`bplist00`, whose four-byte ASCII string object `http` is `0x54 h t t p`).
+pub fn plist_opens_web(b: &[u8]) -> bool {
+    let has = |n: &[u8]| b.windows(n.len()).any(|w| w == n);
+    if !has(b"CFBundleURLSchemes") {
+        return false;
+    }
+    if b.starts_with(b"bplist00") { has(b"\x54http") } else { has(b"<string>http</string>") }
+}
+
+/// A desktop entry's name, when it declares that it opens `http` URLs.
+pub fn desktop_opens_web(text: &str) -> Option<String> {
+    let mut name = None;
+    let mut web = false;
+    let mut in_entry = false;
+    for l in text.lines() {
+        let l = l.trim();
+        if l.starts_with('[') {
+            in_entry = l == "[Desktop Entry]";
+            continue;
+        }
+        if !in_entry {
+            continue;
+        }
+        if let Some(n) = l.strip_prefix("Name=") {
+            name.get_or_insert_with(|| n.to_string());
+        } else if let Some(m) = l.strip_prefix("MimeType=") {
+            web |= m.split(';').any(|t| t.trim() == "x-scheme-handler/http");
+        }
+    }
+    if web { name.or_else(|| Some(String::new())) } else { None }
+}
+
+/// The browsers a `reg query …\StartMenuInternet` listing names: its subkeys' last components.
+pub fn reg_browsers(text: &str) -> Vec<String> {
+    text.lines()
+        .map(str::trim)
+        .filter(|l| l.starts_with("HKEY_") && l.to_ascii_lowercase().contains("\\startmenuinternet\\"))
+        .filter_map(|l| l.rsplit('\\').next().map(String::from))
+        .filter(|n| !n.is_empty())
+        .collect()
+}
+
+fn browsers_found() -> Vec<String> {
+    let mut out: Vec<String> = Vec::new();
+    if let Some(b) = std::env::var_os("BROWSER_BIN").map(PathBuf::from)
+        && b.is_file()
+    {
+        out.push(format!("BROWSER_BIN ({})", b.display()));
+    }
+    if cfg!(target_os = "macos") {
+        let mut dirs = vec![PathBuf::from("/Applications"), PathBuf::from("/System/Applications")];
+        if let Some(h) = home() {
+            dirs.push(h.join("Applications"));
+        }
+        for d in dirs {
+            let Ok(rd) = std::fs::read_dir(&d) else { continue };
+            let mut names: Vec<String> = rd
+                .flatten()
+                .filter(|e| e.file_name().to_string_lossy().ends_with(".app"))
+                .filter(|e| std::fs::read(e.path().join("Contents/Info.plist")).is_ok_and(|b| plist_opens_web(&b)))
+                .map(|e| e.file_name().to_string_lossy().trim_end_matches(".app").to_string())
+                .collect();
+            names.sort();
+            for n in names {
+                if !out.contains(&n) {
+                    out.push(n);
+                }
+            }
+        }
+    } else if cfg!(windows) {
+        for root in ["HKLM", "HKCU"] {
+            if let Ok(o) = std::process::Command::new("reg").args(["query", &format!("{root}\\SOFTWARE\\Clients\\StartMenuInternet")]).output() {
+                for n in reg_browsers(&String::from_utf8_lossy(&o.stdout)) {
+                    if !out.contains(&n) {
+                        out.push(n);
+                    }
+                }
+            }
+        }
+    } else {
+        let mut dirs = Vec::new();
+        if let Some(d) = std::env::var_os("XDG_DATA_HOME").map(PathBuf::from).or_else(|| home().map(|h| h.join(".local/share"))) {
+            dirs.push(d.join("applications"));
+        }
+        let data = std::env::var("XDG_DATA_DIRS").ok().filter(|s| !s.is_empty()).unwrap_or_else(|| "/usr/local/share:/usr/share".into());
+        dirs.extend(data.split(':').map(|d| Path::new(d).join("applications")));
+        dirs.push(PathBuf::from("/var/lib/flatpak/exports/share/applications"));
+        dirs.push(PathBuf::from("/var/lib/snapd/desktop/applications"));
+        for d in dirs {
+            let Ok(rd) = std::fs::read_dir(&d) else { continue };
+            let mut entries: Vec<PathBuf> = rd.flatten().map(|e| e.path()).filter(|p| p.extension().is_some_and(|x| x == "desktop")).collect();
+            entries.sort();
+            for p in entries {
+                if let Some(n) = std::fs::read_to_string(&p).ok().and_then(|t| desktop_opens_web(&t)) {
+                    let n = if n.is_empty() { p.file_stem().map(|s| s.to_string_lossy().into_owned()).unwrap_or_default() } else { n };
+                    if !out.contains(&n) {
+                        out.push(n);
+                    }
+                }
+            }
+        }
+    }
+    out
+}
+
+/// The browsers check, from the browsers found.
+pub fn browsers_check(found: &[String]) -> Check {
+    if found.is_empty() {
+        return Check::new(
+            "browsers",
+            Status::Warn,
+            "no browser is registered here to open web pages: `wai dev` serves the room page, and a browser opens it",
+            "install a browser; on a machine with no display, WAI's browser tests take one at BROWSER_BIN",
+            json!({"found": []}),
+        );
+    }
+    let shown: Vec<&str> = found.iter().take(8).map(String::as_str).collect();
+    let more = found.len().saturating_sub(shown.len());
+    Check::new(
+        "browsers",
+        Status::Ok,
+        format!("registered to open web pages: {}{}", shown.join(", "), if more > 0 { format!(" and {more} more") } else { String::new() }),
+        "",
+        json!({"found": found}),
+    )
+}
+
+// ─────────────────────────────── 5. keychain ───────────────────────────────
+
+/// What this system offers to keep a credential in.
+#[derive(Clone, Debug)]
+pub struct KeychainFacts {
+    /// `$WAI_QUANTUM_CREDENTIALS`.
+    pub mode: Option<String>,
+    pub macos: bool,
+    pub linux: bool,
+    /// macOS: what `security default-keychain` said, `Ok` with the keychain's path.
+    pub security: Option<Result<String, String>>,
+    /// Linux: `secret-tool` on `PATH`.
+    pub secret_tool: bool,
+    /// Linux: a session bus to reach the secret service on.
+    pub session_bus: bool,
+}
+
+/// The keychain check, from the facts.
+pub fn keychain_check(f: &KeychainFacts) -> Check {
+    let detail = json!({"mode": f.mode, "security": f.security.as_ref().map(|r| match r { Ok(p) => json!({"keychain": p}), Err(e) => json!({"error": e}) }), "secret_tool": f.secret_tool, "session_bus": f.session_bus});
+    let file = "credentials are kept in files only you can read";
+    match f.mode.as_deref() {
+        Some("file") => return Check::new("keychain", Status::Ok, format!("WAI_QUANTUM_CREDENTIALS=file: {file}"), "", detail),
+        Some("" | "auto" | "keychain") | None => {}
+        Some(other) => return Check::new("keychain", Status::Warn, format!("WAI_QUANTUM_CREDENTIALS={other}: it is file, keychain or auto"), "unset it, or set it to file, keychain or auto", detail),
+    }
+    let required = f.mode.as_deref() == Some("keychain");
+    let none = |why: String| {
+        Check::new(
+            "keychain",
+            if required { Status::Fail } else { Status::Warn },
+            if required { format!("WAI_QUANTUM_CREDENTIALS=keychain, and {why}") } else { format!("{why}: {file}") },
+            if f.linux { "install secret-tool and run in a desktop session for the secret service; WAI_QUANTUM_CREDENTIALS=file says the file is meant" } else { "WAI_QUANTUM_CREDENTIALS=file says the file is meant" },
+            detail.clone(),
+        )
+    };
+    if f.macos {
+        return match &f.security {
+            Some(Ok(p)) => Check::new("keychain", Status::Ok, format!("the keychain {p}, through the system security tool"), "", detail),
+            Some(Err(e)) => Check::new(
+                "keychain",
+                if required { Status::Fail } else { Status::Warn },
+                format!("the system security tool names no default keychain ({e}): a credential kept there is refused"),
+                "unlock or make the login keychain; WAI_QUANTUM_CREDENTIALS=file keeps credentials in files only you can read",
+                detail,
+            ),
+            None => none("the system security tool is not here".into()),
+        };
+    }
+    if f.linux && f.secret_tool && f.session_bus {
+        return Check::new("keychain", Status::Ok, "the desktop secret service, through secret-tool", "", detail);
+    }
+    if f.linux && f.secret_tool {
+        return none("secret-tool is installed, and there is no session bus (DBUS_SESSION_BUS_ADDRESS) to reach the secret service on".into());
+    }
+    none("no keychain this build reaches".into())
+}
+
+fn keychain_facts() -> KeychainFacts {
+    let macos = cfg!(target_os = "macos");
+    let linux = cfg!(target_os = "linux");
+    let security = (macos && Path::new("/usr/bin/security").is_file()).then(|| match std::process::Command::new("/usr/bin/security").arg("default-keychain").stdin(std::process::Stdio::null()).output() {
+        Ok(o) if o.status.success() => Ok(String::from_utf8_lossy(&o.stdout).trim().trim_matches('"').to_string()),
+        Ok(o) => Err(String::from_utf8_lossy(&o.stderr).trim().to_string()),
+        Err(e) => Err(e.to_string()),
+    });
+    let secret_tool = linux && std::env::var_os("PATH").is_some_and(|p| std::env::split_paths(&p).any(|d| d.join("secret-tool").is_file()));
+    KeychainFacts { mode: std::env::var("WAI_QUANTUM_CREDENTIALS").ok(), macos, linux, security, secret_tool, session_bus: std::env::var_os("DBUS_SESSION_BUS_ADDRESS").is_some_and(|v| !v.is_empty()) }
+}
+
+// ─────────────────────────────── the run ───────────────────────────────
+
+/// This binary's path, as the system reports it.
+fn this_exe() -> Option<PathBuf> {
+    std::env::current_exe().ok()
+}
+
+/// Every check, in order: the path first.
+pub fn checks() -> Vec<Check> {
+    let this = this_exe();
+    let path = std::env::var_os("PATH").unwrap_or_default();
+    let cargo = cargo_home();
+    let installs = cargo.as_deref().map(cargo_installs).unwrap_or_default();
+    let found: Vec<(PathBuf, Who)> = wai_on_path(&path).into_iter().map(|p| {
+        let w = who(&p, this.as_deref(), cargo.as_deref(), &installs);
+        (p, w)
+    }).collect();
+    vec![path_check(&found, this.as_deref()), install_check(this.as_deref()), ports_check(PORTS), browsers_check(&browsers_found()), keychain_check(&keychain_facts())]
+}
+
+/// The report's `data`: this binary, each check, and the counts.
+pub fn report(checks: &[Check]) -> Value {
+    let failed = checks.iter().filter(|c| c.status == Status::Fail).count();
+    let warnings = checks.iter().filter(|c| c.status == Status::Warn).count();
+    json!({
+        "wai": {"version": env!("CARGO_PKG_VERSION"), "path": this_exe().map(|p| p.display().to_string())},
+        "checks": checks.iter().map(Check::to_json).collect::<Vec<_>>(),
+        "failed": failed,
+        "warnings": warnings,
+    })
+}
+
+pub fn main(args: &[String]) -> Result<bool, OpError> {
+    envelope::check_args(args, &["--json", "--text"], &[], 0, USAGE)?;
+    let json_mode = envelope::json_wanted(args);
+    let cs = checks();
+    let data = report(&cs);
+    let failed = data["failed"].as_u64().unwrap_or(0);
+    let warnings = data["warnings"].as_u64().unwrap_or(0);
+    if json_mode {
+        if failed == 0 {
+            envelope::print(&envelope::envelope_with(OP, true, data, None));
+        } else {
+            let names: Vec<&str> = cs.iter().filter(|c| c.status == Status::Fail).map(|c| c.check).collect();
+            envelope::print(&envelope::error_envelope_with(Some(OP), &OpError::of(1, "check-failed", format!("wai doctor: {} failed", names.join(", "))), Some(data)));
+        }
+    } else {
+        println!("wai doctor: wai {} ({})", env!("CARGO_PKG_VERSION"), this_exe().map(|p| p.display().to_string()).unwrap_or_else(|| "path unknown".into()));
+        for c in &cs {
+            println!("{:<5} {:<9} {}", c.status.label(), c.check, c.message);
+            if !c.hint.is_empty() {
+                println!("{:<15} hint: {}", "", c.hint);
+            }
+        }
+        println!("wai doctor: {failed} failed, {warnings} warning{}", if warnings == 1 { "" } else { "s" });
+    }
+    Ok(failed == 0)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn tmp(name: &str) -> PathBuf {
+        let d = std::env::temp_dir().join(format!("wai-doctor-{name}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&d);
+        std::fs::create_dir_all(&d).unwrap();
+        d
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn every_wai_on_path_is_found_in_order_and_each_is_told_apart() {
+        let d = tmp("path");
+        let (a, b, cargo) = (d.join("a"), d.join("b"), d.join("cargo"));
+        for x in [&a, &b, &cargo.join("bin")] {
+            std::fs::create_dir_all(x).unwrap();
+        }
+        // a/wai: another program; b/wai: WAI's (it holds the catalogue's format id); cargo/bin/wai:
+        // what the crates.io package wai-cli put in cargo's bin.
+        std::fs::write(a.join("wai"), b"#!/bin/sh\necho another\n").unwrap();
+        std::fs::write(b.join("wai"), [b"\x7fELF...".as_slice(), MARKS[0], b"..."].concat()).unwrap();
+        std::fs::write(cargo.join("bin/wai"), b"\x7fELF not ours").unwrap();
+        std::fs::write(cargo.join(".crates2.json"), r#"{"installs":{"wai-cli 0.2.1 (registry+https://index.crates.io/)":{"bins":["wai"]}}}"#).unwrap();
+        let path = std::env::join_paths([&a, &b, &a, &cargo.join("bin")]).unwrap();
+        let found = wai_on_path(&path);
+        assert_eq!(found, vec![a.join("wai"), b.join("wai"), cargo.join("bin/wai")], "in order, a directory read once");
+        let installs = cargo_installs(&cargo);
+        let w = |p: &Path, this: Option<&Path>| who(p, this, Some(&cargo), &installs);
+        assert_eq!(w(&a.join("wai"), None), Who::Other);
+        assert_eq!(w(&b.join("wai"), None), Who::Wai);
+        assert_eq!(w(&b.join("wai"), Some(&b.join("wai"))), Who::This);
+        assert_eq!(w(&cargo.join("bin/wai"), None), Who::CratesIo("wai-cli 0.2.1".into()));
+        // The older list cargo keeps reads the same.
+        std::fs::remove_file(cargo.join(".crates2.json")).unwrap();
+        std::fs::write(cargo.join(".crates.toml"), "[v1]\n\"wai-cli 0.2.1 (registry+https://index.crates.io/)\" = [\"wai\"]\n").unwrap();
+        assert_eq!(who(&cargo.join("bin/wai"), None, Some(&cargo), &cargo_installs(&cargo)), Who::CratesIo("wai-cli 0.2.1".into()));
+        // A `wai` WAI's own source tree installed with cargo is WAI's.
+        std::fs::write(cargo.join("bin/wai"), [b"x".as_slice(), MARKS[0]].concat()).unwrap();
+        assert_eq!(who(&cargo.join("bin/wai"), None, Some(&cargo), &cargo_installs(&cargo)), Who::Wai);
+    }
+
+    #[test]
+    fn a_release_from_before_the_catalogue_is_wais() {
+        // wai 0.3.0's binary holds no catalogue; it holds the line `wai hello` begins with.
+        let d = tmp("v030");
+        let old = d.join("wai");
+        std::fs::write(&old, [b"\x7fELF...".as_slice(), b"wai hello: WAI's four steps, on this machine\n\n", b"..."].concat()).unwrap();
+        assert_eq!(who(&old, None, None, &[]), Who::Wai, "another copy of WAI's command line, not another program");
+        std::fs::write(&old, b"\x7fELF... wai hello: another program's greeting").unwrap();
+        assert_eq!(who(&old, None, None, &[]), Who::Other);
+        let _ = std::fs::remove_dir_all(&d);
+    }
+
+    #[test]
+    fn a_shim_is_the_program_its_shim_file_names() {
+        // WAI's bucket puts a generic shim first on PATH (shims/wai.exe) and, beside it,
+        // shims/wai.shim, whose `path` line names the program it starts: this binary, under apps/.
+        let d = tmp("shim");
+        let (shims, app) = (d.join("scoop/shims"), d.join("scoop/apps/wai/current/bin"));
+        for x in [&shims, &app] {
+            std::fs::create_dir_all(x).unwrap();
+        }
+        let this = app.join("wai.exe");
+        std::fs::write(&this, [b"MZ...".as_slice(), MARKS[0]].concat()).unwrap();
+        let shim = shims.join("wai.exe");
+        std::fs::write(&shim, b"MZ... a generic shim: it reads the .shim file beside it").unwrap();
+        let point = |at: &Path| std::fs::write(shims.join("wai.shim"), format!("path = \"{}\"\nargs = \n", at.display())).unwrap();
+        point(&this);
+        assert_eq!(shim_target(&shim).as_deref(), Some(this.as_path()));
+        assert_eq!(who(&shim, Some(&this), None, &[]), Who::This, "the shim runs this binary");
+        assert_eq!(path_check(&[(shim.clone(), who(&shim, Some(&this), None, &[]))], Some(&this)).status, Status::Ok);
+        // To another copy of WAI's command line, or to another program.
+        let other = d.join("other/wai.exe");
+        std::fs::create_dir_all(other.parent().unwrap()).unwrap();
+        std::fs::write(&other, [b"MZ...".as_slice(), MARKS[0]].concat()).unwrap();
+        point(&other);
+        assert_eq!(who(&shim, Some(&this), None, &[]), Who::Wai);
+        std::fs::write(&other, b"MZ... not ours").unwrap();
+        assert_eq!(who(&shim, Some(&this), None, &[]), Who::Other);
+        // A relative path is from the shim's directory.
+        std::fs::write(shims.join("wai.shim"), "path = ../apps/wai/current/bin/wai.exe\n").unwrap();
+        assert_eq!(who(&shim, Some(&this), None, &[]), Who::This);
+        // No .shim file beside it: the program itself, another program here.
+        std::fs::remove_file(shims.join("wai.shim")).unwrap();
+        assert_eq!(shim_target(&shim), None);
+        assert_eq!(who(&shim, Some(&this), None, &[]), Who::Other);
+        let _ = std::fs::remove_dir_all(&d);
+    }
+
+    #[test]
+    fn the_path_check_names_what_runs_when_you_type_wai() {
+        let this = PathBuf::from("/x/bin/wai");
+        let c = |found: Vec<(PathBuf, Who)>| path_check(&found, Some(&this));
+        let ok = c(vec![(this.clone(), Who::This)]);
+        assert_eq!(ok.status, Status::Ok);
+        let crates = c(vec![(PathBuf::from("/h/.cargo/bin/wai"), Who::CratesIo("wai-cli 0.2.1".into())), (this.clone(), Who::This)]);
+        assert_eq!(crates.status, Status::Fail);
+        assert!(crates.message.contains("crates.io (wai-cli 0.2.1)") && crates.hint.contains("cargo uninstall wai-cli "), "{crates:?}");
+        let other = c(vec![(PathBuf::from("/usr/bin/wai"), Who::Other)]);
+        assert_eq!(other.status, Status::Fail);
+        assert!(other.hint.contains("/x/bin"), "{other:?}");
+        assert_eq!(c(vec![(PathBuf::from("/opt/wai"), Who::Wai), (this.clone(), Who::This)]).status, Status::Warn);
+        let after = c(vec![(this.clone(), Who::This), (PathBuf::from("/h/.cargo/bin/wai"), Who::CratesIo("wai-cli 0.2.1".into()))]);
+        assert_eq!(after.status, Status::Warn, "a crates.io wai-cli after this one is still named");
+        assert!(after.hint.contains("cargo uninstall wai-cli"));
+        let none = c(vec![]);
+        assert_eq!(none.status, Status::Warn);
+        assert!(none.hint.contains("export PATH=\"/x/bin:$PATH\""), "{none:?}");
+    }
+
+    #[test]
+    fn the_path_check_comes_first() {
+        let cs = checks();
+        assert_eq!(cs.iter().map(|c| c.check).collect::<Vec<_>>(), vec!["path", "install", "ports", "browsers", "keychain"]);
+    }
+
+    #[test]
+    fn a_port_in_use_is_named_and_a_free_one_is_not() {
+        // A port this test holds is in use.
+        let held = std::net::TcpListener::bind(("127.0.0.1", 0)).unwrap();
+        let port = held.local_addr().unwrap().port();
+        let c = ports_check(&[(port, "wai dev")]);
+        assert_eq!(c.status, Status::Warn, "{c:?}");
+        assert!(c.message.contains(&format!("127.0.0.1:{port}")) && c.message.contains("wai dev"), "{c:?}");
+        drop(held);
+        // What the system answers, given: a port another program could take between two binds
+        // is not asked of the machine twice.
+        let in_use = |busy: u16| move |p: u16| if p == busy { Err(std::io::Error::from(std::io::ErrorKind::AddrInUse)) } else { Ok(()) };
+        assert_eq!(ports_check_by(&[(8080, "wai dev"), (8380, "wai http origin")], in_use(1)).status, Status::Ok);
+        let c = ports_check_by(&[(8080, "wai dev"), (8380, "wai http origin")], in_use(8380));
+        assert_eq!(c.status, Status::Warn);
+        assert!(c.message.contains("127.0.0.1:8380") && c.message.contains("wai http origin") && !c.message.contains("8080"), "{c:?}");
+        assert_eq!(ports_check_by(&[(8080, "wai dev")], in_use(0)).status, Status::Fail, "nothing listens on loopback");
+    }
+
+    #[test]
+    fn a_browser_is_what_the_system_records_as_opening_web_pages() {
+        let xml = b"<?xml version=\"1.0\"?><plist><dict><key>CFBundleURLTypes</key><array><dict><key>CFBundleURLSchemes</key><array><string>http</string><string>https</string></array></dict></array></dict></plist>";
+        assert!(plist_opens_web(xml));
+        assert!(!plist_opens_web(b"<plist><dict><key>CFBundleURLSchemes</key><array><string>https-only-app</string></array></dict></plist>"));
+        assert!(!plist_opens_web(b"<plist><dict><key>CFBundleName</key><string>http</string></dict></plist>"), "no URL schemes, no browser");
+        assert!(plist_opens_web(b"bplist00\x12CFBundleURLSchemes\xa2\x54http\x55https"));
+        assert!(!plist_opens_web(b"bplist00\x12CFBundleURLSchemes\xa1\x55https"));
+        let desktop = "[Desktop Entry]\nName=Web Browser\nName[fr]=Navigateur\nMimeType=text/html;x-scheme-handler/http;x-scheme-handler/https;\n[Desktop Action new]\nName=New Window\n";
+        assert_eq!(desktop_opens_web(desktop).as_deref(), Some("Web Browser"));
+        assert_eq!(desktop_opens_web("[Desktop Entry]\nName=Editor\nMimeType=text/plain;\n"), None);
+        assert_eq!(desktop_opens_web("[Desktop Entry]\nName=Mail\nMimeType=x-scheme-handler/https-mailer;\n"), None);
+        let reg = "\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet\\BrowserOne.exe\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\StartMenuInternet\\BROWSERTWO.EXE\r\n";
+        assert_eq!(reg_browsers(reg), vec!["BrowserOne.exe", "BROWSERTWO.EXE"]);
+        assert_eq!(browsers_check(&[]).status, Status::Warn);
+        assert_eq!(browsers_check(&["One".into()]).status, Status::Ok);
+    }
+
+    #[test]
+    fn the_keychain_is_where_a_credential_would_be_kept() {
+        let f = |mode: Option<&str>, macos: bool, linux: bool, security: Option<Result<String, String>>, st: bool, bus: bool| KeychainFacts { mode: mode.map(String::from), macos, linux, security, secret_tool: st, session_bus: bus };
+        assert_eq!(keychain_check(&f(None, true, false, Some(Ok("/k/login.keychain-db".into())), false, false)).status, Status::Ok);
+        let locked = keychain_check(&f(None, true, false, Some(Err("no default".into())), false, false));
+        assert_eq!(locked.status, Status::Warn);
+        assert_eq!(keychain_check(&f(Some("keychain"), true, false, Some(Err("no default".into())), false, false)).status, Status::Fail, "a keychain asked for and not there");
+        assert_eq!(keychain_check(&f(None, false, true, None, true, true)).status, Status::Ok);
+        let no_bus = keychain_check(&f(None, false, true, None, true, false));
+        assert_eq!(no_bus.status, Status::Warn);
+        assert!(no_bus.message.contains("DBUS_SESSION_BUS_ADDRESS"), "{no_bus:?}");
+        assert_eq!(keychain_check(&f(None, false, true, None, false, false)).status, Status::Warn);
+        assert_eq!(keychain_check(&f(Some("file"), false, false, None, false, false)).status, Status::Ok);
+        assert_eq!(keychain_check(&f(Some("vault"), false, false, None, false, false)).status, Status::Warn);
+    }
+}
diff --git a/wai/wai-rs/src/bin/wai_cli/dx/independent.rs b/wai/wai-rs/src/bin/wai_cli/dx/independent.rs
new file mode 100644
index 000000000..f352db86a
--- /dev/null
+++ b/wai/wai-rs/src/bin/wai_cli/dx/independent.rs
@@ -0,0 +1,625 @@
+//! The independent verifiers: each conformance corpus's second implementation, written from the
+//! specification's text and sharing no code with wai-rs, in one table ([`VERIFIERS`]). The table
+//! is no list kept here: build.rs reads it from the `# independent:` lines of the conformance
+//! workflow's step files (`.github/wai-conformance/verifiers/*.sh`, [`table`]), so a corpus's
+//! verifier joins it in its own step's file and no two changes edit the same line.
+//! `wai conform --independent` runs them, every one or those named, as CI runs the corpus union
+//! in one command; beside a run of `wai conform <kind>` it holds the corpus's verifier to the
+//! same cases; and `wai mcp`'s conformance tools list and run them from here.
+//!
+//! An entry is a command line run in the `wai/` directory, `python3 [-I] <script> <args>`, the
+//! line the corpus's README gives. It passes when the verifier exits 0: every case of its corpus
+//! reached the outcome the corpus states, and every mutated copy it makes was refused. A
+//! verifier with a `verdicts` mode (`<script> verdicts <corpus file>`, one `name<TAB>verdict`
+//! line a case, as the reference's `wai_*_vectors verdicts` prints them) names that file in
+//! [`Verifier::verdicts`], and can be held case by case beside another implementation's answers.
+//!
+//! The table's rules, held by this module's tests:
+//! - the table is the step files' lines, as they are now: the build read every one;
+//! - every `*_verify.py` under `wai/` is an entry's script, or a step file's body runs it itself
+//!   (as the opus deep redundancy and header probe steps run theirs over the inputs they fetch,
+//!   and as a step does whose verifier has no `# independent:` line yet: it runs in its step, and
+//!   joins the union by that line), or it is in [`NOT_HERE`] with the workflow that runs it,
+//!   which must run it in a step's command, so a new corpus's verifier cannot be left out of CI;
+//! - every file and directory an entry names exists, and its name is unique;
+//! - the conformance workflow (`wai-conformance.yml`) runs the union as `wai conform
+//!   --independent`, and neither it nor a step file's body runs an entry's command line itself:
+//!   a line kept by hand beside it would be a second copy of the table to drift from it.
+//!
+//! A build without the step files (one outside the repository) has no table, and says so
+//! ([`TABLE_ABSENT`]): `wai conform --independent` refuses to run, rather than pass on nothing.
+
+// A build with `mcp` and without `quickstart` lists and runs entries for `wai mcp` alone.
+#![cfg_attr(not(feature = "quickstart"), allow(dead_code))]
+
+use std::io::Read;
+use std::path::{Path, PathBuf};
+use std::process::{Command, Stdio};
+use std::time::{Duration, Instant};
+
+/// The reading of the step files' `# independent:` lines, which build.rs shares.
+#[path = "independent_table.rs"]
+pub mod table;
+
+/// The areas a corpus belongs to, as `--suite` names them.
+pub use table::AREAS;
+
+/// One corpus's independent verifier.
+#[derive(Clone, Copy, Debug)]
+pub struct Verifier {
+    /// Its name, which `--suite` takes and its record's `suite` carries.
+    pub name: &'static str,
+    /// One of [`AREAS`].
+    pub area: &'static str,
+    /// The corpus's directory under `wai/`: the record's `corpus.dir`. The record's corpus digest
+    /// covers what the arguments name ([`corpus_files`]).
+    pub dir: &'static str,
+    /// The script, under `wai/`.
+    pub script: &'static str,
+    /// Its arguments, paths under `wai/` or switches.
+    pub args: &'static [&'static str],
+    /// Run with `-I` (isolated: no module from the working directory, the environment or the
+    /// user's site-packages), as the corpus's README and CI run it.
+    pub isolated: bool,
+    /// The Python packages it needs beyond the standard library.
+    pub needs: &'static [&'static str],
+    /// The corpus file its `verdicts` mode reads, where it has one.
+    pub verdicts: Option<&'static str>,
+    /// The step file whose `# independent:` line it is, from the repository's root.
+    pub file: &'static str,
+}
+
+// `VERIFIERS`, every independent verifier in the order they run, and `TABLE_ABSENT`, why
+// this build has none (`None`: it has them), as build.rs wrote them from the step files.
+include!(concat!(env!("OUT_DIR"), "/independent_verifiers.rs"));
+
+/// The verifiers under `wai/` that are not entries and that no step file of the conformance
+/// workflow runs, each with the reason and where CI runs it: the reason names the workflow
+/// (`<name>.yml`), whose steps run the script. (A verifier a step file's body runs itself, as
+/// the opus deep redundancy and header probe steps run theirs over the inputs they fetch, needs
+/// no line here: its step says where it runs.)
+pub const NOT_HERE: &[(&str, &str)] = &[
+    ("pack-conformance/pack_verify.py", "wai-pack.yml runs it, beside the reference packager's differentials against it"),
+];
+
+/// The entry named `name`.
+pub fn named(name: &str) -> Option<&'static Verifier> {
+    VERIFIERS.iter().find(|v| v.name == name)
+}
+
+/// Whether `v` is its corpus's own verifier: its script is in the conformance directory its
+/// corpus is in (`live-conformance/bearer_verify.py` for `live-conformance/bearers`), not another
+/// corpus's verifier run over it, as the claim corpus's `claim_verify.py` reads a corpus's claims.
+pub fn is_own(v: &Verifier) -> bool {
+    let top = v.dir.split('/').next().unwrap_or(v.dir);
+    v.script.strip_prefix(top).is_some_and(|r| r.starts_with('/'))
+}
+
+/// The entries that are the corpus at `dir`'s own verifiers ([`is_own`]), in the table's order.
+pub fn own_verifiers(dir: &str) -> Vec<&'static Verifier> {
+    VERIFIERS.iter().filter(|v| v.dir == dir && is_own(v)).collect()
+}
+
+/// The entries `--suite` selects: each comma-separated word an area or an entry's name, every
+/// entry when none is given, in the table's order. An unknown word is the error.
+pub fn select(spec: Option<&str>) -> Result<Vec<&'static Verifier>, String> {
+    select_in(VERIFIERS, TABLE_ABSENT, spec)
+}
+
+/// [`select`] over a table and its reason for being absent.
+fn select_in(table: &'static [Verifier], absent: Option<&str>, spec: Option<&str>) -> Result<Vec<&'static Verifier>, String> {
+    if let Some(why) = absent {
+        return Err(why.to_string());
+    }
+    let named = |n: &str| table.iter().find(|v| v.name == n);
+    let Some(spec) = spec else { return Ok(table.iter().collect()) };
+    let words: Vec<&str> = spec.split(',').map(str::trim).filter(|w| !w.is_empty()).collect();
+    if words.is_empty() {
+        return Err("--suite names no area or corpus".into());
+    }
+    for w in &words {
+        if !AREAS.contains(w) && named(w).is_none() {
+            return Err(format!("{w}: no area or independent verifier of that name; the areas are {}", AREAS.join(", ")));
+        }
+    }
+    Ok(table.iter().filter(|v| words.iter().any(|w| *w == v.name || *w == v.area)).collect())
+}
+
+/// The command's words after the interpreter: `[-I] <script> <args>`, or, in its `verdicts`
+/// mode, `[-I] <script> verdicts <corpus file>`.
+pub fn argv(v: &Verifier, verdicts: bool) -> Vec<&'static str> {
+    let mut a = Vec::new();
+    if v.isolated {
+        a.push("-I");
+    }
+    a.push(v.script);
+    match (verdicts, v.verdicts) {
+        (true, Some(f)) => a.extend(["verdicts", f]),
+        _ => a.extend_from_slice(v.args),
+    }
+    a
+}
+
+/// The command line as a person runs it in `wai/`.
+pub fn command_line(v: &Verifier, python: &str, verdicts: bool) -> String {
+    std::iter::once(python).chain(argv(v, verdicts)).collect::<Vec<_>>().join(" ")
+}
+
+/// The files a run of `v` reads as its corpus, under `root` (conformance-results §2.1, every
+/// corpus file the run read): each argument that is a file, and every file below each argument
+/// that is a directory; the verifiers' own sources (`*.py`, `__pycache__`) aside; sorted. A run
+/// given one vectors file reads that file, not the rest of its corpus's directory.
+pub fn corpus_files(v: &Verifier, root: &Path) -> Vec<PathBuf> {
+    let source = |name: &str| name.ends_with(".py") || name.ends_with(".pyc");
+    let mut out = Vec::new();
+    for a in v.args {
+        let p = root.join(a);
+        if p.is_file() {
+            if !source(a) {
+                out.push(p);
+            }
+            continue;
+        }
+        let mut stack = if p.is_dir() { vec![p] } else { Vec::new() };
+        while let Some(d) = stack.pop() {
+            let Ok(rd) = std::fs::read_dir(&d) else { continue };
+            for e in rd.flatten() {
+                let p = e.path();
+                let name = e.file_name().to_string_lossy().into_owned();
+                if p.is_dir() {
+                    if name != "__pycache__" {
+                        stack.push(p);
+                    }
+                } else if !source(&name) {
+                    out.push(p);
+                }
+            }
+        }
+    }
+    out.sort();
+    out.dedup();
+    out
+}
+
+/// What a run did.
+#[derive(Clone, Debug)]
+pub struct Ran {
+    pub code: Option<i32>,
+    pub timed_out: bool,
+    pub stdout: String,
+    pub stderr: String,
+    pub seconds: f64,
+}
+
+impl Ran {
+    pub fn passed(&self) -> bool {
+        !self.timed_out && self.code == Some(0)
+    }
+
+    /// The last `n` lines of what it printed, standard output then standard error.
+    pub fn tail(&self, n: usize) -> String {
+        let all = format!("{}{}", self.stdout, self.stderr);
+        let lines: Vec<&str> = all.lines().collect();
+        lines[lines.len().saturating_sub(n)..].join("\n")
+    }
+
+    /// One line on how it ended: `exit 0`, `exit 1: <its last line>`, `timed out after …`.
+    pub fn verdict(&self) -> String {
+        if self.timed_out {
+            return format!("timed out after {:.0} s", self.seconds);
+        }
+        let last = self.tail(1);
+        match self.code {
+            Some(0) => "exit 0".into(),
+            Some(c) if last.trim().is_empty() => format!("exit {c}"),
+            Some(c) => format!("exit {c}: {}", last.trim()),
+            None => format!("stopped by a signal: {}", last.trim()),
+        }
+    }
+}
+
+/// How long the output of a verifier that has exited is still read: a program it left running
+/// can hold the output open, and the run does not wait for it.
+const DRAIN: Duration = Duration::from_secs(2);
+
+/// Run `python` with `args` in `root`, killed after `timeout`.
+pub fn run_in(root: &Path, python: &str, args: &[&str], timeout: Duration) -> Result<Ran, String> {
+    let started = Instant::now();
+    let mut child = Command::new(python)
+        .args(args)
+        .current_dir(root)
+        .stdin(Stdio::null())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .spawn()
+        .map_err(|e| format!("{python}: {e}"))?;
+    let read = |r: Option<Box<dyn Read + Send>>| {
+        let (tx, rx) = std::sync::mpsc::channel();
+        std::thread::spawn(move || {
+            let mut b = Vec::new();
+            if let Some(mut r) = r {
+                let _ = r.read_to_end(&mut b);
+            }
+            let _ = tx.send(b);
+        });
+        rx
+    };
+    let out = read(child.stdout.take().map(|x| Box::new(x) as Box<dyn Read + Send>));
+    let err = read(child.stderr.take().map(|x| Box::new(x) as Box<dyn Read + Send>));
+    let mut timed_out = false;
+    let status = loop {
+        match child.try_wait().map_err(|e| e.to_string())? {
+            Some(s) => break Some(s),
+            None if started.elapsed() >= timeout => {
+                timed_out = true;
+                let _ = child.kill();
+                break child.wait().ok();
+            }
+            None => std::thread::sleep(Duration::from_millis(20)),
+        }
+    };
+    let until = Instant::now() + DRAIN;
+    let stdout = out.recv_timeout(until.saturating_duration_since(Instant::now())).unwrap_or_default();
+    let stderr = err.recv_timeout(until.saturating_duration_since(Instant::now())).unwrap_or_default();
+    Ok(Ran {
+        code: if timed_out { None } else { status.and_then(|s| s.code()) },
+        timed_out,
+        stdout: String::from_utf8_lossy(&stdout).into_owned(),
+        stderr: String::from_utf8_lossy(&stderr).into_owned(),
+        seconds: started.elapsed().as_secs_f64(),
+    })
+}
+
+/// Run the verifier over its corpus (or, with `verdicts`, its `verdicts` mode).
+pub fn run(v: &Verifier, root: &Path, python: &str, verdicts: bool, timeout: Duration) -> Result<Ran, String> {
+    run_in(root, python, &argv(v, verdicts), timeout)
+}
+
+/// The packages of `v.needs` that `python` cannot import: the hint a failed run is given.
+pub fn missing_needs(v: &Verifier, python: &str) -> Vec<&'static str> {
+    v.needs
+        .iter()
+        .copied()
+        .filter(|m| !Command::new(python).args(["-c", &format!("import {m}")]).stdout(Stdio::null()).stderr(Stdio::null()).status().is_ok_and(|s| s.success()))
+        .collect()
+}
+
+/// Whether `program` can be run: a path to a file, or a name found on `PATH`.
+pub fn program_found(program: &str) -> bool {
+    if program.contains('/') || program.contains('\\') {
+        return Path::new(program).is_file();
+    }
+    let Some(path) = std::env::var_os("PATH") else { return false };
+    std::env::split_paths(&path).any(|d| d.join(program).is_file() || (cfg!(windows) && d.join(format!("{program}.exe")).is_file()))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn wai_dir() -> PathBuf {
+        Path::new(env!("CARGO_MANIFEST_DIR")).parent().expect("wai/").to_path_buf()
+    }
+
+    fn repo_dir() -> PathBuf {
+        wai_dir().parent().expect("the repository").to_path_buf()
+    }
+
+    /// The conformance workflow's step files, as the build read them.
+    fn steps() -> Vec<table::StepFile> {
+        table::step_files(&repo_dir().join(table::STEPS)).expect("the step files read").expect("the step files are there")
+    }
+
+    /// Every `*_verify.py` under `wai/`, relative to it: the files git has or would add (build
+    /// output a `.gitignore` names, such as the copy of the corpora a reach build makes under
+    /// `wai-web/reach/`, is not the tree's), or, where git cannot say, every one a walk finds.
+    fn verifiers_in_tree(root: &Path) -> Vec<String> {
+        if let Ok(o) = Command::new("git").args(["ls-files", "--cached", "--others", "--exclude-standard", "--", "*_verify.py"]).current_dir(root).output()
+            && o.status.success()
+        {
+            let mut out: Vec<String> = String::from_utf8_lossy(&o.stdout).lines().filter(|l| l.ends_with("_verify.py") && root.join(l).is_file()).map(String::from).collect();
+            out.sort();
+            out.dedup();
+            if !out.is_empty() {
+                return out;
+            }
+        }
+        let mut out = Vec::new();
+        let mut stack = vec![root.to_path_buf()];
+        while let Some(d) = stack.pop() {
+            let Ok(rd) = std::fs::read_dir(&d) else { continue };
+            for e in rd.flatten() {
+                let p = e.path();
+                let name = e.file_name().to_string_lossy().into_owned();
+                if p.is_dir() {
+                    if !["node_modules", "target", ".git", "__pycache__"].contains(&name.as_str()) {
+                        stack.push(p);
+                    }
+                } else if name.ends_with("_verify.py") {
+                    out.push(p.strip_prefix(root).expect("below").to_string_lossy().replace('\\', "/"));
+                }
+            }
+        }
+        out.sort();
+        out
+    }
+
+    /// The findings of the coverage rule for a table, the step files' bodies and the exclusions.
+    fn uncovered(table: &[Verifier], bodies: &[String], not_here: &[(&str, &str)], tree: &[String]) -> Vec<String> {
+        tree.iter()
+            .filter(|s| !table.iter().any(|v| v.script == s.as_str()) && !bodies.iter().any(|b| runs_script(b, s)) && !not_here.iter().any(|(n, _)| n == s))
+            .cloned()
+            .collect()
+    }
+
+    #[test]
+    fn every_verifier_in_the_tree_is_an_entry_or_says_why_not() {
+        let root = wai_dir();
+        let tree = verifiers_in_tree(&root);
+        assert!(tree.len() > 50, "the walk found the verifiers: {tree:?}");
+        let bodies: Vec<String> = steps().into_iter().map(|f| f.body).collect();
+        let missing = uncovered(VERIFIERS, &bodies, NOT_HERE, &tree);
+        assert!(missing.is_empty(), "verifiers no entry runs, no step file's body runs and NOT_HERE does not name: {missing:?}; give each an `# independent:` line in its step's file (.github/wai-conformance/verifiers/), or run it in the step's body, or name it in NOT_HERE with where it runs");
+        // The two that need fetched inputs run in their steps' bodies, not in the union.
+        for s in ["live-conformance/dred_verify.py", "format-probe-conformance/format_probe_verify.py"] {
+            assert!(!VERIFIERS.iter().any(|v| v.script == s) && bodies.iter().any(|b| runs_script(b, s)), "{s} runs in its step's body");
+        }
+        for (n, why) in NOT_HERE {
+            assert!(root.join(n).is_file(), "NOT_HERE names {n}, which is not there");
+            assert!(why.chars().any(char::is_alphanumeric), "{n}: a reason");
+            assert!(!VERIFIERS.iter().any(|v| v.script == *n), "{n} is both an entry and in NOT_HERE");
+        }
+        // The rule refuses what it names: a table without one entry's script leaves it uncovered,
+        // and so do steps without the body that runs one.
+        let without: Vec<Verifier> = VERIFIERS.iter().copied().filter(|v| v.script != "live-conformance/loc_verify.py").collect();
+        assert_eq!(uncovered(&without, &bodies, NOT_HERE, &tree), vec!["live-conformance/loc_verify.py".to_string()]);
+        let others: Vec<String> = bodies.iter().filter(|b| !runs_script(b, "live-conformance/dred_verify.py")).cloned().collect();
+        assert_eq!(uncovered(VERIFIERS, &others, NOT_HERE, &tree), vec!["live-conformance/dred_verify.py".to_string()]);
+    }
+
+    /// The workflows a reason names: its words ending in `.yml`.
+    fn workflows_named(why: &str) -> Vec<&str> {
+        why.split(|c: char| c.is_whitespace() || c == ',' || c == ';' || c == ':' || c == '(' || c == ')').filter(|w| w.ends_with(".yml")).collect()
+    }
+
+    /// Whether `text`, a workflow, runs `script` (a path from `wai/`) with Python in a step's
+    /// command: a comment, or a step's name, that names it is not a run of it.
+    fn runs_script(text: &str, script: &str) -> bool {
+        text.lines().map(str::trim).filter(|l| !l.starts_with('#') && !l.starts_with("- name:") && !l.starts_with("name:")).any(|l| {
+            let c = l.split(" #").next().unwrap_or("").trim_start_matches("run:").trim();
+            let w: Vec<&str> = c.split_whitespace().collect();
+            w.first().is_some_and(|p| p.starts_with("python")) && w.iter().any(|x| norm(x) == script)
+        })
+    }
+
+    #[test]
+    fn every_verifier_run_elsewhere_runs_where_its_reason_says() {
+        let wf = wai_dir().join("../.github/workflows");
+        for (n, why) in NOT_HERE {
+            let named = workflows_named(why);
+            assert!(!named.is_empty(), "{n}: the reason names the workflow that runs it: {why}");
+            for w in named {
+                let text = std::fs::read_to_string(wf.join(w)).unwrap_or_else(|e| panic!("{n}: its reason names {w}: {e}"));
+                assert!(runs_script(&text, n), "{n}: its reason says {w} runs it, and no step of {w} does: {why}");
+            }
+        }
+        // The rule reads commands: a workflow that names the verifier in a comment and a step's
+        // name alone does not run it; one whose step runs it, from `wai/` or the root, does.
+        let s = "pack-conformance/pack_verify.py";
+        assert!(!runs_script("      # pack_verify.py: pack-conformance/pack_verify.py pack-conformance
+      - name: python3 pack-conformance/pack_verify.py
+        run: echo pack-conformance/pack_verify.py
+", s));
+        assert!(runs_script("        run: python3 pack-conformance/pack_verify.py pack-conformance
+", s));
+        assert!(runs_script("          python3 -I wai/pack-conformance/pack_verify.py --jobs 2 wai/pack-conformance  # both
+", s));
+    }
+
+    #[test]
+    fn every_entry_names_what_is_there_once() {
+        let root = wai_dir();
+        for (i, v) in VERIFIERS.iter().enumerate() {
+            assert!(!VERIFIERS[..i].iter().any(|w| w.name == v.name), "{} twice", v.name);
+            assert!(AREAS.contains(&v.area), "{}: area {}", v.name, v.area);
+            assert!(!v.name.is_empty() && v.name.bytes().all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || c == b'-'), "{}: a name is lowercase words and hyphens", v.name);
+            assert!(!AREAS.contains(&v.name), "{}: a name is not an area's", v.name);
+            assert!(root.join(v.script).is_file(), "{}: {} is not there", v.name, v.script);
+            assert!(root.join(v.dir).is_dir(), "{}: {} is not a directory", v.name, v.dir);
+            for a in v.args.iter().filter(|a| !a.starts_with("--") && a.contains('/')) {
+                assert!(root.join(a).exists(), "{}: {a} is not there", v.name);
+            }
+            if let Some(f) = v.verdicts {
+                assert!(root.join(f).is_file(), "{}: {f}", v.name);
+            }
+            assert!(!corpus_files(v, &root).is_empty(), "{}: a corpus of no file", v.name);
+            assert!(corpus_files(v, &root).iter().all(|f| !f.to_string_lossy().ends_with(".py")), "{}: the corpus is not the verifier", v.name);
+        }
+    }
+
+    #[test]
+    fn a_run_given_files_reads_those_files_and_one_given_a_directory_reads_it() {
+        let root = wai_dir();
+        let files = |n: &str| corpus_files(named(n).unwrap(), &root);
+        // The OER runs, each over one vectors file of the one directory.
+        let oer: Vec<Vec<PathBuf>> = ["oer", "oer-firmware", "oer-edge", "oer-job"].iter().map(|n| files(n)).collect();
+        assert_eq!(oer[0], vec![root.join("oer-conformance/vectors.json")]);
+        assert_eq!(oer[1], vec![root.join("oer-conformance/firmware_vectors.json")]);
+        for i in 0..oer.len() {
+            for j in 0..i {
+                assert_ne!(oer[i], oer[j], "two OER runs read different files");
+            }
+        }
+        // A claims run reads its corpus's vectors file; the corpus's own run, its directory.
+        assert_eq!(files("bearer-claims"), vec![root.join("live-conformance/bearers/vectors.json")]);
+        let bearer = files("bearer");
+        assert!(bearer.len() > 1 && bearer.contains(&root.join("live-conformance/bearers/vectors.json")), "{bearer:?}");
+        // The determinism-cost record, its research page and the tiers text: exactly those three.
+        let mut three = ["research/determinism-cost/record.json", "research/determinism-cost.md", "extensions/determinism-tiers.md"].map(|f| root.join(f)).to_vec();
+        three.sort();
+        assert_eq!(files("determinism-cost"), three);
+        // A switch is no file; the directory after it is read.
+        assert!(files("injection").iter().all(|f| f.starts_with(root.join("live-conformance/injection"))));
+    }
+
+    /// A word of a workflow's command line as the table writes it: a path from `wai/`.
+    fn norm(w: &str) -> &str {
+        w.strip_prefix("wai/").unwrap_or(w)
+    }
+
+    /// The lines of `workflows` that run an entry's command themselves: `python3 [-I]`, the
+    /// entry's script, and its arguments or the first of them (a line continued on the next),
+    /// from `wai/` or from the repository's root.
+    fn by_hand(table: &[Verifier], workflows: &[(String, String)]) -> Vec<String> {
+        let mut out = Vec::new();
+        for (file, text) in workflows {
+            for (n, line) in text.lines().enumerate() {
+                let t = line.trim().trim_start_matches("run:").trim();
+                let Some(rest) = t.strip_prefix("python3 ").or_else(|| t.strip_prefix("python ")) else { continue };
+                let rest = rest.split(['>', '|', ';', '&']).next().unwrap_or("").trim().trim_end_matches('\\');
+                let mut words: Vec<&str> = rest.split_whitespace().collect();
+                if words.first() == Some(&"-I") {
+                    words.remove(0);
+                }
+                let Some((script, args)) = words.split_first() else { continue };
+                for v in table {
+                    if norm(script) == v.script && !args.is_empty() && args.len() <= v.args.len() && args.iter().zip(v.args).all(|(a, b)| norm(a) == *b) {
+                        out.push(format!("{file}:{}: {t} (the independent verifier {})", n + 1, v.name));
+                    }
+                }
+            }
+        }
+        out
+    }
+
+    /// Whether a workflow runs `wai conform --independent` in a step's command: a comment or a
+    /// step's name that only says so is not a run of it.
+    fn runs_the_union(text: &str) -> bool {
+        text.lines().map(str::trim).filter(|l| !l.starts_with('#') && !l.starts_with("- name:") && !l.starts_with("name:")).any(|l| l.split(" #").next().is_some_and(|c| c.contains(" conform --independent")))
+    }
+
+    #[test]
+    fn the_union_is_one_command_and_the_workflow_keeps_no_copy() {
+        let name = "wai-conformance.yml";
+        let text = std::fs::read_to_string(wai_dir().join("../.github/workflows").join(name)).expect("the conformance workflow");
+        let mut wf = vec![(name.to_string(), text)];
+        // The steps of its independent verifiers' job are files: none runs an entry by hand either.
+        let files = steps();
+        assert!(files.len() > 50, "the step files: {}", files.len());
+        wf.extend(files.into_iter().map(|f| (f.file, f.body)));
+        let found = by_hand(VERIFIERS, &wf);
+        assert!(found.is_empty(), "the conformance workflow, or a step file's body, runs an independent verifier itself, beside `wai conform --independent`: {found:#?}");
+        assert!(runs_the_union(&wf[0].1), "{name} runs the union through wai conform --independent, in a step's command");
+        // The rule reads commands: a workflow that names the command only in a comment and a
+        // step's name, and runs `wai conform` without it, does not run the union.
+        assert!(!runs_the_union("      # by `wai conform --independent` in wai/\n      - name: Every verifier, through wai conform --independent\n        run: |\n          \"$w\" conform --root . --out d  # not conform --independent\n"));
+        assert!(runs_the_union("        run: |\n          \"$w\" conform --independent --root . --out d\n"));
+        // The rule finds what it names: a workflow line that runs an entry by hand.
+        let planted = vec![(
+            "x.yml".to_string(),
+            "        run: python3 -I live-conformance/loc_verify.py live-conformance/loc\n          python3 -I wai/quantum-conformance/tools/referee.py wai/quantum-conformance\n          python3 -I tools/wai_determinism_cost_verify.py research/determinism-cost/record.json \\\n".to_string(),
+        )];
+        assert_eq!(by_hand(VERIFIERS, &planted).len(), 3, "{:?}", by_hand(VERIFIERS, &planted));
+        // A verifier's other modes are not the entry: a differential, a --skip, a verdicts mode.
+        let other = vec![("y.yml".to_string(), "python3 -I conform-result-conformance/conform_result_verify.py --skip x conform-result-conformance\npython3 signer-conformance/signer_verify.py verdicts signer-conformance/vectors.json > a.tsv\n".to_string())];
+        assert!(by_hand(VERIFIERS, &other).is_empty());
+    }
+
+    /// The table compiled in is the step files' `# independent:` lines as they are now (a stale
+    /// build's would differ), every one read; and the reading refuses what it cannot read.
+    #[test]
+    fn the_table_is_the_step_files_lines() {
+        assert_eq!(TABLE_ABSENT, None, "this build read the step files");
+        let read = table::entries(&repo_dir()).expect("every line reads").expect("the step files are there");
+        let files = steps();
+        let lines: usize = files.iter().map(|f| f.independent.len()).sum();
+        assert_eq!(read.len(), lines, "an entry a line");
+        assert_eq!(read.len(), VERIFIERS.len(), "the table compiled in has every entry");
+        for (e, v) in read.iter().zip(VERIFIERS) {
+            let same = e.name == v.name && e.area == v.area && e.dir == v.dir && e.script == v.script && e.args == v.args
+                && e.isolated == v.isolated && e.needs == v.needs && e.verdicts.as_deref() == v.verdicts && e.file == v.file;
+            assert!(same, "{} ({}): the step file says {e:?}, the table {v:?}; build again", v.name, v.file);
+        }
+        // In the files' order: the job's, ascending `order:`.
+        let order: Vec<i64> = VERIFIERS.iter().map(|v| files.iter().find(|f| f.file == v.file).expect("its file").order).collect();
+        assert!(order.windows(2).all(|w| w[0] <= w[1]), "the table runs in the step files' order");
+        // A line, read: every option, and the directory from the first argument that names one.
+        let e = table::parse_line("claim trust needs=cryptography verdicts=claim-conformance/vectors.json python3 claim-conformance/claim_verify.py claim-conformance/vectors.json").unwrap();
+        assert_eq!((e.name.as_str(), e.isolated, e.needs.clone(), e.verdicts.as_deref()), ("claim", false, vec!["cryptography".to_string()], Some("claim-conformance/vectors.json")));
+        assert_eq!(table::derive_dir(&e, &wai_dir()).as_deref(), Some("claim-conformance"), "a file's directory");
+        let e = table::parse_line("bearer-claims live needs=cryptography python3 -I claim-conformance/claim_verify.py bearer live-conformance/bearers/vectors.json").unwrap();
+        assert_eq!(table::derive_dir(&e, &wai_dir()).as_deref(), Some("live-conformance/bearers"), "a word that is no path is passed over");
+        // What the reading refuses, each saying why.
+        for (bad, why) in [
+            ("live-rooms live", "an entry is"),
+            ("Live-Rooms live python3 x_verify.py d", "lowercase words"),
+            ("live live python3 x_verify.py d", "no area's"),
+            ("live-rooms nowhere python3 x_verify.py d", "is none of"),
+            ("live-rooms live needs python3 x_verify.py d", "an option is"),
+            ("live-rooms live dir=a dir=b python3 x_verify.py d", "each once"),
+            ("live-rooms live -I x_verify.py d e", "before `python3`"),
+            ("live-rooms live needs=x dir=y", "no command line"),
+            ("live-rooms live needs=x python3 -I", "names no script"),
+        ] {
+            let got = table::parse_line(bad).expect_err(bad);
+            assert!(got.contains(why), "{bad}: {got}");
+        }
+        // A tree without the step files has no table, which is not an empty one.
+        let none = std::env::temp_dir().join(format!("wai-no-steps-{}", std::process::id()));
+        assert_eq!(table::entries(&none).unwrap(), None);
+        // A name two files give, or a line with no corpus, is the error, naming the file.
+        let t = std::env::temp_dir().join(format!("wai-steps-{}", std::process::id()));
+        let d = t.join(table::STEPS);
+        std::fs::create_dir_all(&d).unwrap();
+        std::fs::create_dir_all(t.join("wai/c")).unwrap();
+        std::fs::write(d.join("a.sh"), "# step: a\n# order: 1\n# independent: x live python3 c_verify.py c\n").unwrap();
+        std::fs::write(d.join("b.sh"), "# step: b\n# order: 2\n# independent: x live python3 c_verify.py c\n").unwrap();
+        let got = table::entries(&t).unwrap_err();
+        assert!(got.contains("b.sh: line 3") && got.contains("also .github/wai-conformance/verifiers/a.sh's"), "{got}");
+        std::fs::write(d.join("b.sh"), "# step: b\n# order: 2\n# independent: y live python3 c_verify.py nowhere\n").unwrap();
+        let got = table::entries(&t).unwrap_err();
+        assert!(got.contains("give dir="), "{got}");
+        std::fs::remove_dir_all(&t).unwrap();
+    }
+
+    #[test]
+    fn a_build_without_the_table_refuses_to_run_rather_than_pass_on_nothing() {
+        let got = select_in(&[], Some("this wai was built without the step files"), None).unwrap_err();
+        assert!(got.contains("built without the step files"), "{got}");
+        assert!(select_in(&[], Some("absent"), Some("trust")).is_err());
+        assert_eq!(select_in(VERIFIERS, None, None).unwrap().len(), VERIFIERS.len());
+    }
+
+    #[test]
+    fn a_selection_is_areas_and_names() {
+        assert_eq!(select(None).unwrap().len(), VERIFIERS.len());
+        let trust = select(Some("trust")).unwrap();
+        assert!(trust.iter().all(|v| v.area == "trust") && trust.iter().any(|v| v.name == "claim"));
+        let two = select(Some("live-rooms, pin")).unwrap();
+        assert_eq!(two.iter().map(|v| v.name).collect::<Vec<_>>(), vec!["live-rooms", "pin"], "in the table's order");
+        assert!(select(Some("nope")).unwrap_err().contains("nope"));
+        assert!(select(Some(",")).is_err());
+    }
+
+    #[test]
+    fn the_command_line_is_the_readmes() {
+        let claim = named("claim").unwrap();
+        assert_eq!(command_line(claim, "python3", false), "python3 claim-conformance/claim_verify.py claim-conformance/vectors.json");
+        assert_eq!(command_line(claim, "python3", true), "python3 claim-conformance/claim_verify.py verdicts claim-conformance/vectors.json");
+        let rooms = named("live-rooms").unwrap();
+        assert_eq!(command_line(rooms, "python3", true), "python3 -I live-conformance/live_rooms_verify.py live-conformance/rooms", "no verdicts mode: the corpus run");
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn a_run_reports_its_exit_its_output_and_a_timeout() {
+        let d = std::env::temp_dir();
+        let r = run_in(&d, "sh", &["-c", "echo one; echo two >&2; exit 3"], Duration::from_secs(20)).unwrap();
+        assert_eq!((r.code, r.passed()), (Some(3), false));
+        assert_eq!(r.verdict(), "exit 3: two");
+        assert_eq!(r.tail(5), "one\ntwo");
+        let r = run_in(&d, "sh", &["-c", "sleep 30"], Duration::from_millis(200)).unwrap();
+        assert!(r.timed_out && !r.passed() && r.verdict().starts_with("timed out"));
+        assert!(r.seconds < 10.0);
+    }
+}
diff --git a/wai/wai-rs/src/bin/wai_cli/dx/independent_table.rs b/wai/wai-rs/src/bin/wai_cli/dx/independent_table.rs
new file mode 100644
index 000000000..6f57c1007
--- /dev/null
+++ b/wai/wai-rs/src/bin/wai_cli/dx/independent_table.rs
@@ -0,0 +1,211 @@
+//! The table of independent verifiers, read from the step files of the conformance workflow
+//! (`.github/wai-conformance/verifiers/*.sh`): each `# independent:` line of a file's header is
+//! one entry. `build.rs` reads them with this module and writes the table that
+//! [`super::independent`] includes, so the table is no list of its own: a corpus's verifier
+//! joins it by a line in its own step's file, which no other change edits.
+//! `scripts/wai-conformance-lists.py` reads the same lines the same way (`independent_entry`).
+//!
+//! A line is `<name> <area> [needs=<packages>] [verdicts=<file>] [dir=<dir>] python3 [-I]
+//! <script> <args>`: the command line, run in `wai/`, that the corpus's README gives. The
+//! corpus's directory is `dir=`, or else the first argument that names a directory under `wai/`,
+//! or the directory of the first that names a file. The entries run in the files' order
+//! (`# order:`, a tie by file name), and within a file in the order of its lines.
+//!
+//! Shared by build.rs (by `#[path]`) and the `wai` binary's tests: standard library only.
+
+// build.rs uses the reading and the rendering, the binary's tests the reading alone.
+#![allow(dead_code)]
+
+use std::path::Path;
+
+/// The areas a corpus belongs to, as `wai conform --suite` names them.
+pub const AREAS: &[&str] = &["trust", "media", "delivery", "live"];
+
+/// The step files' directory, from the repository's root.
+pub const STEPS: &str = ".github/wai-conformance/verifiers";
+
+/// One entry, as a step file's line gives it.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Entry {
+    pub name: String,
+    pub area: String,
+    pub dir: String,
+    pub script: String,
+    pub args: Vec<String>,
+    pub isolated: bool,
+    pub needs: Vec<String>,
+    pub verdicts: Option<String>,
+    /// The step file that holds the line, from the repository's root.
+    pub file: String,
+}
+
+/// A step file: its name, its header's `step:` and `order:`, its `independent:` lines (each
+/// with its line number) and its body, the shell after its leading comment.
+#[derive(Clone, Debug)]
+pub struct StepFile {
+    pub file: String,
+    pub step: String,
+    pub order: i64,
+    pub independent: Vec<(usize, String)>,
+    pub body: String,
+}
+
+/// `# key: value`, the key lowercase words joined by hyphens.
+fn header_line(line: &str) -> Option<(&str, &str)> {
+    let rest = line.strip_prefix("# ")?;
+    let (k, v) = rest.split_once(':')?;
+    let ok = k.chars().next().is_some_and(|c| c.is_ascii_lowercase()) && k.chars().all(|c| c.is_ascii_lowercase() || c == '-');
+    ok.then_some((k, v.trim()))
+}
+
+/// Every step file of `dir`, in the order the job runs them; `Ok(None)` when there is no such
+/// directory (a build outside the repository).
+pub fn step_files(dir: &Path) -> Result<Option<Vec<StepFile>>, String> {
+    if !dir.is_dir() {
+        return Ok(None);
+    }
+    let rd = std::fs::read_dir(dir).map_err(|e| format!("{}: {e}", dir.display()))?;
+    let mut names: Vec<String> = rd.flatten().map(|e| e.file_name().to_string_lossy().into_owned()).filter(|n| n.ends_with(".sh")).collect();
+    names.sort();
+    let mut out = Vec::new();
+    for n in names {
+        let file = format!("{STEPS}/{n}");
+        let text = std::fs::read_to_string(dir.join(&n)).map_err(|e| format!("{file}: {e}"))?;
+        let lines: Vec<&str> = text.lines().map(|l| l.trim_end_matches('\r')).collect();
+        let (mut step, mut order, mut independent) = (None, None, Vec::new());
+        let mut i = 0;
+        while i < lines.len() {
+            let Some((k, v)) = header_line(lines[i]) else { break };
+            match k {
+                "step" => step = Some(v.to_string()),
+                "order" => order = Some(v.parse::<i64>().map_err(|_| format!("{file}: line {}: order `{v}` is not an integer", i + 1))?),
+                "independent" => independent.push((i + 1, v.to_string())),
+                _ => {}
+            }
+            i += 1;
+        }
+        while i < lines.len() && lines[i].starts_with('#') {
+            i += 1;
+        }
+        let body = lines[i..].join("\n").trim_end().to_string();
+        out.push(StepFile {
+            step: step.ok_or_else(|| format!("{file}: no `step:` line in its header"))?,
+            order: order.ok_or_else(|| format!("{file}: no `order:` line in its header"))?,
+            file,
+            independent,
+            body,
+        });
+    }
+    out.sort_by(|a, b| a.order.cmp(&b.order).then_with(|| a.file.cmp(&b.file)));
+    Ok(Some(out))
+}
+
+/// The name of an entry: lowercase words and digits joined by hyphens, and no area's.
+fn good_name(n: &str) -> bool {
+    !n.is_empty() && !n.starts_with('-') && !n.ends_with('-') && !n.contains("--")
+        && n.bytes().all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || c == b'-') && !AREAS.contains(&n)
+}
+
+/// One `independent:` line read, its directory not yet derived.
+pub fn parse_line(line: &str) -> Result<Entry, String> {
+    let w: Vec<&str> = line.split_whitespace().collect();
+    if w.len() < 4 {
+        return Err("an entry is `<name> <area> [key=value]... python3 [-I] <script> <args>`".into());
+    }
+    let (name, area) = (w[0], w[1]);
+    if !good_name(name) {
+        return Err(format!("the name `{name}` is lowercase words joined by hyphens, and no area's"));
+    }
+    if !AREAS.contains(&area) {
+        return Err(format!("the area `{area}` is none of {}", AREAS.join(", ")));
+    }
+    let mut e = Entry { name: name.into(), area: area.into(), dir: String::new(), script: String::new(), args: Vec::new(), isolated: false, needs: Vec::new(), verdicts: None, file: String::new() };
+    let mut i = 2;
+    let mut seen: Vec<&str> = Vec::new();
+    while i < w.len() && w[i] != "python3" {
+        let (k, v) = w[i].split_once('=').unwrap_or((w[i], ""));
+        if !["needs", "verdicts", "dir"].contains(&k) || v.is_empty() || seen.contains(&k) {
+            return Err(format!("`{}`: an option is needs=, verdicts= or dir=, each once, before `python3`", w[i]));
+        }
+        seen.push(k);
+        match k {
+            "needs" => e.needs = v.split(',').map(String::from).collect(),
+            "verdicts" => e.verdicts = Some(v.into()),
+            _ => e.dir = v.into(),
+        }
+        i += 1;
+    }
+    if i == w.len() {
+        return Err("no command line: it starts with `python3`".into());
+    }
+    i += 1;
+    if w.get(i) == Some(&"-I") {
+        e.isolated = true;
+        i += 1;
+    }
+    let Some(script) = w.get(i) else { return Err("the command line names no script".into()) };
+    e.script = (*script).into();
+    e.args = w[i + 1..].iter().map(|a| a.to_string()).collect();
+    Ok(e)
+}
+
+/// The corpus directory an entry names, under `wai`: see the module's documentation.
+pub fn derive_dir(e: &Entry, wai: &Path) -> Option<String> {
+    if !e.dir.is_empty() {
+        return Some(e.dir.clone());
+    }
+    for a in e.args.iter().filter(|a| !a.starts_with('-')) {
+        let p = wai.join(a);
+        if p.is_dir() {
+            return Some(a.clone());
+        }
+        if p.is_file() {
+            return Some(a.rsplit_once('/').map_or("", |(d, _)| d).to_string());
+        }
+    }
+    None
+}
+
+/// Every entry of the step files of the repository at `repo`, in order; `Ok(None)` when the
+/// step files are not there. A line that cannot be read, a name given twice or an entry with no
+/// corpus directory is the error, naming its file and line.
+pub fn entries(repo: &Path) -> Result<Option<Vec<Entry>>, String> {
+    let Some(files) = step_files(&repo.join(STEPS))? else { return Ok(None) };
+    let wai = repo.join("wai");
+    let mut out: Vec<Entry> = Vec::new();
+    for f in &files {
+        for (n, line) in &f.independent {
+            let mut e = parse_line(line).map_err(|why| format!("{}: line {n}: independent `{line}`: {why}", f.file))?;
+            if let Some(o) = out.iter().find(|o| o.name == e.name) {
+                return Err(format!("{}: line {n}: the independent verifier `{}` is also {}'s", f.file, e.name, o.file));
+            }
+            e.dir = derive_dir(&e, &wai).ok_or_else(|| format!("{}: line {n}: independent `{}`: no argument names a corpus under wai/ (give dir=)", f.file, e.name))?;
+            e.file = f.file.clone();
+            out.push(e);
+        }
+    }
+    Ok(Some(out))
+}
+
+fn strs(v: &[String]) -> String {
+    format!("&[{}]", v.iter().map(|s| format!("{s:?}")).collect::<Vec<_>>().join(", "))
+}
+
+/// The table as Rust, for `include!`: `VERIFIERS`, and `TABLE_ABSENT`, `None`.
+pub fn render(entries: &[Entry]) -> String {
+    let mut s = String::from("// Written by build.rs from the `# independent:` lines of .github/wai-conformance/verifiers/*.sh\n// (dx/independent_table.rs). Do not edit: edit those lines.\n\n/// Every independent verifier, in the order they run.\npub const VERIFIERS: &[Verifier] = &[\n");
+    for e in entries {
+        s.push_str(&format!(
+            "    Verifier {{ name: {:?}, area: {:?}, dir: {:?}, script: {:?}, args: {}, isolated: {}, needs: {}, verdicts: {}, file: {:?} }},\n",
+            e.name, e.area, e.dir, e.script, strs(&e.args), e.isolated, strs(&e.needs),
+            e.verdicts.as_ref().map_or("None".to_string(), |v| format!("Some({v:?})")), e.file
+        ));
+    }
+    s.push_str("];\n\n/// Why this build has no table: `None`, it has one.\npub const TABLE_ABSENT: Option<&str> = None;\n");
+    s
+}
+
+/// The table of a build that could not read it: none, and why.
+pub fn render_absent(why: &str) -> String {
+    format!("// Written by build.rs (dx/independent_table.rs): this build has no table.\n\npub const VERIFIERS: &[Verifier] = &[];\n\npub const TABLE_ABSENT: Option<&str> = Some({why:?});\n")
+}
diff --git a/wai/wai-rs/src/bin/wai_cli/dx/mod.rs b/wai/wai-rs/src/bin/wai_cli/dx/mod.rs
index aed0a6449..b3950add7 100644
--- a/wai/wai-rs/src/bin/wai_cli/dx/mod.rs
+++ b/wai/wai-rs/src/bin/wai_cli/dx/mod.rs
@@ -2,6 +2,8 @@
 //!
 //! - `toolchain.test` (`wai hello`): the four steps of WAI (name, dispatch, rebuild,
 //!   receipt) on a bundled sample;
+//! - `toolchain.doctor` (`wai doctor`): which `wai` runs when you type it, the install, the
+//!   ports, browsers and keychain, checked (`doctor.rs`);
 //! - `project.create` (`wai create`): a new project from one of the examples
 //!   (`wai/examples/`), or from an app made with Create (`--from app.oui`, `app.export`);
 //! - `dev.start` (`wai dev`): a relay, a room service and the room page on one origin, on this
@@ -12,8 +14,9 @@
 //!   checkout's corpus;
 //! - `compat.check` (`wai breaking`): what the working tree breaks against a git ref;
 //! - `conformance.run` (`wai conform`): WAI's conformance corpus run against another
-//!   implementation, its result a signed record; `conformance.list` (`wai conformance list`,
-//!   also `wai conform --list`) the kinds and suites;
+//!   implementation, its result a signed record, beside or without the corpora's independent
+//!   verifiers (`independent.rs`); `conformance.list` (`wai conformance list`, also `wai conform
+//!   --list`) the kinds and suites;
 //! - `app.guide`, `app.check`, `app.export` (`wai app guide|check|export`; a build with
 //!   `app`): an app made with Create;
 //! - `mcp.start` (`wai mcp`): WAI's operations as tools for a coding agent, a Model Context
@@ -52,9 +55,12 @@ mod channel;
 pub(crate) mod conform;
 mod create;
 mod dev;
+pub(crate) mod doctor;
 pub(crate) mod envelope;
 mod fleet;
 mod hello;
+#[cfg(any(feature = "quickstart", feature = "mcp"))]
+pub(crate) mod independent;
 mod opportunity;
 mod share;
 mod verify;
@@ -74,6 +80,7 @@ pub const MCP: &str = "mcp";
 /// The developer's path, by operation id.
 pub const VERBS: &[Impl] = &[
     Impl { id: "toolchain.test", run: hello::main, json: Json::Text },
+    Impl { id: "toolchain.doctor", run: doctor::main, json: Json::Native },
     Impl { id: "project.create", run: create::main, json: Json::OwnWith("--list") },
     Impl { id: "dev.start", run: dev::main, json: Json::StreamUnless("--check") },
     Impl { id: "receipt.verify", run: verify::main, json: Json::Text },
diff --git a/wai/wai-rs/src/bin/wai_cli/mcp/tools.rs b/wai/wai-rs/src/bin/wai_cli/mcp/tools.rs
index 82a67cdcf..ef0600fd2 100644
--- a/wai/wai-rs/src/bin/wai_cli/mcp/tools.rs
+++ b/wai/wai-rs/src/bin/wai_cli/mcp/tools.rs
@@ -97,9 +97,11 @@ pub(crate) const TOOLS: &[Tool] = &[
     Tool { op: "envelope.wrap", toolset: Toolset::Core, title: "Package a media file", effect: Effect::Writes, schema: s_package, run: package_build,
         description: "Carry a media file's bytes in a WAI envelope under a registered capability, with an optional fallback or companions, as `wai wrap` does and under the same rules; writes the envelope inside the project directory and returns what it holds." },
     Tool { op: "conformance.list", toolset: Toolset::Core, title: "List conformance corpora", effect: Effect::Reads, schema: s_none, run: conformance_list,
-        description: "The conformance corpora in the specification tree and the independent verifier that checks each, as CI runs them." },
+        description: "The conformance corpora in the specification tree and the independent verifier that checks each, with its command line, as wai conform --independent and CI run them." },
     Tool { op: "conformance.run", toolset: Toolset::Core, title: "Run a conformance corpus", effect: Effect::Runs, schema: s_corpus, run: conformance_run,
-        description: "Run a corpus's independent verifier (python3 -I <verifier> <corpus>) on this machine and return whether it passed, its exit code, its time and the end of its output." },
+        description: "Run a corpus's independent verifier on this machine, with the command line conformance_list gives it (python3 [-I] <verifier> <arguments>, in the wai/ directory), and return whether it passed, its exit code, its time and the end of its output." },
+    Tool { op: "toolchain.doctor", toolset: Toolset::Core, title: "Check this machine for the quickstart", effect: Effect::Reads, schema: s_none, run: toolchain_doctor,
+        description: "Which program runs when a person types wai (another program of that name first on PATH, such as the one the crates.io package wai-cli installs, is a failure), this install and what wai dev runs beside it, the loopback ports, the browsers registered to open web pages and where a credential is kept: each check ok, warn or fail, with what to do." },
     Tool { op: "docs.search", toolset: Toolset::Core, title: "Search the specification", effect: Effect::Reads, schema: s_search, run: docs_search,
         description: "Search SPEC.md, REGISTRY.md and every extension for lines holding all the query's words: each hit's file, line, section heading and text, for quoting with its section." },
     Tool { op: "dev.start", toolset: Toolset::Dev, title: "Start a development room", effect: Effect::DevRoom, schema: s_dev_start, run: dev_room::start,
@@ -244,8 +246,8 @@ fn s_package() -> Value {
 fn s_corpus() -> Value {
     obj(
         json!({
-            "corpus": {"type": "string", "description": "The corpus directory, relative to the wai/ directory, as conformance_list names it."},
-            "verifier": {"type": "string", "description": "The verifier script, when the corpus has several or none listed."},
+            "corpus": {"type": "string", "description": "The corpus directory, relative to the wai/ directory, or its independent verifier's name, as conformance_list names them. A directory runs its corpus's own verifier, the one whose script is in that corpus's conformance directory, where it has one; another corpus's verifier run over it (the claim verifier over its claims) is run by its name."},
+            "verifier": {"type": "string", "description": "The verifier script, when the corpus has several of its own or none listed."},
             "timeout_s": {"type": "integer", "minimum": 1, "maximum": 1800, "description": "Default 600."}
         }),
         &["corpus"],
@@ -788,32 +790,14 @@ fn package_build(server: &mut Server, args: &Value) -> Result<Value, String> {
 
 // ---------------------------------------------------------------------------- conformance
 
-/// Every (verifier, corpus) pair: the `python3 [-I] <script.py> <dir>` lines of the conformance
-/// workflow and of its verifier steps' files (`.github/wai-conformance/verifiers/`), when the
-/// tree holds them, and each `*-conformance/*_verify.py` with its directory.
-fn corpora(root: &Path) -> Vec<(String, String)> {
-    let mut pairs = std::collections::BTreeSet::new();
-    let mut texts: Vec<String> = std::fs::read_to_string(root.join("../.github/workflows/wai-conformance.yml")).into_iter().collect();
-    if let Ok(rd) = std::fs::read_dir(root.join("../.github/wai-conformance/verifiers")) {
-        let mut steps: Vec<PathBuf> = rd.filter_map(Result::ok).map(|e| e.path()).filter(|p| p.extension().is_some_and(|x| x == "sh")).collect();
-        steps.sort();
-        texts.extend(steps.iter().filter_map(|p| std::fs::read_to_string(p).ok()));
-    }
-    for wf in &texts {
-        for line in wf.lines() {
-            let t = line.trim().trim_start_matches("run:").trim();
-            let Some(rest) = t.strip_prefix("python3 ") else { continue };
-            let rest = rest.trim_start_matches("-I ").trim();
-            let mut it = rest.split_whitespace();
-            let (Some(script), Some(dir)) = (it.next(), it.next()) else { continue };
-            let script = script.trim_start_matches("wai/");
-            let dir = dir.trim_start_matches("wai/");
-            if script.ends_with("_verify.py") && root.join(script).is_file() && root.join(dir).is_dir() {
-                pairs.insert((dir.to_string(), script.to_string()));
-            }
-        }
-    }
+/// Every (corpus, verifier, command) the independent verifiers' table holds
+/// (`dx::independent`, which `wai conform --independent` and CI run), and each
+/// `*-conformance/*_verify.py` the table does not run, with its directory.
+fn corpora(root: &Path) -> Vec<(String, String, Option<&'static crate::dx::independent::Verifier>)> {
+    let mut out: Vec<(String, String, Option<&'static crate::dx::independent::Verifier>)> =
+        crate::dx::independent::VERIFIERS.iter().map(|v| (v.dir.to_string(), v.script.to_string(), Some(v))).collect();
     if let Ok(rd) = std::fs::read_dir(root) {
+        let mut more = std::collections::BTreeSet::new();
         for e in rd.filter_map(Result::ok) {
             let name = e.file_name().to_string_lossy().to_string();
             if !name.ends_with("-conformance") || !e.path().is_dir() {
@@ -822,34 +806,65 @@ fn corpora(root: &Path) -> Vec<(String, String)> {
             if let Ok(inner) = std::fs::read_dir(e.path()) {
                 for f in inner.filter_map(Result::ok) {
                     let fname = f.file_name().to_string_lossy().to_string();
-                    if fname.ends_with("_verify.py") {
-                        pairs.insert((name.clone(), format!("{name}/{fname}")));
+                    let script = format!("{name}/{fname}");
+                    if fname.ends_with("_verify.py") && !out.iter().any(|(_, s, _)| *s == script) {
+                        more.insert((name.clone(), script));
                     }
                 }
             }
         }
+        out.extend(more.into_iter().map(|(c, s)| (c, s, None)));
     }
-    pairs.into_iter().collect()
+    out
 }
 
 fn conformance_list(server: &mut Server, _: &Value) -> Result<Value, String> {
     let root = server.spec_root()?;
-    let list: Vec<Value> = corpora(&root).into_iter().map(|(c, v)| json!({"corpus": c, "verifier": v})).collect();
+    let list: Vec<Value> = corpora(&root)
+        .into_iter()
+        .map(|(c, s, v)| match v {
+            Some(v) => json!({"corpus": c, "verifier": s, "name": v.name, "area": v.area, "command": crate::dx::independent::command_line(v, "python3", false)}),
+            None => json!({"corpus": c, "verifier": s, "command": format!("python3 -I {s} {c}")}),
+        })
+        .collect();
     Ok(json!({"root": root.display().to_string(), "count": list.len(), "corpora": list}))
 }
 
 fn conformance_run(server: &mut Server, args: &Value) -> Result<Value, String> {
     let root = server.spec_root()?;
-    let corpus = str_arg(args, "corpus")?.trim_end_matches('/').to_string();
+    let asked = str_arg(args, "corpus")?.trim_end_matches('/').to_string();
     let known = corpora(&root);
-    let verifier = match opt_str(args, "verifier") {
-        Some(v) => v.to_string(),
-        None => {
-            let m: Vec<&(String, String)> = known.iter().filter(|(c, _)| *c == corpus).collect();
+    // The corpus by an independent verifier's name, or by its directory.
+    let by_name = crate::dx::independent::named(&asked);
+    let corpus = by_name.map_or(asked.clone(), |v| v.dir.to_string());
+    let (verifier, entry) = match (by_name, opt_str(args, "verifier")) {
+        (Some(v), _) => (v.script.to_string(), Some(v)),
+        (None, Some(v)) => {
+            let m: Vec<&(String, String, Option<&'static crate::dx::independent::Verifier>)> = known.iter().filter(|(c, s, _)| *c == corpus && s == v).collect();
+            if m.len() > 1 {
+                return Err(format!("{corpus} has several runs of {v}: {}; give one's name as corpus", m.iter().filter_map(|(_, _, e)| e.map(|e| e.name)).collect::<Vec<_>>().join(", ")));
+            }
+            (v.to_string(), m.first().and_then(|(_, _, e)| *e))
+        }
+        (None, None) => {
+            let mut m: Vec<&(String, String, Option<&'static crate::dx::independent::Verifier>)> = known.iter().filter(|(c, _, _)| *c == corpus).collect();
+            // Several entries for one directory: the corpus's own verifier, where it has one alone (the
+            // claim verifier also runs over a corpus's claims, as an entry of its own name).
+            let own = crate::dx::independent::own_verifiers(&corpus);
+            if m.len() > 1
+                && let [one] = own.as_slice()
+            {
+                m.retain(|(_, _, e)| e.is_some_and(|e| e.name == one.name));
+            }
             match m.as_slice() {
-                [(_, v)] => v.clone(),
+                [(_, v, e)] => (v.clone(), *e),
                 [] => return Err(format!("no verifier is listed for {corpus}; {} lists the corpora, or give verifier", name_of(conformance_list))),
-                many => return Err(format!("{corpus} has several verifiers: {}; give verifier", many.iter().map(|(_, v)| v.as_str()).collect::<Vec<_>>().join(", "))),
+                many => {
+                    return Err(format!(
+                        "{corpus} has several verifiers: {}; give one's name as corpus, or give verifier",
+                        many.iter().map(|(_, v, e)| e.map_or(v.clone(), |e| format!("{} ({v})", e.name))).collect::<Vec<_>>().join(", ")
+                    ));
+                }
             }
         }
     };
@@ -863,58 +878,37 @@ fn conformance_run(server: &mut Server, args: &Value) -> Result<Value, String> {
     };
     let script = inside(&verifier)?;
     let dir = inside(&corpus)?;
-    if !script.file_name().is_some_and(|n| n.to_string_lossy().ends_with("_verify.py")) || !dir.is_dir() {
+    // A script the table does not name runs only if it is a corpus verifier by its name.
+    if (entry.is_none() && !script.file_name().is_some_and(|n| n.to_string_lossy().ends_with("_verify.py"))) || !dir.is_dir() {
         return Err("verifier: a *_verify.py script; corpus: a directory".into());
     }
-    let timeout = args.get("timeout_s").and_then(Value::as_u64).unwrap_or(600).clamp(1, 1800);
-    let started = std::time::Instant::now();
-    let mut child = std::process::Command::new("python3")
-        .arg("-I")
-        .arg(&script)
-        .arg(&dir)
-        .current_dir(&root)
-        .stdin(std::process::Stdio::null())
-        .stdout(std::process::Stdio::piped())
-        .stderr(std::process::Stdio::piped())
-        .spawn()
-        .map_err(|e| format!("python3: {e}"))?;
-    let (mut so, mut se) = (child.stdout.take().expect("piped"), child.stderr.take().expect("piped"));
-    let out_t = std::thread::spawn(move || {
-        let mut b = Vec::new();
-        let _ = std::io::Read::read_to_end(&mut so, &mut b);
-        b
-    });
-    let err_t = std::thread::spawn(move || {
-        let mut b = Vec::new();
-        let _ = std::io::Read::read_to_end(&mut se, &mut b);
-        b
-    });
-    let status = loop {
-        if let Some(s) = child.try_wait().map_err(|e| e.to_string())? {
-            break Some(s);
+    let timeout = std::time::Duration::from_secs(args.get("timeout_s").and_then(Value::as_u64).unwrap_or(600).clamp(1, 1800));
+    // A verifier of the table runs with its own command line; another, as `python3 -I <script> <corpus>`.
+    let (command, ran) = match entry {
+        Some(v) => (crate::dx::independent::command_line(v, "python3", false), crate::dx::independent::run(v, &root, "python3", false, timeout)?),
+        None => {
+            let (s, d) = (script.to_string_lossy().into_owned(), dir.to_string_lossy().into_owned());
+            (format!("python3 -I {verifier} {corpus}"), crate::dx::independent::run_in(&root, "python3", &["-I", &s, &d], timeout)?)
         }
-        if started.elapsed().as_secs() >= timeout {
-            let _ = child.kill();
-            let _ = child.wait();
-            break None;
-        }
-        std::thread::sleep(std::time::Duration::from_millis(50));
     };
-    let mut text = String::from_utf8_lossy(&out_t.join().unwrap_or_default()).to_string();
-    text.push_str(&String::from_utf8_lossy(&err_t.join().unwrap_or_default()));
-    let lines: Vec<&str> = text.lines().collect();
-    let tail = lines[lines.len().saturating_sub(60)..].join("\n");
     Ok(json!({
         "corpus": corpus,
         "verifier": verifier,
-        "passed": status.is_some_and(|s| s.success()),
-        "exit_code": status.and_then(|s| s.code()),
-        "timed_out": status.is_none(),
-        "seconds": started.elapsed().as_secs_f64(),
-        "output_tail": tail,
+        "command": command,
+        "passed": ran.passed(),
+        "exit_code": ran.code,
+        "timed_out": ran.timed_out,
+        "seconds": ran.seconds,
+        "output_tail": ran.tail(60),
     }))
 }
 
+// ---------------------------------------------------------------------------- the doctor
+
+fn toolchain_doctor(_: &mut Server, _: &Value) -> Result<Value, String> {
+    Ok(crate::dx::doctor::report(&crate::dx::doctor::checks()))
+}
+
 // ------------------------------------------------------------------------- the spec text
 
 /// The specification's Markdown files: SPEC.md, REGISTRY.md, then every file below
diff --git a/wai/wai-rs/src/catalogue.rs b/wai/wai-rs/src/catalogue.rs
index 467281870..fc56c513a 100644
--- a/wai/wai-rs/src/catalogue.rs
+++ b/wai/wai-rs/src/catalogue.rs
@@ -39,11 +39,14 @@ pub const FORMAT: &str = "wai.ops/1";
 pub const ENVELOPE: &str = "envelope/1";
 
 /// The verbs an operation's id ends with (WAI toolchain v1, naming rule N3): a closed list.
+/// Three were added to N3's list after it was approved, each recorded in the catalogue's
+/// README: `upscale` and `tonemap` (exact derivations), and `doctor`, which the approved
+/// specification's own operation table names (`toolchain.doctor`, `wai doctor`).
 pub const VERBS: &[&str] = &[
     "create", "list", "show", "update", "delete", "check", "verify", "run", "build", "export", "import", "start", "stop",
     "join", "leave", "grant", "invite", "revoke", "rotate", "tail", "search", "test", "load", "encode", "decode", "inspect",
     "wrap", "unwrap", "fetch", "generate", "promote", "rollback", "lock", "upgrade", "setup", "guide", "stream", "upscale",
-    "tonemap",
+    "tonemap", "doctor",
 ];
 
 /// Verbs that are another verb's near-synonym, with the verb to use: an id never ends in one.
@@ -296,6 +299,7 @@ const S_DERIVED_VERIFY: &str = r#"{"type":"object","required":["outcome"],"descr
 const S_SCORE: &str = r#"{"type":"object","description":"The score's digests, as `wai score build|render --json` print them"}"#;
 const S_BREAKING: &str = r#"{"type":"object","required":["against","findings"],"description":"Each finding's id, category, what changed and whether the CHANGELOG acknowledges it"}"#;
 const S_CONFORM: &str = r#"{"type":"object","required":["conformant","cases","passed","failed"]}"#;
+const S_DOCTOR: &str = r#"{"type":"object","required":["wai","checks","failed","warnings"],"description":"Each check in order (path, install, ports, browsers, keychain) with its status (ok, warn or fail), what it found and what to do"}"#;
 const S_CONFORM_LIST: &str = r#"{"type":"object","required":["suites"]}"#;
 const S_ANY: &str = r#"{"description": "The tool's structured result"}"#;
 const S_JSONRPC: &str = r#"{"description": "One JSON-RPC 2.0 message per line, the Model Context Protocol"}"#;
@@ -334,6 +338,18 @@ pub const OPS: &[Op] = &[
         needs: Needs::All(&["quickstart"]),
         ..OP
     },
+    Op {
+        id: "toolchain.doctor",
+        summary: "Which wai runs when you type wai, this install and what wai dev runs beside it, the loopback ports, browsers and the keychain, checked",
+        cli: Some("doctor"),
+        usage: "doctor   which `wai` runs when you type wai (first: another program of that name on PATH, such as the one
+    the crates.io package wai-cli installs), this install and what `wai dev` runs beside it, the loopback ports it
+    listens on, the browsers registered to open web pages, and where a credential is kept; exit 1 when a check fails",
+        stability: Stability::Preview,
+        output: Output::Json(S_DOCTOR),
+        mcp: true,
+        ..OP
+    },
     Op {
         id: "project.create",
         summary: "A new project from one of the examples, written into a new or empty directory; --list names the templates",
@@ -939,22 +955,30 @@ http vectors diff|fuzz <dir> --seed S --count N --out F",
     },
     Op {
         id: "conformance.run",
-        summary: "WAI's conformance corpus run against another implementation, through a command or an HTTP adapter, its result a signed record wai verify checks",
+        summary: "WAI's conformance corpus run against another implementation, through a command or an HTTP adapter, or every corpus's independent verifier; each result a signed record wai verify checks",
         cli: Some("conform"),
-        usage: "conform <kind> --suite <suite> --impl <command or URL> [--key <file>] [--out <file>] [--root <wai-dir>]
-    [--timeout <seconds>] [--name <text>] [--version <text>] [--all] [--yes]   `wai conformance list` names
-    the kinds and suites; a record that exists is replaced only with --yes (--confirm, deprecated, is the same)",
+        usage: "conform <kind> --suite <suite> --impl <command or URL> [--independent] [--key <file>] [--out <file>]
+    [--root <wai-dir>] [--timeout <seconds>] [--name <text>] [--version <text>] [--python <program>] [--all]
+    [--format text|json|junit|html] [--yes]   `wai conformance list` names the kinds and suites; --independent
+    runs the corpus's independent verifier beside the implementation, and both must conform
+conform --independent [--suite <area|name>[,...]] [--out <dir>] [--key <file>] [--root <wai-dir>]
+    [--timeout <seconds>] [--python <program>] [--format text|json|junit|html] [--yes]   every corpus's
+    independent verifier (or those named), a record each in <dir>; a record that exists is replaced only with
+    --yes (--confirm, deprecated, is the same)",
         effect: Effect::WritesProject,
         input: &[
-            pos("kind", Ty::String, true, "The kind of implementation (wai conformance list): a decoder, a verifier, an origin, a packager, a sink."),
-            flag("suite", "--suite", Ty::String, false, "The suite (wai conformance list)."),
-            flag("impl", "--impl", Ty::String, true, "The implementation: a command with {case}/{in}/{out}/{corpus} placeholders, or a URL."),
-            flag("key", "--key", Ty::Path, false, "The seed the record is signed with."),
-            flag("out", "--out", Ty::Path, false, "The record (<suite>.wai-conform.json)."),
+            pos("kind", Ty::String, false, "The kind of implementation (wai conformance list): a decoder, a verifier, an origin, a packager, a sink; none with --independent alone."),
+            flag("suite", "--suite", Ty::String, false, "The suite (wai conformance list); with --independent alone, areas and independent verifiers, comma-separated."),
+            flag("impl", "--impl", Ty::String, false, "The implementation: a command with {case}/{in}/{out}/{corpus} placeholders, or a URL; required with a kind."),
+            switch("independent", "--independent", "Run the corpus's independent verifier beside the implementation, held to the same cases; without a kind, every independent verifier."),
+            flag("key", "--key", Ty::Path, false, "The seed the records are signed with."),
+            flag("out", "--out", Ty::Path, false, "The record (<suite>.wai-conform.json); with --independent alone, a directory for a record a corpus."),
             flag("root", "--root", Ty::Path, false, "The wai/ directory whose corpora are run."),
-            flag("timeout", "--timeout", Ty::Integer, false, "Seconds a case may take."),
+            flag("timeout", "--timeout", Ty::Integer, false, "Seconds a case may take (60), or an independent verifier its whole corpus (1800)."),
             flag("name", "--name", Ty::String, false, "The implementation's name, for the record."),
             flag("version", "--version", Ty::String, false, "The implementation's version, for the record."),
+            flag("python", "--python", Ty::String, false, "The Python the independent verifiers run with (python3)."),
+            flag("format", "--format", Ty::String, false, "What is printed: text, json (the envelope, as --json), junit (JUnit XML) or html, the last two from the records."),
             switch("all", "--all", "List every case, passed ones too."),
         ],
         output: Output::Json(S_CONFORM),
@@ -966,9 +990,9 @@ http vectors diff|fuzz <dir> --seed S --count N --out F",
     },
     Op {
         id: "conformance.list",
-        summary: "The kinds and suites wai conform runs, each suite's corpus and its cases",
+        summary: "The kinds and suites wai conform runs, each suite's corpus and its cases, and every corpus's independent verifier",
         cli: Some("conformance list"),
-        usage: "conformance list [--root <wai-dir>]   (also wai conform --list)",
+        usage: "conformance list [--root <wai-dir>]   the kinds and suites, and the independent verifiers (also wai conform --list)",
         input: &[flag("root", "--root", Ty::Path, false, "The wai/ directory whose corpora are listed.")],
         output: Output::Json(S_CONFORM_LIST),
         needs: Needs::All(&["quickstart"]),
diff --git a/wai/wai-rs/tests/cli_conform.rs b/wai/wai-rs/tests/cli_conform.rs
index 95290d393..6ab258c47 100644
--- a/wai/wai-rs/tests/cli_conform.rs
+++ b/wai/wai-rs/tests/cli_conform.rs
@@ -10,7 +10,18 @@
 //!   and one serving an object with one byte changed fails that object;
 //! - a record changed after signing, in a case's outcome or in its summary, is refused by
 //!   `wai verify`; a dry run writes nothing; a record is not replaced without `--yes`;
-//!   each failure to run has its exit status.
+//!   each failure to run has its exit status;
+//! - `--format junit` and `--format html` are the records' report: a test case a case, a failure
+//!   exactly where a case failed, the independent verifier's record told apart from the
+//!   implementation's; `--format json` is the envelope `--json` prints;
+//! - `--independent` beside an implementation runs the corpus's independent verifier on the same
+//!   cases, its own signed record beside the implementation's: the run passes when both conform
+//!   and agree, and a case the two disagree on fails it and is named, two passing answers that
+//!   differ on a case the corpus states in part among them; with the real Python verifier too;
+//!   beside the origin, the HTTP corpus's verifier over the whole corpus, which failing fails it;
+//! - `--independent` alone runs the independent verifiers `--suite` names (each with its own
+//!   command line, in `wai/`), a record a corpus in `--out <dir>` (a file there is a usage
+//!   error), a failed one failing the run and naming the Python package it needs if it is missing.
 #![cfg(all(feature = "quickstart", feature = "score", feature = "key_discovery"))]
 
 use serde_json::Value;
@@ -153,8 +164,27 @@ fn the_reference_origin_conforms_and_one_changed_object_fails() {
     let objects = wai_dir().join("http-conformance").join("objects");
     let (mut c, url) = origin(&objects);
     let (code, v) = conform(&d, "origin", "http", &url, &d.join("http.wai-conform.json"));
+    // Beside it, the HTTP corpus's independent verifier over the whole corpus: one that fails
+    // fails the run, though the origin conforms.
+    #[cfg(unix)]
+    let beside = {
+        let fails = fake_python(&d, "fails", "echo 'FAIL an object'; exit 1");
+        let root = wai_dir();
+        let o = wai(&d, &["conform", "origin", "--suite", "http", "--impl", &url, "--root", root.to_str().unwrap(), "--out", d.join("hb.wai-conform.json").to_str().unwrap(), "--yes", "--independent", "--python", fails.to_str().unwrap(), "--json"]);
+        (o.status.code(), serde_json::from_slice::<Value>(&o.stdout).unwrap_or_else(|_| panic!("JSON: {}", text(&o))))
+    };
     let _ = c.kill();
     assert_eq!(code, 0, "{v:#}");
+    #[cfg(unix)]
+    {
+        let (code, v) = beside;
+        assert_eq!(code, Some(1), "{v:#}");
+        assert_eq!((v["ok"].as_bool(), v["data"]["conformant"].as_bool()), (Some(false), Some(true)), "the origin conforms, and the run fails: {v:#}");
+        let ind = &v["data"]["independent"];
+        assert_eq!((ind["verifier"].as_str(), ind["conformant"].as_bool()), (Some("http"), Some(false)), "{ind:#}");
+        assert!(ind["command"].as_str().unwrap().ends_with("http-conformance/http_verify.py http-conformance"), "{ind}");
+        assert!(d.join("hb.independent.wai-conform.json").is_file());
+    }
 
     // A copy of the objects with one byte of one object changed.
     let copy = d.join("objects");
@@ -255,3 +285,277 @@ fn a_dry_run_writes_nothing_and_each_failure_has_its_exit_status() {
     let v: Value = serde_json::from_slice(&o.stdout).unwrap();
     assert!(v["data"]["suites"].as_array().unwrap().iter().all(|s| s["cases"].as_u64().unwrap() > 0), "{v:#}");
 }
+
+/// A stand-in for `python3`, a shell script at `dir/name`: `body` runs with the verifier's
+/// arguments (`$1` the script, then its arguments).
+#[cfg(unix)]
+fn fake_python(dir: &Path, name: &str, body: &str) -> PathBuf {
+    use std::os::unix::fs::PermissionsExt;
+    let p = dir.join(name);
+    std::fs::write(&p, format!("#!/bin/sh\n{body}\n")).unwrap();
+    std::fs::set_permissions(&p, std::fs::Permissions::from_mode(0o755)).unwrap();
+    p
+}
+
+#[test]
+fn junit_and_html_are_the_records_report() {
+    let d = tmp("formats");
+    let root = wai_dir();
+    let r = root.to_str().unwrap();
+    let good = format!("{} verdicts {{corpus}}", q(env!("CARGO_BIN_EXE_wai_signer_vectors")));
+    let o = wai(&d, &["conform", "verifier", "--suite", "signer", "--impl", &good, "--root", r, "--out", "s.wai-conform.json", "--format", "junit"]);
+    assert!(o.status.success(), "{}", text(&o));
+    let x = String::from_utf8(o.stdout.clone()).unwrap();
+    let rec: Value = serde_json::from_slice(&std::fs::read(d.join("s.wai-conform.json")).unwrap()).unwrap();
+    let n = rec["cases"].as_array().unwrap().len();
+    assert!(x.starts_with("<?xml"), "only the report is on standard output: {x}");
+    assert!(x.contains(&format!("<testsuites name=\"wai conform\" tests=\"{n}\" failures=\"0\"")), "{x}");
+    assert_eq!(x.matches("<testcase ").count(), n);
+    assert!(x.contains(&format!("<property name=\"corpus_digest\" value=\"{}\"/>", rec["corpus"]["digest"].as_str().unwrap())), "the report names its record");
+    assert!(String::from_utf8_lossy(&o.stderr).contains("cases passed: conformant"), "the summary goes to standard error");
+
+    // One verdict changed: one failure, at that case.
+    let bad = format!("{good} | awk 'NR == 1 {{ sub(/\\t/, \"\\t~\") }} 1'");
+    let o = wai(&d, &["conform", "verifier", "--suite", "signer", "--impl", &bad, "--root", r, "--out", "b.wai-conform.json", "--format", "junit"]);
+    assert_eq!(o.status.code(), Some(1), "{}", text(&o));
+    let x = String::from_utf8(o.stdout.clone()).unwrap();
+    assert!(x.contains("failures=\"1\""), "{x}");
+    assert_eq!(x.matches("<failure ").count(), 1);
+    let rec: Value = serde_json::from_slice(&std::fs::read(d.join("b.wai-conform.json")).unwrap()).unwrap();
+    let failed = rec["cases"].as_array().unwrap().iter().find(|c| c["pass"] == false).unwrap();
+    let name = failed["name"].as_str().unwrap();
+    let at = x.find(&format!("name=\"{name}\">")).unwrap_or_else(|| panic!("{name} in {x}"));
+    assert!(x[at..].trim_start_matches(|c| c != '\n').trim_start().starts_with("<failure "), "the failure is the failed case's");
+
+    let o = wai(&d, &["conform", "verifier", "--suite", "signer", "--impl", &bad, "--root", r, "--out", "b.wai-conform.json", "--yes", "--format", "html"]);
+    assert_eq!(o.status.code(), Some(1));
+    let h = String::from_utf8(o.stdout).unwrap();
+    assert!(h.starts_with("<!doctype html>") && h.contains("not conformant"), "{h}");
+    assert_eq!(h.matches("<tr class=\"fail\">").count(), 1);
+    assert_eq!(h.matches("<tr class=\"pass\">").count(), n - 1);
+
+    // With the independent verifier beside it: two test suites, which the report tells apart.
+    #[cfg(unix)]
+    {
+        let same = fake_python(&d, "same", &format!("shift; {} \"$@\"", q(env!("CARGO_BIN_EXE_wai_signer_vectors"))));
+        let o = wai(&d, &["conform", "verifier", "--suite", "signer", "--impl", &good, "--root", r, "--out", "s.wai-conform.json", "--yes", "--independent", "--python", same.to_str().unwrap(), "--format", "junit"]);
+        assert!(o.status.success(), "{}", text(&o));
+        let x = String::from_utf8(o.stdout).unwrap();
+        let suites: Vec<&str> = x.lines().filter_map(|l| l.trim().strip_prefix("<testsuite name=\"")).map(|l| &l[..l.find('"').unwrap()]).collect();
+        assert_eq!(suites, vec!["verifier signer", "verifier signer (independent verifier)"], "{x}");
+        let classes: std::collections::BTreeSet<&str> = x.split("classname=\"").skip(1).map(|l| &l[..l.find('"').unwrap()]).collect();
+        assert_eq!(classes.into_iter().collect::<Vec<_>>(), vec!["verifier.signer", "verifier.signer.independent_verifier"], "{x}");
+        let rec: Value = serde_json::from_slice(&std::fs::read(d.join("s.independent.wai-conform.json")).unwrap()).unwrap();
+        assert_eq!(rec["implementation"]["name"], "independent verifier");
+    }
+
+    // Two outputs at once, or one that is not there, are a usage error.
+    let code = |args: &[&str]| wai(&d, args).status.code();
+    assert_eq!(code(&["conform", "verifier", "--suite", "signer", "--impl", &good, "--root", r, "--format", "xml"]), Some(2));
+    assert_eq!(code(&["conform", "verifier", "--suite", "signer", "--impl", &good, "--root", r, "--format", "html", "--json"]), Some(2));
+}
+
+#[test]
+fn format_json_is_the_json_envelope() {
+    let d = tmp("format-json");
+    let root = wai_dir();
+    let r = root.to_str().unwrap();
+    let imp = format!("{} score render {{in}} --pcm {{out}}", q(env!("CARGO_BIN_EXE_wai")));
+    let call = |a: &[&str]| {
+        let o = wai(&d, a);
+        (o.status.code(), serde_json::from_slice::<Value>(&o.stdout).unwrap_or_else(|_| panic!("JSON on standard output: {}", text(&o))))
+    };
+    let run = |extra: &[&str]| call(&[&["conform", "decoder", "--suite", "score", "--impl", imp.as_str(), "--root", r][..], extra].concat());
+    // A dry run: the same envelope, word for word.
+    let (a, b) = (run(&["--dry-run", "--json"]), run(&["--dry-run", "--format", "json"]));
+    assert_eq!(a, b);
+    assert_eq!((a.0, a.1["dry_run"].as_bool()), (Some(0), Some(true)), "{:#}", a.1);
+    // A run: the same envelope, but for what the run itself says (its time and key).
+    let (a, b) = (run(&["--out", "a.wai-conform.json", "--json"]), run(&["--out", "b.wai-conform.json", "--format", "json"]));
+    assert_eq!((a.0, b.0), (Some(0), Some(0)), "{:#} {:#}", a.1, b.1);
+    let keys = |v: &Value| v["data"].as_object().unwrap().keys().cloned().collect::<Vec<_>>();
+    assert_eq!((a.1["op"].as_str(), keys(&a.1)), (b.1["op"].as_str(), keys(&b.1)));
+    assert_eq!((a.1["data"]["passed"].as_u64(), a.1["data"]["corpus_digest"].as_str()), (b.1["data"]["passed"].as_u64(), b.1["data"]["corpus_digest"].as_str()));
+    // A failure: the error envelope, for each spelling.
+    let nope = |f: &[&str]| call(&[&["conform", "decoder", "--suite", "nope", "--impl", imp.as_str(), "--root", r][..], f].concat());
+    let (a, b) = (nope(&["--json"]), nope(&["--format", "json"]));
+    assert_eq!(a, b);
+    assert_eq!((a.0, a.1["ok"].as_bool()), (Some(5), Some(false)), "{:#}", a.1);
+}
+
+#[cfg(unix)]
+#[test]
+fn beside_an_implementation_the_independent_verifier_must_agree() {
+    let d = tmp("beside");
+    let root = wai_dir();
+    let r = root.to_str().unwrap();
+    let reference = q(env!("CARGO_BIN_EXE_wai_signer_vectors"));
+    let imp = format!("{reference} verdicts {{corpus}}");
+    // A stand-in for the independent verifier: the reference's verdicts ($1 is the script).
+    let same = fake_python(&d, "same", &format!("shift; {reference} \"$@\""));
+    let o = wai(&d, &["conform", "verifier", "--suite", "signer", "--impl", &imp, "--root", r, "--independent", "--python", same.to_str().unwrap(), "--json"]);
+    let v: Value = serde_json::from_slice(&o.stdout).unwrap_or_else(|_| panic!("{}", text(&o)));
+    assert_eq!(o.status.code(), Some(0), "{v:#}");
+    let ind = &v["data"]["independent"];
+    assert_eq!((ind["verifier"].as_str(), ind["conformant"].as_bool()), (Some("signer"), Some(true)), "{v:#}");
+    assert_eq!(ind["disagreements"].as_array().unwrap().len(), 0);
+    assert!(ind["command"].as_str().unwrap().ends_with("signer-conformance/signer_verify.py verdicts signer-conformance/vectors.json"), "{ind}");
+    // Two records, both signed, both verified.
+    assert!(d.join("signer.independent.wai-conform.json").is_file());
+    let o = wai(&d, &["verify", d.to_str().unwrap()]);
+    assert!(o.status.success() && text(&o).contains("2 conformance results verified"), "{}", text(&o));
+
+    // The independent verifier changes one verdict: the run fails, and names the case.
+    let flipped = fake_python(&d, "flipped", &format!("shift; {reference} \"$@\" | awk 'NR == 1 {{ sub(/\\t/, \"\\t~\") }} 1'"));
+    let o = wai(&d, &["conform", "verifier", "--suite", "signer", "--impl", &imp, "--root", r, "--independent", "--python", flipped.to_str().unwrap(), "--yes", "--json"]);
+    let v: Value = serde_json::from_slice(&o.stdout).unwrap_or_else(|_| panic!("{}", text(&o)));
+    assert_eq!(o.status.code(), Some(1), "{v:#}");
+    assert_eq!(v["ok"], false);
+    assert_eq!(v["data"]["conformant"], true, "the implementation itself conforms");
+    let ind = &v["data"]["independent"];
+    assert_eq!((ind["conformant"].as_bool(), ind["failed"].as_u64()), (Some(false), Some(1)), "{ind:#}");
+    let dis = ind["disagreements"].as_array().unwrap();
+    assert_eq!(dis.len(), 1, "{ind:#}");
+    assert!(dis[0]["independent"].as_str().unwrap().contains('~'), "{dis:?}");
+    // In text, the disagreement is said.
+    let o = wai(&d, &["conform", "verifier", "--suite", "signer", "--impl", &imp, "--root", r, "--independent", "--python", flipped.to_str().unwrap(), "--yes"]);
+    assert_eq!(o.status.code(), Some(1));
+    assert!(text(&o).contains("disagree on 1 case"), "{}", text(&o));
+
+    // The real independent verifier (signer_verify.py, which needs the `cryptography` package).
+    let o = wai(&d, &["conform", "verifier", "--suite", "signer", "--impl", &imp, "--root", r, "--independent", "--yes", "--json"]);
+    let v: Value = serde_json::from_slice(&o.stdout).unwrap_or_else(|_| panic!("{}", text(&o)));
+    assert_eq!(o.status.code(), Some(0), "{v:#}");
+    assert_eq!(v["data"]["independent"]["conformant"], true);
+
+    // A suite whose corpus has no independent verifier says so, and the run stands on its own.
+    let w = q(env!("CARGO_BIN_EXE_wai"));
+    let o = wai(&d, &["conform", "decoder", "--suite", "score", "--impl", &format!("{w} score render {{in}} --pcm {{out}}"), "--root", r, "--independent", "--json"]);
+    let v: Value = serde_json::from_slice(&o.stdout).unwrap_or_else(|_| panic!("{}", text(&o)));
+    assert_eq!(o.status.code(), Some(0), "{v:#}");
+    assert!(v["data"]["independent"].is_null(), "{v:#}");
+}
+
+#[cfg(unix)]
+#[test]
+fn alone_the_independent_verifiers_run_as_the_table_says_each_a_record() {
+    let d = tmp("alone");
+    let root = wai_dir();
+    let r = root.to_str().unwrap();
+    // A stand-in that passes every verifier but the live rooms', and prints what it was given.
+    let fake = fake_python(&d, "fake", "echo \"ran $*\"; case \"$*\" in *live_rooms_verify.py*) echo 'FAIL a room'; exit 1;; esac; exit 0");
+    let out = d.join("records");
+    let o = wai(&d, &["conform", "--independent", "--suite", "live-rooms,pin", "--root", r, "--python", fake.to_str().unwrap(), "--out", out.to_str().unwrap(), "--json"]);
+    let v: Value = serde_json::from_slice(&o.stdout).unwrap_or_else(|_| panic!("{}", text(&o)));
+    assert_eq!(o.status.code(), Some(1), "{v:#}");
+    let rows = v["data"]["independent"].as_array().unwrap();
+    assert_eq!(rows.iter().map(|x| x["name"].as_str().unwrap()).collect::<Vec<_>>(), vec!["live-rooms", "pin"]);
+    assert_eq!((rows[0]["pass"].as_bool(), rows[1]["pass"].as_bool()), (Some(false), Some(true)), "{v:#}");
+    assert_eq!(rows[0]["command"].as_str().unwrap(), format!("{} -I live-conformance/live_rooms_verify.py live-conformance/rooms", fake.display()));
+    assert!(rows[0]["got"].as_str().unwrap().starts_with("exit 1: FAIL a room"), "{v:#}");
+    assert!(rows[1]["command"].as_str().unwrap().ends_with(" pin-conformance/pin_verify.py pin-conformance"), "not isolated, as the README runs it");
+    assert_eq!((v["data"]["passed"].as_u64(), v["data"]["failed"].as_u64(), v["data"]["conformant"].as_bool()), (Some(1), Some(1), Some(false)));
+    // A record a corpus, each verified: the failed one a genuine record of a failed run.
+    let rec: Value = serde_json::from_slice(&std::fs::read(out.join("live-rooms.wai-conform.json")).unwrap()).unwrap();
+    assert_eq!((rec["kind"].as_str(), rec["suite"].as_str(), rec["conformant"].as_bool()), (Some("verifier"), Some("live-rooms"), Some(false)));
+    assert_eq!(rec["corpus"]["dir"], "live-conformance/rooms");
+    assert!(rec["implementation"]["files"].as_array().unwrap().iter().any(|f| f["path"] == "live-conformance/live_rooms_verify.py"), "{}", rec["implementation"]);
+    let o = wai(&d, &["verify", out.to_str().unwrap()]);
+    assert!(o.status.success() && text(&o).contains("2 conformance results verified"), "{}", text(&o));
+    // The records are not replaced without --yes.
+    let o = wai(&d, &["conform", "--independent", "--suite", "pin", "--root", r, "--python", fake.to_str().unwrap(), "--out", out.to_str().unwrap(), "--json"]);
+    assert_eq!(o.status.code(), Some(4), "{}", text(&o));
+
+    // JUnit: a test suite a verifier, the failure at the live rooms'.
+    let o = wai(&d, &["conform", "--independent", "--suite", "live-rooms,pin", "--root", r, "--python", fake.to_str().unwrap(), "--format", "junit"]);
+    assert_eq!(o.status.code(), Some(1));
+    let x = String::from_utf8(o.stdout).unwrap();
+    assert!(x.contains("tests=\"2\" failures=\"1\""), "{x}");
+    assert!(x.contains("<testsuite name=\"verifier live-rooms\" tests=\"1\" failures=\"1\""), "{x}");
+    assert!(x.contains("<testsuite name=\"verifier pin\" tests=\"1\" failures=\"0\""), "{x}");
+    assert!(String::from_utf8_lossy(&o.stderr).contains("| FAIL a room"), "the failed verifier's output is shown: {}", String::from_utf8_lossy(&o.stderr));
+
+    // The real verifier: the pin corpus's, standard library only.
+    let o = wai(&d, &["conform", "--independent", "--suite", "pin", "--root", r]);
+    assert!(o.status.success(), "{}", text(&o));
+    assert!(text(&o).contains("1 of 1 independent verifiers passed"), "{}", text(&o));
+
+    // A dry run runs and writes nothing.
+    let dry = d.join("dry");
+    let o = wai(&d, &["conform", "--independent", "--suite", "trust", "--root", r, "--python", fake.to_str().unwrap(), "--out", dry.to_str().unwrap(), "--dry-run", "--json"]);
+    assert!(o.status.success(), "{}", text(&o));
+    let v: Value = serde_json::from_slice(&o.stdout).unwrap();
+    assert_eq!(v["dry_run"], true);
+    assert!(v["data"]["independent"].as_array().unwrap().iter().any(|x| x["name"] == "claim"));
+    assert!(!dry.exists());
+
+    let code = |args: &[&str]| wai(&d, args).status.code();
+    assert_eq!(code(&["conform", "--independent", "--suite", "nope", "--root", r]), Some(5), "no such area or verifier");
+    assert_eq!(code(&["conform", "--independent", "--impl", "x", "--root", r]), Some(2), "an implementation needs a kind");
+    assert_eq!(code(&["conform", "--independent", "--suite", "pin", "--root", r, "--python", "/no/such/python"]), Some(5), "no such interpreter");
+    assert_eq!(code(&["conform", "--root", r]), Some(2), "neither a kind nor --independent");
+}
+
+/// A checkout of the standard that holds what `--root` needs and one claim vector, `x`, which
+/// declares an accepted claim and pins no link hash: any `accept link_hash=` passes it.
+#[cfg(unix)]
+fn one_claim_root(d: &Path) -> PathBuf {
+    let root = d.join("wai");
+    std::fs::create_dir_all(root.join("registry")).unwrap();
+    std::fs::create_dir_all(root.join("claim-conformance")).unwrap();
+    std::fs::write(root.join("SPEC.md"), "# WAI\n").unwrap();
+    std::fs::write(root.join("registry/capabilities.json"), "{}").unwrap();
+    std::fs::write(root.join("claim-conformance/vectors.json"), r#"{"vectors": [{"name": "x", "expected": {"outcome": "accept"}}]}"#).unwrap();
+    root
+}
+
+#[cfg(unix)]
+#[test]
+fn two_answers_that_pass_a_case_stated_in_part_but_differ_fail_the_run() {
+    let d = tmp("both-pass");
+    let root = one_claim_root(&d);
+    let r = root.to_str().unwrap();
+    let imp = "printf 'x\\taccept link_hash=aa\\n'; : {corpus}";
+    // The independent verifier accepts it too, with another link hash: each passes, and they disagree.
+    let other = fake_python(&d, "other", "printf 'x\\taccept link_hash=bb\\n'");
+    let o = wai(&d, &["conform", "verifier", "--suite", "claim", "--impl", imp, "--root", r, "--independent", "--python", other.to_str().unwrap(), "--json"]);
+    let v: Value = serde_json::from_slice(&o.stdout).unwrap_or_else(|_| panic!("{}", text(&o)));
+    assert_eq!(o.status.code(), Some(1), "{v:#}");
+    assert_eq!(v["ok"], false);
+    let ind = &v["data"]["independent"];
+    assert_eq!((v["data"]["conformant"].as_bool(), ind["conformant"].as_bool()), (Some(true), Some(true)), "each passes the case: {v:#}");
+    let dis = ind["disagreements"].as_array().unwrap();
+    assert_eq!(dis.len(), 1, "{ind:#}");
+    assert_eq!((dis[0]["name"].as_str(), dis[0]["implementation"].as_str(), dis[0]["independent"].as_str()), (Some("x"), Some("accept link_hash=aa"), Some("accept link_hash=bb")), "{dis:?}");
+    // The same answer from both: they agree, and the run passes.
+    let same = fake_python(&d, "same", "printf 'x\\taccept link_hash=aa\\n'");
+    let o = wai(&d, &["conform", "verifier", "--suite", "claim", "--impl", imp, "--root", r, "--independent", "--python", same.to_str().unwrap(), "--yes", "--json"]);
+    assert_eq!(o.status.code(), Some(0), "{}", text(&o));
+}
+
+#[cfg(unix)]
+#[test]
+fn a_verifier_that_fails_without_its_package_names_it() {
+    let d = tmp("needs");
+    let root = wai_dir();
+    let r = root.to_str().unwrap();
+    // A Python without the package: `-c 'import cryptography'` fails, and so does the verifier.
+    let bare = fake_python(&d, "bare", "case \"$1\" in -c) exit 1;; esac; echo 'FAIL a claim'; exit 1");
+    let o = wai(&d, &["conform", "--independent", "--suite", "claim", "--root", r, "--python", bare.to_str().unwrap(), "--json"]);
+    let v: Value = serde_json::from_slice(&o.stdout).unwrap_or_else(|_| panic!("{}", text(&o)));
+    assert_eq!(o.status.code(), Some(1), "{v:#}");
+    let got = v["data"]["independent"][0]["got"].as_str().unwrap();
+    assert!(got.starts_with("exit 1: FAIL a claim"), "{got}");
+    assert!(got.contains(&format!("it needs the Python package cryptography: {} -m pip install cryptography", bare.display())), "{got}");
+    // A verifier that needs no package is given no such hint.
+    let o = wai(&d, &["conform", "--independent", "--suite", "pin", "--root", r, "--python", bare.to_str().unwrap(), "--json"]);
+    let v: Value = serde_json::from_slice(&o.stdout).unwrap_or_else(|_| panic!("{}", text(&o)));
+    assert!(!v["data"]["independent"][0]["got"].as_str().unwrap().contains("pip install"), "{v:#}");
+
+    // --out with --independent alone names a directory: a file there is a usage error.
+    let file = d.join("a-file");
+    std::fs::write(&file, "").unwrap();
+    let o = wai(&d, &["conform", "--independent", "--suite", "pin", "--root", r, "--python", bare.to_str().unwrap(), "--out", file.to_str().unwrap()]);
+    assert_eq!(o.status.code(), Some(2), "{}", text(&o));
+    assert!(text(&o).contains("names a directory"), "{}", text(&o));
+}
diff --git a/wai/wai-rs/tests/cli_doctor.rs b/wai/wai-rs/tests/cli_doctor.rs
new file mode 100644
index 000000000..90e3c7db5
--- /dev/null
+++ b/wai/wai-rs/tests/cli_doctor.rs
@@ -0,0 +1,152 @@
+//! `wai doctor` as a person runs it, with `PATH`, `cargo`'s home and the install laid out by
+//! the test:
+//!
+//! - this `wai` first on `PATH`, and what `wai dev` runs found: no check fails (exit 0), and the
+//!   path check is first and holds;
+//! - another program called `wai` first on `PATH`: the path check fails and names it (exit 1);
+//! - the program the crates.io package `wai-cli` installs first on `PATH`, as `cargo`'s own list
+//!   of what it installed says: named as that, with `cargo uninstall wai-cli`;
+//! - nothing beside it for `wai dev` to run: the install check fails, and says what is missing;
+//! - `--json`: one envelope, every check in order, a failure as a check that failed.
+//!
+//! A port in use, no browser and no keychain are warnings: they never fail a run here, whatever
+//! the machine the test runs on holds.
+
+use serde_json::Value;
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output};
+
+fn tmp(name: &str) -> PathBuf {
+    let d = std::env::temp_dir().join(format!("wai-doctor-{name}-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&d);
+    std::fs::create_dir_all(&d).unwrap();
+    d
+}
+
+fn text(o: &Output) -> String {
+    format!("{}{}", String::from_utf8_lossy(&o.stdout), String::from_utf8_lossy(&o.stderr))
+}
+
+fn this_dir() -> PathBuf {
+    Path::new(env!("CARGO_BIN_EXE_wai")).parent().unwrap().to_path_buf()
+}
+
+/// What `wai dev` runs, made in `d`: stand-in binaries and the room page.
+fn install(d: &Path) -> Vec<(&'static str, PathBuf)> {
+    let web = d.join("web");
+    std::fs::create_dir_all(web.join("room")).unwrap();
+    std::fs::write(web.join("room/index.html"), "<!doctype html>").unwrap();
+    for b in ["relay", "room", "pack"] {
+        std::fs::write(d.join(b), "stand-in").unwrap();
+    }
+    vec![("WAI_RELAY_BIN", d.join("relay")), ("WAI_ROOM_BIN", d.join("room")), ("WAI_PACK_BIN", d.join("pack")), ("WAI_WEB", web)]
+}
+
+/// `wai doctor` with `PATH` set to `path` and `cargo`'s home and the home directory in `d`.
+fn doctor(d: &Path, path: &[PathBuf], env: &[(&str, PathBuf)], json: bool) -> (Output, Option<Value>) {
+    let mut c = Command::new(env!("CARGO_BIN_EXE_wai"));
+    c.arg("doctor").current_dir(d).env("PATH", std::env::join_paths(path).unwrap()).env("CARGO_HOME", d.join("cargo")).env("HOME", d.join("home"));
+    for k in ["WAI_RELAY_BIN", "WAI_ROOM_BIN", "WAI_PACK_BIN", "WAI_WEB", "WAI_STUDIO", "WAI_QUANTUM_CREDENTIALS", "BROWSER_BIN"] {
+        c.env_remove(k);
+    }
+    for (k, v) in env {
+        c.env(k, v);
+    }
+    if json {
+        c.arg("--json");
+    }
+    let o = c.output().expect("wai runs");
+    let v = json.then(|| serde_json::from_slice(&o.stdout).unwrap_or_else(|e| panic!("one envelope ({e}): {}", text(&o))));
+    (o, v)
+}
+
+fn check<'a>(v: &'a Value, name: &str) -> &'a Value {
+    v["data"]["checks"].as_array().unwrap().iter().find(|c| c["check"] == name).unwrap_or_else(|| panic!("{name}: {v:#}"))
+}
+
+#[cfg(unix)]
+fn script(p: &Path, body: &str) {
+    use std::os::unix::fs::PermissionsExt;
+    std::fs::create_dir_all(p.parent().unwrap()).unwrap();
+    std::fs::write(p, format!("#!/bin/sh\n{body}\n")).unwrap();
+    std::fs::set_permissions(p, std::fs::Permissions::from_mode(0o755)).unwrap();
+}
+
+#[test]
+fn this_wai_first_and_an_install_wai_dev_can_run_from_holds() {
+    let d = tmp("ok");
+    let env = install(&d);
+    let (o, v) = doctor(&d, &[this_dir()], &env, true);
+    let v = v.unwrap();
+    assert_eq!(o.status.code(), Some(0), "{v:#}");
+    assert_eq!((v["op"].as_str(), v["ok"].as_bool()), (Some("toolchain.doctor"), Some(true)));
+    let names: Vec<&str> = v["data"]["checks"].as_array().unwrap().iter().map(|c| c["check"].as_str().unwrap()).collect();
+    assert_eq!(names, vec!["path", "install", "ports", "browsers", "keychain"], "the path first");
+    assert_eq!(check(&v, "path")["status"], "ok", "{v:#}");
+    assert_eq!(check(&v, "install")["detail"]["found"]["wai-relay"], d.join("relay").to_str().unwrap(), "{v:#}");
+    assert_eq!(v["data"]["failed"], 0);
+    // In text, a line a check, the path first.
+    let (o, _) = doctor(&d, &[this_dir()], &env, false);
+    assert!(o.status.success(), "{}", text(&o));
+    let t = String::from_utf8_lossy(&o.stdout);
+    assert!(t.lines().nth(1).unwrap_or("").starts_with("ok    path"), "{t}");
+    assert!(t.contains("wai doctor: 0 failed"), "{t}");
+}
+
+#[cfg(unix)]
+#[test]
+fn another_program_called_wai_first_on_path_fails_and_is_named() {
+    let d = tmp("other");
+    let env = install(&d);
+    let other = d.join("elsewhere/wai");
+    script(&other, "echo another program");
+    let (o, v) = doctor(&d, &[d.join("elsewhere"), this_dir()], &env, true);
+    let v = v.unwrap();
+    assert_eq!(o.status.code(), Some(1), "{v:#}");
+    assert_eq!((v["ok"].as_bool(), v["error"]["code"].as_str()), (Some(false), Some("check-failed")), "{v:#}");
+    let p = check(&v, "path");
+    assert_eq!(p["status"], "fail");
+    assert!(p["message"].as_str().unwrap().contains(other.to_str().unwrap()) && p["message"].as_str().unwrap().contains("not WAI's"), "{p}");
+    assert!(p["hint"].as_str().unwrap().contains(this_dir().to_str().unwrap()), "{p}");
+    assert_eq!(p["detail"]["on_path"].as_array().unwrap().len(), 2, "every wai on PATH is listed: {p}");
+    let (o, _) = doctor(&d, &[d.join("elsewhere"), this_dir()], &env, false);
+    assert_eq!(o.status.code(), Some(1));
+    assert!(String::from_utf8_lossy(&o.stdout).lines().nth(1).unwrap_or("").starts_with("fail  path"), "{}", text(&o));
+}
+
+#[cfg(unix)]
+#[test]
+fn the_crates_io_wai_cli_is_named_as_that() {
+    let d = tmp("crates");
+    let env = install(&d);
+    script(&d.join("cargo/bin/wai"), "echo a program from crates.io");
+    std::fs::write(d.join("cargo/.crates2.json"), r#"{"installs":{"wai-cli 0.2.1 (registry+https://index.crates.io/)":{"version_req":null,"bins":["wai"]}}}"#).unwrap();
+    let (o, v) = doctor(&d, &[d.join("cargo/bin"), this_dir()], &env, true);
+    let v = v.unwrap();
+    assert_eq!(o.status.code(), Some(1), "{v:#}");
+    let p = check(&v, "path");
+    assert_eq!(p["status"], "fail");
+    assert!(p["message"].as_str().unwrap().contains("crates.io (wai-cli 0.2.1)"), "{p}");
+    assert!(p["hint"].as_str().unwrap().starts_with("cargo uninstall wai-cli "), "{p}");
+    // After this one on PATH it is still named, as a warning.
+    let (o, v) = doctor(&d, &[this_dir(), d.join("cargo/bin")], &env, true);
+    let v = v.unwrap();
+    assert_eq!(o.status.code(), Some(0), "{v:#}");
+    let p = check(&v, "path");
+    assert_eq!(p["status"], "warn", "{p}");
+    assert!(p["hint"].as_str().unwrap().contains("cargo uninstall wai-cli"), "{p}");
+}
+
+#[test]
+fn nothing_beside_it_for_wai_dev_fails_the_install_check() {
+    let d = tmp("bare");
+    let (o, v) = doctor(&d, &[this_dir()], &[], true);
+    let v = v.unwrap();
+    assert_eq!(o.status.code(), Some(1), "{v:#}");
+    assert_eq!(check(&v, "path")["status"], "ok");
+    let i = check(&v, "install");
+    assert_eq!(i["status"], "fail", "{i}");
+    let m = i["message"].as_str().unwrap();
+    assert!(m.contains("`wai dev` cannot start") && m.contains("wai-relay") && m.contains("wai-room") && m.contains("share/wai/web"), "{m}");
+    assert!(i["hint"].as_str().unwrap().contains("install.sh"), "{i}");
+}
diff --git a/wai/wai-rs/tests/cli_mcp.rs b/wai/wai-rs/tests/cli_mcp.rs
index a3a8c67fe..1c9349fa8 100644
--- a/wai/wai-rs/tests/cli_mcp.rs
+++ b/wai/wai-rs/tests/cli_mcp.rs
@@ -21,7 +21,10 @@
 //!   live-conformance/audit (kind audit_bundle); a receipt changed by one character is refused.
 //! - `envelope_wrap` writes an envelope inside the project directory only, never over a file
 //!   without `overwrite`; `envelope_inspect` reads it back, and the directory as a package.
-//! - `conformance_run` runs a corpus's independent verifier and reports it passed.
+//! - `conformance_list` lists the independent verifiers' table, each with its command line, and
+//!   `conformance_run` runs one by its directory or its name and reports it passed; a directory
+//!   the claim verifier also runs over runs its corpus's own verifier.
+//! - `toolchain_doctor` gives every check of `wai doctor`, the path first.
 //! - The `dev` tools refuse a service that is not on a loopback address, before any
 //!   connection, and any target but `local`; with no room they say how to start one. (The room
 //!   itself, joined, published to and verified through these tools, is joule-moq-room's
@@ -136,7 +139,7 @@ fn corpus(rel: &str) -> Value {
 
 /// The operations of each toolset, in the order the server lists them. A tool is its
 /// operation's name with `_` for the dot.
-const CORE: &[&str] = &["envelope.inspect", "media.inspect", "registry.list", "registry.show", "receipt.verify", "envelope.wrap", "conformance.list", "conformance.run", "docs.search"];
+const CORE: &[&str] = &["envelope.inspect", "media.inspect", "registry.list", "registry.show", "receipt.verify", "envelope.wrap", "conformance.list", "conformance.run", "toolchain.doctor", "docs.search"];
 const DEV: &[&str] = &["dev.start", "dev.stop", "room.grant", "room.join", "room.leave", "session.show"];
 
 fn tool_names(c: &mut Client) -> Vec<String> {
@@ -483,14 +486,41 @@ fn a_corpus_runs_through_its_independent_verifier() {
     let pairs: Vec<(String, String)> = l["corpora"].as_array().unwrap().iter().map(|p| (p["corpus"].as_str().unwrap().into(), p["verifier"].as_str().unwrap().into())).collect();
     assert!(pairs.contains(&("live-conformance/rooms".into(), "live-conformance/live_rooms_verify.py".into())), "{pairs:?}");
     assert!(pairs.contains(&("claim-conformance".into(), "claim-conformance/claim_verify.py".into())), "{pairs:?}");
+    let rooms = l["corpora"].as_array().unwrap().iter().find(|p| p["name"] == "live-rooms").unwrap_or_else(|| panic!("{l}"));
+    assert_eq!(rooms["command"], "python3 -I live-conformance/live_rooms_verify.py live-conformance/rooms", "{rooms}");
     let r = c.ok("conformance_run", json!({"corpus": "live-conformance/rooms", "timeout_s": 600}));
     assert_eq!(r["passed"], true, "{r}");
     assert_eq!(r["exit_code"], 0);
+    // By its name, with the table's command line: the pin corpus's verifier, run as its README does.
+    let r = c.ok("conformance_run", json!({"corpus": "pin", "timeout_s": 600}));
+    assert_eq!((r["passed"].as_bool(), r["command"].as_str()), (Some(true), Some("python3 pin-conformance/pin_verify.py pin-conformance")), "{r}");
+    // A directory several entries share names them, when more than one is the corpus's own.
+    assert!(c.call("conformance_run", json!({"corpus": "oer-conformance"})).unwrap_err().contains("oer-firmware"));
+    // A directory the claim verifier also runs over (its claims, an entry of its own name) runs
+    // the corpus's own verifier, as before the table had the claims runs.
+    for (dir, script) in [("live-conformance/bearers", "live-conformance/bearer_verify.py"), ("live-conformance/usage", "live-conformance/ai_usage_verify.py")] {
+        let r = c.ok("conformance_run", json!({"corpus": dir, "timeout_s": 600}));
+        assert_eq!((r["verifier"].as_str(), r["command"].as_str()), (Some(script), Some(format!("python3 -I {script} {dir}").as_str())), "{r}");
+    }
     assert!(c.call("conformance_run", json!({"corpus": "no-such-conformance"})).unwrap_err().contains("no verifier"));
     let e = c.call("conformance_run", json!({"corpus": "live-conformance/rooms", "verifier": "../scripts/check-spec-refs.py"})).unwrap_err();
     assert!(e.contains("outside") || e.contains("_verify.py"), "{e}");
 }
 
+#[test]
+fn the_doctor_gives_every_check_the_path_first() {
+    let d = scratch("doctor");
+    let mut c = Client::start(&d, &[]);
+    let r = c.ok("toolchain_doctor", json!({}));
+    let checks: Vec<&str> = r["checks"].as_array().unwrap().iter().map(|x| x["check"].as_str().unwrap()).collect();
+    assert_eq!(checks, vec!["path", "install", "ports", "browsers", "keychain"], "{r}");
+    for x in r["checks"].as_array().unwrap() {
+        assert!(["ok", "warn", "fail"].contains(&x["status"].as_str().unwrap()), "{x}");
+        assert!(!x["message"].as_str().unwrap().is_empty(), "{x}");
+    }
+    assert_eq!(r["wai"]["version"], env!("CARGO_PKG_VERSION"));
+}
+
 #[test]
 fn development_tools_refuse_any_service_off_this_machine() {
     let d = scratch("dev");
diff --git a/wai/wai-studio/src/actions.generated.js b/wai/wai-studio/src/actions.generated.js
index 1631dc11f..d5a0e2a68 100644
--- a/wai/wai-studio/src/actions.generated.js
+++ b/wai/wai-studio/src/actions.generated.js
@@ -1,9 +1,10 @@
 // GENERATED by scripts/actions.mjs from the WAI operation catalogue. Do not edit: change the
 // catalogue (wai-rs/src/catalogue.rs, exported by `wai ops export`), then run
 // `node scripts/actions.mjs`. `node scripts/actions.mjs --check` fails when this file differs.
-export const CATALOGUE = {"format":"wai.ops/1","toolchain":"0.4.0","sha256":"bbb0d3f85cfb9d2c1e6a0a2a69fff6f9b8fc6762a1a9560834d8136a0b7c47bd"};
+export const CATALOGUE = {"format":"wai.ops/1","toolchain":"0.4.0","sha256":"16f521a6c94388364e99d11f1e597bf37ce558f838cd8641e608fba4e4d88378"};
 export const ACTIONS = [
   {"id":"toolchain.test","noun":"toolchain","verb":"test","menu":"Toolchain","item":"Test","palette":"toolchain test","summary":"WAI's four steps (name, dispatch, rebuild, receipt) on a picture made here, its receipt checked offline","placement":"local","effect":"writes-project","stability":"stable","toolset":"core","cli":"wai hello","mcp":null,"route":null,"call":"toolchain_test"},
+  {"id":"toolchain.doctor","noun":"toolchain","verb":"doctor","menu":"Toolchain","item":"Doctor","palette":"toolchain doctor","summary":"Which wai runs when you type wai, this install and what wai dev runs beside it, the loopback ports, browsers and the keychain, checked","placement":"local","effect":"reads","stability":"preview","toolset":"core","cli":"wai doctor","mcp":"toolchain_doctor","route":null,"call":"toolchain_doctor"},
   {"id":"project.create","noun":"project","verb":"create","menu":"Project","item":"Create","palette":"project create","summary":"A new project from one of the examples, written into a new or empty directory; --list names the templates","placement":"local","effect":"writes-project","stability":"stable","toolset":"core","cli":"wai create","mcp":null,"route":null,"call":"project_create"},
   {"id":"dev.start","noun":"dev","verb":"start","menu":"Dev","item":"Start","palette":"dev start","summary":"A relay, a room service and the room page on one origin on this machine, for development; --check starts, checks every piece and stops","placement":"local","effect":"runs","stability":"stable","toolset":"dev","cli":"wai dev","mcp":"dev_start","route":null,"call":"dev_start"},
   {"id":"receipt.verify","noun":"receipt","verb":"verify","menu":"Receipt","item":"Verify","palette":"receipt verify","summary":"Every receipt index (*.wai.receipts) under each path, its group receipts and claims checked offline, and every conformance result, fleet report bundle and envelope there","placement":"local","effect":"reads","stability":"stable","toolset":"core","cli":"wai verify","mcp":"receipt_verify","route":null,"call":"receipt_verify"},
@@ -44,8 +45,8 @@ export const ACTIONS = [
   {"id":"http.load","noun":"http","verb":"load","menu":"Http","item":"Load","palette":"http load","summary":"An object fetched by the byte-range procedure, repeatedly, and the record of each run","placement":"client","effect":"writes-project","stability":"preview","toolset":"core","cli":"wai http bench","mcp":null,"route":null,"call":"http_load"},
   {"id":"receipt.fetch","noun":"receipt","verb":"fetch","menu":"Receipt","item":"Fetch","palette":"receipt fetch","summary":"An object's receipt index fetched over HTTP and checked, its signers confirmed under the origin's key log where named","placement":"client","effect":"reads","stability":"preview","toolset":"core","cli":"wai http receipts","mcp":null,"route":null,"call":"receipt_fetch"},
   {"id":"compat.check","noun":"compat","verb":"check","menu":"Compat","item":"Check","palette":"compat check","summary":"What the working tree breaks against a git ref, by category (wire, record, api); a break passes once the CHANGELOG names it","placement":"local","effect":"reads","stability":"stable","toolset":"core","cli":"wai breaking","mcp":null,"route":null,"call":"compat_check"},
-  {"id":"conformance.run","noun":"conformance","verb":"run","menu":"Conformance","item":"Run","palette":"conformance run","summary":"WAI's conformance corpus run against another implementation, through a command or an HTTP adapter, its result a signed record wai verify checks","placement":"local","effect":"writes-project","stability":"stable","toolset":"core","cli":"wai conform","mcp":"conformance_run","route":null,"call":"conformance_run"},
-  {"id":"conformance.list","noun":"conformance","verb":"list","menu":"Conformance","item":"List","palette":"conformance list","summary":"The kinds and suites wai conform runs, each suite's corpus and its cases","placement":"local","effect":"reads","stability":"stable","toolset":"core","cli":"wai conformance list","mcp":"conformance_list","route":null,"call":"conformance_list"},
+  {"id":"conformance.run","noun":"conformance","verb":"run","menu":"Conformance","item":"Run","palette":"conformance run","summary":"WAI's conformance corpus run against another implementation, through a command or an HTTP adapter, or every corpus's independent verifier; each result a signed record wai verify checks","placement":"local","effect":"writes-project","stability":"stable","toolset":"core","cli":"wai conform","mcp":"conformance_run","route":null,"call":"conformance_run"},
+  {"id":"conformance.list","noun":"conformance","verb":"list","menu":"Conformance","item":"List","palette":"conformance list","summary":"The kinds and suites wai conform runs, each suite's corpus and its cases, and every corpus's independent verifier","placement":"local","effect":"reads","stability":"stable","toolset":"core","cli":"wai conformance list","mcp":"conformance_list","route":null,"call":"conformance_list"},
   {"id":"enrolment.create","noun":"enrolment","verb":"create","menu":"Enrolment","item":"Create","palette":"enrolment create","summary":"A node's enrolment signed with the organisation key, written to a file and, with --target, given to a fleet service","placement":"client","effect":"writes-target","stability":"preview","toolset":"core","cli":"wai enrolment create","mcp":null,"route":null,"call":"enrolment_create"},
   {"id":"enrolment.list","noun":"enrolment","verb":"list","menu":"Enrolment","item":"List","palette":"enrolment list","summary":"The nodes a fleet service holds enrolled, each with its role, label and how many records it gave","placement":"client","effect":"reads","stability":"preview","toolset":"core","cli":"wai enrolment list","mcp":null,"route":null,"call":"enrolment_list"},
   {"id":"report.create","noun":"report","verb":"create","menu":"Report","item":"Create","palette":"report create","summary":"The fleet report of a period, signed by a fleet service over the enrolments and records it holds","placement":"client","effect":"writes-target","stability":"preview","toolset":"core","cli":"wai report create","mcp":null,"route":null,"call":"report_create"},
-- 
2.54.0 (Apple Git-157)


From a511f1dee19bfa0afc818c5cfa860307d8c95c1a Mon Sep 17 00:00:00 2001
From: Transaction Science <hello@transaction.science>
Date: Thu, 5 Nov 2026 02:00:43 -0500
Subject: [PATCH 2/4] conform-output on toolchain-fixes: the twin and the
 verb-list test as both changes have them

With toolchain-fixes under it, clean-machine.sh has a contents step and checks WAI Studio in
wai dev --check. clean-machine.ps1, its twin, gains both, so check-wai-release-quickstart.py's
rule (the twin runs the script's steps and commands) holds. The check now lists the contents
step, and takes a step's wai command up to the first ; } ' | > or && after it, so the output
the dev-check step keeps is not part of its command. The twin's help range follows its
longer header. The new PowerShell code has not run: no host here has PowerShell, and the
Windows runner is down. The release workflow's comment and the changelog entry say so.

The catalogue test every_text_that_states_the_verb_list_states_the_same_list no longer looks
for the doors' check's own lists, which conform-output removed. It checks that the script
names catalogue.rs as its source and keeps no list, and that what its reader takes from this
file's source is exactly VERBS and NEAR_SYNONYMS. The README must record doctor as well as
upscale and tonemap. The definitions' openings are spelt in two pieces in the test, so that
catalogue.rs holds each once and the doors' check's self-test can change it in a copy.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/wai-release.yml             | 18 +++----
 scripts/check-wai-release-quickstart.py       | 25 ++++++----
 ...lease-runs-quickstart-from-each-archive.md |  3 +-
 wai/quickstart/test/clean-machine.ps1         | 35 +++++++++++--
 wai/wai-rs/src/catalogue.rs                   | 49 ++++++++++++-------
 5 files changed, 88 insertions(+), 42 deletions(-)

diff --git a/.github/workflows/wai-release.yml b/.github/workflows/wai-release.yml
index a5975fcad..d3b5c91a0 100644
--- a/.github/workflows/wai-release.yml
+++ b/.github/workflows/wai-release.yml
@@ -15,14 +15,13 @@ name: wai command line release
 # Before it is attached, each archive runs the quickstart as a new user runs it, from the
 # archive alone on a fresh home directory and a PATH of the system's own directories
 # (wai/quickstart/test/clean-machine.sh; on Windows its PowerShell twin, clean-machine.ps1):
-# the archive checked against its SHA-256 and unpacked, then wai hello, wai verify,
-# wai create my-room --template video-room and wai dev --check in the project; and on the
-# Apple-silicon Mac, the project's page joined in two browser pages, each decoding the other.
-# clean-machine.sh also checks what the archive holds (every binary, each of which runs, the
-# room client and WAI Studio) and that wai dev --check serves Studio at /_wai/; on Windows the
-# packaging step runs wai create --list and wai-quantum --version from the staged archive.
-# A cross-built archive, whose binaries this host cannot run, is not run. The Windows leg has
-# not run yet: its runner is down, so no Windows archive has been through clean-machine.ps1.
+# the archive checked against its SHA-256 and unpacked, what it holds checked (every binary,
+# each of which runs, the room client and WAI Studio), then wai hello, wai verify,
+# wai create my-room --template video-room and wai dev --check in the project, Studio at /_wai/
+# among what it checks; and on the Apple-silicon Mac, the project's page joined in two browser
+# pages, each decoding the other. A cross-built archive, whose binaries this host cannot run,
+# is not run. The Windows leg has not run yet: its runner is down, so no Windows archive has
+# been through clean-machine.ps1.
 # A last job writes the Homebrew formula and the Scoop manifest for the archives attached and
 # attaches them too; they go into the tap and the bucket by hand.
 #
@@ -273,7 +272,8 @@ jobs:
           $h = (Get-FileHash (Join-Path $dist "$name.zip") -Algorithm SHA256).Hash.ToLower()
           Set-Content -NoNewline -Path (Join-Path $dist "$name.zip.sha256") -Value "$h  $name.zip`n"
       # Not yet run: the Windows runner is down, so this step has never run on a Windows archive.
-      # The script's steps have run under PowerShell 7 on a macOS archive.
+      # Under PowerShell 7 on a macOS archive the script has run without its contents step and
+      # its check of WAI Studio, which have not run yet.
       - name: The quickstart from the archive, as a new user runs it
         shell: pwsh
         run: |
diff --git a/scripts/check-wai-release-quickstart.py b/scripts/check-wai-release-quickstart.py
index 8288fd33d..0b414fcf8 100755
--- a/scripts/check-wai-release-quickstart.py
+++ b/scripts/check-wai-release-quickstart.py
@@ -13,9 +13,10 @@ clean-machine.ps1 on Windows. Each step of the twin is a step of the script, wit
   `continue-on-error:`, and neither has its job, so it can neither be skipped nor fail without
   failing the job; and it comes before the job's first step that attaches anything to the
   release (one that runs wai/quickstart/publish.sh or uploads to a release's assets);
-- clean-machine.sh's steps are unpack, hello, verify, create, dev-check and two-tabs (the
-  browser's), and clean-machine.ps1's are the same steps in the same order, the browser's
-  aside, each running the same `wai` command;
+- clean-machine.sh's steps are unpack, contents, hello, verify, create, dev-check and two-tabs
+  (the browser's), and clean-machine.ps1's are the same steps in the same order, the browser's
+  aside, each running the same `wai` command (the command alone, up to the first `;`, `}`,
+  `'`, `|`, `>` or `&&` after it);
 - the unpack step of each checks the archive against the SHA-256 beside it ("$ARCHIVE.sha256",
   "$Archive.sha256") and fails when they differ, before it unpacks anything.
 
@@ -34,7 +35,7 @@ SH = "wai/quickstart/test/clean-machine.sh"
 PS = "wai/quickstart/test/clean-machine.ps1"
 # The job, and the script it runs on its archive.
 JOBS = [("macos", "clean-machine.sh"), ("linux", "clean-machine.sh"), ("windows", "clean-machine.ps1")]
-SH_STEPS = ["unpack", "hello", "verify", "create", "dev-check", "two-tabs"]
+SH_STEPS = ["unpack", "contents", "hello", "verify", "create", "dev-check", "two-tabs"]
 BROWSER_STEP = "two-tabs"
 
 
@@ -162,6 +163,14 @@ def check_workflow(text, findings):
                 findings.append(f"{what} comes after {st[attach]['name']!r}, which attaches the archive: the archive is attached before it is run")
 
 
+def wai_command(rest):
+    """The `wai` command in a step's text, alone: from `wai ` up to the first `;`, `}`, `'`,
+    `|`, `>` or `&&` after it (what the step does with its output is not the command); None
+    when the step runs no `wai` command."""
+    i = rest.find("wai ")
+    return re.split(r"[;}'|>]|&&", rest[i:])[0].strip() if i >= 0 else None
+
+
 def sh_steps(text):
     """clean-machine.sh's steps: (name, the `wai` command it runs, or None)."""
     out = []
@@ -170,9 +179,7 @@ def sh_steps(text):
         m = re.match(r"^(?:\[[^]]*\]\s*&&\s*)*step ([A-Za-z0-9-]+)(?: (.*))?$", t)
         if not m:
             continue
-        rest = m.group(2) or ""
-        i = rest.find("wai ")
-        out.append((m.group(1), rest[i:].split("'")[0].strip() if i >= 0 else None))
+        out.append((m.group(1), wai_command(m.group(2) or "")))
     return out
 
 
@@ -183,9 +190,7 @@ def ps_steps(text):
         m = re.search(r"\bStep '([A-Za-z0-9-]+)' \{(.*)$", l.strip())
         if not m:
             continue
-        rest = m.group(2)
-        i = rest.find("wai ")
-        out.append((m.group(1), re.split(r"[};]", rest[i:])[0].strip() if i >= 0 else None))
+        out.append((m.group(1), wai_command(m.group(2))))
     return out
 
 
diff --git a/wai/changes/2026-11-04-release-runs-quickstart-from-each-archive.md b/wai/changes/2026-11-04-release-runs-quickstart-from-each-archive.md
index 212b6f91d..637b445bd 100644
--- a/wai/changes/2026-11-04-release-runs-quickstart-from-each-archive.md
+++ b/wai/changes/2026-11-04-release-runs-quickstart-from-each-archive.md
@@ -9,4 +9,5 @@
   script before the archive is attached, in a step that is neither skipped (`if:`) nor allowed to fail
   (`continue-on-error:`), the twin to the script's steps and commands, and both unpack steps to checking the archive's
   SHA-256 before unpacking it. **The Windows leg has not run yet**: its runner is down, so no Windows archive has been
-  through it. Its steps have run under PowerShell 7 on a macOS archive.
+  through it. Under PowerShell 7 on a macOS archive it has run without its check of what the archive holds and of
+  WAI Studio, which have not run yet.
diff --git a/wai/quickstart/test/clean-machine.ps1 b/wai/quickstart/test/clean-machine.ps1
index c68424d4f..1897562f9 100644
--- a/wai/quickstart/test/clean-machine.ps1
+++ b/wai/quickstart/test/clean-machine.ps1
@@ -6,9 +6,12 @@
 # profile (USERPROFILE, HOME, APPDATA, LOCALAPPDATA, TEMP and TMP) and working directory, a PATH
 # of the system's own directories, no cargo and no repository. The steps are the quickstart's:
 #   1. check the archive against its .sha256 beside it, and unpack it;
-#   2. wai hello;  3. wai verify;  4. wai create my-room --template video-room;
-#   5. wai dev --check in the project: the relay, the room service and the page on one origin,
-#      each checked through it.
+#   2. the archive holds what `wai dev` and the quickstart name: bin/ with wai, wai-relay,
+#      wai-room, wai-ingest, wai-remote-host, wai-pack and wai-quantum, each of which runs, and
+#      share/wai/web/ and share/wai/studio/ (Studio's page and its core);
+#   3. wai hello;  4. wai verify;  5. wai create my-room --template video-room;
+#   6. wai dev --check in the project: the relay, the room service, the page and WAI Studio at
+#      /_wai/ on one origin, each checked through it.
 # It prints each step's time, the total, and a JSON line; it exits non-zero when a step fails,
 # naming it. Downloading the archive is not timed: the archive is given. It needs PowerShell 7
 # and runs on any system it runs on (a .tar.gz archive elsewhere than Windows), so its steps can
@@ -16,7 +19,7 @@
 param([string]$Archive)
 $ErrorActionPreference = 'Stop'
 if (-not $Archive) {
-  Get-Content $PSCommandPath | Select-Object -First 15 | ForEach-Object { $_ -replace '^# ?', '' }
+  Get-Content $PSCommandPath | Select-Object -First 18 | ForEach-Object { $_ -replace '^# ?', '' }
   exit 2
 }
 $Archive = (Resolve-Path $Archive).Path
@@ -83,10 +86,32 @@ Step 'unpack' {
 }
 $Bin = Get-ChildItem -Path $Work -Directory -Filter 'wai-*' | Select-Object -First 1 | ForEach-Object { Join-Path $_.FullName 'bin' }
 if ($Bin) { $env:PATH = "$Bin$Sep$env:PATH" }
+if (-not $Failed) {
+  Step 'contents' {
+    $exe = if ($IsWindows) { '.exe' } else { '' }
+    $missing = @()
+    foreach ($b in 'wai', 'wai-relay', 'wai-room', 'wai-ingest', 'wai-remote-host', 'wai-pack', 'wai-quantum') {
+      if (-not (Test-Path -PathType Leaf (Join-Path $Bin "$b$exe"))) { $missing += "bin/$b$exe" }
+    }
+    foreach ($f in 'share/wai/web/room/index.html', 'share/wai/studio/index.html', 'share/wai/studio/pkg/wai_studio_core_bg.wasm') {
+      if (-not (Test-Path -PathType Leaf (Join-Path (Split-Path $Bin -Parent) $f))) { $missing += $f }
+    }
+    if ($missing) { throw "the archive lacks: $($missing -join ' ')" }
+    wai-quantum --version
+    if ($LASTEXITCODE -ne 0) { throw "wai-quantum --version exits $LASTEXITCODE" }
+    # wai-ingest without a configuration says how it is run, and exits 2.
+    $err = Join-Path $Root 'ingest.err'
+    $p = Start-Process -FilePath (Join-Path $Bin "wai-ingest$exe") -NoNewWindow -Wait -PassThru -RedirectStandardOutput (Join-Path $Root 'ingest.out') -RedirectStandardError $err
+    if ($p.ExitCode -ne 2 -or -not (Select-String -Path $err -SimpleMatch -Quiet 'usage: wai-ingest')) {
+      throw "wai-ingest without a configuration exits $($p.ExitCode), not 2 with its usage"
+    }
+  }
+}
 if (-not $Failed) { Step 'hello' { wai hello } }
 if (-not $Failed) { Step 'verify' { wai verify wai-hello } }
 if (-not $Failed) { Step 'create' { wai create my-room --template video-room } }
-if (-not $Failed) { Step 'dev-check' { Push-Location my-room; try { wai dev --check --port 0 } finally { Pop-Location } } }
+# Every piece held, Studio among them: the archive's share/wai/studio, found beside wai.
+if (-not $Failed) { Step 'dev-check' { Push-Location my-room; try { wai dev --check --port 0 | Tee-Object -Variable out; if ($LASTEXITCODE -eq 0 -and -not ($out | Select-String -SimpleMatch -Quiet 'ok   WAI Studio at /_wai/')) { throw 'wai dev --check did not hold WAI Studio at /_wai/' } } finally { Pop-Location } } }
 
 $Total = [math]::Round($T0.Elapsed.TotalSeconds, 2).ToString([Globalization.CultureInfo]::InvariantCulture)
 $Os = [Runtime.InteropServices.RuntimeInformation]::OSDescription
diff --git a/wai/wai-rs/src/catalogue.rs b/wai/wai-rs/src/catalogue.rs
index fc56c513a..a01d658e0 100644
--- a/wai/wai-rs/src/catalogue.rs
+++ b/wai/wai-rs/src/catalogue.rs
@@ -2503,12 +2503,14 @@ mod tests {
         assert!(f.is_empty(), "{}", f.join("\n"));
     }
 
-    /// The closed verb list is written in three places: [`VERBS`], the catalogue's README (with
-    /// the record of the two verbs that joined it after its approval, upscale and tonemap), and
-    /// the doors' check, which holds a door's name to the catalogue only when its verb is listed.
-    /// Each states exactly [`VERBS`]. So is the near-synonym list, which the README states beside
-    /// it and the doors' check refuses a door's name by: each states exactly [`NEAR_SYNONYMS`],
-    /// each near-synonym with the verb to use (the first word of the catalogue's).
+    /// The closed verb list is written in two places: [`VERBS`] and the catalogue's README (with
+    /// the record of the three verbs that joined it after its approval: upscale, tonemap and
+    /// doctor). The README states exactly [`VERBS`]. So is the near-synonym list, which the
+    /// README states beside it: exactly [`NEAR_SYNONYMS`], each near-synonym with the verb to use
+    /// (the first word of the catalogue's). The doors' check, which holds a door's name to the
+    /// catalogue only when its verb is listed and refuses one by a near-synonym, keeps no copy of
+    /// either: it reads both from this file's source, and what it reads there is exactly
+    /// [`VERBS`] and [`NEAR_SYNONYMS`].
     #[test]
     fn every_text_that_states_the_verb_list_states_the_same_list() {
         use std::collections::BTreeSet;
@@ -2523,11 +2525,33 @@ mod tests {
         };
         let readme: &'static str = read("wai/catalogue/README.md").leak();
         assert_eq!(between(readme, "rule N3's closed list (", ')'), want, "wai/catalogue/README.md");
-        for v in ["upscale", "tonemap"] {
+        for v in ["upscale", "tonemap", "doctor"] {
             assert!(readme.contains(&format!("`{v}`")), "wai/catalogue/README.md records why {v} joined the list");
         }
+
+        // The doors' check keeps no list of its own: it reads both from this file's source, as
+        // its load_verbs does, the quoted words of the definition of VERBS and the quoted pairs
+        // of that of NEAR_SYNONYMS, each up to the first `];`. What it reads there is the
+        // catalogue's lists, in their order. (Each definition's opening is spelt in two pieces
+        // here, so that this file holds it once, where the check reads it, and the doors'
+        // check's self-test can change it in a copy.)
         let script: &'static str = read("scripts/check-wai-ops-doors.py").leak();
-        assert_eq!(between(script, "\nVERBS = {", '}'), want, "scripts/check-wai-ops-doors.py");
+        assert!(
+            script.contains("\nCATALOGUE = \"wai/wai-rs/src/catalogue.rs\"\n"),
+            "scripts/check-wai-ops-doors.py reads its verbs from wai/wai-rs/src/catalogue.rs"
+        );
+        assert!(!script.contains("\nVERBS = {") && !script.contains("\nNEAR = {\""), "scripts/check-wai-ops-doors.py keeps no list of its own");
+        let source: &'static str = read("wai/wai-rs/src/catalogue.rs").leak();
+        let quoted_after = |open: &str| -> Vec<&'static str> {
+            let at = source.find(open).unwrap_or_else(|| panic!("catalogue.rs: no {open:?}")) + open.len();
+            let body: &'static str = &source[at..at + source[at..].find("];").unwrap()];
+            body.split('"').skip(1).step_by(2).collect()
+        };
+        assert_eq!(quoted_after(concat!("pub const ", "VERBS: &[&str] = &[")), VERBS, "the verbs the doors' check reads from catalogue.rs");
+        let pairs = quoted_after(concat!("pub const ", "NEAR_SYNONYMS: &[(&str, &str)] = &["));
+        assert_eq!(pairs.len() % 2, 0, "the near-synonyms the doors' check reads from catalogue.rs are not pairs: {pairs:?}");
+        let pairs: Vec<(&str, &str)> = pairs.chunks(2).map(|p| (p[0], p[1])).collect();
+        assert_eq!(pairs, NEAR_SYNONYMS, "the near-synonyms the doors' check reads from catalogue.rs");
 
         // The near-synonyms, each with its verb.
         let near: std::collections::BTreeMap<&str, &str> =
@@ -2536,15 +2560,6 @@ mod tests {
         for (n, v) in &near {
             assert!(VERBS.contains(v) && !VERBS.contains(n), "{n} is a near-synonym of the verb {v}");
         }
-        // The script's NEAR: "word": "verb" pairs.
-        let pairs: std::collections::BTreeMap<&str, &str> = between(script, "\nNEAR = {", '}')
-            .into_iter()
-            .map(|p| {
-                let (n, v) = p.split_once(':').unwrap_or_else(|| panic!("NEAR: {p:?} is not a pair"));
-                (n.trim().trim_matches('"'), v.trim().trim_matches('"'))
-            })
-            .collect();
-        assert_eq!(pairs, near, "scripts/check-wai-ops-doors.py's NEAR");
         // The README's sentence: clauses "`a`, `b` and `c` are `v`", one for each verb.
         let open = "never a near-synonym (";
         let at = readme.find(open).unwrap_or_else(|| panic!("the README states no near-synonyms")) + open.len();
-- 
2.54.0 (Apple Git-157)


From 317ae58c6ea51866d9484a9f39f2b07083350923 Mon Sep 17 00:00:00 2001
From: Transaction Science <hello@transaction.science>
Date: Thu, 5 Nov 2026 04:22:37 -0500
Subject: [PATCH 3/4] wai-release: the header states what each archive runs,
 not the state of a runner

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/wai-release.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/wai-release.yml b/.github/workflows/wai-release.yml
index d3b5c91a0..718ef4da1 100644
--- a/.github/workflows/wai-release.yml
+++ b/.github/workflows/wai-release.yml
@@ -20,8 +20,7 @@ name: wai command line release
 # wai create my-room --template video-room and wai dev --check in the project, Studio at /_wai/
 # among what it checks; and on the Apple-silicon Mac, the project's page joined in two browser
 # pages, each decoding the other. A cross-built archive, whose binaries this host cannot run,
-# is not run. The Windows leg has not run yet: its runner is down, so no Windows archive has
-# been through clean-machine.ps1.
+# is not run.
 # A last job writes the Homebrew formula and the Scoop manifest for the archives attached and
 # attaches them too; they go into the tap and the bucket by hand.
 #
-- 
2.54.0 (Apple Git-157)


From b75f6e10341edb53a495e6780dd5c756f1721376 Mon Sep 17 00:00:00 2001
From: Transaction Science <hello@transaction.science>
Date: Thu, 5 Nov 2026 18:24:54 -0500
Subject: [PATCH 4/4] wai dev's test: the stand-in room service listens without
 a reverse lookup

tests/cli_studio.rs failed on every run on one macOS runner and passed on
every other runner, 3 of 3 against 19 of 19 on 5 November, with "the room
service's clock on the relay: not within 30 s".

The stand-in room service starts an HTTPServer, whose server_bind calls
socket.getfqdn before the server listens. On that host, under the runner's
Python 3.15.2, getfqdn("127.0.0.1") takes 35 s, past the 30 s wai dev waits, and
a stack dump of the stalled stand-in shows it there. The stand-in relay opens a
plain socket and answers in 0.1 s. Nothing here reads the name, so the fixture
no longer asks for it.

On that host and Python the room stand-in took 35.5 s and now takes 0.12 s. A
socket.getfqdn planted to stall for 40 s fails the test without this change,
with the same message, and passes with it.

Changelog: none

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 wai/wai-rs/tests/fixtures/dev-stack/fake-stack.py | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/wai/wai-rs/tests/fixtures/dev-stack/fake-stack.py b/wai/wai-rs/tests/fixtures/dev-stack/fake-stack.py
index cce944f03..f8c7a71e4 100755
--- a/wai/wai-rs/tests/fixtures/dev-stack/fake-stack.py
+++ b/wai/wai-rs/tests/fixtures/dev-stack/fake-stack.py
@@ -15,6 +15,7 @@ import json
 import os
 import re
 import socket
+import socketserver
 import sys
 import threading
 import time
@@ -55,6 +56,14 @@ class Room(http.server.BaseHTTPRequestHandler):
         pass
 
 
+class Server(http.server.ThreadingHTTPServer):
+    """HTTPServer looks up a name for its address before it listens, and nothing here reads the
+    name. On some hosts that lookup takes 35 s, past what `wai dev` waits for a service."""
+
+    def server_bind(self):
+        socketserver.TCPServer.server_bind(self)
+
+
 def main(argv):
     if argv[:1] in (["keygen"], ["relay-lines"]):
         open(argv[1], "a").close()
@@ -73,7 +82,7 @@ def main(argv):
         while True:
             c, _ = s.accept()
             c.close()
-    http.server.ThreadingHTTPServer(listen_addr(config, "listen"), Room).serve_forever()
+    Server(listen_addr(config, "listen"), Room).serve_forever()
     return 0
 
 
-- 
2.54.0 (Apple Git-157)