create-evda 0.1.6 → 0.1.7

package/lib/organize.mjs

@@ -13,7 +13,9 @@
 // nothing is written into circles/ or grants/.
 //
 // The judgment part runs through the owner's own AI (`--with-ai`): `claude -p` with the evda skill
-// and read-only EVDA tools, given the report. Its answer is appended to the same report. EVDA holds
+// and read-only EVDA tools, given the last two weeks of entries. It hands back one thread across
+// days, quoted and dated, which leads the report; an answer whose quotes are not in the entries is
+// dropped, and with nothing across two days the report says nothing (HQ-1246). EVDA holds
 // no key and calls no model; `claude` is the owner's install, signed in as the owner.
 
 import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
@@ -203,11 +205,113 @@ export function askOwnersAi(evda, prompt, { model = null, env = process.env, tim
   if (skill) argv.push("--append-system-prompt", skill);
   if (model) argv.push("--model", model);
   const r = spawnSync(bin, argv, { cwd: evda ? evda.dir : tmpdir(), env, encoding: "utf8", timeout: timeoutMs, maxBuffer: 16 * 1024 * 1024 });
-  if (r.error) return { ok: false, why: r.error.code === "ENOENT" ? `${bin} is not installed or not on PATH` : String(r.error.message) };
-  if (r.status !== 0) return { ok: false, why: `${bin} -p exited ${r.status}: ${(r.stderr || r.stdout || "").trim().split("\n").slice(-3).join(" ")}` };
-  const text = (r.stdout ?? "").trim();
-  if (!text) return { ok: false, why: `${bin} -p answered with nothing` };
-  return { ok: true, text };
+  const text = r.error || r.status !== 0 ? "" : (r.stdout ?? "").trim();
+  if (text) return { ok: true, text };
+  return { ok: false, why: aiFailure(r, { bin, env }) };
+}
+
+// Why the owner's AI did not answer, in words the owner can act on (HQ-1246). The report is read by
+// a person, not a developer, so it never says "claude -p exited 1". Claude's own last line follows
+// the plain sentence when it is the only clue. EVDA_ROUTINES_FALSIFY=raw-why gives the old text.
+export function aiFailure(r, { bin = "claude", env = process.env } = {}) {
+  const said = `${r.stderr ?? ""}\n${r.stdout ?? ""}`.trim().split("\n").map((l) => l.trim()).filter(Boolean);
+  if ((env.EVDA_ROUTINES_FALSIFY ?? "").split(",").map((m) => m.trim()).includes("raw-why")) {
+    if (r.error) return r.error.code === "ENOENT" ? `${bin} is not installed or not on PATH` : String(r.error.message);
+    return r.status !== 0 ? `${bin} -p exited ${r.status}: ${said.slice(-3).join(" ")}` : `${bin} -p answered with nothing`;
+  }
+  if (r.error?.code === "ENOENT") return "Claude Code is not on this computer. Install it from https://claude.com/claude-code, open it once and sign in, and the next run includes your AI's read.";
+  if (r.error?.code === "ETIMEDOUT" || r.signal === "SIGTERM") return "Claude took too long and was stopped. The next run tries again.";
+  if (r.error) return `Claude could not be started on this computer. The next run tries again. What the computer said: ${r.error.message}`;
+  if (said.some((l) => /not logged in|please run \/login|invalid api key|oauth token (has )?expired|authentication[_ ]error|\b401\b/i.test(l))) return "Claude is not signed in on this computer: open Claude and sign in, and the next run includes your AI's read.";
+  if (r.status === 0) return "Claude answered with nothing. The next run tries again.";
+  return `Claude stopped with an error before answering. The next run tries again.${said.length ? ` What it said: ${said.at(-1)}` : ""}`;
+}
+
+// How far back the AI part reads for a thread.
+export const PATTERN_DAYS = 14;
+export const NO_PATTERN = "NOTHING";
+
+// The owner's own words, one per dated daily entry in the last `days` days, as the AI part reads
+// them: a sealed or just-noted day is left out, a sealed section is cut, and evda's markers and any
+// secret-shaped line are dropped. Oldest first.
+export function entriesFor(evda, { now = new Date(), days = PATTERN_DAYS } = {}) {
+  const daily = resolveRole(evda, "record/daily");
+  if (!daily.mapped || !daily.exists) return [];
+  const start = new Date(now);
+  start.setDate(start.getDate() - (days - 1));
+  const from = localDate(start);
+  const to = localDate(now);
+  const out = [];
+  for (const abs of mdFiles(daily.abs)) {
+    const raw = readFileSync(abs, "utf8");
+    const date = fileDate(abs, raw);
+    if (!date || date < from || date > to) continue;
+    if (heldBy(frontmatterOf(raw), "organize")) continue;
+    const text = stripFrontmatter(withoutSealed(raw).text)
+      .split("\n")
+      .filter((l) => !/^<!-- evda:/.test(l.trim()) && !/^#{1,6} /.test(l) && !secretShape(l))
+      .join("\n").replace(/\n{3,}/g, "\n\n").trim();
+    if (text) out.push({ date, text });
+  }
+  return out.sort((a, b) => a.date.localeCompare(b.date));
+}
+
+// The prompt for the AI part. It carries the mechanism the answer rests on, the exact shape the
+// answer must take, and the entries themselves.
+export function patternPrompt(entries) {
+  return [
+    "Below are the owner's own entries from the last two weeks, each under its date.",
+    "",
+    "Find one thing that comes back across different days: a person, a question, a worry, a want, a phrase they keep using.",
+    "Why it is worth their reading: a conclusion handed to someone from outside tends not to take, and one they recognize in their own words does. So hand back their words, not your reading of them.",
+    "",
+    "Answer in exactly this shape:",
+    "one or two plain sentences naming what comes back, in their vocabulary",
+    "- YYYY-MM-DD: \"words copied exactly from that day's entry\"",
+    "- YYYY-MM-DD: \"words copied exactly from another day's entry\"",
+    "",
+    "Quote at least two different days. Copy each quote character for character from the entry under that date; a quote that is not there is dropped, and so is the whole answer.",
+    "Say only what the entries say. No advice, no question back to them, no score, no count, no praise, and no words like journey, transformation or growth.",
+    "Do not mention filing, organizing, this report or yourself.",
+    `If nothing honestly comes back across two or more days, answer with the single word ${NO_PATTERN}.`,
+    "",
+    ...entries.flatMap((e) => [`=== ${e.date} ===`, e.text, ""]),
+  ].join("\n");
+}
+
+const squash = (t) => t.replace(/[\u2018\u2019]/g, "'").replace(/[\u201c\u201d]/g, '"').replace(/\s+/g, " ").trim().toLowerCase();
+
+// The answer, kept only when it has the shape: prose first, then two or more quotes from two or more
+// dates, each found in the entry of its date. Returns { prose, quotes } or null (say nothing).
+// EVDA_ROUTINES_FALSIFY=no-quote-check keeps whatever came back.
+export function patternFrom(text, entries, { env = process.env } = {}) {
+  const t = String(text ?? "").trim();
+  if ((env.EVDA_ROUTINES_FALSIFY ?? "").split(",").map((m) => m.trim()).includes("no-quote-check")) return t ? { prose: t, quotes: [] } : null;
+  if (!t || t.replace(/[.\s]/g, "").toUpperCase() === NO_PATTERN) return null;
+  const lines = t.split("\n").map((l) => l.trim()).filter(Boolean);
+  const quoteRe = /^[-*] (\d{4}-\d{2}-\d{2}): ["\u201c](.+)["\u201d]$/;
+  const first = lines.findIndex((l) => quoteRe.test(l));
+  if (first < 1) return null;
+  const prose = lines.slice(0, first);
+  const rest = lines.slice(first);
+  if (prose.length > 3 || rest.some((l) => !quoteRe.test(l))) return null;
+  const byDate = new Map(entries.map((e) => [e.date, squash(e.text)]));
+  const quotes = [];
+  for (const l of rest) {
+    const [, date, words] = quoteRe.exec(l);
+    const q = squash(words);
+    if (q.length < 3 || !byDate.has(date) || !byDate.get(date).includes(q)) return null;
+    quotes.push({ date, words });
+  }
+  if (new Set(quotes.map((q) => q.date)).size < 2) return null;
+  return { prose: prose.join(" "), quotes };
+}
+
+// The pattern leads the run's section, before the filing list.
+export function withPattern(report, { prose, quotes }) {
+  const block = ["### Across your entries", "", prose, "", ...quotes.map((q) => `- ${q.date}: "${q.words}"`), ""].join("\n");
+  const at = report.indexOf("\n", report.indexOf("## Run")) + 1;
+  return `${report.slice(0, at)}\n${block}${report.slice(at)}`;
 }
 
 export async function organize(evda, { now = new Date(), window = 7, withAi = false, dryRun = false, model = null, env = process.env } = {}) {
@@ -234,19 +338,19 @@ export async function organize(evda, { now = new Date(), window = 7, withAi = fa
   }
   let exit = 0;
   if (withAi) {
-    const ai = askOwnersAi(evda, [
-      "Use the evda skill's Organizing section. Here is today's organize report for this record.",
-      "For each note that needs a place, answer in one line: the note's path, where it belongs, and the words from the note that say so, quoted.",
-      "Check against the record with the evda tools first. Write nothing. If nothing needs a place, say so in one line.",
-      "",
-      report,
-    ].join("\n"), { model, env });
-    if (ai.ok) {
-      const secret = secretLine(ai.text);
-      report += secret ? `\n### Your AI's read\n\nNot kept: the answer held ${secret}.\n` : `\n### Your AI's read (claude -p)\n\n${ai.text}\n`;
-    } else {
-      report += `\n### Your AI's read\n\nSKIPPED: ${ai.why}. Nothing else in this run depended on it.\n`;
-      exit = 1;
+    // The AI part hands back a thread across the owner's own entries, not a log of the filing above
+    // (HQ-1246). Its answer is kept only if every quote is in the entry of the date it names and the
+    // quotes span two days or more; otherwise the report says nothing about it.
+    const entries = entriesFor(evda, { now, days: PATTERN_DAYS });
+    if (entries.length) {
+      const ai = askOwnersAi(evda, patternPrompt(entries), { model, env });
+      if (ai.ok) {
+        const pattern = secretLine(ai.text) ? null : patternFrom(ai.text, entries, { env });
+        if (pattern) report = withPattern(report, pattern);
+      } else {
+        report += `\n### Your AI's read\n\nDid not run. ${ai.why}\n\nThe filing above ran without it.\n`;
+        exit = 1;
+      }
     }
   }
   const path = appendReport(evda, "organize", date, report);
@@ -258,7 +362,7 @@ export async function lookBack(evda, { now = new Date(), model = null, env = pro
   const date = localDate(now);
   const block = ai.ok
     ? (secretLine(ai.text) ? `## Run ${localTime(now)}\n\nNot kept: the answer held a secret-shaped line.\n` : `## Run ${localTime(now)}\n\n${ai.text}\n`)
-    : `## Run ${localTime(now)}\n\nSKIPPED: ${ai.why}.\n`;
+    : `## Run ${localTime(now)}\n\nDid not run. ${ai.why}\n`;
   const path = appendReport(evda, "look-back", date, block);
   return { path, exit: ai.ok ? 0 : 1, summary: `${block}\nAppended to ${path}.` };
 }

package/lib/parity.mjs

@@ -24,10 +24,43 @@
 //                                          laptop's .tmp/ (65 files, never on Hestia) reaches the
 //                                          shadow by the relay and could never match. NOT_CARRIED n.
 //
+// And one thing is not yet a difference, while the source is being heard from:
+//
+//   LAG          the record's copy on this device changed after the newest Change this device has
+//                received from the source (`settled`). During S1 the shadow is fed only by the
+//                source (the laptop) and the record here arrives by iCloud, so bytes the shadow
+//                device's own passes write reach the shadow only after iCloud carries them to the
+//                source and its next scan mints them. The source cannot have sent what it had not
+//                seen. Applies to DIFFERS and MISSING, never to EXTRA or FORBIDDEN, and each LAG
+//                file is named. Measured 2026-09-25: the Hestia daily record and the journal,
+//                written on Hestia at 02:10 ET, differed at 03:35 because the laptop's last Change
+//                had arrived at 05:35Z and the laptop was off the network from 06:57Z.
+//   STALE        a LAG file when the source's newest Change is older than `staleAfterMs` (24 h)
+//                at the run. A source that has not been heard from is not lagging, it is absent,
+//                and a week of LAG must not pass the gate. A failure.
+//
+//   LAG, per path  `settled` is the newest Change from the source for ANY file. A short wake of the
+//                source (a 21 s DarkWake on battery, 2026-09-27) can scan before iCloud has
+//                delivered a file's final bytes to it, mint a Change for some other file, and so
+//                move `settled` past a file whose bytes the source never saw. So when the source
+//                has sent a Change for this path (`pathSettled`, keyed by NFC path), the line is
+//                that path's newest Change, not the global one: a file written after the source
+//                last sent THIS path is LAG. Measured 2026-09-27 on Hestia: the two DIFFERS files'
+//                newest Changes were 06:20:41Z, their record mtime 06:48:41Z, the global newest
+//                Change 06:53:08Z. A path the source never sent keeps the global line.
+//                The per-path excuse is bounded: once the source's newest Change is more than
+//                `staleAfterMs` past the file's mtime, the source has been scanning (the laptop's
+//                daily full pass reads every file) and still has not sent it, so it fails as what
+//                it is, DIFFERS or MISSING.
+//
+// Without `settled` (the `evda parity` command) nothing is LAG: parity is byte for byte.
+// A clock skew between the two machines moves the line by the skew; a stamp-preserving edit made
+// before `settled` stays DIFFERS, which is the strict direction.
+//
 // It reads both trees and writes nothing.
 
 import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
+import { readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { circleForPath } from "./filechanges.mjs";
 import { excluder, walk } from "./sync-rules.mjs";
@@ -49,7 +82,41 @@ function circleOf(index, rel) {
 
 // `index` is circleIndex(evda). `holds` and `never` are circle names. `exclude` is the plan's
 // excluder, the same one the scan used.
-export function parity({ source, shadow, index, holds, never = [], exclude = excluder() }) {
+export const STALE_AFTER_MS = 24 * 60 * 60 * 1000;
+
+const finite = (n) => typeof n === "number" && Number.isFinite(n);
+
+// The rule for one DIFFERS or MISSING record file, pure so it can be property-tested:
+//   "FAIL"   it is the difference it looks like
+//   "LAG"    the source had not seen these bytes when it last sent this path (or anything, when it
+//            never sent this path), and the source was heard from within `staleAfterMs`
+//   "STALE"  it would be LAG, but the source has been silent for longer than `staleAfterMs`
+//   "BOUND"  it would be LAG by its path's mark, but the source has sent other Changes for longer
+//            than `staleAfterMs` since the file was written, so it is a difference after all
+export function lateVerdict({ mtimeMs, settled, pathSettled, now, staleAfterMs = STALE_AFTER_MS }) {
+  if (!finite(settled)) return "FAIL";
+  const line = finite(pathSettled) ? pathSettled : settled;
+  if (!(mtimeMs > line)) return "FAIL";
+  if (now - settled > staleAfterMs) return "STALE";
+  if (settled - mtimeMs > staleAfterMs) return "BOUND";
+  return "LAG";
+}
+
+export function parity({ source, shadow, index, holds, never = [], exclude = excluder(), settled, pathSettled, staleAfterMs = STALE_AFTER_MS, now = Date.now() }) {
+  const marked = finite(settled);
+  const lag = [];
+  const hours = Math.round(staleAfterMs / 3600000);
+  // Keyed by NFC here, whatever form the caller's change_log holds the names in.
+  const marks = new Map([...(pathSettled ?? [])].map(([rel, t]) => [nfc(rel), t]));
+  // A DIFFERS or MISSING on a record file written after the source last sent it: LAG, or STALE.
+  const late = (want, code, why) => {
+    const mark = marked ? marks.get(nfc(want.rel)) : undefined;
+    const v = lateVerdict({ mtimeMs: want.mtimeMs, settled, pathSettled: mark, now, staleAfterMs });
+    if (v === "LAG") { lag.push({ rel: want.rel, circle: want.circle, was: code }); return; }
+    if (v === "STALE") { problems.push({ code: "STALE", rel: want.rel, circle: want.circle, why: `${why}, written after the source's newest Change of ${new Date(settled).toISOString()}, which is older than ${hours} h` }); return; }
+    if (v === "BOUND") { problems.push({ code, rel: want.rel, circle: want.circle, why: `${why}; written ${new Date(want.mtimeMs).toISOString()}, after the source last sent this path (${new Date(mark).toISOString()}), but the source has sent Changes for more than ${hours} h since without it` }); return; }
+    problems.push({ code, rel: want.rel, circle: want.circle, why });
+  };
   const held = new Set(holds);
   const forbidden = new Set(never);
   const problems = [];
@@ -68,7 +135,8 @@ export function parity({ source, shadow, index, holds, never = [], exclude = exc
       problems.push({ code: "UNVERIFIABLE", rel: e.rel, circle: c.name, why: `a ${e.kind} on the record side` });
       continue;
     }
-    expected.set(nfc(e.rel), { rel: e.rel, circle: c.name, sha: sha(join(source, e.rel)) });
+    const abs = join(source, e.rel);
+    expected.set(nfc(e.rel), { rel: e.rel, circle: c.name, sha: sha(abs), mtimeMs: statSync(abs).mtimeMs });
   }
 
   const seen = new Set();
@@ -84,26 +152,31 @@ export function parity({ source, shadow, index, holds, never = [], exclude = exc
     if (!want) { problems.push({ code: "EXTRA", rel: e.rel, circle: c.name, why: "in the shadow and not in the record" }); continue; }
     seen.add(nfc(e.rel));
     if (e.kind !== "file" || sha(join(shadow, e.rel)) !== want.sha) {
-      problems.push({ code: "DIFFERS", rel: e.rel, circle: c.name, why: "the shadow's bytes are not the record's" });
+      late({ ...want, rel: e.rel }, "DIFFERS", "the shadow's bytes are not the record's");
       continue;
     }
     perCircle[want.circle] += 1;
   }
   for (const [key, want] of expected) {
-    if (!seen.has(key)) problems.push({ code: "MISSING", rel: want.rel, circle: want.circle, why: "in the record and not in the shadow" });
+    if (!seen.has(key)) late(want, "MISSING", "in the record and not in the shadow");
   }
 
   const checked = Object.values(perCircle).reduce((a, b) => a + b, 0);
   if (checked === 0) problems.push({ code: "CHECKED_0", rel: "", why: "nothing was compared; zero is a broken discovery step, not a pass" });
-  return { ok: problems.length === 0, checked, perCircle, expected: expected.size, shadowFiles, notHeld, excluded, notCarried: notCarriedCount, problems };
+  return { ok: problems.length === 0, checked, perCircle, expected: expected.size, shadowFiles, notHeld, excluded, notCarried: notCarriedCount, settled: marked ? settled : null, lag, problems };
 }
 
 // The lines a person or a log reads. The first line always says what was examined.
 export function formatParity(r, { limit = 20 } = {}) {
   const lines = [`CHECKED ${r.checked} files: ${Object.entries(r.perCircle).map(([n, k]) => `${n} ${k}`).join(", ")}`];
-  lines.push(`  record side: ${r.expected} expected, ${r.notHeld} in circles this device does not hold, ${r.excluded} excluded${r.notCarried ? `, NOT_CARRIED ${r.notCarried} (paths iCloud does not sync, both sides)` : ""}; shadow side: ${r.shadowFiles} files`);
+  lines.push(`  record side: ${r.expected} expected, ${r.notHeld} in circles this device does not hold, ${r.excluded} excluded${r.notCarried ? `, NOT_CARRIED ${r.notCarried} (paths iCloud does not sync, both sides)` : ""}; shadow side: ${r.shadowFiles} files${r.settled ? `; source's newest Change ${new Date(r.settled).toISOString()}` : ""}`);
   const byCode = {};
   for (const p of r.problems) byCode[p.code] = (byCode[p.code] ?? 0) + 1;
+  const lag = r.lag ?? [];
+  if (lag.length) {
+    lines.push(`  LAG ${lag.length} (written on this device after the source last sent that path, or after its newest Change, ${new Date(r.settled).toISOString()}, for a path it never sent; the source has not seen them yet)`);
+    for (const l of lag.slice(0, limit)) lines.push(`  LAG ${l.rel} [${l.circle}] (${l.was})`);
+  }
   for (const p of r.problems.slice(0, limit)) lines.push(`FAIL ${p.code} ${p.rel}${p.circle ? ` [${p.circle}]` : ""}: ${p.why}`);
   if (r.problems.length > limit) lines.push(`... and ${r.problems.length - limit} more`);
   lines.push(r.ok ? "PARITY OK" : `PARITY FAILED: ${Object.entries(byCode).map(([c, n]) => `${c} ${n}`).join(", ")}`);

package/lib/roles.mjs

@@ -26,6 +26,10 @@ export const ROLES = {
   // directory per owner and one subfolder per circle, so several circles from one owner are held
   // side by side. Unmapped, a record holds one circle per owner at `mounts/<owner record id>`.
   mounts: { layer: "circles", kind: "dir" },
+  // Where the owner's agent leaves messages for them and their replies come back (HQ-1246,
+  // lib/messages.mjs). Not part of any layer, like agents: a record without the mapping still has
+  // one, at `messages/`, which is what the phone app reads too.
+  messages: { layer: null, kind: "dir" },
   // The four roles every record has at any scale (Spec 07 section 2, "Four roles, at every scale",
   // HQ-1371). Each maps to one or more paths: the role's own key and any `<role>/<facet>` key, so a
   // record with three journal folders writes `journal`, `journal/captures`, `journal/dreams`. Every

package/lib/routines.mjs

@@ -1,5 +1,6 @@
-// Starter routines: a morning organize and a weekly look back, each optional, each scheduled only on
-// the owner's yes.
+// Starter routines: a morning organize and a weekly look back. The morning organize is on by default
+// (HQ-1246, his call 2026-09-27: "We know that it needs to be organizing and stuff 100%"); setup says
+// so in one line and offers off. The weekly look back stays offered, never on without a yes.
 //
 // The first choice is Claude's own scheduler. A local scheduled task in the Claude desktop app runs
 // on this machine with access to this folder (https://code.claude.com/docs/en/desktop-scheduled-tasks).
@@ -10,8 +11,8 @@
 // calendar, through a login shell so the owner's `claude` is on PATH. `--install` writes it and
 // loads it; nothing else here schedules anything.
 
-import { mkdirSync, writeFileSync, existsSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { mkdirSync, writeFileSync, existsSync, realpathSync, rmSync, statSync } from "node:fs";
+import { delimiter, join, resolve, sep } from "node:path";
 import { homedir } from "node:os";
 import { spawnSync } from "node:child_process";
 import { openEvda, holderOf } from "./manifest.mjs";
@@ -38,6 +39,43 @@ export const ROUTINES = {
 };
 export const ROUTINE_KEYS = Object.keys(ROUTINES);
 
+// EVDA_ROUTINES_FALSIFY=opt-in makes the default nothing, the state before HQ-1246, for the test
+// that shows the default is what installs it.
+export function defaultRoutines(env = process.env) {
+  return (env.EVDA_ROUTINES_FALSIFY ?? "").split(",").map((m) => m.trim()).includes("opt-in") ? [] : ["morning"];
+}
+
+// The owner's claude, found once at setup: EVDA_CLAUDE, then PATH, then where the installers put it.
+// A launchd job runs a login shell, which does not read .zshrc, so a claude on PATH only through
+// .zshrc is invisible to it; the job carries the path found here instead.
+export function findClaude(env = process.env) {
+  if (env.EVDA_CLAUDE) return env.EVDA_CLAUDE;
+  const home = env.HOME ?? homedir();
+  const dirs = [...(env.PATH ?? "").split(delimiter), join(home, ".local", "bin"), join(home, ".claude", "local"), "/opt/homebrew/bin", "/usr/local/bin"];
+  for (const d of dirs) {
+    if (!d) continue;
+    const p = join(d, "claude");
+    try { if (statSync(p).isFile()) return p; } catch {}
+  }
+  return null;
+}
+
+// macOS keeps a scheduled job out of these folders unless the shell running it has Full Disk Access.
+export function protectedLocation(dir, env = process.env) {
+  const home = env.HOME ?? homedir();
+  let real = resolve(dir);
+  try { real = realpathSync(real); } catch {}
+  let realHome = home;
+  try { realHome = realpathSync(home); } catch {}
+  for (const h of new Set([home, realHome])) {
+    for (const f of ["Documents", "Desktop", "Downloads", join("Library", "Mobile Documents")]) {
+      const base = join(h, f);
+      if (real === base || real.startsWith(base + sep) || resolve(dir).startsWith(base + sep)) return f === join("Library", "Mobile Documents") ? "iCloud Drive" : f;
+    }
+  }
+  return null;
+}
+
 const q = (s) => (/^[A-Za-z0-9_./:@=+-]+$/.test(s) ? s : `'${String(s).replace(/'/g, "'\\''")}'`);
 
 // The shell command a routine runs, with this machine's node and this package's bin.
@@ -58,7 +96,7 @@ export function desktopInstructions(key, dir) {
     `  Name:         ${r.id}`,
     `  Schedule:     ${r.when}`,
     `  Folder:       ${resolve(dir)}`,
-    "  Instructions: Run this command in the folder, then tell me the report path it prints and anything it SKIPPED:",
+    "  Instructions: Run this command in the folder, then tell me the report path it prints and anything that did not run:",
     `                ${routineCommand(key, dir)}`,
     "",
     "A local routine runs while the app is open and the computer is awake.",
@@ -72,7 +110,7 @@ export function label(key, evda) {
 
 const xml = (s) => String(s).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 
-export function launchdPlist(key, dir, { home = homedir() } = {}) {
+export function launchdPlist(key, dir, { home = homedir(), claude = null } = {}) {
   const evda = openEvda(dir);
   const r = ROUTINES[key];
   const log = join(home, "Library", "Logs", "evda", `${r.id}.log`);
@@ -93,6 +131,7 @@ export function launchdPlist(key, dir, { home = homedir() } = {}) {
     "  <dict>",
     cal,
     "  </dict>",
+    ...(claude ? ["  <key>EnvironmentVariables</key>", "  <dict>", `    <key>EVDA_CLAUDE</key><string>${xml(claude)}</string>`, "  </dict>"] : []),
     `  <key>StandardOutPath</key><string>${xml(log)}</string>`,
     `  <key>StandardErrorPath</key><string>${xml(log)}</string>`,
     "</dict>",
@@ -101,31 +140,116 @@ export function launchdPlist(key, dir, { home = homedir() } = {}) {
   ].join("\n");
 }
 
-// Write the launchd job and load it. `agentsDir` and `load` exist so tests never touch the real
-// ~/Library/LaunchAgents or launchctl.
-export function installLaunchd(key, dir, { agentsDir = process.env.EVDA_LAUNCH_AGENTS ?? join(homedir(), "Library", "LaunchAgents"), load = process.env.EVDA_NO_LAUNCHCTL !== "1", home = homedir() } = {}) {
-  if (process.platform !== "darwin" && load) throw new EvdaError("REFUSED: launchd is macOS only. Use the Claude desktop routine instead. Nothing was written.", { exit: 2 });
+// launchctl is off when the env handed in says so OR this process's own env does. A caller that
+// hands in a partial env (a test's `{ HOME }`) no longer drops the guard and loads a real job, which
+// is how io.evda.evda-morning-organize.*.atlas jobs stayed loaded after test runs.
+export const noLaunchctl = (env = process.env) => env.EVDA_NO_LAUNCHCTL === "1" || process.env.EVDA_NO_LAUNCHCTL === "1";
+
+// How launchctl is run. EVDA_LAUNCHCTL names a stand-in binary so the tests can drive the whole CLI
+// without the real launchctl; `launchctl` in the options is the same seam for in-process callers.
+export function runLaunchctl(args, env = process.env) {
+  const r = spawnSync(env.EVDA_LAUNCHCTL || "launchctl", args, { encoding: "utf8" });
+  return { status: r.status, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+}
+
+const falsified = (env, mode) => (env.EVDA_ROUTINES_FALSIFY ?? "").split(",").map((m) => m.trim()).includes(mode);
+
+// Unload a job by its label, not by its file: a job whose file is already gone, or was loaded from
+// another path, is still unloaded. EVDA_ROUTINES_FALSIFY=skip-bootout skips it (the HQ-1246 bug:
+// the file went, the job stayed loaded), for the tests.
+function bootout(target, env, launchctl) {
+  if (!falsified(env, "skip-bootout")) launchctl(["bootout", target]);
+}
+
+// Loaded or not, asked of launchd itself: `launchctl print gui/<uid>/<label>` exits 0 only for a
+// loaded job (113 when there is none).
+const isLoaded = (target, launchctl) => launchctl(["print", target]).status === 0;
+
+// Write the launchd job and load it. `agentsDir`, `load` and `launchctl` exist so tests never touch
+// the real ~/Library/LaunchAgents or launchctl. A job already loaded under this label is unloaded
+// first, so a second install replaces it rather than failing to load a duplicate.
+export function installLaunchd(key, dir, { env = process.env, home = env.HOME ?? homedir(), agentsDir = env.EVDA_LAUNCH_AGENTS ?? process.env.EVDA_LAUNCH_AGENTS ?? join(home, "Library", "LaunchAgents"), load = !noLaunchctl(env), claude = findClaude(env), launchctl = (a) => runLaunchctl(a, env) } = {}) {
+  if (process.platform !== "darwin" && load && !env.EVDA_LAUNCHCTL) throw new EvdaError("REFUSED: launchd is macOS only. Use the Claude desktop routine instead. Nothing was written.", { exit: 2 });
   const evda = openEvda(dir);
-  const plist = launchdPlist(key, dir, { home });
+  const plist = launchdPlist(key, dir, { home, claude });
   mkdirSync(agentsDir, { recursive: true });
-  mkdirSync(join(home, "Library", "Logs", "evda"), { recursive: true });
-  const path = join(agentsDir, `${label(key, evda)}.plist`);
+  const name = label(key, evda);
+  const path = join(agentsDir, `${name}.plist`);
   const existed = existsSync(path);
   writeFileSync(path, plist);
   let loaded = "not loaded (EVDA_NO_LAUNCHCTL=1)";
   if (load) {
-    const uid = process.getuid?.() ?? "";
-    spawnSync("launchctl", ["bootout", `gui/${uid}`, path], { encoding: "utf8" });
-    const r = spawnSync("launchctl", ["bootstrap", `gui/${uid}`, path], { encoding: "utf8" });
+    // The log folder is made only for a job that is loaded, so an unloaded install writes nothing
+    // into the owner's home but the job file.
+    mkdirSync(join(home, "Library", "Logs", "evda"), { recursive: true });
+    const domain = `gui/${process.getuid?.() ?? ""}`;
+    bootout(`${domain}/${name}`, env, launchctl);
+    const r = launchctl(["bootstrap", domain, path]);
     loaded = r.status === 0 ? "loaded" : `launchctl bootstrap exited ${r.status}: ${(r.stderr ?? "").trim()}`;
   }
-  return { path, existed, loaded };
+  return { path, label: name, existed, loaded, claude };
+}
+
+// Turn a routine off: unload the job, remove its file, then look again. `off` is true only when
+// launchd has no job under the label and the file is gone; anything left is named in `left`.
+// Nothing there at all is not an error.
+export function uninstallLaunchd(key, dir, { env = process.env, home = env.HOME ?? homedir(), agentsDir = env.EVDA_LAUNCH_AGENTS ?? process.env.EVDA_LAUNCH_AGENTS ?? join(home, "Library", "LaunchAgents"), load = !noLaunchctl(env), launchctl = (a) => runLaunchctl(a, env) } = {}) {
+  const name = label(key, openEvda(dir));
+  const path = join(agentsDir, `${name}.plist`);
+  const target = `gui/${process.getuid?.() ?? ""}/${name}`;
+  const hadFile = existsSync(path);
+  const wasLoaded = load && isLoaded(target, launchctl);
+  if (!hadFile && !wasLoaded) return { path, label: name, removed: false, off: true, left: [] };
+  if (wasLoaded) bootout(target, env, launchctl);
+  rmSync(path, { force: true });
+  const left = [];
+  if (load && isLoaded(target, launchctl)) left.push(`launchd still has ${name} loaded (remove it: launchctl bootout ${target})`);
+  if (existsSync(path)) left.push(`the job file is still at ${path}`);
+  return { path, label: name, removed: true, off: left.length === 0, left };
+}
+
+// What setup does with the routines it was given (HQ-1246). On a Mac each is installed as a launchd
+// job; elsewhere nothing can be scheduled from here, so it prints the Claude desktop steps and says
+// so. Returns the lines to print.
+export function installAtSetup(keys, dir, { env = process.env, platform = process.platform } = {}) {
+  const lines = [];
+  for (const key of keys) {
+    const r = ROUTINES[key];
+    lines.push("");
+    if (platform === "darwin") {
+      const done = installLaunchd(key, dir, { env });
+      const lead = key === "morning" ? "Organizing is on" : `${r.title} is on`;
+      lines.push(`${lead}: ${r.when.toLowerCase()} your own Claude ${key === "morning" ? "files your notes into their day and writes what belongs where" : "reads your week back to you"}, in reports/. Turn it off: evda routine ${key} ${resolve(dir)} --uninstall`);
+      lines.push(`  launchd job ${done.path}: ${done.loaded}. It runs while this computer is on; asleep at that hour, it runs when it wakes.`);
+      if (!done.claude) lines.push("  Claude Code was not found on this computer, so the filing runs and the report says the AI part did not. Install Claude Code and sign in to add it.");
+    } else {
+      for (const l of desktopInstructions(key, dir).split("\n")) lines.push(l);
+      lines.push("Nothing was scheduled on this computer: add the routine above in the Claude desktop app.");
+    }
+  }
+  const where = keys.length && platform === "darwin" ? protectedLocation(dir, env) : null;
+  if (where) lines.push(`This record is in ${where}. A scheduled run cannot read it there unless the shell has Full Disk Access (System Settings, Privacy & Security, Full Disk Access), or move the record to a folder of its own.`);
+  return lines;
 }
 
 export function routineMain(args, { pickDir }) {
   const key = args[0];
-  if (!ROUTINE_KEYS.includes(key)) throw new EvdaError(`usage: evda routine <${ROUTINE_KEYS.join("|")}> [dir] [--launchd] [--install]`, { exit: 2 });
+  if (!ROUTINE_KEYS.includes(key)) throw new EvdaError(`usage: evda routine <${ROUTINE_KEYS.join("|")}> [dir] [--launchd] [--install] [--uninstall]`, { exit: 2 });
   const { dir, flags } = pickDir(args.slice(1));
+  if (flags.includes("--uninstall")) {
+    const r = uninstallLaunchd(key, dir);
+    if (!r.removed) {
+      console.log(`nothing to remove: no ${ROUTINES[key].id} job at ${r.path}`);
+      return 0;
+    }
+    const what = key === "morning" ? "organizing" : ROUTINES[key].title;
+    if (!r.off) {
+      console.log(`${what} is not off: ${r.left.join("; ")}.`);
+      return 1;
+    }
+    console.log(`removed ${r.path}: ${what} is off. Turn it back on: evda routine ${key} ${resolve(dir)} --install`);
+    return 0;
+  }
   if (flags.includes("--install")) {
     const r = installLaunchd(key, dir);
     console.log(`${r.existed ? "replaced" : "wrote"} ${r.path}: ${r.loaded}. ${ROUTINES[key].when}, it runs: ${routineCommand(key, dir)}`);

package/lib/setup.mjs

@@ -283,7 +283,7 @@ export function questions(agent = DEFAULT_AGENT_NAME) {
     { key: "filing", text: `Should ${agent} file everything you say automatically, or only when you ask? (everything)` },
     { key: "import", text: "Bring in what your AI already knows about you?" },
     { key: "skill", text: `Install the evda skill for Claude Code, so ${agent} works through your EVÐA from any folder?` },
-    { key: "morning", text: "Add a morning organize routine, which files your captures into their day and reports what belongs where?" },
+    { key: "morning", text: "Organizing is on: each morning your own Claude files your notes into their day and writes what belongs where. Keep it on?" },
     { key: "weekly", text: "Add a weekly look back routine, which reads your week back to you?" },
   ];
 }
@@ -397,9 +397,11 @@ export async function interview(opts, io, { presets = [] } = {}) {
   }
   if (a.routines == null) {
     out("");
-    out("Routines are optional and nothing is scheduled without a yes. Each runs through your own AI, never an API key in EVÐA.");
-    a.routines = [];
-    for (const key of ["morning", "weekly"]) if (await yes(key)) a.routines.push(key);
+    out("Routines run through your own AI, never an API key in EVÐA.");
+    // Organizing is on by default (HQ-1246): only an explicit no turns it off.
+    const keep = String(await ask(`${q("morning", agent)} (yes/no) `)).trim().toLowerCase();
+    a.routines = ["no", "n", "off"].includes(keep) ? [] : ["morning"];
+    if (await yes("weekly")) a.routines.push("weekly");
   }
   return a;
 }

package/lib/sync-rules.mjs

@@ -7,9 +7,10 @@
 //
 // Three kinds of thing never sync, and each is counted rather than dropped:
 //
-//   excluded      by name anywhere (.DS_Store, node_modules, .git), by name at the root (.evda, the
-//                 derived index every device rebuilds), or by a path the plan names. Reported as
-//                 EXCLUDED n.
+//   excluded      by name anywhere (.DS_Store, node_modules, .git), by name prefix anywhere (~$, the
+//                 owner file Word, Excel and PowerPoint keep beside a document while it is open), by
+//                 name at the root (.evda, the derived index every device rebuilds), or by a path the
+//                 plan names. Reported as EXCLUDED n.
 //   symlink       never followed and never carried: sync moves bytes, and a link's target may be
 //                 outside the record, missing, or itself. A symlink inside a circle fails the
 //                 coverage check until the plan excludes it.
@@ -24,6 +25,11 @@ import { lstatSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 
 export const EXCLUDE_NAMES = [".DS_Store", "node_modules", ".git", ".Trash", "Icon\r"];
+// A name starting with one of these is one machine's state about a file, not the record. `~$` is
+// the Office owner file: it exists only while a document is open on that machine, and iCloud never
+// carries one, so a shadow fed by the laptop held one Hestia's record could not (HQ-1219,
+// 2026-09-25, `~$e Lantern Version 3.docx`, EXTRA).
+export const EXCLUDE_PREFIXES = ["~$"];
 export const EXCLUDE_ROOT_NAMES = [".evda"];
 // The relay refuses a blob over 64 MiB (`xania-relay/src/relay.mjs`, MAX_BLOB_BYTES); the seal adds
 // a nonce, a tag and an ephemeral key, so leave a margin.
@@ -40,7 +46,7 @@ export function excluder(extra = []) {
   const paths = extra.map(norm).filter((p) => p !== "");
   return (rel) => {
     const parts = norm(rel).split("/");
-    if (parts.some((p) => EXCLUDE_NAMES.includes(p))) return true;
+    if (parts.some((p) => EXCLUDE_NAMES.includes(p) || EXCLUDE_PREFIXES.some((x) => p.startsWith(x)))) return true;
     if (EXCLUDE_ROOT_NAMES.includes(parts[0])) return true;
     const r = parts.join("/");
     return paths.some((p) => r === p || r.startsWith(`${p}/`));

package/lib/tools.mjs

@@ -35,6 +35,7 @@ import { doctor } from "./doctor.mjs";
 import { readContext, mayRead, heldBack, callerFrom, aiView, note as writeNote, releaseNote, SEALED_WHY } from "./readers.mjs";
 import { EvdaError } from "./errors.mjs";
 import { dayRole, appendToDay, CONTEXT_LABEL, localDate, localTime } from "./day-file.mjs";
+import { writeMessage, unseenReplies } from "./messages.mjs";
 
 export { localDate, localTime, CONTEXT_LABEL };
 
@@ -296,6 +297,20 @@ export function releaseTool(evda, args = {}, { now = new Date() } = {}) {
   return releaseNote(evda, args.path, { now });
 }
 
+// 5d. Tell the owner something (HQ-1246): one new message file under the messages role, which the
+// phone app shows as a card. Never edits one; refuses anything secret-shaped, like every write.
+export function message(evda, args = {}, { now = new Date() } = {}) {
+  onlyKeys("evda_message", args, ["title", "body", "from"], "It writes one new message for the owner and nothing else: it takes no path, and it never edits a message once written.");
+  return writeMessage(evda, args, { now, refuseSecrets });
+}
+
+// 5e. The owner's replies to messages, the ones not seen yet, marked seen unless peek is true.
+export function replies(evda, args = {}, { caller = callerFrom() } = {}) {
+  onlyKeys("evda_replies", args, ["peek"]);
+  if (args.peek !== undefined && typeof args.peek !== "boolean") throw new EvdaError("evda_replies peek is true or false.", { code: "BAD_ARGUMENT", exit: 2 });
+  return unseenReplies(evda, { peek: args.peek === true }, { caller });
+}
+
 // 6. Circles and their policies, as the record declares them. Read only.
 export function circles(evda, args = {}) {
   onlyKeys("evda_circles", args, []);