@rubytech/create-maxy-code 0.1.157 → 0.1.159

package/payload/platform/neo4j/schema.cypher

@@ -516,15 +516,31 @@ OPTIONS {
 // Neo4j labels are set-semantic; the sublabel is added at ON CREATE SET
 // time in `ensureConversation` so the node carries both `:Conversation`
 // and the sublabel. No new constraints — the existing
-// conversation_id_unique constraint applies to Conversations regardless
-// of sublabel. The sublabel drives /graph canvas colour resolution and
-// filter popover chips per agentType without schema fragmentation.
+// conversation_session_id_unique constraint applies to Conversations
+// regardless of sublabel. The sublabel drives /graph canvas colour
+// resolution and filter popover chips per agentType without schema
+// fragmentation.
 // Pre-Task-633 Conversations stay unlabelled and render in the base
 // :Conversation colour (sublabel backfill is a separate task).
+//
+// Task 429 — kill `conversationId`; `sessionId` is canonical. One-shot
+// migration: copy any legacy `conversationId` property onto `sessionId`
+// and remove the legacy property. Idempotent via WHERE guard: re-runs
+// against already-migrated rows are no-ops. The legacy
+// `conversation_id_unique` constraint is dropped by name; the new
+// uniqueness constraint is `conversation_session_id_unique` on
+// `:Conversation.sessionId` (disambiguated from the :Session
+// constraint that legitimately owns `session_id_unique`).
 // ----------------------------------------------------------
 
-CREATE CONSTRAINT conversation_id_unique IF NOT EXISTS
-FOR (c:Conversation) REQUIRE c.conversationId IS UNIQUE;
+DROP CONSTRAINT conversation_id_unique IF EXISTS;
+
+MATCH (c:Conversation) WHERE c.conversationId IS NOT NULL
+SET c.sessionId = coalesce(c.sessionId, c.conversationId)
+REMOVE c.conversationId;
+
+CREATE CONSTRAINT conversation_session_id_unique IF NOT EXISTS
+FOR (c:Conversation) REQUIRE c.sessionId IS UNIQUE;
 
 CREATE CONSTRAINT conversation_session_key_unique IF NOT EXISTS
 FOR (c:Conversation) REQUIRE c.sessionKey IS UNIQUE;
@@ -574,7 +590,7 @@ OPTIONS {
 //
 // Chain-fork invariant: the write path in
 // platform/ui/app/lib/neo4j-store.ts#persistMessage holds a
-// per-conversationId async mutex around the Cypher that observes
+// per-sessionId async mutex around the Cypher that observes
 // the tail and CREATEs the new [:NEXT] edge. Without this, two
 // concurrent writes under READ_COMMITTED both see the same tail
 // and each CREATE an outgoing NEXT → two edges from one node.
@@ -590,10 +606,10 @@ CREATE CONSTRAINT message_id_unique IF NOT EXISTS
 FOR (m:Message) REQUIRE m.messageId IS UNIQUE;
 
 // Message.sessionKey is the canonical conversation pointer.
-// The legacy m.conversationId index stays until the final cutover, after the
-// full code-rename slice lands and no path reads m.conversationId.
+// The legacy m.sessionId index stays until the final cutover, after the
+// full code-rename slice lands and no path reads m.sessionId.
 CREATE INDEX message_conversation IF NOT EXISTS
-FOR (m:Message) ON (m.conversationId);
+FOR (m:Message) ON (m.sessionId);
 
 CREATE INDEX message_session_key IF NOT EXISTS
 FOR (m:Message) ON (m.sessionKey);
@@ -805,8 +821,9 @@ OPTIONS {
 // attachmentId = sha256("email:<accountId>:<rootMessageId>"). The body
 // is the verbatim chronological transcript; per-message envelopes live
 // in a JSON-serialised `messages` property; address parties hang off
-// the document as :Person edges (FROM/TO/CC). The email-fetch script
-// writes them via storeEmailMessage in plugins/email/mcp/src/lib/graph.ts.
+// the document as :Person edges (FROM/TO/CC). The operator-initiated
+// email-ingest tool writes them via storeEmailMessage in
+// plugins/email/mcp/src/lib/graph.ts.
 //
 // No :Email constraints or indexes are declared. The general
 // KnowledgeDocument constraints + indexes (above) already cover
@@ -992,7 +1009,7 @@ FOR (tc:ToolCall) ON (tc.accountId, tc.startedAt);
 //
 // Properties:
 //   componentId  — UUID, primary key
-//   conversationId / accountId / messageId — denormalised for
+//   sessionId / accountId / messageId — denormalised for
 //     account-scoped reads and cross-account isolation audits
 //   name         — component name (document-editor, action-buttons,
 //                   single-select, etc.)
@@ -1033,7 +1050,7 @@ FOR (c:Component) ON (c.accountId);
 // Properties:
 //   attachmentId   — UUID assigned at storeAttachment time; matches
 //                     the on-disk directory + Neo4j node id.
-//   conversationId — denormalised for filtered scans + cascade delete.
+//   sessionId — denormalised for filtered scans + cascade delete.
 //   accountId      — account-isolation. Reads MUST scope by this.
 //   messageId      — back-pointer to parent :Message.
 //   filename       — original upload name (kept for chip render).
@@ -1397,8 +1414,9 @@ FOR (rec:Recommendation) ON (rec.sessionKey);
 
 // ----------------------------------------------------------
 // Idea (Task 352) — original-thinking candidates extracted by
-// the signal-detector specialist from admin-side conversations.
-// Written via memory-write(labels:["Idea"], ...) with one edge
+// the pre-turn graph pass from admin-side conversations and written
+// by `database-operator` per-write briefs admin dispatches. Written
+// via memory-write(labels:["Idea"], ...) with one edge
 // (:Conversation)-[:HAS_IDEA]->(:Idea). Forward-only write surface:
 // no historical backfill, no dedup, no clustering — let the brain
 // accumulate first. Declared here so memory-write's label validator

package/payload/platform/plugins/admin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "admin",
-  "description": "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, account-update, admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, file-attach, wifi, action-approval tools (action-pending, action-approve, action-reject, action-edit), and session-retrospective-mark-complete (the deterministic sentinel the session-end Stop hook reads via JSONL grep to release the retrospective gate; admin calls it once per session after running the three-pass retrospective) for managing the Maxy platform.",
+  "description": "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, account-update, admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, file-attach, wifi, action-approval tools (action-pending, action-approve, action-reject, action-edit), session-retrospective-mark-complete (the deterministic sentinel the session-end Stop hook reads via JSONL grep to release the retrospective gate; admin calls it once per session after running the three-pass retrospective), and pre-turn-graph-pass-skip (the deterministic decline sentinel the per-turn graph-pass Stop hook reads via JSONL grep to release the per-turn gate when the operator turn has no new writes; admin calls it instead of dispatching to database-operator) for managing the Maxy platform.",
   "version": "0.1.0",
   "author": {
     "name": "Rubytech LLC"

package/payload/platform/plugins/admin/PLUGIN.md

@@ -1,7 +1,7 @@
 ---
 name: admin
 surface: platform
-description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, account-update, admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, file-attach, wifi, action-approval tools (action-pending, action-approve, action-reject, action-edit), and session-retrospective-mark-complete (the deterministic sentinel the session-end Stop hook reads via JSONL grep to release the retrospective gate; admin calls it once per session after running the three-pass retrospective) for managing the Maxy platform."
+description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, account-update, admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, file-attach, wifi, action-approval tools (action-pending, action-approve, action-reject, action-edit), session-retrospective-mark-complete (the deterministic sentinel the session-end Stop hook reads via JSONL grep to release the retrospective gate; admin calls it once per session after running the three-pass retrospective), and pre-turn-graph-pass-skip (the deterministic decline sentinel the per-turn graph-pass Stop hook reads via JSONL grep to release the per-turn gate when the operator turn has no new writes; admin calls it instead of dispatching to database-operator) for managing the Maxy platform."
 tools:
   - name: system-status
     publicAllowlist: false
@@ -75,6 +75,9 @@ tools:
   - name: session-retrospective-mark-complete
     publicAllowlist: false
     adminAllowlist: true
+  - name: pre-turn-graph-pass-skip
+    publicAllowlist: false
+    adminAllowlist: true
 hidden:
   - remote-auth-status
   - remote-auth-set-password
@@ -110,7 +113,7 @@ Tools are available via the `admin` MCP server.
 
 `logs-read { type: "agent-stream" }` is the canonical name for the per-conversation tool-use/tool-result archive previously called `system`; both names work and the legacy alias is preserved.
 
-**Stream log is the primary diagnostic surface for an in-progress session.** Every stream log is named by sessionKey and the stream-log file exists from the first token. The single-writer mandate (2026-05-14) mechanically enforces this contract: the single writer module at [`platform/ui/app/lib/claude-agent/stream-log-writer.ts`](../../ui/app/lib/claude-agent/stream-log-writer.ts) owns every open of `claude-agent-stream-*.log`, opens the file lazily on the first SDK token byte (via `streamLog.writeToken`), and buffers pre-token markers in memory while duplicating them to `server.log` via `console.error` so zero-token sessions retain observability. The build gate `platform/ui/scripts/check-stream-log-writer.mjs` rejects any external `appendFileSync`/`createWriteStream` against the `claude-agent-stream-*` pattern outside the writer module, plus any `claude-agent-stream-${conversationId}` literal (the pre-1013 wrong-identifier signature that produced two files for one session on the Beacons Pi 2026-05-14). The first-token invariant is bound by `platform/scripts/__tests__/first-token-creates-stream-log.test.sh`: one operator turn, one token, `claude-agent-stream-<sessionKey>.log` exists and contains the token bytes after the byte returns to the operator. The parent-process console fan-out tee in [`platform/ui/app/lib/claude-agent/logging.ts`](../../ui/app/lib/claude-agent/logging.ts) appends every `[<tag>]`-prefixed `console.error` / `console.log` line to every active session's stream log alongside `server.log`. For diagnosing an in-session issue (WhatsApp inbound, Cloudflare action, persist write, baileys error), call `logs-read { sessionKey: "<…>" }` first — the stream log carries both the agent lifecycle AND the parent-process events that occurred during the session window. The `conversationId` parameter remains a legacy alias resolving to the same sessionKey-named file. `logs-read { type: "server" }` is the cross-session escape hatch for events outside any single session window.
+**Stream log is the primary diagnostic surface for an in-progress session.** Every stream log is named by sessionKey and the stream-log file exists from the first token. The single-writer mandate (2026-05-14) mechanically enforces this contract: the single writer module at [`platform/ui/app/lib/claude-agent/stream-log-writer.ts`](../../ui/app/lib/claude-agent/stream-log-writer.ts) owns every open of `claude-agent-stream-*.log`, opens the file lazily on the first SDK token byte (via `streamLog.writeToken`), and buffers pre-token markers in memory while duplicating them to `server.log` via `console.error` so zero-token sessions retain observability. The build gate `platform/ui/scripts/check-stream-log-writer.mjs` rejects any external `appendFileSync`/`createWriteStream` against the `claude-agent-stream-*` pattern outside the writer module, plus any `claude-agent-stream-${sessionId}` literal (the pre-1013 wrong-identifier signature that produced two files for one session on the Beacons Pi 2026-05-14). The first-token invariant is bound by `platform/scripts/__tests__/first-token-creates-stream-log.test.sh`: one operator turn, one token, `claude-agent-stream-<sessionKey>.log` exists and contains the token bytes after the byte returns to the operator. The parent-process console fan-out tee in [`platform/ui/app/lib/claude-agent/logging.ts`](../../ui/app/lib/claude-agent/logging.ts) appends every `[<tag>]`-prefixed `console.error` / `console.log` line to every active session's stream log alongside `server.log`. For diagnosing an in-session issue (WhatsApp inbound, Cloudflare action, persist write, baileys error), call `logs-read { sessionKey: "<…>" }` first — the stream log carries both the agent lifecycle AND the parent-process events that occurred during the session window. The `sessionId` parameter remains a legacy alias resolving to the same sessionKey-named file. `logs-read { type: "server" }` is the cross-session escape hatch for events outside any single session window.
 
 ## Skills
 
@@ -139,8 +142,9 @@ Tools are available via the `admin` MCP server.
 - `hooks/webfetch-preflight.mjs` — short-circuits WebFetch on JS-SPA shells with a structured `WEBFETCH_CANNOT_READ_JS_SPA` error so the agent surfaces a loud failure to the owner instead of paying the 60s extraction timeout. Fail-open on any internal error.
 - `hooks/askuserquestion-investigate-gate.sh` — PreToolUse matcher=`AskUserQuestion`. Blocks the question (exit 2) when no read-only investigation tool has fired since the latest real user turn in the session JSONL. The structural fix for the failure class where the agent fabricates a menu before evidence-gathering (session `c085ec2c-46fb-4b73-8865-68cf85866ea8` 2026-05-22 — "change remote access password" → invented options "Admin PIN / Cloudflare tunnel / WiFi password" with zero prior tool_use; post-correction the agent immediately fired `remote-auth-status` → `ToolSearch` → `remote-auth-set-password`, proving it knew the moves). **Allowlist** (exact, with trailing `__<tool>` suffix-match for namespaced `mcp__plugin_<plugin>_<server>__<tool>` aliases): `ToolSearch`, `Grep`, `Glob`, `Read`, `LS`, `NotebookRead`, `Bash`, `WebFetch`, `WebSearch`, plus the read-only admin / memory MCP tools (`*-status`, `*-list`, `*-read`, `skill-find`, `memory-find-candidates`, `profile-read`, `conversation-list`, `memory-list-attachments`, `memory-read-attachment`). **Block message:** `Blocked: AskUserQuestion requires at least one investigation tool (ToolSearch, Grep, Read, *-list, *-status, *-read, skill-find, ...) earlier in this turn. Search the operator's literal phrase first.` **Log line** (stderr, one per call): `[ask-gate] decision=<allow|block> sessionId=<id8> seen=<csv|-> reason=<allowlist-hit|no-investigation|fail-open-no-transcript|fail-open-parse-error>`. **Fail-open** on missing transcript or parse error — nudges, never bricks the UI.
 - `hooks/session-end-retrospective.sh` — **Stop hook.** Fires on every assistant end_turn but exits 0 with `trigger-skipped reason=<role-not-admin|is-specialist|empty-stdin|missing-transcript|no-intent-match>` on every path EXCEPT when the operator's latest real-user message carries an end-intent token (`/end`, `/archive`, `end session`, `archive this session`, case-insensitive, must match the whole message or a standalone line — not embedded in prose). On that path the hook blocks (exit 2 + structured retrospective instruction on stderr per Stop-hook contract) and emits `[session-retrospective] gate-blocked sessionId=<id> reason=sentinel-absent` until the admin agent calls the `session-retrospective-mark-complete` MCP sentinel tool. Completion is recognised by greping the operator's own JSONL (`transcript_path` on the Stop envelope) for a `tool_use` block whose `name` equals that exact string — never by parsing prose ([[feedback_no_stdout_parsing_for_control_flow]], [[feedback_doctrine_paragraph_is_not_a_gate]]). The sentinel-grep doubles as the re-entry guard: every Stop after the sentinel call sees it and exits 0 with `gate-released sessionId=<id>`. Recursion guard: any session whose `MAXY_SPECIALIST` env is set (specialist subagent dispatched via Task tool) skips the gate. The Sidebar archive button POSTs `/:sessionId/archive` directly to the manager which kills the PTY — no Stop fires after that, so clicking archive is the operator's current escape hatch (opt-out remains deferred per the task spec). All emits go through `POST /api/admin/log-ingest`; the only stderr writer is the gate-blocked path (the instruction block the agent reads). The retrospective itself runs as one or more additional turns inside the operator's existing admin session — Task-tool delegation to `database-operator` is the existing IDENTITY.md "Recording" route, not a parallel admin session ([[feedback_deterministic_means_remove_llm]]).
-- `hooks/pre-turn-graph-pass.sh` — **UserPromptSubmit hook.** Tasks 425, 430 — supersedes Task 412's Stop-hook registration of the same logic. Task 412 fired on every admin-agent `end_turn`, including the agent's own ack after the dispatch, producing an unbounded loop until context exhaustion. Firing on `UserPromptSubmit` fires once per operator prompt and removes the loop primitive entirely. **Task 430 reshaped the orchestration:** admin is the session-walker. The hook no longer packages the conversation into the specialist's prompt — that collapsed the data channel and instruction channel into one context, so operator prose pattern-matching as a writer-binding instruction ("memory-update is denied this session") was treated as binding and the pass self-denied (session `d7070b66-1759-41ca-a771-d7559b8a1967` retrospective wrote 3 graph rows on the same session where the pre-turn pass returned `writes=0`). The Task 425 → Task 430 shape change brings the per-turn pass into line with the session-end retrospective, which never had this defect: admin walks, admin dispatches per-write briefs to `database-operator`. The hook now `GET /api/admin/post-turn-context?conversationId&accountId` to fetch every node already written under this conversationId, then emits the documented UserPromptSubmit stdout JSON envelope `{"hookSpecificOutput":{"hookEventName":"UserPromptSubmit","additionalContext":"<directive>"}}` with `exit 0`. The directive body begins with the literal token `[system: pre-turn-graph-pass-hook]` and carries one interpolated `<prior-writes>` block (the skip-list); the IDENTITY.md UserPromptSubmit-directive section routes the agent into scanning the just-submitted operator turn (already in admin's context) and dispatching one `Task → database-operator` per candidate write before composing its reply. Coverage trade: the assistant response to the most recent operator prompt is not covered by a per-turn pass until the next operator turn (or never, if no next turn arrives); end-of-session coverage is provided by `session-end-retrospective.sh` which walks the full transcript at `/end`. Duplicate writes between per-turn dispatches and the admin agent's discretionary inline `database-operator` dispatch are accepted at write time; cleanup is delegated to the dream-cycle / hygiene sweeps (Tasks 410, 411). Early exits: `reason=role-not-admin` (the hook fires only on admin-agent prompt submissions by doctrine), `reason=is-specialist` (`MAXY_SPECIALIST` env-stamped on every subagent PTY blocks the hook from firing inside a specialist's own session), `reason=missing-transcript` (safety exit), `reason=wrong-hook-event event=<…>` (stale Stop-shaped fire), `reason=missing-env env=MAXY_UI_INTERNAL_PORT` (UI port unset). All emits go through `POST /api/admin/log-ingest` under tag `pre-turn-graph-pass`. The canonical fire line is `dispatch sessionId=<id> conversationId=<id> directive-shape=admin-walks priorWritesCount=<n> contextBytes=<n> ms=<n>`; the `directive-shape=admin-walks` field distinguishes the Task 430 shape from any cached device still running the Task 425 shape. Success: one or more `db-op: writes=<n>` lines in the admin session transcript reflecting per-write dispatches admin actually emitted (zero candidate writes ⇒ zero dispatches, no `db-op` line). Failure: a `db-op: error reason=<…>` line, or a turn that named new entities / commitments where admin emitted no dispatch — the latter is the regression signal for self-denial.
-- `hooks/turn-completed-graph-write.sh` — **Dormant since Task 214** — the Stop-hook registration is no longer written to account settings.json; admin delegates graph writes to `database-operator` via the Task tool. The script, envelope walker, loopback `/api/admin/claude-sessions` 127.0.0.1 bypass, `[turn-recorder]` emitters, recorder-auto-archive subscriber, and `initialMessage` envelope spec are preserved as reusable infrastructure for any future autonomous post-turn flow. Historical contract (still describes the dormant path): Stop hook fired once per completed admin-agent turn. Gates on `MAXY_SESSION_ROLE=admin` + `MAXY_SPECIALIST!=database-operator` so it never recurses into the recorder PTY or fires on public sessions. **Task 147** — the recorder is spawned via the same route Sidebar uses. ONE POST to `POST /api/admin/claude-sessions`, body carries `{specialist:'database-operator', model:'haiku', initialMessage:<json-envelope>, adminSessionId:<op>}` — no synthetic `senderId: 'turn-recorder'` marker. The Hono wrapper bypasses cookie auth on this exact method+path when the request originates from `127.0.0.1` (same trust boundary the claude-session-manager itself relies on), looks up the operator's senderId from the manager's `/<adminSessionId>/meta`, and forwards a Sidebar-shape spawn body. The `/recorder-spawn` sibling route is gone. The hook reads its UI port from `MAXY_UI_INTERNAL_PORT` (stamped on the manager systemd unit) — no fallback; absence emits `[turn-recorder] spawn-failed reason=missing-env env=MAXY_UI_INTERNAL_PORT` to stderr instead of silently 19199-ing. **Task 177** — `initialMessage` is a JSON-stringified envelope; the schema lives in [`platform/plugins/docs/references/admin-session.md`](../docs/references/admin-session.md) under "`initialMessage` JSON envelope (Task 177)". Top-level keys exactly: `turns`, `conversationId`, `accountId`, `occurredAt`. `turns` is the full conversation transcript, oldest first, newest last, with each entry `{ role: "user"|"assistant", text, ts, toolCalls? }`. No windowing, no truncation. Multi-record assistant messages collapse on `message.id`. `tool_use` and matching `tool_result` blocks attach as a single `toolCalls` entry on the owning assistant turn; the user record carrying only the `tool_result` does not create a separate user turn. No leading instruction prose. `toolCalls[].input` and `toolCalls[].output` are native JSON values, never re-stringified. (Replaces Task 175's `(operatorMessage, assistantReply)` pair, which asserted a temporal Q→A relationship the walker never enforced.) One observability line `[turn-recorder] envelope sessionId=<op> turnsCount=<n> userTurns=<n> assistantTurns=<n> toolCallTurns=<n>` precedes `spawn-request`. The envelope rides on the `/spawn` body as a trailing positional argv to `claude`, so the database-operator session's JSONL first `role=user` line is the JSON object verbatim. No separate `POST /:id/input` call, no bracketed-paste, no keystroke injection. The recorder-auto-archive subscriber stops the recorder PTY as soon as its JSONL contains an assistant message with `stop_reason === "end_turn"`. **Task 129** — every emit goes through `POST /api/admin/log-ingest` so the lines land in `server.log` keyed by the operator session id. The chain is `trigger` → `spawn-request` → `spawn-success` → `input-delivered` → `tool-call` × N → `tool-result` × N → `write-complete` → `auto-archive`; each gated-off path emits one `trigger-skipped reason=<role-not-admin|is-recorder|empty-stdin|missing-transcript|conversation-empty>` line. Failure modes — `spawn-failed`, `tool-surface-missing`, `input-failed`, `write-empty`, `auto-archive reason=stale-recorder` — each emit one named line; absence is itself a defect.
+- `hooks/per-turn-graph-pass-gate.sh` — **Stop hook.** Task 440. Per-turn blocking gate that closes the gap left when Task 425 moved the per-turn graph pass off Stop onto `UserPromptSubmit`. `pre-turn-graph-pass.sh` delivers the directive (with prior-writes skip-list) as `additionalContext` and exits 0 — that channel can't carry a release path because UserPromptSubmit's only blocking shape erases the prompt without feeding stderr to Claude ([[feedback_doctrine_paragraph_is_not_a_gate]]). This Stop hook is the enforcement primitive: walks the operator's JSONL since the latest real-user message, releases on either a `Task` `tool_use` whose `input.subagent_type` is `database-operator` (admin dispatched the writes) or a `tool_use` whose `name` is `mcp__admin__pre-turn-graph-pass-skip` (admin declined via the deterministic skip sentinel). Both releases emit `gate-released sessionId=<id> via=<dispatch|skip-sentinel>` and exit 0. Absent both, exits 2 with a stderr instruction naming the two release paths — admin reads the instruction (Stop's exit-2 stderr-to-Claude contract) and acts. Recursion guard: any session with `MAXY_SPECIALIST` set (specialist subagent dispatched via Task) skips. Loop-safety: once either release tool_use sits in the JSONL, every subsequent Stop on the same operator-prompt window sees it and exits 0 — the Task 412 loop is avoided because the release decision is JSONL-based, never a re-fire of the directive. Composes with `session-end-retrospective.sh` (the other Stop-array entry): the session-end hook gates only on operator end-intent, this one gates every turn. Early exits: `reason=role-not-admin`, `reason=is-specialist`, `reason=empty-stdin`, `reason=missing-transcript`, `reason=no-real-user` (transcript has no real-user record yet — e.g. SessionStart bootstrap, or only `tool_result`-shaped user records). All emits go through `POST /api/admin/log-ingest` under tag `per-turn-graph-pass-gate`.
+- `hooks/pre-turn-graph-pass.sh` — **UserPromptSubmit hook.** Tasks 425, 430 — supersedes Task 412's Stop-hook registration of the same logic. Task 412 fired on every admin-agent `end_turn`, including the agent's own ack after the dispatch, producing an unbounded loop until context exhaustion. Firing on `UserPromptSubmit` fires once per operator prompt and removes the loop primitive entirely. **Task 430 reshaped the orchestration:** admin is the session-walker. The hook no longer packages the conversation into the specialist's prompt — that collapsed the data channel and instruction channel into one context, so operator prose pattern-matching as a writer-binding instruction ("memory-update is denied this session") was treated as binding and the pass self-denied (session `d7070b66-1759-41ca-a771-d7559b8a1967` retrospective wrote 3 graph rows on the same session where the pre-turn pass returned `writes=0`). The Task 425 → Task 430 shape change brings the per-turn pass into line with the session-end retrospective, which never had this defect: admin walks, admin dispatches per-write briefs to `database-operator`. The hook now `GET /api/admin/post-turn-context?sessionId&accountId` to fetch every node already written under this sessionId, then emits the documented UserPromptSubmit stdout JSON envelope `{"hookSpecificOutput":{"hookEventName":"UserPromptSubmit","additionalContext":"<directive>"}}` with `exit 0`. The directive body begins with the literal token `[system: pre-turn-graph-pass-hook]` and carries one interpolated `<prior-writes>` block (the skip-list); the IDENTITY.md UserPromptSubmit-directive section routes the agent into scanning the just-submitted operator turn (already in admin's context) and dispatching one `Task → database-operator` per candidate write before composing its reply. Enforcement is the Stop-array sibling `per-turn-graph-pass-gate.sh` (Task 440): every admin turn end blocks until admin either dispatched the writes (`Task` `tool_use` with `input.subagent_type=database-operator`) or called the skip sentinel (`pre-turn-graph-pass-skip` MCP tool with a `reason` arg) since the latest real-user message. Duplicate writes between per-turn dispatches and the admin agent's discretionary inline `database-operator` dispatch are accepted at write time; cleanup is delegated to the dream-cycle / hygiene sweeps (Tasks 410, 411). Early exits: `reason=role-not-admin` (the hook fires only on admin-agent prompt submissions by doctrine), `reason=is-specialist` (`MAXY_SPECIALIST` env-stamped on every subagent PTY blocks the hook from firing inside a specialist's own session), `reason=missing-transcript` (safety exit), `reason=wrong-hook-event event=<…>` (stale Stop-shaped fire), `reason=missing-env env=MAXY_UI_INTERNAL_PORT` (UI port unset). All emits go through `POST /api/admin/log-ingest` under tag `pre-turn-graph-pass`. The canonical fire line is `dispatch sessionId=<id> sessionId=<id> directive-shape=admin-walks priorWritesCount=<n> contextBytes=<n> ms=<n>`; the `directive-shape=admin-walks` field distinguishes the Task 430 shape from any cached device still running the Task 425 shape. Success: one or more `db-op: writes=<n>` lines in the admin session transcript reflecting per-write dispatches admin actually emitted (zero candidate writes ⇒ zero dispatches, no `db-op` line). Failure: a `db-op: error reason=<…>` line, or a turn that named new entities / commitments where admin emitted no dispatch — the latter is the regression signal for self-denial.
+- `hooks/turn-completed-graph-write.sh` — **Dormant since Task 214** — the Stop-hook registration is no longer written to account settings.json; admin delegates graph writes to `database-operator` via the Task tool. The script, envelope walker, loopback `/api/admin/claude-sessions` 127.0.0.1 bypass, `[turn-recorder]` emitters, recorder-auto-archive subscriber, and `initialMessage` envelope spec are preserved as reusable infrastructure for any future autonomous post-turn flow. Historical contract (still describes the dormant path): Stop hook fired once per completed admin-agent turn. Gates on `MAXY_SESSION_ROLE=admin` + `MAXY_SPECIALIST!=database-operator` so it never recurses into the recorder PTY or fires on public sessions. **Task 147** — the recorder is spawned via the same route Sidebar uses. ONE POST to `POST /api/admin/claude-sessions`, body carries `{specialist:'database-operator', model:'haiku', initialMessage:<json-envelope>, adminSessionId:<op>}` — no synthetic `senderId: 'turn-recorder'` marker. The Hono wrapper bypasses cookie auth on this exact method+path when the request originates from `127.0.0.1` (same trust boundary the claude-session-manager itself relies on), looks up the operator's senderId from the manager's `/<adminSessionId>/meta`, and forwards a Sidebar-shape spawn body. The `/recorder-spawn` sibling route is gone. The hook reads its UI port from `MAXY_UI_INTERNAL_PORT` (stamped on the manager systemd unit) — no fallback; absence emits `[turn-recorder] spawn-failed reason=missing-env env=MAXY_UI_INTERNAL_PORT` to stderr instead of silently 19199-ing. **Task 177** — `initialMessage` is a JSON-stringified envelope; the schema lives in [`platform/plugins/docs/references/admin-session.md`](../docs/references/admin-session.md) under "`initialMessage` JSON envelope (Task 177)". Top-level keys exactly: `turns`, `sessionId`, `accountId`, `occurredAt`. `turns` is the full conversation transcript, oldest first, newest last, with each entry `{ role: "user"|"assistant", text, ts, toolCalls? }`. No windowing, no truncation. Multi-record assistant messages collapse on `message.id`. `tool_use` and matching `tool_result` blocks attach as a single `toolCalls` entry on the owning assistant turn; the user record carrying only the `tool_result` does not create a separate user turn. No leading instruction prose. `toolCalls[].input` and `toolCalls[].output` are native JSON values, never re-stringified. (Replaces Task 175's `(operatorMessage, assistantReply)` pair, which asserted a temporal Q→A relationship the walker never enforced.) One observability line `[turn-recorder] envelope sessionId=<op> turnsCount=<n> userTurns=<n> assistantTurns=<n> toolCallTurns=<n>` precedes `spawn-request`. The envelope rides on the `/spawn` body as a trailing positional argv to `claude`, so the database-operator session's JSONL first `role=user` line is the JSON object verbatim. No separate `POST /:id/input` call, no bracketed-paste, no keystroke injection. The recorder-auto-archive subscriber stops the recorder PTY as soon as its JSONL contains an assistant message with `stop_reason === "end_turn"`. **Task 129** — every emit goes through `POST /api/admin/log-ingest` so the lines land in `server.log` keyed by the operator session id. The chain is `trigger` → `spawn-request` → `spawn-success` → `input-delivered` → `tool-call` × N → `tool-result` × N → `write-complete` → `auto-archive`; each gated-off path emits one `trigger-skipped reason=<role-not-admin|is-recorder|empty-stdin|missing-transcript|conversation-empty>` line. Failure modes — `spawn-failed`, `tool-surface-missing`, `input-failed`, `write-empty`, `auto-archive reason=stale-recorder` — each emit one named line; absence is itself a defect.
 
 ## Session identifiers (Task 135)
 

package/payload/platform/plugins/admin/hooks/__tests__/archive-ingest-surface-gate.test.sh

@@ -103,7 +103,7 @@ run_case "BYPASS: nested rows[0].archiveType=linkedin + top-level archiveType=wh
   2
 
 run_case "BYPASS: conversation.archiveType=linkedin + top-level archiveType=whatsapp-export → BLOCKED" \
-  '{"hook_event_name":"PreToolUse","tool_name":"mcp__memory__memory-archive-write","tool_input":{"conversation":{"archiveType":"linkedin-connections","conversationId":"x"},"archiveType":"whatsapp-export","ownerNodeId":"x","accountId":"a","rows":[]}}' \
+  '{"hook_event_name":"PreToolUse","tool_name":"mcp__memory__memory-archive-write","tool_input":{"conversation":{"archiveType":"linkedin-connections","sessionId":"x"},"archiveType":"whatsapp-export","ownerNodeId":"x","accountId":"a","rows":[]}}' \
   2
 
 # Plugin-source-edit path block must read tool_input.file_path top-level,

package/payload/platform/plugins/admin/hooks/__tests__/per-turn-graph-pass-gate.test.sh

@@ -0,0 +1,361 @@
+#!/usr/bin/env bash
+# Task 440 — per-turn-graph-pass-gate Stop hook test suite.
+#
+# Mirrors session-end-retrospective.test.sh's listener-mock pattern. Local
+# Python HTTP server stands in for /api/admin/log-ingest and records every
+# POST so the assertions read every log line the hook emitted.
+#
+# Contract under test:
+#   - Role/specialist gates: exit 0, single trigger-skipped log line, no
+#     stderr.
+#       role-not-admin | is-specialist | empty-stdin | missing-transcript
+#   - No real-user record in transcript (e.g. SessionStart bootstrap, or
+#     only tool_result-shaped user records): exit 0, single
+#     `trigger-skipped reason=no-real-user` line, no stderr.
+#   - Block path — admin's turn since the latest real-user message contains
+#     no `Task(database-operator)` dispatch and no `pre-turn-graph-pass-skip`
+#     tool_use: exit 2, stderr carries the instruction block,
+#     `gate-blocked sessionId=<id> reason=sentinel-absent` emitted.
+#   - Release via dispatch — a `Task` tool_use with
+#     `input.subagent_type=database-operator` appears AFTER the latest
+#     real-user message: exit 0, `gate-released sessionId=<id> via=dispatch`.
+#   - Release via skip-sentinel — a `tool_use` named
+#     `mcp__admin__pre-turn-graph-pass-skip` appears AFTER the latest
+#     real-user message: exit 0,
+#     `gate-released sessionId=<id> via=skip-sentinel`.
+#   - Per-prompt scoping — a dispatch BEFORE the latest real-user message
+#     does NOT release the gate.
+#   - Re-entry — a second Stop fired after the release tool_use still
+#     releases (the JSONL grep is the re-entry guard, no loop).
+
+set -u
+
+HOOK="$(cd "$(dirname "$0")/.." && pwd)/per-turn-graph-pass-gate.sh"
+if [[ ! -x "$HOOK" ]]; then
+  echo "FAIL: $HOOK not executable" >&2
+  exit 1
+fi
+
+OP_ID='aaaaaaaa-1111-2222-3333-bbbbbbbbbbbb'
+
+TMPFILES=()
+LISTENER_PIDS=()
+cleanup_test_state() {
+  for pid in "${LISTENER_PIDS[@]:-}"; do
+    if [[ -n "$pid" ]]; then
+      kill "$pid" 2>/dev/null || true
+      wait "$pid" 2>/dev/null || true
+    fi
+  done
+  for f in "${TMPFILES[@]:-}"; do
+    [[ -n "$f" ]] && rm -f "$f" 2>/dev/null || true
+  done
+}
+trap cleanup_test_state EXIT
+
+PASS=0
+FAIL=0
+pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
+fail() { echo "FAIL: $1" >&2; FAIL=$((FAIL + 1)); }
+
+start_listener() {
+  REQ_LOG=$(mktemp); TMPFILES+=("$REQ_LOG")
+  LISTENER_PORT=$((39800 + RANDOM % 100))
+  python3 - "$LISTENER_PORT" "$REQ_LOG" <<'PY' &
+import sys, http.server, json
+port = int(sys.argv[1])
+log_path = sys.argv[2]
+class H(http.server.BaseHTTPRequestHandler):
+  def log_message(self, *a, **k): pass
+  def do_POST(self):
+    n = int(self.headers.get('Content-Length','0') or 0)
+    body = self.rfile.read(n).decode('utf-8','replace')
+    with open(log_path, 'a', encoding='utf-8') as f:
+      f.write(self.path + '\t' + body + '\n')
+    self.send_response(200)
+    self.send_header('Content-Type','application/json')
+    self.end_headers()
+    self.wfile.write(json.dumps({"ok": True}).encode('utf-8'))
+http.server.HTTPServer(('127.0.0.1', port), H).serve_forever()
+PY
+  LISTENER_PIDS+=("$!")
+  for _ in $(seq 1 20); do
+    if curl -sS --max-time 1 -X POST "http://127.0.0.1:${LISTENER_PORT}/ping" -d '{}' >/dev/null 2>&1; then
+      break
+    fi
+    sleep 0.1
+  done
+  : > "$REQ_LOG"
+}
+
+run_hook() {
+  local role="$1"; local specialist="$2"; local stdin_json="$3"
+  local stderr_file; stderr_file=$(mktemp); TMPFILES+=("$stderr_file")
+  local stdout_file; stdout_file=$(mktemp); TMPFILES+=("$stdout_file")
+  printf '%s' "$stdin_json" | \
+    MAXY_SESSION_ROLE="$role" \
+    MAXY_SPECIALIST="$specialist" \
+    MAXY_UI_INTERNAL_PORT="$LISTENER_PORT" \
+    bash "$HOOK" >"$stdout_file" 2>"$stderr_file"
+  HOOK_RC=$?
+  HOOK_STDERR=$(cat "$stderr_file")
+  HOOK_STDOUT=$(cat "$stdout_file")
+  sleep 0.1
+}
+
+ingest_lines() {
+  grep -E '^/api/admin/log-ingest	' "$REQ_LOG" 2>/dev/null | python3 -c '
+import sys, json
+for raw in sys.stdin:
+  try:
+    _, body = raw.rstrip("\n").split("\t", 1)
+    d = json.loads(body)
+    if isinstance(d, dict) and isinstance(d.get("line"), str):
+      print(d["line"])
+  except Exception:
+    pass
+' || true
+}
+
+# write_transcript: builds JSONL from positional specs.
+# Spec format: <role>|<text>|<extra>
+#   extra "" — plain text record
+#   extra "tool_result" — user record carrying only a tool_result block
+#   extra "tool_use:<NAME>" — assistant record with a tool_use block (no input)
+#   extra "task:<subagent_type>" — assistant record with a Task tool_use whose
+#                                  input.subagent_type equals <subagent_type>
+write_transcript() {
+  local out="$1"; shift
+  python3 - "$out" "$@" <<'PY'
+import sys, json
+out = sys.argv[1]
+spec = sys.argv[2:]
+with open(out, "w", encoding="utf-8") as f:
+    for entry in spec:
+        role, text, extra = entry.split("|", 2)
+        rec = {"type": role, "timestamp": "2026-05-26T10:00:00.000Z"}
+        if role == "user":
+            if extra == "tool_result":
+                rec["message"] = {
+                    "role": "user",
+                    "content": [
+                        {"type": "tool_result", "tool_use_id": "tu_x", "content": text or "ok"},
+                    ],
+                }
+            else:
+                rec["message"] = {"role": "user", "content": text}
+        else:
+            content_blocks = []
+            if text:
+                content_blocks.append({"type": "text", "text": text})
+            if extra.startswith("tool_use:"):
+                tool_name = extra.split(":", 1)[1]
+                content_blocks.append({
+                    "type": "tool_use",
+                    "id": f"toolu_{tool_name}",
+                    "name": tool_name,
+                    "input": {},
+                })
+            elif extra.startswith("task:"):
+                subagent = extra.split(":", 1)[1]
+                content_blocks.append({
+                    "type": "tool_use",
+                    "id": f"toolu_task_{subagent}",
+                    "name": "Task",
+                    "input": {"subagent_type": subagent, "description": "test", "prompt": "test"},
+                })
+            rec["message"] = {
+                "id": f"msg_{role}_{hash(text) & 0xffff:04x}",
+                "role": "assistant",
+                "content": content_blocks,
+            }
+        f.write(json.dumps(rec) + "\n")
+PY
+}
+
+envelope_for() {
+  python3 -c '
+import json, sys
+print(json.dumps({"session_id": sys.argv[1], "transcript_path": sys.argv[2]}))
+' "$1" "$2"
+}
+
+INSTRUCTION_TOKEN='Before this turn closes, do the per-turn graph pass'
+
+# ---------------------------------------------------------------------------
+# Case 1: role != admin → trigger-skipped reason=role-not-admin
+# ---------------------------------------------------------------------------
+start_listener
+TR_BASIC=$(mktemp); TMPFILES+=("$TR_BASIC")
+write_transcript "$TR_BASIC" "user|hello|" "assistant|hi|"
+ENV_BASIC=$(envelope_for "$OP_ID" "$TR_BASIC")
+: > "$REQ_LOG"
+run_hook "public" "" "$ENV_BASIC"
+[[ "$HOOK_RC" -eq 0 ]] || fail "case-1 rc=$HOOK_RC"
+[[ -z "$HOOK_STDERR" ]] || fail "case-1 stderr must be empty"
+if ingest_lines | grep -qE "^trigger-skipped sessionId=${OP_ID} reason=role-not-admin$"; then
+  pass "case-1 role=public → trigger-skipped reason=role-not-admin"
+else
+  fail "case-1 expected role-not-admin, got: $(ingest_lines)"
+fi
+
+# ---------------------------------------------------------------------------
+# Case 2: MAXY_SPECIALIST set → trigger-skipped reason=is-specialist
+# ---------------------------------------------------------------------------
+: > "$REQ_LOG"
+run_hook "admin" "database-operator" "$ENV_BASIC"
+[[ "$HOOK_RC" -eq 0 ]] || fail "case-2 rc=$HOOK_RC"
+[[ -z "$HOOK_STDERR" ]] || fail "case-2 stderr must be empty"
+if ingest_lines | grep -qE "^trigger-skipped sessionId=${OP_ID} reason=is-specialist specialist=database-operator$"; then
+  pass "case-2 specialist=database-operator → trigger-skipped is-specialist"
+else
+  fail "case-2 expected is-specialist, got: $(ingest_lines)"
+fi
+
+# ---------------------------------------------------------------------------
+# Case 3: empty stdin → trigger-skipped reason=empty-stdin
+# ---------------------------------------------------------------------------
+: > "$REQ_LOG"
+run_hook "admin" "" ""
+[[ "$HOOK_RC" -eq 0 ]] || fail "case-3 rc=$HOOK_RC"
+if ingest_lines | grep -qE "^trigger-skipped sessionId=.* reason=empty-stdin$"; then
+  pass "case-3 empty stdin → trigger-skipped reason=empty-stdin"
+else
+  fail "case-3 expected empty-stdin, got: $(ingest_lines)"
+fi
+
+# ---------------------------------------------------------------------------
+# Case 4: missing transcript_path → trigger-skipped reason=missing-transcript
+# ---------------------------------------------------------------------------
+BAD_ENV=$(python3 -c 'import json,sys; print(json.dumps({"session_id": sys.argv[1]}))' "$OP_ID")
+: > "$REQ_LOG"
+run_hook "admin" "" "$BAD_ENV"
+[[ "$HOOK_RC" -eq 0 ]] || fail "case-4 rc=$HOOK_RC"
+if ingest_lines | grep -qE "^trigger-skipped sessionId=${OP_ID} reason=missing-transcript$"; then
+  pass "case-4 missing transcript → trigger-skipped reason=missing-transcript"
+else
+  fail "case-4 expected missing-transcript, got: $(ingest_lines)"
+fi
+
+# ---------------------------------------------------------------------------
+# Case 5: no real-user record in transcript → trigger-skipped no-real-user
+# ---------------------------------------------------------------------------
+TR_NO_USER=$(mktemp); TMPFILES+=("$TR_NO_USER")
+# Only a tool_result-shaped user record + an assistant record. The hook should
+# treat this as "no real user yet" and trigger-skip.
+write_transcript "$TR_NO_USER" "user|ok|tool_result" "assistant|booting|"
+ENV_NO_USER=$(envelope_for "$OP_ID" "$TR_NO_USER")
+: > "$REQ_LOG"
+run_hook "admin" "" "$ENV_NO_USER"
+[[ "$HOOK_RC" -eq 0 ]] || fail "case-5 rc=$HOOK_RC"
+[[ -z "$HOOK_STDERR" ]] || fail "case-5 stderr must be empty"
+if ingest_lines | grep -qE "^trigger-skipped sessionId=${OP_ID} reason=no-real-user$"; then
+  pass "case-5 only tool_result-user records → trigger-skipped no-real-user"
+else
+  fail "case-5 expected no-real-user, got: $(ingest_lines)"
+fi
+
+# ---------------------------------------------------------------------------
+# Case 6: gate-blocked — admin replied to operator without dispatching or
+# calling the skip sentinel.
+# ---------------------------------------------------------------------------
+TR_BLOCKED=$(mktemp); TMPFILES+=("$TR_BLOCKED")
+write_transcript "$TR_BLOCKED" "user|hello|" "assistant|hi there|"
+ENV_BLOCKED=$(envelope_for "$OP_ID" "$TR_BLOCKED")
+: > "$REQ_LOG"
+run_hook "admin" "" "$ENV_BLOCKED"
+[[ "$HOOK_RC" -eq 2 ]] || fail "case-6 expected rc=2, got $HOOK_RC"
+if ! printf '%s' "$HOOK_STDERR" | grep -qF "$INSTRUCTION_TOKEN"; then
+  fail "case-6 stderr must contain instruction token; got: $HOOK_STDERR"
+fi
+if ingest_lines | grep -qE "^gate-blocked sessionId=${OP_ID} reason=sentinel-absent$"; then
+  pass "case-6 admin replied without dispatch/skip → gate-blocked + stderr instruction + rc=2"
+else
+  fail "case-6 expected gate-blocked, got: $(ingest_lines)"
+fi
+
+# ---------------------------------------------------------------------------
+# Case 7: release via dispatch — admin issued Task(database-operator) AFTER
+# the latest real-user message.
+# ---------------------------------------------------------------------------
+TR_DISPATCH=$(mktemp); TMPFILES+=("$TR_DISPATCH")
+write_transcript "$TR_DISPATCH" \
+  "user|tell me about Alice|" \
+  "assistant|dispatching|task:database-operator" \
+  "assistant|done|"
+ENV_DISPATCH=$(envelope_for "$OP_ID" "$TR_DISPATCH")
+: > "$REQ_LOG"
+run_hook "admin" "" "$ENV_DISPATCH"
+[[ "$HOOK_RC" -eq 0 ]] || fail "case-7 expected rc=0, got $HOOK_RC"
+[[ -z "$HOOK_STDERR" ]] || fail "case-7 stderr must be empty on release"
+if ingest_lines | grep -qE "^gate-released sessionId=${OP_ID} via=dispatch$"; then
+  pass "case-7 Task(database-operator) after latest user → gate-released via=dispatch"
+else
+  fail "case-7 expected gate-released via=dispatch, got: $(ingest_lines)"
+fi
+
+# ---------------------------------------------------------------------------
+# Case 8: release via skip-sentinel — admin called the skip MCP tool AFTER
+# the latest real-user message.
+# ---------------------------------------------------------------------------
+TR_SKIP=$(mktemp); TMPFILES+=("$TR_SKIP")
+write_transcript "$TR_SKIP" \
+  "user|thanks|" \
+  "assistant|noted|tool_use:mcp__admin__pre-turn-graph-pass-skip" \
+  "assistant|you're welcome|"
+ENV_SKIP=$(envelope_for "$OP_ID" "$TR_SKIP")
+: > "$REQ_LOG"
+run_hook "admin" "" "$ENV_SKIP"
+[[ "$HOOK_RC" -eq 0 ]] || fail "case-8 expected rc=0, got $HOOK_RC"
+[[ -z "$HOOK_STDERR" ]] || fail "case-8 stderr must be empty on release"
+if ingest_lines | grep -qE "^gate-released sessionId=${OP_ID} via=skip-sentinel$"; then
+  pass "case-8 skip-sentinel after latest user → gate-released via=skip-sentinel"
+else
+  fail "case-8 expected gate-released via=skip-sentinel, got: $(ingest_lines)"
+fi
+
+# ---------------------------------------------------------------------------
+# Case 9: per-prompt scoping — a dispatch BEFORE the latest real-user
+# message does NOT release the current turn's gate.
+# ---------------------------------------------------------------------------
+TR_PRIOR=$(mktemp); TMPFILES+=("$TR_PRIOR")
+write_transcript "$TR_PRIOR" \
+  "user|first turn|" \
+  "assistant|dispatching|task:database-operator" \
+  "assistant|done|" \
+  "user|second turn|" \
+  "assistant|hello again|"
+ENV_PRIOR=$(envelope_for "$OP_ID" "$TR_PRIOR")
+: > "$REQ_LOG"
+run_hook "admin" "" "$ENV_PRIOR"
+[[ "$HOOK_RC" -eq 2 ]] || fail "case-9 expected rc=2, got $HOOK_RC"
+if ingest_lines | grep -qE "^gate-blocked sessionId=${OP_ID} reason=sentinel-absent$"; then
+  pass "case-9 dispatch before latest user does NOT release current turn → gate-blocked"
+else
+  fail "case-9 expected gate-blocked, got: $(ingest_lines)"
+fi
+
+# ---------------------------------------------------------------------------
+# Case 10: re-entry — a release tool_use earlier in the same prompt window
+# stays released on a second Stop fire (no loop).
+# ---------------------------------------------------------------------------
+TR_REENTRY=$(mktemp); TMPFILES+=("$TR_REENTRY")
+write_transcript "$TR_REENTRY" \
+  "user|hi|" \
+  "assistant|dispatching|task:database-operator" \
+  "assistant|done|" \
+  "assistant|wrap-up reply|"
+ENV_REENTRY=$(envelope_for "$OP_ID" "$TR_REENTRY")
+: > "$REQ_LOG"
+run_hook "admin" "" "$ENV_REENTRY"
+[[ "$HOOK_RC" -eq 0 ]] || fail "case-10 expected rc=0, got $HOOK_RC"
+if ingest_lines | grep -qE "^gate-released sessionId=${OP_ID} via=dispatch$"; then
+  pass "case-10 second Stop after dispatch still releases (no loop)"
+else
+  fail "case-10 expected gate-released via=dispatch, got: $(ingest_lines)"
+fi
+
+# ---------------------------------------------------------------------------
+echo
+echo "per-turn-graph-pass-gate tests: $PASS passed, $FAIL failed"
+[[ "$FAIL" -eq 0 ]]