create-evda 0.1.5 → 0.1.6

package/lib/doctor.mjs

@@ -39,27 +39,64 @@
 // `evda access workshop --as iris.atlas` on the same record: ALLOWED, exit 0, naming the grant
 // file; `evda access core --as iris.atlas`: REFUSED, exit 2, "no circle named "core"".
 
+// FALSIFIED 2026-09-22, section 10a and the mount-root line of section 11 (HQ-835), by
+// test/mounts.test.mjs: mountProblems made to return no problems and the stray-file line disabled ->
+// doctor exited 0 on a record holding mounts/ava.atlas/stray.md in no held circle, and on a home
+// circle claiming mounts/ava.atlas/shared-with-ben/01_Projects; three of four tests failed. Restored,
+// the same records print "FAIL  mounts  1 file(s) under the mount root mounts that no held circle
+// covers: mounts/ava.atlas/stray.md" and exit 1.
+
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";
 import { readManifest, checkVersion, unknownKeys, unknownLayers, holderOf, holderProblems, KNOWN_LAYERS, SCHEMA_VERSION } from "./manifest.mjs";
 import { readGrants } from "./grants.mjs";
-import { resolveAll, resolveRole, rolesForLayer, ROLES } from "./roles.mjs";
+import { readDevices } from "./devices.mjs";
+import { resolveAll, resolveRole, rolesForLayer, ROLES, FOUR_ROLES, fourRoles } from "./roles.mjs";
+import { subRecords, boundaries } from "./records.mjs";
+import { folderEfforts } from "./work.mjs";
+import { isBounded, SUBRECORD_MODES } from "./manifest.mjs";
 import { parseLedger, countHeads } from "./ledger.mjs";
 import { validateEntries } from "./validate.mjs";
 import { deriveDue, currentIndex, currentDigest } from "./index.mjs";
 import { mdFiles, fileDate } from "./record.mjs";
 import { splitFence, digestFrom, digestBytes, DIGEST_BUDGET } from "./agents.mjs";
-import { readCircles, coverage, LEGACY_MANIFEST } from "./circles.mjs";
+import { readCircles, coverage, released, mountProblems, markdownFiles, LEGACY_MANIFEST, SEALED, MARK, sealedSections } from "./circles.mjs";
+import { parseReaders, describeReaders, frontOf, NOTED, READ_BY } from "./readers.mjs";
+import { renderViews } from "./render.mjs";
+import { planBeside } from "./circle-plan.mjs";
+import { excluder, walk } from "./sync-rules.mjs";
 import { folderManifests, folderFor, viewNamedIn, FOLDER_MANIFEST } from "./folders.mjs";
 import { referencesIn } from "./references.mjs";
 import { KIND_FOR_TYPE, PERSON_KINDS, entryFromFile, readEntry } from "./kinds.mjs";
+import { datedHeadings } from "./migrate-people.mjs";
 import { EvdaError } from "./errors.mjs";
+import { hookStatus, promptHookStatus, HOOK_REL, PROMPT_HOOK_REL, SETTINGS_REL } from "./hooks.mjs";
+import { FILING_MODES, filingOf } from "./day-file.mjs";
+import { listSkills, SKILLS_REL } from "./skills.mjs";
+import { guardStatus } from "./connect.mjs";
+
+// The dated sections of a person-profile that no observation covers (HQ-1397). An observation
+// covers a section when its text is the heading's exactly, or else when it carries the heading's
+// date as its `since`: a reworded observation ("2026-09-22 evening, ..." for "2026-09-22, evening:
+// ...") still counts. Each observation covers one section, so two sections on one day need two.
+export function uncoveredSections(headings, observations) {
+  const free = [...observations];
+  const take = (i) => free.splice(i, 1);
+  const rest = headings.filter((h) => {
+    const i = free.findIndex((o) => o.text === h.text);
+    return i === -1 ? true : (take(i), false);
+  });
+  return rest.filter((h) => {
+    const i = free.findIndex((o) => String(o.since) === h.since);
+    return i === -1 ? true : (take(i), false);
+  });
+}
 
 // Same rule as record.mjs fileDate: a daily file is dated by a leading YYYY-MM-DD in its name.
 // A suffix after the date is allowed (`2026-01-19 - The Scale Question.md`); no date is not.
 const DAILY_NAME = /^\d{4}-\d{2}-\d{2}(?:[ .-]|$)/;
 
-export function doctor(dir, { out = console.log, via = "argument" } = {}) {
+export function doctor(dir, { out = console.log, via = "argument", depth = 0 } = {}) {
   const failures = [];
   const warnings = [];
   const checked = [];
@@ -127,7 +164,10 @@ export function doctor(dir, { out = console.log, via = "argument" } = {}) {
   const mappedKnown = roles.filter((r) => r.mapped && r.known);
   for (const r of roles) {
     if (!r.known) continue;
+    // The four roles are listed by 4b; an absent one is said there, once.
+    if (!r.mapped && ROLES[r.role]?.four) continue;
     if (!r.mapped) { out(`        ${r.role.padEnd(16)} absent (not in mapping)`); continue; }
+    if (r.kind === "source") { out(`        ${r.role.padEnd(16)} -> ${r.source.source}${r.source.project ? ` project ${r.source.project}` : " (projects by vault_path)"}  a live source`); continue; }
     if (r.kind === "file") {
       if (!r.exists) { fail(`role ${r.role}`, `is mapped to ${r.rel} but that file does not exist.`); continue; }
       if (r.isDir) { fail(`role ${r.role}`, `is mapped to ${r.rel} which is a directory, not a file.`); continue; }
@@ -142,7 +182,40 @@ export function doctor(dir, { out = console.log, via = "argument" } = {}) {
     out(`        ${r.role.padEnd(16)} -> ${r.rel}  ${detail}`);
     if (r.file && !r.fileExists) fail(`role ${r.role}`, `${r.fileRel} does not exist. The ledger role is mapped, so its file must be there.`);
   }
-  ok(mappedKnown.length, "roles", `${mappedKnown.length} mapped, ${roles.filter((r) => r.known && !r.mapped).length} absent`);
+  ok(mappedKnown.length, "roles", `${mappedKnown.length} mapped, ${roles.filter((r) => r.known && !r.mapped && !ROLES[r.role]?.four).length} absent`);
+
+  // 4a. sub-records (Spec 07 section 2, HQ-1371): every evda.json below the root starts a record of
+  // its own. Found here so the four roles and the circles below know where this record stops; each
+  // is walked as its own record at the end.
+  if (manifest.subrecords !== undefined && !SUBRECORD_MODES.includes(manifest.subrecords)) fail("evda.json", `"subrecords" is ${JSON.stringify(manifest.subrecords)}; the one value is "bounded", and absent means this record's circles still cover its sub-records' files.`);
+  const subs = subRecords(dir);
+  const bounded = isBounded(manifest);
+
+  // 4b. the four roles (Spec 07 section 2, "Four roles, at every scale", HQ-1371): journal, work,
+  // collections, knowledge, each filled by one or more paths, or for work a live source. A missing
+  // path, one path in two roles, a path inside a sub-record and a source this tool cannot read fail.
+  const four = fourRoles(evda, { subRecords: subs });
+  for (const p of four.problems) fail("evda.json four roles", p);
+  if (four.declared.length === 0) {
+    skip("four roles", `none of ${FOUR_ROLES.join(", ")} is in the mapping; record/daily, record/captures, record/people and ledger count toward them when present`);
+  } else {
+    for (const role of FOUR_ROLES) {
+      const es = four.roles[role];
+      if (!es.length) { out(`        ${role.padEnd(12)} absent`); continue; }
+      out(`        ${role.padEnd(12)} ${es.map((e) => (e.source ? `${e.source.source}:${e.source.project ?? ""} (live)` : `${e.rel}${e.key === role ? "" : ` [${e.key}]`}`)).join(", ")}`);
+    }
+    ok(four.declared.length, "four roles", `${four.declared.join(", ")}${four.declared.length < 4 ? `; absent: ${FOUR_ROLES.filter((r) => !four.declared.includes(r)).join(", ")}` : ""}`);
+    // Work read from a folder is checked here, offline. A live source is read by `evda work`, which
+    // doctor does not call: doctor runs where there is no network and no board key.
+    for (const e of four.roles.work) {
+      if (e.source) { skip(`efforts from ${e.source.source}`, "a live source; `evda work` reads it and prints CHECKED <n> efforts"); continue; }
+      const r = folderEfforts(evda, e);
+      for (const p of r.problems) fail("work", p);
+      if (r.status === "failed") fail("work", r.why);
+      else if (r.efforts.length === 0 && r.problems.length === 0) skip(`efforts in ${e.rel}`, "the work folder holds no effort file yet");
+      else if (r.efforts.length) ok(r.efforts.length, "efforts", `in ${e.rel}`);
+    }
+  }
 
   // 5. operating layer, a mapped role like the others. Only a record with none is a failure.
   const agentsRole = resolveRole(evda, "agents");
@@ -175,6 +248,45 @@ export function doctor(dir, { out = console.log, via = "argument" } = {}) {
     ok(1, "operating layer", rel);
   }
 
+  // 5b. the keep-record Stop hook (HQ-1376): whether a Claude Code session opened here is asked to
+  // file before it stops. Reported, never required; only a registered hook with a missing or stale
+  // file is a warning, because that is a hook that does not do what the settings say.
+  const hook = hookStatus(dir);
+  if (hook.problem) warn(SETTINGS_REL, hook.problem);
+  else if (hook.registered && !hook.file) warn(SETTINGS_REL, `registers the keep-record Stop hook, but ${HOOK_REL} is missing, so every stop runs a file that is not there. \`evda hook install\` restores it.`);
+  else if (hook.registered && !hook.current) warn(HOOK_REL, "differs from the hook this tooling ships. `evda hook install` updates it.");
+  else if (hook.registered) ok(1, "keep-record Stop hook", `${SETTINGS_REL} runs ${HOOK_REL}, current`);
+  else skip("keep-record Stop hook", `not installed. A Claude Code session here is not asked to file before it stops; \`evda hook install\` adds it to ${SETTINGS_REL}.`);
+
+  // 5b2. filing (HQ-1385): the owner's one answer on whether their words are filed without being
+  // asked, read by every agent and hook. A value none of them knows fails; no answer yet is a skip,
+  // because the agent asks at first connect.
+  if (manifest.filing !== undefined && !FILING_MODES.includes(manifest.filing)) fail("evda.json", `"filing" must be ${FILING_MODES.map((m) => JSON.stringify(m)).join(" or ")}, got ${JSON.stringify(manifest.filing)}. Every agent and hook reads it, and one none of them knows is read as no answer.`);
+  else if (manifest.filing) ok(1, "filing", `evda.json says "${manifest.filing}": ${manifest.filing === "everything" ? "every message the owner sends is filed without being asked" : "their words are filed only when they ask"}`);
+  else skip("filing", "evda.json has no answer yet. The agent asks the owner once, at first connect, and records it with evda_filing.");
+
+  // 5b3. the prompt hook (HQ-1385): a UserPromptSubmit hook that files each message, for an owner
+  // who chose everything. Installed and current is a check; installed while filing says otherwise
+  // warns, because it then files nothing and the settings say it does.
+  const prompt = promptHookStatus(dir);
+  const everything = filingOf(manifest) === "everything";
+  if (prompt.problem) { /* the settings file's problem is reported once, above */ }
+  else if (prompt.registered && !prompt.file) warn(SETTINGS_REL, `registers the prompt hook, but ${PROMPT_HOOK_REL} is missing, so every message runs a file that is not there. \`evda hook install\` restores it.`);
+  else if (prompt.registered && !prompt.current) warn(PROMPT_HOOK_REL, "or a file copied beside it differs from what this tooling ships. `evda hook install` updates them.");
+  else if (prompt.registered && !everything) warn(SETTINGS_REL, `registers the prompt hook, but evda.json does not say "filing": "everything", so it files nothing.`);
+  else if (prompt.registered) ok(1, "prompt hook", `${SETTINGS_REL} runs ${PROMPT_HOOK_REL}, current: each message the owner sends is filed verbatim`);
+  else skip("prompt hook", everything ? `not installed. \`evda hook install\` adds it, and each message the owner sends in Claude Code is filed before the model sees it.` : `installed only for an owner whose evda.json says "filing": "everything".`);
+
+  // 5c. the read guard (HQ-1374), the other hook create-evda installs for a Claude owner (HQ-1377):
+  // a PreToolUse hook in the record's own settings that stops a Claude Code session reading a noted
+  // entry. Reported present or missing, like the Stop hook above; a registered guard whose file is
+  // gone warns, because every read then runs a command that is not there.
+  const guard = guardStatus(dir);
+  if (guard.problem) warn(SETTINGS_REL, guard.problem);
+  else if (guard.registered && !guard.file) warn(SETTINGS_REL, `registers the read guard, but ${guard.target} is missing, so Claude Code cannot run it and a noted entry is not held back there. \`evda hook install\` restores it.`);
+  else if (guard.registered) ok(1, "read guard", `${SETTINGS_REL} runs ${guard.target ?? "the evda guard through npx"} before Read, Grep and shell reads`);
+  else skip("read guard", `not installed. A Claude Code session here is not stopped before reading a just-noted entry (the MCP server still holds it back); \`evda hook install\` adds it to ${SETTINGS_REL}.`);
+
   // 6. record files
   const recordRoles = mappedKnown.filter((r) => r.layer === "record" && r.exists && r.isDir);
   if (recordRoles.length === 0) {
@@ -265,22 +377,60 @@ export function doctor(dir, { out = console.log, via = "argument" } = {}) {
       fail(circlesRole.rel, e.code);
       return finish(e.exit ?? 1);
     }
+    const circleNames = new Set(circles.map((c) => c.name));
     for (const c of circles) {
       for (const p of c.problems) (p.level === "fail" ? fail : warn)(`circle ${c.name}`, p.message);
-      const members = Object.entries(c.members).map(([n, m]) => `${n} -> ${m.kind === "path" ? m.rel : `table ${m.table}`}`).join(", ");
+      // A release list names circles; one the record does not have is a boundary that points at nothing.
+      for (const n of Array.isArray(c.release) ? c.release : []) if (!circleNames.has(n)) fail(`circle ${c.name}`, `release names "${n}", and this record has no such circle.`);
+      const members = Object.entries(c.members).map(([n, m]) => `${n} -> ${m.kind === "path" ? m.rel : m.kind === "table" ? `table ${m.table}` : m.kind === "render" ? `render ${m.view} at ${m.rel}` : `where ${JSON.stringify(m.where)}`}`).join(", ");
       const policy = c.policy ? `, policy: ${c.policy.rules.length} rule(s)` : "";
-      out(`        ${c.name.padEnd(16)} ${c.manifest?.public === true ? "public" : "private"}  ${c.readable ? "readable" : "not readable"}${c.source === LEGACY_MANIFEST ? "  (circle.json)" : ""}${members ? `  [${members}]` : ""}${policy}`);
+      const release = c.manifest?.public === true ? "" : `  release: ${Array.isArray(c.release) ? c.release.join(",") : c.release}`;
+      out(`        ${c.name.padEnd(16)} ${c.manifest?.public === true ? "public" : "private"}  ${c.readable ? "readable" : "not readable"}${release}${c.source === LEGACY_MANIFEST ? "  (circle.json)" : ""}${members ? `  [${members}]` : ""}${policy}`);
     }
+    // 10a. mounts (HQ-835): circles held from other holders, each in its own subfolder under the
+    // mounts role, none nested, none claimed by a home circle.
+    const mounts = mountProblems(evda, circles);
+    for (const p of mounts.problems) fail("mounts", p);
+    if (mounts.held === 0) skip("mounts", `no circle held from another holder${mounts.root ? ` (mount root ${mounts.root})` : ""}`);
+    else ok(mounts.held, "mounts", `${mounts.held} circle(s) held from ${mounts.owners} other holder(s), ${mounts.root ? `under ${mounts.root}, one subfolder each` : "no mounts role, one per owner"}`);
+
     if (circles.length === 0) skip("circles", `${circlesRole.rel} holds no circle directories`);
     else ok(circles.length, "circles", `${circles.filter((c) => c.readable).length} public and readable, ${circles.filter((c) => c.manifest?.public === false).length} private, ${circles.filter((c) => c.policy).length} with a policy${circles.some((c) => c.source === LEGACY_MANIFEST) ? `, ${circles.filter((c) => c.source === LEGACY_MANIFEST).length} still on circle.json` : ""}`);
 
     // 11. every entry resolves to exactly one circle (Spec 07, section 3). Zero is an entry nobody
     // can say who may read; two is an entry with two access answers, which an encryption boundary
-    // cannot have.
+    // cannot have. The entries are EVERY file under the record, by the same walk `evda circles check`
+    // and the sync scan use (sync-rules.mjs, minus the plan's excludes when a plan sits beside the
+    // circles), not only the record roles and the ledger (HQ-1364): a file written at the root that
+    // no circle covered passed this section for a day while the sync scan skipped it.
     if (circles.length > 0) {
+      let beside = null;
+      try {
+        beside = planBeside(evda);
+      } catch (e) {
+        fail("circles", e.message);
+      }
+      // A bounded record's circles stop at its sub-records, so their files are not this record's
+      // entries; each sub-record's doctor covers its own. Unbounded, they are covered here as before.
+      const exclude = excluder([...(beside?.plan?.exclude ?? []), ...boundaries(evda)]);
+      if (subs.length && !bounded) skip("sub-record boundary", `${subs.length} sub-record(s) (${subs.slice(0, 3).join(", ")}${subs.length > 3 ? ", ..." : ""}), and this record does not declare "subrecords": "bounded", so its circles still cover their files as its own and sync sends them so`);
+      else if (subs.length) {
+        for (const c of circles) for (const [name, m] of Object.entries(c.members)) {
+          if (m.kind !== "path" || m.rel === "") continue;
+          const rel = m.rel.replace(/\/+$/, "");
+          const inside = subs.find((s) => rel === s || rel.startsWith(`${s}/`));
+          if (inside !== undefined) fail(`circle ${c.name}`, `member "${name}" (${rel}) is inside the sub-record at ${inside}. A bounded record's circles stop there; hold the sub-record's circle through a mount instead.`);
+        }
+        ok(subs.length, "sub-record boundaries", `this record's circles stop at ${subs.join(", ")}`);
+      }
       const entries = [];
-      for (const r of mappedKnown.filter((x) => x.layer === "record" && x.exists && x.isDir)) entries.push(...mdFiles(r.abs));
-      if (ledgerRole.mapped && ledgerRole.fileExists) entries.push(ledgerRole.file);
+      const unsyncable = [];
+      let excluded = 0;
+      for (const e of walk(dir, { exclude })) {
+        if (e.kind === "excluded") excluded += 1;
+        else if (e.kind === "file") entries.push(join(dir, e.rel));
+        else unsyncable.push(e);
+      }
       if (entries.length === 0) {
         skip("entries across circles", "the record has no entries to cover");
       } else {
@@ -288,11 +438,131 @@ export function doctor(dir, { out = console.log, via = "argument" } = {}) {
         const none = cov.filter((c) => c.circles.length === 0);
         const many = cov.filter((c) => c.circles.length > 1);
         const show = (list) => list.slice(0, 5).map((c) => relative(dir, c.abs)).join(", ") + (list.length > 5 ? ", ..." : "");
-        if (none.length) fail("circles", `${none.length} entr${none.length === 1 ? "y" : "ies"} no circle covers: ${show(none)}. Every entry resolves to exactly one circle; a private circle whose members cover the rest of the record is the usual answer.`);
-        if (many.length) fail("circles", `${many.length} entr${many.length === 1 ? "y" : "ies"} covered by more than one circle: ${many.slice(0, 5).map((c) => `${relative(dir, c.abs)} (${c.circles.join(", ")})`).join(", ")}${many.length > 5 ? ", ..." : ""}. One access answer per entry.`);
-        ok(entries.length, "entries", `across ${circles.length} circles, ${none.length} uncovered, ${many.length} covered twice`);
+        if (none.length) fail("circles", `${none.length} entr${none.length === 1 ? "y" : "ies"} no circle covers: ${show(none)}. Every entry resolves to exactly one circle; a private circle whose member is the record root ("") is the usual answer.`);
+        // A file under the mount root belongs to a circle held from another holder, or it is a file
+        // of this record placed where only held circles go, which the root circle would otherwise
+        // sync as its own.
+        if (mounts.root !== null) {
+          const heldNames = new Set(circles.filter((c) => c.mount).map((c) => c.name));
+          const stray = cov.filter((c) => { const rel = relative(dir, c.abs); return rel.startsWith(`${mounts.root}/`) && !c.circles.some((n) => heldNames.has(n)); });
+          if (stray.length) fail("mounts", `${stray.length} file(s) under the mount root ${mounts.root} that no held circle covers: ${show(stray)}. Only circles held from other holders live there.`);
+        }
+        if (many.length) fail("circles", `${many.length} entr${many.length === 1 ? "y" : "ies"} covered by more than one circle at the same depth: ${many.slice(0, 5).map((c) => `${relative(dir, c.abs)} (${c.circles.join(", ")})`).join(", ")}${many.length > 5 ? ", ..." : ""}. One access answer per entry.`);
+        for (const u of unsyncable) warn("circles", `${u.rel} is a ${u.kind}, which sync never carries; \`evda circles check\` fails on it until the plan excludes it or it is replaced.`);
+        ok(entries.length, "entries", `across ${circles.length} circles, ${none.length} uncovered, ${many.length} covered twice; the whole record, ${excluded} excluded${beside ? ` (plan: ${beside.path})` : " (no plan beside the circles)"}`);
       }
+
+      // 11a. the released set (Spec 07 section 3, HQ-1351): for every circle with a rule member, each
+      // file released into it from its home circle, one line per file, every run; for the public
+      // circle its whole set, paths and tables too, so it cannot grow quietly. A file a rule matches
+      // that its home does not release to this circle is a failure here and refuses a publish.
+      const gathered = released(evda, circles);
+      if (gathered.length === 0) {
+        skip("released", "no public circle and no circle with a rule member in this record");
+      } else {
+        for (const r of gathered) {
+          // Views (HQ-1351): a public circle's render members draw from the released entries that
+          // name them. One line per rendered view saying how many it drew from, then those entries
+          // under it; the entries that name no view are listed as themselves. Every problem the
+          // renderer finds is a FAIL here, and the same problem refuses a publish.
+          const circle = circles.find((c) => c.name === r.circle);
+          const rendered = r.public && circle ? renderViews(evda, circle, r) : { views: [], loose: [...r.byPath, ...r.byRule], problems: [] };
+          const consumed = new Set(rendered.views.flatMap((v) => v.entries.map((e) => e.path)));
+          for (const f of r.byPath) if (!consumed.has(f.path)) out(`        path  ${f.path}  (${r.circle}.${f.member})`);
+          for (const f of r.byRule) if (!consumed.has(f.path)) out(`        rule  ${f.path}  (released from ${f.circle} into ${r.circle}.${f.member})`);
+          for (const v of rendered.views) {
+            out(`        view  ${v.path}  rendered from ${v.entries.length} entries  (${r.circle}.${v.member}, ${v.shape} "${v.view}")`);
+            for (const e of v.entries) out(`          rule  ${e.path}  (released from ${e.home} into ${r.circle}, ${v.view} #${e.order})`);
+          }
+          for (const t of r.tables) out(`        table ${t.table} where ${Object.entries(t.where).map(([k, v]) => `${k}=${JSON.stringify(v)}`).join(", ")}  (${r.circle}.${t.member})`);
+          for (const f of r.refused) fail("released", `${f.path} matches a rule of "${r.circle}" and is refused: ${f.reason}.`);
+          for (const p of rendered.problems) fail("released", `${p.path} ${p.message}`);
+          const drawn = rendered.views.reduce((k, v) => k + v.entries.length, 0);
+          const n = r.byPath.length + r.byRule.length + r.tables.length;
+          const views = rendered.views.length ? `, ${rendered.views.length} rendered from ${drawn} entries` : "";
+          if (r.public && circle) {
+            // Provenance (HQ-1367): every derived entry names its sources and date, checked by the
+            // renderer above (a malformed pair is a FAIL there). Here, one line per derived entry,
+            // and which of its sources changed since, which is what the publish pass re-derives.
+            const derived = rendered.views.flatMap((v) => v.entries.filter((e) => e.provenance));
+            for (const e of derived) out(`        derived  ${e.path}  from ${e.provenance.from.length} source(s) on ${e.provenance.at}${e.provenance.changed.length ? `; changed since: ${e.provenance.changed.join(", ")}` : ""}`);
+            const entries = rendered.views.reduce((k, v) => k + v.entries.length, 0);
+            if (derived.length === 0) skip(`derived entries in ${r.circle}`, `none of its ${entries} view entries carries ${"derived_from"} yet`);
+            else ok(derived.length, "derived entries", `${r.circle}: ${derived.filter((e) => e.provenance.changed.length).length} with a source changed since, ${entries - derived.length} not derived`);
+          }
+          if (!r.public && n === 0) skip(`released into ${r.circle}`, `its rule(s) match nothing yet${r.refused.length ? `, ${r.refused.length} refused` : ""}`);
+          else ok(n, "released", `${r.circle}: ${r.byPath.length} by path, ${r.byRule.length} by rule, ${r.tables.length} table, ${r.refused.length} refused${views}`);
+        }
+      }
+    }
+  }
+
+  // 10b. readers (HQ-1374): which AI reads each part, from read_by on each circle and on evda.json,
+  // printed as a fact per part ("Read by: ..."), never as a promise (Spec 06, "The call on
+  // phrasing"). A read_by that does not parse fails, because a reader nobody can read is refused by
+  // every agent that checks it. A read_by on a public circle is a warning: everyone reads it.
+  {
+    const knownCircles = circlesRole.mapped && circlesRole.exists && circlesRole.isDir ? (() => { try { return readCircles(evda) ?? []; } catch { return []; } })() : [];
+    const record = parseReaders(manifest[READ_BY], "read_by");
+    for (const p of record.problems) fail("evda.json", p);
+    let stated = record.readers !== null ? 1 : 0;
+    let inherit = 0;
+    let unstated = 0;
+    if (record.readers !== null || knownCircles.length === 0) out(`        ${"the record".padEnd(16)} Read by: ${describeReaders(record.problems.length ? null : record.readers)}${knownCircles.length ? "  (every part without its own)" : ""}`);
+    for (const c of knownCircles) {
+      const isPublic = c.manifest?.public === true;
+      const own = parseReaders(c.manifest?.[READ_BY], "read_by");
+      if (isPublic && own.readers !== null) warn(`circle ${c.name}`, "read_by is set on a public circle. Everyone may read it, so the reader says nothing; ignored.");
+      for (const p of own.problems) fail(`circle ${c.name}`, p);
+      if (isPublic) { out(`        ${c.name.padEnd(16)} Read by: ${describeReaders(null, { isPublic: true })}`); stated += 1; continue; }
+      if (own.readers !== null) { stated += 1; out(`        ${c.name.padEnd(16)} Read by: ${describeReaders(own.problems.length ? null : own.readers)}`); continue; }
+      if (record.readers !== null) { inherit += 1; out(`        ${c.name.padEnd(16)} Read by: ${describeReaders(record.readers)}  (from evda.json)`); continue; }
+      unstated += 1;
+      out(`        ${c.name.padEnd(16)} Read by: ${describeReaders(null)}`);
+    }
+    if (stated + inherit === 0) skip("readers", "no circle and no evda.json says who reads it; whatever AI opens the record reads what it opens");
+    else ok(stated + inherit, "readers", `${stated} stated, ${inherit} from evda.json, ${unstated} not stated`);
+
+    // 10c. just-noted entries: read by no AI until their owner releases them. `noted` is true or
+    // absent; any other value is a flag no agent can be sure of, so it fails.
+    const md = markdownFiles(dir);
+    let noted = 0;
+    for (const abs of md) {
+      const front = frontOf(abs);
+      if (!front || front[NOTED] === undefined) continue;
+      if (front[NOTED] === true) { noted += 1; continue; }
+      if (front[NOTED] !== false) fail(relative(dir, abs), `"${NOTED}" is ${JSON.stringify(front[NOTED])}. It is true (just noted, read by no AI) or absent.`);
+    }
+    if (noted === 0) skip("noted entries", `none of ${md.length} markdown file(s) is just noted`);
+    else ok(noted, "noted entries", `read by no AI until their owner releases them; searchable on this device with \`evda search\``);
+
+    // 10d. sealed (HQ-1220): nothing but the owner's own devices opens it. `sealed` is true or
+    // absent, as noted is. A sealed file never carries a share mark, whether or not a rule matches
+    // it, since no mark releases it and a mark that says otherwise misleads its owner. A sealed
+    // fence that never closes seals to the end of its file, and fails so the owner sees it.
+    let sealedFiles = 0;
+    let sections = 0;
+    let sectioned = 0;
+    for (const abs of md) {
+      const rel = relative(dir, abs);
+      const front = frontOf(abs);
+      if (front && front[SEALED] !== undefined) {
+        if (front[SEALED] === true) {
+          sealedFiles += 1;
+          if (front[MARK] !== undefined) fail(rel, `is sealed and carries ${MARK}: ${Array.isArray(front[MARK]) ? front[MARK].join(", ") : String(front[MARK])}. No mark releases a sealed entry; take off the mark, or the seal.`);
+        } else if (front[SEALED] !== false) fail(rel, `"${SEALED}" is ${JSON.stringify(front[SEALED])}. It is true (sealed: only you open it, on your own devices) or absent.`);
+      }
+      let text;
+      try { text = readFileSync(abs, "utf8"); } catch { continue; }
+      const found = sealedSections(text);
+      if (!found.length) continue;
+      sections += found.length;
+      sectioned += 1;
+      const open = found.filter((x) => !x.closed);
+      if (open.length) fail(rel, `has a sealed section that is never closed (line ${open[0].start + 1}), so everything after it is sealed. Close it with a fence like the one that opens it.`);
     }
+    if (sealedFiles + sections === 0) skip("sealed entries", `none of ${md.length} markdown file(s) is sealed or holds a sealed section`);
+    else ok(sealedFiles + sections, "sealed entries", `${sealedFiles} sealed file(s), ${sections} sealed section(s) in ${sectioned} file(s); opened only on your own devices, read by no AI, released by no tool; searchable on this device with \`evda search\``);
   }
 
   // 11b. grants (Spec 00 #65): who may read each circle, one substrate member tuple per file under
@@ -316,6 +586,16 @@ export function doctor(dir, { out = console.log, via = "argument" } = {}) {
     }
     if (grants.length === 0) skip("grants", `${grantsRole.rel} holds no grant files`);
     else ok(grants.length, "grants", `across ${new Set(grants.map((g) => g.circle).filter(Boolean)).size} circle(s), ${grants.filter((g) => g.holder?.kind === "agent").length} to agents`);
+
+    // 11c. device lists (HQ-835): the devices each granted holder's record id resolves to. A holder
+    // with no list is one device of the same id.
+    const devices = readDevices(evda);
+    for (const p of devices.problems) fail("devices", p.message);
+    if (devices.lists.size === 0) skip("devices", "no device lists; every holder is one device of its record id");
+    else {
+      for (const [record, list] of devices.lists) out(`        ${record.padEnd(24)} ${list.devices.filter((d) => !d.retiredAt).map((d) => d.atlasId).join(", ") || "(no active device)"}${list.devices.some((d) => d.retiredAt) ? `  retired: ${list.devices.filter((d) => d.retiredAt).map((d) => d.atlasId).join(", ")}` : ""}`);
+      ok(devices.lists.size, "device lists", `${[...devices.lists.values()].reduce((n, l) => n + l.devices.filter((d) => !d.retiredAt).length, 0)} active device(s), ${[...devices.lists.values()].reduce((n, l) => n + l.devices.filter((d) => d.retiredAt).length, 0)} retired`);
+    }
   }
 
   // 12. folder manifests (Spec 07, section 2): each folder says what its entries are and which
@@ -363,6 +643,7 @@ export function doctor(dir, { out = console.log, via = "argument" } = {}) {
     // kind's rules. A file of another kind, or one that does not read, fails with what is wrong.
     // Markdown with no `kind:` is left alone; it is not claiming to be an entry.
     const typed = folders.filter((f) => f.type && KIND_FOR_TYPE[f.type]);
+    let profilesChecked = 0;
     if (typed.length === 0) {
       skip("typed entries", `no folder manifest declares a person-layer type (${Object.keys(KIND_FOR_TYPE).join(", ")})`);
     } else {
@@ -386,12 +667,29 @@ export function doctor(dir, { out = console.log, via = "argument" } = {}) {
           entries += 1;
           if (kind !== want) { fail(rel, `is a ${kind}, and ${where} declares type ${f.type}, whose entries are ${want}. Move it, or say what the folder holds.`); continue; }
           counts[want] = (counts[want] ?? 0) + 1;
-          for (const problem of readEntry(want, read.raw, { owner }).problems) fail(rel, `${want} ${problem}`);
+          const problems = readEntry(want, read.raw, { owner }).problems;
+          for (const problem of problems) fail(rel, `${want} ${problem}`);
+          // A People doc gets an observation for each dated section (CLAUDE.md's rule, HQ-1189):
+          // check the body's dated H2/H3 headings against the frontmatter's observations, so a new
+          // section added without one does not pass silently. Only once the shape itself is sound.
+          if (want === "person-profile") {
+            profilesChecked += 1;
+            if (problems.length === 0 && read.body !== undefined) {
+              for (const h of uncoveredSections(datedHeadings(read.body), read.raw.observations ?? [])) {
+                fail(rel, `has a dated section "${h.text}" with no observation in its person-profile frontmatter (since: ${h.since}). A dated heading gets an observation for it.`);
+              }
+            }
+          }
         }
       }
       if (entries === 0) skip("typed entries", `${typed.length} typed folder(s) hold no entry files yet`);
       else ok(entries, "typed entries", `across ${typed.length} folder(s): ${PERSON_KINDS.filter((k) => counts[k]).map((k) => `${counts[k]} ${k}`).join(", ") || "none of the declared kind"}`);
     }
+
+    // 12d. person-profile dated sections (CLAUDE.md's People rule): reports what the check above
+    // found, across every person-profile record read, so a run that examined none says so plainly.
+    if (profilesChecked === 0) skip("person-profile observations", "no person-profile record was read above");
+    else ok(profilesChecked, "person-profile record(s)", "checked for a dated section with no observation");
   }
 
   // 13. references (Spec 07, section 4): a pointer, a label and a date, never the payload, never
@@ -421,6 +719,41 @@ export function doctor(dir, { out = console.log, via = "argument" } = {}) {
     else ok(refs, "references", `across ${files.size} file(s)${refused ? `, ${refused} refused` : ""}`);
   }
 
+  // 13b. skills the agent wrote for itself (HQ-1377): every .claude/skills/<name>/SKILL.md carries a
+  // kebab-case name matching its folder and a description. A broken one fails, because Claude Code
+  // skips a skill it cannot parse without saying so. One with no "when" or no steps, or that reads as
+  // a rule about the owner's life, warns: the tool refuses to write one, and a hand-written one is the
+  // owner's to keep or cut. FALSIFIED 2026-09-22 by Argus on Mike's vault: with "no when" and "no
+  // steps" as failures, doctor exited 1 on four of his seventeen hand-written skills, which load fine.
+  {
+    const sk = listSkills(evda);
+    if (sk.outside) fail(SKILLS_REL, "resolves outside the record (a symlink). A skill is part of the record and travels with it.");
+    else if (sk.skills.length === 0) skip("skills", `none written yet in ${SKILLS_REL}`);
+    else {
+      for (const s of sk.skills) {
+        for (const p of s.problems) fail(s.path, p);
+        for (const w of s.warnings) warn(s.path, w);
+      }
+      ok(sk.skills.length, "skills", `${SKILLS_REL}: ${sk.skills.map((s) => s.folder).join(", ")}`);
+    }
+  }
+
+  // 14. every sub-record, as a record of its own, to any depth. Its failures are this run's.
+  if (subs.length) {
+    let clean = 0;
+    const failing = [];
+    for (const rel of subs) {
+      out(`  sub-record ${rel}`);
+      const r = doctor(join(dir, rel), { out: (line) => out(`    ${line}`), via: "parent", depth: depth + 1 });
+      if (r.exit === 0) clean += 1;
+      else failing.push(`${rel} (exit ${r.exit})`);
+    }
+    ok(subs.length, "sub-records", `${clean} clean, ${failing.length} failing, each walked as its own record`);
+    if (failing.length) fail("sub-records", `${failing.join(", ")} failed above. A sub-record's failure is its parent's.`);
+  } else if (depth === 0) {
+    skip("sub-records", "no evda.json below the root");
+  }
+
   return finish(0);
 
   function finish(refusedExit) {