create-evda 0.1.8 → 0.1.10

package/lib/gather-apply.mjs

@@ -27,7 +27,9 @@
 //
 // Revert restores the record and the sources to their bytes before the apply: moved files go back
 // with their mode and modification time, written files are removed, changed manifests get their
-// old bytes and times back, and directories the apply made are removed when empty. A written file
+// old bytes and times back, and directories the apply made are removed when empty. Every folder that
+// existed before the apply and that it wrote into or moved a file out of (in the pile or the record)
+// gets its modification time back (HQ-1368); one removed since is named and left gone. A written file
 // edited since the apply is named and the revert refused, unless --force.
 //
 // EVDA_GATHER_FALSIFY=<mode,...>, for the tests (APPLY_FALSIFY_MODES):
@@ -36,27 +38,35 @@
 //   reapply-resorts       nothing in the record counts as present, so a second gather places it all again
 //   move-without-flag     apply moves the sources when --move was not given
 //   revert-ignores-edits  revert removes a placed file the owner edited, without --force
+//   revert-dir-times      revert leaves the folders' modification times as its own writes made them
+//   two-schemes           a create-evda record grows the preset's Title Case folders beside record/
 
 import { createHash } from "node:crypto";
 import { chmodSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, rmdirSync, statSync, unlinkSync, utimesSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { tmpdir } from "node:os";
-import { openEvda, readManifest, findRoot } from "./manifest.mjs";
+import { openEvda, readManifest, findRoot, holderOf } from "./manifest.mjs";
 import { fourRoles, roleForPath, fourRoleOf } from "./roles.mjs";
 import { subRecords } from "./records.mjs";
 import { folderManifests, folderFor, FOLDER_MANIFEST } from "./folders.mjs";
 import { loadPreset, applyPreset, manifestFor } from "./presets.mjs";
 import { reference } from "./references.mjs";
-import { proposeCircle, onlyKeys, refuse } from "./tools.mjs";
+import { proposeCircle, onlyKeys, refuse, PROPOSALS } from "./tools.mjs";
 import { doctor } from "./doctor.mjs";
 import { gatherDir, loadProposal, checkOut, presentIndex, presentAt, GATHERED, chatPlan, dayDirOf } from "./gather.mjs";
 import { dayAppend } from "./chat-export.mjs";
+import { sealForKeychain, removeSecret, SERVICE } from "./keychain.mjs";
 import { EvdaError } from "./errors.mjs";
 import { carries, NOTED, SEALED } from "./circles.mjs";
+import { planProfile } from "./migrate-people.mjs";
+import { README_NAME } from "./person-folders.mjs";
+import { localDate } from "./day-file.mjs";
+import { htmlNoteToMarkdown } from "./html-notes.mjs";
+import { captionOf } from "./takeout.mjs";
 import { parseArgs, scaffold } from "../create-evda.mjs";
 
 export const APPLY_VERSION = 1;
-export const APPLY_FALSIFY_MODES = ["apply-writes-share", "revert-not-exact", "reapply-resorts", "move-without-flag", "revert-ignores-edits"];
+export const APPLY_FALSIFY_MODES = ["apply-writes-share", "revert-not-exact", "reapply-resorts", "move-without-flag", "revert-ignores-edits", "revert-dir-times", "two-schemes"];
 const falsified = (mode) => (process.env.EVDA_GATHER_FALSIFY ?? "").split(",").map((s) => s.trim()).includes(mode);
 const posix = (p) => p.split(sep).join("/");
 const sha256 = (buf) => createHash("sha256").update(buf).digest("hex");
@@ -67,20 +77,27 @@ const within = (abs, root) => abs === root || abs.startsWith(root + sep);
 
 // Every write the apply makes goes through here, so the reversal manifest is complete by
 // construction: a file made, a file changed (its old bytes and times kept), a directory made.
-function tracker(root) {
-  const t = { root, created: [], modified: [], dirs: [], moved: [], stash: new Map() };
+function tracker(root, times = new Map(), made = []) {
+  const t = { root, created: [], modified: [], dirs: [], moved: [], stash: new Map(), times };
   const abs = (rel) => join(root, rel);
+  // A folder that was there before the apply is about to gain or lose an entry: its times are kept
+  // first, once, so revert can put them back. One the apply made (or made the record with) is removed
+  // by revert instead. `times` is shared with the apply, which notes the pile's folders the same way.
+  const ours = new Set(made.map((d) => abs(d)));
+  t.noteDir = (dirAbs) => { if (!ours.has(dirAbs) && !t.dirs.some((d) => abs(d) === dirAbs)) noteDirTimes(times, dirAbs); };
   t.mkdirp = (rel) => {
     if (!rel || rel === ".") return;
     const segs = rel.split("/");
     for (let i = 1; i <= segs.length; i++) {
       const sub = segs.slice(0, i).join("/");
       if (existsSync(abs(sub))) continue;
+      t.noteDir(dirname(abs(sub)));
       mkdirSync(abs(sub));
       t.dirs.push(sub);
     }
   };
   t.writeNew = (rel, buf, times = null) => {
+    t.noteDir(dirname(abs(rel)));
     t.mkdirp(posix(dirname(rel)));
     writeFileSync(abs(rel), buf, { flag: "wx" });
     if (times) utimesSync(abs(rel), times.atime, times.mtime);
@@ -94,6 +111,7 @@ function tracker(root) {
         t.stash.set(rel, { path: rel, before: readFileSync(abs(rel)).toString("base64"), mode: st.mode & 0o7777, atimeMs: st.atimeMs, mtimeMs: st.mtimeMs });
       } else t.stash.set(rel, { path: rel, before: null });
     }
+    t.noteDir(dirname(abs(rel)));
     t.mkdirp(posix(dirname(rel)));
     writeFileSync(abs(rel), buf);
   };
@@ -105,6 +123,13 @@ function tracker(root) {
   return t;
 }
 
+// Keep a folder's times before the apply changes what is in it: { path, atimeMs, mtimeMs }, by path.
+function noteDirTimes(times, dirAbs) {
+  if (times.has(dirAbs) || !existsSync(dirAbs)) return;
+  const st = statSync(dirAbs);
+  if (st.isDirectory()) times.set(dirAbs, { path: dirAbs, atimeMs: st.atimeMs, mtimeMs: st.mtimeMs });
+}
+
 // Every file and directory under `root`, relative, hidden ones included; symlinks are listed as files.
 function tree(root) {
   const files = [];
@@ -171,13 +196,37 @@ function ensureRecord(target, p, { owner = "", dry = false } = {}) {
   return { evda: openEvda(dir), made, existed: false, scratch: dry ? dirname(dir) : null };
 }
 
+// A new record is create-evda's own layout and nothing more (HQ-1368, naming slice): the preset's
+// Title Case folders are not made, so the folders the apply needs are made in the record's own
+// lowercase scheme under record/, beside record/daily, and only those the items need.
 function createRecord(dir, presetId, owner) {
-  const opts = parseArgs([dir, "--yes", "--no-pointer", ...(owner ? ["--owner", owner] : []), "--preset", presetId]);
+  const opts = parseArgs([dir, "--yes", "--no-pointer", ...(owner ? ["--owner", owner] : [])]);
   scaffold(opts);
-  const plan = applyPreset(dir, presetId);
-  return { preset: plan.id };
+  if (falsified("two-schemes")) applyPreset(dir, presetId);
+  return { preset: presetId };
 }
 
+// Folders other code finds by their name, kept as they are in every layout.
+const NAMED_FOLDERS = new Set(["Credentials"]);
+
+// True when the record is laid out the way create-evda makes one: its record layer under record/
+// and no typed folder of a preset beside it. A record a preset grew (Journal/, 01_Projects/) keeps
+// its own scheme. (HQ-1368, naming slice; Phronesis 2026-10-21.)
+export function ownLayout(evda) {
+  if (falsified("two-schemes")) return false;
+  if (evda.manifest.mapping?.["record/daily"] !== "record/daily") return false;
+  const subs = subRecords(evda.dir);
+  return folderManifests(evda).every((m) => {
+    const rel = posix(relative(evda.dir, m.dir));
+    return !m.type || rel === "" || rel === "record" || rel.startsWith("record/") || rel === "messages" || rel.startsWith("messages/") || NAMED_FOLDERS.has(rel.split("/")[0]) || subs.some((s) => rel === s || rel.startsWith(`${s}/`));
+  });
+}
+
+// A proposal folder's name in a create-evda record: lowercase under record/, any number prefix
+// dropped, so 01_Projects is record/projects and Events is record/events. Only the proposal's own
+// folder is renamed; a subject below it ("02_Areas/COMP 318") keeps its spaces and case.
+export const ownName = (path) => (NAMED_FOLDERS.has(path.split("/")[0]) ? path : `record/${path.split("/").map((s) => s.replace(/^\d+_/, "").toLowerCase()).join("/")}`);
+
 // ---- the plan ----
 
 // The folder a proposal folder lands in, in this record.
@@ -188,11 +237,13 @@ function folderResolver(evda, p) {
   const inSub = (rel) => subs.some((s) => rel === s || rel.startsWith(`${s}/`));
   const manifests = folderManifests(evda).filter((m) => m.type && !inSub(posix(relative(evda.dir, m.dir))));
   const cache = new Map();
+  const own = ownLayout(evda);
   return (f) => {
     if (cache.has(f.path)) return cache.get(f.path);
     let r;
-    const abs = join(evda.dir, f.path);
-    if (existsSync(abs) && statSync(abs).isDirectory()) r = { path: f.path, how: "exists" };
+    const name = own ? ownName(f.path) : f.path;
+    const abs = join(evda.dir, name);
+    if (existsSync(abs) && statSync(abs).isDirectory()) r = { path: name, how: "exists" };
     else if (!falsified("reapply-resorts") && f.type) {
       const same = manifests
         .map((m) => ({ m, rel: posix(relative(evda.dir, m.dir)) }))
@@ -202,7 +253,7 @@ function folderResolver(evda, p) {
     }
     if (!r) {
       const pf = preset.folders.find((x) => x.path === f.path);
-      r = { path: f.path, how: "create", type: f.type ?? null, role: f.role ?? null, connectors: pf?.connectors ?? [] };
+      r = { path: name, how: "create", type: f.type ?? null, role: f.role ?? null, connectors: pf?.connectors ?? [] };
     }
     cache.set(f.path, r);
     return r;
@@ -212,17 +263,26 @@ function folderResolver(evda, p) {
 // The proposal folder a destination sits under: the longest one at or above it.
 const topOf = (p, to) => p.folders.filter((f) => to === f.path || to.startsWith(`${f.path}/`)).sort((a, b) => b.path.length - a.path.length)[0] ?? null;
 
+// The caption a photo's Takeout sidecar holds, read at apply because the proposal quotes none; null
+// when the sidecar is gone or changed since the gather.
+function sidecarCaption(p, item) {
+  const abs = sourceAbs(p, { ...item, path: item.takeout.sidecar });
+  let buf;
+  try { buf = readFileSync(abs); } catch { return null; }
+  return sha256(buf) === item.takeout.sha256 ? captionOf(buf) : null;
+}
+
 function sourceAbs(p, item) {
   const s = p.sources.find((x) => x.id === item.source);
   return existsSync(s.path) && statSync(s.path).isFile() ? s.path : join(s.path, item.path);
 }
 
 // The whole apply as a list of intended writes, before any is made. Pure over the record's state.
-function plan(evda, p, { mode }) {
+function plan(evda, p, { mode, now = new Date() }) {
   const resolveFolder = folderResolver(evda, p);
   const index = presentIndex(evda.dir);
   const items = new Map(p.items.map((i) => [i.id, i]));
-  const out = { writes: [], present: [], changed: [], left: [], refused: [], referenceOnly: [], folders: new Map() };
+  const out = { writes: [], present: [], changed: [], left: [], refused: [], duplicates: [], referenceOnly: [], folders: new Map() };
   const taken = new Set();
   const claim = (to) => {
     let t = to;
@@ -255,6 +315,7 @@ function plan(evda, p, { mode }) {
     const i = items.get(pl.item);
     if (pl.status === "refused") { out.refused.push({ item: pl.item, why: pl.why }); continue; }
     if (pl.status === "unplaced") { out.left.push({ item: pl.item, why: pl.why }); continue; }
+    if (pl.status === "duplicate") { out.duplicates.push({ item: pl.item, of: pl.of }); continue; }
     if (pl.status === "present") { out.present.push({ item: pl.item, at: pl.at }); continue; }
     if (pl.status === "reference" && !pl.to) { out.referenceOnly.push({ item: pl.item, refs: (i.cards ?? []).map((c) => c.ref) }); continue; }
     if (pl.status === "create") {
@@ -290,17 +351,32 @@ function plan(evda, p, { mode }) {
     // A credential kept in the Credentials folder is sealed (HQ-1368): evda_search, evda_recent and
     // evda_read refuse it to every caller without naming it, and no tool releases it.
     if (md && pl.sealed && !i.sealed) add.sealed = `${SEALED}: true`;
+    // A Keep note's Takeout sidecar gives its created and edited times (HQ-1368, lib/takeout.mjs).
+    if (md && i.takeout?.created) add.created = `created: ${q(i.takeout.created)}`;
+    if (md && i.takeout?.edited) add.edited = `edited: ${q(i.takeout.edited)}`;
     // The item's own bytes, frontmatter included, so `noted: true` and `sealed: true` ride into the
     // record with it (HQ-1414). EVDA_CARRY_FALSIFY=gather-apply:<flag> drops that line on the way in.
-    let bytes = withFrontmatter(buf, add);
+    // A note-shaped HTML file becomes the markdown the proposal named (HQ-1368); revert puts the .html back.
+    let bytes = withFrontmatter(pl.convert === "html-to-markdown" ? Buffer.from(htmlNoteToMarkdown(buf.toString("utf8")).markdown, "utf8") : buf, add);
     // A note that already said `sealed: false` (or anything but true) is sealed all the same.
     if (add.sealed && !/^sealed:[ \t]*true[ \t]*$/m.test(bytes.toString("utf8").split(/\n---/)[0])) bytes = Buffer.from(bytes.toString("utf8").replace(/^sealed:.*$/m, `${SEALED}: true`), "utf8");
     for (const flag of [NOTED, SEALED]) if (md && !carries("gather-apply", flag)) bytes = Buffer.from(bytes.toString("utf8").replace(new RegExp(`^${flag}:[ \\t]*true[ \\t]*\\n`, "m"), ""), "utf8");
     const st = statSync(src);
+    // A photo's date taken, from its Takeout sidecar, is its copy's modification time, to the second:
+    // a photo carries no frontmatter, and the time Takeout wrote the file says nothing of the moment.
+    // The caption is read again from the sidecar, unchanged since the gather, for the gathered list.
+    const taken = !md && Number.isInteger(i.takeout?.takenEpoch) ? i.takeout.takenEpoch : null;
+    const takeout = i.takeout ? { ...(i.takeout.taken ? { taken: i.takeout.taken } : {}), ...(i.takeout.created ? { created: i.takeout.created } : {}), ...(i.takeout.caption ? { caption: sidecarCaption(p, i) } : {}) } : null;
+    if (takeout && takeout.caption === null) delete takeout.caption;
+    // A note gather caught as holding a credential, newly sealed here (HQ-1916): its value(s) are
+    // moved into the Keychain at apply, not left in the file. A file that already carried its own
+    // seal (re-gathered, or hand-marked) is not a fresh credential detection and is left as it is.
     out.writes.push({
       kind: mode === "move" ? "move" : "copy", item: pl.item, source: src, sourceSha: i.sha256, to: claim(to), folder, bytes, original: buf,
+      credential: !!(md && pl.sealed && i.credential && !i.sealed),
       schemes: md && add.references ? pl.refs.map((r) => r.split(":")[0]) : [],
-      times: { atime: st.atimeMs / 1000, mtime: st.mtimeMs / 1000 }, mode: st.mode & 0o7777, atimeMs: st.atimeMs, mtimeMs: st.mtimeMs,
+      times: { atime: st.atimeMs / 1000, mtime: taken ?? st.mtimeMs / 1000 }, mode: st.mode & 0o7777, atimeMs: st.atimeMs, mtimeMs: st.mtimeMs,
+      ...(takeout && Object.keys(takeout).length ? { takeout } : {}),
     });
   }
   // A finished project with no README placed gets one, holding only its status and its name.
@@ -309,6 +385,20 @@ function plan(evda, p, { mode }) {
     const { to, folder } = land(`${f.dir}/README.md`);
     out.writes.push({ kind: "page", item: `status:${f.name}`, to: claim(to), folder, bytes: Buffer.from(`---\nstatus: ${f.status}\n---\n# ${f.name}\n`, "utf8"), schemes: [] });
   }
+  // A page that lands directly in a person folder is that person's profile (HQ-2024), so it opens
+  // with person-profile frontmatter, planned the way `evda migrate-people` plans one: keys the page
+  // already has stay, a dated heading becomes an observation, and a page with none gets one dated
+  // the day of the apply. A sealed or just-noted page is left as it is, and doctor names it.
+  const typeAt = new Map(folderManifests(evda).map((m) => [posix(relative(evda.dir, m.dir)), m.type]));
+  const owner = (() => { const h = holderOf(evda.manifest); return h.id ?? h.name ?? "owner"; })();
+  for (const w of out.writes) {
+    const f = out.folders.get(w.folder);
+    if (!f || !/\.md$/i.test(w.to) || basename(w.to) === README_NAME || posix(dirname(w.to)) !== f.path) continue;
+    if ((typeAt.has(f.path) ? typeAt.get(f.path) : f.proposal.type) !== "person") continue;
+    const prof = planProfile({ fileName: basename(w.to), text: w.bytes.toString("utf8"), owner, date: localDate(now) });
+    if (prof.skip || prof.problems.length) continue;
+    w.bytes = Buffer.concat([Buffer.from(prof.frontmatter, "utf8"), w.bytes.subarray(prof.bodyAt)]);
+  }
   // The folders the writes land in: made, with their manifest and role, or the record's own.
   out.roles = [];
   const mapping = evda.manifest.mapping;
@@ -317,7 +407,8 @@ function plan(evda, p, { mode }) {
   for (const f of [...out.folders.values()].filter((x) => x.how === "create" && out.writes.some((w) => w.folder === x.proposal.path))) {
     if (roleForPath(four, f.path)) continue;
     // The proposal's own key for this folder, or for the nearest folder above it.
-    const candidates = Object.entries(p.mapping ?? {}).filter(([, v]) => f.path === v || f.path.startsWith(`${v}/`)).sort((a, b) => b[1].length - a[1].length);
+    // A folder renamed into the record's own scheme takes the folder's own role under its new name.
+    const candidates = f.path !== f.proposal.path ? [] : Object.entries(p.mapping ?? {}).filter(([, v]) => f.path === v || f.path.startsWith(`${v}/`)).sort((a, b) => b[1].length - a[1].length);
     const [key0, rel] = candidates[0] ?? [`${f.role ?? "collections"}/${slug(basename(f.path))}`, f.path];
     if (out.roles.some((r) => r.rel === rel) || Object.values(mapping).includes(rel)) continue;
     let key = key0;
@@ -349,9 +440,12 @@ export async function applyGather(p, into, { mode = "copy", dry = false, now = n
   const manifestAbs = dry ? null : checkOut(manifestOut ?? join(gatherDir(env), `${p.id}.apply-${now.toISOString().replace(/[-:]/g, "").replace(/\..*$/, "")}.json`), p);
   if (manifestAbs && existsSync(manifestAbs)) throw refuse(`a reversal manifest is already at ${manifestAbs}. Name another with --manifest.`, "MANIFEST_EXISTS");
 
+  // The folders whose times revert puts back: the target's own, when it is there before the apply.
+  const dirTimes = new Map();
+  if (!dry) noteDirTimes(dirTimes, target);
   const rec = ensureRecord(target, p, { owner, dry });
   const evda = rec.evda;
-  const pl = plan(evda, p, { mode });
+  const pl = plan(evda, p, { mode, now });
   pl.chats = chatWrites(evda, p);
   const result = { dry, mode, target, made: rec.made, plan: pl, manifest: manifestAbs, proposal: p.id };
   result.counts = counts(pl, p);
@@ -361,7 +455,7 @@ export async function applyGather(p, into, { mode = "copy", dry = false, now = n
     return result;
   }
 
-  const t = tracker(evda.dir);
+  const t = tracker(evda.dir, dirTimes, rec.made?.dirs ?? []);
   // 1. Folders the writes need that the record does not have, each with its manifest.
   const needSchemes = new Map();
   for (const w of pl.writes) for (const s of w.schemes) {
@@ -385,13 +479,35 @@ export async function applyGather(p, into, { mode = "copy", dry = false, now = n
   }
   // 3. The files.
   const ledger = [];
+  // HQ-1916: a credential's value moves into the Keychain here, before its file ever touches disk;
+  // the tracker only ever sees the redacted bytes. Not macOS, or the write fails: the value stays in
+  // the sealed file exactly as HQ-1368 left it, and the fallback says why in one plain line.
+  const keychainPath = env.EVDA_KEYCHAIN_PATH || null;
+  const keychainAccounts = [];
+  const keychainLines = [];
+  let keychainFilesMoved = 0;
+  let keychainFilesKept = 0;
   for (const w of pl.writes) {
-    t.writeNew(w.to, w.bytes, w.times ?? null);
-    if (w.source) ledger.push({ source: w.sourceSha, to: w.to, proposal: p.id, at: now.toISOString() });
+    let bytes = w.bytes;
+    if (w.credential) {
+      const sealed = sealForKeychain(bytes.toString("utf8"), basename(w.to), { keychainPath });
+      if (sealed.ok) {
+        bytes = Buffer.from(sealed.text, "utf8");
+        keychainAccounts.push(...sealed.accounts);
+        keychainFilesMoved += 1;
+        keychainLines.push(`  kept     ${w.to}: ${sealed.accounts.length} value(s) moved to the Keychain (${SERVICE}); the file holds a pointer, not the value`);
+      } else {
+        keychainFilesKept += 1;
+        keychainLines.push(`  kept     ${w.to}: the value stays in the sealed file (${sealed.why})`);
+      }
+    }
+    t.writeNew(w.to, bytes, w.times ?? null);
+    if (w.source) ledger.push({ source: w.sourceSha, to: w.to, proposal: p.id, at: now.toISOString(), ...(w.takeout ? { takeout: w.takeout } : {}) });
     if (w.kind === "move") {
+      t.noteDir(dirname(w.source));
       unlinkSync(w.source);
       // A file the apply changed on the way in keeps its source bytes here, so revert can put them back.
-      t.moved.push({ source: w.source, to: w.to, sha256: w.sourceSha, mode: w.mode, atimeMs: w.atimeMs, mtimeMs: w.mtimeMs, ...(sha256(w.bytes) !== w.sourceSha ? { bytes: w.original.toString("base64") } : {}) });
+      t.moved.push({ source: w.source, to: w.to, sha256: w.sourceSha, mode: w.mode, atimeMs: w.atimeMs, mtimeMs: w.mtimeMs, ...(sha256(bytes) !== w.sourceSha ? { bytes: w.original.toString("base64") } : {}) });
     }
   }
   // 3b. The owner's chat messages no agent filed (HQ-1385), appended to their days.
@@ -429,6 +545,8 @@ export async function applyGather(p, into, { mode = "copy", dry = false, now = n
     const covers = f ? f.path + c.covers.slice(f.proposal.path.length) : c.covers;
     if (!pl.writes.some((w) => w.to.startsWith(`${covers}/`))) continue;
     const before = tree(evda.dir);
+    t.noteDir(evda.dir);
+    t.noteDir(join(evda.dir, PROPOSALS));
     const r = proposeCircle(evda, { name: c.name, who: c.readBy === "none" ? "Only the owner, on their own devices. No AI reads it (read_by: none), and no agent host holds it." : "Only the people the owner grants it to, by name.", what: `${covers}/`, why: `The owner said yes to its own circle for these notes while gathering a pile (proposal ${p.id}).` }, { now });
     const after = tree(evda.dir);
     for (const d of after.dirs.filter((x) => !before.dirs.includes(x))) t.dirs.push(d);
@@ -451,9 +569,15 @@ export async function applyGather(p, into, { mode = "copy", dry = false, now = n
     modified: t.modified.filter((m) => !rec.made?.files.includes(m.path)),
     dirs: t.dirs,
     moved: t.moved,
+    // The times of every folder that was there before the apply and that it changed (HQ-1368).
+    dirTimes: [...dirTimes.values()],
     placed: pl.writes.map((w) => ({ item: w.item, kind: w.kind, from: w.source ?? null, to: w.to })),
     chats: [...pl.chats.byFile.keys()],
     counts: result.counts,
+    // HQ-1916: the Keychain items this apply added, and the keychain they went into (null is the
+    // login keychain), so revert can remove exactly these and nothing else.
+    keychain: keychainAccounts,
+    keychainPath,
   };
   mkdirSync(dirname(manifestAbs), { recursive: true });
   writeFileSync(manifestAbs, JSON.stringify(manifest, null, 2) + "\n", { flag: "wx" });
@@ -461,6 +585,9 @@ export async function applyGather(p, into, { mode = "copy", dry = false, now = n
   const lines = [];
   const d = doctor(evda.dir, { out: (l) => lines.push(l), via: "gather apply" });
   result.doctor = { exit: d.exit, lines, failures: d.failures, warnings: d.warnings.length };
+  result.keychainLines = keychainLines;
+  result.keychainMoved = keychainFilesMoved;
+  result.keychainKept = keychainFilesKept;
   result.lines = applyLines(result, p);
   return result;
 }
@@ -493,7 +620,7 @@ function counts(pl, p) {
   const placed = by("copy") + by("move") + by("reference") + by("page");
   return {
     placed, copied: by("copy"), moved: by("move"), references: by("reference"), pages: by("page"),
-    asked: (p.questions ?? []).length, left: pl.left.length, refused: pl.refused.length, present: pl.present.length,
+    asked: (p.questions ?? []).length, left: pl.left.length, refused: pl.refused.length, present: pl.present.length, duplicates: pl.duplicates.length,
     changed: pl.changed.length, referenceOnly: pl.referenceOnly.length,
     chatAdded: pl.chats?.added ?? 0, chatFiled: pl.chats?.filed ?? 0, chatSecret: pl.chats?.secret ?? 0, chatDays: pl.chats?.byFile.size ?? 0,
   };
@@ -507,7 +634,7 @@ function applyLines(r, p) {
   const c = r.counts;
   const out = [];
   const verb = r.dry ? "would" : "did";
-  if (r.made) out.push(`${r.dry ? "Would make" : "Made"} a new EVDA at ${r.target} with the ${p.preset.title} preset (${r.made.files.length} file(s)).`);
+  if (r.made) out.push(`${r.dry ? "Would make" : "Made"} a new EVDA at ${r.target} in create-evda's own layout, its new folders under record/ (${r.made.files.length} file(s)).`);
   else out.push(`${r.dry ? "Would grow" : "Grew"} the EVDA at ${r.target}; nothing already in it was moved.`);
   for (const f of r.plan.folders.values()) {
     if (f.how === "adopted") out.push(`  adopted  ${f.proposal.path}/ as the record's own ${f.path}/ (type ${f.proposal.type}, ${f.proposal.role})`);
@@ -519,12 +646,14 @@ function applyLines(r, p) {
   if (c.pages) out.push(`  ${verb === "did" ? "wrote   " : "write   "} ${c.pages} page(s) the answers asked for`);
   if (c.referenceOnly) out.push(`  kept     ${c.referenceOnly} export(s) as references only, never copied`);
   if (c.present) out.push(`  present  ${c.present} item(s) already in the record, left where they are`);
+  if (r.keychainLines?.length) out.push(...r.keychainLines);
   for (const x of r.plan.changed) out.push(`  changed  ${x.item} ${x.why}`);
   if ((p.chats ?? []).length) {
     out.push(`  ${verb === "did" ? "added   " : "add     "} ${c.chatAdded} message(s) of the owner's from ${p.chats.length} chat export(s) to ${c.chatDays} day file(s), each conversation under its date and time; ${c.chatFiled} already in the record${c.chatSecret ? `, ${c.chatSecret} left out for holding something shaped like a secret` : ""}`);
     for (const why of r.plan.chats.changed) out.push(`  changed  ${why}`);
   }
   for (const x of r.plan.left) out.push(`  left     ${x.item}: ${x.why}`);
+  for (const x of r.plan.duplicates) out.push(`  duplicate ${x.item}: the same bytes as ${x.of}, placed once; this copy is left in the pile`);
   for (const x of r.plan.refused) out.push(`  refused  ${x.item}: left where it is`);
   for (const x of r.proposed ?? []) out.push(`  proposed ${x}  (a proposal file; no circle was created, and no file was marked for sharing)`);
   if (!r.dry) {
@@ -535,7 +664,8 @@ function applyLines(r, p) {
   } else out.push("Nothing was written.");
   out.push(checkedLine(c));
   if ((p.chats ?? []).length) out.push(`CHECKED ${c.chatAdded + c.chatFiled + c.chatSecret} chat message(s) of the owner's  ${c.chatAdded} added, ${c.chatFiled} already filed, ${c.chatSecret} secret-shaped`);
-  out.push(`CHECKED ${c.copied + c.moved} file(s) ${r.mode === "move" ? "moved" : "copied"}, ${c.references} reference entr${c.references === 1 ? "y" : "ies"}, ${c.pages} page(s), ${c.present} already in the record, ${c.refused} refused, ${c.changed} changed since the gather`);
+  out.push(`CHECKED ${c.copied + c.moved} file(s) ${r.mode === "move" ? "moved" : "copied"}, ${c.references} reference entr${c.references === 1 ? "y" : "ies"}, ${c.pages} page(s), ${c.present} already in the record, ${c.refused} refused, ${c.changed} changed since the gather${c.duplicates ? `, ${c.duplicates} duplicate(s) left in the pile` : ""}`);
+  if (r.keychainLines?.length) out.push(`CHECKED ${r.keychainMoved + r.keychainKept} credential file(s)  ${r.keychainMoved} with their value(s) moved to the Keychain, ${r.keychainKept} kept in the sealed file`);
   return out;
 }
 
@@ -587,6 +717,10 @@ export function revertGather(path, { force = false, now = new Date() } = {}) {
   }
   let removed = 0;
   for (const f of files) { const a = join(root, f.path); if (existsSync(a)) { unlinkSync(a); removed += 1; } }
+  // HQ-1916: every Keychain item this apply added, removed again. Never blocks the revert: a value
+  // already gone from the Keychain (the owner deleted it by hand) is simply not there to remove.
+  let keychainRemoved = 0;
+  for (const account of m.keychain ?? []) if (removeSecret({ account, keychainPath: m.keychainPath ?? null })) keychainRemoved += 1;
   let put = 0;
   if (!falsified("revert-not-exact")) {
     for (const f of m.modified) {
@@ -608,9 +742,21 @@ export function revertGather(path, { force = false, now = new Date() } = {}) {
     rmdirSync(a);
   }
   if (m.made?.root && existsSync(root) && readdirSync(root).length === 0) rmdirSync(root);
+  // Last, once nothing more is written: every folder the apply changed gets its times back, deepest
+  // first. One the owner removed since is named and not made again for its time.
+  const dirTimes = Array.isArray(m.dirTimes) ? m.dirTimes : null;
+  const timesSet = [];
+  const dirsGone = [];
+  if (dirTimes && !falsified("revert-dir-times")) {
+    for (const d of [...dirTimes].sort((a, b) => b.path.split(sep).length - a.path.split(sep).length)) {
+      if (!existsSync(d.path) || !statSync(d.path).isDirectory()) { dirsGone.push(d.path); continue; }
+      utimesSync(d.path, d.atimeMs / 1000, d.mtimeMs / 1000);
+      timesSet.push(d.path);
+    }
+  }
   m.reverted = now.toISOString();
   writeFileSync(abs, JSON.stringify(m, null, 2) + "\n");
-  return { manifest: abs, target: root, restored, removed, put, kept, gone, edited, forced: force && edited.length > 0 };
+  return { manifest: abs, target: root, restored, removed, put, kept, gone, edited, forced: force && edited.length > 0, keychainRemoved, dirTimes: dirTimes ? { set: timesSet.length, gone: dirsGone } : null };
 }
 
 export function revertLines(r) {
@@ -621,7 +767,11 @@ export function revertLines(r) {
   if (r.forced) out.push(`  forced   ${r.edited.length} file(s) edited since the apply were removed: ${r.edited.join(", ")}`);
   for (const d of r.kept) out.push(`  kept     ${d}/, which holds files the apply did not write`);
   if (r.gone.length) out.push(`  gone     ${r.gone.length} file(s) were already removed`);
+  if (r.dirTimes?.gone.length) out.push(`  gone     ${r.dirTimes.gone.length} folder(s) removed since the apply, left as they are: ${r.dirTimes.gone.map((d) => (d.startsWith(r.target + sep) ? posix(relative(r.target, d)) : d)).join(", ")}`);
+  if (r.keychainRemoved) out.push(`  removed  ${r.keychainRemoved} Keychain item(s) the apply added`);
   out.push(`CHECKED ${r.removed + r.restored + r.put} file(s) reverted  ${r.kept.length} folder(s) kept`);
+  if (r.keychainRemoved) out.push(`CHECKED ${r.keychainRemoved} Keychain item(s) removed`);
+  out.push(r.dirTimes ? `CHECKED ${r.dirTimes.set} folder time(s) restored, ${r.dirTimes.gone.length} folder(s) gone` : "SKIPPED folder times: this reversal manifest is older than HQ-1368's folder times, so none were kept");
   return out;
 }