diff --git a/rig/ctrl/deps.sh b/rig/ctrl/deps.sh
index c08cb44..95de60c 100755
--- a/rig/ctrl/deps.sh
+++ b/rig/ctrl/deps.sh
@@ -353,8 +353,8 @@ DEV_TOOLS="kind tilt ctlptl docker-compose"
 # A tool already on PATH at its pinned version is left where it is. Without
 # this, install downloads a second copy into OUT_BIN and then reports the first
 # one as shadowed — noise, and wrong, when both are the same version. That is
-# the normal state of any machine someone set up by hand: the AWS Workspace
-# keeps its toolchain in ~/wdir/bin, all five at exactly these pins.
+# the normal state of any machine someone set up by hand, whatever directory
+# they happened to choose.
 
 pin_of() {
     case "$1" in
diff --git a/rig/standalone/README.md b/rig/standalone/README.md
index 0f369dd..d24abe5 100644
--- a/rig/standalone/README.md
+++ b/rig/standalone/README.md
@@ -6,7 +6,7 @@ install first.
 
 | file | does | full-rig equivalent |
 | --- | --- | --- |
-| `rigdeps.sh` | installs kind, kubectl, tilt, ctlptl and jq at rig's pins, checksum-verified, no sudo | `make deps` (`ctrl/deps.sh`) |
+| `rigdeps.sh` | installs kind, kubectl, tilt, ctlptl, jq and docker compose at rig's pins, checksum-verified, no sudo | `make deps` (`ctrl/deps.sh`) |
 | `rigmini.sh` | reports how much memory the machine *advertises* and what caps it; `push` measures what it will actually *survive* | `make mem`, and the memory section of `make check` |
 
 **These are transitional.** Where the full rig is installed, use its own
@@ -26,6 +26,12 @@ it. `status` reads the caps; `push` allocates until something stops it.
 
 ## Use
 
+**These two files are the whole setup.** No folder to create, no PATH to edit by
+hand, nothing else to download first. The toolchain goes into `~/.local/bin`,
+which Ubuntu already puts on PATH at login once the directory exists — so a new
+shell after `install` is all it takes. If it is not on PATH, `install` says so
+and prints the one line to add.
+
 ```bash
 bash rigdeps.sh detect          # report, change nothing
 bash rigdeps.sh install dev     # install into ~/.local/bin
@@ -33,5 +39,17 @@ bash rigmini.sh status          # advertised memory and caps; safe
 bash rigmini.sh push            # allocates until it stops — not on a machine you need
 ```
 
+If an earlier setup already put these tools in some other directory on PATH,
+remove that directory and the line that added it — do not rely on `install` to
+notice. It only reports shadowing once `~/.local/bin` is itself on PATH, which on
+a fresh machine it is not until the next login. After a new shell, check which
+copy wins:
+
+```bash
+command -v kind kubectl tilt     # each should be ~/.local/bin/...
+```
+
+One toolchain, in the one place everyone else will also look.
+
 `rigmini.sh push` deliberately consumes memory. Run `status` first, and only run
 `push` somewhere it is acceptable for other processes to be squeezed.
diff --git a/rig/standalone/rigdeps.sh b/rig/standalone/rigdeps.sh
index 817d3c5..ee352c2 100755
--- a/rig/standalone/rigdeps.sh
+++ b/rig/standalone/rigdeps.sh
@@ -469,19 +469,25 @@ verify_tools() {
     for b in $(tier_tools "$tier"); do
         bin="$OUT_BIN/$b"
         if [ ! -x "$bin" ]; then
-            printf '  %-8s not installed\n' "$b"
+            printf '  %-14s not installed\n' "$b"
             continue
         fi
+        # Not piped into `head`. With `pipefail` set, a tool that prints more
+        # than one line gets SIGPIPE when head closes the pipe, and the
+        # pipeline reports 141 — so a working kubectl was announced as "does
+        # not run here", with its own correct version string as the evidence.
+        # Take the first line afterwards, from the string.
         rc=0
         case "$b" in
-            kubectl) out=$("$bin" version --client 2>&1 | head -1) || rc=$? ;;
-            jq)      out=$("$bin" --version 2>&1 | head -1) || rc=$? ;;
-            *)       out=$("$bin" version 2>&1 | head -1) || rc=$? ;;
+            kubectl) out=$("$bin" version --client 2>&1) || rc=$? ;;
+            jq)      out=$("$bin" --version 2>&1) || rc=$? ;;
+            *)       out=$("$bin" version 2>&1) || rc=$? ;;
         esac
+        out=${out%%$'\n'*}
         if [ "$rc" -eq 0 ]; then
-            printf '  %-8s %s\n' "$b" "$out"
+            printf '  %-14s %s\n' "$b" "$out"
         else
-            printf '  ! %-6s does not run here: %s\n' "$b" "$out"
+            printf '  ! %-12s does not run here: %s\n' "$b" "$out"
             broke=1
         fi
     done
@@ -502,7 +508,7 @@ verify_tools() {
 # unrelated work — kubectl more than one minor away from its cluster is the
 # common one. Say so; never decide it.
 warn_shadowing() {
-    local b existing shadowed="" tier="${1:-dev}"
+    local b existing shadowed="" paths="" tier="${1:-dev}"
     case ":${PATH}:" in
         *":$OUT_BIN:"*) ;;
         *) return 0 ;;   # not on PATH, so nothing is being shadowed yet
@@ -513,7 +519,10 @@ warn_shadowing() {
                    command -v "$b" 2>/dev/null || true)
         [ -n "$existing" ] || continue
         [ "$existing" = "$OUT_BIN/$b" ] && continue
-        shadowed+="      $b  $existing"$'\n'
+        shadowed+=$(printf '      %-14s %s' "$b" "$existing")$'\n'
+        # Only the shadowing copies are the user's to remove. Listing the whole
+        # tier would delete tools that shadow nothing and are the only copy.
+        paths+="$OUT_BIN/$b "
     done
     [ -n "$shadowed" ] || return 0
 
@@ -521,9 +530,10 @@ warn_shadowing() {
     echo "  ! these were already installed elsewhere and are now shadowed:"
     printf '%s' "$shadowed"
     MANUAL+=("Decide which toolchain wins. To keep the previous one:
-      rm -f $(for b in $(tier_tools "$tier"); do printf '%s ' "$OUT_BIN/$b"; done)
-  Or install somewhere private instead:
-      OUT_BIN=\$PWD/bin $0 install")
+      rm -f ${paths% }
+  Or keep both, and let the existing one win by putting $OUT_BIN
+  last on PATH instead of first:
+      export PATH=\"\$PATH:$OUT_BIN\"")
     return 0
 }
 
@@ -606,12 +616,19 @@ list() {
 
 require_linux
 
-case "${1:-install}" in
+# Read the command, THEN shift — and shift only if there is something there.
+# A bare `shift` with no positional parameters returns 1, and under `set -e`
+# that ended the script before a single line was printed: running this with no
+# arguments at all, the documented default, did nothing and said nothing.
+cmd="${1:-install}"
+[ $# -gt 0 ] && shift
+
+case "$cmd" in
     detect)  detect; report_manual ;;
     list)    list ;;
-    verify)  verify_tools "${2:-dev}" ;;
-    fetch)   shift; require_amd64; pick_downloader; pick_sha; fetch "$@" ;;
-    install) shift; require_amd64; pick_downloader; pick_sha; install "${1:-dev}" ;;
+    verify)  verify_tools "${1:-dev}" ;;
+    fetch)   require_amd64; pick_downloader; pick_sha; fetch "$@" ;;
+    install) require_amd64; pick_downloader; pick_sha; install "${1:-dev}" ;;
     *)       echo "usage: $0 [detect|list|install|fetch|verify]" >&2
              echo "       install [core|dev]           (default dev)" >&2
              echo "       fetch   [core|dev] [--to DIR]" >&2