create-evda 0.1.8 → 0.1.10

package/lib/mcp.mjs

@@ -11,8 +11,8 @@
 //
 // Every tool here reads and writes files on this machine, with two exceptions. evda_check_update
 // asks the npm registry for the tooling's latest version number; it carries nothing from the record
-// and installs nothing. The device tools (evda_pair_device, evda_sync_devices, HQ-1217) talk to the
-// relay that carries the record between the owner's own devices, and what they send is sealed on
+// and installs nothing. The device tools (evda_pair, evda_finish_pairing, evda_sync_devices,
+// evda_remove_device; HQ-1217, HQ-2040) talk to the relay that carries the record between the owner's own devices, and what they send is sealed on
 // this machine: the relay cannot read it.
 
 import { createInterface } from "node:readline";
@@ -23,14 +23,21 @@ import * as tools from "./tools.mjs";
 import * as presets from "./presets.mjs";
 import * as gather from "./gather.mjs";
 import * as gatherApply from "./gather-apply.mjs";
+import * as adoptLib from "./adopt.mjs";
 import { checkForUpdate, summarize } from "./update-check.mjs";
 import { callerFrom } from "./readers.mjs";
 import { listSkills, getSkill, writeSkill, noticeRepeat, SKILLS_REL } from "./skills.mjs";
 import { createSubrecord } from "./subrecord.mjs";
 import { FALSIFY } from "./mcp-auth.mjs";
-import { filingOf, FILING_MODES } from "./day-file.mjs";
+import { filingOf, FILING_MODES, entriesAsk } from "./day-file.mjs";
 import { readManifest, writeManifest } from "./manifest.mjs";
 import * as pairing from "./pairing.mjs";
+import { encodeQr, qrPng, qrText } from "./qr.mjs";
+import { splitFence } from "./agents.mjs";
+import { touches, touchesText, warmTouches } from "./touches.mjs";
+import { CLAUDE_AI_LAYER_BUDGET, appNamed } from "./connecting-apps.mjs";
+import { EVERY_CHAT_KEY, EVERY_CHAT_VERSION, CHAT_APPS, chatAppOf, needsEveryChat, everyChatWalkthrough } from "./every-chat.mjs";
+import { newToolsFor, newToolsNotice } from "./connector-tools.mjs";
 
 // Newest first. The server answers with the client's version when it supports it, and with the
 // newest otherwise; the client decides whether to continue.
@@ -41,7 +48,8 @@ export const SERVER_NAME = "evda";
 // acting on this field (2026-09-22: it told Mike "I only write to EVÐA when you ask me to" while
 // this said to file unasked), so the trigger is also the first words of evda_write's description,
 // which is what a deferred tool shows. This stays for the clients that read it.
-export function instructions(filing) {
+export function instructions(filing, surface = "terminal") {
+  const chat = surface !== "terminal";
   const lines = [
     "This server is the owner's EVDA: their record, in plain files on this machine.",
     "Call evda_operating_layer first and follow it for the whole session: it is who you are (Iris unless they renamed you) and how the record is kept.",
@@ -51,13 +59,17 @@ export function instructions(filing) {
     ...(filing === null ? ["They have not said how filing works yet: evda_operating_layer holds the one question to ask them first, and evda_filing records the answer."] : []),
     "The day's entry is their words verbatim plus one line of context on what the conversation was about, passed as evda_write's context: that line is yours and is labeled as not theirs, and it is never written into words. Where anything else goes (a person's page, a project, the ledger) is your call by the record's four roles, journal, work, collections and knowledge.",
     "When you notice a process repeating (the same steps done or explained a second time, the same correction twice), write it once as a skill with evda_write_skill and tell the owner in one line; read the skills there are with evda_skills and follow the one that fits; when a run of one goes wrong, revise it. A skill is how you work, never a rule about their life.",
+    "When the owner corrects you, record it in the same turn with evda_record_correction: it appends one dated entry where this record keeps corrections (the file evda.json names as \"corrections\", else AGENTS.md's \"What I have been taught\"), in their own words where they gave some, and nothing else in that file changes.",
     "When they ask for an EVÐA inside this one (a project, a company, an agent), make it with evda_create_subrecord; it runs doctor and returns the report. Sharing, grants and deletes still wait for their explicit yes.",
     "When they say to just note something, file it with evda_note instead: no AI reads a noted entry, you included, until they say it can, and then evda_release_note clears it. A sealed entry or section is theirs alone: no tool shows it or releases it, and you are never told where it is; when a tool says part of the record is sealed, tell them it is there for them on their own device. When a tool says something was not shown, tell them in one plain sentence what is there and how they open it.",
     ...(filing === "asked" ? [] : ["Filing is expected without being asked: they should never have to say \"save this\", and a conversation that ends with nothing of theirs filed has lost it."]),
-    "Never quiz them. Never create a circle or grant; propose one with evda_propose_circle only when they ask to share, and wait for their yes.",
+    // A chat app is offered the chat tool set (chatToolNames), so its instructions name no tool outside it (HQ-2227).
+    chat
+      ? "Never quiz them. Never create a circle or grant: when they ask to share, propose it in words and wait for their yes."
+      : "Never quiz them. Never create a circle or grant; propose one with evda_propose_circle only when they ask to share, and wait for their yes.",
     "Organization comes from the preset library (evda_presets): propose with evda_propose_structure, and apply with evda_apply_preset only after their yes.",
-    "When they point you at a pile they already have (a folder, an export), call evda_gather, then ask the questions from evda_gather_questions one at a time in your own words, and record each answer with evda_gather_answer. When every question is answered and the owner says yes to the summary, apply it with evda_gather_apply and confirmed: true; tell them the reversal manifest it names.",
-    DISPATCH_LINE,
+    ...(chat ? [] : ["When they point you at a pile they already have (a folder, an export), call evda_gather, then ask the questions from evda_gather_questions one at a time in your own words, and record each answer with evda_gather_answer. When every question is answered and the owner says yes to the summary, apply it with evda_gather_apply and confirmed: true; tell them the reversal manifest it names."]),
+    chat ? CHAT_DISPATCH_LINE : DISPATCH_LINE,
     PRIVACY_INSTRUCTIONS,
   ];
   return lines.join(" ");
@@ -95,8 +107,239 @@ export const PRIVACY_SECTION = [
 // Dispatch (HQ-1246), one line on every surface an agent reads first: the server instructions and
 // the operating layer. The vault's AGENTS-template.md is the core's source; until it carries this
 // line, this is where it lives, and evda_operating_layer serves it above AGENTS.md.
-export const DISPATCH_LINE = "Call evda_replies at the start of a run: it returns the owner's replies to your messages that you have not seen yet. When the owner should hear something from you (what you did, a question), send it with evda_message, which shows it on their phone as a card; a thing only filed waits until they go looking.";
+export const DISPATCH_LINE = "Call evda_replies at the start of a run: it returns the owner's replies to your messages that you have not seen yet. When the owner should hear something from you (what you did, a question), send it with evda_message. It only files the message into the record; whether that reaches them as a notification depends on their EVÐA app being paired and synced, which this tool cannot see or confirm. Never tell the owner a notification or a card went out -- say only that you sent or filed the message, and that a reply, if any, comes back through evda_replies.";
 export const DISPATCH_SECTION = `## Messages to the owner\n\n${DISPATCH_LINE}`;
+// In a chat app the owner is reading the conversation, so a message goes in the reply, and their
+// replies to messages other agents sent come in the layer call's result (HQ-2227). So the chat layer
+// says that and names neither evda_message nor evda_replies, which the chat tool set leaves out.
+export const CHAT_DISPATCH_LINE = "In a chat app the owner is reading this conversation, so tell them here, in your reply. Their replies to messages an agent sent them come with this layer when you pass first_message, under \"Their replies you have not seen\".";
+export const CHAT_DISPATCH_SECTION = `## Messages to the owner\n\n${CHAT_DISPATCH_LINE}`;
+export const dispatchSection = (surface) => (surface === "terminal" ? DISPATCH_SECTION : CHAT_DISPATCH_SECTION);
+
+// The operating layer as a chat app receives it (HQ-2203): the chat lines, Dispatch, privacy, a line
+// with the layer's size, the generated core when the agents file lacks it (tools.coreBeside), and
+// the agents file whole. His measured 2026-10-04: an owner layer of 72,284 characters plus a core
+// of about 28,600 is about 27,300 tokens (Anthropic's count_tokens, 3.7 characters a token), over
+// the 25,000-token cap Claude Code puts on one MCP tool result. So a layer longer than its client's
+// part size comes in parts, cut only where a `## ` section starts (inside a section only when one
+// section alone is too long), and every part ends by naming the next.
+export const LAYER_PART_MAX = 80_000;
+const PART_RESERVE = 400;
+
+// Which of the owner's sections a client gets is the owner's call, made with one marker (HQ-2207):
+// a `## ` section with SURFACE_TERMINAL on a line of its own text applies only where the agent has a shell
+// (the scripts it may run, the hosts it may ssh to, its local MCP servers). A coding agent gets every
+// section; any other client, named or not, gets the rest. A chat app is the default, so an app this
+// table has never heard of works on day one, and a record with no marker reads the same everywhere.
+export const SURFACE_TERMINAL = "<!-- evda:surface terminal -->";
+
+// Whether one `## ` section is marked for a terminal (HQ-2223, slice 2): the marker on a line of its
+// own anywhere in the section's own text, before its first subsection, and not inside a code fence.
+// It used to count only on the line right after the heading, and on 2026-10-05 an edit that put one
+// line above it turned a terminal section into a chat one with nothing said; a marker the owner wrote
+// in the section means what it says wherever the section's own text holds it. A marker under a `### `
+// is not the section's, and one in a fence is the marker being shown, not used.
+export function terminalOnly(sec) {
+  let fence = null;
+  for (const line of sec.split(/\r?\n/).slice(1)) {
+    const t = line.trim();
+    const f = /^(`{3,}|~{3,})/.exec(t);
+    if (f) {
+      if (fence === null) fence = f[1][0];
+      else if (f[1][0] === fence) fence = null;
+      continue;
+    }
+    if (fence !== null) continue;
+    if (/^#{3,}\s/.test(t)) return false;
+    if (t === SURFACE_TERMINAL) return true;
+  }
+  return false;
+}
+
+// Which app is connecting, and what it is served: the one table in lib/connecting-apps.mjs
+// (HQ-2218), read here by exact name. An app it does not name gets a chat app's sections and the
+// smallest documented part, LAYER_PART_MAX.
+export { CLAUDE_AI_LAYER_BUDGET };
+export function clientProfile(name) {
+  const known = appNamed(name);
+  if (known) return { app: known.app, surface: known.surface, max: known.max ?? LAYER_PART_MAX, budget: known.budget ?? CHAT_LAYER_BUDGET };
+  return { app: null, surface: "chat", max: LAYER_PART_MAX, budget: CHAT_LAYER_BUDGET };
+}
+
+// The owner layer for one surface: the text without the sections tagged for another, and the
+// headings it left out. A terminal reads the text as it is.
+export function forSurface(text, surface) {
+  if (surface === "terminal" || !text.includes(SURFACE_TERMINAL)) return { text, left: [] };
+  const left = [];
+  const kept = text.split(/^(?=## )/m).filter((sec) => {
+    const m = /^## (.*)/.exec(sec);
+    if (m && terminalOnly(sec)) { left.push(m[1].trim()); return false; }
+    return true;
+  });
+  return { text: kept.join(""), left };
+}
+
+// A section the owner marked for a terminal is dropped from a chat app's layer without a word
+// (HQ-2227). It used to be named in a line ("left out here: ..."), and a chat app read that as a
+// list to fetch: claude.ai, 2026-10-05, spent calls asking for sections it could not be given.
+
+// The chat budget (HQ-2223): how long the operating layer a chat app reads in its first call may
+// be, in characters, everything in that result counted. Set from two measurements: the generated
+// core, which every chat needs whole, is about 29,100 characters (his IRIS.md, 2026-10-05), and the
+// lines above it (chat section, Dispatch, privacy) about 4,500. A budget of 70,000 leaves the owner's
+// own sections about as much room again as the core, enough for the opening sections a first reply
+// draws on (his reach through "Proactive Context Loading", 29,700 characters), while the whole result
+// stays under LAYER_PART_MAX minus the part reserve, so every chat app (ChatGPT and unknown apps
+// included) takes it in one call, and near 19,000 tokens (3.7 characters a token) instead of the
+// 27,300 his whole layer cost. Past it, a section is one line in an index and is fetched whole by
+// name when a conversation needs it. A coding agent is not budgeted: it gets every section.
+export const CHAT_LAYER_BUDGET = 70_000;
+// The size line ("Operating layer: N characters, in one part.") is written after the layer is cut.
+const SIZE_LINE_RESERVE = 120;
+// A listed section's first line is cut here, at a word, so one long paragraph cannot fill the index.
+const INDEX_LINE_MAX = 200;
+
+// The owner layer as units, in order. A unit with a heading is one `## ` section with everything
+// under it; a unit with none is served whole always: the text before the first heading, and the
+// installer's generated fence (the core, in a scaffolded AGENTS.md), which is never listed.
+export function ownerUnits(text) {
+  let fence = null;
+  try { fence = splitFence(text); } catch { fence = null; }
+  const chunks = fence ? [[fence.before, false], [fence.generated, true], [fence.after, false]] : [[text, false]];
+  const units = [];
+  for (const [chunk, pinned] of chunks) {
+    if (!chunk) continue;
+    if (pinned) { units.push({ text: chunk, heading: null }); continue; }
+    for (const sec of chunk.split(/^(?=## )/m)) {
+      if (!sec) continue;
+      const m = /^## (.*)/.exec(sec);
+      units.push({ text: sec, heading: m ? m[1].trim() : null });
+    }
+  }
+  return units;
+}
+
+function firstLineOf(sec) {
+  const line = sec.split("\n").slice(1).map((l) => l.trim()).find((l) => l && l !== SURFACE_TERMINAL) ?? "";
+  if (line.length <= INDEX_LINE_MAX) return line;
+  const cut = line.slice(0, INDEX_LINE_MAX);
+  const at = cut.lastIndexOf(" ");
+  return `${at > INDEX_LINE_MAX / 2 ? cut.slice(0, at) : cut}...`;
+}
+
+// A listed section, where it stands in the owner layer: its heading, how to fetch it, and how it opens.
+function sectionStub(u) {
+  return `## ${u.heading}\n\n(Listed here, not served whole, to keep a chat's first call short: call evda_operating_layer with {"section": ${JSON.stringify(u.heading)}} and read it whole before acting on it. It opens: ${firstLineOf(u.text)})\n\n`;
+}
+
+// The owner layer as a chat app reads it: whole when the result fits the budget. Otherwise first
+// fit, in the file's order: each section is served whole if the result still fits with it, and is
+// listed where it stands if not, and the next one is tried. One large section early in a file does
+// not push out every smaller one after it (HQ-2223: for Mike, Preferences, how to talk to him).
+// `fixed` is everything else in the result. The stubs are counted from the start, so a section is
+// kept only when the result with it, and with every section not yet decided listed, fits.
+export function fitChat(text, fixed, budget = CHAT_LAYER_BUDGET) {
+  if (fixed + text.length <= budget) return { text, listed: [] };
+  const units = ownerUnits(text);
+  const sections = units.filter((u) => u.heading !== null);
+  if (!sections.length) return { text, listed: [] };
+  const keep = new Set();
+  const render = () => units.map((u) => (u.heading === null || keep.has(u) ? u.text : sectionStub(u))).join("");
+  let size = fixed + render().length;
+  for (const u of sections) {
+    const grow = u.text.length - sectionStub(u).length;
+    if (size + grow <= budget) { keep.add(u); size += grow; }
+  }
+  return { text: render(), listed: sections.filter((u) => !keep.has(u)).map((u) => u.heading) };
+}
+
+// One section of the owner layer, whole, by its heading: matched exactly, then without case, with
+// or without a leading "## ". Every section under that heading comes back, in order. A section the
+// owner tagged for a terminal is refused to any other client.
+export function findSection(text, name, surface) {
+  if (typeof name !== "string" || !name.trim()) throw tools.refuse('evda_operating_layer "section" is a heading of the owner layer, as the list in the first result names it.', "BAD_ARGUMENT");
+  const want = name.trim().replace(/^##\s+/, "").trim();
+  const units = ownerUnits(text).filter((u) => u.heading !== null);
+  let hits = units.filter((u) => u.heading === want);
+  if (!hits.length) hits = units.filter((u) => u.heading.toLowerCase() === want.toLowerCase());
+  const offered = [...new Set(units.filter((u) => surface === "terminal" || !terminalOnly(u.text)).map((u) => u.heading))];
+  if (!hits.length) throw tools.refuse(`The owner layer has no section ${JSON.stringify(want)}. Its sections are: ${offered.map((h) => JSON.stringify(h)).join(", ")}.`, "NO_SECTION");
+  if (surface !== "terminal") {
+    const served = hits.filter((u) => !terminalOnly(u.text));
+    if (!served.length) throw tools.refuse(`${JSON.stringify(hits[0].heading)} applies only where the agent has a terminal (its owner marked it so), so it is not served in a chat app.`, "TERMINAL_ONLY");
+    hits = served;
+  }
+  return { heading: hits[0].heading, text: hits.map((u) => u.text).join("\n") };
+}
+
+// A section fetched whole, in parts when it is longer than the client's part size.
+export function sectionParts(evda, client, name) {
+  const profile = clientProfile(client?.name);
+  const r = tools.operatingLayer(evda);
+  const s = findSection(r.text, name, profile.surface);
+  const head = `Section ${JSON.stringify(s.heading)} of the owner layer, whole.`;
+  const max = profile.max;
+  const pieces = packSections(s.text, max - PART_RESERVE - head.length - 2, max - PART_RESERVE);
+  const n = pieces.length;
+  const ask = (i) => `{"section": ${JSON.stringify(s.heading)}, "part": ${i}}`;
+  const parts = pieces.map((p, i) => {
+    const top = i === 0 ? `${head}\n\n` : `Section ${JSON.stringify(s.heading)}, part ${i + 1} of ${n}, continued.\n\n`;
+    const end = i < n - 1 ? `\n\n(Part ${i + 1} of ${n} ends here. The section continues: call evda_operating_layer with ${ask(i + 2)} now.)` : "";
+    return `${top}${p}${end}`;
+  });
+  return { path: r.path, heading: s.heading, parts };
+}
+
+export function coreBlock(r) {
+  if (r.core) return [r.core.text];
+  if (r.coreNote) return [r.coreNote];
+  return [];
+}
+
+export function layerParts(evda, client = null) {
+  const profile = clientProfile(client?.name);
+  const r = tools.operatingLayer(evda);
+  const owner = forSurface(r.text, profile.surface);
+  const head = [chatSection(evda, r.text, { app: profile.app }), dispatchSection(profile.surface), PRIVACY_SECTION].join("\n\n");
+  const core = coreBlock(r);
+  // Everything in the result but the owner sections: head, size line, core, and the joins between.
+  const fixed = head.length + 2 + SIZE_LINE_RESERVE + 2 + core.reduce((n, c) => n + c.length + 2, 0);
+  const fit = profile.surface === "terminal" ? { text: owner.text, listed: [] } : fitChat(owner.text, fixed, profile.budget);
+  const body = [...core, fit.text].join("\n\n");
+  const max = profile.max;
+  const pieces = packSections(body, max - PART_RESERVE - head.length, max - PART_RESERVE);
+  const n = pieces.length;
+  const chars = head.length + body.length;
+  const size = `Operating layer: ${chars.toLocaleString("en-US")} characters, in ${n === 1 ? "one part" : `${n} parts`}.${n === 1 ? "" : " Read every part before your first answer; each part ends by naming the next."}`;
+  const parts = pieces.map((p, i) => {
+    const top = i === 0 ? `${head}\n\n${size}\n\n` : `Operating layer, part ${i + 1} of ${n}, continued.\n\n`;
+    const end = i < n - 1 ? `\n\n(Part ${i + 1} of ${n} ends here. The layer continues: call evda_operating_layer with {"part": ${i + 2}} now, before answering.)` : "";
+    return `${top}${p}${end}`;
+  });
+  return { path: r.path, core: r.core?.path ?? null, parts, chars, surface: profile.surface, left: owner.left, listed: fit.listed };
+}
+
+// Split text into pieces of at most `max` characters (the first at most `first`), cutting where a
+// `## ` heading starts; a section longer than a piece is cut at a line, and a line at a character.
+// The pieces joined with "" are the text.
+export function packSections(text, first, max) {
+  const units = [];
+  for (const sec of text.split(/^(?=## )/m)) {
+    if (sec.length <= Math.min(first, max)) { units.push(sec); continue; }
+    for (const line of sec.split(/(?<=\n)/)) {
+      for (let i = 0; i < line.length; i += max) units.push(line.slice(i, i + max));
+    }
+  }
+  const out = [];
+  let cur = "";
+  for (const u of units) {
+    const cap = out.length === 0 ? first : max;
+    if (cur && cur.length + u.length > cap) { out.push(cur); cur = ""; }
+    cur += u;
+  }
+  out.push(cur);
+  return out;
+}
 
 const str = (description) => ({ type: "string", description });
 
@@ -106,6 +349,22 @@ const str = (description) => ({ type: "string", description });
 const NEEDS_A_COMMAND = new Set(["UPDATE_AVAILABLE", "UNSTAMPED"]);
 const TERMINAL_NOTE = "Run that command in a terminal on this machine. Nothing here can run it: this server tells the owner an update exists, it never installs one.";
 
+// Layer 1 of HQ-2205: the first words of every tool a chat app shows the model. claude.ai defers
+// connector tools and shows only each one's cut-off first line, and it does not act on the server's
+// instructions, so the first line is the only place a model that never loaded the layer reads that
+// it should. The clause carries its reason in a few words, then the tool's own description follows.
+// evda_write and evda_note keep their trigger as their first words (HQ-1385 measured that the first
+// words are what files) and carry the same clause inside their first sentence instead.
+// HQ-2223: the clause follows each tool's own first sentence. claude.ai's tool search ranks on the
+// description, and when every one opened with this same sentence it took three searches to find
+// evda_write (2026-10-05).
+// HQ-2223, slice 2: the clause no longer names the layer tool. With evda_operating_layer in all 29
+// descriptions, a search for "operating layer" matched every tool equally and returned five that
+// were not it (2026-10-05). So only the layer tool carries those words, and every other tool points
+// at it by what it does; a model that has the name from the server's instructions searches by it.
+export const LAYER_TOOL_REF = "the tool that loads who you are here";
+export const LAYER_FIRST = `Call ${LAYER_TOOL_REF} first in a new chat. `;
+
 // evda_write's description, by the owner's filing answer. It leads with when to call it, because a
 // deferred connector tool shows the model its name and the first line of its description and
 // nothing else until it is loaded (HQ-1385). An owner who has not answered is filed for as if they
@@ -113,28 +372,123 @@ const TERMINAL_NOTE = "Run that command in a terminal on this machine. Nothing h
 // EVDA_CHAT_FALSIFY=old-description serves the description from before HQ-1385, which says what the
 // tool does and never when, for the test that shows the first line is what files.
 export const WRITE_DESCRIPTION = {
-  everything: "Call on every message the owner sends, unless automatic filing is off: files their words verbatim in today's daily file, one section per conversation (pass context, one line on what it is about, with the first), and returns the path. Append only. Refuses anything shaped like a password, key or token.",
-  asked: "Call only when the owner asks you to save or file something (they turned automatic filing off): files their words verbatim in today's daily file, one section per conversation, and returns the path. Append only. Refuses anything shaped like a password, key or token.",
+  everything: `Call on every message the owner sends (in a new chat, after ${LAYER_TOOL_REF}), unless automatic filing is off: files the owner's message verbatim and writes it to today's daily file, one section per chat (with the first, pass context: one line on what it is about), and returns the path. Append only. Refuses a password, key or token.`,
+  asked: `Call only when the owner asks you to save or file something (in a new chat, after ${LAYER_TOOL_REF}; they turned automatic filing off): files the owner's message verbatim and writes it to today's daily file, one section per chat, and returns the path. Append only. Refuses anything shaped like a password, key or token.`,
   old: "Appends the owner's words, exactly as they said them, to today's daily file under the local time, with one line of context on what the conversation was about when given, and returns the path. Append only: it takes no path and never edits or replaces anything. Refuses anything shaped like a password, key or token.",
 };
 const chatFalsified = (mode, env = process.env) => (env.EVDA_CHAT_FALSIFY ?? "").split(",").map((x) => x.trim()).includes(mode);
 
+const OWN_TRIGGER_FIRST = new Set(["evda_operating_layer", "evda_write", "evda_note"]);
+
 // The tool list a client sees, with the descriptions that depend on the owner's filing answer.
-export function toolList(filing, env = process.env) {
-  return TOOLS.map(({ run, ...t }) => {
-    if (t.name !== "evda_write") return t;
-    const description = chatFalsified("old-description", env) ? WRITE_DESCRIPTION.old : WRITE_DESCRIPTION[filing === "asked" ? "asked" : "everything"];
-    return { ...t, description };
+export function toolList(filing, env = process.env, only = null) {
+  return TOOLS.filter((t) => !only || only.has(t.name)).map(({ run, ...t }) => {
+    if (t.name === "evda_write") {
+      const description = chatFalsified("old-description", env) ? WRITE_DESCRIPTION.old : WRITE_DESCRIPTION[filing === "asked" ? "asked" : "everything"];
+      return { ...t, description };
+    }
+    if (OWN_TRIGGER_FIRST.has(t.name)) return t;
+    const lead = firstSentence(t.description);
+    return { ...t, description: `${lead} ${LAYER_FIRST}${t.description.slice(lead.length).trimStart()}`.trimEnd() };
   });
 }
 
+// The tools a chat app is offered (HQ-2227). claude.ai defers every connector tool behind a search
+// that returns about five, so each tool a chat needs can cost a search, and 37 tools made the first
+// answer take about 7 calls (2026-10-05). The rule: a chat app gets every tool the operating layer it
+// reads tells it to use, and nothing else. So the set is derived from that layer, for this record and
+// this client: every evda_* name in it (the chat lines, the core, the owner sections a chat may read,
+// listed ones included), every `evda <command>` it says to run mapped to the tool that does it here,
+// and the few tools its prose asks for without a name. A coding agent gets every tool.
+//
+// A command the core names must be in CLI_TOOLS, mapped to the tools that do it in a chat or to none
+// with the reason; test/chat-tools.test.mjs fails on one that is not, so a new command is a decision.
+export const CLI_TOOLS = {
+  "check-update": ["evda_check_update"],
+  acknowledge: ["evda_acknowledge"],
+  preset: ["evda_presets", "evda_propose_structure", "evda_apply_preset"],
+  note: ["evda_note"],
+  release: ["evda_release_note"],
+  // "after structural changes when the platform allows it": in a chat the structural tools
+  // (evda_apply_preset, evda_create_subrecord) report what doctor would, so it is not offered there.
+  doctor: [],
+  // The installer's own commands, run in a terminal; nothing here runs them.
+  upgrade: [],
+  "local-model": [],
+};
+// What the core asks for in prose, without a tool name: reading by path and searching (every
+// session, "Read the last few days ... and anything they point you at"), an entry or a person's page
+// growing ("Entries grow on their own"), the setup answers, an import ("An import is what another AI said"), and the filing
+// answer ("ask them once ... and record the answer there").
+// HQ-2228: an entry growing is evda_append (any entry) beside evda_record_person_note (a person's
+// page), and setup ("Write each answer into that section in their exact words") is evda_setup_answer.
+// HQ-2328/HQ-2331: a row in a log kept as a table is evda_append_row, and the page, person's page or
+// folder the core says to offer ("start it only on their yes") is evda_create. HQ-2333: an item in a
+// board or queue kept as a list is evda_append_item.
+export const CHAT_PROSE_TOOLS = ["evda_operating_layer", "evda_write", "evda_read", "evda_search", "evda_recent", "evda_record_person_note", "evda_append", "evda_append_row", "evda_append_item", "evda_create", "evda_setup_answer", "evda_import", "evda_filing"];
+
+// The tool names a text tells an agent to use: evda_* names and `evda <command>` runs.
+export function toolsNamedIn(text) {
+  const names = new Set(text.match(/\bevda_[a-z_]+\b/g) ?? []);
+  for (const m of text.matchAll(/`evda ([a-z][a-z-]*)/g)) for (const t of CLI_TOOLS[m[1]] ?? []) names.add(t);
+  return names;
+}
+
+export function chatToolNames(evda, { app = null } = {}) {
+  const known = new Set(TOOLS.map((t) => t.name));
+  const names = new Set(CHAT_PROSE_TOOLS);
+  let text = "";
+  try {
+    const r = tools.operatingLayer(evda);
+    const owner = forSurface(r.text, "chat").text;
+    text = [chatSection(evda, r.text), CHAT_DISPATCH_SECTION, PRIVACY_SECTION, ...coreBlock(r), owner].join("\n\n");
+  } catch { text = chatSection(evda, ""); }
+  text += `\n\n${instructions(filingOf(evda.manifest), "chat")}`;
+  for (const n of toolsNamedIn(text)) names.add(n);
+  // The every-chat walkthrough rides on a chat's first result while this app has no answer.
+  if (needsEveryChat(evda.manifest, app, filingOf(evda.manifest))) names.add("evda_every_chat");
+  return new Set([...names].filter((n) => known.has(n)));
+}
+
+// A description's first sentence: up to the first period that ends a sentence, so not one in an
+// ellipsis or a dotted name such as evda.json.
+export function firstSentence(text) {
+  const m = /^.*?[^.]\.(?=\s|$)/s.exec(text);
+  return m ? m[0] : text;
+}
+
 // The one setup question, asked at first connect when evda.json has no filing answer (HQ-1385).
 export const FILING_QUESTION = "Should I file everything you say here automatically, or only when you ask? (everything)";
 
+// HQ-2326: on 2026-10-07 a claude.ai chat worked out a real read of what he asked, wrote it into a
+// person's page, and replied with only the filing report. In a chat the reply is where he hears it.
+export const REPLY_FIRST_LINE = "- Your reply carries your thinking and your answer. Report filing after it, in one line; a page you write never replaces saying it to them here.";
+
 // The few lines a chat app reads before the whole operating layer (HQ-1385): who the agent is,
 // whether to file, one section per conversation, no share marks or circle rules, and "just note".
 // Five lines, and a sixth that asks the setup question when the owner has not answered it.
-export function chatSection(evda, agentsText = "") {
+// HQ-2228: in a claude.ai chat whose setup is not finished, one line telling the owner that Always
+// allow on this connector makes every chat easier, and where it is. A connector cannot grant itself
+// permission, so it is a recommendation with its reason, never a step setup waits on. Only claude.ai,
+// whose setting this names; another app's is somewhere else, and a setting is never named from memory.
+export const ALWAYS_ALLOW_LINE = "In claude.ai, setting the EVÐA connector to Always allow makes every chat easier: filing and reading happen without them approving each call. Tell them once during this setup, in one line, with where it is: claude.ai Settings, Connectors, EVÐA, tool permissions. It is their choice, and setup goes on either way.";
+
+// THE NOW LINE (HQ-2268). A chat model has no clock and guesses the time, or reads a UTC stamp as
+// the owner's; each surface that worked the time out on its own was wrong once (HQ-713, HQ-2199,
+// HQ-2236). So the agent is handed the time, in the owner's zone, at the top of what it reads first.
+// The zone is this process's own (TZ). The package stays zone-agnostic: whoever runs the server
+// sets TZ to where the owner is, and EVDA_ZONE_SOURCE to how it knows (Hestia: his-zone.mjs, every
+// five minutes). Same shape as the line Hestia's passes open with: `Now: Tue 10/6 9:58 AM PDT (America/Los_Angeles, from ...)`.
+export function nowLine(at = new Date(), env = process.env) {
+  const zone = new Intl.DateTimeFormat().resolvedOptions().timeZone;
+  const p = Object.fromEntries(new Intl.DateTimeFormat("en-US", {
+    timeZone: zone, weekday: "short", month: "numeric", day: "numeric", hour: "numeric", minute: "2-digit", timeZoneName: "short",
+  }).formatToParts(at).map((x) => [x.type, x.value]));
+  const source = String(env.EVDA_ZONE_SOURCE ?? "").trim() || "this machine's clock";
+  return `Now: ${p.weekday} ${p.month}/${p.day} ${p.hour}:${p.minute} ${p.dayPeriod} ${p.timeZoneName} (${zone}, from ${source})`;
+}
+
+export function chatSection(evda, agentsText = "", { app = null } = {}) {
   const field = (label) => new RegExp(`^- \\*\\*${label}:\\*\\*[ \\t]*(\\S.*)$`, "m").exec(agentsText)?.[1]?.trim() ?? "";
   const agent = field("Agent name") || "Iris";
   const owner = (typeof evda.manifest?.owner?.name === "string" && evda.manifest.owner.name.trim()) || field("Who I am") || "the owner";
@@ -142,6 +496,8 @@ export function chatSection(evda, agentsText = "") {
   const lines = [
     "## In a chat app, read this first",
     "",
+    `${nowLine()}. That is the owner's local time: use it for "today", "tonight" and any time you say, and never work it out from a timestamp.`,
+    "",
     `- You are ${agent}, ${owner}'s thinking partner, and this server is their EVÐA; the full operating layer follows and holds for the whole session.`,
     filing === "asked"
       ? "- They turned automatic filing off: file their words with evda_write only when they ask you to."
@@ -149,7 +505,16 @@ export function chatSection(evda, agentsText = "") {
     "- One conversation is one section: your first evda_write opens it with one line of context, and the rest go under it.",
     "- Never write a share mark or a circle rule. When they want to share, propose it and wait for their yes.",
     "- \"Just note this\" means evda_note: no AI reads that entry, you included, until they say it can.",
+    "- When a person, project or place that already has an entry comes up, add a dated section to it with evda_append (a person's page with evda_record_person_note). Neither creates or overwrites anything. A log or board kept as a table grows by a row (evda_append_row), and one kept as a list by an item in its format (evda_append_item).",
+    REPLY_FIRST_LINE,
   ];
+  // HQ-2164: what the agent itself did goes to its own day log. Named here, so a chat app is offered
+  // the tool (chatToolNames offers what this layer names), and only when the record has that log.
+  if (tools.hasAgentLog(evda)) lines.push("- What you yourself did (built, filed, fixed, found) goes to your own day log with evda_write_agent_log, never into their words.");
+  if (tools.setupPending(agentsText)) {
+    lines.push("- Setup is not finished: write each answer into \"What this EVÐA is\" with evda_setup_answer, in their exact words.");
+    if (app === "claude.ai") lines.push(`- ${ALWAYS_ALLOW_LINE}`);
+  }
   if (filing === null && !chatFalsified("no-consent-question")) lines.push(`- They have not said how filing works yet. Before anything else, ask this one line and nothing more: "${FILING_QUESTION}" Record the answer with evda_filing, then file the messages before it too if they said everything.`);
   return lines.join("\n");
 }
@@ -166,30 +531,156 @@ export function setFiling(evda, args = {}) {
   return { filing: args.filing, changed: true };
 }
 
+// Record whether the owner put the every-chat line in one app (HQ-2205, layer 4), so the next chat
+// in that app is not asked again. It writes one entry under evda.json "every_chat" and no other key:
+// the rest of the manifest is written back as it was read. The app defaults to the one this session
+// connected from, which is what the walkthrough named.
+export const EVERY_CHAT_APPS = [...Object.keys(CHAT_APPS), "other"];
+export const EVERY_CHAT_STATES = ["set", "declined"];
+export function setEveryChat(evda, args = {}, { app: sessionApp = null, now = new Date() } = {}) {
+  tools.onlyKeys("evda_every_chat", args, ["app", "state", "confirmed"]);
+  const app = args.app ?? sessionApp;
+  if (!EVERY_CHAT_APPS.includes(app)) throw tools.refuse(`evda_every_chat "app" is ${EVERY_CHAT_APPS.map((a) => JSON.stringify(a)).join(", ")}: the app the owner set it in.`, "BAD_APP");
+  if (!EVERY_CHAT_STATES.includes(args.state)) throw tools.refuse(`evda_every_chat "state" is "set" (they added the line) or "declined" (they do not want it).`, "BAD_STATE");
+  if (args.confirmed !== true) throw tools.refuse("evda_every_chat records what the owner told you. Ask them, and pass confirmed: true only with what they said in this conversation.", "NOT_CONFIRMED");
+  const m = readManifest(evda.dir);
+  const all = m[EVERY_CHAT_KEY] && typeof m[EVERY_CHAT_KEY] === "object" && !Array.isArray(m[EVERY_CHAT_KEY]) ? m[EVERY_CHAT_KEY] : {};
+  const form = filingOf(m) === "asked" ? "asked" : "everything";
+  const entry = { state: args.state, form, version: EVERY_CHAT_VERSION, date: tools.localDate(now) };
+  m[EVERY_CHAT_KEY] = { ...all, [app]: entry };
+  writeManifest(evda.dir, m);
+  return { app, ...entry };
+}
+
+// What an earlier reader already acknowledged in a file (HQ-2060), as one attribute on its tag, so
+// a reader sees the mark in the same breath as the words and never twice-acts on the same entry.
+// Outside the file's text on purpose: nothing the agent writes goes inside the owner's words.
+export function ackAttr(acknowledged = []) {
+  if (!acknowledged?.length) return "";
+  const esc = (s) => String(s ?? "").replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;");
+  const parts = acknowledged.map((a) => `${a.section ? `${a.section}: ` : ""}${esc(a.by ?? "an earlier reader")} at ${esc(a.at)} ${esc(a.note)}`);
+  return ` acknowledged="${parts.join(" | ")}"`;
+}
+
+export function acknowledgedNote(n) {
+  return `${n} entr${n === 1 ? "y" : "ies"} here ${n === 1 ? "is" : "are"} already acknowledged (the acknowledged attribute says who and what they did): do not raise ${n === 1 ? "it" : "them"} again unless the owner does. Anything weighty with no mark is yours to acknowledge once, with evda_acknowledge.`;
+}
+
+// The ride-along arguments on evda_read and evda_search (HQ-2227): the owner's message this turn,
+// filed by fileAlong when the call runs, so a turn that reads files in the same call. evda_write
+// stays the tool for a turn with nothing to read.
+export const ALONG_LINE = "Pass the owner's message this turn as owner_message (and context the first time) and it is filed verbatim as evda_write files it, once per message, so you need no separate evda_write.";
+const ALONG_PROPS = {
+  owner_message: str("The owner's message this turn, verbatim: filler, hedges and typos intact. Filed as evda_write files it, unless they turned automatic filing off. Never a summary."),
+  context: str("With owner_message only: one line, yours, on what the chat is about. Written above their words and labeled as not theirs."),
+};
+
+// Run a read or a search with its ride-along: the tool's own arguments go to the tool, and the
+// filing line follows its result. The filing runs first, so a refused read still files the message.
+function withAlong(evda, args, ctx, toolName, run) {
+  const { owner_message, context, ...rest } = args ?? {};
+  if (owner_message === undefined) {
+    if (context !== undefined) throw tools.refuse(`${toolName} "context" goes with "owner_message": it is the line above the owner's message. Pass both, or neither.`, "BAD_ARGUMENT");
+    return run(rest);
+  }
+  if (typeof owner_message !== "string" || !owner_message.trim()) throw tools.refuse(`${toolName} "owner_message" is the owner's message this turn, verbatim, as text; leave it out when there is none.`, "BAD_ARGUMENT");
+  const f = fileAlong(evda, { words: owner_message, context }, ctx, toolName);
+  let r;
+  try {
+    r = run(rest);
+  } catch (e) {
+    if (e instanceof EvdaError) throw new EvdaError(`${e.message}\n\n${f.head}`, { code: e.code, exit: e.exit });
+    throw e;
+  }
+  return { ...r, text: `${r.text}\n\n---\n\n${f.head}`, filed: f.filed ? f.path : null };
+}
+
 export const TOOLS = [
   {
     name: "evda_operating_layer",
     title: "Read the operating layer",
-    description: "Call first, every session: returns how to act here, a few lines for a chat app, what leaves this device, and then AGENTS.md whole, the record's operating layer (who the agent is, what this EVDA is for in the owner's words, and how the record is kept).",
-    inputSchema: { type: "object", properties: {}, additionalProperties: false },
-    annotations: { readOnlyHint: true, openWorldHint: false },
-    run: (evda, args) => {
-      const r = tools.operatingLayer(evda, args);
-      return { text: `${chatSection(evda, r.text)}\n\n${DISPATCH_SECTION}\n\n${PRIVACY_SECTION}\n\n${r.text}`, data: { path: r.path } };
+    // HQ-2223, slice 2: the first sentence holds the words a model searches by when it starts a chat
+    // as the owner's agent (who you are, the owner's record, a new chat), and this is the one tool
+    // whose definition says "operating layer", so a search for it finds this tool and no other.
+    description: "Loads the operating layer: who you are for the owner and how their record is kept, to read at the start of every new chat before your first reply. Pass the owner's first message as first_message (and context, one line on what the chat is about) and it is filed verbatim in this same call, exactly as evda_write files it, and the result also carries their unseen replies, the recent days (each section's context and the opening of their words) and the people whose pages grew this week, so you can answer after this one call. Returns how to act here, a few lines for a chat app, what leaves this device, the core of how the agent thinks, and then AGENTS.md (who the agent is, what this EVDA is for in the owner's words, and how the record is kept). A long layer comes in parts; read every part before answering. In a chat app, owner sections past a size budget are listed by heading; pass section to read one whole.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        part: { type: "integer", minimum: 1, description: "Which part of a long layer or section. Default 1; the end of each part names the next." },
+        section: { type: "string", description: "A heading from the layer's list of sections, to read that section whole." },
+        first_message: { type: "string", description: "The owner's first message in this chat, verbatim: filler, hedges and typos intact. Filed as evda_write files it, unless they turned automatic filing off. Never a summary." },
+        context: { type: "string", description: "With first_message only: one line, yours, on what the chat is about. Written above their words and labeled as not theirs." },
+      },
+      additionalProperties: false,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+    run: (evda, args, ctx = {}) => {
+      tools.onlyKeys("evda_operating_layer", args, ["part", "section", "first_message", "context"]);
+      const part = args.part === undefined ? 1 : args.part;
+      const opening = args.first_message !== undefined;
+      if (args.context !== undefined && !opening) throw tools.refuse('evda_operating_layer "context" goes with "first_message": it is the line above the owner\'s first message. Pass both, or neither.', "BAD_ARGUMENT");
+      if (opening) {
+        if (typeof args.first_message !== "string" || !args.first_message.trim()) throw tools.refuse('evda_operating_layer "first_message" is the owner\'s first message in this chat, verbatim, as text; leave it out when there is none.', "BAD_ARGUMENT");
+        if (args.section !== undefined || part !== 1) throw tools.refuse('evda_operating_layer "first_message" goes on the first call of a chat, with no "section" and no later "part": the message is filed once, with the start of the layer.', "BAD_ARGUMENT");
+      }
+      if (args.section !== undefined) {
+        const s = sectionParts(evda, ctx.client, args.section);
+        if (!Number.isInteger(part) || part < 1 || part > s.parts.length) throw tools.refuse(`evda_operating_layer "part" is a whole number from 1 to ${s.parts.length}; this section has ${s.parts.length === 1 ? "one part" : `${s.parts.length} parts`}.`, "BAD_ARGUMENT");
+        return { text: s.parts[part - 1], data: { path: s.path, section: s.heading, part, parts: s.parts.length } };
+      }
+      const l = layerParts(evda, ctx.client);
+      if (!Number.isInteger(part) || part < 1 || part > l.parts.length) throw tools.refuse(`evda_operating_layer "part" is a whole number from 1 to ${l.parts.length}; this layer has ${l.parts.length === 1 ? "one part" : `${l.parts.length} parts`}.`, "BAD_ARGUMENT");
+      const data = { path: l.path, core: l.core, part, parts: l.parts.length, chars: l.chars, listed: l.listed };
+      if (!opening) return { text: l.parts[part - 1], data };
+      const start = openChat(evda, args, ctx, { room: clientProfile(ctx.client?.name).max - l.parts[part - 1].length - 7 - AFTER_RUN_RESERVE });
+      return { text: `${l.parts[part - 1]}\n\n---\n\n${start.text}`, data: { ...data, filed: start.filed } };
     },
   },
   {
     name: "evda_recent",
     title: "Read the last few days",
-    description: "Returns every record file dated in the last N days (default 3), newest first, whole.",
+    description: "Lists what the record's last few days were about. Per file, each section's heading, its context line and the opening of the owner's words; N days (default 3), newest first. Read a specific one whole with evda_read, by the path this returns. Each file says what an earlier reader already acknowledged in it, which you do not raise again.",
     inputSchema: { type: "object", properties: { days: { type: "integer", minimum: 1, maximum: 90, description: "How many days back, today included. Default 3." } }, additionalProperties: false },
     annotations: { readOnlyHint: true, openWorldHint: false },
     run: (evda, args, ctx) => {
-      const r = tools.recent(evda, args, { caller: ctx.caller });
-      const body = r.files.map((f) => `<file path="${f.path}" date="${f.date}">\n${f.text}\n</file>`).join("\n\n");
-      const head = `${r.files.length} file(s) dated ${r.from} to ${r.to}${r.omitted ? `, ${r.omitted} more omitted for size (read them with evda_search)` : ""}.`;
-      const main = r.files.length ? `${head}\n\n${body}` : `Nothing${r.refused.length ? " you may read" : ""} in the record is dated ${r.from} to ${r.to}.`;
-      return { text: r.heldBack ? `${main}\n\n${r.heldBack}` : main, data: { from: r.from, to: r.to, paths: r.files.map((f) => f.path), omitted: r.omitted } };
+      const r = tools.recent(evda, args, { caller: ctx.caller, now: ctx.now });
+      const room = ctx.room ?? clientProfile(ctx.client?.name).max - PART_RESERVE;
+      return renderRecent(r, room);
+    },
+  },
+  {
+    name: "evda_acknowledge",
+    title: "Mark that you acted on a weighty entry",
+    description: "Marks a weighty entry acknowledged so no other reader raises it again. Call once you have said a weighty entry back to the owner (a correction, a decision, a hard moment), so no other reader of this record says it again. Writes one mark beside the record, never into the entry. The first reader to reach an entry is the one that acts: when it is already marked this writes nothing, returns who did it and what they did, and you say nothing about that entry unless the owner brings it up. evda_recent shows the marks on every file it returns.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        path: str("The entry you acted on, as a path inside the record: the path evda_recent returned."),
+        section: str("That section's heading exactly as the file writes it (\"## 14:03\"), when the weight is in one section of a day file rather than the whole entry."),
+        note: str("One line: what you did about it. The next reader reads this instead of acting again."),
+        by: str("Who you are, when that is not the agent this record names: a scheduled run, an always-on agent."),
+      },
+      required: ["path", "note"],
+      additionalProperties: false,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    run: (evda, args) => {
+      const r = tools.acknowledgeEntry(evda, args);
+      const what = r.section ? `${r.path} "${r.section}"` : r.path;
+      if (!r.first) return { text: `Already acknowledged by ${r.by ?? "an earlier reader"} at ${r.at}: ${r.note}\n\nNothing was written. Say nothing about ${what} unless the owner brings it up.`, data: r };
+      return { text: `Marked ${what} acknowledged, as ${r.by}. You reached it first, so it is yours to say back to them; every later reader sees this mark and stays quiet.`, data: r };
+    },
+  },
+  {
+    name: "evda_acknowledgements",
+    title: "What readers have already acknowledged",
+    description: "Lists the entries an earlier reader already said back to the owner. Each mark says who did it, when, and what they did. Read only.",
+    inputSchema: { type: "object", properties: {}, additionalProperties: false },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+    run: (evda, args) => {
+      const r = tools.acknowledgements(evda, args);
+      if (!r.count) return { text: "Nothing in this record is acknowledged yet.", data: r };
+      return { text: `${r.count} acknowledged:\n${r.marks.map((m) => `- ${m.key}  (${m.by ?? "unknown"}, ${m.at}): ${m.note}`).join("\n")}`, data: r };
     },
   },
   {
@@ -198,15 +689,183 @@ export const TOOLS = [
     description: WRITE_DESCRIPTION.everything,
     inputSchema: { type: "object", properties: { words: str("The owner's words, verbatim: filler, hedges and typos intact. Never a summary."), context: str("One line, yours, on what the conversation was about. Written above their words and labeled as not theirs. Never their words.") }, required: ["words"], additionalProperties: false },
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+    run: async (evda, args, ctx) => {
+      const dup = sameAsFiled(ctx.session, args?.words);
+      if (dup) return { text: `Already filed: these words were filed in this chat a moment ago (with the layer call, a read or a search), at ${dup.path}. Nothing was written again.`, data: { path: dup.path, deduped: true } };
+      // HQ-2165: writeVerified reads the words back after a short delay and throws instead of
+      // returning, so a clobbered write is never reported to the owner as "Filed".
+      const r = await tools.writeVerified(evda, args, { session: ctx.session });
+      markWrite(ctx.session, args.words, r.path);
+      if (r.queued) return { text: queuedText(r), data: r };
+      return withTouches(evda, ctx, { text: `Filed to ${r.path}.`, data: r }, { path: r.path, words: [args.context, args.words].filter(Boolean).join("\n") });
+    },
+  },
+  {
+    name: "evda_record_correction",
+    title: "Record a correction",
+    description: "Records a correction as one dated entry in what the agent has been taught. Call when the owner corrects you (\"no, don't do that\", \"that's not how I work anymore\"): appends a dated section to the file evda.json names as \"corrections\" when it names one, else one dated line to AGENTS.md's \"What I have been taught\" section, in the owner's own words where they gave some, and returns the path. That section is always outside the installer's block, so `evda upgrade` never touches what this writes. Append only: it never edits or removes an earlier entry. When a correction reverses one, pass supersedes with that entry's date instead of trying to change it.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        words: str("The owner's exact words, quoted verbatim, when they gave some. Omit rather than paraphrase."),
+        change: str("One line: what you do differently now."),
+        title: str("A few words naming what went wrong, e.g. \"missed the midterm when checking a week\". The entry's heading when corrections go to their own file."),
+        supersedes: str("YYYY-MM-DD of an earlier entry this correction reverses, if any."),
+      },
+      required: ["change"],
+      additionalProperties: false,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+    run: (evda, args, ctx) => {
+      const r = tools.recordCorrection(evda, args, { caller: ctx.caller });
+      return { text: `Recorded to ${r.path}, under "${r.section}".`, data: r };
+    },
+  },
+  {
+    name: "evda_write_agent_log",
+    title: "File Iris's own day log",
+    description: "Files the agent's own day log, separate from the owner's words. Call to record what you (the agent, not the owner) did, built, filed or found: appends to Iris's own day log, the one named sub-record at \"01_Projects/Evda/Iris - Universal Thinking Partner/memory/record/daily\", and returns the path. It takes no path. It also keeps the one pointer line to that log under the agent's heading in the owner's day for today (added, or refreshed in place, never a second line), and touches nothing else there. One section per conversation, exactly like evda_write: the first call in a conversation opens the time heading with its context line, and later calls in the same conversation continue it.",
+    inputSchema: { type: "object", properties: { words: str("What you did, in your own words."), context: str("One line on what the conversation was about. Written above the words and labeled as not the owner's.") }, required: ["words"], additionalProperties: false },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+    run: (evda, args, ctx) => {
+      const r = tools.writeAgentLog(evda, args, { session: ctx.session });
+      const p = r.pointer;
+      const pointer = p.state === "failed" ? ` The pointer line in ${p.path} was NOT written (${p.error}); the log entry is filed, so do not call this again for it.`
+        : p.state === "sealed" ? ` ${p.path} is sealed, so its pointer line was left alone.`
+        : ` Pointer line in ${p.path} ${p.state}.`;
+      return { text: `Filed to ${r.path}.${pointer}`, data: r };
+    },
+  },
+  {
+    name: "evda_record_person_note",
+    title: "Add to a person's page",
+    description: "Adds one dated section to an existing person's page, found by their name. Returns the path. A person's page is any page with kind: person-profile frontmatter wherever it is in the record (a Family folder, a second people folder), or any page in the people folder; the name you give matches its filename, its name: or an alias, with or without a trailing parenthetical. Refuses when no page matches (it never creates one; offer to make the page first) and when more than one page matches (say which). Refuses a sealed page, a just-noted page and one in a part set to be read by a different AI. When the page's frontmatter is kind: person-profile, also adds a matching observations entry so the page still passes evda doctor. Append only: an earlier section is never edited or removed.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        person: str("The name on their page, e.g. the file's name without .md."),
+        context: str("One line: what this section is. Becomes the heading and, for a person-profile page, the observation's text."),
+        words: str("The section's words."),
+      },
+      required: ["person", "context", "words"],
+      additionalProperties: false,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+    run: (evda, args, ctx) => {
+      const r = tools.recordPersonNote(evda, args, { caller: ctx.caller });
+      return withTouches(evda, ctx, { text: `Added to ${r.path}${r.observation ? `, observation ${r.observation}` : ""}.`, data: r }, { path: r.path, words: [args.context, args.words].filter(Boolean).join("\n") });
+    },
+  },
+  {
+    name: "evda_append",
+    title: "Add to an existing entry",
+    description: "Adds one dated section to an entry that already exists, by its path. Call when a project, place or other entry the record already has comes up again: appends `## YYYY-MM-DD` and the words to the end of that file, or continues today's section when it is already the last one, and returns the path. With under, the section goes at the end of that heading's section instead (so a new item lands in the queue, not under \"Completed\"), its heading one level below. With title, the heading is `<title> (added YYYY-MM-DD)`. Every byte already there stays as it was. Refuses a path with no entry (start one with evda_create, on their yes), a sealed entry, a just-noted entry, a part set to be read by a different AI, and anything shaped like a password, key or token. A row in a table goes in with evda_append_row, an item in a list with evda_append_item, a person's page through evda_record_person_note, the day's words through evda_write.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        path: str("The existing entry, relative to the record, as evda_search or evda_recent gave it."),
+        words: str("The new section's words. Their experience in their words; never another person's motive stated as fact."),
+        under: str("Optional: the text of a heading in that file, without the #s. The section goes at the end of that heading's section instead of the end of the file."),
+        title: str("Optional, one line: what the section is. The heading becomes `<title> (added YYYY-MM-DD)`."),
+      },
+      required: ["path", "words"],
+      additionalProperties: false,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+    run: (evda, args, ctx) => {
+      const r = tools.appendEntry(evda, args, { caller: ctx.caller });
+      const under = r.under ? ` under "${r.under}"` : "";
+      return withTouches(evda, ctx, { text: r.section === "continued" ? `Added to the ${r.date} section of ${r.path}${under} (continued).` : `Added a ${r.date} section to ${r.path}${under}.`, data: r }, { path: r.path, words: [args.title, args.words].filter(Boolean).join("\n") });
+    },
+  },
+  {
+    name: "evda_append_row",
+    title: "Add a row to a table",
+    description: "Adds one row to a table in an entry that already exists, by its path. Call when the owner reports something kept as a table (a food log, a spike log, a word list): the row goes at the end of that table, its cells in the table's column order, and every other byte of the file stays as it was. Returns the path and the row written. A file with more than one table needs under, the heading whose section holds the table meant. Refuses a row whose cell count is not the table's column count, a cell with a line break, a path with no entry, a sealed or just-noted entry, a part set to be read by a different AI, and anything shaped like a password, key or token.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        path: str("The existing entry, relative to the record, as evda_search or evda_recent gave it."),
+        cells: { type: "array", items: { type: "string" }, description: "The row's cells in the table's column order, one string each, \"\" for an empty cell. Their words where the column holds their words." },
+        under: str("Optional: the text of the heading whose section holds the table, without the #s. Needed when the file has more than one table."),
+      },
+      required: ["path", "cells"],
+      additionalProperties: false,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+    run: (evda, args, ctx) => {
+      const r = tools.appendRow(evda, args, { caller: ctx.caller });
+      return withTouches(evda, ctx, { text: `Added a row to ${r.path}: ${r.row}`, data: r }, { path: r.path, words: (args.cells ?? []).join("\n") });
+    },
+  },
+  {
+    name: "evda_append_item",
+    title: "Add an item to a list",
+    description: "Adds one item to a list in an existing entry. Call when the owner reports something kept as a list of one-line items (a board of weekends or trips, a queue, a reading list): read the list first and write the line in the format its items use, and it goes in after the last item with the list's own marker (the next number in a numbered list), or with after right after the item that names, so a list kept in order stays in order; every other byte of the file is kept. Returns the path and the item written. A file with more than one list needs under, the heading whose section holds the list meant. Refuses a line with a line break, a path with no entry, a section with no list (a new section is evda_append), a sealed or just-noted entry, a part set to be read by a different AI, and anything shaped like a password, key or token.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        path: str("The existing entry, relative to the record, as evda_search or evda_recent gave it."),
+        line: str("The new item, one line, without its marker, in the format the list's other items use. Their words where the list holds their words."),
+        under: str("Optional: the text of the heading whose section holds the list, without the #s. Needed when the file has more than one list."),
+        after: str("Optional: a piece of the text of the item the new one goes right after, as it is written there (for a dated list, the item it follows in date order). Without it the item goes at the end."),
+      },
+      required: ["path", "line"],
+      additionalProperties: false,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+    run: (evda, args, ctx) => {
+      const r = tools.appendItem(evda, args, { caller: ctx.caller });
+      return withTouches(evda, ctx, { text: `Added an item to ${r.path}: ${r.item}`, data: r }, { path: r.path, words: args.line });
+    },
+  },
+  {
+    name: "evda_create",
+    title: "Start a new page or folder",
+    description: "Starts a new page, person's page or folder in the record, on the owner's yes. Call after you offered in one line to start an entry that does not exist yet (\"want me to start a page for X?\") and they said yes in this conversation; pass confirmed: true only then. kind \"page\" makes a Markdown page at path with a title and, with words, a first dated section; kind \"person\" makes their page in the people folder under their name, with the person-profile frontmatter doctor reads and, with context and words, a first section and its observation; kind \"folder\" makes one empty folder. Returns the path. Refuses a path that already exists (it never overwrites), a path outside the record, the record's own files, a folder that is not there yet for the page, a part that is sealed or set to be read by a different AI, and anything shaped like a password, key or token.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        kind: { type: "string", enum: tools.CREATE_KINDS, description: "page, person, or folder." },
+        path: str("For a page or folder: where, relative to the record. A page ends in .md, and the folder it goes in must exist."),
+        person: str("For a person's page: their name, as the page should be called."),
+        title: str("For a page: its title. Defaults to the file name."),
+        context: str("For a person's page, with words: one line on what the first section is. Becomes its heading and the observation's text."),
+        words: str("The first section's words, in the owner's words. Optional."),
+        confirmed: { type: "boolean", description: "true only when the owner said yes to starting this in this conversation." },
+      },
+      required: ["kind", "confirmed"],
+      additionalProperties: false,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
     run: (evda, args, ctx) => {
-      const r = tools.write(evda, args, { session: ctx.session });
-      return { text: `Filed to ${r.path}.`, data: r };
+      const r = tools.createEntry(evda, args, { caller: ctx.caller });
+      return { text: `Created ${r.kind === "folder" ? "the folder" : "the page"} ${r.path}${r.observation ? `, observation ${r.observation}` : ""}.`, data: r };
+    },
+  },
+  {
+    name: "evda_setup_answer",
+    title: "Write a setup answer",
+    description: `Writes one setup answer, in the owner's exact words. Call during setup, once per answer: fills one empty field of AGENTS.md's "What this EVÐA is" (${tools.SETUP_FIELDS.map((f) => JSON.stringify(f)).join(", ")}) and changes nothing else in the file, and returns the path. Refuses a field that already has an answer (changing it is the owner's own edit), more than one line, and anything shaped like a password, key or token.`,
+    inputSchema: {
+      type: "object",
+      properties: {
+        field: { type: "string", enum: tools.SETUP_FIELDS, description: "Which field of \"What this EVÐA is\" this answers." },
+        words: str("Their answer, exactly as they said it: hedges intact, one line. Never a summary."),
+      },
+      required: ["field", "words"],
+      additionalProperties: false,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+    run: (evda, args) => {
+      const r = tools.setupAnswer(evda, args);
+      return { text: `Wrote "${r.field}" in ${r.path}, in their words.`, data: r };
     },
   },
   {
     name: "evda_import",
     title: "File an import from another AI",
-    description: "Files what another AI (ChatGPT, Claude, Gemini...) said it knows about the owner, verbatim, under imports/ with its source and date, and returns the path. An import is not the owner's words; each line is a claim to check with them over time.",
+    description: "Files what another AI said it knows about the owner, verbatim, under imports/. Pass its source (ChatGPT, Claude, Gemini...) and date; returns the path. An import is not the owner's words; each line is a claim to check with them over time.",
     inputSchema: {
       type: "object",
       properties: { text: str("The other AI's answer, verbatim."), source: str("Which AI or app said it."), date: str("YYYY-MM-DD the other AI wrote it. Default today.") },
@@ -222,32 +881,54 @@ export const TOOLS = [
   {
     name: "evda_search",
     title: "Search the record",
-    description: "Plain text search, case-insensitive, over the record, its imports and the ledger, on this machine. Nothing leaves it. Returns each matching line with its path and line number.",
-    inputSchema: { type: "object", properties: { query: str("Words to find."), limit: { type: "integer", minimum: 1, maximum: 500, description: "Most lines to return. Default 50." } }, required: ["query"], additionalProperties: false },
-    annotations: { readOnlyHint: true, openWorldHint: false },
-    run: (evda, args, ctx) => {
-      const r = tools.search(evda, args, { caller: ctx.caller });
+    description: `Searches the record for words, plain text and case-insensitive. It covers the record, its imports and the ledger, on this machine. Nothing leaves it. Returns each matching line with its path and line number. ${ALONG_LINE}`,
+    inputSchema: { type: "object", properties: { query: str("Words to find."), limit: { type: "integer", minimum: 1, maximum: 500, description: "Most lines to return. Default 50." }, ...ALONG_PROPS }, required: ["query"], additionalProperties: false },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+    run: (evda, args, ctx) => withAlong(evda, args, ctx, "evda_search", (rest) => {
+      const r = tools.search(evda, rest, { caller: ctx.caller });
       const lines = r.matches.map((m) => `${m.path}:${m.line}: ${m.text}`);
       const tail = r.more ? `\n${r.more} more match(es) past the limit.` : "";
       const main = r.matches.length ? `${r.matches.length} match(es) in ${r.searched} file(s):\n${lines.join("\n")}${tail}` : `No match for ${JSON.stringify(r.query)} in ${r.searched} file(s).`;
       return { text: r.heldBack ? `${main}\n\n${r.heldBack}` : main, data: r };
-    },
+    }),
   },
   {
     name: "evda_read",
     title: "Read one file of the record",
-    description: "Returns one file of the record, whole, by its path. Refuses, with the reason, a sealed entry, a just-noted entry and a file whose circle is set to be read by a different AI; a sealed section is replaced by one line saying it is there.",
-    inputSchema: { type: "object", properties: { path: str("The file's path, relative to the record.") }, required: ["path"], additionalProperties: false },
-    annotations: { readOnlyHint: true, openWorldHint: false },
-    run: (evda, args, ctx) => {
-      const r = tools.readFile(evda, args, { caller: ctx.caller });
+    description: `Returns one file of the record, whole, by its path. Refuses, with the reason, a sealed entry, a just-noted entry and a file whose circle is set to be read by a different AI; a sealed section is replaced by one line saying it is there. ${ALONG_LINE}`,
+    inputSchema: { type: "object", properties: { path: str("The file's path, relative to the record."), ...ALONG_PROPS }, required: ["path"], additionalProperties: false },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+    run: (evda, args, ctx) => withAlong(evda, args, ctx, "evda_read", (rest) => {
+      const r = tools.readFile(evda, rest, { caller: ctx.caller });
       return { text: `<file path="${r.path}">\n${r.text}\n</file>${r.truncated ? "\n(truncated for size)" : ""}` };
+    }),
+  },
+  // HQ-2066: the phone's editor saves through this, the Mac's save safety on the writer. It is in no
+  // chat set (CHAT_PROSE_TOOLS), so a chat app is never offered a tool that replaces a note.
+  {
+    name: "evda_replace",
+    title: "Save the owner's edit of one note",
+    description: "Replaces one note's whole text with the owner's edit, only when the note is unchanged since it was read. Call only to save an edit the owner made by hand, as the phone's editor does: pass the path, the whole new text, and base, the SHA-256 in hex of the text evda_read returned. Refuses, with nothing written, a note changed since (read it again and edit what is there now), a missing note, a note with a sealed section or too long to read whole, a sealed, just-noted or other-AI note, the record's own files, and a new line shaped like a password, key or token. Returns the path and the saved text's SHA-256, the base for the next save.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        path: str("The note, relative to the record, as evda_read gave it."),
+        text: { type: "string", description: "The note's whole new text, exactly as the owner left it." },
+        base: str("The SHA-256, in hex, of the text evda_read returned for this note."),
+      },
+      required: ["path", "text", "base"],
+      additionalProperties: false,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false },
+    run: (evda, args, ctx) => {
+      const r = tools.replaceNote(evda, args, { caller: ctx.caller });
+      return { text: `${r.changed ? "Saved" : "Nothing to save in"} ${r.path}. version ${r.version}`, data: r };
     },
   },
   {
     name: "evda_note",
     title: "Just note something",
-    description: "Call only when the owner says to just note something: files their words verbatim as a noted capture and returns the path. No AI reads a noted entry, this one included, until the owner says it can; it stays on their devices and in their own search. Refuses anything shaped like a password, key or token.",
+    description: `Call only when the owner says to just note something (in a new chat, after ${LAYER_TOOL_REF}): files their words verbatim as a noted capture and returns the path. No AI reads a noted entry, this one included, until the owner says it can; it stays on their devices and in their own search. Refuses anything shaped like a password, key or token.`,
     inputSchema: { type: "object", properties: { words: str("The owner's words, verbatim.") }, required: ["words"], additionalProperties: false },
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
     run: (evda, args) => {
@@ -258,18 +939,18 @@ export const TOOLS = [
   {
     name: "evda_message",
     title: "Tell the owner something",
-    description: "Sends the owner a message: writes it as one new file in the record's messages folder, which their phone app shows as a card, and returns its id and path. Use it for what they should hear from you (what you did, a question for them); a reply comes back through evda_replies. Never edits a message once written. Refuses anything shaped like a password, key or token.",
-    inputSchema: { type: "object", properties: { title: str("One line: what the card says at a glance."), body: str("The message, in markdown."), from: str("The agent's name. Default: the name in the operating layer.") }, required: ["title", "body"], additionalProperties: false },
+    description: "Sends the owner a message: writes it as one new file in the record's messages folder, and returns its id and path. This tool cannot see whether the owner's phone receives it -- that depends on their EVÐA app being paired and synced. Tell them only that you sent or filed the message; never say a notification or a card reached them unless they have told you so themselves. Use it for what they should hear from you (what you did, a question for them); a reply comes back through evda_replies. Never edits a message once written. Refuses anything shaped like a password, key or token.",
+    inputSchema: { type: "object", properties: { title: str("One line: what the message is about at a glance."), body: str("The message, in markdown."), from: str("The agent's name. Default: the agent name this record gives you.") }, required: ["title", "body"], additionalProperties: false },
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
     run: (evda, args) => {
       const r = tools.message(evda, args);
-      return { text: `Sent the message ${r.id}, filed at ${r.path}. The owner's reply, when there is one, comes back through evda_replies.`, data: r };
+      return { text: `Filed the message ${r.id} at ${r.path}. This does not confirm the owner saw it: whether it shows on their phone depends on their EVÐA app, which this tool cannot check. Tell them only that you sent or filed it, never that a notification or a card appeared. Their reply, when there is one, comes back through evda_replies.`, data: r };
     },
   },
   {
     name: "evda_replies",
     title: "Read the owner's replies",
-    description: "Call at the start of a run: returns the owner's replies to your messages that you have not seen yet (message id, title, reply, date) and marks them seen, so each shows once; a reply the owner changes shows again. peek: true returns them without marking.",
+    description: "Returns the owner's replies to the agent's messages, each once. Call at the start of a run: returns the owner's replies to your messages that you have not seen yet (message id, title, reply, date) and marks them seen, so each shows once; a reply the owner changes shows again. peek: true returns them without marking.",
     inputSchema: { type: "object", properties: { peek: { type: "boolean", description: "true to read without marking them seen." } }, additionalProperties: false },
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
     run: (evda, args, ctx) => {
@@ -282,7 +963,7 @@ export const TOOLS = [
   {
     name: "evda_filing",
     title: "Record how filing works",
-    description: "Call once, when the owner answers how filing works: records \"everything\" (file every message they send, without being asked) or \"asked\" (only when they ask) in evda.json, and returns what it wrote. Pass confirmed: true only with the answer they gave in this conversation. It changes the one filing key and nothing else.",
+    description: "Records whether the owner wants every message filed or only on request. Call once, when the owner answers how filing works: records \"everything\" (file every message they send, without being asked) or \"asked\" (only when they ask) in evda.json, and returns what it wrote. Pass confirmed: true only with the answer they gave in this conversation. It changes the one filing key and nothing else.",
     inputSchema: {
       type: "object",
       properties: { filing: { type: "string", enum: FILING_MODES, description: "everything, or asked." }, confirmed: { type: "boolean", description: "true only when the owner gave this answer in this conversation." } },
@@ -295,10 +976,31 @@ export const TOOLS = [
       return { text: r.changed ? `Recorded "filing": "${r.filing}" in evda.json. ${r.filing === "everything" ? "Every message they send is filed from here on, this one included." : "From here on, file only when they ask."}` : `evda.json already says "filing": "${r.filing}". Nothing changed.`, data: r };
     },
   },
+  {
+    name: "evda_every_chat",
+    title: "Record the every-chat setting",
+    description: "Records whether the every-chat line is set in a chat app, or declined. Call when the owner says they added the every-chat line to their chat app's settings, or that they do not want it: records \"set\" or \"declined\" for that app in evda.json, so no later chat in that app asks them again. Pass confirmed: true only with what they said in this conversation. It changes that one app's entry and nothing else.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        app: { type: "string", enum: EVERY_CHAT_APPS, description: "The app they set it in. Default: the app this conversation is in." },
+        state: { type: "string", enum: EVERY_CHAT_STATES, description: "set, or declined." },
+        confirmed: { type: "boolean", description: "true only when the owner said this in this conversation." },
+      },
+      required: ["state", "confirmed"],
+      additionalProperties: false,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    run: (evda, args, ctx) => {
+      const r = setEveryChat(evda, args, { app: ctx.app ?? null });
+      const label = CHAT_APPS[r.app]?.label ?? "this app";
+      return { text: r.state === "set" ? `Recorded in evda.json that the every-chat line is set in ${label}. No chat there asks again.` : `Recorded in evda.json that they do not want the every-chat line in ${label}. It is not raised there again.`, data: r };
+    },
+  },
   {
     name: "evda_release_note",
     title: "Release a noted entry",
-    description: "Clears the just-noted flag on one entry so it can be read, after the owner said in this conversation that this entry can be read now. Pass confirmed: true only then. It changes one frontmatter line and never the words. Refuses a sealed entry: no tool releases one.",
+    description: "Clears the just-noted flag on one entry so it can be read. Only after the owner said in this conversation that this entry can be read now. Pass confirmed: true only then. It changes one frontmatter line and never the words. Refuses a sealed entry: no tool releases one.",
     inputSchema: {
       type: "object",
       properties: { path: str("The noted entry's path, relative to the record."), confirmed: { type: "boolean", description: "true only when the owner said in this conversation that this entry can be read now." } },
@@ -314,7 +1016,7 @@ export const TOOLS = [
   {
     name: "evda_circles",
     title: "List circles",
-    description: "Lists the record's circles (the parts the owner chose to share), who may read each, what it covers and its policy rules. Read only.",
+    description: "Lists the record's circles, the parts the owner chose to share. For each: who may read it, what it covers and its policy rules. Read only.",
     inputSchema: { type: "object", properties: {}, additionalProperties: false },
     annotations: { readOnlyHint: true, openWorldHint: false },
     run: (evda, args) => {
@@ -333,7 +1035,7 @@ export const TOOLS = [
   {
     name: "evda_propose_circle",
     title: "Propose a circle",
-    description: "Writes a proposal for a circle as a file under proposals/ for the owner to read. It never creates the circle, grants anyone access, or moves an entry: those wait for the owner's explicit yes. Use it only when the owner asks to share something.",
+    description: "Writes a proposal for a circle under proposals/ for the owner to read. It never creates the circle, grants anyone access, or moves an entry: those wait for the owner's explicit yes. Use it only when the owner asks to share something.",
     inputSchema: {
       type: "object",
       properties: {
@@ -355,7 +1057,7 @@ export const TOOLS = [
   {
     name: "evda_presets",
     title: "List presets",
-    description: "Lists the ways to organize a record that EVDA ships (the preset library), each with who it suits, or with an id shows one preset's folders. Read only. A new folder is proposed from a preset here, never invented.",
+    description: "Lists the ways to organize a record that EVDA ships, the preset library. Each says who it suits; with an id, shows one preset's folders. Read only. A new folder is proposed from a preset here, never invented.",
     inputSchema: { type: "object", properties: { id: str("A preset id, to show that one. Omit to list them all.") }, additionalProperties: false },
     annotations: { readOnlyHint: true, openWorldHint: false },
     run: (evda, args) => {
@@ -368,7 +1070,7 @@ export const TOOLS = [
   {
     name: "evda_propose_structure",
     title: "Propose a preset's structure",
-    description: "Shows what applying a preset would add to this record, as a plan and a plain-language summary to show the owner. It never writes. Folders that already match are left alone, one that differs is reported and never changed, and nothing is ever moved, renamed or deleted.",
+    description: "Shows what applying a preset would add to this record, without writing. It returns a plan and a plain-language summary to show the owner. It never writes. Folders that already match are left alone, one that differs is reported and never changed, and nothing is ever moved, renamed or deleted.",
     inputSchema: { type: "object", properties: { id: str("The preset id, from evda_presets.") }, required: ["id"], additionalProperties: false },
     annotations: { readOnlyHint: true, openWorldHint: false },
     run: (evda, args) => {
@@ -396,7 +1098,7 @@ export const TOOLS = [
   {
     name: "evda_gather",
     title: "Gather a pile into a proposal",
-    description: "Walks the folders or export files the owner names (a Documents folder, a Notes or Obsidian export, a contacts export), types every file, and writes a proposal: a preset, the folders the pile needs, and where each item would go. Anything an app holds becomes a reference, never a copy. It moves, copies and changes nothing in the sources and writes nothing into the record; the proposal is a file outside both. Returns the proposal's id and its summary.",
+    description: "Proposes where a pile of the owner's files would go in the record. It walks the folders or export files the owner names (a Documents folder, a Notes or Obsidian export, a contacts export), types every file, and writes a proposal: a preset, the folders the pile needs, and where each item would go. Anything an app holds becomes a reference, never a copy. It moves, copies and changes nothing in the sources and writes nothing into the record; the proposal is a file outside both. Returns the proposal's id and its summary.",
     inputSchema: { type: "object", properties: { sources: { type: "array", items: { type: "string" }, minItems: 1, description: "Paths on this machine: folders or export files." }, into: str("The record this pile would grow, when it grows one: what that record already holds is left out, and a person with a page there is not asked about.") }, required: ["sources"], additionalProperties: false },
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
     run: (evda, args) => {
@@ -419,7 +1121,7 @@ export const TOOLS = [
   {
     name: "evda_gather_answer",
     title: "Record the owner's answer on a gather",
-    description: "Records the owner's answer to one gather question on the proposal, re-places the items it affects, and says what moved. Pass the answer they gave in this conversation, never a guess. It changes the proposal file only; no source file and nothing in the record moves.",
+    description: "Records an answer to one gather question and re-places the items it affects. It says what moved. Pass the answer they gave in this conversation, never a guess. It changes the proposal file only; no source file and nothing in the record moves.",
     inputSchema: {
       type: "object",
       properties: { proposal: str("The proposal id."), question: str("The question id, in brackets in evda_gather_questions."), answer: str("One of the question's answers, as the owner gave it.") },
@@ -436,7 +1138,7 @@ export const TOOLS = [
   {
     name: "evda_gather_apply",
     title: "Apply a gather proposal",
-    description: "Writes a gather proposal into a record: a new one made with the proposal's preset when \"into\" is a new folder, or the record named (the open one by default), adopting what it already holds and re-sorting nothing. Copies by default; move: true takes the files out of their sources. Call it only after every question is answered and the owner said yes to applying this proposal in this conversation; pass confirmed: true only then. It writes no share mark and no circle, keeps references as references, runs doctor, and writes a reversal manifest that `evda gather revert` undoes byte for byte.",
+    description: "Writes an answered gather proposal into a record, copying by default. The record is a new one made with the proposal's preset when \"into\" is a new folder, or the record named (the open one by default), adopting what it already holds and re-sorting nothing. Copies by default; move: true takes the files out of their sources. Call it only after every question is answered and the owner said yes to applying this proposal in this conversation; pass confirmed: true only then. It writes no share mark and no circle, keeps references as references, runs doctor, and writes a reversal manifest that `evda gather revert` undoes byte for byte.",
     inputSchema: {
       type: "object",
       properties: {
@@ -454,10 +1156,34 @@ export const TOOLS = [
       return { text: r.lines.join("\n") };
     },
   },
+  {
+    name: "evda_adopt",
+    title: "Adopt a folder of notes where it is",
+    description: "Makes a folder of notes the owner already keeps (an old Iris Vault, an Obsidian vault) an EVÐA in place: nothing moves. It maps the folders already there to the record's roles (an Iris Vault without asking), writes evda.json, AGENTS.md, .evda/ and the Claude Code hooks, and adds one @AGENTS.md line to the end of their CLAUDE.md; every other file stays byte for byte. Call it with dry: true first: it returns the mapping and names each folder it cannot place. Ask the owner about each of those one at a time, in your own words, and pass their answers as map. Ask whether everything they say should be filed automatically or only when they ask, and pass it as filing. Call it without dry only after they said yes to the mapping in this conversation, with confirmed: true. It runs doctor and names the reversal manifest that `evda adopt --revert` undoes byte for byte; tell them that path.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        dir: str("The folder to adopt, as a path on this machine."),
+        map: { type: "object", additionalProperties: { type: "string" }, description: "The owner's answers: folder (relative to dir) -> role (record/daily, record/captures, record/people, journal, collections, knowledge, work, each with an optional /facet, or none)." },
+        filing: { type: "string", enum: ["everything", "asked"], description: "The owner's answer: file everything they say, or only when asked." },
+        owner: str("The owner's name, as they gave it."),
+        dry: { type: "boolean", description: "true to see the mapping and the open questions; writes nothing." },
+        confirmed: { type: "boolean", description: "true only when the owner said yes to adopting this folder with this mapping in this conversation." },
+      },
+      required: ["dir"],
+      additionalProperties: false,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+    run: (evda, args) => {
+      const r = adoptLib.adoptTool(args);
+      if (r.dry) return { text: [...r.lines, "", r.questions.length ? `Open questions, ask them one at a time:\n${r.questions.map((q) => `- ${q}`).join("\n")}` : "No open questions. Nothing was written; adopt it with confirmed: true after the owner's yes."].join("\n") };
+      return { text: [...r.lines, "", ...adoptLib.connectLines(r.dir, args.filing ?? null)].join("\n") };
+    },
+  },
   {
     name: "evda_skills",
     title: "List or read the agent's skills",
-    description: `Lists the skills in this record (${SKILLS_REL}/<name>/SKILL.md), each with when to use it, or with a name returns that skill whole. A skill is a process the agent wrote down after repeating it; follow the one whose description fits what is being done. Read only.`,
+    description: `Lists the agent's skills in this record, or returns one whole by name. Skills live at ${SKILLS_REL}/<name>/SKILL.md, each with when to use it. A skill is a process the agent wrote down after repeating it; follow the one whose description fits what is being done. Read only.`,
     inputSchema: { type: "object", properties: { name: str("A skill's name, to read that one. Omit to list them.") }, additionalProperties: false },
     annotations: { readOnlyHint: true, openWorldHint: false },
     run: (evda, args) => {
@@ -473,7 +1199,7 @@ export const TOOLS = [
   {
     name: "evda_write_skill",
     title: "Write down a process as a skill",
-    description: `Writes a skill into the record at ${SKILLS_REL}/<name>/SKILL.md (Claude Code loads it on its own; any app reads it with evda_skills): a kebab-case name, a description saying when to use it, and the steps. Use it when you notice you are doing or explaining the same process a second time, or making the same correction twice, and tell the owner in one line. With revise: true and why (what went wrong on a run), it rewrites one and keeps what it replaced in REVISIONS.md. Refuses a name that would land outside the skills folder, and refuses content that is a rule about the owner's life (a threshold, count or streak about a person): a skill is how you work.`,
+    description: `Writes down a process the agent repeats as a skill in this record. It lands at ${SKILLS_REL}/<name>/SKILL.md (Claude Code loads it on its own; any app reads it with evda_skills): a kebab-case name, a description saying when to use it, and the steps. Use it when you notice you are doing or explaining the same process a second time, or making the same correction twice, and tell the owner in one line. With revise: true and why (what went wrong on a run), it rewrites one and keeps what it replaced in REVISIONS.md. Refuses a name that would land outside the skills folder, and refuses content that is a rule about the owner's life (a threshold, count or streak about a person): a skill is how you work.`,
     inputSchema: {
       type: "object",
       properties: {
@@ -496,7 +1222,7 @@ export const TOOLS = [
   {
     name: "evda_create_subrecord",
     title: "Make an EVÐA inside this one",
-    description: "Makes a record inside this record at a path (a project, a company, an agent): its own evda.json with the four roles (journal, work, collections, knowledge) and an AGENTS.md saying what it is for, then runs doctor on this record, which walks the new one, and returns the report. The parent's evda.json is unchanged unless bounded: true, which makes this record's circles stop at the new one and so needs confirmed: true, the owner's yes in this conversation. Refuses a path that is not empty, one inside another sub-record, and one that would hold a folder this record maps. When doctor was clean before and fails after, it removes what it made.",
+    description: "Makes an EVÐA inside this record at a path: a project, a company, an agent. It gets its own evda.json with the four roles (journal, work, collections, knowledge) and an AGENTS.md saying what it is for, then runs doctor on this record, which walks the new one, and returns the report. The parent's evda.json is unchanged unless bounded: true, which makes this record's circles stop at the new one and so needs confirmed: true, the owner's yes in this conversation. Refuses a path that is not empty, one inside another sub-record, and one that would hold a folder this record maps. When doctor was clean before and fails after, it removes what it made.",
     inputSchema: {
       type: "object",
       properties: {
@@ -531,9 +1257,9 @@ export const TOOLS = [
     },
   },
   {
-    name: "evda_pair_device",
+    name: "evda_pair",
     title: "Pair a phone",
-    description: "Call only when the owner asks to pair, add or connect a phone or another device to their EVÐA. Returns a one-time pairing code and a QR link for the phone, and the steps to do on it. The code works once, for 10 minutes, and the device gets only the parts named (journal by default). Show the code to the owner and no one else.",
+    description: `Pairs a phone or another device with this EVÐA through a one-time code. Call only when the owner asks to pair, add or connect a phone or another device to their EVÐA: adding a device is the owner's explicit yes, never yours. Pairs the device to the computer this EVÐA server runs on (the answer names it), so the device syncs with that computer's copy of the record. Returns a one-time code, a QR code to scan (as an image and as text), and the steps on the phone. The code works once, for 10 minutes, and the device gets only the parts named (journal by default). This server then adds the device on its own as soon as it uses the code, until the code runs out; evda_finish_pairing waits for that. Show the code to the owner and no one else.`,
     inputSchema: {
       type: "object",
       properties: {
@@ -544,15 +1270,39 @@ export const TOOLS = [
     },
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
     run: async (evda, args) => {
-      tools.onlyKeys("evda_pair_device", args, ["name", "parts"]);
+      tools.onlyKeys("evda_pair", args, ["name", "parts"]);
+      // The device tools read process.env, never ctx.env: over HTTP ctx.env names the reader only.
       const r = await pairing.pair(evda.dir, { name: args.name, parts: args.parts });
-      return { text: pairing.pairText(r) };
+      pairing.watchPairing(evda.dir, { until: r.expiresAt });
+      const qr = encodeQr(r.qr, { ecl: "M" });
+      return {
+        text: pairing.pairToolText(r, { qrText: qrText(qr) }),
+        images: [{ data: qrPng(qr).toString("base64"), mimeType: "image/png" }],
+      };
+    },
+  },
+  {
+    name: "evda_finish_pairing",
+    title: "Wait for a phone to join",
+    description: "Waits for a device to use its pairing code, and adds it when it does. Call after evda_pair, once the owner says they scanned the code or pasted it on the device: waits up to `seconds` (default 60, at most 120) for the device to use its code, adds it to this computer's copy of the record when it does, and says so in plain words. It adds only a device the owner already asked to pair with evda_pair. Never waits on a running sync: that sync adds the device itself.",
+    inputSchema: {
+      type: "object",
+      properties: { seconds: { type: "number", description: "How long to wait for the device, 0 to 120. Default 60." } },
+      additionalProperties: false,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    run: async (evda, args) => {
+      tools.onlyKeys("evda_finish_pairing", args, ["seconds"]);
+      if (args.seconds !== undefined && !(typeof args.seconds === "number" && args.seconds >= 0 && args.seconds <= pairing.FINISH_WAIT_MAX_S)) {
+        throw tools.refuse(`evda_finish_pairing "seconds" is a number from 0 to ${pairing.FINISH_WAIT_MAX_S}.`, "BAD_SECONDS");
+      }
+      return { text: (await pairing.finishWaiting(evda.dir, { seconds: args.seconds ?? 60 })).join("\n") };
     },
   },
   {
     name: "evda_sync_devices",
     title: "Sync with paired devices",
-    description: "Call after the owner used a pairing code on their phone, or when they ask to sync their devices: adds a device that used its code, takes in what paired devices wrote, and sends what changed here. Answers in plain words.",
+    description: "Syncs the record with the owner's paired devices. Call after the owner used a pairing code on their phone, or when they ask to sync their devices: adds a device that used its code, takes in what paired devices wrote, and sends what changed here. Syncs the copy of the record on the computer this EVÐA server runs on. Waits for a sync already running there, for a bounded time. Answers in plain words.",
     inputSchema: { type: "object", properties: {}, additionalProperties: false },
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
     run: async (evda, args) => {
@@ -563,18 +1313,54 @@ export const TOOLS = [
   {
     name: "evda_devices",
     title: "Paired devices",
-    description: "Lists the devices paired with the owner's EVÐA, whether each is waiting, paired or removed, and which parts each reads. Removing one is a command the owner runs: evda remove <device>.",
+    description: "Lists the devices paired with the owner's EVÐA on this computer. For each, on the computer this EVÐA server runs on (the answer names it): whether it is waiting, paired or removed, which parts it reads, and when this computer last heard from it. A device paired through another computer is listed there, not here. Removing one is evda_remove_device, and only on the owner's explicit yes.",
     inputSchema: { type: "object", properties: {}, additionalProperties: false },
     annotations: { readOnlyHint: true, openWorldHint: false },
     run: async (evda, args) => {
       tools.onlyKeys("evda_devices", args, []);
-      return { text: (await pairing.devices(evda.dir)).join("\n") };
+      return { text: (await pairing.deviceContacts(evda.dir)).join("\n") };
+    },
+  },
+  {
+    name: "evda_sync_status",
+    title: "Sync status",
+    description: "Says how syncing stands with each paired device, in plain words. On the computer this EVÐA server runs on: for each device, what is waiting to go out, what was sent and not yet confirmed, what the device confirmed, when this computer last heard from it, and whether a sync is running now and what runs it. Reads only; never starts or waits on a sync.",
+    inputSchema: { type: "object", properties: {}, additionalProperties: false },
+    annotations: { readOnlyHint: true, openWorldHint: false },
+    run: async (evda, args) => {
+      tools.onlyKeys("evda_sync_status", args, []);
+      return { text: (await pairing.syncStatus(evda.dir)).join("\n") };
+    },
+  },
+  {
+    name: "evda_remove_device",
+    title: "Remove a device",
+    description: "Removes a paired device's access to the record, which cannot be undone. Call only when the owner asks to remove, unpair or disconnect a device, and pass confirm: true only after they said yes to what removing it does: removing a device is the owner's explicit yes, never yours, and it cannot be undone. Without confirm: true it changes nothing and returns what removing that device would do, to put to the owner. With it: the device loses its access, the parts it read get new keys so nothing new reaches it, and this computer syncs. What the device already has stays on it. Acts on the computer this EVÐA server runs on.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        name: { type: "string", description: "The device's name, as evda_devices lists it." },
+        confirm: { type: "boolean", description: "true only once the owner said yes to removing this device." },
+      },
+      required: ["name"],
+      additionalProperties: false,
+    },
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
+    run: async (evda, args) => {
+      tools.onlyKeys("evda_remove_device", args, ["name", "confirm"]);
+      if (typeof args.name !== "string" || !args.name.trim()) throw tools.refuse("evda_remove_device needs the device's \"name\", as evda_devices lists it.", "NO_NAME");
+      if (args.confirm !== undefined && typeof args.confirm !== "boolean") throw tools.refuse("evda_remove_device \"confirm\" is true or false.", "BAD_CONFIRM");
+      const what = await pairing.describeRemoval(evda.dir, args.name);
+      if (args.confirm !== true) {
+        return { text: [...what, "", "Nothing was changed. Put this to the owner, and call again with confirm: true only if they say yes."].join("\n") };
+      }
+      return { text: (await pairing.remove(evda.dir, args.name)).join("\n") };
     },
   },
   {
     name: "evda_check_update",
     title: "Check for newer EVDA tooling",
-    description: "Asks the npm registry whether a newer version of the EVDA tooling exists, and returns the one line that says so. At most one real check an hour; inside that hour it reports the cached result. A check that fails reports the status as UNKNOWN, never as up to date. It sends nothing from the record, and it changes nothing: taking the update is a command the owner runs in their own terminal.",
+    description: "Asks the npm registry whether newer EVDA tooling exists. Returns the one line that says so. At most one real check an hour; inside that hour it reports the cached result. A check that fails reports the status as UNKNOWN, never as up to date. It sends nothing from the record, and it changes nothing: taking the update is a command the owner runs in their own terminal.",
     inputSchema: { type: "object", properties: {}, additionalProperties: false },
     annotations: { readOnlyHint: true, openWorldHint: true },
     run: async (evda) => {
@@ -586,14 +1372,14 @@ export const TOOLS = [
 ];
 
 export const RESOURCES = [
-  { uri: "evda://agents", name: "AGENTS.md", title: "The operating layer", mimeType: "text/markdown", read: (evda) => { const t = tools.operatingLayer(evda).text; return `${chatSection(evda, t)}\n\n${DISPATCH_SECTION}\n\n${t}`; } },
+  { uri: "evda://agents", name: "AGENTS.md", title: "The operating layer", mimeType: "text/markdown", read: (evda, ctx = {}) => { const r = tools.operatingLayer(evda); const surface = clientProfile(ctx.client?.name).surface; const o = forSurface(r.text, surface); return [chatSection(evda, r.text, { app: clientProfile(ctx.client?.name).app }), dispatchSection(surface), ...coreBlock(r), o.text].join("\n\n"); } },
   {
     uri: "evda://today",
     name: "today",
     title: "Today's daily file",
     mimeType: "text/markdown",
     read: (evda, ctx) => {
-      const r = tools.recent(evda, { days: 1 }, { caller: ctx.caller });
+      const r = tools.recent(evda, { days: 1 }, { caller: ctx.caller, full: true });
       const daily = r.files.find((f) => /(^|\/)\d{4}-\d{2}-\d{2}\.md$/.test(f.path) && f.date === r.to);
       if (daily) return daily.text;
       return r.heldBack ? `# ${r.to}\n\n${r.heldBack}\n` : `# ${r.to}\n\nNothing written today yet.\n`;
@@ -606,14 +1392,301 @@ export const RESOURCES = [
 // Once the session has read the record or been handed the owner's content and filed nothing, a tool
 // result carries one line saying so, at most once every NUDGE_EVERY calls, and never after a write.
 // EVDA_RECORD_FALSIFY=no-nudge turns it off, for the test that shows the nudge is what files.
-export const NUDGE = "Nothing from this conversation is filed yet: file their words with evda_write before you finish.";
+export const NUDGE = "Nothing the owner has said in this conversation is filed yet, so if it ended now their words would be lost: file them verbatim with evda_write in this turn.";
 export const NUDGE_EVERY = 3;
 const READS = new Set(["evda_recent", "evda_search", "evda_read"]);
 const RECEIVED = new Set(["evda_import", "evda_gather_answer"]);
 const WRITES = new Set(["evda_write", "evda_note"]);
 
 export function newSession() {
-  return { calls: 0, reads: 0, received: 0, writes: 0, lastNudge: -Infinity };
+  return { calls: 0, reads: 0, received: 0, writes: 0, lastNudge: -Infinity, layer: false, preambled: false, lastCall: null, everyChatAsked: false, lastFiled: null, agentWork: [], agentLogged: false, agentLogNudged: false, sections: {}, named: [], namedTickets: [], wrotePaths: [], entriesAsked: false };
+}
+
+// The agent-log nudge (HQ-2329). In Claude Code a Stop hook makes the agent log what it did; a chat
+// app has none, and measured 2026-10-07 claude.ai made 2 evda_write_agent_log calls in 13 sessions
+// against 14 from Claude Code: the 10/7 test chat wrote a person page, the Deep Work Queue and the
+// journal and logged none of it. So once a chat has written something beyond the owner's words, the
+// result of that write says what to log, once per conversation, and never after the chat has logged.
+// A write tool counts unless it is named here: the owner's own words (filed by the layer, a read, a
+// search, evda_write, evda_note), setup answers, device pairing and the log itself. A write tool
+// added later counts without anyone remembering to add it.
+// EVDA_RECORD_FALSIFY=no-agent-log-nudge turns it off, for the control test.
+const NOT_AGENT_WORK = new Set([
+  "evda_operating_layer", "evda_write", "evda_note", "evda_write_agent_log", "evda_search", "evda_read", "evda_replies",
+  "evda_acknowledge", "evda_import", "evda_filing", "evda_every_chat", "evda_setup_answer", "evda_release_note",
+  "evda_gather", "evda_gather_answer", "evda_pair", "evda_finish_pairing", "evda_sync_devices", "evda_remove_device", "evda_check_update",
+]);
+export function isAgentWork(tool) {
+  return Boolean(tool) && tool.annotations?.readOnlyHint === false && !NOT_AGENT_WORK.has(tool.name);
+}
+export function agentLogNudge(paths) {
+  const what = paths.length ? `wrote to ${paths.join(", ")}` : "changed the record";
+  return `You ${what} in this conversation, beyond the owner's words, and your own day log has nothing from this conversation yet. Before you answer, say what you did (built, filed, fixed, found) in a sentence or two with evda_write_agent_log, with one line of context. Only once per conversation is this said.`;
+}
+
+// The named-entries ask (HQ-2799). A write's answer names the existing entries its words bear on
+// (withTouches); nothing checked that any was acted on, and on 2026-10-21 a named project page was
+// never opened. So the server keeps, per chat, what it named and what was written, and the first
+// result after one named entries, while none of them has been written to, asks once, naming them and
+// saying that adding nothing is fine: the agent judges. Quiet after a write to any of them or after
+// asking once. Never for an owner who files only when they ask (HQ-1385). Open tickets the answer
+// named (HQ-2798) are listed in the ask too; the board is another server's, so this one cannot see a
+// ticket being updated, and only a write to a named entry answers the ask here.
+// EVDA_RECORD_FALSIFY=no-entries-ask turns it off, for the control test.
+export function countEntries(session, r, { filing = null, env = process.env } = {}) {
+  if (!r || r.isError) return null;
+  session.named ??= [];
+  session.wrotePaths ??= [];
+  const path = typeof r.data?.path === "string" ? r.data.path : null;
+  if (path && !session.wrotePaths.includes(path)) session.wrotePaths.push(path);
+  const answered = () => session.named.some((n) => session.wrotePaths.includes(n.path));
+  let ask = null;
+  session.namedTickets ??= [];
+  if ((session.named.length || session.namedTickets.length) && !answered() && !session.entriesAsked && filing !== "asked" && !(env.EVDA_RECORD_FALSIFY ?? "").split(",").map((m) => m.trim()).includes("no-entries-ask")) {
+    session.entriesAsked = true;
+    ask = entriesAsk(session.named.map((n) => n.path), undefined, session.namedTickets);
+  }
+  for (const n of r.data?.touches?.related ?? []) if (!session.named.some((x) => x.path === n.path)) session.named.push({ path: n.path, name: n.name });
+  for (const k of r.data?.touches?.tickets ?? []) if (k?.id && !session.namedTickets.includes(k.id)) session.namedTickets.push(k.id);
+  return ask;
+}
+
+// Count one call toward the agent-log nudge and say whether its result carries it. `hasLog` is
+// whether the record has the agent log at all; with none, there is nothing to nudge toward.
+export function countAgentWork(session, tool, r, { hasLog, env = process.env } = {}) {
+  if (tool?.name === "evda_write_agent_log" && !r?.isError) { session.agentLogged = true; return null; }
+  if (!isAgentWork(tool) || r?.isError) return null;
+  const path = typeof r?.data?.path === "string" ? r.data.path : null;
+  if (path && !session.agentWork.includes(path)) session.agentWork.push(path);
+  if (!path && !session.agentWork.length) session.agentWork.push(null);
+  if (!hasLog || session.agentLogged || session.agentLogNudged) return null;
+  if ((env.EVDA_RECORD_FALSIFY ?? "").split(",").map((m) => m.trim()).includes("no-agent-log-nudge")) return null;
+  session.agentLogNudged = true;
+  return agentLogNudge(session.agentWork.filter(Boolean));
+}
+
+// The recent days as a chat reads them (HQ-2324): per file, each section's heading, its context line
+// in parentheses and the opening of the owner's words after ">". Measured 2026-10-07 on his record:
+// 3 days were 13 files and 3,181 characters as headings, and most headings were times, so a chat
+// knew when he wrote and not what. It fits `room` characters: every file by heading first, then
+// sections gain their context and opening newest first (newest file, and its last section first,
+// since a day file grows downward) while they fit, so an over-full window loses detail on its
+// oldest sections before it loses a file.
+const sectionLine = (s, rich) => [s.heading !== null ? `# ${s.heading}` : null, rich && s.context ? `(${s.context})` : null, rich && s.opening ? `> ${s.opening}` : null].filter(Boolean).join("\n");
+const fileOpen = (f) => `<file path="${f.path}" date="${f.date}"${ackAttr(f.acknowledged)}>`;
+function renderFiles(files, rich) {
+  return files.map((f, i) => {
+    const lines = f.sections.map((s, j) => sectionLine(s, rich[i].has(j))).filter(Boolean);
+    return `${fileOpen(f)}${lines.length ? `\n${lines.join("\n")}` : ""}\n</file>`;
+  }).join("\n\n");
+}
+
+export function renderRecent(r, room = Infinity) {
+  const files = r.files.map((f) => ({ ...f, sections: f.sections ?? f.headings.map((h) => ({ heading: h, context: null, opening: null })) }));
+  const head = (shown, thin, cut) => `${shown.length} file(s) dated ${r.from} to ${r.to}, newest first: each section's heading, its context line in parentheses and the opening of the owner's words after ">" (read one whole with evda_read when the question needs it)${thin ? `; the oldest ${thin} section(s) by heading only, for size` : ""}${r.omitted + cut ? `, ${r.omitted + cut} more file(s) omitted for size (read them with evda_search)` : ""}.${r.acknowledged ? ` ${acknowledgedNote(r.acknowledged)}` : ""}`;
+  const tail = r.heldBack ? `\n\n${r.heldBack}` : "";
+  if (!files.length) return { text: `Nothing${r.refused.length ? " you may read" : ""} in the record is dated ${r.from} to ${r.to}.${tail}`, data: { from: r.from, to: r.to, paths: [], omitted: r.omitted, acknowledged: r.acknowledged } };
+  const reserve = head(files, 99999, 99999).length + tail.length + 4;
+  // Every file by heading, dropping the oldest while even that is over the room.
+  let shown = files.slice();
+  const none = () => shown.map(() => new Set());
+  while (shown.length > 1 && reserve + renderFiles(shown, none()).length > room) shown.pop();
+  const rich = none();
+  let size = reserve + renderFiles(shown, rich).length;
+  let thin = 0;
+  for (let i = 0; i < shown.length; i++) {
+    for (let j = shown[i].sections.length - 1; j >= 0; j--) {
+      const s = shown[i].sections[j];
+      const grow = sectionLine(s, true).length - sectionLine(s, false).length + (s.heading === null && !sectionLine(s, false) ? 1 : 0);
+      if (grow === 0) continue;
+      if (size + grow <= room) { rich[i].add(j); size += grow; } else thin += 1;
+    }
+  }
+  const cut = files.length - shown.length;
+  const text = `${head(shown, thin, cut)}\n\n${renderFiles(shown, rich)}${tail}`;
+  return { text, data: { from: r.from, to: r.to, paths: shown.map((f) => f.path), omitted: r.omitted + cut, acknowledged: r.acknowledged } };
+}
+
+// The people whose pages grew this week (HQ-2324), in at most `room` characters, newest first.
+export function renderPeople(p, room = Infinity) {
+  if (!p.people.length) return "";
+  const block = (x) => `<person name="${x.name.replace(/"/g, "&quot;")}" path="${x.path}">\n${x.sections.map((s) => sectionLine(s, true)).join("\n")}${x.more ? `\n(${x.more} more dated section(s) this week: read the page with evda_read)` : ""}\n</person>`;
+  const top = `## People whose pages grew this week\n\nDated sections added ${p.from} to ${p.to}, newest first. Read a page whole with evda_read when the conversation turns to them.`;
+  const out = [];
+  let size = top.length;
+  for (const x of p.people) {
+    const b = block(x);
+    if (size + b.length + 2 > room) break;
+    out.push(b);
+    size += b.length + 2;
+  }
+  return out.length ? `${top}\n\n${out.join("\n\n")}` : "";
+}
+
+// The people window: a week, so a chat knows who his last week was about (HQ-2324, 10/7: the 10/2
+// question about chemistry was five days back, outside the three-day recent window).
+export const PEOPLE_DAYS = 7;
+// What handle() adds after a tool's own text on the same result: the every-chat walkthrough (about
+// 1,400 characters, measured 2026-10-07 for ChatGPT), the nudge, the repeat notice.
+const AFTER_RUN_RESERVE = 3_000;
+
+// The one-call start (HQ-2223, slice 2). Measured 2026-10-05: a fresh claude.ai chat took 5 tool
+// calls before it replied, each its own Allow click. So the layer call takes the owner's first
+// message and files it the way evda_write does (same day file, same section for the chat, same
+// refusals), and returns what a chat reads next (unseen replies, the recent days' headings), so the
+// chat can answer after one call. An owner who turned automatic filing off, or has not answered
+// yet, is filed for only when they ask: nothing is written and the result says so.
+// `room` is what the client's result has left after the layer part this rides on (HQ-2324): the
+// replies come whole, then the people block and the recent days share what is left.
+export function openChat(evda, args, ctx, { room = LAYER_PART_MAX } = {}) {
+  const f = fileAlong(evda, { words: args.first_message, context: args.context }, ctx, "evda_operating_layer");
+  const head = f.filed
+    ? `Filed their first message to ${f.path}. Tell them in the past tense, and file each later message with evda_write; this one is already filed.`
+    : f.head;
+  const run = (name) => TOOLS.find((t) => t.name === name).run(evda, {}, ctx).text;
+  const replies = `## Their replies you have not seen\n\n${run("evda_replies")}`;
+  const DAYS = "## The last few days\n\n";
+  let left = room - head.length - replies.length - DAYS.length - 8;
+  const people = renderPeople(tools.recentPeople(evda, { days: PEOPLE_DAYS, caller: ctx.caller, now: ctx.now }), Math.floor(left / 3));
+  left -= people.length + 2;
+  const recent = renderRecent(tools.recent(evda, {}, { caller: ctx.caller, now: ctx.now }), left).text;
+  const parts = [head, replies, `${DAYS}${recent}`, ...(people ? [people] : [])];
+  return { text: parts.join("\n\n"), filed: f.filed ? f.path : null };
+}
+
+// Filing that rides along (HQ-2227): the owner's message passed on a call that is not evda_write
+// (the layer's first_message, a read's or a search's owner_message) is filed the way evda_write files
+// it: the same day file, the same section for the chat, the same refusals. It is the automatic path,
+// so it files only when the owner said everything; "asked" or no answer yet files nothing and says
+// so. A secret is not filed and the call it rode on still answers. claude.ai measured 2026-10-05:
+// the first answer took about 7 calls, one of them a write per turn, so a turn that reads can file
+// in the same call.
+//
+// Every filing in a chat leaves one mark, the words last filed (session.lastFiled), and the dedupe is
+// one rule over it: a model that passes the same message on the read, the search and then evda_write
+// in one turn files it once. A mark left by a ride-along is matched by any later filing of the same
+// words; evda_write spends it, so after that the same words again are the owner saying it again. A
+// mark left by evda_write is matched only by a ride-along, so two evda_writes of "ok" in two turns
+// still file twice, as before.
+export function fileAlong(evda, { words, context }, ctx, toolName) {
+  const filing = filingOf(evda.manifest);
+  if (filing !== "everything") {
+    return {
+      filed: false,
+      head: filing === "asked"
+        ? "Not filed: they turned automatic filing off, so their message is filed only if they ask (then with evda_write)."
+        : "Not filed: they have not said how filing works yet. Ask the filing question first; if they say everything, file this message with evda_write too.",
+    };
+  }
+  const dup = sameAsFiled(ctx.session, words, { spend: false });
+  if (dup) return { filed: true, deduped: true, path: dup.path, head: `Already filed at ${dup.path}; nothing was written again.` };
+  try {
+    const w = { words };
+    if (context !== undefined) w.context = context;
+    const r = tools.write(evda, w, { session: ctx.session, toolName });
+    if (ctx.session) {
+      ctx.session.writes += 1;
+      ctx.session.lastFiled = { words: words.trim(), path: r.path, by: "along" };
+    }
+    if (r.queued) return { filed: true, queued: true, path: r.path, head: queuedText(r) };
+    return { filed: true, path: r.path, head: `Filed their message to ${r.path}.` };
+  } catch (e) {
+    if (!(e instanceof EvdaError) || e.code !== "SECRET") throw e;
+    return { filed: false, head: `Not filed: ${e.message}` };
+  }
+}
+
+// What a filing bears on (HQ-2631): the existing entries the filed words name and the shared circles
+// they and the written path reach, and the open board tickets they reference when the work role is a
+// board (HQ-2798), appended to a write tool's answer as information. Empty adds nothing.
+export function withTouches(evda, ctx, out, { path, words }) {
+  const t = touches(evda, { paths: [path], words, caller: ctx.caller ?? callerFrom() });
+  const block = touchesText(t);
+  return block ? { text: `${out.text}\n\n${block}`, data: { ...out.data, touches: { related: t.related, circles: t.circles, tickets: t.tickets ?? [] } } } : out;
+}
+
+// What an evda_write held by EVDA_DAY_WRITE_GATE says (HQ-2596): queued, where, and why, so the
+// agent tells the owner the truth and does not call it again (a second call queues a second copy).
+function queuedText(r) {
+  return `Queued, not filed yet: this machine is holding writes to the day (${r.held}). Their words wait at ${r.path} and are filed into the day, in order, once its copy has synced. Tell them the words are queued, not filed, and do not call evda_write again for them.`;
+}
+
+// Whether these words are the ones last filed in this chat (fileAlong's rule). evda_write passes
+// spend: true and matches only a ride-along's mark, and spends it either way.
+export function sameAsFiled(session, words, { spend = true } = {}) {
+  const mark = session?.lastFiled;
+  if (!mark) return null;
+  const same = typeof words === "string" && words.trim() === mark.words;
+  if (!spend) return same ? mark : null;
+  if (mark.by !== "along") return null;
+  session.lastFiled = null;
+  return same ? mark : null;
+}
+
+// What evda_write leaves for the ride-alongs after it to match.
+function markWrite(session, words, path) {
+  if (session && typeof words === "string") session.lastFiled = { words: words.trim(), path, by: "write" };
+}
+
+// One chat, as the server can see it (HQ-2205). An Mcp-Session-Id is not one conversation: on
+// Hestia, 2026-10-05, claude.ai sent one session id for 7.5 hours, into conversations other than the
+// one that opened it, while a chat's own turns were at most 15 minutes apart. So a gap longer than
+// this between tool calls on a session starts a new chat: the layer counts as not served and
+// nothing as filed. A long pause inside one chat costs the short preamble again; the other error,
+// a new chat taken for an old one, would leave it with no layer and no nudge.
+export const CHAT_IDLE_MS = 20 * 60 * 1000;
+
+// HQ-2330: claude.ai also sends one session id into chats only minutes apart (2026-10-07, Hestia:
+// session 57ff531a served the 20:24 chat, the 20:30 chat and the 20:38 test chat), and no header or
+// parameter it sends names the conversation. What does mark one is the call every chat starts with:
+// evda_operating_layer, the layer the server's instructions and the tool's own description say to
+// read at the start of a new chat. So a layer call for its start (part 1, no section: a long layer's
+// later parts and a section read are the same chat reading on) after anything else on the session
+// starts a new chat too: nothing filed, nothing logged, and the next write opens its own section. A chat that
+// reloads the layer mid-way costs one new section, which carries its context line; the other error,
+// two chats in one section, files one chat's words under the other's heading.
+const opensLayer = (args) => (args?.part === undefined || args.part === 1) && args?.section === undefined;
+function enterChat(session, now, name, args, env) {
+  const idle = session.lastCall !== null && now - session.lastCall > CHAT_IDLE_MS;
+  const restart = name === "evda_operating_layer" && opensLayer(args) && session.calls > 0 && !chatFalsified("no-layer-boundary", env);
+  if (idle || restart) Object.assign(session, newSession());
+  session.lastCall = now;
+}
+
+// Layer 2 of HQ-2205. A model that never loaded evda_operating_layer answers as a generic assistant
+// and does not file, and no wording reaches it reliably, so the server says it in the result of the
+// first tool it does call: the short chat section, never the whole layer. Later results in the same
+// chat get one line until the layer is loaded. Returns "preamble", "reminder" or null.
+// EVDA_CHAT_FALSIFY=no-layer-preamble turns it off, for the control test.
+export const LAYER_REMINDER = "evda_operating_layer is still not loaded in this conversation: call it before you answer, so you answer as who you are here.";
+export function layerNotice(session, name, { env = process.env, now = Date.now(), args = {} } = {}) {
+  enterChat(session, now, name, args, env);
+  if (name === "evda_operating_layer") { session.layer = true; return null; }
+  if (session.layer || chatFalsified("no-layer-preamble", env)) return null;
+  if (session.preambled) return "reminder";
+  session.preambled = true;
+  return "preamble";
+}
+
+export function layerPreamble(evda) {
+  let agentsText = "";
+  try { agentsText = tools.operatingLayer(evda).text; } catch { /* a record with no AGENTS.md still gets the section */ }
+  // The section's first line says the layer follows it, which is true inside the layer and not here.
+  const section = chatSection(evda, agentsText).replace("the full operating layer follows and holds for the whole session.", "evda_operating_layer holds the rest.");
+  return `This conversation has not loaded the operating layer yet: call evda_operating_layer now, before you answer. Until you do, you are answering as a generic assistant, not as the one this record set up. These lines hold until then:\n\n${section}`;
+}
+
+// Layer 4 of HQ-2205: whether this result carries the every-chat walkthrough. Once per chat, in the
+// first result, for a client that named itself on initialize as a chat app, while evda.json has no
+// answer from the owner for that app. Not while the filing question is open: two setup questions at
+// once is a quiz, and the line depends on that answer, so evda_filing's result carries it instead.
+// EVDA_CHAT_FALSIFY=no-every-chat turns it off, for the control test.
+export function everyChatNotice(session, app, manifest, name, env = process.env) {
+  if (!app || session.everyChatAsked || name === "evda_every_chat" || chatFalsified("no-every-chat", env)) return null;
+  const filing = filingOf(manifest);
+  if (filing === null || !needsEveryChat(manifest, app, filing)) return null;
+  session.everyChatAsked = true;
+  return everyChatWalkthrough(app, filing);
 }
 
 // Count one tool call and say whether its result carries the nudge.
@@ -633,6 +1706,31 @@ export function countCall(session, name, { env = process.env, filing = null } =
   return true;
 }
 
+// The new-tools notice (HQ-2205, lib/connector-tools.mjs): once per connection, on its first tool
+// call, a chat app's offered names are compared with every name it was offered before on this
+// record. It rides in the tail, so a refused call carries it too: the refusal may be the very
+// permission it is about. A coding agent (offered null) sets its own permissions and is skipped.
+// It writes the record's .evda/connector-tools.json, so only a server keeps it: serve() and
+// lib/mcp-http.mjs set ctx.keepsToolList, and a caller of handle() that did not ask writes nothing.
+// EVDA_CHAT_FALSIFY=no-new-tools turns it off, for the control test.
+export function toolListNotice(ctx, evda, env = ctx.env ?? process.env) {
+  if (ctx.toolsChecked) return null;
+  ctx.toolsChecked = true;
+  if (!ctx.keepsToolList || !ctx.app || chatFalsified("no-new-tools", env)) return null;
+  const names = offered(ctx);
+  if (!names) return null;
+  const added = newToolsFor(evda, ctx.app, names, { now: new Date(ctx.clock?.() ?? Date.now()) });
+  if (!added.length) return null;
+  return newToolsNotice(ctx.app, added, Object.fromEntries(TOOLS.map((t) => [t.name, t.title])));
+}
+
+// The tools this client is offered: every tool for a coding agent, the chat set for any other.
+// A record that cannot be opened offers the chat set's fixed part.
+function offered(ctx) {
+  if (clientProfile(ctx.client?.name).surface === "terminal") return null;
+  try { return chatToolNames(ctx.evda(), { app: ctx.app ?? null }); } catch { return new Set(CHAT_PROSE_TOOLS); }
+}
+
 // The owner's filing answer as the record says it now, or null when it cannot be read.
 function filingNow(ctx) {
   try { return filingOf(ctx.evda().manifest); } catch { return null; }
@@ -656,17 +1754,24 @@ export async function handle(msg, ctx) {
         const asked = p.protocolVersion;
         // Who is calling, for every read that follows: the client's own name, or $EVDA_READER.
         ctx.caller = callerFrom({ clientName: p.clientInfo?.name ?? null, env: ctx.env ?? process.env });
+        // Which app this is, for the operating layer's surface (HQ-2207). Name and version only.
+        ctx.client = clientInfoOf(p);
+        // Which chat app, for the every-chat walkthrough only (HQ-2205). It decides which words are
+        // shown, never what may be read, so a client that misnames itself costs nothing but wording.
+        ctx.app = chatAppOf(p.clientInfo?.name ?? null);
+        // HQ-2631: index the record's names after this answer, so the first filing does not wait.
+        try { const e = typeof ctx.evda === "function" ? ctx.evda() : null; if (e?.dir) warmTouches(e); } catch { /* the first filing builds it */ }
         return ok({
           protocolVersion: PROTOCOL_VERSIONS.includes(asked) ? asked : PROTOCOL_VERSIONS[0],
           capabilities: { tools: { listChanged: false }, resources: { listChanged: false, subscribe: false } },
           serverInfo: { name: SERVER_NAME, title: "EVDA", version: ctx.version },
-          instructions: instructions(filingNow(ctx)),
+          instructions: instructions(filingNow(ctx), clientProfile(ctx.client?.name).surface),
         });
       }
       case "ping":
         return ok({});
       case "tools/list":
-        return ok({ tools: toolList(filingNow(ctx), ctx.env ?? process.env) });
+        return ok({ tools: toolList(filingNow(ctx), ctx.env ?? process.env, offered(ctx)) });
       case "tools/call": {
         const tool = TOOLS.find((t) => t.name === p.name);
         if (!tool) return error(msg.id, RPC.PARAMS, `unknown tool ${JSON.stringify(p.name)}`);
@@ -674,22 +1779,33 @@ export async function handle(msg, ctx) {
         if (typeof args !== "object" || Array.isArray(args)) return error(msg.id, RPC.PARAMS, "arguments must be an object");
         // EVDA_MCP_FALSIFY=log-args: a debug line with the arguments, the leak test/privacy.test.mjs exists to catch.
         if (FALSIFY("log-args", process.env)) ctx.log?.(`debug ${p.name} ${JSON.stringify(args)}`);
+        let tail = "";
         try {
           if (!ctx.caller) ctx.caller = callerFrom({ env: ctx.env ?? process.env });
           ctx.session ??= newSession();
           const evda = ctx.evda();
+          const notice = layerNotice(ctx.session, tool.name, { env: process.env, now: ctx.clock?.() ?? Date.now(), args });
+          tail = notice === "preamble" ? `\n\n---\n\n${layerPreamble(evda)}` : notice === "reminder" ? `\n\n${LAYER_REMINDER}` : "";
+          const added = toolListNotice(ctx, evda);
+          if (added) tail += `\n\n---\n\n${added}`;
           const r = await tool.run(evda, args, ctx);
           const nudge = countCall(ctx.session, tool.name, { filing: filingOf(evda.manifest) }) ? `\n\n${NUDGE}` : "";
+          const logNudge = countAgentWork(ctx.session, tool, r, { hasLog: tools.hasAgentLog(evda) });
+          const entries = countEntries(ctx.session, r, { filing: filingOf(evda.manifest) });
+          // evda_filing just changed the answer the walkthrough's line depends on, so it reads it again.
+          const setup = r.isError ? null : everyChatNotice(ctx.session, ctx.app, tool.name === "evda_filing" ? ctx.evda().manifest : evda.manifest, tool.name);
           // A process run twice is pointed at once (HQ-1377), so an agent in an app with no memory of
           // its own still writes it down as a skill. Only a call that did its work counts as a step.
           const repeat = r.isError ? null : noticeRepeat(ctx.session, tool.name);
           // Text only. A client that finds structuredContent may show the model that instead of the text
           // (Claude Code did, 2026-09-17: evda_operating_layer reached the model as {"path":"AGENTS.md"}),
           // so everything the model needs, paths included, is in the text.
-          return ok({ content: [{ type: "text", text: `${r.text}${nudge}${repeat ? `\n\n${repeat}` : ""}` }], isError: Boolean(r.isError) });
+          // An image (evda_pair's QR code, HQ-2040) follows the text; everything the model needs is still in the text.
+          const images = (r.images ?? []).map((i) => ({ type: "image", data: i.data, mimeType: i.mimeType }));
+          return ok({ content: [{ type: "text", text: `${r.text}${tail}${setup ? `\n\n---\n\n${setup}` : ""}${nudge}${logNudge ? `\n\n${logNudge}` : ""}${entries ? `\n\n${entries}` : ""}${repeat ? `\n\n${repeat}` : ""}` }, ...images], isError: Boolean(r.isError) });
         } catch (e) {
           // A refusal is a tool result the model reads and acts on, not a protocol failure.
-          if (e instanceof EvdaError) return ok({ content: [{ type: "text", text: e.message }], isError: true });
+          if (e instanceof EvdaError) return ok({ content: [{ type: "text", text: `${e.message}${tail}` }], isError: true });
           throw e;
         }
       }
@@ -715,6 +1831,12 @@ export async function handle(msg, ctx) {
   }
 }
 
+// initialize's clientInfo, reduced to a short name and version: the only part of it kept or logged.
+export function clientInfoOf(params) {
+  const clip = (v) => (typeof v === "string" ? v.replace(/[^\x20-\x7e]/g, "").slice(0, 64) : null);
+  return { name: clip(params?.clientInfo?.name), version: clip(params?.clientInfo?.version) };
+}
+
 function error(id, code, message) {
   return { jsonrpc: "2.0", id, error: { code, message } };
 }
@@ -722,7 +1844,7 @@ function error(id, code, message) {
 // Serve on stdio until stdin closes. `dir` is the located record; it is reopened for every call so
 // a record edited by hand between calls is read as it is now.
 export function serve({ dir, version, input = process.stdin, output = process.stdout, log = (s) => process.stderr.write(`[evda mcp] ${s}\n`) }) {
-  const ctx = { version, log, evda: () => openEvda(dir), session: newSession() };
+  const ctx = { version, log, evda: () => openEvda(dir), session: newSession(), keepsToolList: true };
   openEvda(dir); // refuse to start on something that is not a record
   log(`serving ${dir} (tool schema ${SCHEMA_VERSION})`);
   const rl = createInterface({ input, crlfDelay: Infinity });