@rubytech/create-maxy-code 0.1.493 → 0.1.495

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.493",
+  "version": "0.1.495",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/docs/superpowers/plans/2026-07-23-task-1930-adherence-enforcement.md

@@ -0,0 +1,422 @@
+# Task 1930 — Schema-and-preference adherence enforcement — Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Hard-block customer-facing document deliverables that go out without the account's layer-2 preferences being consulted that turn, and make placement drift (`output/` scratch domination) a visible signal.
+
+**Architecture:** Two new admin hooks (a PreToolUse gate on document-deliverable sends, a UserPromptSubmit reminder), plus spec edits to `SCHEMA.md` and the `data-manager` reconcile brief, plus registration in the account-provisioning settings writer. The periodic scheduling of the reconcile audit is deferred to a filed Task 1931.
+
+**Tech Stack:** Bash + python3 hooks (Claude Code hook protocol), markdown specs. No TypeScript, no npm build.
+
+## Global Constraints
+
+- All work under `maxy-code/` (this is a `getmaxy` worktree; the subtree root is `maxy-code/`). Run commands from `maxy-code/`.
+- Hook contract: exit 0 allow, exit 2 block (PreToolUse) / exit 0 always (UserPromptSubmit). Fail OPEN on tty, empty stdin, missing `python3`, or missing/unreadable transcript. A broken hook that blocks everything is worse than the miss.
+- No task numbers or internal refs in any operator-visible (stderr block / injected) string.
+- British English, plain hyphens, no em-dashes in any shipped markdown or block message.
+- New hook tests join the existing tree suite at `platform/plugins/admin/hooks/__tests__/` (they are committed, not ephemeral — the project's hook tests live there).
+- Every commit carries `Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>` and a `Session:` trailer.
+
+---
+
+### Task 1: Preference-consult gate hook
+
+**Files:**
+- Create: `platform/plugins/admin/hooks/preference-consult-gate.sh`
+- Test: `platform/plugins/admin/hooks/__tests__/preference-consult-gate.test.sh`
+
+**Interfaces:**
+- Consumes: the Claude Code PreToolUse JSON envelope on stdin (`{tool_name, tool_input, transcript_path, ...}`).
+- Produces: exit 0 (allow) / exit 2 (block). Stderr `[preference-gate] op=allow|bypass tool=<name>`.
+
+- [ ] **Step 1: Write the failing test**
+
+```bash
+# platform/plugins/admin/hooks/__tests__/preference-consult-gate.test.sh
+#!/usr/bin/env bash
+set -uo pipefail
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+HOOK="$DIR/../preference-consult-gate.sh"
+PASS=0; FAIL=0; FAILED=()
+run() { printf '%s' "$1" | bash "$HOOK" >/dev/null 2>&1; echo $?; }
+assert_exit() { local got; got=$(run "$2"); if [ "$got" = "$1" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$3: want exit $1 got $got"); fi; }
+
+TMP="$(mktemp -d)"
+# Transcript WITH a profile-read after the last user message.
+CONSULTED="$TMP/consulted.jsonl"
+{
+  printf '%s\n' '{"type":"user","message":{"role":"user","content":"make the quote"}}'
+  printf '%s\n' '{"type":"assistant","message":{"role":"assistant","content":[{"type":"tool_use","name":"mcp__plugin_memory_memory__profile-read","input":{}}]}}'
+} > "$CONSULTED"
+# Transcript with NO profile-read this turn (one appears BEFORE the last user msg only).
+UNCONSULTED="$TMP/unconsulted.jsonl"
+{
+  printf '%s\n' '{"type":"assistant","message":{"role":"assistant","content":[{"type":"tool_use","name":"mcp__plugin_memory_memory__profile-read","input":{}}]}}'
+  printf '%s\n' '{"type":"user","message":{"role":"user","content":"send it"}}'
+  printf '%s\n' '{"type":"assistant","message":{"role":"assistant","content":[{"type":"text","text":"ok"}]}}'
+} > "$UNCONSULTED"
+
+pdf_env() { printf '{"tool_name":"mcp__plugin_browser_browser__browser-pdf-save","tool_input":{"path":"memory/users/+447700900000/documents/quote.pdf"},"transcript_path":"%s"}' "$1"; }
+email_att_env() { printf '{"tool_name":"mcp__plugin_email_email__email-send","tool_input":{"attachments":["memory/users/+44/documents/x.pdf"]},"transcript_path":"%s"}' "$1"; }
+
+# Gated tool + consulted → allow.
+assert_exit 0 "$(pdf_env "$CONSULTED")" "pdf consulted allows"
+# Gated tool + not consulted → block.
+assert_exit 2 "$(pdf_env "$UNCONSULTED")" "pdf unconsulted blocks"
+# Email with attachment + not consulted → block.
+assert_exit 2 "$(email_att_env "$UNCONSULTED")" "email+attach unconsulted blocks"
+# Email with NO attachment → not a document deliverable → allow.
+assert_exit 0 "$(printf '{"tool_name":"mcp__plugin_email_email__email-send","tool_input":{},"transcript_path":"%s"}' "$UNCONSULTED")" "email no-attach allows"
+# browser-pdf-save OUTSIDE customer documents scope → allow.
+assert_exit 0 "$(printf '{"tool_name":"mcp__plugin_browser_browser__browser-pdf-save","tool_input":{"path":"output/report.pdf"},"transcript_path":"%s"}' "$UNCONSULTED")" "pdf outside scope allows"
+# Non-send tool → allow.
+assert_exit 0 "$(printf '{"tool_name":"Read","tool_input":{"file_path":"x"},"transcript_path":"%s"}' "$UNCONSULTED")" "read allows"
+# Empty stdin → fail open (allow).
+assert_exit 0 "" "empty stdin fails open"
+
+echo "----- $PASS passed, $FAIL failed -----"
+for f in "${FAILED[@]:-}"; do [ -n "$f" ] && echo "  $f"; done
+[ "$FAIL" -eq 0 ]
+```
+
+- [ ] **Step 2: Run it, verify it fails** — `bash platform/plugins/admin/hooks/__tests__/preference-consult-gate.test.sh` — Expected: FAIL (hook does not exist).
+
+- [ ] **Step 3: Write the hook**
+
+```bash
+#!/usr/bin/env bash
+# preference-consult-gate — PreToolUse gate on customer-facing document deliverables.
+#
+# A customer document (a PDF/file to the customer documents scope, or an email/
+# Outlook send carrying an attachment) must not go out until the account's saved
+# layer-2 preferences were consulted this turn, proven by a profile-read tool
+# call after the last user message in the session transcript. Layer-2 records
+# hold the signature policy, header, naming and styling rules the fixed layer-1
+# block does not; a send with no profile-read this turn is the miss that dropped
+# a customer signature.
+#
+# Scope (document-deliverable shape only; every other tool/shape exits 0):
+#   *browser-pdf-save  path under memory/users/<phone>/documents/
+#   SendUserFile       path under memory/users/<phone>/documents/ or .pdf/.html/.docx
+#   *email-send|reply|draft-send / *outlook-mail-send|reply|draft-send  non-empty attachments
+#
+# Exit: 0 allow, 2 block. Fail OPEN on tty/empty stdin/no python3/transcript
+# unreadable. Block log: [preference-gate] op=bypass tool=<name> detail=no profile-read this turn
+set -uo pipefail
+
+if [ -t 0 ]; then exit 0; fi
+INPUT=$(cat)
+[ -z "$INPUT" ] && exit 0
+command -v python3 >/dev/null 2>&1 || exit 0
+
+DECISION=$(INPUT="$INPUT" python3 - <<'PY' 2>/dev/null || true
+import os, json, re, sys
+try:
+    d = json.loads(os.environ["INPUT"])
+except Exception:
+    sys.exit(0)
+tool = d.get("tool_name", "") or ""
+ti = d.get("tool_input", {}) or {}
+
+def under_customer_docs(p):
+    return bool(re.search(r'(^|/)memory/users/[^/]+/documents/', os.path.normpath(p or "")))
+
+gated = False
+if tool.endswith("browser-pdf-save"):
+    gated = under_customer_docs(ti.get("path", ""))
+elif tool == "SendUserFile" or tool.endswith("__SendUserFile"):
+    p = ti.get("path", "") or ti.get("file_path", "")
+    gated = under_customer_docs(p) or p.lower().endswith((".pdf", ".html", ".docx"))
+elif re.search(r'(email-send|email-reply|email-draft-send|outlook-mail-send|outlook-mail-reply|outlook-draft-send)$', tool):
+    atts = ti.get("attachments")
+    gated = isinstance(atts, list) and len(atts) > 0
+
+if not gated:
+    print("")  # not a document deliverable
+    sys.exit(0)
+
+transcript = d.get("transcript_path", "") or ""
+if not transcript or not os.access(transcript, os.R_OK):
+    print("")  # cannot inspect consultation → fail open
+    sys.exit(0)
+
+try:
+    with open(transcript) as f:
+        lines = f.readlines()
+except Exception:
+    print("")
+    sys.exit(0)
+
+last_user = -1
+for i, ln in enumerate(lines):
+    try:
+        e = json.loads(ln)
+    except Exception:
+        continue
+    msg = e.get("message", e)
+    role = e.get("role") or (msg.get("role") if isinstance(msg, dict) else None)
+    if role == "user" or e.get("type") == "user":
+        last_user = i
+
+consulted = False
+for ln in (lines[last_user + 1:] if last_user >= 0 else lines):
+    try:
+        e = json.loads(ln)
+    except Exception:
+        continue
+    msg = e.get("message", e)
+    content = msg.get("content") if isinstance(msg, dict) else None
+    if isinstance(content, list):
+        for block in content:
+            if isinstance(block, dict) and block.get("type") == "tool_use" and (block.get("name", "") or "").endswith("profile-read"):
+                consulted = True
+
+print("%s|%s" % (tool, "yes" if consulted else "no"))
+PY
+)
+
+[ -z "$DECISION" ] && exit 0
+TOOL="${DECISION%%|*}"
+CONSULTED="${DECISION##*|}"
+
+if [ "$CONSULTED" = "yes" ]; then
+  echo "[preference-gate] op=allow tool=$TOOL consulted=true" >&2
+  exit 0
+fi
+
+echo "[preference-gate] op=bypass tool=$TOOL detail=no profile-read this turn" >&2
+echo "Blocked: this customer document is about to go out without the account's saved preferences being checked this turn. Those records hold the signature, header, naming and styling rules. Run profile-read for this account, apply anything relevant, then send again." >&2
+exit 2
+```
+
+- [ ] **Step 4: Make it executable and run the test** — `chmod +x platform/plugins/admin/hooks/preference-consult-gate.sh && bash platform/plugins/admin/hooks/__tests__/preference-consult-gate.test.sh` — Expected: `7 passed, 0 failed`.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add platform/plugins/admin/hooks/preference-consult-gate.sh platform/plugins/admin/hooks/__tests__/preference-consult-gate.test.sh
+git commit -m "feat: preference-consult gate blocks customer documents sent without a profile-read this turn"
+```
+
+---
+
+### Task 2: Preference-consult wrapper injector
+
+**Files:**
+- Create: `platform/plugins/admin/hooks/preference-consult-directive.sh`
+- Test: `platform/plugins/admin/hooks/__tests__/preference-consult-directive.test.sh`
+
+**Interfaces:**
+- Consumes: UserPromptSubmit envelope on stdin (ignored; block is prompt-independent).
+- Produces: stdout JSON `{"hookSpecificOutput":{"hookEventName":"UserPromptSubmit","additionalContext":"<preference-adherence>...</preference-adherence>"}}`; always exit 0.
+
+- [ ] **Step 1: Write the failing test**
+
+```bash
+#!/usr/bin/env bash
+set -uo pipefail
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+HOOK="$DIR/../preference-consult-directive.sh"
+PASS=0; FAIL=0; FAILED=()
+OUT=$(printf '{"session_id":"x","prompt":"hi"}' | bash "$HOOK" 2>/dev/null); RC=$?
+check() { if eval "$1"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$2"); fi; }
+check '[ "$RC" = "0" ]' "exit 0"
+check 'printf "%s" "$OUT" | grep -q "hookSpecificOutput"' "emits envelope"
+check 'printf "%s" "$OUT" | grep -q "profile-read"' "names profile-read"
+check 'printf "%s" "$OUT" | grep -q "output/"' "names output scratch rule"
+check 'printf "%s" "$OUT" | grep -qv "—"' "no em-dash"
+echo "----- $PASS passed, $FAIL failed -----"
+for f in "${FAILED[@]:-}"; do [ -n "$f" ] && echo "  $f"; done
+[ "$FAIL" -eq 0 ]
+```
+
+- [ ] **Step 2: Run it, verify it fails** — Expected: FAIL (hook absent).
+
+- [ ] **Step 3: Write the hook**
+
+```bash
+#!/usr/bin/env bash
+# preference-consult-directive — UserPromptSubmit hook. Injects a standing line
+# naming the two-layer preference architecture and two adherence directives:
+# consult layer-2 preferences (profile-read) before any customer document, and
+# promote finished deliverables out of output/. Prompt-independent; fail-open.
+set -uo pipefail
+HOOK_INPUT=$(cat 2>/dev/null || true)
+command -v python3 >/dev/null 2>&1 || exit 0
+python3 - <<'PY' 2>/dev/null || exit 0
+import json
+ctx = (
+"<preference-adherence>\n"
+"Your preferences live in two layers. Layer 1 is the fixed block already in front of you every turn. "
+"Layer 2 is the account's own saved records, read with profile-read; it holds the signature policy, header, "
+"naming conventions and styling that layer 1 does not, and it grows over time. Before any customer-facing "
+"document deliverable (a PDF or file sent to the customer, or an email or Outlook message carrying an "
+"attachment), read the relevant layer-2 preferences with profile-read and apply them. "
+"Store finished deliverables under documents/ or the project folder. output/ is scratch of last resort, "
+"rebuilt on the next tool write, and never the home a graph reference points at.\n"
+"</preference-adherence>"
+)
+print(json.dumps({"hookSpecificOutput": {"hookEventName": "UserPromptSubmit", "additionalContext": ctx}}))
+PY
+echo "[pref-wrapper] op=inject" >&2
+exit 0
+```
+
+- [ ] **Step 4: Run the test** — `bash platform/plugins/admin/hooks/__tests__/preference-consult-directive.test.sh` — Expected: `5 passed, 0 failed`.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add platform/plugins/admin/hooks/preference-consult-directive.sh platform/plugins/admin/hooks/__tests__/preference-consult-directive.test.sh
+git commit -m "feat: preference-consult UserPromptSubmit directive names the two-layer architecture and output-scratch rule"
+```
+
+---
+
+### Task 3: Register both hooks in account provisioning
+
+**Files:**
+- Modify: `platform/scripts/lib/provision-account-dir.sh` (the `SETTINGS_EOF` hooks block, around lines 63-178)
+
+**Interfaces:**
+- Consumes: the hook scripts from Tasks 1-2 at `$HOOKS_PATH`.
+- Produces: a `.claude/settings.json` with PreToolUse matchers for the document-send tools routed to `preference-consult-gate.sh`, and `preference-consult-directive.sh` in the UserPromptSubmit list.
+
+- [ ] **Step 1: Write the failing test** (asserts the rendered settings block references both hooks)
+
+```bash
+#!/usr/bin/env bash
+set -uo pipefail
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+LIB="$DIR/../lib/provision-account-dir.sh"
+PASS=0; FAIL=0; FAILED=()
+c(){ if grep -qF "$1" "$LIB"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$2"); fi; }
+c 'preference-consult-gate.sh' "gate registered"
+c 'preference-consult-directive.sh' "directive registered"
+c 'mcp__plugin_email_email__email-send' "email matcher present"
+c 'mcp__plugin_outlook_outlook__outlook-mail-send' "outlook matcher present"
+echo "----- $PASS passed, $FAIL failed -----"
+for f in "${FAILED[@]:-}"; do [ -n "$f" ] && echo "  $f"; done
+[ "$FAIL" -eq 0 ]
+```
+
+Save as `platform/scripts/__tests__/preference-hooks-registered.test.sh`.
+
+- [ ] **Step 2: Run it, verify it fails** — Expected: FAIL (strings absent).
+
+- [ ] **Step 3: Edit the settings block.** In the `"PreToolUse"` array, after the `browser-pdf-save` → `quote-render-gate.sh` entry, add matcher entries (one per document-send tool) routed to `preference-consult-gate.sh`, plus a second `browser-pdf-save` hook entry so both gates run on it. Exact JSON to insert inside `"PreToolUse": [ ... ]`:
+
+```json
+      {
+        "matcher": "mcp__plugin_browser_browser__browser-pdf-save",
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/preference-consult-gate.sh" }
+        ]
+      },
+      {
+        "matcher": "mcp__plugin_email_email__email-send|mcp__plugin_email_email__email-reply|mcp__plugin_email_email__email-draft-send|mcp__plugin_outlook_outlook__outlook-mail-send|mcp__plugin_outlook_outlook__outlook-mail-reply|mcp__plugin_outlook_outlook__outlook-draft-send|SendUserFile",
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/preference-consult-gate.sh" }
+        ]
+      }
+```
+
+In the `"UserPromptSubmit"` array's single `hooks` list, append after `datetime-inject.sh`:
+
+```json
+          ,{ "type": "command", "command": "bash $HOOKS_PATH/preference-consult-directive.sh" }
+```
+
+- [ ] **Step 4: Run the test + JSON validity check.**
+
+Run: `bash platform/scripts/__tests__/preference-hooks-registered.test.sh` — Expected: `4 passed, 0 failed`.
+Then confirm the emitted settings JSON parses. Extract the heredoc body with the placeholders stubbed and pipe through `python3 -m json.tool`:
+
+```bash
+HOOKS_PATH=/x PLATFORM_ROOT=/x ACCOUNT_DIR=/x \
+python3 - <<'PY'
+import re, os, json
+s = open("platform/scripts/lib/provision-account-dir.sh").read()
+body = s.split("SETTINGS_EOF", 2)[1] if "SETTINGS_EOF" in s else ""
+body = re.sub(r'\$\{?[A-Z_]+\}?', '/x', body)
+json.loads(body); print("settings JSON valid")
+PY
+```
+Expected: `settings JSON valid`.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add platform/scripts/lib/provision-account-dir.sh platform/scripts/__tests__/preference-hooks-registered.test.sh
+git commit -m "feat: register preference-consult gate and directive in account provisioning settings"
+```
+
+---
+
+### Task 4: Spec edits — SCHEMA.md and data-manager reconcile brief
+
+**Files:**
+- Modify: `platform/templates/account-schema/SCHEMA.md` (tool-owned section, lines 29-42)
+- Modify: `platform/templates/specialists/agents/data-manager.md` (reconcile audit brief + output contract)
+
+**Interfaces:** documentation only; consumed by the agent and the `data-manager` specialist at runtime.
+
+- [ ] **Step 1: Edit `SCHEMA.md`.** In the tool-owned paragraph, after the sentence listing `output/` as recreated on the next write, add:
+
+> Finished deliverables must be promoted out of `output/` into `documents/` or `projects/<name>/` through the `data-manager` specialist; `output/` is scratch of last resort, and a graph reference must never point into it (the next tool write rebuilds the tree and the reference dangles).
+
+- [ ] **Step 2: Edit `data-manager.md`.** In "The reconcile audit brief" paragraph, extend the counted set: after "(b) graph file-references that do not resolve to a real path", add "(c) graph file-references that resolve into a tool-owned scratch dir (`output/`, `generated/`, `extracted/`, `url-get/`), which the next tool write rebuilds so the reference is fragile by construction, and (d) deliverables a node references that resolve only under a scratch dir and were never promoted to `documents/` or `projects/`." In the "Output contract" paragraph, change the reconcile line to: `unreachable=N broken-refs=M scratch-refs=P stranded=Q`.
+
+- [ ] **Step 3: Verify the edits landed**
+
+```bash
+grep -q "scratch of last resort" platform/templates/account-schema/SCHEMA.md && \
+grep -q "scratch-refs=P stranded=Q" platform/templates/specialists/agents/data-manager.md && echo "spec edits present"
+```
+Expected: `spec edits present`.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add platform/templates/account-schema/SCHEMA.md platform/templates/specialists/agents/data-manager.md
+git commit -m "docs: SCHEMA promote-out-of-output rule and data-manager reconcile counts scratch-refs and stranded deliverables"
+```
+
+---
+
+### Task 5: Plugin and reference docs + file deferred Task 1931
+
+**Files:**
+- Modify: `platform/plugins/admin/PLUGIN.md` (hooks section — add both hooks)
+- Modify: `.docs/` (the relevant enforcement/hooks doc) and `platform/plugins/docs/references/` (the shipped guide) as the sprint doc-gate requires
+- Create: `.tasks/backlog/1931-make-reconcile-audit-run-on-a-standing-periodic-cadence.md`
+- Modify: `.tasks/LANES.md` (Ready row for 1931)
+
+- [ ] **Step 1: PLUGIN.md.** In the hooks list (near the `quote-render-gate` entry ~line 190), add an entry for `preference-consult-gate.sh` (PreToolUse matcher set = the document-send tools; block condition = document deliverable with no `profile-read` after the last user message; block message and `[preference-gate] op=bypass` log line; fail-open cases) and for `preference-consult-directive.sh` (UserPromptSubmit; injects the two-layer directive; `[pref-wrapper] op=inject`).
+
+- [ ] **Step 2: `.docs/` + references.** Add the two hooks to whichever `.docs/` file documents the admin hook surface and to the shipped `platform/plugins/docs/references/` guide that lists enforcement behaviour. Locate them by grep: `grep -rl "fs-schema-guard\|quote-render-gate" .docs platform/plugins/docs/references`.
+
+- [ ] **Step 3: File Task 1931.** Create `.tasks/backlog/1931-make-reconcile-audit-run-on-a-standing-periodic-cadence.md`: problem (the extended reconcile counts scratch-refs and stranded deliverables but only runs on ad-hoc `data-manager` dispatch, so the no-event placement drift is not caught on a standing basis); success (the audit runs on a periodic cadence per account and emits `[reconcile] op=run unreachable=… broken-refs=… scratch-refs=… stranded=…`, with absence-of-run itself a detectable failure); scope in (a scheduler mechanism for the read-only audit, deterministic where possible); scope out (the counts themselves — landed in 1930; auto-promotion). Add its Ready row to `.tasks/LANES.md`.
+
+- [ ] **Step 4: Verify** — `test -f .tasks/backlog/1931-make-reconcile-audit-run-on-a-standing-periodic-cadence.md && grep -q "1931" .tasks/LANES.md && grep -q "preference-consult-gate" platform/plugins/admin/PLUGIN.md && echo "docs + task filed"` — Expected: `docs + task filed`.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add platform/plugins/admin/PLUGIN.md .docs platform/plugins/docs/references .tasks/backlog/1931-make-reconcile-audit-run-on-a-standing-periodic-cadence.md .tasks/LANES.md
+git commit -m "docs: document preference-consult hooks; file Task 1931 for standing reconcile cadence"
+```
+
+---
+
+## Verification (Phase 4)
+
+- All hook tests pass: `for t in platform/plugins/admin/hooks/__tests__/*.test.sh platform/scripts/__tests__/preference-hooks-registered.test.sh; do bash "$t" | tail -1; done`. The 22 `fs-schema-guard` tests and `quote-render-gate` tests stay green.
+- Settings JSON parses (Task 3 Step 4).
+- **Pi signal verification (mandatory — this sprint touches hook input handling).** After deploy, trigger a customer-document send in admin chat without a `profile-read` that turn and confirm the block; read the transcript JSONL structure on the Pi and confirm the `role:user` boundary and `tool_use` `name` fields match what the test pipes. If the live envelope's `tool_input` field names diverge (e.g. `attachments` vs another key, or the transcript entry shape), fix the hook and the test before proceeding.
+
+## Self-Review
+
+- **Spec coverage:** gate (Task 1), wrapper (Task 2), registration (Task 3), SCHEMA + data-manager (Task 4), PLUGIN/docs + deferred 1931 (Task 5). All five spec units mapped.
+- **Placeholder scan:** none; every hook and test carries full code.
+- **Type consistency:** the gate emits `op=allow`/`op=bypass` and the wrapper `op=inject` consistently across plan, spec, and PLUGIN entry. The reconcile contract `unreachable=N broken-refs=M scratch-refs=P stranded=Q` is identical in Task 4 and the spec.

package/payload/platform/docs/superpowers/specs/2026-07-23-task-1930-adherence-enforcement-design.md

@@ -0,0 +1,81 @@
+# Task 1930 — Schema-and-preference adherence enforcement (design)
+
+Date: 2026-07-23
+Task: `.tasks/backlog/1930-enforce-schema-and-preference-adherence-scratch-deliverables-and-unconsulted-sends.md`
+
+## Problem
+
+Two adherence failures share one root: a rule the agent follows by judgement, with no gate forcing it.
+
+- **Preferences.** Layer-2 `Preference` nodes (`platform/plugins/memory/mcp/src/tools/profile-read.ts`) are consulted by per-turn judgement. A customer signature preference was missed on a delivered document because nothing forced a `profile-read` before the send.
+- **Placement.** `output/` is tool-owned scratch rebuilt each write (`platform/templates/account-schema/SCHEMA.md:29-42`); finished deliverables strand there and graph refs point at those scratch paths. The `data-manager` reconcile audit skips tool-owned dirs, so both are invisible to it.
+
+## Decisions (operator-confirmed)
+
+1. The preference gate fires only on **customer-facing document deliverables**, not every send. Casual channel replies and plain-text emails pass.
+2. This sprint ships the gate, the wrapper reminder, and the spec changes. The **periodic scheduling** of the reconcile audit is deferred to Task 1931.
+3. The gate hard-blocks (exit 2), matching the user's instruction.
+
+## Architecture
+
+Five units, each single-purpose and independently testable.
+
+### 1. `platform/plugins/admin/hooks/preference-consult-gate.sh` (new, PreToolUse)
+
+Contract mirrors `quote-render-gate.sh`: read the JSON envelope on stdin, exit 0 allow / exit 2 block, fail-open on any uninspectable call (tty, empty stdin, missing `python3`, missing/unreadable transcript).
+
+**Fires only on a customer-facing document deliverable**, decided from `tool_name` + `tool_input`:
+- `mcp__plugin_browser_browser__browser-pdf-save` whose output path is under `memory/users/<phone>/documents/`.
+- `SendUserFile` whose file path is under `memory/users/<phone>/documents/` or carries a document extension (`.pdf`, `.html`, `.docx`).
+- `mcp__plugin_email_email__email-send` / `email-reply` / `email-draft-send` with a non-empty `attachments`.
+- `mcp__plugin_outlook_outlook__outlook-mail-send` / `outlook-mail-reply` / `outlook-draft-send` with a non-empty `attachments`.
+
+Any tool or shape not matching the above exits 0 (not a document deliverable).
+
+**Consultation check.** Read the transcript at `transcript_path`. Scan the messages from the last `role:user` entry to the end for an assistant `tool_use` whose name ends in `profile-read`. Found → exit 0. Absent → exit 2.
+
+**Block message** (operator-visible, no task numbers): names that a customer document is about to go out without the account's saved preferences being checked this turn, and directs the agent to run `profile-read` for this account and retry the send. A false block (preferences read in an earlier turn) is a one-step recovery, not a dead end.
+
+**Log line** (stderr): `[preference-gate] op=bypass tool=<name> detail=no profile-read this turn` on a block; `op=allow tool=<name> consulted=true` on the allow path for a document deliverable. `browser-pdf-save` already carries `quote-render-gate` on the same matcher; both hooks run and are independent (one on receipt, one on consultation).
+
+### 2. `platform/plugins/admin/hooks/preference-consult-directive.sh` (new, UserPromptSubmit)
+
+Mirrors `datetime-inject.sh`: drain stdin first, fail-open exit 0 on every path, emit `hookSpecificOutput.additionalContext` via python3. The block is standing and prompt-independent. Content: the two-layer preference architecture (layer 1 fixed/injected, layer 2 the account's `Preference` records read via `profile-read`), and two directives: consult the relevant layer-2 preferences before any customer-facing document deliverable, and promote finished deliverables out of `output/` into `documents/` or `projects/`. Breadcrumb line: `[pref-wrapper] op=inject`.
+
+### 3. `platform/templates/account-schema/SCHEMA.md`
+
+In the tool-owned section (`:29-42`), add one sentence: finished deliverables must be promoted out of `output/` into `documents/` or `projects/`; `output/` is scratch of last resort, rebuilt on the next write, and a graph reference must never point into it.
+
+### 4. `platform/templates/specialists/agents/data-manager.md`
+
+Extend "The reconcile audit brief": in addition to (a) files unreachable from any node and (b) refs that resolve to no real path, count (c) graph refs resolving into a scratch dir (`output/`, `generated/`, `extracted/`, `url-get/`) and (d) deliverables referenced by a node but resolving only under scratch. Output contract becomes `unreachable=N broken-refs=M scratch-refs=P stranded=Q`. The audit stays read-only; it moves nothing.
+
+### 5. Registration + docs
+
+- `platform/scripts/lib/provision-account-dir.sh`: add PreToolUse matcher entries routing the document-send tools to `preference-consult-gate.sh`, and add `preference-consult-directive.sh` to the UserPromptSubmit hooks list.
+- `platform/plugins/admin/PLUGIN.md`: hook entries for both new hooks (matcher, block condition, block message, log line, fail-open).
+- `.docs/` and `platform/plugins/docs/references/`: the sprint-gate documentation targets.
+
+## Registration matcher note
+
+Settings matchers are per-tool. The gate registers against the browser, email, outlook, and SendUserFile matchers; the script itself does the document-deliverable discrimination, so over-matching a non-document send is safe (it exits 0). WhatsApp document delivery routes through the file path the same discrimination covers when a document goes out as a `SendUserFile`; a plain `whatsapp-reply` text is not a document deliverable and is out of scope by decision 1.
+
+## Testing (ephemeral)
+
+- **Gate.** For each document-send tool: envelope whose transcript has a `profile-read` since the last user turn → exit 0; envelope with none → exit 2 with the bypass line. A non-document send (email with no attachments, plain browser-pdf-save outside the customer documents scope) → exit 0. Empty/tty stdin → exit 0.
+- **Wrapper.** Emits `hookSpecificOutput.additionalContext` containing both directives; fails open (exit 0) when python3 is absent.
+- **Regression.** The 22 `fs-schema-guard` tests and the `quote-render-gate` tests stay green.
+
+## Observability
+
+- **Gate (per send):** `[preference-gate] op=allow|bypass tool=<name>`. Success = `op=allow consulted=true`. Failure = any `op=bypass`.
+- **Wrapper:** `[pref-wrapper] op=inject` per turn; absence across turns means the directive is not reaching the agent.
+- **Reconcile:** the extended brief emits `unreachable=N broken-refs=M scratch-refs=P stranded=Q`; a rising `scratch-refs`/`stranded` is the placement-drift signal. The standing periodic run that would make this a no-event backstop is Task 1931.
+
+## Out of scope
+
+- Hard write-block on `output/` writes (render tools legitimately use it as scratch).
+- Auto-promotion or auto-move of stranded files (stays the `data-manager` paired-move job).
+- The periodic scheduler for the reconcile audit (Task 1931).
+- Layer-1 fixed-block content, the voice file, and which preferences are stored.
+- Quote-specific conformance (1922/1928/1929).

package/payload/platform/plugins/admin/PLUGIN.md

@@ -188,6 +188,7 @@ Tools are available via the `admin` MCP server.
 ## Hooks
 
 - `hooks/quote-render-gate.sh` — **PreToolUse matcher=`mcp__plugin_browser_browser__browser-pdf-save`.** Makes the deterministic quote-render path the only route a client-facing quote PDF can reach a customer. Blocks (exit 2) a `browser-pdf-save` whose output path is a client-quote artefact (`memory/users/<phone>/documents/quote-<jobId>.pdf` or `…-breakdown.pdf`) when no render receipt exists at `quoting/jobs/<jobId>/render-receipt.json` — the receipt `quote-render` writes only after its reconcile / margin-leak / link-liveness gates all pass. A hand-authored quote (the SiteDesk 2026-07-14 bypass: `Write` HTML → `browser-pdf-save`, `quote-render` never called, an internal back-test caveat naming another client folded into the free-text region) has no receipt, so the print is refused rather than delivered. **Block message:** `Blocked: this client quote was not produced by the quote-render tool, so its fixed layout and the reconcile, margin-leak and link-liveness gates never ran. Run quote-render for this job (it files the document and its receipt), then print the client HTML path it returns to PDF.` **Log line** (stderr, on a block): `[quote-render] op=bypass jobId=<jobId> detail=client quote PDF has no render receipt` (or `reason=bad-jobid` when the filename does not resolve to a job). Every non-quote PDF — brochures, invoices, the admin-scope internal view — and the deterministic path itself (receipt present) pass at exit 0. **Fail-open** on an uninspectable call (tty / empty stdin / no `python3`): `browser-pdf-save` is a general-purpose tool and the agent never controls this hook's stdin, so failing open opens no bypass while never bricking unrelated PDFs.
+- `hooks/preference-consult-gate.sh` — **PreToolUse gate on customer-facing document deliverables.** Registered against `mcp__plugin_browser_browser__browser-pdf-save` (a second command on the same matcher as `quote-render-gate`, either exit 2 blocks) and against the email/Outlook send tools plus `SendUserFile`. It fires only in the document-deliverable shape: a `browser-pdf-save` or `SendUserFile` whose path is under `memory/users/<phone>/documents/` (or a `SendUserFile` of a `.pdf`/`.html`/`.docx`), and `email-send`/`email-reply`/`email-draft-send`/`outlook-mail-send`/`outlook-mail-reply`/`outlook-draft-send` carrying a non-empty `attachments`. For a gated call it reads the session transcript (`transcript_path`) and blocks (exit 2) when no `profile-read` tool call ran after the last user message, because the account's layer-2 `Preference` records (signature policy, header, naming, styling) were not consulted this turn, the exact miss that dropped a customer signature on a delivered document. **Block message:** `Blocked: this customer document is about to go out without the account's saved preferences being checked this turn. Those records hold the signature, header, naming and styling rules. Run profile-read for this account, apply anything relevant, then send again.` **Log line** (stderr): `[preference-gate] op=bypass tool=<name> detail=no profile-read this turn` on a block, `op=allow tool=<name> consulted=true` on an allowed document deliverable. Every non-document tool/shape, and every casual channel reply or plain-text email, passes at exit 0. **Fail-open** on an uninspectable call (tty / empty stdin / no `python3` / transcript missing or unreadable). Scope decision: the gate fires on document deliverables only, not on every send, so it never blocks routine chat. The standing reconcile counterpart for stranded `output/` deliverables is filed as a follow-up task.
 - `hooks/quote-render-pdf-conformance.sh` — **PostToolUse matcher=`mcp__plugin_browser_browser__browser-pdf-save`.** The PDF-time companion to the PreToolUse `quote-render-gate`: the HTML gates run inside `quote-render` before the receipt, but the two PDF-only conformance checks cannot, because the PDF does not exist until `browser-pdf-save` runs. For a gated client-quote PDF (`memory/users/<phone>/documents/quote-<jobId>.pdf` or `…-breakdown.pdf`) whose render receipt names the source HTML, it blocks (exit 2) when the printed PDF's `/URI` annotation count is below the source HTML's absolute-link count (a rasterised or flattened print that dropped links) or when an embedded `https://` link does not answer 200 (a Sign-Online link a pending redeploy would 404). The offline `/URI`-count check runs first and short-circuits, so a link-loss regression never depends on the network. **Block message:** `Blocked: the printed quote PDF is missing links the document declared, or an embedded link is not live (…). Do not send it. If a Sign-Online link is not live yet, deploy the signing page first; then re-render and re-print so the PDF carries every link the document declares.` **Log line** (stderr, on a block): `[quote-render] op=bypass jobId=<jobId> reason=pdf-link-conformance detail=<uri-count …|link <url> -> <code>>`. Every non-quote PDF, and any call with no receipt (the PreToolUse gate owns that block), passes at exit 0. **Fail-open** on an uninspectable call (tty / empty stdin / no `python3` / receipt or PDF absent). **Reach on upgrade:** `provision-account-dir.sh` writes this PostToolUse matcher only at account-provision time, so accounts provisioned before it landed keep a stale matcher and need a settings backfill (tracked as a follow-up task), the same reach limit the AskUserQuestion carrier gate hit.
 - `hooks/webfetch-preflight.mjs` — short-circuits WebFetch on JS-SPA shells with a structured `WEBFETCH_CANNOT_READ_JS_SPA` error so the agent surfaces a loud failure to the owner instead of paying the 60s extraction timeout. Fail-open on any internal error.
 - `hooks/askuserquestion-investigate-gate.sh` — PreToolUse matcher=`AskUserQuestion`. Blocks the question (exit 2) when no read-only investigation tool has fired since the latest real user turn in the session JSONL. The structural fix for the failure class where the agent fabricates a menu before evidence-gathering (session `c085ec2c-46fb-4b73-8865-68cf85866ea8` 2026-05-22 — "change remote access password" → invented options "Admin PIN / Cloudflare tunnel / WiFi password" with zero prior tool_use; post-correction the agent immediately fired `remote-auth-status` → `ToolSearch` → `remote-auth-set-password`, proving it knew the moves). **Allowlist** (exact, with trailing `__<tool>` suffix-match for namespaced `mcp__plugin_<plugin>_<server>__<tool>` aliases): `ToolSearch`, `Grep`, `Glob`, `Read`, `LS`, `NotebookRead`, `Bash`, `WebFetch`, `WebSearch`, plus the read-only admin / memory MCP tools (`*-status`, `*-list`, `*-read`, `skill-find`, `memory-find-candidates`, `profile-read`, `conversation-list`, `memory-list-attachments`, `memory-read-attachment`). **Block message:** `Blocked: AskUserQuestion requires at least one investigation tool (ToolSearch, Grep, Read, *-list, *-status, *-read, skill-find, ...) earlier in this turn. Search the operator's literal phrase first.` **Log line** (stderr, one per call): `[ask-gate] decision=<allow|block> sessionId=<id8> seen=<csv|-> reason=<allowlist-hit|no-investigation|fail-open-no-transcript|fail-open-parse-error>`. **Fail-open** on missing transcript or parse error — nudges, never bricks the UI.
@@ -196,6 +197,7 @@ Tools are available via the `admin` MCP server.
 - `hooks/post-tool-use-agent.sh` — **PostToolUse hook on `Agent`.** Drains any subagent hook-decision buffers under `~/.maxy-code/logs/hook-decisions/` modified since this parent's previous PostToolUse-Agent fire (cursor file keyed by parent session id), prints one `[hook-propagate]` line per record to stdout — Claude Code attaches the stdout as a `hook_success` attachment on the parent JSONL, making the records grep-queryable from the parent session alone. Rotates consumed buffers to `consumed/`. Emits one `[hook-propagate-census] parentSession=<…> subagentHooksObserved=<N> attachmentsEmitted=<M>` line per fire to stdout and server.log; `N != M` is the propagation regression signal. The companion emitter library `hooks/lib/hook-emit.sh` is sourced by `post-tool-use-agent.sh` and any other hook that records a block decision (4 KB stderr truncation, `truncated=true` set on the record).
 - `hooks/admin-authoring-observer.sh` — **PostToolUse hook on Write and Edit.** Observation only — never blocks; exits 0 on every path. Fires when the admin agent (not a specialist subagent — gated by `MAXY_SPECIALIST` env) writes or edits a file under `<accountDir>/output/`. Walks the session transcript from the latest real-user turn forward to detect any prior `Task` `tool_use` whose `subagent_type` starts with `specialists:`. Emits one stderr line `[admin-authoring] inline-write path=<rel> priorSpecialistSpawnInTurn=<true|false|unknown>`. A `false` value on a long-form prose file is the regression signal this hook was designed to make visible — the BioSymm proposal session (admin authored a customer-facing proposal inline despite content-producer being installed) is the failure mode this surfaces mechanically. Mechanical enforcement (refuse the write, force a re-spawn) is deferred per the task spec.
 - `hooks/prompt-optimiser-directive.sh` — **UserPromptSubmit hook.** Injects the standing prompt-optimiser restatement directive plus the per-turn three-tier routing ladder as `additionalContext`: **(1)** delegate to the specialist that owns the deliverable via the Agent tool — the brief states the outcome plus binding constraints, never lines/anchors/literal text; **(2)** only if none fits, load an admin-usable skill with `skill-load`; **(3)** only if neither fits, author inline — freestyle is the named last resort. Re-emits the full agent roster (`agents/admin/AGENTS.md`) and the full admin-usable skills list (`agents/admin/ADMIN-SKILLS.md`) every turn by reading the two generated files from the account dir (the hook fires with the account dir as cwd); it never walks the plugins tree per turn. Fail-open is **visible**: a missing list logs `[prompt-optimiser] missing=<AGENTS.md\|ADMIN-SKILLS.md> emitting-partial` to stderr and the ladder still injects. The trivial-turn skip (one-word confirmation, slash-command, direct continuation) is unchanged. **Staleness:** `ADMIN-SKILLS.md` is regenerated only by `setup-account.sh`; a plugin add/remove since the last setup leaves the list stale — compare `ADMIN-SKILLS.md` mtime against the newest `SKILL.md` mtime and re-run setup to refresh. The list generator is `platform/scripts/lib/admin-skills-bootstrap.sh`; it logs `[admin-skills] scanned=<N> admin-usable=<M> no-declaration=<K>` (failure signature: `admin-usable=0` while `scanned>0`, or any `missing-declaration` line). The directive also carries a standing CAPABILITY-QUESTIONS-ARE-OWNED-WORK clause (how-to / "do you have instructions for X" / config questions about platform features are answered from the owning specialist or plugin tool/reference, never from training memory), and the hook appends a durable `<ts> [prompt-optimiser-directive] injected len=<n> session=<id>` breadcrumb to `$LOG_DIR/prompt-optimiser-directive.log` so per-turn injection is greppable, not stderr-only. The directive is also **suppressed on native channel turns** — when the parsed `.prompt` starts with the `<channel source=` event marker, the hook logs `[prompt-optimiser-directive] skipped reason=channel-turn session=<id>` to stderr and exits without injecting, because the channel service already reframes the inbound into a select-and-dispatch turn (`composeAdminContent`, see `.docs/whatsapp-inbound-lifeline.md`). Marker-matched at start-of-prompt only, so an admin/Terminal prompt that merely mentions "channel" still gets the directive; fail-open injects if the prompt cannot be parsed.
+- `hooks/preference-consult-directive.sh` — **UserPromptSubmit hook.** Injects a standing `<preference-adherence>` block naming the two-layer preference architecture (layer 1 the fixed block already in front of the agent every turn; layer 2 the account's own saved `Preference` records, read with `profile-read`, holding signature policy, header, naming and styling) and two directives: consult the relevant layer-2 preferences with `profile-read` before any customer-facing document deliverable, and store finished deliverables under `documents/` or the project folder because `output/` is scratch of last resort. Prompt-independent and always exit 0 (fail-open). Breadcrumb (stderr): `[pref-wrapper] op=inject`. This is the advisory companion to the `preference-consult-gate` hard gate.
 - `hooks/datetime-inject.sh` — **UserPromptSubmit hook.** Injects a fresh `<datetime>` block as `additionalContext` on every turn (`refresh=per-turn`), so the agent always has the current instant — date, time, timezone, weekday, and the raw UTC ISO — without hand-computing it and without depending on Claude Code's spawn-time "Today's date" line going stale. The instant is computed fresh each turn; the timezone is **not** computed here — it is the operator's own zone, resolved from their `UserProfile.timezone` on the graph once per admin spawn and stamped into `MAXY_ACCOUNT_TZ` (see `platform/services/claude-session-manager/src/account-timezone.ts`). When `MAXY_ACCOUNT_TZ` is empty (a non-admin turn, an unset profile timezone, or a neo4j hiccup at spawn) the block falls back to the server's own zone and labels the source, so a reader can always tell which clock the agent saw. This is the current-time surface the `datetime` skill points at. **Fail-open** on every path (missing `python3` or `node`, any formatting error → exit 0, empty stdout — the turn is never blocked). The hook appends `<ts> [datetime-inject] injected tz=<zone> source=<graph|server-fallback> refresh=per-turn session=<id>` to `$LOG_DIR/datetime-inject.log` so "did the agent have the right time this turn, and from which clock?" is answerable from logs without reproduction.
 - `hooks/prompt-optimiser-compliance.sh` — **Stop hook.** After each admin turn, reads the just-finished turn from `transcript_path` and appends `<ts> [prompt-optimiser-compliance] directive-fired no-route-taken session=<id8> prompt="<clip>"` to `$LOG_DIR/prompt-optimiser-directive.log` (and stderr) when the routing directive fired, the prompt was non-trivial (not a slash-command, not a one-word confirmation), and the turn took **no route** — no `Agent` dispatch, no `Skill` load, no `ToolSearch`, no `mcp__*` tool call. This is the standing compliance signal that surfaces the session-`da0b12d4` failure class (agent answers a capability question from memory) as a visible event instead of a silent stale answer. Directive-fired is detected by the marker `PROMPT-OPTIMISER DIRECTIVE` in the turn slice, so it is robust to the CC-version difference in how `UserPromptSubmit` `additionalContext` is recorded (`attachment`/`hook_success` vs `hook_additional_context`). **Known limitation:** "direct continuation of the prior turn" is not detectable from the transcript, so a continuation turn that legitimately needs no route can be flagged; treat the log as a review signal, not a gate. **Fail-open:** no python3, no `transcript_path`, or an unreadable transcript → exit 0, no output. Lives in the same log as the directive breadcrumb, so a single `grep` interleaves "fired" and "no-route" into one per-session timeline; cross-check via `platform/scripts/logs-read.sh <sessionKey>`. This is a lightweight transcript read, not a per-turn spawn (contrast the turn recorder below).
 - **Turn recorder — removed entirely.** The `turn-completed-graph-write.sh` Stop hook, the `/api/admin/claude-sessions` loopback bypass it relied on, the `[turn-recorder]` emitters, the envelope walker, and the recorder-auto-archive subscriber are deleted. It had been dormant for a long time (never re-registered in settings.json); the admin now writes to the graph by delegating to `database-operator` via the Task tool inside the live session, and the on-demand `/insight` pass (`skills/insight/SKILL.md`, a registered admin skill) is the per-session review. There is no per-turn spawn.

package/payload/platform/plugins/admin/hooks/__tests__/preference-consult-directive.test.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -uo pipefail
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+HOOK="$DIR/../preference-consult-directive.sh"
+PASS=0; FAIL=0; FAILED=()
+OUT=$(printf '{"session_id":"x","prompt":"hi"}' | bash "$HOOK" 2>/dev/null); RC=$?
+check() { if eval "$1"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$2"); fi; }
+check '[ "$RC" = "0" ]' "exit 0"
+check 'printf "%s" "$OUT" | grep -q "hookSpecificOutput"' "emits envelope"
+check 'printf "%s" "$OUT" | grep -q "profile-read"' "names profile-read"
+check 'printf "%s" "$OUT" | grep -q "output/"' "names output scratch rule"
+check '! printf "%s" "$OUT" | grep -q "—"' "no em-dash"
+echo "----- $PASS passed, $FAIL failed -----"
+for f in "${FAILED[@]:-}"; do [ -n "$f" ] && echo "  $f"; done
+[ "$FAIL" -eq 0 ]

package/payload/platform/plugins/admin/hooks/__tests__/preference-consult-gate.test.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+set -uo pipefail
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+HOOK="$DIR/../preference-consult-gate.sh"
+PASS=0; FAIL=0; FAILED=()
+run() { printf '%s' "$1" | bash "$HOOK" >/dev/null 2>&1; echo $?; }
+assert_exit() { local got; got=$(run "$2"); if [ "$got" = "$1" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$3: want exit $1 got $got"); fi; }
+
+TMP="$(mktemp -d)"
+# Transcript WITH a profile-read this turn. The profile-read's RESULT is recorded
+# as a user entry whose content is only tool_result blocks (the real Claude Code
+# shape); that entry must NOT be treated as the human turn boundary, or the gate
+# false-blocks every compliant send.
+CONSULTED="$TMP/consulted.jsonl"
+{
+  printf '%s\n' '{"type":"user","message":{"role":"user","content":"make the quote"}}'
+  printf '%s\n' '{"type":"assistant","message":{"role":"assistant","content":[{"type":"tool_use","name":"mcp__plugin_memory_memory__profile-read","input":{}}]}}'
+  printf '%s\n' '{"type":"user","message":{"role":"user","content":[{"type":"tool_result","content":"prefs..."}]}}'
+  printf '%s\n' '{"type":"assistant","message":{"role":"assistant","content":[{"type":"text","text":"saving the pdf now"}]}}'
+} > "$CONSULTED"
+# Genuine human turn recorded as a content LIST (image + text), not a string, must
+# still count as the boundary.
+CONSULTED_LIST="$TMP/consulted_list.jsonl"
+{
+  printf '%s\n' '{"type":"user","message":{"role":"user","content":[{"type":"text","text":"make the quote"}]}}'
+  printf '%s\n' '{"type":"assistant","message":{"role":"assistant","content":[{"type":"tool_use","name":"mcp__plugin_memory_memory__profile-read","input":{}}]}}'
+  printf '%s\n' '{"type":"user","message":{"role":"user","content":[{"type":"tool_result","content":"prefs..."}]}}'
+} > "$CONSULTED_LIST"
+# Transcript with NO profile-read this turn (one appears BEFORE the last user msg only).
+UNCONSULTED="$TMP/unconsulted.jsonl"
+{
+  printf '%s\n' '{"type":"assistant","message":{"role":"assistant","content":[{"type":"tool_use","name":"mcp__plugin_memory_memory__profile-read","input":{}}]}}'
+  printf '%s\n' '{"type":"user","message":{"role":"user","content":"send it"}}'
+  printf '%s\n' '{"type":"assistant","message":{"role":"assistant","content":[{"type":"text","text":"ok"}]}}'
+} > "$UNCONSULTED"
+
+pdf_env() { printf '{"tool_name":"mcp__plugin_browser_browser__browser-pdf-save","tool_input":{"path":"memory/users/+447700900000/documents/quote.pdf"},"transcript_path":"%s"}' "$1"; }
+email_att_env() { printf '{"tool_name":"mcp__plugin_email_email__email-send","tool_input":{"attachments":["memory/users/+44/documents/x.pdf"]},"transcript_path":"%s"}' "$1"; }
+
+# Gated tool + consulted (with a tool_result user entry after profile-read) -> allow.
+assert_exit 0 "$(pdf_env "$CONSULTED")" "pdf consulted allows despite tool_result user entry"
+# Genuine user turn as a content list -> boundary still detected, consulted -> allow.
+assert_exit 0 "$(pdf_env "$CONSULTED_LIST")" "pdf consulted (list user turn) allows"
+# Gated tool + not consulted -> block.
+assert_exit 2 "$(pdf_env "$UNCONSULTED")" "pdf unconsulted blocks"
+# Email with attachment + not consulted -> block.
+assert_exit 2 "$(email_att_env "$UNCONSULTED")" "email+attach unconsulted blocks"
+# Email with NO attachment -> not a document deliverable -> allow.
+assert_exit 0 "$(printf '{"tool_name":"mcp__plugin_email_email__email-send","tool_input":{},"transcript_path":"%s"}' "$UNCONSULTED")" "email no-attach allows"
+# browser-pdf-save OUTSIDE customer documents scope -> allow.
+assert_exit 0 "$(printf '{"tool_name":"mcp__plugin_browser_browser__browser-pdf-save","tool_input":{"path":"output/report.pdf"},"transcript_path":"%s"}' "$UNCONSULTED")" "pdf outside scope allows"
+# Non-send tool -> allow.
+assert_exit 0 "$(printf '{"tool_name":"Read","tool_input":{"file_path":"x"},"transcript_path":"%s"}' "$UNCONSULTED")" "read allows"
+# Empty stdin -> fail open (allow).
+assert_exit 0 "" "empty stdin fails open"
+
+echo "----- $PASS passed, $FAIL failed -----"
+for f in "${FAILED[@]:-}"; do [ -n "$f" ] && echo "  $f"; done
+[ "$FAIL" -eq 0 ]

package/payload/platform/plugins/admin/hooks/preference-consult-directive.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# preference-consult-directive — UserPromptSubmit hook. Injects a standing line
+# naming the two-layer preference architecture and two adherence directives:
+# consult layer-2 preferences (profile-read) before any customer document, and
+# promote finished deliverables out of output/. Prompt-independent; fail-open.
+set -uo pipefail
+HOOK_INPUT=$(cat 2>/dev/null || true)
+command -v python3 >/dev/null 2>&1 || exit 0
+python3 - <<'PY' 2>/dev/null || exit 0
+import json
+ctx = (
+"<preference-adherence>\n"
+"Your preferences live in two layers. Layer 1 is the fixed block already in front of you every turn. "
+"Layer 2 is the account's own saved records, read with profile-read; it holds the signature policy, header, "
+"naming conventions and styling that layer 1 does not, and it grows over time. Before any customer-facing "
+"document deliverable (a PDF or file sent to the customer, or an email or Outlook message carrying an "
+"attachment), read the relevant layer-2 preferences with profile-read and apply them. "
+"Store finished deliverables under documents/ or the project folder. output/ is scratch of last resort, "
+"rebuilt on the next tool write, and never the home a graph reference points at.\n"
+"</preference-adherence>"
+)
+print(json.dumps({"hookSpecificOutput": {"hookEventName": "UserPromptSubmit", "additionalContext": ctx}}))
+PY
+echo "[pref-wrapper] op=inject" >&2
+exit 0

package/payload/platform/plugins/admin/hooks/preference-consult-gate.sh

@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+# preference-consult-gate — PreToolUse gate on customer-facing document deliverables.
+#
+# A customer document (a PDF/file to the customer documents scope, or an email/
+# Outlook send carrying an attachment) must not go out until the account's saved
+# layer-2 preferences were consulted this turn, proven by a profile-read tool
+# call after the last user message in the session transcript. Layer-2 records
+# hold the signature policy, header, naming and styling rules the fixed layer-1
+# block does not; a send with no profile-read this turn is the miss that dropped
+# a customer signature.
+#
+# Scope (document-deliverable shape only; every other tool/shape exits 0):
+#   *browser-pdf-save  path under memory/users/<phone>/documents/
+#   SendUserFile       path under memory/users/<phone>/documents/ or .pdf/.html/.docx
+#   *email-send|reply|draft-send / *outlook-mail-send|reply|draft-send  non-empty attachments
+#
+# Exit: 0 allow, 2 block. Fail OPEN on tty/empty stdin/no python3/transcript
+# unreadable. Block log: [preference-gate] op=bypass tool=<name> detail=no profile-read this turn
+set -uo pipefail
+
+if [ -t 0 ]; then exit 0; fi
+INPUT=$(cat)
+[ -z "$INPUT" ] && exit 0
+command -v python3 >/dev/null 2>&1 || exit 0
+
+DECISION=$(INPUT="$INPUT" python3 - <<'PY' 2>/dev/null || true
+import os, json, re, sys
+try:
+    d = json.loads(os.environ["INPUT"])
+except Exception:
+    sys.exit(0)
+tool = d.get("tool_name", "") or ""
+ti = d.get("tool_input", {}) or {}
+
+def under_customer_docs(p):
+    return bool(re.search(r'(^|/)memory/users/[^/]+/documents/', os.path.normpath(p or "")))
+
+gated = False
+if tool.endswith("browser-pdf-save"):
+    gated = under_customer_docs(ti.get("path", ""))
+elif tool == "SendUserFile" or tool.endswith("__SendUserFile"):
+    p = ti.get("path", "") or ti.get("file_path", "")
+    gated = under_customer_docs(p) or p.lower().endswith((".pdf", ".html", ".docx"))
+elif re.search(r'(email-send|email-reply|email-draft-send|outlook-mail-send|outlook-mail-reply|outlook-draft-send)$', tool):
+    atts = ti.get("attachments")
+    gated = isinstance(atts, list) and len(atts) > 0
+
+if not gated:
+    print("")  # not a document deliverable
+    sys.exit(0)
+
+transcript = d.get("transcript_path", "") or ""
+if not transcript or not os.access(transcript, os.R_OK):
+    print("")  # cannot inspect consultation -> fail open
+    sys.exit(0)
+
+try:
+    with open(transcript) as f:
+        lines = f.readlines()
+except Exception:
+    print("")
+    sys.exit(0)
+
+def is_genuine_user_turn(e):
+    is_user = (e.get("type") == "user") or (e.get("role") == "user") or (isinstance(e.get("message"), dict) and e["message"].get("role") == "user")
+    if not is_user:
+        return False
+    msg = e.get("message", e)
+    content = msg.get("content") if isinstance(msg, dict) else None
+    if isinstance(content, str):
+        return True
+    if isinstance(content, list):
+        # A tool_result delivery is recorded as a user entry whose content is
+        # composed only of tool_result blocks. It is not a human turn; counting
+        # it would push the boundary past the profile-read that ran this turn and
+        # false-block a compliant send. A genuine human turn carries at least one
+        # non-tool_result block (text/image).
+        return any(not (isinstance(b, dict) and b.get("type") == "tool_result") for b in content)
+    # Unknown shape: do not advance the boundary, biasing toward a wider consulted
+    # window (toward allow) — fail-open is the correct direction here.
+    return False
+
+last_user = -1
+for i, ln in enumerate(lines):
+    try:
+        e = json.loads(ln)
+    except Exception:
+        continue
+    if is_genuine_user_turn(e):
+        last_user = i
+
+consulted = False
+for ln in (lines[last_user + 1:] if last_user >= 0 else lines):
+    try:
+        e = json.loads(ln)
+    except Exception:
+        continue
+    msg = e.get("message", e)
+    content = msg.get("content") if isinstance(msg, dict) else None
+    if isinstance(content, list):
+        for block in content:
+            if isinstance(block, dict) and block.get("type") == "tool_use" and (block.get("name", "") or "").endswith("profile-read"):
+                consulted = True
+
+print("%s|%s" % (tool, "yes" if consulted else "no"))
+PY
+)
+
+[ -z "$DECISION" ] && exit 0
+TOOL="${DECISION%%|*}"
+CONSULTED="${DECISION##*|}"
+
+if [ "$CONSULTED" = "yes" ]; then
+  echo "[preference-gate] op=allow tool=$TOOL consulted=true" >&2
+  exit 0
+fi
+
+echo "[preference-gate] op=bypass tool=$TOOL detail=no profile-read this turn" >&2
+echo "Blocked: this customer document is about to go out without the account's saved preferences being checked this turn. Those records hold the signature, header, naming and styling rules. Run profile-read for this account, apply anything relevant, then send again." >&2
+exit 2

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:643a947eb8968517ad598f7f8b4e433d8545877d7c21f857d4867ac914e34cc9
+content-hash: sha256:59873e611d7a40e6aa9c3f41bc766d8a4e0632934f7542470aa309fb59dc5db7
 brand: maxy-code
 product-name: Maxy
 ---
@@ -4227,6 +4227,8 @@ Standing rules the operator gives over a channel are `Preference` nodes. Two mec
 
 **Observability.** `[preference-write] op=reconcile … mode=<reinforce|update|contradict|new> similarity=…` — a stream of `mode=new` for subjects that already exist is the duplicate-minting signature. `[preference-inject] op=inject channel=<wa|tg|web> injected=<N> owner=<8> source=<owner|no-owner|owner-error|fetch-error>` — injection selects only the account owner's admin preferences, so `source=owner injected=0` is a genuinely empty owner, `source=no-owner` is an account with no seeded owner (injects nothing, a missed owner seeding), and `injected=0 source=owner` on an account whose owner holds rules is the write-only regression re-appearing. `[preference-audit] op=drift accountId=… storedActive=… injectedActive=… duplicateClusters=…` — the standing reconciliation audit (claude-session-manager, 5-minute tick) flags any account whose store holds more active rows than injection would surface, the no-event detector for drift.
 
+**Consult-before-send gate.** Injection (above) puts the owner's active rules in front of every channel turn, but the growing layer-2 `Preference` set is read on demand with `profile-read`, a per-turn judgement the agent can skip, the miss that dropped a customer signature on a delivered document. `hooks/preference-consult-gate.sh` (admin plugin) is the deliverable-boundary enforcement: a PreToolUse gate on customer-facing document deliverables (`browser-pdf-save`/`SendUserFile` to `memory/users/<phone>/documents/`, and email/Outlook sends carrying attachments) that blocks (exit 2) when no `profile-read` ran after the last user message in the transcript. It fires on documents only, never on casual replies. **Observability:** `[preference-gate] op=allow tool=<name> consulted=true` on an allowed document deliverable, `op=bypass tool=<name> detail=no profile-read this turn` on a block; a stream of `op=bypass` is the un-consulted-send signature. The advisory companion `hooks/preference-consult-directive.sh` injects the two-layer architecture reminder every turn (`[pref-wrapper] op=inject`). The placement half, promoting finished deliverables out of `output/` scratch, is counted by the `data-manager` reconcile audit (`scratch-refs`, `stranded`); making that audit run on a standing periodic cadence is a filed follow-up.
+
 ---
 
 ## Output Formatting and Budget

package/payload/platform/plugins/docs/references/internals.md

@@ -408,6 +408,8 @@ Standing rules the operator gives over a channel are `Preference` nodes. Two mec
 
 **Observability.** `[preference-write] op=reconcile … mode=<reinforce|update|contradict|new> similarity=…` — a stream of `mode=new` for subjects that already exist is the duplicate-minting signature. `[preference-inject] op=inject channel=<wa|tg|web> injected=<N> owner=<8> source=<owner|no-owner|owner-error|fetch-error>` — injection selects only the account owner's admin preferences, so `source=owner injected=0` is a genuinely empty owner, `source=no-owner` is an account with no seeded owner (injects nothing, a missed owner seeding), and `injected=0 source=owner` on an account whose owner holds rules is the write-only regression re-appearing. `[preference-audit] op=drift accountId=… storedActive=… injectedActive=… duplicateClusters=…` — the standing reconciliation audit (claude-session-manager, 5-minute tick) flags any account whose store holds more active rows than injection would surface, the no-event detector for drift.
 
+**Consult-before-send gate.** Injection (above) puts the owner's active rules in front of every channel turn, but the growing layer-2 `Preference` set is read on demand with `profile-read`, a per-turn judgement the agent can skip, the miss that dropped a customer signature on a delivered document. `hooks/preference-consult-gate.sh` (admin plugin) is the deliverable-boundary enforcement: a PreToolUse gate on customer-facing document deliverables (`browser-pdf-save`/`SendUserFile` to `memory/users/<phone>/documents/`, and email/Outlook sends carrying attachments) that blocks (exit 2) when no `profile-read` ran after the last user message in the transcript. It fires on documents only, never on casual replies. **Observability:** `[preference-gate] op=allow tool=<name> consulted=true` on an allowed document deliverable, `op=bypass tool=<name> detail=no profile-read this turn` on a block; a stream of `op=bypass` is the un-consulted-send signature. The advisory companion `hooks/preference-consult-directive.sh` injects the two-layer architecture reminder every turn (`[pref-wrapper] op=inject`). The placement half, promoting finished deliverables out of `output/` scratch, is counted by the `data-manager` reconcile audit (`scratch-refs`, `stranded`); making that audit run on a standing periodic cadence is a filed follow-up.
+
 ---
 
 ## Output Formatting and Budget

package/payload/platform/scripts/__tests__/preference-hooks-registered.test.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+set -uo pipefail
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+LIB="$DIR/../lib/provision-account-dir.sh"
+PASS=0; FAIL=0; FAILED=()
+c(){ if grep -qF "$1" "$LIB"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$2"); fi; }
+c 'preference-consult-gate.sh' "gate registered"
+c 'preference-consult-directive.sh' "directive registered"
+c 'mcp__plugin_email_email__email-send' "email matcher present"
+c 'mcp__plugin_outlook_outlook__outlook-mail-send' "outlook matcher present"
+echo "----- $PASS passed, $FAIL failed -----"
+for f in "${FAILED[@]:-}"; do [ -n "$f" ] && echo "  $f"; done
+[ "$FAIL" -eq 0 ]

package/payload/platform/scripts/lib/__tests__/account-settings-pdf-conformance.test.sh

@@ -0,0 +1,151 @@
+#!/usr/bin/env bash
+# Regression test for account-settings-pdf-conformance.sh (Task 1929).
+#
+# The lib retrofits the quote-render PDF-conformance PostToolUse matcher onto
+# existing accounts' .claude/settings.json on every install/upgrade. Task 1922
+# added the matcher to provision-account-dir.sh, but that writer only runs at
+# account-provision time and the upgrade path re-provisions only the house
+# account -- so an account provisioned before 1922 keeps a settings.json without
+# the browser-pdf-save PostToolUse matcher and never runs the PDF gate (live
+# glsmith is such an account).
+#
+# Covers:
+#   1. Stale matcher (browser-pdf-save present, conformance cmd absent) -> updated, appended, idempotent
+#   2. Correct matcher (conformance cmd present)                        -> already-set, byte-identical
+#   3. browser-pdf-save matcher absent (broad mcp__.* present)          -> updated, matcher added, wildcard untouched
+#   4. No .hooks.PostToolUse                                            -> no-hooks, untouched
+#   5. File absent                                                      -> absent
+#   6. Malformed JSON                                                   -> rewrite-failed, untouched, no temp
+#   7. reconcile_all_accounts_pdf_conformance                          -> patches every account.json dir, skips others
+#
+# All cases assert the [backfill-1929] status token and the post-state of the file.
+
+set -u
+
+LIB="$(cd "$(dirname "$0")/.." && pwd)/account-settings-pdf-conformance.sh"
+if [ ! -f "$LIB" ]; then
+  echo "FAIL: $LIB not found" >&2
+  exit 1
+fi
+# shellcheck source=/dev/null
+. "$LIB"
+
+MATCHER='mcp__plugin_browser_browser__browser-pdf-save'
+CONFORMANCE='bash $PLATFORM_ROOT/plugins/admin/hooks/quote-render-pdf-conformance.sh'
+
+PASS=0
+FAIL=0
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+
+ok()   { PASS=$((PASS+1)); }
+bad()  { FAIL=$((FAIL+1)); echo "FAIL: $1" >&2; }
+
+# settings.json with a PostToolUse browser-pdf-save matcher carrying the given
+# command list. Args after $1 are command strings for that matcher.
+write_settings() {
+  local file="$1"; shift
+  local cmds="" c
+  for c in "$@"; do
+    [ -n "$cmds" ] && cmds="$cmds,"
+    cmds="$cmds{\"type\":\"command\",\"command\":\"$c\"}"
+  done
+  mkdir -p "$(dirname "$file")"
+  cat > "$file" <<EOF
+{
+  "permissions": { "defaultMode": "bypassPermissions", "allow": [], "deny": [] },
+  "hooks": {
+    "PostToolUse": [
+      { "matcher": "Bash", "hooks": [ { "type": "command", "command": "bash \$P/b.sh" } ] },
+      { "matcher": "$MATCHER", "hooks": [ $cmds ] },
+      { "matcher": "mcp__.*", "hooks": [ { "type": "command", "command": "bash \$P/missing.sh" } ] }
+    ]
+  }
+}
+EOF
+}
+
+conformance_count() { grep -cF 'quote-render-pdf-conformance.sh' "$1" 2>/dev/null || true; }
+pdfmatcher_present() {
+  jq -e --arg m "$MATCHER" '.hooks.PostToolUse | any(.[]; .matcher == $m)' "$1" >/dev/null 2>&1
+}
+wildcard_present() {
+  jq -e '.hooks.PostToolUse | any(.[]; .matcher == "mcp__.*")' "$1" >/dev/null 2>&1
+}
+
+# --- 1. stale matcher -> updated, then idempotent ---------------------------
+F="$TMP/stale/.claude/settings.json"
+write_settings "$F"
+OUT="$(ensure_pdf_conformance_matcher "$F")"
+case "$OUT" in *status=updated*) ok;; *) bad "1a stale should be updated, got: $OUT";; esac
+[ "$(conformance_count "$F")" -eq 1 ] && ok || bad "1b conformance not appended (count=$(conformance_count "$F"))"
+OUT2="$(ensure_pdf_conformance_matcher "$F")"
+case "$OUT2" in *status=already-set*) ok;; *) bad "1c re-run should be already-set, got: $OUT2";; esac
+[ "$(conformance_count "$F")" -eq 1 ] && ok || bad "1d conformance duplicated on re-run (count=$(conformance_count "$F"))"
+
+# --- 2. correct matcher -> already-set, byte-identical ----------------------
+F="$TMP/good/.claude/settings.json"
+write_settings "$F" "$CONFORMANCE"
+BEFORE="$(cat "$F")"
+OUT="$(ensure_pdf_conformance_matcher "$F")"
+case "$OUT" in *status=already-set*) ok;; *) bad "2a good should be already-set, got: $OUT";; esac
+[ "$BEFORE" = "$(cat "$F")" ] && ok || bad "2b already-set file was rewritten"
+
+# --- 3. browser-pdf-save matcher absent (wildcard present) -> updated, added --
+F="$TMP/nomatcher/.claude/settings.json"
+mkdir -p "$(dirname "$F")"
+cat > "$F" <<'EOF'
+{ "permissions": {}, "hooks": { "PostToolUse": [
+  { "matcher": "Bash", "hooks": [] },
+  { "matcher": "mcp__.*", "hooks": [ { "type": "command", "command": "bash $P/missing.sh" } ] }
+] } }
+EOF
+OUT="$(ensure_pdf_conformance_matcher "$F")"
+case "$OUT" in *status=updated*) ok;; *) bad "3a nomatcher should be updated, got: $OUT";; esac
+pdfmatcher_present "$F" && ok || bad "3b browser-pdf-save matcher not added"
+[ "$(conformance_count "$F")" -eq 1 ] && ok || bad "3c conformance missing after add"
+wildcard_present "$F" && ok || bad "3d wildcard matcher was disturbed"
+# added matcher carries exactly the one conformance command
+if jq -e --arg m "$MATCHER" '.hooks.PostToolUse[] | select(.matcher==$m) | .hooks | length == 1' "$F" >/dev/null 2>&1; then ok; else bad "3e added matcher should carry exactly one command"; fi
+
+# --- 4. no PostToolUse -> no-hooks, untouched -------------------------------
+F="$TMP/nohooks/.claude/settings.json"
+mkdir -p "$(dirname "$F")"
+echo '{ "permissions": {}, "hooks": {} }' > "$F"
+BEFORE="$(cat "$F")"
+OUT="$(ensure_pdf_conformance_matcher "$F")"
+case "$OUT" in *status=no-hooks*) ok;; *) bad "4a should be no-hooks, got: $OUT";; esac
+[ "$BEFORE" = "$(cat "$F")" ] && ok || bad "4b no-hooks file was rewritten"
+
+# --- 5. file absent -> absent ------------------------------------------------
+OUT="$(ensure_pdf_conformance_matcher "$TMP/does-not-exist/.claude/settings.json")"
+case "$OUT" in *status=absent*) ok;; *) bad "5 should be absent, got: $OUT";; esac
+
+# --- 6. malformed JSON -> rewrite-failed, untouched -------------------------
+F="$TMP/bad/.claude/settings.json"
+mkdir -p "$(dirname "$F")"
+printf '{ this is not json ' > "$F"
+BEFORE="$(cat "$F")"
+OUT="$(ensure_pdf_conformance_matcher "$F")"
+case "$OUT" in *status=rewrite-failed*) ok;; *) bad "6a malformed should be rewrite-failed, got: $OUT";; esac
+[ "$BEFORE" = "$(cat "$F")" ] && ok || bad "6b malformed file was mutated"
+[ ! -e "$F.1929.tmp" ] && ok || bad "6c temp file left behind"
+
+# --- 7. reconcile_all_accounts_pdf_conformance ------------------------------
+ROOT="$TMP/accts"
+mkdir -p "$ROOT/acctA/.claude" "$ROOT/acctB/.claude" "$ROOT/notanaccount/.claude"
+echo '{"role":"house"}'  > "$ROOT/acctA/account.json"
+echo '{"role":"client"}' > "$ROOT/acctB/account.json"
+# notanaccount has no account.json -> must be skipped
+write_settings "$ROOT/acctA/.claude/settings.json"
+write_settings "$ROOT/acctB/.claude/settings.json" "$CONFORMANCE"
+write_settings "$ROOT/notanaccount/.claude/settings.json"
+RECOUT="$(reconcile_all_accounts_pdf_conformance "$ROOT")"
+[ "$(conformance_count "$ROOT/acctA/.claude/settings.json")" -eq 1 ] && ok || bad "7a acctA not patched"
+[ "$(conformance_count "$ROOT/acctB/.claude/settings.json")" -eq 1 ] && ok || bad "7b acctB disturbed"
+[ "$(conformance_count "$ROOT/notanaccount/.claude/settings.json")" -eq 0 ] && ok || bad "7c non-account dir was patched"
+case "$RECOUT" in *acctA*status=updated*) ok;; *) bad "7d reconcile did not log acctA updated";; esac
+
+echo "----------------------------------------"
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]

package/payload/platform/scripts/lib/account-settings-pdf-conformance.sh

@@ -0,0 +1,98 @@
+# account-settings-pdf-conformance.sh — retrofit the quote-render PDF-conformance
+# PostToolUse matcher onto existing accounts' .claude/settings.json. Task 1929.
+#
+# Task 1922 added a PostToolUse matcher on the browser-pdf-save tool running
+# quote-render-pdf-conformance.sh to provision-account-dir.sh. That writer only
+# runs at account-provision time; the upgrade path re-provisions the house
+# account but NOT existing client sub-accounts, so any account provisioned before
+# 1922 keeps a settings.json without the matcher and never runs the PDF gate
+# (live glsmith is such an account). This lib is the standing backfill:
+# setup-account.sh reconciles every account on every install so the gate reaches
+# pre-1922 accounts. Mirrors account-settings-askgate.sh (Task 1683).
+#
+# Requires jq. Idempotent. Never echoes file contents. Fail-open (nudge, not
+# brick): any unusable file logs a status and is left untouched.
+#
+# Sourced by setup-account.sh; also runnable standalone for a manual repair.
+
+# The exact command string provision-account-dir.sh writes. $PLATFORM_ROOT is a
+# literal in the settings file, resolved by Claude Code at hook-run time.
+_PDF_CONFORMANCE_MATCHER='mcp__plugin_browser_browser__browser-pdf-save'
+_PDF_CONFORMANCE_CMD='bash $PLATFORM_ROOT/plugins/admin/hooks/quote-render-pdf-conformance.sh'
+
+# ensure_pdf_conformance_matcher <settings_file>
+# Guarantees the PostToolUse browser-pdf-save matcher carries the conformance
+# command: appends it if the matcher exists without it, or adds the whole matcher
+# (single conformance command) if the matcher is absent. Logs exactly one
+# `[backfill-1929] file=<f> status=<absent|no-hooks|already-set|updated|rewrite-failed>`
+# to stdout. Always returns 0.
+ensure_pdf_conformance_matcher() {
+  local f="$1"
+  if [ ! -f "$f" ]; then
+    echo "[backfill-1929] file=$f status=absent"
+    return 0
+  fi
+  # Patchable only when the file is valid JSON with a PostToolUse array.
+  if ! jq -e '.hooks.PostToolUse | type == "array"' "$f" >/dev/null 2>&1; then
+    if jq -e . "$f" >/dev/null 2>&1; then
+      echo "[backfill-1929] file=$f status=no-hooks"
+    else
+      echo "[backfill-1929] file=$f status=rewrite-failed"
+    fi
+    return 0
+  fi
+  local tmp="$f.1929.tmp"
+  if ! jq \
+      --arg matcher "$_PDF_CONFORMANCE_MATCHER" \
+      --arg cmd "$_PDF_CONFORMANCE_CMD" '
+      .hooks.PostToolUse |= (
+        if any(.[]; .matcher == $matcher)
+        then map(
+          if .matcher == $matcher
+          then .hooks = (
+                 if any(.hooks[]; .command == $cmd)
+                 then .hooks
+                 else .hooks + [{type: "command", command: $cmd}]
+                 end)
+          else . end)
+        else . + [{matcher: $matcher, hooks: [{type: "command", command: $cmd}]}]
+        end)
+    ' "$f" > "$tmp" 2>/dev/null; then
+    rm -f "$tmp"
+    echo "[backfill-1929] file=$f status=rewrite-failed"
+    return 0
+  fi
+  # Semantic no-op? Compare canonical forms; leave the file byte-identical if so.
+  # `|| true` keeps a jq failure here (e.g. $f truncated by a concurrent writer
+  # between the type-check above and this read) from tripping a caller's `set -e`
+  # and aborting the whole install. This lib is fail-open by contract.
+  local before after
+  before="$(jq -S . "$f" 2>/dev/null || true)"
+  after="$(jq -S . "$tmp" 2>/dev/null || true)"
+  if [ "$before" = "$after" ]; then
+    rm -f "$tmp"
+    echo "[backfill-1929] file=$f status=already-set"
+    return 0
+  fi
+  if mv "$tmp" "$f"; then
+    echo "[backfill-1929] file=$f status=updated"
+  else
+    rm -f "$tmp"
+    echo "[backfill-1929] file=$f status=rewrite-failed"
+  fi
+  return 0
+}
+
+# reconcile_all_accounts_pdf_conformance <accounts_dir>
+# Standing check + backfill: every account dir with an account.json gets its
+# PostToolUse browser-pdf-save matcher's conformance command ensured. Mirrors
+# reconcile_all_accounts_askgate.
+reconcile_all_accounts_pdf_conformance() {
+  local accts="$1"
+  [ -d "$accts" ] || return 0
+  local acct
+  for acct in "$accts"/*/; do
+    [ -f "$acct/account.json" ] || continue
+    ensure_pdf_conformance_matcher "$acct/.claude/settings.json"
+  done
+}

package/payload/platform/scripts/lib/provision-account-dir.sh

@@ -113,6 +113,18 @@ provision_account_dir() {
         "hooks": [
           { "type": "command", "command": "bash $HOOKS_PATH/quote-render-gate.sh" }
         ]
+      },
+      {
+        "matcher": "mcp__plugin_browser_browser__browser-pdf-save",
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/preference-consult-gate.sh" }
+        ]
+      },
+      {
+        "matcher": "mcp__plugin_email_email__email-send|mcp__plugin_email_email__email-reply|mcp__plugin_email_email__email-draft-send|mcp__plugin_outlook_outlook__outlook-mail-send|mcp__plugin_outlook_outlook__outlook-mail-reply|mcp__plugin_outlook_outlook__outlook-draft-send|SendUserFile",
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/preference-consult-gate.sh" }
+        ]
       }
     ],
     "PostToolUse": [
@@ -164,7 +176,8 @@ provision_account_dir() {
         "hooks": [
           { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" },
           { "type": "command", "command": "bash $HOOKS_PATH/prompt-optimiser-directive.sh" },
-          { "type": "command", "command": "bash $HOOKS_PATH/datetime-inject.sh" }
+          { "type": "command", "command": "bash $HOOKS_PATH/datetime-inject.sh" },
+          { "type": "command", "command": "bash $HOOKS_PATH/preference-consult-directive.sh" }
         ]
       }
     ],

package/payload/platform/scripts/setup-account.sh

@@ -36,6 +36,8 @@ ACCOUNTS_DIR="$INSTALL_DIR/data/accounts"
 . "$SCRIPT_DIR/lib/provision-account-dir.sh"
 # shellcheck source=lib/account-settings-askgate.sh
 . "$SCRIPT_DIR/lib/account-settings-askgate.sh"
+# shellcheck source=lib/account-settings-pdf-conformance.sh
+. "$SCRIPT_DIR/lib/account-settings-pdf-conformance.sh"
 # shellcheck source=lib/read-brand-json.sh
 . "$SCRIPT_DIR/lib/read-brand-json.sh"
 # Resolve brand-aware persistent users.json path before the resolver runs.
@@ -77,3 +79,14 @@ reconcile_all_accounts_owned_dirs "$ACCOUNTS_DIR"
 # so the gate reaches pre-1552 accounts. Idempotent; logs one [backfill-1683] line
 # per account.
 reconcile_all_accounts_askgate "$ACCOUNTS_DIR"
+
+# ------------------------------------------------------------------
+# 5. Retrofit the quote-render PDF-conformance matcher onto every account
+# ------------------------------------------------------------------
+# Standing check + durable backfill (Task 1929): provision_account_dir writes the
+# PostToolUse browser-pdf-save matcher (quote-render-pdf-conformance.sh) only at
+# provision time, and this script re-provisions only the house account. An
+# account created before Task 1922 keeps a settings.json without the matcher and
+# never runs the PDF gate. Reconcile every account on every install so the gate
+# reaches pre-1922 accounts. Idempotent; logs one [backfill-1929] line per account.
+reconcile_all_accounts_pdf_conformance "$ACCOUNTS_DIR"

package/payload/platform/templates/account-schema/SCHEMA.md

@@ -28,6 +28,11 @@ rule. Renaming an existing bad name goes through the `data-manager` specialist.
 
 ## Tool-owned (off-limits — never reorganise)
 
+Finished deliverables must be promoted out of `output/` into `documents/` or
+`projects/<name>/` through the `data-manager` specialist; `output/` is scratch of
+last resort, and a graph reference must never point into it (the next tool write
+rebuilds the tree and the reference dangles).
+
 The internal structure of these is owned by the writing tool and is recreated on
 the next write: `url-get/`, `output/`, `generated/`, `extracted/`, `uploads/`,
 any published/served tree (`sites/`, `public/`), `agents/`, `specialists/`, and

package/payload/platform/templates/specialists/agents/data-manager.md

@@ -21,13 +21,13 @@ Directories whose layout is owned by tools are not yours to reorganise — a too
 
 ## The reconcile audit brief
 
-When admin's brief names a reconcile audit, the pass is read-only: walk the operator-file areas of the account directory, resolve each file against the graph via `memory-search`, and count (a) files unreachable from any graph node and (b) graph file-references that do not resolve to a real path. Move nothing, dispatch nothing. The audit exists so a rising count is visible before anyone asks for a cleanup.
+When admin's brief names a reconcile audit, the pass is read-only: walk the operator-file areas of the account directory, resolve each file against the graph via `memory-search`, and count (a) files unreachable from any graph node, (b) graph file-references that do not resolve to a real path, (c) graph file-references that resolve into a tool-owned scratch dir (`output/`, `generated/`, `extracted/`, `url-get/`), which the next tool write rebuilds so the reference is fragile by construction, and (d) deliverables a node references that resolve only under a scratch dir and were never promoted to `documents/` or `projects/`. Move nothing, dispatch nothing. The audit exists so a rising count is visible before anyone asks for a cleanup.
 
 When the vertical's `schema-<vertical>.md` declares a **published / served tree** with a Filesystem ↔ graph section (e.g. the per-listing site target with a URL ↔ path rule and an artefact → graph-reference table), the audit also walks that tree. The graph references it by hosted URL, not local path, so resolution runs through the section's URL ↔ path rule: for each served file, derive its hosted URL and check that some node references it; for each node URL **that matches the section's hosted-URL prefix**, derive its local path and check the file exists. Count served files matching no node reference in `unreachable` and prefix-matching node URLs resolving to no served file in `broken-refs`. Node URLs the rule cannot resolve — externally-hosted URLs (a CDN image, a third-party portal link) carry no served-tree prefix — are outside this audit and are never counted as broken. Honour the section's "served but intentionally unreferenced (tool / collateral)" list — those classes carry no reference by design and are never orphans, the same exclusion you already apply to the `url-get/` cache. This walk is still read-only: the served tree is a publish write target (off-limits to moves, above); the audit only counts drift, it never reorganises.
 
 ## Output contract
 
-End every dispatch with a one-line machine-greppable summary as the last line of your reply. For stewardship work: `moves=N ref-updates=M skipped=<reason|none>`. For the reconcile audit: `unreachable=N broken-refs=M`. If a brief is ambiguous about whether a directory is operator data or a system convention, name the ambiguity in your reply instead of guessing.
+End every dispatch with a one-line machine-greppable summary as the last line of your reply. For stewardship work: `moves=N ref-updates=M skipped=<reason|none>`. For the reconcile audit: `unreachable=N broken-refs=M scratch-refs=P stranded=Q`. If a brief is ambiguous about whether a directory is operator data or a system convention, name the ambiguity in your reply instead of guessing.
 
 ## Review gates