@mnstry/atelier 0.2.0-alpha.12 → 0.2.0-alpha.14

package/src/commands/obsidian.mjs

@@ -1,33 +1,48 @@
 #!/usr/bin/env node
 import fs from 'node:fs'
+import os from 'node:os'
 import path from 'node:path'
+import tty from 'node:tty'
 import { fileURLToPath } from 'node:url'
 import { AtelierDiagnosticError, resolveProjectConfig } from '../project/config.mjs'
+import { readRegularTextNoFollow } from '../project/private-state.mjs'
 import { ObsidianContractRefusal } from '../projection/obsidian/contracts.mjs'
 import { applyPolicyDigest } from '../projection/obsidian/edits/policy.mjs'
-import { MINIMUM_APP_VERSION } from '../runtime/obsidian/app-capability.mjs'
+import { MINIMUM_APP_VERSION, inspectApp } from '../runtime/obsidian/app-capability.mjs'
 import { loadContributions } from '../runtime/obsidian/contributions.mjs'
 import { isoTime } from '../runtime/obsidian/documents.mjs'
 import { readObsidianEnablement } from '../runtime/obsidian/enablement.mjs'
 import { ObsidianMaintenanceRefusal, refuse } from '../runtime/obsidian/errors.mjs'
 import { BUILT_IN_OPERATIONS, UNAVAILABLE_APPLY_OPERATION, createObsidianRegistry } from '../runtime/obsidian/extension-points.mjs'
-import { LIFECYCLE_PRIMITIVES, readServiceStatusDocument, requestServiceTick, serviceStatus, startService, stopService } from '../runtime/obsidian/lifecycle.mjs'
+import { LIFECYCLE_PRIMITIVES, readServiceStatusDocument, requestServiceTick, runtimeRelease, serviceStatus, startService, stopService } from '../runtime/obsidian/lifecycle.mjs'
 import {
-  authorizeAutomaticApply, defaultMachineSettings, ensureWorkspaceIdentity, installApplyPolicy, protectedRoots, readInstalledApplyPolicy, readMachineSettings,
-  revokeApplyPolicy, writeMachineSettings,
+  DECISIONS, ONLY_YOU_AUDIENCES, authorizeAutomaticApply, defaultMachineSettings, ensureWorkspaceIdentity, installApplyPolicy, localPointerPath, protectedRoots,
+  readInstalledApplyPolicy, readMachineSettings, revokeApplyPolicy, withDecision, writeMachineSettings,
 } from '../runtime/obsidian/machine-settings.mjs'
+import {
+  currentLoginItemPlan, installLoginItem, loginItemDataRoot, loginItemLabel, loginItemStarter, loginItemStatus, planLoginItem, projectNameOf, readLoginItemRecord, realNodePath,
+  removeLoginItem, resolveLoginItemEntry, temporaryRoots,
+} from '../runtime/obsidian/login-item.mjs'
 import { APPLY_UNAVAILABLE, OPENING_OUTCOMES, OPENING_PRIMITIVES, REASON_NEXT, nextStep, openScopeForOracleTests, resolveScope, scopeReport } from '../runtime/obsidian/opening.mjs'
 import { currentPluginChoice, writePluginChoice } from '../runtime/obsidian/plugin-choice.mjs'
-import { pluginPresenceOf, turnPluginOnNext, withPluginReportedVersion } from '../runtime/obsidian/plugin-presence.mjs'
-import { serviceNameFor, servicePaths } from '../runtime/obsidian/service-record.mjs'
+import { pluginPresenceOf, turnPluginOnNext, withPluginFilesPending, withPluginReportedVersion } from '../runtime/obsidian/plugin-presence.mjs'
+import { planViewAdd, viewFromRequest, writeViewPlan } from '../runtime/obsidian/project-views.mjs'
+import { askGoAhead, createQuestioner } from '../runtime/obsidian/questions.mjs'
+import { readServiceSettings } from '../runtime/obsidian/service-record.mjs'
 import { resolveServiceWorkspace } from '../runtime/obsidian/service.mjs'
-import { buildStartupAdapter } from '../runtime/obsidian/startup-adapters.mjs'
+import { STARTUP_PLATFORMS, buildStartupAdapter, startupSearchPath } from '../runtime/obsidian/startup-adapters.mjs'
+import { OBSIDIAN_SETTINGS_FILE, obsidianSandboxedBuild, obsidianUserDataDir, readObsidianSettings } from '../projection/obsidian/publication/vault-list.mjs'
+import { checkVaultParent, projectDisplayName, vaultFolderName } from '../runtime/obsidian/vault-location.mjs'
+import { PublicationRefusal, allocationFile, hasCommittedGeneration, readVaultAllocation, vaultRootFor } from '../projection/obsidian/recovery/store.mjs'
 
 // `atelier obsidian <operation>`: status, views, audiences, apply policy, the
 // owned maintenance service, and opening a view.
 //
-// Noninteractive: every input is an argument, nothing is ever asked. With
-// `--json` exactly one JSON document is printed on stdout, for a refusal too.
+// Every input is an argument. A person at a terminal (`isInteractive`) is
+// asked before a change to a file they commit, and can answer with --yes
+// beforehand; anyone else is never asked, and their command is their consent.
+// With `--json` exactly one JSON document is printed on stdout, for a refusal
+// too.
 //
 // Exit codes: 0 done (for `open`: the view is current and open); 1 an error
 // nobody typed; 2 a typed refusal or a usage error; 3 the operation ran and
@@ -37,8 +52,15 @@ import { buildStartupAdapter } from '../runtime/obsidian/startup-adapters.mjs'
 // Reaching the installed app or the operating system goes through seams
 // (`appProbe`, `launcher`, `registry`, `service`). A caller passes them. The production
 // seams are constructed only when this module runs as the real command-line
-// entry (`production: true`) AND `--adapter=obsidian-cli` was given, the same
-// explicit rule the service entry has; there is no default.
+// entry (`production: true`) AND the adapter was selected: `--adapter=obsidian-cli`
+// given now, or given once before and remembered in this workspace's machine
+// settings (`selectAdapter`). A remembered adapter is never used under the test
+// runner. There is no default.
+//
+// What a person decided is remembered per workspace on this machine
+// (`atelier obsidian settings` shows it). The first start of the maintenance
+// service records who allowed it: `--consent-actor ID`, or, for a person at a
+// terminal, their account's name (`isInteractive`).
 
 export const COMMAND_SCHEMA = 'atelier-obsidian-command/v1'
 export const EXIT = Object.freeze({ ok: 0, error: 1, refused: 2, notSuccess: 3 })
@@ -47,26 +69,61 @@ const PRODUCTION_ADAPTER = 'obsidian-cli'
 const MAX_POLICY_BYTES = 64 * 1024
 const AUDIENCE = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/
 
-export const USAGE = `Usage: atelier obsidian <operation> [--project atelier.project.json] [--data-root DIR] [--json]
+export const USAGE = `Usage: atelier obsidian <operation> [--project atelier.project.json | --personal-home DIR] [--data-root DIR] [--json] [--no-input]
 
   status                               Enablement, machine settings, service and per-view freshness. Read-only.
-  scope list | scope show ID           The views this project declares. Read-only.
-  audience show | set A,B | clear      The audiences this machine lets into a view (private; none by default).
+  settings                             What this machine remembers for this workspace, and how to change it. Read-only.
+  scope list | scope show ID           The views this project declares. Read-only. (\`view list | show ID\` too.)
+  view add ID (--all | --folder PATH [--folder PATH ...] [--repo R] | --tag T) [--expand DEPTH:MAX] [--default]
+      [--allow-empty] [--yes]
+                                       Add a view to the project's configuration, which you commit: every note, the
+                                       notes under folders of one repository, or those with a tag, optionally with the
+                                       notes they link to (DEPTH steps, MAX notes in all). Shows the change and how many
+                                       notes the view would show, and asks at a terminal.
+  audience show | set me|A,B | clear   The audiences this machine lets into a view (private; none by default).
+                                       \`me\` is only you: every audience but sensitive, which is added by name, and
+                                       the notes without a classification, which no other list shows.
+  location show | set DIR [--allow-synced-location]
+                                       Where this workspace's vaults live, as "<project> (<view>)"; each is allocated
+                                       there at its first publication. A vault published already stays where it is.
   mode show | set manual|automatic     Whether queued edits wait for a person or are applied under the policy.
   policy show | install FILE | revoke  The private apply policy. Automatic mode needs an installed, active one.
   policy digest FILE                   The digest FILE has to carry to be installed. Reads FILE; writes nothing.
-  service start [--consent-actor ID] --adapter=${PRODUCTION_ADAPTER}
-  service status | stop                The owned maintenance service of this workspace.
-  service unit --print --adapter=${PRODUCTION_ADAPTER}
-                                       Print an operating-system startup unit. Writes and installs nothing.
-  open [--scope ID] [--consent-actor ID] [--allow-stale] --adapter=${PRODUCTION_ADAPTER}
+  service start [--consent-actor ID] [--adapter=${PRODUCTION_ADAPTER}]
+  service status | stop                The owned maintenance service of this workspace. start replaces one of an
+                                       earlier release still running after an upgrade.
+  service unit --print [--adapter=${PRODUCTION_ADAPTER}]
+                                       Print the login item (launchd agent, systemd user unit). Writes nothing.
+  service unit --install [--consent-actor ID] [--adapter=${PRODUCTION_ADAPTER}]
+                                       Install the login item: maintenance starts when you log in. macOS and Linux.
+  service unit --remove                Remove the login item; the consent goes back to the service alone, and the
+                                       service is started for this session only.
+  open [--scope ID] [--consent-actor ID] [--allow-stale] [--restart-obsidian] [--wait-ms MS] [--adapter=${PRODUCTION_ADAPTER}]
                                        Start or reconnect maintenance, verify the view, add it to Obsidian and open it.
+                                       --restart-obsidian lets open quit a running Obsidian it cannot reach (its command
+                                       line off, or no vault open), add the vault and start it again; never implied.
+                                       --wait-ms bounds the wait for maintenance's tick.
+  uninstall                            Stop maintenance and remove the login item. Vaults, private state, the project
+                                       file and Obsidian's vault list are kept, and where each is is printed.
   plugin show [--scope ID]             Whether Atelier's plugin is on in a view's vault, and whether it holds it open.
   plugin on [--scope ID] [--adapter=${PRODUCTION_ADAPTER}]
                                        Offer Atelier's plugin again in a vault where it was turned off; a running
                                        service publishes the view at once (with --adapter, one of an earlier release
                                        is replaced first).
 
+--personal-home DIR, given instead of --project, follows the generation last confirmed in that private home of a personal
+workspace (the personal-workspace module's selection); its views come from the overlay. Nothing here confirms one: while
+none is confirmed and current nothing is published, and status, open and service start refuse with the reason. service
+status and stop, unit --remove and uninstall find the service from the home alone. Who may see its vaults stays this
+machine's audience setting, none by default.
+Reaching the installed app needs --adapter=${PRODUCTION_ADAPTER} once for a workspace; it is remembered after that.
+Obsidian's own settings file (obsidian.json) is written only while no Obsidian runs: open adds the view's vault to its
+list, turns its command line on (cli: true), and creates the file for an Obsidian that never started; every write is
+shown in open's answer, with the backup of the file as it was.
+The first start of the maintenance service records who allows it: --consent-actor ID, or, for a person at a terminal,
+their account's name; service unit --install records who allows it to start at login the same way (at a terminal, the
+actor already recorded is kept). --no-input, --json, a CI environment or ATELIER_NONINTERACTIVE=1 mean no person is at a terminal.
+
 Contributed operations, registered by the modules shipped under src/runtime/obsidian/contributions/:
   apply list | show EDIT | run EDIT [--actor ID] | recover
                                        Pending edits, and the explicit apply of one of them to its source file.
@@ -83,7 +140,77 @@ Pending edits additionally report ${APPLY_UNAVAILABLE} while no apply operation
 Minimum Obsidian version: ${MINIMUM_APP_VERSION}.
 Exit codes: 0 done; 1 internal error; 2 refusal or usage; 3 ran, and the answer is not success.`
 
-const FLAGS = Object.freeze({ json: 'flag', 'allow-stale': 'flag', print: 'flag', help: 'flag', project: 'value', 'project-config': 'value', 'data-root': 'value', scope: 'value', 'consent-actor': 'value', actor: 'value', adapter: 'value', 'wait-ms': 'value' })
+// Every option of the command. `atelier obsidian --help` names each one but `help` and `project-config` (the older
+// spelling of `project`); a test holds it to that.
+export const FLAGS = Object.freeze({
+  json: 'flag', 'allow-stale': 'flag', 'restart-obsidian': 'flag', print: 'flag', install: 'flag', remove: 'flag', help: 'flag', 'no-input': 'flag', 'allow-synced-location': 'flag', all: 'flag', default: 'flag', 'allow-empty': 'flag', yes: 'flag',
+  project: 'value', 'project-config': 'value', 'personal-home': 'value', 'data-root': 'value', scope: 'value', 'consent-actor': 'value', actor: 'value', adapter: 'value', 'wait-ms': 'value', repo: 'value', tag: 'value',
+  expand: 'value', folder: 'values',
+})
+
+const IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/
+
+// Which adapter this run may use, or a typed refusal. Pure. `flag` is --adapter as given; `remembered` is the adapter
+// this workspace's machine settings remember (or null); `production` says this module runs as the real command-line
+// entry. A remembered adapter is used only by the real entry, and never under the test runner: a test that reaches an
+// app names the adapter, and runs where no app of the developer's can be reached.
+export function selectAdapter({ flag, remembered = null, production = false, env = process.env } = {}) {
+  if (flag !== undefined) {
+    if (flag !== PRODUCTION_ADAPTER) refuse('app-adapter-not-selected', `no editor adapter is called ${String(flag).slice(0, 40)}; the only one is ${PRODUCTION_ADAPTER}`)
+    return { adapter: PRODUCTION_ADAPTER, source: 'flag' }
+  }
+  if (remembered === PRODUCTION_ADAPTER && production === true) {
+    if (env.NODE_TEST_CONTEXT !== undefined) refuse('remembered-adapter-under-test', 'a remembered adapter is never used under the test runner; pass the seams, or the adapter explicitly')
+    return { adapter: PRODUCTION_ADAPTER, source: 'remembered' }
+  }
+  return refuse('app-adapter-not-selected', 'no editor adapter was selected; reaching the installed app is never a default')
+}
+
+// Whether a person is at a terminal: nothing says otherwise, and both standard input and output are one. Pure.
+// `terminal` is `{ stdin, stdout }`, each true when that stream is a terminal.
+export function isInteractive({ flags = {}, env = process.env, terminal = { stdin: false, stdout: false } } = {}) {
+  if (flags.json === true || flags['no-input'] === true) return false
+  if (env.ATELIER_NONINTERACTIVE === '1') return false
+  if (typeof env.CI === 'string' && env.CI !== '' && env.CI !== 'false' && env.CI !== '0') return false
+  return terminal.stdin === true && terminal.stdout === true
+}
+
+// The account's name as an actor identifier, or null when it is not one.
+export const accountActor = (username) => (typeof username === 'string' && IDENTIFIER.test(username) ? username : null)
+
+// How each remembered answer is changed; null where no command changes it.
+const DECISION_CHANGES = Object.freeze({
+  audience: '`atelier obsidian audience set me|A,B` decides who may see the vaults again',
+  location: '`atelier obsidian location set DIR` decides where the vaults of views not published yet live',
+  loginItem: '`atelier obsidian service unit --install` starts maintenance at login; `service unit --remove` stops that',
+  adapter: null,
+  consent: '`atelier obsidian service stop`, then `service start --consent-actor ID`, records another actor',
+})
+const SOURCE_WORDS = Object.freeze({ question: 'answered at a terminal', command: 'given on the command line', defaults: 'the defaults', v1: 'set before this release' })
+
+// One remembered answer in words, with when and how it was given.
+function decisionWords(name, decision, audienceAllow = []) {
+  if (decision === null) return name === 'audience' && audienceAllow.length === 0 ? 'not decided; no audience is allowed, so every view is empty' : 'not decided'
+  const what = name === 'audience'
+    ? `${decision.choice === 'only-you' ? `only you (${audienceAllow.join(', ')})` : audienceAllow.length === 0 ? 'no audience: every view is empty' : audienceAllow.join(', ')}; notes without a classification ${decision.unclassified}`
+    : name === 'location' ? decision.parent : decision.choice
+  return `${what} (${SOURCE_WORDS[decision.via]}, ${decision.decidedAt}${decision.decidedBy === null ? '' : `, by ${decision.decidedBy}`})`
+}
+
+function decisionSummary(decisions) {
+  const words = {
+    audience: (decision) => `who may see ${decision.choice === 'only-you' ? 'only you' : 'a list of audiences'}`,
+    location: (decision) => `vaults in ${decision.parent}`,
+    loginItem: (decision) => `start at login ${decision.choice}`,
+    adapter: (decision) => `app through ${decision.choice}`,
+  }
+  const decided = DECISIONS.filter((name) => decisions[name] !== null)
+  return decided.length === 0 ? 'nothing yet' : decided.map((name) => words[name](decisions[name])).join('; ')
+}
+
+function accountName() {
+  try { return os.userInfo().username } catch { return null }
+}
 
 function parse(argv) {
   const positionals = []
@@ -97,24 +224,120 @@ function parse(argv) {
     if (FLAGS[name] === 'flag') { if (inline !== undefined) refuse('usage', `--${name} takes no value`); flags[name] = true; continue }
     const value = inline ?? argv[index += 1]
     if (value === undefined || value === '' || (inline === undefined && value.startsWith('--'))) refuse('usage', `--${name} needs a value`)
-    flags[name] = value
+    // An option that takes several values is given once for each.
+    flags[name] = FLAGS[name] === 'values' ? [...(flags[name] ?? []), value] : value
   }
   return { positionals, flags }
 }
 
-const isTyped = (error) => error instanceof ObsidianMaintenanceRefusal || error instanceof AtelierDiagnosticError || error instanceof ObsidianContractRefusal
+// What `open` did to the person's Obsidian, in words: a restart they asked for, and every write to its settings file.
+const STATE_WORDS = Object.freeze({ 'cli-turned-off': 'its command line was turned off', 'no-vault-open': 'it had no vault open' })
+function restartLines(restart) {
+  if (restart === undefined || restart === null) return []
+  const why = STATE_WORDS[restart.state] ?? restart.state
+  const copy = restart.settingsCopy && restart.signalled ? [`  A copy of Obsidian's settings, taken just before the first signal, is kept in ${restart.settingsCopy}.`] : []
+  const asked = restart.signals === 2 ? `it was sent SIGTERM twice (process ${restart.pid}), and has not gone` : `it was asked to quit (SIGTERM to process ${restart.pid}) and has not`
+  if (restart.quit !== true) return [`Obsidian: not restarted (${restart.reason}${restart.detail ? `: ${restart.detail}` : ''}); ${restart.signalled ? asked : 'it was not asked to quit'}.`, ...copy]
+  const quit = !restart.signalled ? 'already gone'
+    : restart.signals === 2 ? `quit: SIGTERM to its main process, ${restart.pid}, closed its windows, and a second SIGTERM ended that process, left without a window, at once, without its quit handlers`
+      : `quit (SIGTERM to its main process, ${restart.pid})`
+  return [`Obsidian: restarted as you asked, because ${why}: ${quit}; ${restart.startedAgain === true ? 'then started again plainly, which reopens the vaults it had open' : restart.startedAgain === false ? 'it could not be started again: start it yourself' : 'not started again yet'}.`, ...copy]
+}
+function obsidianSettingsLines(settings) {
+  if (settings === undefined || settings === null) return []
+  const file = settings.file ?? 'obsidian.json'
+  const what = settings.created
+    ? `created ${file}${settings.directoryCreated ? ' (and its folder, private to you)' : ''}, because Obsidian never started on this account: this vault flagged open, and the command line on (cli: true)`
+    : [settings.vaultAdded ? `added this vault to the vault list in ${file}, flagged open` : null, settings.cliTurnedOn ? `turned the command line on (cli: true)${settings.vaultAdded ? '' : ` in ${file}`}` : null].filter(Boolean).join('; ')
+  return [`Obsidian's settings, written while it was quit: ${what}.`, ...(settings.backupPath ? [`  The file as it was is kept in ${settings.backupPath}.`] : [])]
+}
+
+const isTyped = (error) => error instanceof ObsidianMaintenanceRefusal || error instanceof AtelierDiagnosticError || error instanceof ObsidianContractRefusal || error instanceof PublicationRefusal
 const plainMessage = (error) => String(error.message ?? '').replace(new RegExp(`^${error.code}: `), '')
 const NEXT = Object.freeze({
   usage: 'run `atelier obsidian --help`',
   'seams-required': 'pass the seams, or run the real command-line entry',
-  'app-adapter-not-selected': `pass --adapter=${PRODUCTION_ADAPTER} to let this command reach the installed app`,
-  'startup-consent-required': 'pass --consent-actor ID to record who allows the maintenance service to run',
+  'app-adapter-not-selected': `pass --adapter=${PRODUCTION_ADAPTER} to let this command reach the installed app; it is remembered for this workspace`,
+  'remembered-adapter-under-test': `a test passes its own seams, or --adapter=${PRODUCTION_ADAPTER} with a HOME that leads to no app of the developer's`,
+  'startup-consent-required': 'pass --consent-actor ID to record who allows the maintenance service to run (at a terminal, your account\'s name is recorded)',
   'automatic-mode-refused': 'install an active automatic policy with `obsidian policy install FILE`',
   [APPLY_UNAVAILABLE]: 'no apply operation is registered on this command; edits stay preserved and queued',
   'policy-digest-mismatch': 'set the "digest" member of the file to the expected digest (`obsidian policy digest FILE` prints it), then install again',
-  disabled: 'declare the Obsidian settings in the project configuration',
+  disabled: 'declare the Obsidian settings in the project configuration: `atelier obsidian view add everything --all` does it',
+  'view-would-be-empty': 'check the folders or the tag, and who may see them (`atelier obsidian audience show`; `audience set me` admits every note that is only yours, those without a classification included, and leaves out `sensitive`; a list such as `me,sensitive` shows no note without a classification); --allow-empty declares the view anyway',
+  'view-exists': 'choose another name; `atelier obsidian view list` shows the views declared',
+  'view-repository-ambiguous': 'name the repository the folders are in with --repo',
+  'project-config-format-unknown': 'add the member shown under "detail" to the project configuration by hand, under "ext"',
+  'project-config-changed': 'run the command again',
+  'canonical-graph-invalid': '`atelier graph --check` names the errors in the project\'s notes; fix them, then run the command again',
+  unanswered: 'run the command again at a terminal, or pass --yes',
+  'startup-platform-unqualified': 'a login item is offered on macOS and Linux; `atelier obsidian open` starts maintenance when you open a view',
+  'startup-platform-unsupported': 'a login item is offered on macOS and Linux; `atelier obsidian open` starts maintenance when you open a view',
+  'login-item-needs-installed-package': 'install @mnstry/atelier in the project (`npm i -D @mnstry/atelier`), then run the command there',
+  'login-item-home-mismatch': 'run the command in your own session, with HOME set to your home directory',
+  'real-login-item-under-test': 'a test passes its own service manager',
+  'login-item-unavailable': 'no service manager of your session answered (on Linux: systemd --user); `atelier obsidian open` starts maintenance when you open a view',
+  'login-item-install-failed': 'see `atelier obsidian status`; `atelier obsidian service unit --install` tries again',
+  'login-item-remove-failed': 'see `atelier obsidian status`; `atelier obsidian service unit --remove` tries again',
+  'login-item-file-unsafe': 'the login item\'s file is a link or not a regular file and is left alone; remove it by hand, then try again',
+  'invalid-login-item': 'the login item record in private state does not validate; inspect it, remove it, then install the login item again',
+  'selection-history-shortened': 'records of the selection history were removed after this process read them; put them back, or run the command in a process of its own, which reads the history as it now stands',
+})
+
+// The login item of `status`, in words.
+function loginItemWords(item, platform) {
+  if (item.installed === null) return `unreadable (${item.reason})`
+  if (item.installed === false) return 'off'
+  const where = item.file
+  if (item.programPresent === false) return `installed, but the Node or the package it runs is gone, so it cannot start: install @mnstry/atelier in the project, then \`atelier obsidian service unit --install\`, or remove it with \`service unit --remove\`; ${where}`
+  return {
+    loaded: `on (${item.running ? 'running' : 'loaded'}); ${where}`,
+    'switched-off': `installed, ${platform === 'darwin' ? 'switched off in System Settings' : 'disabled'}; it does not start at login; ${where}`,
+    'file-missing': `installed, but its file is gone: it does not start at login; \`atelier obsidian service unit --install\` puts it back; ${where}`,
+    'not-loaded': `installed, not loaded by the service manager; it starts at the next login; ${where}`,
+  }[item.state] ?? `installed; ${where}`
+}
+
+// What a start through the login item adds to the answer of `service start` and `open`.
+function loginItemLines(item) {
+  if (item === undefined || item === null) return []
+  return [
+    ...(item.refreshed === true ? ['login item refreshed: its unit is written as it would be now, and loaded again'] : []),
+    ...(item.via === 'child' ? [`the login item did not start the service (${item.reason}); it was started for this session only`] : []),
+  ]
+}
+
+// A start's answer in words: started, replaced, or already running, and which release when that is why it was kept.
+function serviceWords(result) {
+  if (result.replaced === 'outdated' && result.started) return `${result.state} (restarted: the service of an earlier release was replaced)`
+  if (result.started) return `${result.state} (started)`
+  if (result.alreadyRunning) {
+    if (result.release === 'later') return `${result.state} (already running, a later release; it is not replaced by this one)`
+    if (result.release === 'outdated') return `${result.state} (already running, an earlier release, not replaced: ${result.reason})`
+    return `${result.state} (already running)`
+  }
+  return `${result.state} (${result.reason})`
+}
+
+// What `status` suggests after the login item did not start the service.
+const LOGIN_ITEM_NEXT = Object.freeze({
+  'startup-consent-absent': 'install it again with `atelier obsidian service unit --install --consent-actor ID`',
+  'service-port-occupied': 'something else answers on the recorded port; see `atelier obsidian service status`',
+  'service-settings-absent': 'install it again with `atelier obsidian service unit --install --consent-actor ID`',
 })
 
+// What a view would show, in words: `counts` of viewCounts, and who they were counted for.
+function viewCountWords(scopeId, counts, audience) {
+  const who = audience.decided ? (audience.allow.length === 0 ? 'no audience' : audience.allow.join(', ')) : 'only you, until you decide'
+  const reasons = [
+    ...(counts.withheld.unclassified > 0 ? [`${counts.withheld.unclassified} carry no classification`] : []),
+    ...(counts.withheld.audience > 0 ? [`${counts.withheld.audience} an audience not admitted`] : []),
+  ]
+  const shown = `view ${scopeId} would show ${counts.shown === 0 ? 'no note' : `${counts.shown} note(s)`} (who may see: ${who})`
+  if (counts.named === 0) return `${shown}: it names no note`
+  return reasons.length === 0 ? shown : `${shown}; of the ${counts.named} note(s) it names, ${reasons.join(' and ')}`
+}
+
 // The decisions the command's oracles are sensitive to are those of opening and of the lifecycle; tests substitute
 // broken ones here to prove the oracles can fail. `runObsidianCommand` always uses the production ones.
 export async function runObsidianCommandForOracleTests(options = {}, rules = {}) {
@@ -123,9 +346,22 @@ export async function runObsidianCommandForOracleTests(options = {}, rules = {})
   const {
     argv = [], seams = null, production = false, env = process.env, cwd = process.cwd(), platform = process.platform, clock = () => new Date(),
     stdout = (text) => process.stdout.write(`${text}\n`), stderr = (text) => process.stderr.write(`${text}\n`), contributions = null, contributionsDirectory,
+    // Whether standard input and output are terminals, and the name of the account this runs as. A test injects both;
+    // under the test runner the process's own terminal is never looked at.
+    terminal = env.NODE_TEST_CONTEXT === undefined ? { stdin: tty.isatty(0), stdout: tty.isatty(1) } : { stdin: false, stdout: false },
+    account = accountName,
+    // The home folder a location is read against (`~/`) and checked for sync clients; a test names its own.
+    homedir = env.NODE_TEST_CONTEXT === undefined ? os.homedir() : null,
+    // Where a person at a terminal is asked, and answers; a test types into its own.
+    input = env.NODE_TEST_CONTEXT === undefined ? process.stdin : null, output = env.NODE_TEST_CONTEXT === undefined ? process.stdout : null,
   } = options
   let json = argv.includes('--json')
   let operationName = null
+  let questions = null
+  const questioner = () => {
+    if (input === null || output === null) throw new Error('a question needs an input and an output')
+    return (questions ??= createQuestioner({ input, output }))
+  }
   const emit = ({ exit, document, human }) => {
     const complete = { schema: COMMAND_SCHEMA, ok: exit === EXIT.ok, operation: operationName, ...document }
     if (json) stdout(JSON.stringify(complete, null, 2))
@@ -142,23 +378,88 @@ export async function runObsidianCommandForOracleTests(options = {}, rules = {})
 
     const dataRoot = flags['data-root'] === undefined ? options.dataRoot : path.resolve(cwd, flags['data-root'])
     const configFlag = flags.project ?? flags['project-config']
-    const loadProject = options.loadProject ?? (() => resolveProjectConfig({ argv: configFlag === undefined ? [] : [`--project=${path.resolve(cwd, configFlag)}`], cwd, env, writeLocalState: false }))
+    // A personal home is followed instead of a project: the generation confirmed there is loaded (composed in this
+    // thread, as for a command run once), and the service's workspace is located from the home alone.
+    const personalHome = flags['personal-home'] === undefined ? null : path.resolve(cwd, flags['personal-home'])
+    if (personalHome !== null && configFlag !== undefined) refuse('usage', '--personal-home is given instead of --project, not with it')
+    const selection = personalHome === null ? null : await import('../runtime/obsidian/personal-selection.mjs')
+    const loadProject = options.loadProject ?? (selection !== null ? () => selection.loadSelectedProject({ personalHome }) : () => resolveProjectConfig({ argv: configFlag === undefined ? [] : [`--project=${path.resolve(cwd, configFlag)}`], cwd, env, writeLocalState: false }))
+    const locateProject = selection === null ? null : () => selection.locatePersonalHome({ personalHome })
     const registry = createObsidianRegistry({ reservedOperations: BUILT_IN_OPERATIONS, contributions: contributions ?? await loadContributions(contributionsDirectory === undefined ? {} : { directory: contributionsDirectory }) })
     const applyAvailable = registry.extensions.applyOperation() !== UNAVAILABLE_APPLY_OPERATION
-    const lifecycle = { loadProject, dataRoot, env, platform, ...(options.probeTimeoutMs === undefined ? {} : { probeTimeoutMs: options.probeTimeoutMs }) }
+    const lifecycle = { loadProject, ...(locateProject === null ? {} : { locateProject }), dataRoot, env, platform, ...(options.probeTimeoutMs === undefined ? {} : { probeTimeoutMs: options.probeTimeoutMs }) }
 
-    const serviceSeam = async () => {
+    // The adapter of this run: given now, or remembered by this workspace (read only when the real entry has no flag).
+    const chooseAdapter = () => selectAdapter({ flag: flags.adapter, remembered: flags.adapter === undefined && production === true ? rememberedAdapter() : null, production, env })
+    // The entry this command may start, and its arguments.
+    const entrySeam = async () => {
       if (seams !== null) { if (typeof seams.service?.entryPath !== 'string') refuse('seams-required', 'the service seam names the entry this command may start'); return seams.service }
-      if (flags.adapter !== PRODUCTION_ADAPTER) refuse('app-adapter-not-selected', 'no editor adapter was selected; a service that reaches the installed app is never a default')
+      chooseAdapter()
       const { SERVICE_ENTRY_PATH } = await import('../runtime/obsidian/service-entry-path.mjs')
       return { entryPath: SERVICE_ENTRY_PATH, entryArgs: [`--adapter=${PRODUCTION_ADAPTER}`] }
     }
+    // The service manager of a login item: the caller's (`serviceManager`, or `seams.serviceManager`), or, for the real
+    // command-line entry only, the production one, which refuses under the test runner and for a HOME that is not the
+    // account's own. Without `required`, null where none can be had.
+    const managerSeam = async ({ required = true } = {}) => {
+      const given = options.serviceManager ?? seams?.serviceManager ?? null
+      if (given !== null) return given
+      if (seams !== null || production !== true) { if (required) refuse('seams-required', 'no service manager was passed for the login item'); return null }
+      try {
+        const { createProductionServiceManager } = await import('../runtime/obsidian/service-manager-production.mjs')
+        return createProductionServiceManager({ platform, env })
+      } catch (error) {
+        if (!required && isTyped(error)) return null
+        throw error
+      }
+    }
+    const nodePath = () => options.nodePath ?? realNodePath()
+    // The service seam: once this workspace has a login item, the service is started through its manager, running the
+    // entry the item names; a unit that differs from what would be written now is written again on the way.
+    const serviceSeam = async () => {
+      const entry = await entrySeam()
+      const { project, workspace } = readable()
+      let record = null
+      try { record = workspace === null ? null : readLoginItemRecord(workspace) } catch (error) { if (!isTyped(error)) throw error }
+      if (record === null) return entry
+      const manager = await managerSeam({ required: false })
+      if (manager === null) return entry
+      const plan = currentLoginItemPlan({ record, project, workspaceRoot: workspace.workspaceRoot, dataRoot, env, platform, ownEntry: entry.entryPath, entryArgs: entry.entryArgs ?? [], nodePath: nodePath() })
+      // An item that names an entry that is gone, with nothing to refresh it to from here, cannot start anything.
+      if (plan === null && !fs.existsSync(record.program.entry)) return entry
+      return { ...entry, entryPath: plan?.program.entry ?? record.program.entry, loginItem: loginItemStarter({ workspace, manager, record, plan, clock }) }
+    }
     const appSeams = async () => {
-      if (seams !== null) return { appProbe: seams.appProbe, launcher: seams.launcher, registry: seams.registry }
-      if (flags.adapter !== PRODUCTION_ADAPTER) refuse('app-adapter-not-selected', 'no editor adapter was selected; reaching the installed app is never a default')
+      if (seams !== null) return { appProbe: seams.appProbe, launcher: seams.launcher, registry: seams.registry, quitter: seams.quitter ?? null }
+      chooseAdapter()
       const { createProductionAppSeams } = await import('../runtime/obsidian/app-production-seams.mjs')
       return createProductionAppSeams({ env, platform })
     }
+    // The app's vault list, read only, for a check of where vaults may live: through the app when it runs and answers,
+    // else from its settings file. { source: 'app' | 'file' | 'none', vaults } ('none': the app never ran here), or
+    // { source: 'unread', vaults: null, reason }. The app is reached only with the adapter (given or remembered, or the
+    // caller's seams); without it, only the file is read, and never under the test runner.
+    const appVaultList = async () => {
+      const quietly = async (read) => { try { return await read() } catch { return null } }
+      const reach = seams !== null ? seams : adapterSelected() ? await appSeams() : null
+      const registry = reach?.registry ?? null
+      if (registry !== null && reach.appProbe !== undefined) {
+        const seen = await inspectApp(reach.appProbe)
+        if (seen.running === true && typeof seen.version === 'string') {
+          const listed = await quietly(() => registry.listThroughApp())
+          if (listed?.answered === true) return { source: 'app', vaults: listed.vaults }
+        }
+      }
+      const settings = registry !== null ? await quietly(() => registry.readSettings())
+        : env.NODE_TEST_CONTEXT !== undefined ? { ok: false, code: 'app-vault-list-under-test' }
+          : obsidianSandboxedBuild({ platform, env }) !== null ? { ok: false, code: 'obsidian-sandboxed' }
+            : readObsidianSettings({ userDataDir: obsidianUserDataDir({ platform, env }) })
+      if (settings?.ok === true) return { source: 'file', vaults: settings.vaults ?? {} }
+      if (settings?.code === 'obsidian-settings-missing') return { source: 'none', vaults: {} }
+      return { source: 'unread', vaults: null, reason: typeof settings?.code === 'string' ? settings.code : 'obsidian-settings-unreadable' }
+    }
+    // Whether this run may reach the installed app: --adapter given, or remembered by the workspace for the real entry.
+    const adapterSelected = () => { try { chooseAdapter(); return true } catch (error) { if (isTyped(error)) return false; throw error } }
     // Atelier's plugin as the running service sees it, for one view. A vault that turned it off says so from its own list
     // and the private record too, whether or not the service runs.
     const pluginView = (running, workspace, scopeId) => {
@@ -167,8 +468,11 @@ export async function runObsidianCommandForOracleTests(options = {}, rules = {})
       return { present: false, reason: 'turned-off-in-this-vault', next: turnPluginOnNext(scopeId) }
     }
     const pluginOf = async (scopeId) => pluginPresenceOf((await readServiceStatusDocument(lifecycle, lifecycleRules)).document, scopeId)
-    const pluginLine = (plugin) => (plugin.present ? `; plugin present (Obsidian ${plugin.appVersion})` : plugin.reason === 'turned-off-in-this-vault' ? '; plugin turned off in this vault' : `; plugin not present (${plugin.reason})`)
+    const pluginLine = (plugin) => `${plugin.present ? `; plugin present (Obsidian ${plugin.appVersion})` : plugin.reason === 'turned-off-in-this-vault' ? '; plugin turned off in this vault' : `; plugin not present (${plugin.reason})`}${plugin.files === 'waits-for-app' ? '; plugin files wait for the app' : ''}`
 
+    // A project bound to a personal workspace takes its views from the overlay, and has no place for these decisions
+    // yet: the operations that would write them refuse before anything is resolved or written.
+    const refuseOnPersonalBinding = async (project, operation) => (await import('../projection/obsidian/personal-workspace.mjs')).refuseOnPersonalBinding(project, operation)
     const configured = () => {
       const project = loadProject()
       const enablement = readObsidianEnablement(project)
@@ -189,15 +493,225 @@ export async function runObsidianCommandForOracleTests(options = {}, rules = {})
       return { project, enablement, workspace: workspace?.workspaceRoot ? workspace : null, workspaceId: workspace?.workspaceId ?? null }
     }
     const machineOf = (workspace) => (workspace === null ? null : readMachineSettings(workspace))
-    const consent = flags['consent-actor'] === undefined ? undefined : { actor: flags['consent-actor'], coverage: 'service' }
+    const rememberedAdapter = () => machineOf(readable().workspace)?.decisions.adapter?.choice ?? null
+    const interactive = isInteractive({ flags, env, terminal })
+    // Who allows the maintenance service to run, for a start this run may make: --consent-actor; else, for a person at a
+    // terminal and only while this workspace has no consent recorded, their account's name. A derived consent never
+    // replaces a recorded one. `source` says which.
+    // With a login item installed, the service is started through it, so the consent covers startup too, or the item's
+    // own start would be refused (`seam.loginItem`).
+    const consentOfThisRun = (seam = null) => {
+      const coverage = seam?.loginItem ? 'service-and-startup' : 'service'
+      if (flags['consent-actor'] !== undefined) return { consent: { actor: flags['consent-actor'], coverage }, source: 'flag' }
+      if (!interactive) return { consent: undefined, source: null }
+      const { workspace } = readable()
+      if (workspace !== null && readServiceSettings(workspace) !== null) return { consent: undefined, source: null }
+      const actor = accountActor(account())
+      // `derived`: the start records it only while no consent is recorded, checked again under the start lock.
+      return actor === null ? { consent: undefined, source: null } : { consent: { actor, coverage, derived: true }, source: 'account' }
+    }
+    // --adapter, given to an operation that starts or reaches the service of an enabled project, is remembered the first
+    // time: the workspace is prepared and the decision written before anything starts, so no later run needs the flag.
+    // Answers whether this run remembered it.
+    // Remembering never stands in the way of the operation: a workspace that cannot be prepared refuses the operation
+    // itself, which says so in its own terms.
+    const rememberAdapter = (decidedBy) => {
+      if (flags.adapter !== PRODUCTION_ADAPTER) return false
+      try {
+        if (readable().enablement.state !== 'enabled') return false
+        const { workspace, repositoryRoots, now } = writable()
+        const current = machineOf(workspace) ?? defaultMachineSettings({ workspaceId: workspace.workspaceId, updatedAt: now })
+        if (current.decisions.adapter?.choice === PRODUCTION_ADAPTER) return false
+        const decided = withDecision(current, 'adapter', { choice: PRODUCTION_ADAPTER }, { decidedAt: now, decidedBy: decidedBy ?? accountActor(account()), via: 'command' })
+        writeMachineSettings({ ...workspace, repositoryRoots, settings: { ...decided, updatedAt: now } })
+        return true
+      } catch (error) {
+        if (isTyped(error)) return false
+        throw error
+      }
+    }
+    // What a run that starts or reaches the service says about what it remembered, in the document and in words.
+    const rememberedLines = ({ adapterRemembered, consent }) => [
+      ...(consent.source === 'account' ? [`The maintenance service is allowed by ${consent.consent.actor}, this account; recorded for this workspace.`] : []),
+      ...(adapterRemembered ? [`Remembered for this workspace: the app is reached through ${PRODUCTION_ADAPTER}; --adapter is not needed again.`] : []),
+    ]
     const shownMachine = (machine, workspace) => {
-      const settings = machine ?? { maintenanceMode: 'manual', audienceAllow: [], applyPolicy: null }
+      const settings = machine ?? defaultMachineSettings({ workspaceId: workspace?.workspaceId ?? 'ws-unprepared', updatedAt: isoTime(clock) })
       const automatic = workspace === null ? { authorized: false, reason: 'machine-settings-absent' } : authorizeAutomaticApply(workspace)
-      return { maintenanceMode: settings.maintenanceMode, audienceAllow: settings.audienceAllow, applyPolicy: settings.applyPolicy, automaticApply: { authorized: automatic.authorized, reason: automatic.reason } }
+      return {
+        maintenanceMode: settings.maintenanceMode, audienceAllow: settings.audienceAllow, applyPolicy: settings.applyPolicy, automaticApply: { authorized: automatic.authorized, reason: automatic.reason },
+        decisions: settings.decisions,
+      }
+    }
+    // After a run that may have started the service: whether the consent it derived is the one now recorded.
+    const consentRecorded = (consent) => {
+      if (consent.source !== 'account') return consent
+      const { workspace } = readable()
+      const recorded = workspace === null ? null : readServiceSettings(workspace)
+      return recorded?.consent.actor === consent.consent.actor ? consent : { consent: undefined, source: null }
     }
     const applyShown = { available: applyAvailable, state: applyAvailable ? 'available' : APPLY_UNAVAILABLE, operationId: registry.extensions.applyOperation().id }
     const [, sub, value] = positionals
 
+    // The login item's text as `--install` would write it now. Writes nothing and asks no service manager.
+    const printUnit = async () => {
+      const { project, workspace } = readable()
+      if (workspace === null) refuse('service-workspace-not-prepared', 'this workspace has no private state yet; `service start` prepares it')
+      const entry = await entrySeam()
+      const record = readLoginItemRecord(workspace)
+      const temporary = temporaryRoots()
+      const { entryPath } = resolveLoginItemEntry({ project, ownEntry: entry.entryPath, temporary })
+      const label = record?.label ?? loginItemLabel({ platform, projectName: projectNameOf(project), workspaceId: workspace.workspaceId })
+      const { platform: unitPlatform, kind, fileName, text } = planLoginItem({
+        platform, project, workspaceRoot: workspace.workspaceRoot, workspaceId: workspace.workspaceId, dataRoot: loginItemDataRoot({ project, dataRoot, env, platform }), label, entryPath,
+        entryArgs: entry.entryArgs ?? [], nodePath: nodePath(),
+        searchPath: record?.searchPath ?? startupSearchPath(env.PATH, { temporary }),
+      })
+      return { exit: EXIT.ok, document: { unit: { platform: unitPlatform, kind, fileName, text }, installed: record !== null, note: 'the service runs under this unit only with a recorded consent that covers startup; `service unit --install` records one' }, human: [text] }
+    }
+    // Who allows the service to run at login, for `--install`: --consent-actor; else, for a person at a terminal, the
+    // actor this workspace already recorded (its coverage is raised to startup), or the account's name when none is.
+    // Asking for the login item at a terminal is that person's consent to it. A program names its actor.
+    const startupConsent = () => {
+      if (flags['consent-actor'] !== undefined) return { actor: flags['consent-actor'] }
+      if (!interactive) return undefined
+      const { workspace } = readable()
+      const recorded = workspace === null ? null : readServiceSettings(workspace)
+      const actor = recorded?.consent.actor ?? accountActor(account())
+      return actor === null ? undefined : { actor }
+    }
+    // Installs the login item, then starts the service through it (launchd has usually started it already).
+    const installUnit = async () => {
+      configured()
+      if (!STARTUP_PLATFORMS.includes(platform)) buildStartupAdapter({ platform })
+      const entry = await entrySeam()
+      const manager = await managerSeam()
+      const consent = startupConsent()
+      // A service of an earlier release still running would make the unit's own first start refuse (another runtime
+      // answers): it is stopped as its owner stops it once the consent is recorded, just before the unit is loaded.
+      let replaced = null
+      const beforeInstall = async ({ entryPath }) => {
+        if (runtimeRelease(await serviceStatus(lifecycle, lifecycleRules), entryPath) !== 'outdated') return
+        if ((await stopService(lifecycle, lifecycleRules)).stopped) replaced = 'outdated'
+      }
+      const installed = await installLoginItem({
+        loadProject, dataRoot, env, platform, manager, ownEntry: entry.entryPath, entryArgs: entry.entryArgs ?? [], nodePath: nodePath(), pathValue: env.PATH, clock, beforeInstall,
+        ...(consent === undefined ? {} : { consent }),
+      })
+      if (!installed.installed) {
+        // The earlier release was stopped for nothing: the installed one runs in its place for this session.
+        const service = replaced === null ? null : (({ child: _child, ...result }) => result)(await startService({ ...lifecycle, detached: true, ...entry, replaceOutdated: true }, lifecycleRules))
+        return {
+          exit: EXIT.notSuccess, document: { loginItem: installed, ...(service === null ? {} : { service: { ...service, replaced } }) },
+          human: [`login item not installed: ${installed.reason}${installed.message ? ` (${installed.message})` : ''}`, `Next: ${NEXT[installed.reason] ?? 'see `atelier obsidian status`'}`, ...(service === null ? [] : [`service: ${serviceWords({ ...service, replaced })}`])],
+        }
+      }
+      const remembered = rememberLoginItem('on')
+      const adapterRemembered = rememberAdapter(consent?.actor)
+      const seam = await serviceSeam()
+      const started = (({ child: _child, ...result }) => result)(await startService({ ...lifecycle, detached: true, ...seam, replaceOutdated: true }, lifecycleRules))
+      const service = replaced === null || started.replaced !== undefined ? started : { ...started, replaced }
+      const running = service.state === 'healthy' || service.state === 'busy'
+      return {
+        exit: running ? EXIT.ok : EXIT.notSuccess, document: { loginItem: installed, service, rememberedNow: { loginItem: remembered ? 'on' : null, adapter: adapterRemembered } },
+        human: [
+          `login item installed: ${installed.file}`, `it runs ${installed.entry.path}${installed.entry.source === 'project' ? ', the package installed in this project' : ''}`,
+          ...(platform === 'darwin' ? ['macOS lists it as "node" under Login Items & Extensions, and may say "Background Items Added"'] : []),
+          `service: ${serviceWords(service)}`, ...loginItemLines(service.loginItem),
+          ...(consent !== undefined && flags['consent-actor'] === undefined ? [`Maintenance at login is allowed by ${consent.actor}; recorded for this workspace.`] : []),
+          ...rememberedLines({ adapterRemembered, consent: { source: null } }),
+        ],
+      }
+    }
+    // Removes the login item. A service it ran is stopped as its manager unloads it, and is started again at once as a
+    // process of its own for this session, under the consent now recorded (the service alone), so the vaults stay fresh
+    // until the person logs out. That start needs the adapter, given or remembered; without it, `open` starts it.
+    const removeUnit = async () => {
+      if (!STARTUP_PLATFORMS.includes(platform)) buildStartupAdapter({ platform })
+      const manager = await managerSeam()
+      const removed = await removeLoginItem({ loadProject: locateProject ?? loadProject, dataRoot, env, platform, manager, clock })
+      const failed = removed.removed !== true && removed.reason !== undefined && removed.reason !== 'workspace-not-prepared'
+      if (failed) return { exit: EXIT.notSuccess, document: { loginItem: removed }, human: [`login item not removed: ${removed.reason}${removed.message ? ` (${removed.message})` : ''}`, `Next: ${NEXT[removed.reason] ?? 'see `atelier obsidian status`'}`] }
+      const remembered = removed.reason === 'workspace-not-prepared' ? false : rememberLoginItem('off')
+      let service = null
+      if (removed.removed === true) {
+        let entry = null
+        try { entry = await entrySeam() } catch (error) { if (!isTyped(error)) throw error; service = { state: 'stopped', started: false, reason: error.code } }
+        if (entry !== null) {
+          try { service = (({ child: _child, ...result }) => result)(await startService({ ...lifecycle, detached: true, ...entry, replaceOutdated: true }, lifecycleRules)) } catch (error) {
+            if (!isTyped(error)) throw error
+            service = { state: 'stopped', started: false, reason: error.code }
+          }
+        }
+      }
+      service ??= await serviceStatus(lifecycle, lifecycleRules)
+      const running = ['healthy', 'busy'].includes(service.state)
+      return {
+        exit: EXIT.ok, document: { loginItem: removed, service: { state: service.state, reason: service.reason ?? null, started: service.started === true }, rememberedNow: { loginItem: remembered ? 'off' : null } },
+        human: [
+          removed.removed ? `login item removed: ${removed.file}` : 'no login item was installed', 'the consent now covers the service alone',
+          `service: ${service.state}${running ? (service.started ? ' (started for this session only; it does not start at login)' : '') : `${service.reason ? ` (${service.reason})` : ''}; \`atelier obsidian open\` starts it again`}`,
+        ],
+      }
+    }
+    // The person's answer to "start at login?", remembered for this workspace as the `loginItem` decision of its machine
+    // settings, given on the command line. By whom: the actor named, else a person at a terminal by the account's name,
+    // else nobody known. Answers whether it wrote; an answer already remembered is not written again.
+    const rememberLoginItem = (choice) => {
+      if (readable().enablement.reason === 'not-configured') return false
+      const { workspace, repositoryRoots, now } = writable()
+      const current = machineOf(workspace) ?? defaultMachineSettings({ workspaceId: workspace.workspaceId, updatedAt: now })
+      if (current.decisions.loginItem?.choice === choice) return false
+      const decidedBy = flags['consent-actor'] ?? (interactive ? accountActor(account()) : null)
+      const decided = withDecision(current, 'loginItem', { choice }, { decidedAt: now, decidedBy, via: 'command' })
+      writeMachineSettings({ ...workspace, repositoryRoots, settings: { ...decided, updatedAt: now } })
+      return true
+    }
+    // Where what `uninstall` keeps is: the vaults, the private state, the project file and Obsidian's vault list. The
+    // vaults are those under the data root and every folder allocated to a view where the workspace decided its vaults
+    // live, a view no longer declared included; a record that cannot be read names none.
+    const keptLocations = (project, workspace) => {
+      const vaultsDirectory = workspace === null ? null : path.join(workspace.workspaceRoot, 'vaults')
+      let underDataRoot = []
+      try { underDataRoot = vaultsDirectory === null ? [] : fs.readdirSync(vaultsDirectory, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => path.join(vaultsDirectory, entry.name)) } catch { underDataRoot = [] }
+      const allocated = []
+      if (workspace !== null) {
+        const records = path.join(workspace.workspaceRoot, 'state', 'allocations')
+        let names = []
+        try { names = fs.readdirSync(records).filter((name) => name.endsWith('.json')) } catch { names = [] }
+        for (const name of names) {
+          // Whatever the file is or holds (a link, a FIFO, not JSON, `null`, another view's record), it names a folder only
+          // when it is a valid record of its own view, which the store would read too; nothing here can stop `uninstall`.
+          try {
+            // Read as the store reads a record: a regular file only, never through a link, never a FIFO that would block.
+            const scopeId = JSON.parse(readRegularTextNoFollow(path.join(records, name)))?.scopeId
+            if (typeof scopeId !== 'string' || path.basename(allocationFile(workspace.workspaceRoot, scopeId)) !== name) continue
+            const allocation = readVaultAllocation({ ...workspace, scopeId })
+            if (allocation !== null) allocated.push(allocation.path)
+          } catch { /* a record that cannot be read names no folder */ }
+        }
+      }
+      const vaults = [...new Set([...underDataRoot, ...allocated])].sort()
+      const userDataDir = obsidianUserDataDir({ platform, env })
+      return { vaults, privateState: workspace?.workspaceRoot ?? null, projectFile: project.configPath ?? null, pointer: project.configPath ? localPointerPath(project) : null, obsidianList: userDataDir === null ? null : path.join(userDataDir, OBSIDIAN_SETTINGS_FILE) }
+    }
+
+    // Where a view's vault is, or will be: { path, origin }. A view the next tick will place is shown where it would go,
+    // if that name is still free then (`to-be-allocated`).
+    // A view whose record cannot be read, or was lost, says why, as `status` does, and the other views are still shown.
+    const vaultWhere = (workspace, scopeId, decided, projectName) => {
+      if (workspace === null) return { path: null, origin: 'workspace-not-prepared' }
+      let found
+      try { found = vaultRootFor({ ...workspace, scopeId }) } catch (error) {
+        if (!isTyped(error)) throw error
+        return { path: null, origin: 'unreadable', reason: error.code }
+      }
+      if (found.origin === 'legacy-data-root' && decided !== null && !hasCommittedGeneration({ ...workspace, scopeId })) {
+        return { path: path.join(decided.parent, vaultFolderName({ projectName, scopeId })), origin: 'to-be-allocated' }
+      }
+      return { path: found.path, origin: found.origin }
+    }
+
     const operations = {
       async status() {
         const { project, enablement, workspace, workspaceId } = readable()
@@ -205,25 +719,38 @@ export async function runObsidianCommandForOracleTests(options = {}, rules = {})
         const running = service.state === 'healthy' ? (await readServiceStatusDocument(lifecycle, lifecycleRules)).document : null
         // What the service last learned about the app, and what a person can do about it.
         const app = running?.app ? { ...running.app, next: running.app.outcome === 'qualified' ? null : nextStep(running.app.outcome, running.app.reason) } : null
+        // The login item: its record, what its manager says (asked only when one is recorded), and how its last start ended.
+        const item = workspace === null ? { installed: false, lastStartup: null } : await loginItemStatus({ workspace, manager: () => managerSeam({ required: false }) })
+        const refusedAtLogin = item.lastStartup?.outcome === 'refused' && item.lastStartup.code !== 'service-already-running' && !['healthy', 'busy'].includes(service.state) ? item.lastStartup.code : null
+        const loginItem = { ...item, didNotStart: refusedAtLogin, next: refusedAtLogin === null ? null : LOGIN_ITEM_NEXT[refusedAtLogin] ?? NEXT[refusedAtLogin] ?? 'see `atelier obsidian service status`, and the private log it names' }
         const scopes = workspace === null
           ? enablement.scopes.map(({ scopeId }) => ({ scopeId, outcome: enablement.state === 'disabled' ? 'disabled' : 'not-prepared', reason: enablement.state === 'disabled' ? enablement.reason : 'workspace-not-prepared' }))
           : enablement.scopes.map(({ scopeId }) => {
-            const { vaultRoot: _vault, summary: _summary, ...report } = scopeReport({ workspace, scopeId, repositoryRoots: protectedRoots(project), serviceState: service.state, applyAvailable }, openingRules)
-            const plugin = pluginView(running, workspace, scopeId)
+            const { vaultRoot: _vault, summary: _summary, ...found } = scopeReport({ workspace, scopeId, repositoryRoots: protectedRoots(project), serviceState: service.state, applyAvailable }, openingRules)
+            // A view whose vault the next tick allocates elsewhere says where, not the data root it will not use.
+            const report = found.vault?.origin === 'legacy-data-root' ? { ...found, vault: vaultWhere(workspace, scopeId, machineOf(workspace)?.decisions.location ?? null, projectDisplayName(project)) } : found
+            const plugin = withPluginFilesPending(pluginView(running, workspace, scopeId), report.freshness)
             return enablement.state === 'disabled' ? { ...report, outcome: 'disabled', reason: enablement.reason, next: OPENING_OUTCOMES.disabled.next, plugin } : { ...report, plugin }
           })
+        // The confirmed selection a personal home's project was loaded under; reported, never confirmed here.
+        const pinned = selection === null ? null : selection.personalSelectionOf(project)
         const document = {
+          ...(pinned === null ? {} : { selection: { generationId: pinned.generationId, sequence: pinned.sequence } }),
           enablement: { state: enablement.state, reason: enablement.reason, defaultScopeId: enablement.defaultScopeId }, workspace: { workspaceId, prepared: workspace !== null },
           machine: shownMachine(machineOf(workspace), workspace), apply: applyShown,
           service: { state: service.state, reason: service.reason ?? null, address: service.address ?? null, runtimeId: service.record?.runtimeId ?? null, pid: service.record?.pid ?? null, lastTick: running?.lastTick ?? null, lastError: running?.lastError ?? null, app },
-          app: { probed: false, minimumVersion: MINIMUM_APP_VERSION }, scopes, extensions: registry.extensions.describe(), operations: registry.operations.describe(),
+          loginItem, app: { probed: false, minimumVersion: MINIMUM_APP_VERSION }, scopes, extensions: registry.extensions.describe(), operations: registry.operations.describe(),
         }
         return {
           exit: EXIT.ok, document,
           human: [
+            ...(pinned === null ? [] : [`personal workspace: generation ${pinned.generationId}, confirmed as selection ${pinned.sequence}`]),
             `obsidian: ${enablement.state} (${enablement.reason}); mode ${document.machine.maintenanceMode}; audiences ${document.machine.audienceAllow.join(', ') || 'none'}`,
+            `remembered: ${decisionSummary(document.machine.decisions)}`,
             `service: ${service.state} (${service.reason ?? 'no reason'})${app ? `; app ${app.outcome} (${app.reason})` : ''}`,
             ...(app?.next ? [`Next for the app: ${app.next}`] : []),
+            `login item: ${loginItemWords(loginItem, platform)}`,
+            ...(refusedAtLogin === null ? [] : [`the login item did not start the service: ${refusedAtLogin}`, `Next: ${loginItem.next}`]),
             `apply: ${applyShown.state}`,
             ...scopes.flatMap((scope) => [
               `view ${scope.scopeId}: ${scope.outcome} (${scope.reason})${scope.pendingEdits?.open ? `; ${scope.pendingEdits.open} pending edit(s), apply ${scope.pendingEdits.apply}` : ''}${scope.plugin ? pluginLine(scope.plugin) : ''}`,
@@ -234,6 +761,125 @@ export async function runObsidianCommandForOracleTests(options = {}, rules = {})
         }
       },
 
+      // What this machine remembers for this workspace, and how each answer is changed. Read-only.
+      async settings() {
+        const { workspace, workspaceId } = readable()
+        const { audienceAllow, decisions } = shownMachine(machineOf(workspace), workspace)
+        const service = workspace === null ? null : readServiceSettings(workspace)
+        const consent = service === null ? null : service.consent
+        const document = { workspace: { workspaceId, prepared: workspace !== null }, decisions, audienceAllow, consent, change: DECISION_CHANGES }
+        return {
+          exit: EXIT.ok, document,
+          human: [
+            `who may see: ${decisionWords('audience', decisions.audience, audienceAllow)}`,
+            `where vaults live: ${decisionWords('location', decisions.location)}`,
+            `start at login: ${decisionWords('loginItem', decisions.loginItem)}`,
+            `reaching the app: ${decisionWords('adapter', decisions.adapter)}`,
+            `maintenance allowed by: ${consent === null ? 'nobody yet' : `${consent.actor} (${consent.coverage}, since ${consent.grantedAt})`}`,
+            ...Object.values(DECISION_CHANGES).filter((change) => change !== null).map((change) => `Change: ${change}`),
+          ],
+        }
+      },
+
+      // Where this workspace's vaults live. Deciding it places the vaults of views not published yet; a vault published
+      // already, under the data root or where an earlier decision placed it, stays where it is.
+      async location() {
+        const where = vaultWhere
+        const views = (project, enablement, workspace, decided) => enablement.scopes.map(({ scopeId }) => ({ scopeId, ...where(workspace, scopeId, decided, projectDisplayName(project)) }))
+        const lines = (list) => list.map((view) => `view ${view.scopeId}: ${view.path ?? 'no vault yet'} (${view.origin}${view.reason === undefined ? '' : `: ${view.reason}`})`)
+        if (sub === 'show' || sub === undefined) {
+          const { project, enablement, workspace } = readable()
+          const { decisions } = shownMachine(machineOf(workspace), workspace)
+          const shown = views(project, enablement, workspace, decisions.location)
+          return { exit: EXIT.ok, document: { location: decisions.location, views: shown }, human: [`where vaults live: ${decisionWords('location', decisions.location)}`, ...lines(shown)] }
+        }
+        if (sub !== 'set' || value === undefined) refuse('usage', 'location show | location set DIR [--allow-synced-location]')
+        // `~/` is read against the home folder, which a shell does not do after `--x=`; under the test runner a home
+        // folder is only ever one the test named.
+        const tilde = value === '~' || value.startsWith('~/')
+        if (tilde && typeof homedir !== 'string') refuse('real-vault-location-under-test', 'a location under the home folder is never used under the test runner; name an absolute folder')
+        // Resolved, so a trailing separator (as tab completion leaves it) is no refusal.
+        const parent = tilde ? path.resolve(path.join(homedir, value.slice(1))) : path.resolve(cwd, value)
+        await refuseOnPersonalBinding(loadProject(), 'location set')
+        const { project, enablement, workspace, repositoryRoots, now } = writable()
+        // A record that cannot be read names no folder here; the engine refuses its view on its own.
+        const allocatedPaths = enablement.scopes.map(({ scopeId }) => vaultWhere(workspace, scopeId, null, null)).filter((found) => found.origin === 'allocated').map((found) => found.path)
+        // A folder inside, or holding, a vault the app lists is refused now; when the list cannot be read, it is checked
+        // again, and has to be read, before any vault is allocated there.
+        const list = await appVaultList()
+        const warnings = checkVaultParent({ parent, workspaceRoot: workspace.workspaceRoot, repositoryRoots, vaults: list.vaults, allocatedPaths, allowSynced: flags['allow-synced-location'] === true, homedir: homedir ?? undefined, platform })
+        const appVaultListShown = { source: list.source, ...(list.reason === undefined ? {} : { reason: list.reason }) }
+        const current = machineOf(workspace) ?? defaultMachineSettings({ workspaceId: workspace.workspaceId, updatedAt: now })
+        const decided = withDecision(current, 'location', { parent }, { decidedAt: now, decidedBy: accountActor(account()), via: 'command' })
+        writeMachineSettings({ ...workspace, repositoryRoots, settings: { ...decided, updatedAt: now } })
+        const placed = views(project, enablement, workspace, decided.decisions.location)
+        return {
+          exit: EXIT.ok, document: { location: decided.decisions.location, warnings, appVaultList: appVaultListShown, views: placed, takesEffect: 'next-tick' },
+          human: [
+            `where vaults live: ${parent}; a view's vault is allocated there at its first publication, as "${projectDisplayName(project)} (<view>)"`,
+            ...(warnings.synced === null ? [] : [`Warning: ${warnings.synced} keeps this folder in step with other machines.`]),
+            ...(warnings.protected === null ? [] : [`Warning: macOS asks before Obsidian or the maintenance service may read your ${warnings.protected} folder.`]),
+            ...(list.source === 'unread' ? [`Obsidian's vault list could not be read (${list.reason}); no vault is allocated there until it can be, and it is checked again then.`] : []),
+            ...lines(placed),
+          ],
+        }
+      },
+
+      // One more view in the project's configuration. A person at a terminal sees the change and how many notes the view
+      // would show, and is asked; --yes answers beforehand. Anyone else gets the change made, and shown.
+      async view() {
+        if (sub === 'list' || sub === 'show' || sub === undefined) return operations.scope()
+        if (sub !== 'add' || value === undefined) refuse('usage', 'view add ID (--all | --folder PATH [--folder PATH ...] [--repo R] | --tag T) [--expand DEPTH:MAX] [--default] [--allow-empty] [--yes]')
+        await refuseOnPersonalBinding(loadProject(), 'view add')
+        const { project, workspace, workspaceId } = readable()
+        const repositories = project.repos.filter((repo) => !repo.external && typeof repo.name === 'string').map((repo) => repo.name)
+        const scope = viewFromRequest({ scopeId: value, all: flags.all === true, folders: flags.folder ?? [], repo: flags.repo, tag: flags.tag, expand: flags.expand, repositories })
+        const plan = planViewAdd(project, { scope, makeDefault: flags.default === true })
+        // Counted as this machine decided who may see; while nobody decided, for "only you", the answer offered first,
+        // which shows the notes without a classification too.
+        const machine = machineOf(workspace)
+        const decided = machine?.decisions.audience ?? null
+        const audience = { allow: decided === null ? ONLY_YOU_AUDIENCES : machine.audienceAllow, decided: decided !== null }
+        const { eligibilityFor, onlyYouEligibility } = await import('../runtime/obsidian/pipeline.mjs')
+        const { viewCounts } = await import('../runtime/obsidian/view-counts.mjs')
+        const eligibility = decided === null ? onlyYouEligibility({ project }) : eligibilityFor({ machine, project })
+        const counts = viewCounts({ project, audienceAllow: audience.allow, scope, eligibility, ...(workspaceId === null ? {} : { workspaceId }) })
+        const countLine = viewCountWords(scope.scopeId, counts, audience)
+        // No audience admitted on this machine (`audience clear`): the view is empty whatever it selects, and the way out is
+        // deciding who may see, not classifying notes.
+        const nobody = audience.decided && audience.allow.length === 0 ? '; no audience is admitted on this machine: `atelier obsidian audience set me` admits yours' : ''
+        if (counts.shown === 0 && flags['allow-empty'] !== true) refuse('view-would-be-empty', `${countLine}${nobody}; nothing was written`, { scopeId: scope.scopeId, counts, audience })
+        const file = path.basename(project.configPath)
+        const shownPlan = [
+          `Atelier will add the view "${scope.scopeId}" to ${file}${plan.ignore.needed ? ', and .atelier-local/ to .gitignore' : ''} (you commit it):`,
+          ...plan.diff.trimEnd().split('\n').map((line) => `  ${line}`),
+          countLine,
+        ]
+        const asked = interactive && flags.yes !== true
+        if (asked) {
+          for (const line of shownPlan) stdout(line)
+          const yes = await askGoAhead(questioner(), 'Write this change? [Y/n] ')
+          if (yes === null) refuse('unanswered', 'no answer came; nothing was written')
+          if (!yes) return { exit: EXIT.notSuccess, document: { scope, declined: true, written: [], diff: plan.diff, counts, audience }, human: ['Nothing was written.'] }
+        }
+        const { written } = writeViewPlan(plan)
+        const committed = written.map((item) => path.relative(project.configDir, item).split(path.sep).join('/'))
+        // The counts are for "only you" while nobody decided, but the maintenance service publishes nothing until someone
+        // does: deciding comes first.
+        const openStep = `\`atelier obsidian open${plan.settings.defaultScopeId === scope.scopeId ? '' : ` --scope ${scope.scopeId}`}\` shows it in Obsidian`
+        const next = audience.decided ? [openStep] : ['`atelier obsidian audience set me` lets only you see its notes; until someone decides, the view publishes none', openStep]
+        return {
+          exit: EXIT.ok,
+          document: { scope, defaultScopeId: plan.settings.defaultScopeId ?? null, declined: false, written: committed, diff: plan.diff, counts, audience, next },
+          human: [
+            ...(asked ? [] : shownPlan),
+            `Added the view ${scope.scopeId}${plan.settings.defaultScopeId === scope.scopeId ? ', the default' : ''}. Commit ${committed.join(' and ')} when you are ready; Atelier commits nothing.`,
+            ...(plan.settings.enabled === true ? [] : ['The projection is turned off in this project ("enabled": false), so nothing is published until it is turned on.']),
+            `Next: ${next[0]}`, ...next.slice(1).map((step) => `Then: ${step}`),
+          ],
+        }
+      },
+
       async scope() {
         const { enablement } = readable()
         if (sub === 'list' || sub === undefined) return { exit: EXIT.ok, document: { defaultScopeId: enablement.defaultScopeId, scopes: enablement.scopes }, human: enablement.scopes.map((scope) => `${scope.scopeId}\t${scope.mode}${scope.scopeId === enablement.defaultScopeId ? '\tdefault' : ''}`) }
@@ -245,19 +891,32 @@ export async function runObsidianCommandForOracleTests(options = {}, rules = {})
       async audience() {
         if (sub === 'show' || sub === undefined) {
           const { workspace } = readable()
-          const { audienceAllow } = shownMachine(machineOf(workspace), workspace)
-          return { exit: EXIT.ok, document: { audienceAllow }, human: [audienceAllow.join(', ') || 'no audience is allowed: every view is empty'] }
+          const { audienceAllow, decisions } = shownMachine(machineOf(workspace), workspace)
+          return { exit: EXIT.ok, document: { audienceAllow, choice: decisions.audience?.choice ?? null, unclassified: decisions.audience?.unclassified ?? 'withheld' }, human: [decisionWords('audience', decisions.audience, audienceAllow)] }
         }
-        if (sub !== 'set' && sub !== 'clear') refuse('usage', 'audience show | audience set A,B | audience clear')
-        const audienceAllow = sub === 'clear' ? [] : String(value ?? '').split(',').map((item) => item.trim()).filter((item) => item !== '')
-        if (sub === 'set' && audienceAllow.length === 0) refuse('usage', 'audience set needs at least one audience; `audience clear` allows none')
-        if (audienceAllow.some((item) => !AUDIENCE.test(item)) || new Set(audienceAllow).size !== audienceAllow.length || audienceAllow.length > 64) refuse('invalid-audience', 'audiences are distinct identifiers, at most 64')
+        if (sub !== 'set' && sub !== 'clear') refuse('usage', 'audience show | audience set me|A,B | audience clear')
+        const named = sub === 'clear' ? [] : String(value ?? '').split(',').map((item) => item.trim()).filter((item) => item !== '')
+        if (sub === 'set' && named.length === 0) refuse('usage', 'audience set needs at least one audience; `audience clear` allows none')
+        if (named.some((item) => !AUDIENCE.test(item)) || new Set(named).size !== named.length || named.length > 64) refuse('invalid-audience', 'audiences are distinct identifiers, at most 64')
+        // `me` stands for "only you". Named beside other audiences, it adds its own to theirs, and the list is the person's own choice.
+        const audienceAllow = [...new Set(named.flatMap((item) => (item === 'me' ? ONLY_YOU_AUDIENCES : [item])))]
+        const choice = named.length === 1 && named[0] === 'me' ? 'only-you' : 'custom'
+        await refuseOnPersonalBinding(loadProject(), `audience ${sub}`)
         const { workspace, repositoryRoots, now } = writable()
         const current = machineOf(workspace) ?? defaultMachineSettings({ workspaceId: workspace.workspaceId, updatedAt: now })
-        const changed = JSON.stringify(current.audienceAllow) !== JSON.stringify(audienceAllow)
-        writeMachineSettings({ ...workspace, repositoryRoots, settings: { ...current, audienceAllow, updatedAt: now } })
+        // A vault that is only yours shows the notes that carry no classification too; any other list withholds them.
+        const unclassified = choice === 'only-you' ? 'shown' : 'withheld'
+        const changed = JSON.stringify(current.audienceAllow) !== JSON.stringify(audienceAllow) || (current.decisions.audience?.unclassified ?? 'withheld') !== unclassified
+        const decided = withDecision({ ...current, audienceAllow }, 'audience', { choice, unclassified }, { decidedAt: now, decidedBy: accountActor(account()), via: 'command' })
+        writeMachineSettings({ ...workspace, repositoryRoots, settings: { ...decided, updatedAt: now } })
         // The engine compares a digest of these on every tick: a change invalidates every view at the next one.
-        return { exit: EXIT.ok, document: { audienceAllow, changed, takesEffect: 'next-tick' }, human: [`audiences: ${audienceAllow.join(', ') || 'none'}; views are rebuilt at the next tick`] }
+        return {
+          exit: EXIT.ok, document: { audienceAllow, choice, unclassified, changed, takesEffect: 'next-tick' },
+          human: [
+            `audiences: ${choice === 'only-you' ? `only you (${audienceAllow.join(', ')})` : audienceAllow.join(', ') || 'none'}; notes without a classification ${unclassified}; views are rebuilt at the next tick`,
+            ...(choice === 'only-you' ? [] : ['Notes without a classification are shown only in a vault that is only yours: `atelier obsidian audience set me`.']),
+          ],
+        }
       },
 
       async mode() {
@@ -325,44 +984,58 @@ export async function runObsidianCommandForOracleTests(options = {}, rules = {})
         if (sub === 'start') {
           configured()
           const seam = await serviceSeam()
-          const result = shown(await startService({ ...lifecycle, detached: true, ...seam, ...(consent === undefined ? {} : { consent }) }, lifecycleRules))
+          const consent = consentOfThisRun(seam)
+          const adapterRemembered = rememberAdapter(consent.consent?.actor)
+          const result = shown(await startService({ ...lifecycle, detached: true, ...seam, replaceOutdated: true, ...(consent.consent === undefined ? {} : { consent: consent.consent }) }, lifecycleRules))
+          const recorded = consentRecorded(consent)
           const running = result.state === 'healthy' || result.state === 'busy'
-          return { exit: running ? EXIT.ok : EXIT.notSuccess, document: { service: result }, human: [result.state === 'busy' ? 'running, and busy in a long tick; nothing was started beside it' : `${result.state}${result.started ? ' (started)' : result.alreadyRunning ? ' (already running)' : ` (${result.reason})`}`] }
+          return {
+            exit: running ? EXIT.ok : EXIT.notSuccess,
+            document: { service: result, rememberedNow: { adapter: adapterRemembered, consentActor: recorded.source === 'account' ? recorded.consent.actor : null } },
+            human: [
+              result.state === 'busy' && !result.started ? 'running, and busy in a long tick; nothing was started beside it' : serviceWords(result),
+              ...(result.release === 'later' ? [`Next: ${REASON_NEXT['service-other-release']}`] : []),
+              ...rememberedLines({ adapterRemembered, consent: recorded }), ...loginItemLines(result.loginItem),
+            ],
+          }
         }
         if (sub === 'stop') {
           const result = await stopService(lifecycle, lifecycleRules)
           return { exit: result.refused ? EXIT.notSuccess : EXIT.ok, document: { service: result }, human: [result.refused ? `not stopped: ${result.state} (${result.reason})${result.retry ? '; ask again in a moment' : ''}` : result.stopped ? 'stopped' : `nothing to stop (${result.reason})`] }
         }
-        if (sub !== 'unit' || flags.print !== true) refuse('usage', 'service start | status | stop | unit --print (installing a startup unit is not offered here)')
-        const { project, workspace } = readable()
-        if (workspace === null) refuse('service-workspace-not-prepared', 'this workspace has no private state yet; `service start` prepares it')
-        const seam = await serviceSeam()
-        // Pure text from the builder. Nothing is written, installed or handed to a service manager.
-        const unit = buildStartupAdapter({
-          platform, label: serviceNameFor(workspace.workspaceId), nodePath: process.execPath, entryPath: seam.entryPath, logPath: servicePaths(workspace.workspaceRoot).log,
-          args: [`--project=${project.configPath}`, ...(dataRoot === undefined ? [] : [`--data-root=${dataRoot}`]), ...(seam.entryArgs ?? [])],
-        })
-        return { exit: EXIT.ok, document: { unit, installed: false, note: 'running this unit needs a recorded consent that covers operating-system startup' }, human: [unit.text] }
+        if (sub !== 'unit' || [flags.print, flags.install, flags.remove].filter((flag) => flag === true).length !== 1) refuse('usage', 'service start | status | stop | unit --print | unit --install | unit --remove')
+        if (flags.install === true) return installUnit()
+        if (flags.remove === true) return removeUnit()
+        return printUnit()
       },
 
       async open() {
         const seam = await serviceSeam()
         const app = await appSeams()
         const { appProbe } = app
+        const consent = consentOfThisRun(seam)
+        const adapterRemembered = rememberAdapter(consent.consent?.actor)
         // The view whose plugin may report the app version; an unknown one is refused by open itself.
         const requested = () => { try { return resolveScope(readObsidianEnablement(loadProject()), flags.scope) } catch { return null } }
         const result = await openScopeForOracleTests({
           ...lifecycle, ...app,
           appProbe: typeof appProbe?.inspect === 'function' && typeof appProbe?.vaultState === 'function' ? withPluginReportedVersion(appProbe, async () => { const scopeId = requested(); return scopeId === null ? null : pluginOf(scopeId) }) : appProbe,
-          service: seam, scopeId: flags.scope, consent, allowStale: flags['allow-stale'] === true, extensions: registry.extensions,
+          service: seam, scopeId: flags.scope, consent: consent.consent, allowStale: flags['allow-stale'] === true, restartApp: flags['restart-obsidian'] === true, extensions: registry.extensions,
           ...(flags['wait-ms'] === undefined ? {} : { tickTimeoutMs: Number(flags['wait-ms']) || undefined }), ...(options.open ?? {}),
         }, openingRules, lifecycleRules)
+        const recorded = consentRecorded(consent)
         const { ok: _ok, ...opened } = result
-        const plugin = typeof result.scopeId === 'string' ? await pluginOf(result.scopeId) : null
-        const document = plugin === null ? opened : { ...opened, plugin }
+        const plugin = typeof result.scopeId === 'string' ? withPluginFilesPending(await pluginOf(result.scopeId), result.freshness) : null
+        const rememberedNow = { adapter: adapterRemembered, consentActor: recorded.source === 'account' ? recorded.consent.actor : null }
+        const document = plugin === null ? { ...opened, rememberedNow } : { ...opened, plugin, rememberedNow }
         return {
           exit: result.ok ? EXIT.ok : EXIT.notSuccess, document,
-          human: [`${result.outcome}: ${result.summary}${result.reason ? ` (${result.reason})` : ''}${plugin ? pluginLine(plugin) : ''}`, `Next: ${result.next}`, ...(result.service?.restarted ? [`service: restarted (${result.service.restarted})`] : []), ...(result.duplicates ? [`open in Obsidian as: ${result.duplicates.map((entry) => entry.path).join(', ')}`] : []), ...(result.pendingEdits?.open ? [`${result.pendingEdits.open} pending edit(s); apply ${result.pendingEdits.apply}`] : [])],
+          human: [
+            `${result.outcome}: ${result.summary}${result.reason ? ` (${result.reason})` : ''}${plugin ? pluginLine(plugin) : ''}`, `Next: ${result.next}`, ...(plugin?.files === 'waits-for-app' ? [`Next for the plugin: ${plugin.next}`] : []), ...(result.service?.restarted ? [`service: restarted (${result.service.restarted})`] : []),
+            ...loginItemLines(result.service?.loginItem), ...restartLines(result.restart), ...obsidianSettingsLines(result.obsidianSettings),
+            ...(result.duplicates ? [`open in Obsidian as: ${result.duplicates.map((entry) => entry.path).join(', ')}`] : []), ...(result.pendingEdits?.open ? [`${result.pendingEdits.open} pending edit(s); apply ${result.pendingEdits.apply}`] : []),
+            ...rememberedLines({ adapterRemembered, consent: recorded }),
+          ],
         }
       },
 
@@ -377,9 +1050,9 @@ export async function runObsidianCommandForOracleTests(options = {}, rules = {})
           const scopeId = resolveScope(enablement, flags.scope)
           const choice = writePluginChoice({ ...workspace, scopeId, state: 'requested', reason: 'requested-by-command', clock })
           // The request is recorded either way; a service that cannot be asked leaves it to the view's next publication.
-          // With the installed entry to start (`--adapter`), a service of an earlier release still running after an upgrade
+          // With the installed entry to start (`--adapter`, given or remembered), a service of an earlier release still running after an upgrade
           // is replaced before its tick, under the consent already recorded, as `open` does; without it, it is reported.
-          const replaceable = seams !== null || flags.adapter === PRODUCTION_ADAPTER
+          const replaceable = seams !== null || adapterSelected()
           let asked
           try { asked = await requestServiceTick({ ...lifecycle, scopeId, ...(replaceable ? { service: await serviceSeam() } : {}) }, lifecycleRules) } catch (error) { if (!isTyped(error)) throw error; asked = { requested: false, reason: error.code } }
           const view = asked.tick?.scopes?.find((scope) => scope.scopeId === scopeId) ?? null
@@ -413,6 +1086,36 @@ export async function runObsidianCommandForOracleTests(options = {}, rules = {})
         }
       },
 
+      // Maintenance of this workspace ends here: the login item goes first, so its manager does not start the service
+      // again, then the proven service stops. Everything a person made or may want back stays, and is named.
+      async uninstall() {
+        const project = (locateProject ?? loadProject)()
+        let workspace = null
+        try { const found = resolveServiceWorkspace({ project, dataRoot, env, platform }); workspace = found?.workspaceRoot ? found : null } catch (error) { if (!isTyped(error)) throw error }
+        const record = workspace === null ? null : readLoginItemRecord(workspace)
+        // What is kept is read before anything is stopped or removed, so nothing it finds can stop the answer after that.
+        const kept = keptLocations(project, workspace)
+        const item = record === null ? { removed: false, reason: 'not-installed' } : await removeLoginItem({ loadProject: locateProject ?? loadProject, dataRoot, env, platform, manager: await managerSeam(), clock })
+        const service = workspace === null ? { state: 'stopped', stopped: false, refused: false, reason: 'workspace-not-prepared' } : await stopService(lifecycle, lifecycleRules)
+        const itemGone = item.removed === true || item.reason === 'not-installed' || item.reason === 'workspace-not-prepared'
+        const serviceGone = service.stopped === true || service.state === 'stopped'
+        const remembered = workspace !== null && itemGone ? rememberLoginItem('off') : false
+        return {
+          exit: itemGone && serviceGone ? EXIT.ok : EXIT.notSuccess,
+          document: { loginItem: item, service, kept, rememberedNow: { loginItem: remembered ? 'off' : null } },
+          human: [
+            `login item: ${item.removed ? `removed (${item.file})` : item.reason === 'not-installed' || item.reason === 'workspace-not-prepared' ? 'none was installed' : `not removed (${item.reason})`}`,
+            `service: ${service.stopped ? 'stopped' : service.refused ? `not stopped: ${service.state} (${service.reason})` : `not running (${service.reason})`}`,
+            ...(itemGone && serviceGone ? [] : [`Next: ${!itemGone ? NEXT[item.reason] ?? 'run `atelier obsidian uninstall` again' : service.retry ? 'run `atelier obsidian uninstall` again in a moment' : 'see `atelier obsidian service status`'}`]),
+            'Kept as they are:',
+            ...kept.vaults.map((vault) => `  vault           ${vault}`),
+            ...(kept.privateState === null ? [] : [`  private state   ${kept.privateState}`]),
+            `  project file    ${kept.projectFile ?? '(none)'}; its Obsidian settings stay`,
+            ...(kept.obsidianList === null ? [] : [`  Obsidian's list ${kept.obsidianList}; the vaults stay in it`]),
+          ],
+        }
+      },
+
       // The placeholder that answers when no contribution registered an apply operation; the shipped source-apply contribution replaces it.
       async apply() {
         return refuse(APPLY_UNAVAILABLE, 'no apply operation is registered; pending edits stay preserved and queued', { operationId: registry.extensions.applyOperation().id })
@@ -424,6 +1127,8 @@ export async function runObsidianCommandForOracleTests(options = {}, rules = {})
     // One option table serves every operation. No built-in operation has a use for an actor, and a contributed one takes
     // it only when it declares so (`options: ['actor']`); the apply operation then decides which of its verbs takes it.
     if (flags.actor !== undefined && !(Array.isArray(contributed?.options) && contributed.options.includes('actor'))) refuse('usage', '--actor belongs to `apply run`; this operation does not take it')
+    // Stopping the person's app is asked for one run of `open`, by name, and by nothing else.
+    if (flags['restart-obsidian'] === true && operationName !== 'open') refuse('usage', '--restart-obsidian belongs to `open`; this operation does not take it')
     const result = contributed !== null
       ? await contributed.run({ args: positionals.slice(1), flags: { ...flags }, registry, loadProject, dataRoot, env, platform, clock, readable, writable })
       : await operations[operationName]()
@@ -436,6 +1141,8 @@ export async function runObsidianCommandForOracleTests(options = {}, rules = {})
     }
     const next = NEXT[error.code] ?? error.hint ?? 'see `atelier obsidian status`'
     return emit({ exit: EXIT.refused, document: { error: { code: error.code, message: plainMessage(error), next, detail: error.detail ?? {} } }, human: [`[${error.code}] ${plainMessage(error)}`, `Next: ${next}`] })
+  } finally {
+    questions?.close()
   }
 }