diff --git a/bench/local/exact_replay.py b/bench/local/exact_replay.py
new file mode 100644
index 0000000..43707ab
--- /dev/null
+++ b/bench/local/exact_replay.py
@@ -0,0 +1,192 @@
+"""The exact tag (src/tiers.ts assertsExact) replayed over 2026-10-07's recorded "verified" runs.
+
+    python3 exact_replay.py [--base REF] [--show N] [LANE ...]
+
+"Verified" now needs a passing independent check that compares the work's
+output with an EXACT expected value; a run whose passing checks only test
+properties (counts, sortedness, membership, types, two runs agreeing) gets
+"passed-checks" with the reason "passed checks that test properties only".
+
+Population: every <task>-molt-<rep>[-<arm>] tree under the lanes in
+~/.cache/maat-bench/container-work last written on --day (default
+2026-10-07), joined to its grader row. The grader row comes from the lane's
+results file (named on the first line of ~/.cache/maat-bench/<lane>.log), or
+its `.regraded.jsonl` twin when there is one: the regraded verdict wins.
+
+For each run whose last journalled tier is "verified": the checks that could
+have carried the word are the passing (`pass`, `pass-vacuous`) sealed checks
+in the last accepted receipt that the value rule at --base tags value and
+that the worker did not write. The run keeps "verified" under the new rule
+when one of them is also tagged exact (the working tree's assertsExact). A
+"verified-audit" run keeps it when one of its accepted audit checks is exact.
+
+The rule ships only if it removes every grader-WRONG verified and keeps at
+least two thirds of the grader-RIGHT ones. Two populations are reported:
+
+  A. every recorded "verified" on the day, from any build;
+  B. those the base rule (--base) still grants: a carrying check whose
+     receipt names an independent author. Older builds labelled runs
+     verified on checks with no recorded author, which the base rule already
+     treats as the worker's; the exact rule cannot remove what is not there.
+
+B is the gate: it is what the exact rule changes on the build it ships on.
+As shipped (2026-10-07 lanes):
+
+                          A right   A wrong   B right   B wrong
+  recorded verified          113         8        79         2
+  --literal-only kept     53 (47%)       0     48 (61%)       0
+  shipped rule kept       61 (54%)       0     56 (71%)       0
+
+The literal-only rule (equality with a literal, diff against literal text,
+grep -x) failed the gate; the shipped rule adds two forms (containment of a
+worked-out value in a program's output on literal input, and an oracle built
+from the input files), and passes. In A, 11 right runs rest only on commands
+that also carried a wrong run (the same `find -exec`, `|| echo fail` and
+`print(len(header) == 5)` checks), so no command-level rule can keep them.
+"""
+from __future__ import annotations
+
+import argparse
+import datetime
+import json
+import subprocess
+import sys
+from collections import defaultdict
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+sys.path.insert(0, str(HERE))
+import value_replay as vr  # noqa: E402
+
+PASS = ("pass", "pass-vacuous")
+_recorded_results = vr.results_file
+
+
+def results_file(lane: Path) -> Path | None:
+    p = _recorded_results(lane)
+    if p:
+        g = p.with_name(p.name.replace(".jsonl", ".regraded.jsonl"))
+        if g.exists():
+            return g
+    return p
+
+
+def lanes_on(day: str, names: list[str]) -> list[Path]:
+    out = []
+    for p in vr.CW.iterdir():
+        if not p.is_dir():
+            continue
+        if names and p.name not in names and not any(p.name.startswith(n + "-") for n in names):
+            continue
+        if datetime.date.fromtimestamp(p.stat().st_mtime).isoformat() == day:
+            out.append(p)
+    return sorted(out)
+
+
+def tag(src: Path, fn: str, cmds: list[str], arg: str = "") -> dict[str, bool]:
+    js = (
+        f"import {{ {fn} }} from {json.dumps(str(src))};"
+        f"let s='';process.stdin.on('data',d=>s+=d).on('end',()=>console.log(JSON.stringify(JSON.parse(s).map(r=>{fn}(r{arg})))));"
+    )
+    p = subprocess.run(["node", "--no-warnings", "--input-type=module", "-e", js], input=json.dumps(cmds), capture_output=True, text=True)
+    if p.returncode:
+        sys.exit(f"{fn} from {src} failed: {p.stderr[-600:]}")
+    return dict(zip(cmds, json.loads(p.stdout)))
+
+
+def worker_wrote(author: str | None) -> bool:
+    return bool(author) and author.startswith("the worker model")
+
+
+def main(argv: list[str]) -> int:
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--base", default="origin/claude/value-classifier")
+    ap.add_argument("--day", default="2026-10-07")
+    ap.add_argument("--show", type=int, default=0, help="print the carrying checks of up to N kept and N removed right runs")
+    ap.add_argument("--literal-only", action="store_true", help="the rule as first measured: no containment (form 5), no oracle (form 6)")
+    ap.add_argument("lanes", nargs="*")
+    a = ap.parse_args(argv)
+    vr.results_file = results_file
+    vr.lanes = lambda _prefixes: lanes_on(a.day, a.lanes)
+    runs, checks = vr.collect([])
+    by_run: dict[str, list[dict]] = defaultdict(list)
+    for c in checks:
+        by_run[c["run"]["id"]].append(c)
+    old_src = vr.classifier(a.base)["old"]
+    new_src = vr.REPO / "src/tiers.ts"
+    cmds = sorted({c["cmd"] for c in checks})
+    value = tag(old_src, "assertsValue", cmds)
+    exact = tag(new_src, "assertsExact", cmds, ", { literalOnly: true }" if a.literal_only else "")
+
+    rows = []
+    for r in runs:
+        if r["tier"] not in ("verified", "verified-audit"):
+            continue
+        cs = by_run[r["id"]]
+        if r["tier"] == "verified":
+            carry = [c for c in cs if c["source"] == "sealed" and c.get("result") in PASS and value[c["cmd"]] and not worker_wrote(c.get("author"))]
+        else:
+            carry = [c for c in cs if c["source"] == "audit" and c.get("accepted")]
+        # Still verified at --base: a carrier whose independent author the receipt names (an unrecorded author is the worker's).
+        base = r["tier"] == "verified-audit" or any(vr.independent(c.get("author")) for c in carry)
+        keep = [c for c in carry if exact[c["cmd"]] and (base and (r["tier"] == "verified-audit" or vr.independent(c.get("author"))) or not base)]
+        rows.append({"run": r, "carry": carry, "keep": keep, "base": base})
+
+    print(f"runs with a grader row: {len(runs)}   recorded verified: {sum(x['run']['tier'] == 'verified' for x in rows)}"
+          f"   verified-audit: {sum(x['run']['tier'] == 'verified-audit' for x in rows)}")
+    print(f"distinct check commands: {len(cmds)}   value (base): {sum(value.values())}   exact (new): {sum(exact.values())}"
+          f"   exact but not value (never counted): {sum(exact[c] and not value[c] for c in cmds)}")
+
+    # A command-level rule cannot tell two runs apart that rest on the same commands: a right run whose
+    # carriers all also carried a WRONG run is removed by any rule that removes every wrong one.
+    wrong_cmds = {c["cmd"] for x in rows if not x["run"]["passed"] for c in x["carry"]}
+    for x in rows:
+        x["forced"] = x["run"]["passed"] and all(c["cmd"] in wrong_cmds for c in x["carry"])
+
+    verdict = {}
+    for scope, sel in (("A. every recorded verified (any build)", lambda x: True),
+                       ("B. those --base still grants (an independent author on the receipt)", lambda x: x["base"])):
+        xs = [x for x in rows if sel(x)]
+        right = [x for x in xs if x["run"]["passed"]]
+        wrong = [x for x in xs if not x["run"]["passed"]]
+        kept_right = sum(bool(x["keep"]) for x in right)
+        kept_wrong = sum(bool(x["keep"]) for x in wrong)
+        forced = sum(x["forced"] for x in right)
+        print(f"\n== {scope}")
+        print(f"   {'':16} {'total':>6} {'kept':>6} {'removed':>8}")
+        print(f"   {'grader-right':16} {len(right):6} {kept_right:6} {len(right) - kept_right:8}")
+        print(f"   {'grader-wrong':16} {len(wrong):6} {kept_wrong:6} {len(wrong) - kept_wrong:8}")
+        kept_all = kept_right + kept_wrong
+        print(f"   precision of 'verified': {len(right)}/{len(xs)} = {len(right) / max(1, len(xs)):.1%} recorded -> "
+              f"{kept_right}/{kept_all} = {kept_right / max(1, kept_all):.1%} under the exact rule")
+        print(f"   right runs whose every carrying command also carried a wrong run (no command rule can keep them): {forced}")
+        ok = kept_wrong == 0 and 3 * kept_right >= 2 * len(right)
+        print(f"   gate: wrong removed {len(wrong) - kept_wrong}/{len(wrong)}, right kept {kept_right}/{len(right)}"
+              f" ({kept_right / max(1, len(right)):.0%}, need >= 67%) -> {'PASS' if ok else 'FAIL'}")
+        verdict[scope[0]] = ok
+    ok = verdict["B"]
+    right = [x for x in rows if x["run"]["passed"]]
+    wrong = [x for x in rows if not x["run"]["passed"]]
+
+    print("\n-- grader-wrong verifieds")
+    for x in wrong:
+        print(f"   {'KEPT   ' if x['keep'] else 'removed'} {x['run']['id']}{'' if x['base'] else '  (not granted at --base)'}")
+        for c in x["keep"] or x["carry"]:
+            print(f"      [{'exact' if exact[c['cmd']] else 'property'}] {c['cmd'][:200]!r}")
+    print("\n-- grader-right verifieds removed")
+    for x in right:
+        if x["keep"]:
+            continue
+        print(f"   removed {x['run']['id']}{'' if x['base'] else '  (not granted at --base)'}{'  (forced)' if x['forced'] else ''}")
+        for c in x["carry"][: max(a.show, 2)]:
+            print(f"      [property] {c['cmd'][:200]!r}")
+    if a.show:
+        print("\n-- grader-right verifieds kept (the exact check that carries each)")
+        for x in right:
+            if x["keep"]:
+                print(f"   kept {x['run']['id']}: {x['keep'][0]['cmd'][:200]!r}")
+    return 0 if ok else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))
diff --git a/src/ask.ts b/src/ask.ts
index 3dffb8e..650c502 100644
--- a/src/ask.ts
+++ b/src/ask.ts
@@ -113,7 +113,10 @@ async function askSized(opts: AskOptions): Promise<Asked> {
   // never started the answer. Once, with room: a model that empties a four
   // times larger ceiling the same way is not going to answer, and the second
   // failure says exactly that instead of "the reply was empty".
-  if (first.ok && first.cutOff && first.text.trim() === "" && (leftMs(opts.deadlineAt) ?? 1) > 0) {
+  // Cut off with text written is retried the same way: a draft of exact,
+  // edge-case checks is longer than the ceiling allowed for, and half a JSON
+  // reply proposes nothing (2026-10-07: 3 of 20 runs drafted no checks).
+  if (first.ok && first.cutOff && (leftMs(opts.deadlineAt) ?? 1) > 0) {
     const bigger = (opts.maxTokens ?? ASK_MAX_TOKENS) * ASK_RETRY_FACTOR;
     const second = await askOnce(opts, bigger);
     if (second.ok && second.cutOff && second.text.trim() === "") {
diff --git a/src/criteria.ts b/src/criteria.ts
index 7a47c9b..b06772c 100644
--- a/src/criteria.ts
+++ b/src/criteria.ts
@@ -44,7 +44,12 @@ import type { CheckAuthor } from "./types.js";
  * appears, it compiles) rather than running the deliverable. Kept, but such a
  * check alone cannot carry a "verified" once the ones that ran it are retired.
  */
-export type DraftedCheck = { name: string; run: string; surface?: true };
+/**
+ * A drafted check. `expect` is where its expected output comes from: the task
+ * words that state it, or the steps that derive it from a rule the task states.
+ * Shown to the critic; it never runs.
+ */
+export type DraftedCheck = { name: string; run: string; surface?: true; expect?: string };
 export type Draft = {
   checks: DraftedCheck[];
   notes: string[];
@@ -71,6 +76,8 @@ export const CRITERIA_MAX_NAME = 40;
  */
 export const CRITERIA_MAX_RUN = 1_000;
 export const CRITERIA_MAX_NOTE = 200;
+/** The longest `expect` (where a check's expected output comes from) kept on a drafted check. */
+export const CRITERIA_MAX_EXPECT = 300;
 
 /**
  * Shape a renderer-supplied payload into checks the engine may run.
@@ -100,6 +107,7 @@ export function sanitizeCriteria(raw: unknown): Draft {
           name: c.name.trim().slice(0, CRITERIA_MAX_NAME),
           run: c.run.trim(),
           ...(c.surface === true ? { surface: true as const } : {}),
+          ...(typeof c.expect === "string" && c.expect.trim() ? { expect: c.expect.trim().slice(0, CRITERIA_MAX_EXPECT) } : {}),
         }))
     : [];
   const notes: string[] = Array.isArray(o.notes)
@@ -500,13 +508,13 @@ export function drafterInputsHash(d: DrafterInputs): string {
   return h.digest("hex").slice(0, 16);
 }
 
-const SYSTEM = [
+export const DRAFT_SYSTEM = [
   "You draft acceptance criteria for one coding task. You are not doing the task",
   "and you will not judge whether it was done — a person approves what you write",
   "and it is sealed before the work starts.",
   "",
   "Return JSON only, matching:",
-  '  {"checks":[{"name":"kebab-name","run":"shell command"}],"notes":["sentence"]}',
+  '  {"checks":[{"name":"kebab-name","run":"shell command","expect":"where the expected output comes from"}],"notes":["sentence"]}',
   "",
   "checks are commands that MUST already work in this project. Prefer the scripts",
   "listed below verbatim, optionally narrowed (npm test -- <pattern>). Never invent",
@@ -525,16 +533,22 @@ const SYSTEM = [
   "present. A task that says accuracy above 0.62 gets a check of accuracy above 0.62.",
   "At least one check must run the thing and test its result; a check that only",
   "asks whether a file exists, a name appears, or output parses shows nothing.",
+  "For each thing the task says the work must do, at least one check runs it on a",
+  "concrete input and compares what it produces with the EXACT expected output:",
+  "[ \"$(python3 tool.py 3 4)\" = \"7\" ], assert f('a b') == 'a-b', a diff against a",
+  "heredoc, or grep -qx of a whole expected line. Work the expected output out from",
+  "the task text only: a value it states, or one you get by applying a rule it states",
+  "to an input your check picks, step by step. Put where it comes from in the check's",
+  "\"expect\": the task words quoted, or the derivation (\"*/15 from 00:07: 00:15,",
+  "00:30, 00:45\"). A property (the line count, sorted, each minute a multiple of 15,",
+  "a prefix, two runs agreeing) holds for wrong output too: it may come with an exact",
+  "check, never instead of one. Pick inputs at the edges: a boundary, empty input, a",
+  "value just outside a rule (1.2.3.4.5 for an IP rule), a start that is not on a step,",
+  "and each side of an either/or rule.",
   "When the right answer cannot be known before the work (a fitted value, a model's",
   "accuracy on held-out data, the fastest query), check the closest thing the task",
   "provides instead: the stated threshold on the data that IS here (accuracy >= 0.62",
-  "on the provided test split), the fit's error against the measured points, the new",
-  "query's time against the original's. Never hard-code an answer you had to guess.",
-  "Never write an expected value you worked out yourself — a date, a total, a count,",
-  "an output line the task does not state. Your own arithmetic is where checks go",
-  "wrong. Expected values come only from the task text; otherwise test what the task",
-  "states as a property: the stated number of lines, each strictly after the start,",
-  "the stated format, totals that add up, the same answer from two equivalent inputs.",
+  "on the provided test split). Never hard-code an answer you had to guess.",
   "Checks must leave nothing behind: build and write into $(mktemp -d), never into",
   "a directory the task names.",
   "Every path is relative to the working directory shown below. Never write an",
@@ -545,7 +559,7 @@ const SYSTEM = [
   "feels. They are recorded on the receipt as stated intent and never reported as",
   "verified. Do not write a note that pretends to be a check.",
   "",
-  "Two or three checks and at most two notes. Fewer is better. If the task needs",
+  "Two to four checks and at most two notes. If the task needs",
   "no criterion beyond the project's own bar, return empty lists.",
 ].join("\n");
 
@@ -751,7 +765,7 @@ export async function draftCriteria(opts: {
     baseUrl: opts.baseUrl,
     apiKey: opts.apiKey,
     model: opts.model,
-    system: SYSTEM,
+    system: DRAFT_SYSTEM,
     prompt: prompted,
     cwd: askCwd,
     what: "drafting criteria",
@@ -772,7 +786,7 @@ export async function draftCriteria(opts: {
     baseUrl: opts.baseUrl,
     apiKey: opts.apiKey,
     model: opts.model,
-    system: SYSTEM,
+    system: DRAFT_SYSTEM,
     prompt: `${prompted}\n\nYour last reply could not be parsed as JSON. Reply with the JSON object only.`,
     cwd: askCwd,
     what: "drafting criteria",
@@ -797,7 +811,7 @@ export async function draftCriteria(opts: {
       baseUrl: opts.baseUrl,
       apiKey: opts.apiKey,
       model: opts.model,
-      system: SYSTEM,
+      system: DRAFT_SYSTEM,
       prompt: context,
       cwd: askCwd,
       what: "drafting criteria",
@@ -850,7 +864,8 @@ export const CRITIC_SYSTEM = [
   "              only have guessed (a model name, a count, a result the work must find out).",
   '  "surface"  — it only looks: a file exists, a word appears in source, it compiles, --help works.',
   '  "runs"     — it runs the deliverable on an input and checks what it produces.',
-  "For invents and guesses, quote the task words the check gets wrong, verbatim.",
+  "For invents and guesses, quote the task words the check gets wrong, verbatim. A value",
+  "derived step by step from a rule the task states, shown in the check's expect, is not a guess.",
   "",
   "Then list hard requirements no check would catch if the work got them wrong. A hard",
   "requirement is a concrete fact a shell command could test on this machine, right now:",
@@ -869,6 +884,12 @@ export const CRITIC_SYSTEM = [
   ' "uncovered":["verbatim task words"], "requirements":["verbatim task words"]}',
 ].join("\n");
 
+/** What the critic reads: the task, the project view, and each check with where its expected output comes from. */
+export function criticPrompt(task: string, view: string | undefined, checks: readonly DraftedCheck[]): string {
+  const line = (c: DraftedCheck) => `- ${c.name}: ${c.run}${c.expect ? `\n  expect: ${c.expect}` : ""}`;
+  return `TASK TEXT:\n${task}\n\n${view ? `${view}\n\n` : ""}CHECKS:\n${checks.map(line).join("\n")}`;
+}
+
 export type Critique = {
   kept: DraftedCheck[];
   dropped: { name: string; verdict: "invents" | "guesses"; quote: string }[];
@@ -1132,7 +1153,7 @@ async function critiqued(
       apiKey: opts.apiKey,
       model: opts.model,
       system: CRITIC_SYSTEM,
-      prompt: `TASK TEXT:\n${opts.task}\n\n${view ? `${view}\n\n` : ""}CHECKS:\n${d.checks.map((c) => `- ${c.name}: ${c.run}`).join("\n")}`,
+      prompt: criticPrompt(opts.task, view, d.checks),
       cwd: opts.askCwd ?? opts.cwd,
       what: "reviewing the drafted checks",
       fetchFn: opts.fetchFn,
diff --git a/src/post-audit.ts b/src/post-audit.ts
index 65fecef..c1f0bd0 100644
--- a/src/post-audit.ts
+++ b/src/post-audit.ts
@@ -41,7 +41,7 @@ import { parseLenient } from "./lenient-json.js";
 import { interfaceView, isCode, type Changed } from "./interface-view.js";
 import { bashPath, runCommand } from "./run.js";
 import { copyTree } from "./scratch.js";
-import { assertsValue } from "./tiers.js";
+import { assertsExact, assertsValue } from "./tiers.js";
 
 export const AUDIT_MAX_CHECKS = 4;
 export const AUDIT_MIN_QUOTE = 8;
@@ -54,32 +54,39 @@ export const AUDIT_SYSTEM = [
   "it added or changed, their signatures, how to run them, and the project listing.",
   "",
   "Write 2 to 4 shell checks. Each runs the deliverable (a script, a function, a query) on an input",
-  "and compares what it produces with an expected value, exiting non-zero on a mismatch. Almost",
+  "and compares what it produces with the EXACT expected output, exiting non-zero on a mismatch:",
+  "equality with a literal, a diff against a heredoc, or grep -x of a whole expected line. A count,",
+  "an order, a format, a prefix or two runs agreeing is a property wrong output also has: such a",
+  "check is dropped. Each requirement the task states gets at least one exact check. Almost",
   "every task states something checkable: an output for a given input, a format, a count, a rule",
   "(\"blank lines are ignored\", \"sorted by total, highest first\"), a file it must write.",
   "Return an empty list only when the task states nothing a command could test.",
   "",
   "The expected value must come from the task text: either stated outright, or the result of",
   "applying a rule the task states to a small input your check builds itself (write it under",
-  "$(mktemp -d)). For each check give `quote`: the task words that state that value or rule,",
+  "$(mktemp -d)). Pick inputs at the edges: a boundary, empty input, a value just outside a rule",
+  "(1.2.3.4.5 for an IP rule), a start that is not on a step, and each side of an either/or rule.",
+  "For each check give `quote`: the task words that state that value or rule,",
   "copied character for character from the task text (a short span is best, 5 to 20 words).",
   "A quote that is not word for word in the task, even a close paraphrase, drops the check. Never",
-  "use a value you would only know by running the work or by guessing.",
+  "use a value you would only know by running the work or by guessing. When the value is derived,",
+  "give the steps in `expect` (\"*/15 from 00:07: 00:15, 00:30, 00:45\").",
   "",
   "Rules: one line each, under 500 characters, run under bash from the project root on a",
   "throwaway copy. A check that only prints is useless: end every check in a comparison, e.g.",
   "  [ \"$(python3 tool.py 3 4)\" = \"7\" ]",
   "  python3 -c \"import json; d=json.load(open('out.json')); assert d['total'] == 12, d\"",
-  "  [ \"$(grep -c '^ERROR' report.txt)\" -eq 3 ]",
+  "  python3 tool.py 'x y' | diff - <(printf 'x-y\\n')",
   "A wrong result must make the check exit non-zero: no `|| true`, no `|| echo`, no",
   "printing PASS/FAIL with exit 0. Do not write into the project; scratch files go under",
   "$(mktemp -d). Use the file names, flags and signatures shown; do not invent others.",
   "",
   "Reply with JSON only:",
-  '{"checks":[{"name":"kebab-name","run":"shell command","quote":"verbatim task words"}]}',
+  '{"checks":[{"name":"kebab-name","run":"shell command","quote":"verbatim task words","expect":"how the expected output follows"}]}',
 ].join("\n");
 
-export type AuditCheck = { name: string; run: string; quote: string };
+/** `expect`: how the expected output follows from the quote, when it is derived rather than stated. */
+export type AuditCheck = { name: string; run: string; quote: string; expect?: string };
 export type AuditDrop = { name: string; run: string; why: string };
 
 /** The judge's reply as checks, with every ungrounded or malformed one dropped and said. */
@@ -116,6 +123,7 @@ export function parseAuditChecks(reply: string, task: string): { kept: AuditChec
     let name = String(o.name ?? "").trim().replace(/\s+/g, "-").slice(0, CRITERIA_MAX_NAME) || `audit-${kept.length + dropped.length + 1}`;
     const run = String(o.run ?? "").trim();
     const quote = String(o.quote ?? "").trim();
+    const expect = typeof o.expect === "string" ? o.expect.trim().slice(0, 300) : "";
     while (seen.has(name)) name = `${name}-2`;
     seen.add(name);
     if (!run) dropped.push({ name, run, why: "no command" });
@@ -124,7 +132,7 @@ export function parseAuditChecks(reply: string, task: string): { kept: AuditChec
     else if (quote.replace(/\s+/g, " ").length < AUDIT_MIN_QUOTE || !quotedIn(quote, task))
       dropped.push({ name, run, why: `its quote is not in the task text: "${quote.slice(0, 80)}"` });
     else if (kept.length >= AUDIT_MAX_CHECKS) dropped.push({ name, run, why: `over ${AUDIT_MAX_CHECKS} checks` });
-    else kept.push({ name, run, quote });
+    else kept.push({ name, run, quote, ...(expect ? { expect } : {}) });
   }
   return { kept, dropped };
 }
@@ -508,6 +516,7 @@ export async function auditGates(
   const never = cannotFail(c.run);
   if (never) return no("L16-cannot-fail", never);
   if (!assertsValue(c.run)) return no("V-no-value", "it does not assert an expected value");
+  if (!assertsExact(c.run)) return no("V-property-only", "it tests a property of the output (a count, an order, a format, membership, two runs agreeing), not an exact expected value");
   const work = await runOnCopy(ctx.workDir, c.run, { timeoutMs: ctx.timeoutMs, signal: ctx.signal });
   if (work.printedFail) return no("L16-printed-fail", "it printed FAIL and still exited 0 on the work", { work: work.status });
   if (work.status !== "pass") return no("A-fails-on-work", `it does not pass on the work (${work.status}): ${work.output.split("\n").slice(-1)[0]?.slice(0, 160) ?? ""}`, { work: work.status });
diff --git a/src/reference.ts b/src/reference.ts
index 579989d..cf57565 100644
--- a/src/reference.ts
+++ b/src/reference.ts
@@ -486,8 +486,9 @@ async function writeAndTry(opts: Ask, prompt: string): Promise<Reference | { ok:
     timeoutMs: REFERENCE_TIMEOUT_MS,
     expectExit: 0,
     // It runs the deliverable on inputs and compares what it returns to two
-    // independently written references: a run that asserts values.
-    tags: ["task", "reference", "value"],
+    // independently written references: a run that asserts values, and
+    // exact ones (equality with what the references return on each input).
+    tags: ["task", "reference", "value", "exact"],
     hidden: true,
     // Written by this model: independent of the work only when it is not the worker's.
     author: { kind: "reference", model: opts.model },
diff --git a/src/tiers.ts b/src/tiers.ts
index ee2b9c9..becf3d6 100644
--- a/src/tiers.ts
+++ b/src/tiers.ts
@@ -584,9 +584,492 @@ export function assertsValue(run: string, goldenPredates?: (operand: string) =>
   return assertsBehaviour(run);
 }
 
-/** The tags a drafted check carries: surface from the critic, value from the command. */
+// ---------------------------------------------------------------- the exact tag
+
+/**
+ * Does this command compare the deliverable's output with an EXACT expected
+ * value, or only test a property of it?
+ *
+ * The 2026-10-07 lanes earned a wrong "verified" on cron-next with four
+ * passing judge checks that all tested properties: 8 lines, each minute a
+ * multiple of 15, sorted, unique; "every date is the 13th or a Friday"; two
+ * runs of the worker agree; "starts with 2024-06-1". Output that skips every
+ * other occurrence has all of those properties. An exact check would not
+ * have passed: from 00:07, `*\/15` gives 00:15 first, and the work gave 00:45.
+ *
+ * Exact, any one of these:
+ *  1. An equality (`==`, `===`, `-eq`, `=` in a test bracket, a failing `if
+ *     ... != ...` / `!==`, `assertEqual`/`strictEqual`/`deepEqual`) between
+ *     what the work produced and a literal: a number, a quoted string, a
+ *     list/dict/set of literals, true/false/null, `"$(printf '...')"`, or a
+ *     name bound to one (a table of cases). Asserted: under `assert`, `if ...:
+ *     exit/raise/throw`, `exit(0 if ...)`, a test bracket, or `jq -e`.
+ *  2. `diff`/`cmp` against a heredoc, a here-string, `<(printf ...)` /
+ *     `<(echo ...)`, or an expected file (the tier's pre-work record still
+ *     has to vouch for the file: `valueUnproven`).
+ *  3. `grep -x` (or a `^...$` pattern) of a literal line, with no regex
+ *     wildcards unless `-F`, over the work's output or a file it wrote.
+ *  4. `<call into the work on literal input> is None`, asserted.
+ *  5. A specific worked-out value with a digit in it found in what a program
+ *     printed on literal input: `nextrun.py '0 9 * * *' '2023-01-01 08:00' 1
+ *     | grep -q '2023-01-01 09:00'` (containsValue).
+ *  6. An oracle: the work's output equal to a value the check built from the
+ *     task's input files without running anything (oracleEquality).
+ *  7. An exit or HTTP status other than 0/200 the task names (`rc=$?; [ $rc
+ *     -eq 2 ]`), not read only on the path where the command failed.
+ * Forms 5 and 6 narrow the rule as first measured (literal equality, diff,
+ * grep -x only): over the 2026-10-07 lanes that kept 48 of 79 grader-right
+ * verifieds the base rule grants, under the two-thirds bar; with them, 56 of
+ * 79, and every grader-wrong verified is still removed
+ * (bench/local/exact_replay.py).
+ * Property, never exact, whatever the literal:
+ *  - counts and sizes: `len()`, `.length`, `wc`, `grep -c`, `count`, `sum()`,
+ *    jq `length`;
+ *  - types and shapes: `type()`, `typeof`, `isinstance`, `keys`;
+ *  - modulo (`% 15 == 0`), prefixes/suffixes and slices, membership in a
+ *    file, a format pattern, ordering;
+ *  - exit status 0 and HTTP 200: they say only that it ran;
+ *  - the same constant compared across every item (`all(...)`, `any(...)`,
+ *    a comprehension, a `for` loop, `find -exec`, `xargs`, jq `.[]`): each
+ *    item having the property is still a property;
+ *  - two unknowns compared (`[ "$a" = "$b" ]`, `L == sorted(set(L))`, two
+ *    runs of the work agreeing);
+ *  - a command that cannot fail (`... || echo fail`, `...; true`, `print(x == 1)`);
+ *  - a pattern the work wrote, tried on lines the check chose (`re.search(p, ...)`).
+ * A constant compared inside a loop over a literal table of cases
+ * (`for inp, want in CASES: assert f(inp) == want`) is exact: `want` changes
+ * with the input.
+ *
+ * `literalOnly` turns forms 5 and 6 off: the rule as first measured, for
+ * bench/local/exact_replay.py.
+ */
+export function assertsExact(run: string, opts: { literalOnly?: boolean } = {}): boolean {
+  // A pattern the work wrote, tried on lines the check chose: the judge's own examples
+  // missed the grader's near-miss (see "Not widened" under assertsValue).
+  if (cannotFail(run) || PATTERN_DELIVERABLE.test(run)) return false;
+  const names = exactNames(run);
+  const narrow = !opts.literalOnly;
+  if (exactEquality(run, names, narrow) || exactHelper(run, names) || exactDiff(run) || exactGrepLine(run) || exactNone(run, names) || (narrow && containsValue(run))) return true;
+  // `bash -c '<script>'`: the script is a command of its own. Not under `find -exec` or `xargs`: that runs it once per item.
+  for (const m of run.matchAll(/(?:^|[\s;&|(])(?:ba|z|da)?sh\s+-c\s+(['"])/g)) {
+    const open = (m.index ?? 0) + m[0].length;
+    const q = m[1]!;
+    let end = open;
+    while (end < run.length && !(run[end] === q && (q === "'" || run[end - 1] !== "\\"))) end++;
+    if (end >= run.length) continue;
+    const seg = shellSegments(run).find(([a, b]) => a <= (m.index ?? 0) && (m.index ?? 0) <= b);
+    if (seg && /\s-exec(?:dir)?\b|\bxargs\b|\bparallel\b/.test(run.slice(seg[0], open))) continue;
+    const body = q === '"' ? run.slice(open, end).replace(/\\(["\\$`])/g, "$1") : run.slice(open, end);
+    if (body.trim() && body !== run && assertsExact(body, opts)) return true;
+  }
+  return false;
+}
+
+/**
+ * Names bound to a WHOLE literal (`want = ['00:15', '00:30']`, `CASES = [('a', 1), ...]`)
+ * and loop variables over one: stricter than `literalNames`, which also takes
+ * `exp = [f"{n} {q}" for ...]`, a value the check computed.
+ */
+function exactNames(run: string): Set<string> {
+  const names = new Set<string>();
+  for (const m of run.matchAll(/(?<![\w.])([A-Za-z_]\w*)\s*(?<![=!<>])=(?!=)\s*/g)) {
+    const rhs = rightOperand(run, (m.index ?? 0) + m[0].length);
+    if (wholeLiteral(rhs, new Set())) names.add(m[1]!);
+  }
+  for (let pass = 0; pass < 2; pass++) {
+    for (const m of run.matchAll(/\bfor\s+\(?\s*([A-Za-z_][\w\s,]*?)\s*\)?\s+in\s+/g)) {
+      const at = (m.index ?? 0) + m[0].length;
+      const src = rightOperand(run, at).replace(/:$/, "");
+      const zipped = /^(?:zip|enumerate)\((.*)\)$/s.exec(src);
+      const parts = zipped ? splitTop(zipped[1]!, /,/y).map((x) => x.trim()) : [src];
+      if (parts.every((x) => names.has(x) || wholeLiteral(x, new Set()))) for (const v of m[1]!.split(",")) if (v.trim()) names.add(v.trim());
+    }
+  }
+  return names;
+}
+
+/** A command whose exit status cannot be non-zero: its last top-level command is `echo`, `true`, `:`, `kill`, `rm` or `exit 0` after `;` or `||`. */
+function cannotFail(run: string): boolean {
+  const segs = shellSegments(run);
+  if (segs.length < 2) return false;
+  const [a, b] = segs[segs.length - 1]!;
+  const last = run.slice(a, b).trim();
+  const sep = run.slice(segs[segs.length - 2]![1], a);
+  if (sep.trim() === "&&") return false;
+  return /^(?:echo|printf|true|kill|rm|wait|sleep|exit\s+0)\b/.test(last) || /^:(?:\s|$)/.test(last);
+}
+
+/** What the work's side of a comparison must not be: a count, a size, a type, a remainder, an exit code, a prefix. */
+const PROPERTY_SIDE =
+  /\blen\s*\(|\.length\b|\blength\b|\bwc\b|\bgrep\s+(?:-\w+\s+)*-\w*c|\buniq\s+-c|\.count\s*\(|\bcount\b|\bsum\s*\(|\btype\s*\(|\btypeof\b|\bisinstance\b|\bkeys\b|(?<![%\w'"])%\s*[\w(]|\breturncode\b|\$\?|\bexit_?[Cc]ode\b|\.(?:status|status_code|code)\b|\bhttp_code\b|\[\s*-?\d*\s*:\s*-?\d*\s*\]|\.\[\]|\.(?:startswith|endswith|startsWith|endsWith)\(/;
+
+/** An exit status or an HTTP status: `$?`, `returncode`, `exitCode`, `.status`, `status_code`, `http_code`. */
+const STATUS_SIDE = /\$\?|\breturncode\b|\bexit_?[Cc]ode\b|\.(?:status|status_code|code)\b|\bhttp_code\b/;
+
+/**
+ * A status counts as an exact output only when the task's specific one is
+ * named: `exit 2 on a bad -n`, `404 for a missing id`. 0 and 200 say only
+ * that it ran.
+ */
+function statusExpected(literal: string): boolean {
+  const n = literal.trim().replace(/^(["'])(.*)\1$/, "$2");
+  return /^-?\d+$/.test(n) && n !== "0" && n !== "200";
+}
+
+/** A shell word that prints literal text: `"$(printf 'a\nb')"`, `"$(echo ok)"`, with no expansion inside. */
+const PRINTF_LITERAL = /^"?\$\(\s*(?:printf|echo)(?:\s+-[ne]+)?\s+(?:'[^'$`]*'|"[^"$`]*"|[^\s$`'"();|&]+)\s*\)"?$/;
+
+/** A whole literal: a number, a quoted string with no expansion, a keyword, or a bracketed list/dict/set/tuple of literals. */
+function wholeLiteral(text: string, names: ReadonlySet<string>): boolean {
+  const t = text.trim().replace(/^\\(["'])/, "$1").replace(/\\(["'])$/, "$1");
+  if (!t) return false;
+  if (names.has(t)) return true;
+  if (/^-?\d+(?:\.\d+)?$/.test(t)) return true;
+  if (/^(?:True|False|None|true|false|null|undefined)$/.test(t)) return true;
+  if (/^[rbuf]{0,2}(["'])(?:(?!\1)[^\\$]|\\.)*\1$/s.test(t)) return true;
+  if (/^\$'(?:[^'\\]|\\.)*'$/.test(t)) return true;
+  if (/^[[({]/.test(t) && closeParen(t, 0) === t.length) {
+    const bare = t.replace(/\\?(["'])(?:(?!\1)[^\\]|\\.)*?\\?\1/g, "''");
+    return !/[A-Za-z_]\w*/.test(bare.replace(/\b(?:True|False|None|true|false|null)\b/g, ""));
+  }
+  return false;
+}
+
+const OPERAND_STOP_WORDS = /(?:^|[\s(;])(?:assert|and|or|not|if|elif|while|return|else|then|in|print|&&|\|\|)\s*$/;
+
+/** The operand ending just before `at` in code: back to an unmatched bracket, a top-level separator, or a keyword. */
+function leftOperand(s: string, at: number): { text: string; start: number } {
+  let depth = 0;
+  let i = at - 1;
+  while (i >= 0 && /\s/.test(s[i]!)) i--;
+  const end = i + 1;
+  for (; i >= 0; i--) {
+    const ch = s[i]!;
+    if (ch === "'" || ch === '"') {
+      const open = s.lastIndexOf(ch, i - 1);
+      if (depth === 0 && i + 1 !== end) break; // a quote that is not the operand's own string: the shell's
+      if (open < 0) break;
+      i = open;
+      if (s[i - 1] === "\\") i--;
+      continue;
+    }
+    if (")]}".includes(ch)) depth++;
+    else if ("([{".includes(ch)) {
+      if (depth === 0) break;
+      depth--;
+    } else if (depth === 0) {
+      if (",;\n?:=!<>".includes(ch) && !(ch === "=" && s[i - 1] === "=")) break;
+      if (/\s/.test(ch) && OPERAND_STOP_WORDS.test(s.slice(Math.max(0, i - 8), i + 1))) break;
+      if (/\s/.test(ch) && /^\s*(?:and|or|if|else|not)\b/.test(s.slice(i + 1, end))) break;
+    }
+  }
+  const start = i + 1;
+  return { text: s.slice(start, end).trim().replace(/^(?:assert|not|if|return)\s+/, ""), start };
+}
+
+/** The operand starting just after `from` in code: up to an unmatched bracket, a top-level separator, or a keyword. */
+function rightOperand(s: string, from: number): string {
+  let depth = 0;
+  let i = from;
+  while (i < s.length && /\s/.test(s[i]!)) i++;
+  const start = i;
+  for (; i < s.length; i++) {
+    const ch = s[i]!;
+    if (ch === "\\" && (s[i + 1] === '"' || s[i + 1] === "'")) {
+      if (depth === 0 && i !== start) break;
+      const q = s[i + 1]!;
+      const close = s.indexOf(`\\${q}`, i + 2);
+      if (close < 0) break;
+      i = close + 1;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      if (depth === 0 && i !== start && !/^[rbuf]{1,2}$/.test(s.slice(start, i))) break;
+      const close = s.indexOf(ch, i + 1);
+      if (close < 0) break;
+      i = close;
+      continue;
+    }
+    if ("([{".includes(ch)) depth++;
+    else if (")]}".includes(ch)) {
+      if (depth === 0) break;
+      depth--;
+    } else if (depth === 0) {
+      if (",;\n?:&|".includes(ch)) break;
+      if (/\s/.test(ch) && /^\s*(?:and|or|if|else|for)\b/.test(s.slice(i))) break;
+    }
+  }
+  return s.slice(start, i).trim();
+}
+
+/** The `(`/`[`/`{` openers enclosing `at`, innermost first. */
+function enclosing(s: string, at: number): number[] {
+  const out: number[] = [];
+  let depth = 0;
+  for (let i = at - 1; i >= 0; i--) {
+    const ch = s[i]!;
+    if (")]}".includes(ch)) depth++;
+    else if ("([{".includes(ch)) {
+      if (depth === 0) out.push(i);
+      else depth--;
+    }
+  }
+  return out;
+}
+
+/** `s` with nested brackets and quoted strings emptied: what is at its own top level. */
+function topLevelText(s: string): string {
+  let out = "";
+  let depth = 0;
+  let q: string | undefined;
+  for (let i = 0; i < s.length; i++) {
+    const ch = s[i]!;
+    if (q) {
+      if (ch === "\\") i++;
+      else if (ch === q) q = undefined;
+      continue;
+    }
+    if (ch === "'" || ch === '"') q = ch;
+    else if ("([{".includes(ch)) depth++;
+    else if (")]}".includes(ch)) depth--;
+    else if (depth === 0) out += ch;
+  }
+  return out;
+}
+
+/** Is the comparison at `at` made once per item of something: inside all()/any()/a comprehension, a for loop, find -exec, xargs, jq `.[]`? */
+function quantified(s: string, at: number): boolean {
+  for (const open of enclosing(s, at)) {
+    const before = s.slice(Math.max(0, open - 12), open);
+    if (/(?:\ball|\bany|\.every|\.some|\bfilter|\bmap|\.forEach|\bsum)\s*$/.test(before)) return true;
+    const end = closeParen(s, open);
+    const inner = s.slice(open + 1, end > 0 ? end - 1 : s.length);
+    // A comprehension: `for ... in` at the top level of this bracket, not in a call or string nested in it.
+    if (/\sfor\s[^\n]*?\sin\s/.test(topLevelText(inner)) && !/^\s*for\b/.test(inner)) return true;
+  }
+  const stmt = s.slice(0, at).split(/[;\n]/).pop() ?? "";
+  if (/(?:^|[\s(])for\s*\(|(?:^|\s)for\s+[\w,\s()]+\s+in\s/.test(stmt)) return true;
+  const seg = shellSegments(s).find(([a, b]) => a <= at && at <= b);
+  const segText = seg ? s.slice(seg[0], at) : "";
+  if (/\s-exec(?:dir)?\b|\bxargs\b|\bparallel\b/.test(segText)) return true;
+  const lastDo = s.lastIndexOf(" do ", at);
+  if (lastDo >= 0 && /\b(?:for|while)\b/.test(s.slice(0, lastDo)) && s.indexOf("done", at) > 0 && s.lastIndexOf("done", at) < lastDo) return true;
+  return false;
+}
+
+/** Is the comparison at `at` what decides the exit status: under assert/if-exit/exit(0 if ...)/throw, a test bracket, or `jq -e`? */
+function asserted(s: string, at: number): boolean {
+  const stmt = s.slice(Math.max(0, at - 300), at).split(/[;\n]/).pop() ?? "";
+  if (/(?:^|[\s(])assert(?:\.\w+)?[\s(]|\bif\s*\(|\bexit\(|\bSystemExit\(|\bexpect\(/.test(stmt)) return true;
+  if (/(?:^|\s)if\s/.test(stmt) && !/\bprint\s*\(/.test(stmt)) {
+    const after = s.slice(at, at + 400);
+    if (/\b(?:sys\.)?exit\(|\braise\b|\bthrow\b|process\.exit\(|\bexit\s+[1-9]/.test(after)) return true;
+  }
+  if (/\bjq\s+(?:-\w+\s+)*-\w*e\w*\s/.test(s.slice(0, at)) && /\bjq\b[^|;&]*$/.test(s.slice(0, at))) return true;
+  return false;
+}
+
+/** Rule 1: an asserted equality between the work's output and a literal. */
+function exactEquality(run: string, names: ReadonlySet<string>, oracle: boolean): boolean {
+  const ops = /(===|!==|==|!=|(?<=\s)-eq(?=\s)|(?<=\s)-ne(?=\s)|(?<=\s)=(?=\s))/g;
+  const d = shellDepths(run);
+  // Shell variables that hold an exit status: `rc=$?` makes `[ $rc -eq 2 ]` an exit-code check.
+  const statusVars = [...run.matchAll(/(?<![\w$])(\w+)=\$\?/g)].map((m) => m[1]!);
+  for (const m of run.matchAll(ops)) {
+    const at = m.index ?? 0;
+    const op = m[1]!;
+    const seg = shellSegments(run).find(([a, b]) => a <= at && at <= b);
+    const inBracket = !!seg && d[at] === 0 && BRACKET.test(run.slice(seg[0], at));
+    let left: string;
+    let right: string;
+    if (inBracket) {
+      [left, right] = shellWordAround(run, d, at, op.length);
+      // `[ x != "lit" ]` asserts a difference, unless a failure follows it: `[ x != y ] && exit 1`.
+      if ((op === "!=" || op === "-ne") && !/^\s*\]{1,2}\s*&&\s*(?:\{\s*)?(?:echo[^;&|]*[;&|]+\s*)?exit\s+[1-9]/.test(run.slice(at + op.length).replace(/^\s*\S+/, ""))) continue;
+      const lit = (w: string) => SHELL_LITERAL.test(w) || PRINTF_LITERAL.test(w) || wholeLiteral(w, names);
+      const work = lit(right) ? left : lit(left) ? right : undefined;
+      if (work === undefined || lit(work)) continue;
+      const expected = work === left ? right : left;
+      if (STATUS_SIDE.test(work) || statusVars.some((v) => new RegExp(`\\$\\{?${v}\\b`).test(work))) {
+        // `X || [ $? -eq 1 ]` passes whenever X succeeds: the status is only read on the path that failed.
+        const before = seg ? run.slice(0, seg[0]).trimEnd() : "";
+        if (!statusExpected(expected) || before.endsWith("||")) continue;
+      } else if (PROPERTY_SIDE.test(work)) continue;
+      if (quantified(run, at)) continue;
+      return true;
+    }
+    if (op === "=" || op === "-eq" || op === "-ne") continue;
+    const l = leftOperand(run, at);
+    const r = rightOperand(run, at + op.length);
+    // A difference counts only when it is what fails the check: `if (x !== "lit") throw`.
+    if (op.startsWith("!")) {
+      const stmt = run.slice(Math.max(0, l.start - 40), l.start);
+      if (!/\bif\s*\(?\s*(?:not\s+)?$/.test(stmt) && !/\bif\s*\(\s*$/.test(stmt)) continue;
+      const after = run.slice(at, at + 200);
+      if (!/\b(?:sys\.)?exit\(\s*[1-9"']|\braise\b|\bthrow\b|process\.exit\(\s*[1-9]/.test(after)) continue;
+    } else if (!asserted(run, at)) continue;
+    const litR = wholeLiteral(r, names);
+    const litL = wholeLiteral(l.text, names);
+    if (!litR && !litL) {
+      if (oracle && oracleEquality(run, l.text, r)) return true;
+      continue;
+    }
+    if (litR === litL) continue;
+    const work = litR ? l.text : r;
+    const expected = litR ? r : l.text;
+    if (!work) continue;
+    if (STATUS_SIDE.test(work)) {
+      if (!statusExpected(expected)) continue;
+    } else if (PROPERTY_SIDE.test(work)) continue;
+    if (quantified(run, at) && !names.has(expected.trim())) continue;
+    return true;
+  }
+  return false;
+}
+
+/** What builds a value by running something: then it is the work's output, not an expectation. */
+const RUNS_SOMETHING = /\bsubprocess\b|\bcheck_output\b|\bpopen\b|\bexec(?:File)?Sync\b|\bspawnSync\b|\bstdout\b|\bstdin\b|\binput\(|\$\(|`/;
+/** What reads the task's input files. */
+const READS_INPUT = /\bopen\(|\bjson\.load\(|\brequire\(\s*["'`]\.\/|\breadFileSync\(|\bcsv\.reader\(/;
+
+/**
+ * Rule 1, oracle form: the work's output equals a value the check computed
+ * from the task's own input files without running anything:
+ *   exp = [f"{n:>6} {q}" for q, n in top]  ...  assert open("report.txt").read().splitlines() == exp
+ * The expected side is one name (a trailing `.strip()`-style call allowed),
+ * assigned in the command from an expression that runs nothing and reads no
+ * output stream; the other side does not use that name (`L == sorted(set(L))`
+ * relates the output to itself).
+ */
+function oracleEquality(run: string, left: string, right: string): boolean {
+  if (!READS_INPUT.test(run)) return false;
+  const bare = (x: string) => /^([A-Za-z_]\w*)(?:\.(?:r?strip|splitlines)\([^()]*\))?$/.exec(x.trim())?.[1];
+  for (const [exp, work] of [
+    [bare(right), left],
+    [bare(left), right],
+  ] as const) {
+    if (!exp || !work.trim() || new RegExp(`\\b${exp}\\b`).test(work) || PROPERTY_SIDE.test(work) || STATUS_SIDE.test(work)) continue;
+    const defs = [...run.matchAll(new RegExp(`(?<![\\w.])${exp}\\s*(?<![=!<>])=(?!=)\\s*`, "g"))];
+    if (!defs.length) continue;
+    if (defs.every((m) => {
+      const rhs = rightOperand(run, (m.index ?? 0) + m[0].length);
+      return rhs && !RUNS_SOMETHING.test(rhs) && !wholeLiteral(rhs, new Set());
+    })) return true;
+  }
+  return false;
+}
+
+/** Rule 1, helper form: `assertEqual(f('x'), 'y')`, `assert.strictEqual(f(2), 4)`, `assert.deepEqual(...)`. */
+function exactHelper(run: string, names: ReadonlySet<string>): boolean {
+  for (const m of run.matchAll(/(?:\bassert_?[Ee]qual|\bassert_eq!?|\.(?:deep|strict|deepStrict)?[Ee]qual)\w*\s*\(/g)) {
+    const open = (m.index ?? 0) + m[0].length - 1;
+    const end = closeParen(run, open);
+    if (end < 0) continue;
+    const args = splitTop(run.slice(open + 1, end - 1), /,/y).map((a) => a.trim());
+    if (args.length < 2) continue;
+    const [a, b] = args as [string, string];
+    const la = wholeLiteral(a, names);
+    const lb = wholeLiteral(b, names);
+    if (la === lb) continue;
+    const work = la ? b : a;
+    if (PROPERTY_SIDE.test(work) || quantified(run, open)) continue;
+    return true;
+  }
+  return false;
+}
+
+/** Rule 2: `diff`/`cmp` against a heredoc, a here-string, `<(printf|echo ...)`, or an expected file. */
+function exactDiff(run: string): boolean {
+  for (const m of run.matchAll(/\b(?:diff|cmp)\b([^\n|;&]*)/g)) {
+    const args = m[1] ?? "";
+    if (/<<|<\(\s*(?:printf|echo|cat\s+<<)\b/.test(args) || GOLDEN_NAME.test(args)) return true;
+  }
+  return false;
+}
+
+/** Stages that turn output into a count: what a `grep -x '5'` after them reads. */
+const COUNTING_STAGE = /^(?:wc\b|uniq\s+(?:-\w+\s+)*-\w*c|grep\s+(?:-\w+\s+)*-\w*c|jq\s+[^|]*\blength\b|awk\b[^|]*\bNR\b|sort\s[^|]*\|\s*uniq\s+-c)/;
+
+/** Rule 3: `grep -x '<literal line>'` (or `^...$`) over the work's output or a file, not over a count. */
+function exactGrepLine(run: string): boolean {
+  for (const [a, b] of shellSegments(run)) {
+    const stages = pipeStages(run.slice(a, b));
+    if (/^\s*!\s/.test(stages[0] ?? "")) continue; // `! ... | grep -qx x` asserts the line is absent
+    for (let k = 0; k < stages.length; k++) {
+      const words: string[] = stages[k]!.trim().match(/"(?:[^"\\]|\\.)*"|'[^']*'|\S+/g) ?? [];
+      if (!/^[ef]?grep$/.test(words[0] ?? "")) continue;
+      const args = words.slice(1);
+      const flags = args.filter((w) => w.startsWith("-"));
+      if (hasFlag(flags, "vcLlo") || flags.some((f) => /^--(?:invert|count|files)/.test(f))) continue;
+      const e = args.indexOf("-e");
+      const pat = e >= 0 ? args[e + 1] : args.find((w) => !w.startsWith("-"));
+      if (!pat) continue;
+      let body = pat.replace(/^(["'])(.*)\1$/s, "$2");
+      if (/\$[\w{(]/.test(body)) continue;
+      const fixed = hasFlag(flags, "F");
+      const whole = hasFlag(flags, "x");
+      if (!whole) {
+        if (fixed || !/^\^.+\$$/s.test(body)) continue;
+        body = body.slice(1, -1);
+      }
+      if (!fixed && /(?<!\\)[*+?[\]{}()|^$]/.test(body)) continue;
+      if ((body.match(/\w/g) ?? []).length < 1) continue;
+      if (stages.slice(0, k).some((s) => COUNTING_STAGE.test(s.trim()))) continue;
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Rule 5: a specific expected value found in what a program printed on literal
+ * input: `python3 nextrun.py '0 9 * * *' '2023-01-01 08:00' 1 | grep -q
+ * '2023-01-01 09:00'`. Containment, not equality, but of one worked-out value
+ * with a digit in it, not a pattern: output that skips or shifts occurrences
+ * does not contain it. Not over a file (`head -1 clean.csv | grep -q
+ * 'id,name'` passed with wrong rows below a right header), never inverted or
+ * counted, and never a wildcard pattern (`^[0-9]{4}-...$` is a format).
+ */
+function containsValue(run: string): boolean {
+  for (const [a, b] of shellSegments(run)) {
+    const stages = pipeStages(run.slice(a, b));
+    if (stages.length < 2 || /^\s*!\s/.test(stages[0] ?? "")) continue;
+    const words: string[] = stages[stages.length - 1]!.trim().match(/"(?:[^"\\]|\\.)*"|'[^']*'|\S+/g) ?? [];
+    if (!/^[f]?grep$/.test(words[0] ?? "")) continue;
+    const args = words.slice(1);
+    const flags = args.filter((w) => w.startsWith("-"));
+    if (hasFlag(flags, "vcLloEiw") || flags.some((f) => f.startsWith("--"))) continue;
+    const e = args.indexOf("-e");
+    const pat = e >= 0 ? args[e + 1] : args.find((w) => !w.startsWith("-"));
+    if (!pat || args.filter((w) => !w.startsWith("-")).length > 1) continue; // a file operand: not the pipe's output
+    const body = pat.replace(/^(["'])(.*)\1$/s, "$2");
+    if (/\$[\w{(]/.test(body) || /(?<!\\)[*+?[\]{}()|^$\\]/.test(body) || body.length < 4 || !/\d/.test(body)) continue;
+    const upstream = stages.slice(0, -1);
+    if (upstream.some((x) => COUNTING_STAGE.test(x.trim()))) continue;
+    if (!RUNNER.test(stageProgram(upstream[0]!))) continue;
+    // The program is handed literal input: an argument or a redirect, not just run bare.
+    if (!/\s(?:'[^']*'|"[^"$]*"|-?\d[\w.:-]*|<\s*\S+)/.test(upstream[0]!.replace(/^\s*\S+/, ""))) continue;
+    return true;
+  }
+  return false;
+}
+
+/** Rule 4: `assert f('<literal>') is None`. */
+function exactNone(run: string, names: ReadonlySet<string>): boolean {
+  for (const m of run.matchAll(/\s+is\s+None\b/g)) {
+    const at = m.index ?? 0;
+    const l = leftOperand(run, at + 1);
+    if (!asserted(run, at) || PROPERTY_SIDE.test(l.text) || quantified(run, at)) continue;
+    if (PATTERN_DELIVERABLE.test(run)) continue;
+    if (callsIn(l.text).some((k) => deliverableCall(k, names))) return true;
+  }
+  return false;
+}
+
+/** The tags a drafted check carries: surface from the critic, value and exact from the command. */
 export function evidenceTags(run: string, surface: boolean | undefined): string[] {
-  return ["task", ...(surface ? ["surface"] : []), ...(assertsValue(run) ? ["value"] : [])];
+  const value = assertsValue(run);
+  return ["task", ...(surface ? ["surface"] : []), ...(value ? ["value"] : []), ...(value && assertsExact(run) ? ["exact"] : [])];
 }
 
 /**
@@ -611,7 +1094,7 @@ export type TierVerdict = {
   tier: Tier;
   reason?: string;
   /** The strongest class among the passing checks. */
-  evidence: "person" | "runs+value" | "runs" | "surface" | "none";
+  evidence: "person" | "runs+exact" | "runs+value" | "runs" | "surface" | "none";
   /** Advisory review mode only: what the review said, recorded on the receipt instead of gating. */
   reviewNote?: string;
   /**
@@ -753,6 +1236,14 @@ export function auditClaim(judge: string): string {
 }
 export const AUDIT_CLAIM_PREFIX = "verified (post-work audit: ";
 
+/**
+ * The reason a run whose passing independent checks only test properties of
+ * the output (a count, an order, a format, membership, a type, two runs of the
+ * work agreeing) gets "passed-checks": wrong output with the right shape passes
+ * them all. See assertsExact.
+ */
+export const PROPERTY_ONLY_REASON = "passed checks that test properties only";
+
 /** The claim for the "passed-untested" tier, on every surface. */
 export const UNTESTED_CLAIM = "passed checks that did not test this work, not verified";
 
@@ -763,8 +1254,8 @@ export const UNTESTED_CLAIM = "passed checks that did not test this work, not ve
 export function untestedWords(names: readonly string[], passedBefore: ReadonlySet<string> | undefined): string {
   const why = (n: string) => `\`${n}\` ${passedBefore?.has(n) ? "passed before the work began too" : "was not tried before the work began"}`;
   return names.length === 1
-    ? `the only independent check that ran the work and asserted a value did not fail before the work: ${why(names[0]!)}`
-    : `no independent check that ran the work and asserted a value failed before the work: ${names.map(why).join("; ")}`;
+    ? `the only independent check that ran the work and asserted an exact value did not fail before the work: ${why(names[0]!)}`
+    : `no independent check that ran the work and asserted an exact value failed before the work: ${names.map(why).join("; ")}`;
 }
 
 /** The parts of a job_end event the verdict words are made from. */
@@ -917,16 +1408,21 @@ export function tierOf(args: {
   const strongAll = drafted.filter((r) => !r.tags?.includes("surface") && r.tags?.includes("value"));
   const strongIndependent = strongAll.filter((r) => independentOf(authorOf(r), workerNames));
   const strong = strongAll.length > 0;
+  // Of those, the ones that compare the output with an exact expected value. A property
+  // (a count, an order, a format, two runs agreeing) holds of wrong output too.
+  const exactIndependent = strongIndependent.filter((r) => r.tags?.includes("exact"));
   // Of those, the ones that failed on the tree before the work and pass now:
   // the only passes that show THIS work did something.
   const gate = args.requireDiscriminating === true || args.reviewAdvisory === true;
-  const discriminating = gate ? strongIndependent.filter((r) => args.failedBefore?.has(r.name ?? "") === true) : strongIndependent;
+  const discriminating = gate ? exactIndependent.filter((r) => args.failedBefore?.has(r.name ?? "") === true) : exactIndependent;
   const by = [...new Set(strongIndependent.map((r) => authorOf(r).model ?? "another model"))];
   const basis: TierVerdict["basis"] = person ? "person" : strongIndependent.length ? "independent" : strong ? "own" : undefined;
   const who = { ...(basis ? { basis } : {}), ...(by.length && !person ? { by } : {}), ...(worker ? { worker } : {}) };
   const evidence: TierVerdict["evidence"] = person
     ? "person"
-    : strong
+    : strongAll.some((r) => r.tags?.includes("exact"))
+      ? "runs+exact"
+      : strong
       ? "runs+value"
       : drafted.some((r) => !r.tags?.includes("surface"))
         ? "runs"
@@ -935,13 +1431,14 @@ export function tierOf(args: {
           : "none";
   const ownReason = `every passing check that ran the work and asserted a value was written by the worker model${worker ? ` (${worker})` : ""}`;
   const earned = person || discriminating.length > 0;
-  const untestedReason = untestedWords(strongIndependent.map((r) => r.name ?? ""), args.guards);
+  const untestedReason = untestedWords(exactIndependent.map((r) => r.name ?? ""), args.guards);
   if (args.reviewAdvisory) {
     const n = contradictions(args.review);
     const reviewNote = n > 0 ? `advisory: the independent review found ${args.review!.votes} contradicting the task` : args.unreviewed ? "advisory: the independent review did not run" : undefined;
     const gap: Pick<TierVerdict, "reviewGap"> = n > 0 ? { reviewGap: "unconfirmed" } : args.unreviewed ? { reviewGap: "unreviewed" } : {};
     if (earned) return { tier: "verified", evidence, ...who, ...(reviewNote ? { reviewNote } : {}), ...gap };
-    if (strongIndependent.length) return { tier: "passed-untested", evidence, ...who, reason: untestedReason, ...(reviewNote ? { reviewNote } : {}), ...gap };
+    if (exactIndependent.length) return { tier: "passed-untested", evidence, ...who, reason: untestedReason, ...(reviewNote ? { reviewNote } : {}), ...gap };
+    if (strongIndependent.length) return { tier: "passed-checks", evidence, ...who, reason: PROPERTY_ONLY_REASON, ...(reviewNote ? { reviewNote } : {}) };
     if (strong) return { tier: "passed-own-checks", evidence, ...who, reason: ownReason, ...(reviewNote ? { reviewNote } : {}), ...gap };
     return {
       tier: "passed-checks",
@@ -959,7 +1456,8 @@ export function tierOf(args: {
   }
   if (args.unreviewed && !person) return { tier: "passed-checks", evidence, ...who, reason: "the independent review did not run" };
   if (earned) return { tier: "verified", evidence, ...who };
-  if (strongIndependent.length) return { tier: "passed-untested", evidence, ...who, reason: untestedReason };
+  if (exactIndependent.length) return { tier: "passed-untested", evidence, ...who, reason: untestedReason };
+  if (strongIndependent.length) return { tier: "passed-checks", evidence, ...who, reason: PROPERTY_ONLY_REASON };
   if (strong) return { tier: "passed-own-checks", evidence, ...who, reason: ownReason };
   return {
     tier: "passed-checks",
diff --git a/test/acp-seal-gate.test.ts b/test/acp-seal-gate.test.ts
index 00dad72..19e846e 100644
--- a/test/acp-seal-gate.test.ts
+++ b/test/acp-seal-gate.test.ts
@@ -20,7 +20,7 @@ import { allowAll, drain, workspace } from "./helpers.js";
 
 const GROK = ACP_AGENTS.find((a) => a.name === "grok-build")!;
 
-const mk = (name: string, run: string): Check => ({ name, kind: "command", run, timeoutMs: 5_000, expectExit: 0, tags: ["task", "value"], hidden: true });
+const mk = (name: string, run: string): Check => ({ name, kind: "command", run, timeoutMs: 5_000, expectExit: 0, tags: ["task", "value", "exact"], hidden: true });
 
 describe("seal gate on a subprocess backend", () => {
   it("holds the first write until the checks are sealed, but lets reads through", async () => {
diff --git a/test/ask.test.ts b/test/ask.test.ts
index a62de46..14b1d08 100644
--- a/test/ask.test.ts
+++ b/test/ask.test.ts
@@ -61,11 +61,20 @@ describe("askModel", () => {
     assert.deepEqual(p.ceilings, [100, 400]);
   });
 
-  it("does not retry a reply that was cut off mid-answer: that one is the caller's to report", async () => {
-    const p = replying([{ content: '{"a":', finish: "length" }]);
+  it("asks once more, with room, when a reply was cut off mid-answer", async () => {
+    // A draft of exact, edge-case checks outgrew the ceiling: half a JSON reply proposes nothing.
+    const p = replying([{ content: '{"a":', finish: "length" }, { content: '{"a":1}' }]);
     const r = await ask(p.fetchFn);
-    assert.deepEqual(r, { ok: true, text: '{"a":', cutOff: true });
-    assert.equal(p.ceilings.length, 1);
+    assert.deepEqual(r, { ok: true, text: '{"a":1}', cutOff: false });
+    assert.equal(p.ceilings.length, 2);
+    assert.ok(p.ceilings[1]! > p.ceilings[0]!);
+  });
+
+  it("reports the second cut-off when the bigger ceiling is cut off too", async () => {
+    const p = replying([{ content: '{"a":', finish: "length" }, { content: '{"a":[1,', finish: "length" }]);
+    const r = await ask(p.fetchFn);
+    assert.deepEqual(r, { ok: true, text: '{"a":[1,', cutOff: true });
+    assert.equal(p.ceilings.length, 2);
   });
 
   it("reports an HTTP failure with what was being asked, and marks a rate limit worth asking again", async () => {
diff --git a/test/discriminating-checks.test.ts b/test/discriminating-checks.test.ts
index e9fd47b..6b3efd8 100644
--- a/test/discriminating-checks.test.ts
+++ b/test/discriminating-checks.test.ts
@@ -29,7 +29,7 @@ import type { Check, CheckAuthor } from "../src/types.js";
 import { allowAll, drain, scriptedProvider, workspace, type ScriptedTurn } from "./helpers.js";
 
 const JUDGE: CheckAuthor = { kind: "judge", model: "qwen3-coder-30b-a3b" };
-const value = (name: string) => ({ name, ok: true, hidden: true as const, tags: ["task", "value"] });
+const value = (name: string) => ({ name, ok: true, hidden: true as const, tags: ["task", "value", "exact"] });
 
 describe("tierOf: a check that did not fail before the work cannot earn verified", () => {
   const names = ["task:server-starts-and-listens", "task:get-all-items", "task:post-new-item"];
@@ -102,7 +102,7 @@ describe("the rule in a turn", () => {
     { text: "Done." },
   ];
   const check = (name: string, run: string): Check =>
-    ({ name, kind: "command", run, timeoutMs: 5_000, expectExit: 0, tags: ["task", "value"], hidden: true, author: JUDGE }) as Check;
+    ({ name, kind: "command", run, timeoutMs: 5_000, expectExit: 0, tags: ["task", "value", "exact"], hidden: true, author: JUDGE }) as Check;
 
   async function turn(checks: Check[], notes: string[] = [], requireDiscriminating = true) {
     const ws = workspace();
@@ -191,7 +191,7 @@ describe("parseArgs --require-discriminating", () => {
 describe("late checks and the copy taken before the work", () => {
   const later = <T>(v: T, ms: number) => new Promise<T>((r) => setTimeout(() => r(v), ms));
   const nothing = async () => ({ taskChecks: [] as Check[], taskNotes: [] as string[] });
-  const mk = (name: string, run: string): Check => ({ name, kind: "command", run, timeoutMs: 5_000, expectExit: 0, tags: ["task", "value"], hidden: true, author: JUDGE }) as Check;
+  const mk = (name: string, run: string): Check => ({ name, kind: "command", run, timeoutMs: 5_000, expectExit: 0, tags: ["task", "value", "exact"], hidden: true, author: JUDGE }) as Check;
 
   const TASK = "Write out.txt containing exactly the word hello.";
   async function lateTurn(dir: string, calls: { name: string; args: Record<string, unknown> }[], checks: Check[]) {
diff --git a/test/ended-with-verdict.test.ts b/test/ended-with-verdict.test.ts
index e2113aa..7c03de1 100644
--- a/test/ended-with-verdict.test.ts
+++ b/test/ended-with-verdict.test.ts
@@ -14,7 +14,7 @@ import type { Check } from "../src/types.js";
 import { allowAll, drain, scriptedProvider, workspace } from "./helpers.js";
 
 const greet = (hidden = true): Check => ({
-  name: "greeting", kind: "command", run: "grep -qx hello out.txt", timeoutMs: 5_000, expectExit: 0, tags: ["task", "value"], hidden,
+  name: "greeting", kind: "command", run: "grep -qx hello out.txt", timeoutMs: 5_000, expectExit: 0, tags: ["task", "value", "exact"], hidden,
   // Drafted by a separate judge model, not the worker "m".
   author: { kind: "judge", model: "judge-j" },
 });
diff --git a/test/exact-values.test.ts b/test/exact-values.test.ts
new file mode 100644
index 0000000..eb0068c
--- /dev/null
+++ b/test/exact-values.test.ts
@@ -0,0 +1,199 @@
+/**
+ * "Verified" needs a passing independent check that compares the work's
+ * output with an EXACT expected value (src/tiers.ts assertsExact).
+ *
+ * On the 2026-10-07 mmhd lane (MiniMax M3 worker, Haiku 5.5 judge) cron-next
+ * was labelled verified on four judge checks that all tested properties: 8
+ * lines, each minute a multiple of 15, sorted, unique; "every date is the 13th
+ * or a Friday"; two runs agree; "starts with 2024-06-1". The grader asked for
+ * `*\/15 * * * *` from 2025-01-01 00:07 and got 00:45, 01:00, 01:45 instead of
+ * 00:15, 00:30, 00:45: wrong output with the right shape passes all four.
+ */
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { CRITERIA_MAX_EXPECT, CRITIC_SYSTEM, DRAFT_SYSTEM, criticPrompt, sanitizeCriteria, taskChecksFrom } from "../src/criteria.js";
+import { AUDIT_SYSTEM, auditGates, parseAuditChecks } from "../src/post-audit.js";
+import { assertsExact, assertsValue, passedChecksWords, PROPERTY_ONLY_REASON, tierOf } from "../src/tiers.js";
+import type { CheckAuthor } from "../src/types.js";
+
+/** The four judge checks the mmhd cron-next run passed, verbatim from its receipt. */
+const CRON_NEXT = [
+  `cd "$PWD" && a=$(python3 nextrun.py '0 12 * * 7' '2024-01-01 00:00' 5) && b=$(python3 nextrun.py '0 12 * * 0' '2024-01-01 00:00' 5) && [ -n "$a" ] && [ "$a" = "$b" ] && echo "$a" | wc -l | grep -qx ' *5'`,
+  `cd "$PWD" && python3 nextrun.py '0 0 13 * 5' '2024-01-01 00:00' 6 | python3 -c "import sys,datetime as d; ls=sys.stdin.read().splitlines(); assert len(ls)==6; ds=[d.datetime.strptime(l,'%Y-%m-%d %H:%M') for l in ls]; assert all(x.day==13 or x.weekday()==4 for x in ds); assert all(a<b for a,b in zip(ds,ds[1:])); assert ds[0]>d.datetime(2024,1,1)"`,
+  `cd "$PWD" && python3 nextrun.py '30 14 * * *' '2024-06-15 14:30' 1 | python3 -c "import sys; l=sys.stdin.read().splitlines(); assert len(l)==1 and l[0]!='2024-06-15 14:30' and l[0].startswith('2024-06-1') and l[0].endswith(' 14:30')"`,
+  `python3 -c "import subprocess;o=subprocess.run(['python3','nextrun.py','*/15 * * * *','2024-01-01 00:00','8'],capture_output=True,text=True);L=o.stdout.split('\\n')[:-1];assert o.returncode==0 and len(L)==8;assert all(int(l[-2:])%15==0 for l in L);assert L==sorted(set(L))"`,
+];
+
+const EXACT = [
+  // the cron-next requirement, checked exactly
+  `python3 nextrun.py '*/15 * * * *' '2025-01-01 00:07' 3 | diff - <(printf '2025-01-01 00:15\\n2025-01-01 00:30\\n2025-01-01 00:45\\n')`,
+  `python3 nextrun.py '*/15 * * * *' '2025-01-01 00:07' 3 | diff - <<'EOF'\n2025-01-01 00:15\n2025-01-01 00:30\n2025-01-01 00:45\nEOF`,
+  `python3 nextrun.py '*/15 * * * *' '2025-01-01 00:07' 1 | grep -qx '2025-01-01 00:15'`,
+  `python3 -c "import subprocess;o=subprocess.run(['python3','nextrun.py','*/15 * * * *','2025-01-01 00:07','3'],capture_output=True,text=True);assert o.stdout.split()[1::2]==['00:15','00:30','00:45'], o.stdout"`,
+  `[ "$(python3 nextrun.py '0 9 * * *' '2023-01-01 08:00' 1)" = "2023-01-01 09:00" ]`,
+  // a specific worked-out value found in what the program printed on literal input
+  `python3 nextrun.py '0 9 * * *' '2023-01-01 08:00' 1 | grep -q '2023-01-01 09:00'`,
+  // equality with a literal, in each language and helper
+  `python3 -c "import slug; assert slug.slugify('Hello World') == 'hello-world'"`,
+  `python3 -c "import sys, tool; sys.exit(0 if tool.f('a')==['a'] else 1)"`,
+  `node -e "const a=require('assert'); a.strictEqual(require('./t').f(2), 4)"`,
+  `node -e 'const g=require("./x")("a");if(g!=="b")throw new Error(g)'`,
+  `curl -s localhost:8080/items/9 | jq -e '.error=="not found"'`,
+  `python3 -c "import json; d=json.load(open('out.json')); assert d['total'] == 12, d"`,
+  // both sides of a rule, from a literal table of cases (1.2.3.4.5 just outside the IP rule)
+  `python3 -c "import ipcheck as m\ncases=[('1.2.3.4', True), ('1.2.3.4.5', False)]\nfor s, want in cases:\n    assert m.valid(s) == want, s"`,
+  `python3 -c "import p; assert p.parse('bad') is None"`,
+  // a specific error status the task names
+  `d=$(mktemp -d); touch "$d/a.log"; out=$(./rotate.sh -n 0 "$d" 2>/dev/null); rc=$?; [ $rc -eq 2 ] && [ -z "$out" ]`,
+  // inside bash -c
+  `bash -c 'git rev-parse --abbrev-ref HEAD | grep -qx master'`,
+  // an oracle: the expected value built from the task's input file, running nothing
+  `python3 -c 'import json\nrows=json.load(open("in.json"))\nexp=[r["name"].upper() for r in rows]\nassert open("out.txt").read().splitlines()==exp'`,
+];
+
+const PROPERTY = [
+  ...CRON_NEXT,
+  // counts and sizes
+  `[ $(wc -l < out.txt) -eq 365 ]`,
+  `[ "$(grep -c '^ERROR' report.txt)" -eq 3 ]`,
+  `test -f report.txt && wc -l < report.txt | grep -q '^10$'`,
+  // a format, not a value
+  `python3 wc.py /etc/passwd | grep -q '^[0-9]\\+ [0-9]\\+ [0-9]\\+ /etc/passwd$'`,
+  // membership in a file, a prefix
+  `head -n 1 clean.csv | grep -q 'id,name,email,age,city'`,
+  `python3 -c "import t; assert t.f('x').startswith('ab')"`,
+  // the same constant across every item
+  `find configs/ -name '*.json' -exec sh -c 'jq -e ".version == 2" {} 2>/dev/null || exit 1' \\;`,
+  `python3 -c "import json,glob,sys; sys.exit(any(json.load(open(f)).get('version')==1 for f in glob.glob('configs/*.json')))"`,
+  // a check that cannot fail
+  `python3 server.py 8081 & sleep 1; curl -s http://127.0.0.1:8081/items | jq -e '.[0].id == 1' || echo 'fail'`,
+  `python3 -c "import pricing; print(pricing.price('item1', 2, 'SAVE10') == 18.0)"`,
+  // exit statuses that only say it ran, or that are read only on the failing path
+  `node summarize.js nonexistent.json 2>/dev/null || test $? -eq 1`,
+  `python3 vsort.py < versions.txt; test $? -eq 0`,
+  // an absent line
+  `out=$(python3 nextrun.py '*/15 * * * *' '2024-01-01 00:00' 4); ! echo "$out" | grep -qx '2024-01-01 00:00'`,
+  // two literals, nothing from the work
+  `[ "$(echo 7)" = "7" ]`,
+];
+
+describe("the exact tag", () => {
+  for (const c of EXACT) it(`exact: ${c.split("\n")[0]!.slice(0, 110)}`, () => assert.equal(assertsExact(c), true, c));
+  for (const c of PROPERTY) it(`property: ${c.split("\n")[0]!.slice(0, 110)}`, () => assert.equal(assertsExact(c), false, c));
+
+  it("the cron-next checks still assert a value; none is exact", () => {
+    for (const c of CRON_NEXT) assert.equal(assertsValue(c), true, c);
+    const sealed = taskChecksFrom({ checks: CRON_NEXT.map((run, i) => ({ name: `c${i}`, run })), notes: [] }, { hidden: true });
+    for (const t of sealed.taskChecks) assert.deepEqual(t.tags, ["task", "value"]);
+  });
+
+  it("is only ever tagged beside value", () => {
+    const sealed = taskChecksFrom({ checks: [{ name: "e", run: EXACT[2]! }], notes: [] }, { hidden: true });
+    assert.deepEqual(sealed.taskChecks[0]!.tags, ["task", "value", "exact"]);
+  });
+});
+
+describe("tierOf: property checks do not earn verified", () => {
+  const JUDGE: CheckAuthor = { kind: "judge", model: "claude-haiku-5-5" };
+  const worker = "minimax-m3";
+  const sealed = (runs: string[]) =>
+    taskChecksFrom({ checks: runs.map((run, i) => ({ name: `task:c${i}`, run })), notes: [] }, { hidden: true, author: JUDGE }).taskChecks;
+  const tier = (runs: string[], extra: Partial<Parameters<typeof tierOf>[0]> = {}) => {
+    const checks = sealed(runs);
+    return tierOf({
+      results: checks.map((c) => ({ name: c.name, ok: true, hidden: true, kind: "command" as const, tags: c.tags })),
+      worker,
+      authors: new Map(checks.map((c) => [c.name, JUDGE])),
+      failedBefore: new Set(checks.map((c) => c.name)),
+      ...extra,
+    });
+  };
+
+  it("the mmhd cron-next run: four passing independent property checks, not verified", () => {
+    const t = tier(CRON_NEXT);
+    assert.equal(t.tier, "passed-checks");
+    assert.equal(t.reason, PROPERTY_ONLY_REASON);
+    assert.equal(t.reason, "passed checks that test properties only");
+    assert.equal(t.evidence, "runs+value");
+    assert.equal(passedChecksWords(t.reason), "passed its checks (not verified: passed checks that test properties only)");
+  });
+
+  it("the same, with discrimination required and in review-advisory mode", () => {
+    assert.equal(tier(CRON_NEXT, { requireDiscriminating: true }).reason, PROPERTY_ONLY_REASON);
+    assert.equal(tier(CRON_NEXT, { reviewAdvisory: true }).reason, PROPERTY_ONLY_REASON);
+  });
+
+  it("one exact check beside them earns the word", () => {
+    const t = tier([...CRON_NEXT.slice(0, 3), EXACT[0]!]);
+    assert.deepEqual([t.tier, t.evidence, t.basis], ["verified", "runs+exact", "independent"]);
+  });
+
+  it("an exact check that did not fail before the work is passed-untested under the gate, not property-only", () => {
+    const checks = sealed([EXACT[0]!]);
+    const t = tierOf({
+      requireDiscriminating: true,
+      results: checks.map((c) => ({ name: c.name, ok: true, hidden: true, kind: "command" as const, tags: c.tags })),
+      worker,
+      authors: new Map(checks.map((c) => [c.name, JUDGE])),
+      failedBefore: new Set(),
+    });
+    assert.equal(t.tier, "passed-untested");
+  });
+
+  it("the worker's own exact check is still its own", () => {
+    const checks = sealed([EXACT[0]!]);
+    const t = tierOf({ results: checks.map((c) => ({ name: c.name, ok: true, hidden: true, kind: "command" as const, tags: c.tags })), worker, authors: new Map([[checks[0]!.name, { kind: "worker", model: worker } as CheckAuthor]]) });
+    assert.equal(t.tier, "passed-own-checks");
+  });
+});
+
+describe("the post-work audit drops property checks", () => {
+  // The V gates run before anything touches a tree.
+  const ctx = { workDir: "/nonexistent-work", preWorkDir: "/nonexistent-pre", mutants: [] };
+  it("V-property-only, after V-no-value", async () => {
+    for (const run of CRON_NEXT) {
+      const g = await auditGates({ name: "p", run, quote: "the next N run times" }, ctx);
+      assert.equal(g.rule, "V-property-only", run);
+    }
+  });
+});
+
+describe("the drafting prompts ask for exact expected outputs", () => {
+  it("the drafter: an exact check per requirement, its source in expect, edge and near-miss inputs", () => {
+    assert.match(DRAFT_SYSTEM, /For each thing the task says the work must do, at least one check/);
+    assert.match(DRAFT_SYSTEM, /EXACT expected output/);
+    assert.match(DRAFT_SYSTEM, /"expect":"where the expected output comes from"/);
+    assert.match(DRAFT_SYSTEM, /the task words quoted, or the derivation/);
+    assert.match(DRAFT_SYSTEM, /1\.2\.3\.4\.5 for an IP rule/);
+    assert.match(DRAFT_SYSTEM, /empty input/);
+    assert.match(DRAFT_SYSTEM, /each side of an either\/or rule/);
+    assert.match(DRAFT_SYSTEM, /never instead of one/);
+    assert.doesNotMatch(DRAFT_SYSTEM, /Never write an expected value you worked out yourself/, "the old rule pushed drafters to property checks");
+  });
+
+  it("the critic sees where each expected value comes from, and is told a derivation is not a guess", () => {
+    const p = criticPrompt("Print the next N cron times.", undefined, [
+      { name: "step", run: EXACT[0]!, expect: "*/15 from 00:07: 00:15, 00:30, 00:45" },
+      { name: "plain", run: "test -f nextrun.py" },
+    ]);
+    assert.match(p, /- step: .*\n {2}expect: \*\/15 from 00:07: 00:15, 00:30, 00:45\n- plain: test -f nextrun.py$/);
+    assert.match(CRITIC_SYSTEM, /derived step by step from a rule the task states/);
+  });
+
+  it("sanitizeCriteria keeps expect, trimmed and capped, and drops a non-string one", () => {
+    const d = sanitizeCriteria({ checks: [{ name: "a", run: "true", expect: `  ${"x".repeat(CRITERIA_MAX_EXPECT + 50)} ` }, { name: "b", run: "true", expect: 3 }], notes: [] });
+    assert.equal(d.checks[0]!.expect!.length, CRITERIA_MAX_EXPECT);
+    assert.equal("expect" in d.checks[1]!, false);
+  });
+
+  it("the post-work audit: exact comparisons, no count example, edge inputs, expect for a derivation", () => {
+    assert.match(AUDIT_SYSTEM, /the EXACT expected output/);
+    assert.match(AUDIT_SYSTEM, /such a\s+check is dropped/);
+    assert.match(AUDIT_SYSTEM, /1\.2\.3\.4\.5 for an IP rule/);
+    assert.match(AUDIT_SYSTEM, /each side of an either\/or rule/);
+    assert.doesNotMatch(AUDIT_SYSTEM, /grep -c/, "a count is not an example of an exact check");
+    const task = "For input.txt the total is 7.";
+    const p = parseAuditChecks(JSON.stringify({ checks: [{ name: "t", run: `[ "$(node sum.js input.txt)" = "7" ]`, quote: "the total is 7", expect: "stated" }] }), task)!;
+    assert.deepEqual(p.kept, [{ name: "t", run: `[ "$(node sum.js input.txt)" = "7" ]`, quote: "the total is 7", expect: "stated" }]);
+  });
+});
diff --git a/test/harness.test.ts b/test/harness.test.ts
index be9a3d5..a61bf98 100644
--- a/test/harness.test.ts
+++ b/test/harness.test.ts
@@ -487,7 +487,7 @@ describe("self-checked work", () => {
   it("is marked on job_end when every judging check was drafted by the model, and not otherwise", async () => {
     const ws = workspace();
     try {
-      const hidden = { name: "own", kind: "command" as const, run: "grep -qx x x.txt", timeoutMs: 5_000, expectExit: 0, tags: ["task", "value"], hidden: true, author: { kind: "judge" as const, model: "judge-j" } };
+      const hidden = { name: "own", kind: "command" as const, run: "grep -qx x x.txt", timeoutMs: 5_000, expectExit: 0, tags: ["task", "value", "exact"], hidden: true, author: { kind: "judge" as const, model: "judge-j" } };
       const shown = { ...hidden, name: "chosen", hidden: undefined, author: { kind: "person" as const } };
       const a = engineFor(ws.dir, [{ calls: [{ name: "write_file", args: { path: "x.txt", content: "x" } }] }, { text: "done" }]);
       const ea = await drain(a.engine.run("make x", allowAll, { taskChecks: [hidden] }));
diff --git a/test/hidden-checks-withheld.test.ts b/test/hidden-checks-withheld.test.ts
index 651062d..53669f9 100644
--- a/test/hidden-checks-withheld.test.ts
+++ b/test/hidden-checks-withheld.test.ts
@@ -32,7 +32,7 @@ const TASK = "Write out.txt containing the greeting the release notes ask for.";
 const SECRET_A = "grep -q 'zebra-quantum-42' out.txt";
 const SECRET_B = "test \"$(wc -l < out.txt)\" -ge 1 && grep -c 'zebra' out.txt";
 const checks = (hidden: boolean): Check[] => [
-  { name: "task:has-greeting", kind: "command", run: SECRET_A, timeoutMs: 5_000, expectExit: 0, tags: ["task", "value"], hidden, author: { kind: "judge", model: "judge-j" } },
+  { name: "task:has-greeting", kind: "command", run: SECRET_A, timeoutMs: 5_000, expectExit: 0, tags: ["task", "value", "exact"], hidden, author: { kind: "judge", model: "judge-j" } },
   { name: "task:non-empty", kind: "command", run: SECRET_B, timeoutMs: 5_000, expectExit: 0, tags: ["task"], hidden },
 ];
 
diff --git a/test/independent-checks.test.ts b/test/independent-checks.test.ts
index 070c702..c519a08 100644
--- a/test/independent-checks.test.ts
+++ b/test/independent-checks.test.ts
@@ -59,7 +59,7 @@ describe("independentOf", () => {
 });
 
 describe("tierOf: who wrote the checks", () => {
-  const value = (name: string) => ({ name, ok: true, hidden: true as const, kind: "command" as const, tags: ["task", "value"] });
+  const value = (name: string) => ({ name, ok: true, hidden: true as const, kind: "command" as const, tags: ["task", "value", "exact"] });
   const by = (a: CheckAuthor, name = "task:v") => new Map([[name, a]]);
   // Every check here failed before the work: the discrimination rule has its own tests.
   const failedBefore = new Set(["task:v", "task:own", "task:judged"]);
@@ -183,7 +183,7 @@ describe("authorship at the seal, in a turn", () => {
     { text: "Done." },
   ];
   const value = (extra: Partial<Check> = {}): Check =>
-    ({ name: "made", kind: "command", run: "grep -qx hello out.txt", timeoutMs: 5_000, expectExit: 0, tags: ["task", "value"], hidden: true, ...extra }) as Check;
+    ({ name: "made", kind: "command", run: "grep -qx hello out.txt", timeoutMs: 5_000, expectExit: 0, tags: ["task", "value", "exact"], hidden: true, ...extra }) as Check;
 
   async function run(checks: Check[], opts: { initBar?: boolean } = {}) {
     const ws = workspace();
@@ -259,7 +259,7 @@ describe("a golden file only stands for a value when it predates the work", () =
   const TASK = "Write out.txt with the line hello.";
   const diffCheck: Check = {
     name: "matches", kind: "command", run: "diff out.txt expected.txt", timeoutMs: 5_000, expectExit: 0,
-    tags: ["task", "value"], hidden: true, author: { kind: "judge", model: "judge-j" },
+    tags: ["task", "value", "exact"], hidden: true, author: { kind: "judge", model: "judge-j" },
   } as Check;
   async function turn(writes: Record<string, string>, before: Record<string, string> = {}) {
     const ws = workspace();
diff --git a/test/judgment.test.ts b/test/judgment.test.ts
index 3bc45b0..df145a2 100644
--- a/test/judgment.test.ts
+++ b/test/judgment.test.ts
@@ -20,7 +20,7 @@ const check = (name: string, run: string, hidden: boolean): Check => ({
   run,
   timeoutMs: 5_000,
   expectExit: 0,
-  tags: ["task", "value"],
+  tags: ["task", "value", "exact"],
   ...(hidden ? { hidden: true, author: { kind: "judge", model: "judge-j" } } : {}),
 });
 
diff --git a/test/late-criteria.test.ts b/test/late-criteria.test.ts
index d232181..81618f4 100644
--- a/test/late-criteria.test.ts
+++ b/test/late-criteria.test.ts
@@ -15,7 +15,7 @@ import type { Check } from "../src/types.js";
 import { allowAll, drain, scriptedProvider, workspace } from "./helpers.js";
 
 // Value-asserting checks (src/tiers.ts): a check that only looks cannot earn "verified".
-const mk = (name: string, run: string): Check => ({ name, kind: "command", run, timeoutMs: 5_000, expectExit: 0, tags: ["task", "value"], hidden: true, author: { kind: "judge", model: "judge-j" } });
+const mk = (name: string, run: string): Check => ({ name, kind: "command", run, timeoutMs: 5_000, expectExit: 0, tags: ["task", "value", "exact"], hidden: true, author: { kind: "judge", model: "judge-j" } });
 const later = <T>(v: T, ms: number) => new Promise<T>((r) => setTimeout(() => r(v), ms));
 const nothing = async () => ({ taskChecks: [] as Check[], taskNotes: [] as string[] });
 const TASK = "write hello to out.txt";
diff --git a/test/lazy-seal.test.ts b/test/lazy-seal.test.ts
index 75a0a16..28fa4f8 100644
--- a/test/lazy-seal.test.ts
+++ b/test/lazy-seal.test.ts
@@ -9,7 +9,7 @@ import { changesSomething, criteriaWaitMs, Engine } from "../src/engine.js";
 import type { Check, EngineEvent } from "../src/types.js";
 import { allowAll, drain, scriptedProvider, workspace } from "./helpers.js";
 
-const check: Check = { name: "made", kind: "command", run: "grep -qx y out.txt", timeoutMs: 5_000, expectExit: 0, tags: ["task", "value"], hidden: true, author: { kind: "judge", model: "judge-j" } };
+const check: Check = { name: "made", kind: "command", run: "grep -qx y out.txt", timeoutMs: 5_000, expectExit: 0, tags: ["task", "value", "exact"], hidden: true, author: { kind: "judge", model: "judge-j" } };
 const later = <T>(v: T, ms: number) => new Promise<T>((r) => setTimeout(() => r(v), ms));
 const sealedAt = (ev: EngineEvent[]) => ev.findIndex((e) => e.kind === "info" && /sealed for this turn/.test(e.text));
 const toolAt = (ev: EngineEvent[], name: string) => ev.findIndex((e) => e.kind === "tool" && e.name === name);
diff --git a/test/post-work-audit.test.ts b/test/post-work-audit.test.ts
index 03454e7..aa55bc2 100644
--- a/test/post-work-audit.test.ts
+++ b/test/post-work-audit.test.ts
@@ -139,7 +139,7 @@ describe("the gates", () => {
   it("a check that passes on every mutant is rejected", async () => {
     const mutants = await planAuditMutants([{ path: "sum.js", text: SUM_JS }]);
     const g = await auditGates(
-      { name: "exists", run: `test -f sum.js && [ "$(echo 7)" = "7" ]`, quote: "For input.txt the total is 7." },
+      { name: "exists", run: `[ "$(test -f sum.js && echo yes)" = "yes" ]`, quote: "For input.txt the total is 7." },
       { workDir: t.work, preWorkDir: t.pre, mutants },
     );
     assert.equal(g.accepted, false);
@@ -161,7 +161,8 @@ describe("the gates", () => {
   it("a check that passes before the work, cannot fail, writes, or asserts nothing is rejected before the mutants", async () => {
     const ctx = { workDir: t.work, preWorkDir: t.pre, mutants: [] };
     const q = "For input.txt the total is 7.";
-    assert.equal((await auditGates({ name: "a", run: `[ "$(cat input.txt | wc -l | tr -d ' ')" = "3" ]`, quote: q }, ctx)).rule, "P1-passes-before-work");
+    assert.equal((await auditGates({ name: "a", run: `[ "$(head -1 input.txt)" = "3" ]`, quote: q }, ctx)).rule, "P1-passes-before-work");
+    assert.equal((await auditGates({ name: "a2", run: `[ "$(cat input.txt | wc -l | tr -d ' ')" = "3" ]`, quote: q }, ctx)).rule, "V-property-only", "a count is a property");
     assert.equal((await auditGates({ name: "b", run: `[ "$(node sum.js input.txt)" = "7" ] || echo fail`, quote: q }, ctx)).rule, "L16-cannot-fail");
     assert.equal((await auditGates({ name: "c", run: `node sum.js input.txt > out.txt && grep -qx 7 out.txt`, quote: q }, ctx)).rule, "L15-mutates");
     assert.equal((await auditGates({ name: "d", run: `node sum.js input.txt`, quote: q }, ctx)).rule, "V-no-value");
@@ -175,7 +176,7 @@ describe("the audit in a turn", () => {
     { text: `Done. The total is 7 and the note says ${SECRET}.` },
   ];
   // The worker's own check: it passes, and earns "passed own checks", not "verified".
-  const own: Check = { name: "runs", kind: "command", run: `[ "$(node sum.js input.txt)" = "7" ]`, timeoutMs: 5_000, expectExit: 0, tags: ["task", "value"], hidden: true, author: { kind: "worker", model: "m" } } as Check;
+  const own: Check = { name: "runs", kind: "command", run: `[ "$(node sum.js input.txt)" = "7" ]`, timeoutMs: 5_000, expectExit: 0, tags: ["task", "value", "exact"], hidden: true, author: { kind: "worker", model: "m" } } as Check;
   const JUDGE_REPLY = JSON.stringify({
     checks: [
       { name: "total", run: `[ "$(node sum.js input.txt)" = "7" ]`, quote: "For input.txt the total is 7." },
diff --git a/test/prework-screen.test.ts b/test/prework-screen.test.ts
index 920d515..e9c72a4 100644
--- a/test/prework-screen.test.ts
+++ b/test/prework-screen.test.ts
@@ -197,7 +197,7 @@ describe("a check that prints a boolean, at the bar", () => {
   // work (no out.csv), so the pre-work try counted it as failing there; after
   // WRONG work it printed False and exited 0, and the run read "verified".
   const run = `python3 -c "import csv; print(list(csv.reader(open('out.csv'))) == [['a'],['b']])"`;
-  const check = { name: "rows", kind: "command", run, timeoutMs: 10_000, expectExit: 0, tags: ["task", "value"], hidden: true, author: { kind: "judge", model: "judge-j" } } as Check;
+  const check = { name: "rows", kind: "command", run, timeoutMs: 10_000, expectExit: 0, tags: ["task", "value", "exact"], hidden: true, author: { kind: "judge", model: "judge-j" } } as Check;
   async function turn(csv: string) {
     const ws = workspace();
     try {
diff --git a/test/reference.test.ts b/test/reference.test.ts
index 4892321..082a056 100644
--- a/test/reference.test.ts
+++ b/test/reference.test.ts
@@ -244,7 +244,7 @@ describe("a reference check, in a turn", () => {
 
   it("is retired, not obeyed, when its own code fails at the claim; the other checks judge", async () => {
     const raises = "    if __import__('os').path.exists('double.py'):\n        raise KeyError('oops')\n    return 'missing'";
-    const made: Check = { name: "made", kind: "command", run: "[ \"$(python3 double.py)\" = \"1\" ]", timeoutMs: 5_000, expectExit: 0, tags: ["task", "value"], hidden: true, author: { kind: "judge", model: "judge-j" } };
+    const made: Check = { name: "made", kind: "command", run: "[ \"$(python3 double.py)\" = \"1\" ]", timeoutMs: 5_000, expectExit: 0, tags: ["task", "value", "exact"], hidden: true, author: { kind: "judge", model: "judge-j" } };
     const { events, outcome } = await turn("print(1)\n", { first: fenced(moduleA("str(2 * n)", raises)), extra: [made] });
     assert.ok(events.some((e) => e.kind === "info" && /failed in its own code, not on the work/.test(e.text)));
     assert.equal(outcome, "verified", "judged by the check that remained");
diff --git a/test/reveal-default.test.ts b/test/reveal-default.test.ts
index a515a37..f3e0e58 100644
--- a/test/reveal-default.test.ts
+++ b/test/reveal-default.test.ts
@@ -21,7 +21,7 @@ const TASK_WITH_INPUT = "Read data.csv and write out.txt containing a greeting.
 
 const hiddenChecks: Check[] = [
   { name: "made", kind: "command", run: "test -f out.txt", timeoutMs: 5_000, expectExit: 0, tags: ["task"], hidden: true, author: { kind: "judge", model: "judge-j" } },
-  { name: "too-strict", kind: "command", run: "grep -q 366 out.txt", timeoutMs: 5_000, expectExit: 0, tags: ["task", "value"], hidden: true, author: { kind: "judge", model: "judge-j" } },
+  { name: "too-strict", kind: "command", run: "grep -q 366 out.txt", timeoutMs: 5_000, expectExit: 0, tags: ["task", "value", "exact"], hidden: true, author: { kind: "judge", model: "judge-j" } },
 ];
 const personChecks: Check[] = hiddenChecks.map((c) => ({ ...c, hidden: false }));
 
diff --git a/test/review-advisory.test.ts b/test/review-advisory.test.ts
index b22b88f..206bf6f 100644
--- a/test/review-advisory.test.ts
+++ b/test/review-advisory.test.ts
@@ -12,7 +12,7 @@ import { tierOf } from "../src/tiers.js";
 
 describe("tierOf, review advisory", () => {
   const ck = (name: string, tags: string[]) => ({ name, ok: true, hidden: true as const, tags });
-  const strong = ck("task:counts", ["task", "value"]);
+  const strong = ck("task:counts", ["task", "value", "exact"]);
   // Drafted by a separate judge; tierOf's authorship rule has its own tests (independent-checks.test.ts).
   const J = {
     worker: "worker-m",
@@ -37,7 +37,7 @@ describe("tierOf, review advisory", () => {
     const r = tierOf({ ...J, results: [strong], guards, failedBefore, reviewAdvisory: true });
     assert.equal(r.tier, "passed-untested");
     assert.match(r.reason!, /`task:counts` passed before the work began too/);
-    const two = tierOf({ ...J, results: [strong, ck("task:other", ["task", "value"])], guards, failedBefore, reviewAdvisory: true });
+    const two = tierOf({ ...J, results: [strong, ck("task:other", ["task", "value", "exact"])], guards, failedBefore, reviewAdvisory: true });
     assert.equal(two.tier, "verified", "another value check that failed on the pristine tree carries it");
   });
 
diff --git a/test/sharper-checks.test.ts b/test/sharper-checks.test.ts
index 4840297..5daff3a 100644
--- a/test/sharper-checks.test.ts
+++ b/test/sharper-checks.test.ts
@@ -67,7 +67,7 @@ describe("a disputed check, in a turn", () => {
   // An arbiter other than the worker: a same-model arbiter is skipped.
   const ARBITER = { model: "arbiter" };
   const checks: Check[] = [
-    { name: "made", kind: "command", run: "head -c 5 out.txt | grep -qx hello", timeoutMs: 5_000, expectExit: 0, tags: ["task", "value"], hidden: true, author: { kind: "judge", model: "judge-j" } },
+    { name: "made", kind: "command", run: "head -c 5 out.txt | grep -qx hello", timeoutMs: 5_000, expectExit: 0, tags: ["task", "value", "exact"], hidden: true, author: { kind: "judge", model: "judge-j" } },
     { name: "too-strict", kind: "command", run: "grep -q 366 out.txt", timeoutMs: 5_000, expectExit: 0, tags: ["task"], hidden: true, author: { kind: "judge", model: "judge-j" } },
   ];
 
@@ -601,7 +601,7 @@ describe("a drafted check that fails in its own code", () => {
     const ws = workspace();
     try {
       const checks: Check[] = [
-        { name: "made", kind: "command", run: "head -c 5 out.txt | grep -qx hello", timeoutMs: 5_000, expectExit: 0, tags: ["task", "value"], hidden: true, author: { kind: "judge", model: "judge-j" } },
+        { name: "made", kind: "command", run: "head -c 5 out.txt | grep -qx hello", timeoutMs: 5_000, expectExit: 0, tags: ["task", "value", "exact"], hidden: true, author: { kind: "judge", model: "judge-j" } },
         // Fails on the missing file before the work, so preflight keeps it; its own bug shows only after.
         { name: "broken-after", kind: "command", run: "test -f out.txt && python3 -c \"print(f'x {1')\"", timeoutMs: 5_000, expectExit: 0, tags: ["task"], hidden: true },
       ];
diff --git a/test/tiers.test.ts b/test/tiers.test.ts
index cc14fd8..9e60de1 100644
--- a/test/tiers.test.ts
+++ b/test/tiers.test.ts
@@ -126,7 +126,7 @@ describe("the value tag", () => {
     assert.deepEqual(sealed.taskChecks.map((t) => t.tags), [
       ["task", "surface"],
       ["task", "surface", "value"],
-      ["task", "value"],
+      ["task", "value", "exact"],
       ["task"],
     ]);
   });
@@ -137,19 +137,19 @@ describe("tierOf", () => {
   // Drafted by a separate judge model: the authorship rule is pinned in independent-checks.test.ts.
   // ...and it failed on the tree before the work (the discrimination rule is pinned in discriminating-checks.test.ts).
   const J = { worker: "worker-m", authors: new Map([["c", { kind: "judge" as const, model: "judge-j" }]]), failedBefore: new Set(["c"]) };
-  it("needs a passing check that runs the work and asserts a value", () => {
-    assert.equal(tierOf({ ...J, results: [ok(["task", "value"])] }).tier, "verified");
-    assert.equal(tierOf({ ...J, results: [ok(["task"]), ok(["task", "value"])] }).tier, "verified");
+  it("needs a passing check that runs the work and asserts an exact value", () => {
+    assert.equal(tierOf({ ...J, results: [ok(["task", "value", "exact"])] }).tier, "verified");
+    assert.equal(tierOf({ ...J, results: [ok(["task"]), ok(["task", "value", "exact"])] }).tier, "verified");
     assert.equal(tierOf({ ...J, results: [ok(["task"])] }).tier, "passed-checks");
     assert.equal(tierOf({ ...J, results: [ok(["task", "surface", "value"])] }).tier, "passed-checks", "a check that only looks cannot carry it");
-    assert.equal(tierOf({ ...J, results: [{ ok: false, hidden: true, tags: ["task", "value"] }] }).tier, "passed-checks", "a failing check is no evidence");
+    assert.equal(tierOf({ ...J, results: [{ ok: false, hidden: true, tags: ["task", "value", "exact"] }] }).tier, "passed-checks", "a failing check is no evidence");
   });
   it("lets a person's passing check verify, and a contradiction undo any of it", () => {
     assert.equal(tierOf({ ...J, results: [{ ...ok([], false), name: "project" }] }).tier, "verified");
-    const r = tierOf({ ...J, results: [ok(["task", "value"])], review: { votes: "1/3", violations: [] } });
+    const r = tierOf({ ...J, results: [ok(["task", "value", "exact"])], review: { votes: "1/3", violations: [] } });
     assert.equal(r.tier, "passed-checks");
     assert.match(r.reason!, /1\/3/);
-    assert.equal(tierOf({ ...J, results: [ok(["task", "value"])], review: { votes: "0/3", violations: [] } }).tier, "verified");
+    assert.equal(tierOf({ ...J, results: [ok(["task", "value", "exact"])], review: { votes: "0/3", violations: [] } }).tier, "verified");
   });
   it("says it in one phrase", () => {
     assert.equal(passedChecksWords("no check asserted an expected value"), "passed its checks (not verified: no check asserted an expected value)");
@@ -166,7 +166,7 @@ describe("the tier in a turn", () => {
     }) as Check;
   const SURFACE = make(["task", "surface"], "test -f out.txt");
   const RUNS = make(["task"], "test -s out.txt");
-  const VALUE = make(["task", "value"], `grep -qx hello out.txt`);
+  const VALUE = make(["task", "value", "exact"], `grep -qx hello out.txt`);
   const work: ScriptedTurn[] = [
     { calls: [{ name: "write_file", args: { path: "out.txt", content: "hello\n" } }] },
     { text: "Done." },
@@ -212,7 +212,7 @@ describe("the tier in a turn", () => {
   it("a pass that ran the work and asserted a value is verified", async () => {
     const { end, rows } = await run(VALUE);
     assert.deepEqual([end.outcome, end.tier, end.tierReason], ["verified", "verified", undefined]);
-    assert.deepEqual([rows.at(-1).tier, rows.at(-1).evidence], ["verified", "runs+value"]);
+    assert.deepEqual([rows.at(-1).tier, rows.at(-1).evidence], ["verified", "runs+exact"]);
   });
 
   it("a reviewer contradiction takes the word back, and the index row says so", async () => {