@rubytech/create-maxy-code 0.1.216 → 0.1.221

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.216",
+  "version": "0.1.221",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/lib/mcp-eager/dist/index.d.ts

@@ -20,41 +20,6 @@
  */
 /** Wire-format metadata key the Claude Code SDK reads. */
 export declare const ALWAYS_LOAD_META_KEY: "anthropic/alwaysLoad";
-/**
- * Admin-seat detection. The rc-daemon exports `MAXY_SESSION_ROLE=admin` and
- * `MAXY_SPECIALIST=""` for the orchestrator process and its MCP plugin
- * children; specialist spawns set `MAXY_SPECIALIST=<name>`. A plugin process
- * inheriting the env can therefore decide at registration AND invocation
- * time whether it is loaded inside the admin seat.
- *
- * Mirrors `isAdminSeat` in platform/plugins/admin/mcp/src/skill-resolution.ts
- * — this is a duplicate at the library layer so plugins that cannot import
- * from the admin plugin (a sibling, not a dependency) share the same rule.
- */
-export declare function isAdminSeat(env?: NodeJS.ProcessEnv): boolean;
-/**
- * MCP refusal envelope returned when the admin seat invokes a specialist-
- * owned tool. The text names the dispatch route so the model's next action
- * is the `Agent` dispatch rather than a dead end.
- */
-export declare function adminBlockedResponse(toolName: string, owner: string): {
-    content: {
-        type: "text";
-        text: string;
-    }[];
-    isError: true;
-};
-/**
- * Wrap a tool handler so any admin-seat invocation short-circuits with the
- * refusal envelope above and emits one `[admin-tool-gate]` line to stderr.
- *
- * Specialist seats pass through unchanged: this is the primitive Task 529
- * defines for closing the in-message authoring path that Task 516 could
- * not reach. The handler signature is preserved so existing call sites
- * substitute `eagerTool(... handler)` for `eagerTool(... withAdminGate(name,
- * owner, handler))` mechanically.
- */
-export declare function withAdminGate<H extends (...args: any[]) => any>(toolName: string, owner: string, handler: H): H;
 /**
  * Loose structural type for any object exposing a `registerTool` method. The
  * MCP SDK ships dual ESM/CJS packages with conditional exports, so importing
@@ -92,25 +57,5 @@ type LocalZodRawShape = Record<string, unknown>;
  * the consumer's own zod version) infers the handler args.
  */
 export declare function eagerTool<Args extends LocalZodRawShape>(server: EagerCapableServer, name: string, description: string, inputSchema: Args, handler: (...args: any[]) => any): void;
-/**
- * Loose structural type for the legacy four-arg `server.tool(name, desc,
- * schema, handler)` call shape — used when the admin seat must register a
- * specialist-owned tool as deferred (not eager) so it does not appear in
- * the admin's eager tool list.
- */
-type DeferredCapableServer = {
-    tool: (name: string, description: string, inputSchema: any, handler: (...args: any[]) => any) => any;
-};
-/**
- * Register a tool that is eager for specialists but deferred + admin-gated
- * for the admin seat. The owning specialist name is named here so the
- * refusal envelope (and the `[admin-tool-gate]` log line) carries it.
- *
- * Use for every tool whose owner is a specialist (database-operator, writer-
- * craft, research-assistant, personal-assistant, content-producer). The
- * admin seat sees the tool only via ToolSearch — and any invocation from the
- * admin seat refuses with the dispatch hint.
- */
-export declare function eagerToolGated<Args extends LocalZodRawShape>(server: EagerCapableServer & DeferredCapableServer, name: string, owner: string, description: string, inputSchema: Args, handler: (...args: any[]) => any): void;
 export {};
 //# sourceMappingURL=index.d.ts.map

package/payload/platform/lib/mcp-eager/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,0DAA0D;AAC1D,eAAO,MAAM,oBAAoB,EAAG,sBAA+B,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAEzE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG;IACrE,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC1C,OAAO,EAAE,IAAI,CAAC;CACf,CAYA;AAED;;;;;;;;;GASG;AAEH,wBAAgB,aAAa,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAC7D,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,CAAC,GACT,CAAC,CAYH;AAED;;;;;;;GAOG;AAEH,KAAK,kBAAkB,GAAG;IAAE,YAAY,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;CAAE,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,KAAK,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,SAAS,gBAAgB,EACrD,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,IAAI,EAEjB,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,GAC/B,IAAI,CAUN;AAED;;;;;GAKG;AAEH,KAAK,qBAAqB,GAAG;IAAE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,KAAK,GAAG,CAAA;CAAE,CAAC;AAEtI;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,IAAI,SAAS,gBAAgB,EAC1D,MAAM,EAAE,kBAAkB,GAAG,qBAAqB,EAClD,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,IAAI,EAEjB,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,GAC/B,IAAI,CAMN"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,0DAA0D;AAC1D,eAAO,MAAM,oBAAoB,EAAG,sBAA+B,CAAC;AAEpE;;;;;;;GAOG;AAEH,KAAK,kBAAkB,GAAG;IAAE,YAAY,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;CAAE,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,KAAK,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,SAAS,gBAAgB,EACrD,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,IAAI,EAEjB,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,GAC/B,IAAI,CAUN"}

package/payload/platform/lib/mcp-eager/dist/index.js

@@ -1,11 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ALWAYS_LOAD_META_KEY = void 0;
-exports.isAdminSeat = isAdminSeat;
-exports.adminBlockedResponse = adminBlockedResponse;
-exports.withAdminGate = withAdminGate;
 exports.eagerTool = eagerTool;
-exports.eagerToolGated = eagerToolGated;
 /**
  * MCP eager-load helper.
  *
@@ -28,59 +24,6 @@ exports.eagerToolGated = eagerToolGated;
  */
 /** Wire-format metadata key the Claude Code SDK reads. */
 exports.ALWAYS_LOAD_META_KEY = "anthropic/alwaysLoad";
-/**
- * Admin-seat detection. The rc-daemon exports `MAXY_SESSION_ROLE=admin` and
- * `MAXY_SPECIALIST=""` for the orchestrator process and its MCP plugin
- * children; specialist spawns set `MAXY_SPECIALIST=<name>`. A plugin process
- * inheriting the env can therefore decide at registration AND invocation
- * time whether it is loaded inside the admin seat.
- *
- * Mirrors `isAdminSeat` in platform/plugins/admin/mcp/src/skill-resolution.ts
- * — this is a duplicate at the library layer so plugins that cannot import
- * from the admin plugin (a sibling, not a dependency) share the same rule.
- */
-function isAdminSeat(env = process.env) {
-    return env.MAXY_SESSION_ROLE === "admin" && !(env.MAXY_SPECIALIST && env.MAXY_SPECIALIST.length > 0);
-}
-/**
- * MCP refusal envelope returned when the admin seat invokes a specialist-
- * owned tool. The text names the dispatch route so the model's next action
- * is the `Agent` dispatch rather than a dead end.
- */
-function adminBlockedResponse(toolName, owner) {
-    return {
-        content: [
-            {
-                type: "text",
-                text: `Tool \`${toolName}\` is owned by the \`${owner}\` specialist and is not callable from the admin seat. ` +
-                    `Dispatch \`${owner}\` with the Agent tool and pass the work as the brief.`,
-            },
-        ],
-        isError: true,
-    };
-}
-/**
- * Wrap a tool handler so any admin-seat invocation short-circuits with the
- * refusal envelope above and emits one `[admin-tool-gate]` line to stderr.
- *
- * Specialist seats pass through unchanged: this is the primitive Task 529
- * defines for closing the in-message authoring path that Task 516 could
- * not reach. The handler signature is preserved so existing call sites
- * substitute `eagerTool(... handler)` for `eagerTool(... withAdminGate(name,
- * owner, handler))` mechanically.
- */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-function withAdminGate(toolName, owner, handler) {
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    const wrapped = ((...args) => {
-        if (isAdminSeat(process.env)) {
-            process.stderr.write(`[admin-tool-gate] role=admin tool=${toolName} decision=block reason=specialist-owned owner=${owner}\n`);
-            return adminBlockedResponse(toolName, owner);
-        }
-        return handler(...args);
-    });
-    return wrapped;
-}
 /**
  * Register an MCP tool that the Claude Code SDK eager-loads into the
  * model's prompt at session boot, bypassing the ToolSearch round-trip.
@@ -103,23 +46,4 @@ handler) {
         _meta: { [exports.ALWAYS_LOAD_META_KEY]: true },
     }, handler);
 }
-/**
- * Register a tool that is eager for specialists but deferred + admin-gated
- * for the admin seat. The owning specialist name is named here so the
- * refusal envelope (and the `[admin-tool-gate]` log line) carries it.
- *
- * Use for every tool whose owner is a specialist (database-operator, writer-
- * craft, research-assistant, personal-assistant, content-producer). The
- * admin seat sees the tool only via ToolSearch — and any invocation from the
- * admin seat refuses with the dispatch hint.
- */
-function eagerToolGated(server, name, owner, description, inputSchema, 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-handler) {
-    if (isAdminSeat(process.env)) {
-        server.tool(name, description, inputSchema, withAdminGate(name, owner, handler));
-        return;
-    }
-    eagerTool(server, name, description, inputSchema, handler);
-}
 //# sourceMappingURL=index.js.map

package/payload/platform/lib/mcp-eager/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAkCA,kCAEC;AAOD,oDAeC;AAaD,sCAgBC;AAuCD,8BAiBC;AAqBD,wCAcC;AAlLD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,0DAA0D;AAC7C,QAAA,oBAAoB,GAAG,sBAA+B,CAAC;AAEpE;;;;;;;;;;GAUG;AACH,SAAgB,WAAW,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC9D,OAAO,GAAG,CAAC,iBAAiB,KAAK,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvG,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,QAAgB,EAAE,KAAa;IAIlE,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EACF,UAAU,QAAQ,wBAAwB,KAAK,yDAAyD;oBACxG,cAAc,KAAK,wDAAwD;aAC9E;SACF;QACD,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,8DAA8D;AAC9D,SAAgB,aAAa,CAC3B,QAAgB,EAChB,KAAa,EACb,OAAU;IAEV,8DAA8D;IAC9D,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,IAAW,EAAE,EAAE;QAClC,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,qCAAqC,QAAQ,iDAAiD,KAAK,IAAI,CACxG,CAAC;YACF,OAAO,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAiB,CAAC;IACnB,OAAO,OAAO,CAAC;AACjB,CAAC;AA0BD;;;;;;;;;;;;GAYG;AACH,SAAgB,SAAS,CACvB,MAA0B,EAC1B,IAAY,EACZ,WAAmB,EACnB,WAAiB;AACjB,8DAA8D;AAC9D,OAAgC;IAEhC,MAAM,CAAC,YAAY,CACjB,IAAI,EACJ;QACE,WAAW;QACX,WAAW;QACX,KAAK,EAAE,EAAE,CAAC,4BAAoB,CAAC,EAAE,IAAI,EAAE;KACxC,EACD,OAAO,CACR,CAAC;AACJ,CAAC;AAWD;;;;;;;;;GASG;AACH,SAAgB,cAAc,CAC5B,MAAkD,EAClD,IAAY,EACZ,KAAa,EACb,WAAmB,EACnB,WAAiB;AACjB,8DAA8D;AAC9D,OAAgC;IAEhC,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QACjF,OAAO;IACT,CAAC;IACD,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AA4DA,8BAiBC;AA7ED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,0DAA0D;AAC7C,QAAA,oBAAoB,GAAG,sBAA+B,CAAC;AA0BpE;;;;;;;;;;;;GAYG;AACH,SAAgB,SAAS,CACvB,MAA0B,EAC1B,IAAY,EACZ,WAAmB,EACnB,WAAiB;AACjB,8DAA8D;AAC9D,OAAgC;IAEhC,MAAM,CAAC,YAAY,CACjB,IAAI,EACJ;QACE,WAAW;QACX,WAAW;QACX,KAAK,EAAE,EAAE,CAAC,4BAAoB,CAAC,EAAE,IAAI,EAAE;KACxC,EACD,OAAO,CACR,CAAC;AACJ,CAAC"}

package/payload/platform/lib/mcp-eager/src/index.ts

@@ -21,72 +21,6 @@
 /** Wire-format metadata key the Claude Code SDK reads. */
 export const ALWAYS_LOAD_META_KEY = "anthropic/alwaysLoad" as const;
 
-/**
- * Admin-seat detection. The rc-daemon exports `MAXY_SESSION_ROLE=admin` and
- * `MAXY_SPECIALIST=""` for the orchestrator process and its MCP plugin
- * children; specialist spawns set `MAXY_SPECIALIST=<name>`. A plugin process
- * inheriting the env can therefore decide at registration AND invocation
- * time whether it is loaded inside the admin seat.
- *
- * Mirrors `isAdminSeat` in platform/plugins/admin/mcp/src/skill-resolution.ts
- * — this is a duplicate at the library layer so plugins that cannot import
- * from the admin plugin (a sibling, not a dependency) share the same rule.
- */
-export function isAdminSeat(env: NodeJS.ProcessEnv = process.env): boolean {
-  return env.MAXY_SESSION_ROLE === "admin" && !(env.MAXY_SPECIALIST && env.MAXY_SPECIALIST.length > 0);
-}
-
-/**
- * MCP refusal envelope returned when the admin seat invokes a specialist-
- * owned tool. The text names the dispatch route so the model's next action
- * is the `Agent` dispatch rather than a dead end.
- */
-export function adminBlockedResponse(toolName: string, owner: string): {
-  content: { type: "text"; text: string }[];
-  isError: true;
-} {
-  return {
-    content: [
-      {
-        type: "text",
-        text:
-          `Tool \`${toolName}\` is owned by the \`${owner}\` specialist and is not callable from the admin seat. ` +
-          `Dispatch \`${owner}\` with the Agent tool and pass the work as the brief.`,
-      },
-    ],
-    isError: true,
-  };
-}
-
-/**
- * Wrap a tool handler so any admin-seat invocation short-circuits with the
- * refusal envelope above and emits one `[admin-tool-gate]` line to stderr.
- *
- * Specialist seats pass through unchanged: this is the primitive Task 529
- * defines for closing the in-message authoring path that Task 516 could
- * not reach. The handler signature is preserved so existing call sites
- * substitute `eagerTool(... handler)` for `eagerTool(... withAdminGate(name,
- * owner, handler))` mechanically.
- */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-export function withAdminGate<H extends (...args: any[]) => any>(
-  toolName: string,
-  owner: string,
-  handler: H,
-): H {
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  const wrapped = ((...args: any[]) => {
-    if (isAdminSeat(process.env)) {
-      process.stderr.write(
-        `[admin-tool-gate] role=admin tool=${toolName} decision=block reason=specialist-owned owner=${owner}\n`,
-      );
-      return adminBlockedResponse(toolName, owner);
-    }
-    return handler(...args);
-  }) as unknown as H;
-  return wrapped;
-}
-
 /**
  * Loose structural type for any object exposing a `registerTool` method. The
  * MCP SDK ships dual ESM/CJS packages with conditional exports, so importing
@@ -142,38 +76,3 @@ export function eagerTool<Args extends LocalZodRawShape>(
     handler,
   );
 }
-
-/**
- * Loose structural type for the legacy four-arg `server.tool(name, desc,
- * schema, handler)` call shape — used when the admin seat must register a
- * specialist-owned tool as deferred (not eager) so it does not appear in
- * the admin's eager tool list.
- */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-type DeferredCapableServer = { tool: (name: string, description: string, inputSchema: any, handler: (...args: any[]) => any) => any };
-
-/**
- * Register a tool that is eager for specialists but deferred + admin-gated
- * for the admin seat. The owning specialist name is named here so the
- * refusal envelope (and the `[admin-tool-gate]` log line) carries it.
- *
- * Use for every tool whose owner is a specialist (database-operator, writer-
- * craft, research-assistant, personal-assistant, content-producer). The
- * admin seat sees the tool only via ToolSearch — and any invocation from the
- * admin seat refuses with the dispatch hint.
- */
-export function eagerToolGated<Args extends LocalZodRawShape>(
-  server: EagerCapableServer & DeferredCapableServer,
-  name: string,
-  owner: string,
-  description: string,
-  inputSchema: Args,
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  handler: (...args: any[]) => any,
-): void {
-  if (isAdminSeat(process.env)) {
-    server.tool(name, description, inputSchema, withAdminGate(name, owner, handler));
-    return;
-  }
-  eagerTool(server, name, description, inputSchema, handler);
-}

package/payload/platform/plugins/admin/PLUGIN.md

@@ -106,7 +106,7 @@ Tools are available via the `admin` MCP server.
 
 **Admin-seat authoring-skill gate (Task 516).** `skill-load` and `plugin-read` refuse to return the body of a content-producer-owned authoring skill — `professional-document`, `a4-print-documents`, `publish-site` — when the caller is the admin seat (`MAXY_SESSION_ROLE=admin` with no `MAXY_SPECIALIST`). The refusal relays one line — "This deliverable is owned by content-producer. Dispatch it with the Agent tool and subagent_type content-producer." — so the admin's next action is the dispatch, not inline authoring. `plugin-read` extracts the skill slug from a `skills/<slug>/…` file path (or a slug buried in `pluginName`), so the raw-SKILL.md read path can't bypass the gate; `PLUGIN.md` and plain `references/*` reads are untouched. content-producer's own spawns carry `MAXY_SPECIALIST=content-producer` and resolve these skills normally (it reaches them via the native `Skill` tool regardless), and the public seat is out of scope. The gate is a pure name+env check before any filesystem read and fails open for any non-admin or unidentified seat — it never bricks a legitimate load. Each block emits `[admin-skill-gate] role=admin skill=<name> decision=block reason=content-producer-owned`. This is the enforcement layer; the IDENTITY.md delegation paragraph documents the intent but is not the gate ([[feedback_deterministic_means_remove_llm]], [[feedback_doctrine_paragraph_is_not_a_gate]]). Skills the admin invokes directly are deliberately excluded: `unzip-attachment` (its SKILL.md says "Invoked by the admin agent directly — admin owns all unzipping", then routes the extracted tree to a specialist) and `deck-pages` (admin-owned, a content-producer refusal target). The set is each skill's own SKILL.md "Invoked by" declaration, not the admin plugin's skill catalogue (which lists these admin-hosted skills for discovery — the catalogue is the inline path this gate closes).
 
-**Three-store admin auth invariant.** `admin-add` writes to all three identity stores (`users.json` PIN auth at the persistent `~/{configDir}/users.json` location , `account.json` `admins[]` role, Neo4j `:AdminUser`/`:Person` graph identity) with per-leg `[admin-auth-store]` log lines plus the `[admins-write]` chokepoint line, and returns `is_error: true` on any leg failure naming what's already written. `admin-update-pin` writes `users.json` only and emits the same `[admin-auth-store]` line. **Single chokepoint:** every `users.json` + `account.json admins[]` mutation routes through `platform/lib/admins-write` (`writeAdminEntry` for admin-add/set-pin, `removeAdminFromAccount` for admin-remove); the static check `grep -rnE 'admins\.push\|config\.admins\s*=' platform/ \| grep -v lib/admins-write` returns 0. Direct `Edit`/`Write` on `account.json` is blocked at the `pre-tool-use` hook — mutations go through `account-update`, `plugin-toggle-enabled`, or the `admin-*` tools. **Install + boot invariants:** the installer and admin-server boot walk every account.json admins[] vs users.json; `[install-invariant]` / `[admin-invariant] direction=… userId=<id8> source=<file>` fires per divergence with a `check complete divergences=<n>` summary. Log-only — does not block. See `.docs/agents.md` § "Three-store admin auth invariant" for the full contract.
+**Three-store admin auth invariant.** `admin-add` writes to all three identity stores (`users.json` PIN auth at the persistent `~/{configDir}/users.json` location , `account.json` `admins[]` role, Neo4j `:AdminUser`/`:Person` graph identity) with per-leg `[admin-auth-store]` log lines plus the `[admins-write]` chokepoint line, and returns `is_error: true` on any leg failure naming what's already written. `admin-update-pin` writes `users.json` only and emits the same `[admin-auth-store]` line. **Single chokepoint:** every `users.json` + `account.json admins[]` mutation routes through `platform/lib/admins-write` (`writeAdminEntry` for admin-add/set-pin, `removeAdminFromAccount` for admin-remove); the static check `grep -rnE 'admins\.push\|config\.admins\s*=' platform/ \| grep -v lib/admins-write` returns 0. Direct `Edit`/`Write` on `account.json` is forbidden by IDENTITY.md doctrine — mutations go through `account-update`, `plugin-toggle-enabled`, or the `admin-*` tools. **Install + boot invariants:** the installer and admin-server boot walk every account.json admins[] vs users.json; `[install-invariant]` / `[admin-invariant] direction=… userId=<id8> source=<file>` fires per divergence with a `check complete divergences=<n>` summary. Log-only — does not block. See `.docs/agents.md` § "Three-store admin auth invariant" for the full contract.
 
 **AdminUser graph stamp + boot self-heal.** The seed cypher in `platform/scripts/seed-neo4j.sh` stamps `:AdminUser.accountId` + `:AdminUser.role='owner'` ON CREATE so the graph-write gate's account-scoped MATCH succeeds on the first user-domain write. Admin-server boot additionally runs `platform/ui/app/lib/adminuser-self-heal.ts` to repair legacy nodes whose `accountId` or `role` is null — emits `[adminuser-self-heal] healed=<N> userId=<8> accountId=<8>` once per boot, idempotent. The `graph-write-gate` reject log gains a `subReason=` field (`no-admin-user-node` / `admin-user-no-accountid` / `no-business-or-personal-profile`) for operator diagnosis. See `.docs/agents.md` § "AdminUser graph stamp contract" for the full contract.
 
@@ -139,12 +139,11 @@ Tools are available via the `admin` MCP server.
 
 ## Hooks
 
-- `hooks/pre-tool-use.sh` — enforces admin agent write boundaries
 - `hooks/webfetch-preflight.mjs` — short-circuits WebFetch on JS-SPA shells with a structured `WEBFETCH_CANNOT_READ_JS_SPA` error so the agent surfaces a loud failure to the owner instead of paying the 60s extraction timeout. Fail-open on any internal error.
 - `hooks/askuserquestion-investigate-gate.sh` — PreToolUse matcher=`AskUserQuestion`. Blocks the question (exit 2) when no read-only investigation tool has fired since the latest real user turn in the session JSONL. The structural fix for the failure class where the agent fabricates a menu before evidence-gathering (session `c085ec2c-46fb-4b73-8865-68cf85866ea8` 2026-05-22 — "change remote access password" → invented options "Admin PIN / Cloudflare tunnel / WiFi password" with zero prior tool_use; post-correction the agent immediately fired `remote-auth-status` → `ToolSearch` → `remote-auth-set-password`, proving it knew the moves). **Allowlist** (exact, with trailing `__<tool>` suffix-match for namespaced `mcp__plugin_<plugin>_<server>__<tool>` aliases): `ToolSearch`, `Grep`, `Glob`, `Read`, `LS`, `NotebookRead`, `Bash`, `WebFetch`, `WebSearch`, plus the read-only admin / memory MCP tools (`*-status`, `*-list`, `*-read`, `skill-find`, `memory-find-candidates`, `profile-read`, `conversation-list`, `memory-list-attachments`, `memory-read-attachment`). **Block message:** `Blocked: AskUserQuestion requires at least one investigation tool (ToolSearch, Grep, Read, *-list, *-status, *-read, skill-find, ...) earlier in this turn. Search the operator's literal phrase first.` **Log line** (stderr, one per call): `[ask-gate] decision=<allow|block> sessionId=<id8> seen=<csv|-> reason=<allowlist-hit|no-investigation|fail-open-no-transcript|fail-open-parse-error>`. **Fail-open** on missing transcript or parse error — nudges, never bricks the UI.
 - `hooks/session-end-retrospective.sh` — **Stop hook.** Fires on every assistant end_turn but exits 0 with `trigger-skipped reason=<role-not-admin|is-specialist|empty-stdin|missing-transcript|no-intent-match>` on every path EXCEPT when the operator's latest real-user message carries an end-intent token (`/end`, `/archive`, `end session`, `archive this session`, case-insensitive, must match the whole message or a standalone line — not embedded in prose). On that path the hook blocks (exit 2 + structured retrospective instruction on stderr per Stop-hook contract) and emits `[session-retrospective] gate-blocked sessionId=<id> reason=sentinel-absent` until the admin agent calls the `session-retrospective-mark-complete` MCP sentinel tool. Completion is recognised by greping the operator's own JSONL (`transcript_path` on the Stop envelope) for a `tool_use` block whose `name` equals that exact string — never by parsing prose ([[feedback_no_stdout_parsing_for_control_flow]], [[feedback_doctrine_paragraph_is_not_a_gate]]). The sentinel-grep doubles as the re-entry guard: every Stop after the sentinel call sees it and exits 0 with `gate-released sessionId=<id>`. Recursion guard: any session whose `MAXY_SPECIALIST` env is set (specialist subagent dispatched via Task tool) skips the gate. The Sidebar archive button POSTs `/:sessionId/archive` directly to the manager which kills the PTY — no Stop fires after that, so clicking archive is the operator's current escape hatch (opt-out remains deferred per the task spec). All emits go through `POST /api/admin/log-ingest`; the only stderr writer is the gate-blocked path (the instruction block the agent reads). The retrospective itself runs as one or more additional turns inside the operator's existing admin session — Task-tool delegation to `database-operator` is the existing IDENTITY.md "Recording" route, not a parallel admin session ([[feedback_deterministic_means_remove_llm]]).
 - `hooks/mcp-tool-missing.sh` — **PostToolUse hook on `mcp__.*` (Task 502, directive 3).** Defence-in-depth for the `No such tool available: mcp__…` failure class that the Task 502 name-binding is built to eliminate. Fires on any MCP tool call; no-op unless the `tool_response` carries `No such tool available` AND the qualified name resolves to a maxy plugin (read from the generated `hooks/lib/maxy-mcp-plugins.txt`). On a maxy match it logs one deterministic `[mcp-tool-missing] server=<server> tool=<tool>` line and exits 2 with a fixed envelope on stderr, so the agent relays a named server-unavailable failure instead of narrating "warming up" or blind-retrying. A missing non-maxy bridge tool (Playwright etc., upstream-owned) passes through (exit 0). The maxy-plugin list is regenerated and gate-diffed by `platform/scripts/check-canonical-tool-names.mjs`.
-- `hooks/post-tool-use-agent.sh` — **PostToolUse hook on `Agent` (Task 560).** Drains any subagent hook-decision buffers under `~/.maxy-code/logs/hook-decisions/` modified since this parent's previous PostToolUse-Agent fire (cursor file keyed by parent session id), prints one `[hook-propagate]` line per record to stdout — Claude Code attaches the stdout as a `hook_success` attachment on the parent JSONL, making the records grep-queryable from the parent session alone (Task 559 motivating case). Rotates consumed buffers to `consumed/`. Emits one `[hook-propagate-census] parentSession=<…> subagentHooksObserved=<N> attachmentsEmitted=<M>` line per fire to stdout and server.log; `N != M` is the propagation regression signal. The companion emitter library `hooks/lib/hook-emit.sh` is sourced by `pre-tool-use.sh` and writes one record per block decision (4 KB stderr truncation, `truncated=true` set on the record).
+- `hooks/post-tool-use-agent.sh` — **PostToolUse hook on `Agent` (Task 560).** Drains any subagent hook-decision buffers under `~/.maxy-code/logs/hook-decisions/` modified since this parent's previous PostToolUse-Agent fire (cursor file keyed by parent session id), prints one `[hook-propagate]` line per record to stdout — Claude Code attaches the stdout as a `hook_success` attachment on the parent JSONL, making the records grep-queryable from the parent session alone (Task 559 motivating case). Rotates consumed buffers to `consumed/`. Emits one `[hook-propagate-census] parentSession=<…> subagentHooksObserved=<N> attachmentsEmitted=<M>` line per fire to stdout and server.log; `N != M` is the propagation regression signal. The companion emitter library `hooks/lib/hook-emit.sh` is sourced by `post-tool-use-agent.sh` and any other hook that records a block decision (4 KB stderr truncation, `truncated=true` set on the record).
 - `hooks/admin-authoring-observer.sh` — **PostToolUse hook on Write and Edit (Task 486).** Observation only — never blocks; exits 0 on every path. Fires when the admin agent (not a specialist subagent — gated by `MAXY_SPECIALIST` env) writes or edits a file under `<accountDir>/output/`. Walks the session transcript from the latest real-user turn forward to detect any prior `Task` `tool_use` whose `subagent_type` starts with `specialists:`. Emits one stderr line `[admin-authoring] inline-write path=<rel> priorSpecialistSpawnInTurn=<true|false|unknown>`. A `false` value on a long-form prose file is the regression signal Task 486 was designed to make visible — the BioSymm proposal session (admin authored a customer-facing proposal inline despite content-producer being installed) is the failure mode this surfaces mechanically. Mechanical enforcement (refuse the write, force a re-spawn) is deferred per the task spec.
 - `hooks/turn-completed-graph-write.sh` — **Dormant since Task 214** — the Stop-hook registration is no longer written to account settings.json; admin delegates graph writes to `database-operator` via the Task tool. The script, envelope walker, loopback `/api/admin/claude-sessions` 127.0.0.1 bypass, `[turn-recorder]` emitters, recorder-auto-archive subscriber, and `initialMessage` envelope spec are preserved as reusable infrastructure for any future autonomous post-turn flow. Historical contract (still describes the dormant path): Stop hook fired once per completed admin-agent turn. Gates on `MAXY_SESSION_ROLE=admin` + `MAXY_SPECIALIST!=database-operator` so it never recurses into the recorder PTY or fires on public sessions. **Task 147** — the recorder is spawned via the same route Sidebar uses. ONE POST to `POST /api/admin/claude-sessions`, body carries `{specialist:'database-operator', model:'haiku', initialMessage:<json-envelope>, adminSessionId:<op>}` — no synthetic `senderId: 'turn-recorder'` marker. The Hono wrapper bypasses cookie auth on this exact method+path when the request originates from `127.0.0.1` (same trust boundary the claude-session-manager itself relies on), looks up the operator's senderId from the manager's `/<adminSessionId>/meta`, and forwards a Sidebar-shape spawn body. The `/recorder-spawn` sibling route is gone. The hook reads its UI port from `MAXY_UI_INTERNAL_PORT` (stamped on the manager systemd unit) — no fallback; absence emits `[turn-recorder] spawn-failed reason=missing-env env=MAXY_UI_INTERNAL_PORT` to stderr instead of silently 19199-ing. **Task 177** — `initialMessage` is a JSON-stringified envelope; the schema lives in [`platform/plugins/docs/references/admin-session.md`](../docs/references/admin-session.md) under "`initialMessage` JSON envelope (Task 177)". Top-level keys exactly: `turns`, `sessionId`, `accountId`, `occurredAt`. `turns` is the full conversation transcript, oldest first, newest last, with each entry `{ role: "user"|"assistant", text, ts, toolCalls? }`. No windowing, no truncation. Multi-record assistant messages collapse on `message.id`. `tool_use` and matching `tool_result` blocks attach as a single `toolCalls` entry on the owning assistant turn; the user record carrying only the `tool_result` does not create a separate user turn. No leading instruction prose. `toolCalls[].input` and `toolCalls[].output` are native JSON values, never re-stringified. (Replaces Task 175's `(operatorMessage, assistantReply)` pair, which asserted a temporal Q→A relationship the walker never enforced.) One observability line `[turn-recorder] envelope sessionId=<op> turnsCount=<n> userTurns=<n> assistantTurns=<n> toolCallTurns=<n>` precedes `spawn-request`. The envelope rides on the `/spawn` body as a trailing positional argv to `claude`, so the database-operator session's JSONL first `role=user` line is the JSON object verbatim. No separate `POST /:id/input` call, no bracketed-paste, no keystroke injection. The recorder-auto-archive subscriber stops the recorder PTY as soon as its JSONL contains an assistant message with `stop_reason === "end_turn"`. **Task 129** — every emit goes through `POST /api/admin/log-ingest` so the lines land in `server.log` keyed by the operator session id. The chain is `trigger` → `spawn-request` → `spawn-success` → `input-delivered` → `tool-call` × N → `tool-result` × N → `write-complete` → `auto-archive`; each gated-off path emits one `trigger-skipped reason=<role-not-admin|is-recorder|empty-stdin|missing-transcript|conversation-empty>` line. Failure modes — `spawn-failed`, `tool-surface-missing`, `input-failed`, `write-empty`, `auto-archive reason=stale-recorder` — each emit one named line; absence is itself a defect.
 

package/payload/platform/plugins/admin/hooks/__tests__/hook-emit-stale-lock-ttl.test.sh

@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+# Task 569 — stale-lockdir TTL reclamation in _hook_acquire_lock and
+# _drain_acquire_lock. A backdated lockdir is force-removed on acquire;
+# a freshly held lockdir is not.
+set -u
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+LIB="$ROOT/lib/hook-emit.sh"
+DRAIN="$ROOT/post-tool-use-agent.sh"
+[[ -f "$LIB" ]] || { echo "FAIL: $LIB missing"; exit 1; }
+[[ -f "$DRAIN" ]] || { echo "FAIL: $DRAIN missing"; exit 1; }
+
+TMP=$(mktemp -d)
+export MAXY_HOOK_BUFFER_DIR="$TMP/buffers"
+export MAXY_HOOK_SERVER_LOG="$TMP/server.log"
+# Tight test budget — 20 × 10ms = 200ms ceiling so the negative case
+# returns quickly.
+export MAXY_HOOK_LOCK_ATTEMPTS=20
+export MAXY_HOOK_LOCK_SLEEP=0.01
+export MAXY_HOOK_LOCK_TTL_SECONDS=2
+mkdir -p "$MAXY_HOOK_BUFFER_DIR"
+
+PASS=0; FAIL=0
+pass() { PASS=$((PASS+1)); echo "PASS: $1"; }
+fail() { FAIL=$((FAIL+1)); echo "FAIL: $1" >&2; }
+
+# shellcheck disable=SC1090
+source "$LIB" || { fail "source library"; exit 1; }
+pass "source library"
+
+# Test 1: a stale lockdir (mtime backdated 10s; TTL=2s) is reclaimed and
+# acquire succeeds.
+LOCK1="$TMP/lock-stale"
+mkdir "$LOCK1"
+# Backdate mtime by 10s. -t needs YYYYMMDDhhmm.SS form; portable form
+# uses -d on GNU and -A/-r on BSD, so we use python to set it.
+python3 -c "import os,time; os.utime('$LOCK1', (time.time()-10, time.time()-10))"
+if _hook_acquire_lock "$LOCK1"; then
+  pass "stale lockdir reclaimed (emit-path)"
+else
+  fail "stale lockdir not reclaimed within budget (emit-path)"
+fi
+# Verify observability line.
+if grep -q "\[hook-propagate-error\] reason=stale-lock-reclaimed lockdir=$LOCK1" "$MAXY_HOOK_SERVER_LOG"; then
+  pass "stale-lock-reclaimed observability line emitted"
+else
+  fail "stale-lock-reclaimed line missing from server.log"
+fi
+rmdir "$LOCK1" 2>/dev/null || true
+
+# Test 2: a fresh lockdir (mtime = now) is NOT reclaimed and acquire
+# returns 1 within the attempt budget.
+LOCK2="$TMP/lock-fresh"
+mkdir "$LOCK2"
+START=$(date +%s)
+if _hook_acquire_lock "$LOCK2"; then
+  fail "fresh lockdir wrongly reclaimed (emit-path)"
+else
+  END=$(date +%s)
+  pass "fresh lockdir not reclaimed; acquire timed out (emit-path, ${END}-${START}s)"
+fi
+# Verify no stale-lock-reclaimed line was written for LOCK2.
+if grep -q "lockdir=$LOCK2 ageSeconds=" "$MAXY_HOOK_SERVER_LOG"; then
+  fail "fresh lockdir wrongly logged as stale (emit-path)"
+else
+  pass "no stale-lock log for fresh lockdir (emit-path)"
+fi
+rmdir "$LOCK2" 2>/dev/null || true
+
+# Test 3: same property for the drainer-side function. Extract
+# _drain_acquire_lock + its age helper from post-tool-use-agent.sh and
+# source them in isolation.
+DRAIN_LIB="$TMP/drain-lock.sh"
+awk '
+  /^_drain_lockdir_age_seconds\(\)/,/^}/ { print; next }
+  /^_drain_acquire_lock\(\)/,/^}/ { print; next }
+' "$DRAIN" > "$DRAIN_LIB"
+[[ -s "$DRAIN_LIB" ]] || { fail "drain lock extract empty"; }
+# shellcheck disable=SC1090
+source "$DRAIN_LIB" || fail "source drain lib"
+
+LOCK3="$TMP/lock-drain-stale"
+mkdir "$LOCK3"
+python3 -c "import os,time; os.utime('$LOCK3', (time.time()-10, time.time()-10))"
+if _drain_acquire_lock "$LOCK3"; then
+  pass "stale lockdir reclaimed (drain-path)"
+else
+  fail "stale lockdir not reclaimed (drain-path)"
+fi
+
+LOCK4="$TMP/lock-drain-fresh"
+mkdir "$LOCK4"
+if _drain_acquire_lock "$LOCK4"; then
+  fail "fresh lockdir wrongly reclaimed (drain-path)"
+else
+  pass "fresh lockdir not reclaimed; acquire timed out (drain-path)"
+fi
+
+rm -rf "$TMP"
+echo "----"
+echo "$PASS pass, $FAIL fail"
+[[ "$FAIL" -eq 0 ]]

package/payload/platform/plugins/admin/hooks/archive-ingest-surface-gate.sh

@@ -52,8 +52,7 @@
 #    server.log alongside the [whatsapp-ingest] script lines.
 #
 # Exit codes follow Claude Code hook protocol: 0 = allow, 2 = block (stderr
-# message shown to the agent). Fail-closed on terminal stdin to match
-# pre-tool-use.sh.
+# message shown to the agent). Fail-closed on terminal stdin.
 
 set -uo pipefail
 

package/payload/platform/plugins/admin/hooks/lib/hook-emit.sh

@@ -14,11 +14,39 @@
 # (tests) without flock(1).
 : "${MAXY_HOOK_LOCK_ATTEMPTS:=100}"
 : "${MAXY_HOOK_LOCK_SLEEP:=0.01}"
+# Task 569 — TTL for orphaned lockdirs left behind when a holder dies
+# between `mkdir lock` and `rmdir lock` (SIGKILL, OOM, systemd restart).
+# Default 5s is far longer than the legitimate hold (microseconds for a
+# rename or append) and shorter than operator-noticeable propagation lag.
+: "${MAXY_HOOK_LOCK_TTL_SECONDS:=5}"
+
+# _hook_lockdir_age_seconds <lockdir> — prints integer age in seconds, or
+# -1 if the lockdir cannot be stat'd. Portable across Linux (`stat -c`)
+# and macOS (`stat -f`).
+_hook_lockdir_age_seconds() {
+  local lockdir="$1" mtime now
+  mtime=$(stat -c %Y "$lockdir" 2>/dev/null || stat -f %m "$lockdir" 2>/dev/null)
+  [[ -z "$mtime" ]] && { echo -1; return; }
+  now=$(date +%s)
+  echo $((now - mtime))
+}
 
 # _hook_acquire_lock <lockdir> — returns 0 on success, 1 on timeout.
+# On each mkdir failure, if the lockdir is older than
+# MAXY_HOOK_LOCK_TTL_SECONDS, the orphaned holder is presumed dead: the
+# lockdir is force-removed, a stale-lock-reclaimed observability line is
+# emitted, and one mkdir retry is attempted before resuming the spin.
 _hook_acquire_lock() {
-  local lockdir="$1" i=0
+  local lockdir="$1" i=0 age
   while ! mkdir "$lockdir" 2>/dev/null; do
+    age=$(_hook_lockdir_age_seconds "$lockdir")
+    if [[ "$age" -ge "$MAXY_HOOK_LOCK_TTL_SECONDS" ]]; then
+      rmdir "$lockdir" 2>/dev/null || rm -rf "$lockdir" 2>/dev/null
+      mkdir -p "$(dirname "$MAXY_HOOK_SERVER_LOG")" 2>/dev/null
+      printf '[hook-propagate-error] reason=stale-lock-reclaimed lockdir=%s ageSeconds=%s\n' \
+        "$lockdir" "$age" >>"$MAXY_HOOK_SERVER_LOG" 2>/dev/null || true
+      mkdir "$lockdir" 2>/dev/null && return 0
+    fi
     i=$((i+1))
     [[ "$i" -ge "$MAXY_HOOK_LOCK_ATTEMPTS" ]] && return 1
     sleep "$MAXY_HOOK_LOCK_SLEEP" 2>/dev/null || true
@@ -102,8 +130,9 @@ PY
 
 # hook_block_with_emit <agentId> <hookName> <toolName> <reason>
 #                      <userMessage> [durationMs]
-# Convenience wrapper for pre-tool-use.sh: emits the propagation record,
-# echoes the user-facing block message to stderr, and exits 2.
+# Convenience wrapper for any PreToolUse hook that records a block decision:
+# emits the propagation record, echoes the user-facing block message to stderr,
+# and exits 2.
 hook_block_with_emit() {
   local agentId="$1" hookName="$2" toolName="$3" reason="$4"
   local userMessage="$5" durationMs="${6:-0}"

package/payload/platform/plugins/admin/hooks/post-tool-use-agent.sh

@@ -28,6 +28,8 @@ set -uo pipefail
 : "${MAXY_HOOK_SERVER_LOG:=$HOME/.maxy-code/logs/server.log}"
 : "${MAXY_HOOK_LOCK_ATTEMPTS:=100}"
 : "${MAXY_HOOK_LOCK_SLEEP:=0.01}"
+# Task 569 — TTL for orphaned lockdirs (see hook-emit.sh for rationale).
+: "${MAXY_HOOK_LOCK_TTL_SECONDS:=5}"
 
 if [ -t 0 ]; then
   # No stdin — no correlation possible. Fail-open.
@@ -65,9 +67,26 @@ NOW_EPOCH=$(date +%s)
 N_OBSERVED=0
 N_EMITTED=0
 
+# Task 569 — same stale-lockdir TTL reclamation as hook-emit.sh.
+_drain_lockdir_age_seconds() {
+  local lockdir="$1" mtime now
+  mtime=$(stat -c %Y "$lockdir" 2>/dev/null || stat -f %m "$lockdir" 2>/dev/null)
+  [[ -z "$mtime" ]] && { echo -1; return; }
+  now=$(date +%s)
+  echo $((now - mtime))
+}
+
 _drain_acquire_lock() {
-  local lockdir="$1" i=0
+  local lockdir="$1" i=0 age
   while ! mkdir "$lockdir" 2>/dev/null; do
+    age=$(_drain_lockdir_age_seconds "$lockdir")
+    if [[ "$age" -ge "$MAXY_HOOK_LOCK_TTL_SECONDS" ]]; then
+      rmdir "$lockdir" 2>/dev/null || rm -rf "$lockdir" 2>/dev/null
+      mkdir -p "$(dirname "$MAXY_HOOK_SERVER_LOG")" 2>/dev/null
+      printf '[hook-propagate-error] reason=stale-lock-reclaimed lockdir=%s ageSeconds=%s\n' \
+        "$lockdir" "$age" >>"$MAXY_HOOK_SERVER_LOG" 2>/dev/null || true
+      mkdir "$lockdir" 2>/dev/null && return 0
+    fi
     i=$((i+1))
     [[ "$i" -ge "$MAXY_HOOK_LOCK_ATTEMPTS" ]] && return 1
     sleep "$MAXY_HOOK_LOCK_SLEEP" 2>/dev/null || true

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -755,8 +755,8 @@ eagerTool(server, "account-update", "Update a user-configurable setting in accou
     }
 });
 // Plugin enable/disable: deterministic write to account.json.enabledPlugins.
-// The pre-tool-use hook denies the agent's direct Edit on account.json,
-// so the agent can no longer toggle enablement by hand-editing the file. This
+// IDENTITY.md doctrine forbids the agent's direct Edit on account.json,
+// so the agent must not toggle enablement by hand-editing the file. This
 // tool is the legitimate path: validates the plugin name, refuses core plugins,
 // confirms the plugin directory exists, and atomically updates the array.
 // Entitlement-bearing fields (tier, purchasedPlugins) are NOT writable here.