@rubytech/create-maxy-code 0.1.568 → 0.1.569

package/payload/platform/plugins/admin/hooks/quote-render-pdf-conformance.sh

@@ -30,6 +30,184 @@ if [ -t 0 ]; then exit 0; fi
 INPUT=$(cat)
 [ -z "$INPUT" ] && exit 0
 
+# --- log sink ---------------------------------------------------------------
+# A hook's stderr on exit 0 is not an observable sink: measured 2026-08-06 on the
+# laptop's sitedesk-code install, no bracketed hook line has ever reached
+# server.log (live or rotated) or the JSONL transcripts. The sibling inject hooks
+# each write their own file under the resolved log dir; the header conformance
+# line below does the same, so a clean run is distinguishable from a check that
+# never ran. The ladder mirrors mailbox-inject.sh: LOG_DIR is stamped only on the
+# rc-spawn path, CLAUDE_SESSION_MANAGER_PERSIST_DIR is on the systemd unit and
+# resolves to the same directory, ACCOUNT_DIR/logs is the last resort.
+ACCT_DIR=""
+if [ -n "${ACCOUNT_DIR:-}" ] && [ -d "${ACCOUNT_DIR}" ]; then ACCT_DIR="$ACCOUNT_DIR"; fi
+LOGD=""
+if [ -n "${LOG_DIR:-}" ] && [ -d "${LOG_DIR}" ]; then
+  LOGD="$LOG_DIR"
+elif [ -n "${CLAUDE_SESSION_MANAGER_PERSIST_DIR:-}" ] && [ -d "${CLAUDE_SESSION_MANAGER_PERSIST_DIR}/logs" ]; then
+  LOGD="$CLAUDE_SESSION_MANAGER_PERSIST_DIR/logs"
+elif [ -n "$ACCT_DIR" ] && [ -d "$ACCT_DIR/logs" ]; then
+  LOGD="$ACCT_DIR/logs"
+fi
+SID=$(printf '%s' "$INPUT" | python3 -c 'import json,sys
+try:
+    print(json.load(sys.stdin).get("session_id","") or "?")
+except Exception:
+    print("?")' 2>/dev/null)
+SID=${SID:-?}
+NOW_ISO=$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || echo "?")
+
+emit_log() {
+  local line="$NOW_ISO [quote-render] $1 session=$SID"
+  if [ -n "$LOGD" ]; then
+    # stderr redirect FIRST: with the append first, bash emits its own
+    # "Permission denied" on an unwritable log before 2>/dev/null takes effect,
+    # and that escapes to the hook's stderr on every print.
+    printf '%s\n' "$line" 2>/dev/null >> "$LOGD/quote-render-conformance.log" || true
+  fi
+  echo "$line" >&2 || true
+}
+
+# --- per-physical-page running-header conformance ---------------------------
+# Chrome decides physical pagination at print time, so a document whose header is
+# a hand-placed div next to a hand-placed page break loses that header on any page
+# the content bled onto. This stage is deliberately receipt-free and path-
+# agnostic: template-seeded documents (budget estimates, valuations, works
+# orders, survey sheets) never pass through the quote renderer and so have no
+# receipt, and they are exactly the documents that reproduce the fault.
+#
+# It only ever gates a document that DECLARES a running header in a @page top
+# margin box, so a brochure or any document without one is never blocked.
+HRESULT=$(INPUT="$INPUT" BASE="$PWD" python3 - <<'PY' 2>/dev/null || true
+import os, json, re, sys, subprocess, html as htmlmod
+
+def out(s):
+    print(s)
+    sys.exit(0)
+
+try:
+    d = json.loads(os.environ["INPUT"])
+except Exception:
+    sys.exit(0)  # uninspectable envelope -> fail open
+if not (d.get("tool_name", "") or "").endswith("browser-pdf-save"):
+    sys.exit(0)
+pdf = (d.get("tool_input", {}) or {}).get("path", "") or ""
+if not pdf or not os.path.isfile(pdf):
+    sys.exit(0)  # PDF not written -> nothing to inspect
+base = os.path.basename(pdf)
+
+# Source HTML: the render receipt for a gated client quote, else the sibling
+# .html beside the PDF. The sibling is the documented browser-pdf-save
+# convention (invoicing.md step 4, document-management.md step 4: print the HTML
+# to an absolute .pdf path alongside it, same name).
+src = ""
+m = re.search(r'(?:^|/)memory/users/[^/]+/documents/quote-(.+?)(-breakdown)?\.pdf$',
+              os.path.normpath(pdf))
+if m and "/" not in m.group(1) and ".." not in m.group(1):
+    try:
+        r = json.load(open(os.path.join(os.environ["BASE"], "quoting", "jobs",
+                                        m.group(1), "render-receipt.json")))
+        src = (r.get("filed", {}) or {}).get("breakdown" if m.group(2) else "quote", "")
+    except Exception:
+        src = ""
+if not src or not os.path.isfile(src):
+    sib = os.path.splitext(pdf)[0] + ".html"
+    src = sib if os.path.isfile(sib) else ""
+if not src:
+    out("LOG|op=pdf-header-conformance file=%s pagesChecked=0 reason=no-source-html" % base)
+try:
+    doc = open(src, encoding="utf-8", errors="replace").read()
+except Exception:
+    out("LOG|op=pdf-header-conformance file=%s pagesChecked=0 reason=no-source-html" % base)
+
+# The marker is the literal string content of a @top-* box. A content:url() logo
+# box carries no text and is skipped: only extractable text can be asserted per
+# page. EVERY declaration of each box is considered, not just the first, because
+# @page :first declares the same boxes with empty content to suppress them on
+# page 1 and CSS does not fix the order of the two rules — taking the first match
+# alone would read the suppression rule as "no running header" and silently skip
+# the check on any document that declared :first before @page.
+def unesc(s):
+    s = htmlmod.unescape(s)
+    s = re.sub(r'\\([0-9a-fA-F]{1,6})\s?', lambda g: chr(int(g.group(1), 16)), s)
+    return s.replace('\\"', '"').replace("\\\\", "\\").strip()
+
+marker = ""
+for box in ("top-center", "top-right", "top-left"):
+    for mm in re.finditer(r'@' + box + r'\s*\{[^}]*?content\s*:\s*"((?:[^"\\]|\\.)*)"', doc, re.S):
+        cand = unesc(mm.group(1))
+        if len(cand) >= 4:
+            marker = cand
+            break
+    if marker:
+        break
+if not marker:
+    out("LOG|op=pdf-header-conformance file=%s pagesChecked=0 reason=no-running-header" % base)
+
+try:
+    info = subprocess.run(["pdfinfo", pdf], capture_output=True, text=True, timeout=20)
+    pages = int(re.search(r'^Pages:\s+(\d+)', info.stdout, re.M).group(1))
+except Exception:
+    out("LOG|op=pdf-header-conformance file=%s pagesChecked=0 reason=no-poppler" % base)
+
+# The marker must be found in the TOP BAND of the page, not anywhere on it. A
+# running footer routinely repeats the same reference as the header (the GLS
+# footer is "… Builders Est. 1987 · Quote <ref>"), so a whole-page text match
+# reports a header on a page that has only a footer — measured on a real
+# 10-page print, where page 1 matched on its footer alone while its header was
+# correctly suppressed by @page :first. Cropping to the top 12% of the page
+# covers a top margin as deep as 30mm on A4 and excludes the footer entirely.
+sz = re.search(r'^Page size:\s+([\d.]+) x ([\d.]+)', info.stdout, re.M)
+pw, ph = (float(sz.group(1)), float(sz.group(2))) if sz else (595.0, 842.0)
+band = max(1, int(ph * 0.12))
+crop = ["-x", "0", "-y", "0", "-W", str(int(pw) + 1), "-H", str(band)]
+
+# @page :first suppresses the margin boxes on page 1, which carries its own
+# masthead instead; without it every physical page is expected to carry one.
+first = 2 if re.search(r'@page\s*:first', doc) else 1
+if pages < first:
+    out("LOG|op=pdf-header-conformance file=%s pages=%d pagesChecked=0 reason=single-page"
+        % (base, pages))
+
+def norm(s):
+    return re.sub(r'\s+', ' ', s).strip()
+
+want = norm(marker)
+missing = []
+for p in range(first, pages + 1):
+    try:
+        t = subprocess.run(["pdftotext", "-f", str(p), "-l", str(p)] + crop + [pdf, "-"],
+                           capture_output=True, text=True, timeout=20).stdout
+    except Exception:
+        out("LOG|op=pdf-header-conformance file=%s pagesChecked=0 reason=no-poppler" % base)
+    if want not in norm(t):
+        missing.append(p)
+
+checked = pages - first + 1
+if missing:
+    print("LOG|op=pdf-header-conformance file=%s pages=%d pagesChecked=%d pagesHeaderless=%d"
+          % (base, pages, checked, len(missing)))
+    out("HBLOCK|%s|pagesHeaderless=%d pages=%s"
+        % (base, len(missing), ",".join(str(x) for x in missing)))
+out("LOG|op=pdf-header-conformance file=%s pages=%d pagesChecked=%d pagesHeaderless=0"
+    % (base, pages, checked))
+PY
+)
+
+while IFS= read -r hline; do
+  case "$hline" in
+    LOG\|*) emit_log "${hline#LOG|}" ;;
+    HBLOCK\|*)
+      hrest=${hline#HBLOCK|}
+      hfile=${hrest%%|*}
+      hdetail=${hrest#*|}
+      emit_log "op=bypass file=$hfile reason=pdf-header-conformance detail=$hdetail"
+      echo "Blocked: this printed document has physical pages carrying no running header, so it would go out with unbranded pages ($hdetail). The header must be a property of the page itself, a page margin box, not a header block placed next to a declared page break, because the browser decides the real page boundaries at print time. Fix the document's print CSS, print it again, and check every page." >&2
+      exit 2
+      ;;
+  esac
+done <<< "$HRESULT"
+
 RESULT=$(INPUT="$INPUT" BASE="$PWD" python3 - <<'PY' 2>/dev/null || true
 import os, json, re, sys, urllib.request
 

package/payload/platform/plugins/admin/mcp/dist/lib/roster-census.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roster-census.d.ts","sourceRoot":"","sources":["../../src/lib/roster-census.ts"],"names":[],"mappings":"AAmCA,MAAM,WAAW,iBAAiB;IAChC,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC;IACrB;;;uDAGmD;IACnD,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;;uBAImB;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB;;;qBAGiB;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB;;;;4EAIwE;IACxE,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B;;qEAEiE;IACjE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;oEAEgE;IAChE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB;;;;sEAIkE;IAClE,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAyCD,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,kBAAkB,CAqC5E"}
+{"version":3,"file":"roster-census.d.ts","sourceRoot":"","sources":["../../src/lib/roster-census.ts"],"names":[],"mappings":"AAmCA,MAAM,WAAW,iBAAiB;IAChC,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC;IACrB;;;uDAGmD;IACnD,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;;uBAImB;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB;;;qBAGiB;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB;;;;4EAIwE;IACxE,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B;;qEAEiE;IACjE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;oEAEgE;IAChE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB;;;;sEAIkE;IAClE,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAoFD,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,kBAAkB,CAsC5E"}

package/payload/platform/plugins/admin/mcp/dist/lib/roster-census.js

@@ -10,6 +10,49 @@ function markdownIn(dir) {
         return [];
     return readdirSync(dir).filter((entry) => entry.endsWith(".md"));
 }
+/** The `name:` value from a card's frontmatter, or null. CRLF-tolerant and
+ *  quote-stripping, the same idiom `specialist-roster.ts` and `spawn-context.ts`
+ *  use, so all three agree on what a card is called. A card that cannot be read
+ *  — a dangling registry symlink, EACCES, a directory at the path — yields
+ *  null, which is the honest answer to "does this resolve?". */
+function frontmatterName(file) {
+    let raw;
+    try {
+        raw = readFileSync(file, "utf8");
+    }
+    catch {
+        return null;
+    }
+    const fm = raw.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+    if (!fm)
+        return null;
+    const m = fm[1].match(/^name:\s*(.*?)\r?$/m);
+    if (!m)
+        return null;
+    let value = m[1].trim();
+    if ((value.startsWith('"') && value.endsWith('"')) ||
+        (value.startsWith("'") && value.endsWith("'"))) {
+        value = value.slice(1, -1);
+    }
+    return value || null;
+}
+/** Every subagent name the CLI can resolve from `registryDir`.
+ *
+ *  Task 2469 — keyed on the frontmatter `name`, not the filename. Those differ
+ *  by construction for a bundle-scoped card: `glsmith--order-clerk.md`
+ *  registers `order-clerk`, and `order-clerk` is also what AGENTS.md declares,
+ *  so asking for `<rosterName>.md` missed all four of GLS's clerks while every
+ *  one of them dispatched. For a bare card the filename stem and the name are
+ *  equal, so nothing about that class changes. */
+function resolvableNames(registryDir) {
+    const names = new Set();
+    for (const filename of markdownIn(registryDir)) {
+        const name = frontmatterName(join(registryDir, filename));
+        if (name !== null)
+            names.add(name);
+    }
+    return names;
+}
 function subdirs(dir) {
     if (!existsSync(dir))
         return [];
@@ -45,10 +88,13 @@ export function runRosterCensus(input) {
     }
     // Task 2460 — measured against the registry, not the source directory. Those
     // two disagreed on the account that filed that task: 13 authored, 12
-    // registered, and this line reported zero orphans three times. existsSync
-    // follows symlinks, so a dangling registry link reads as absent, which is
-    // correct — it does not resolve.
-    const orphaned = declared.filter((name) => !existsSync(join(input.registryDir, `${name}.md`)));
+    // registered, and this line reported zero orphans three times.
+    //
+    // Task 2469 — and measured by the name the registry actually resolves rather
+    // than by filename. A dangling link still reads as absent, because reading it
+    // throws and yields no name.
+    const resolvable = resolvableNames(input.registryDir);
+    const orphaned = declared.filter((name) => !resolvable.has(name));
     const durable = new Set();
     for (const dir of input.durableDirs) {
         for (const filename of markdownIn(dir))

package/payload/platform/plugins/admin/mcp/dist/lib/roster-census.js.map

@@ -1 +1 @@
-{"version":3,"file":"roster-census.js","sourceRoot":"","sources":["../../src/lib/roster-census.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAkFjC;;;;uDAIuD;AACvD,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SAC7C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SACtC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,iBAAiB,CACxB,oBAA4B,EAC5B,iBAA0B;IAE1B,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3C,4EAA4E;IAC5E,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,wEAAwE;IACxE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,0EAA0E;IAC1E,6EAA6E;IAC7E,cAAc;IACd,OAAO,UAAU,CAAC,oBAAoB,CAAC;SACpC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;SACrC,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CACvF,CAAC;AACN,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAwB;IACtD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC;QACzC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC;QAC1C,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EAAE,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,6EAA6E;IAC7E,qEAAqE;IACrE,0EAA0E;IAC1E,0EAA0E;IAC1E,iCAAiC;IACjC,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAC9B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAC7D,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACpC,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC5C,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAC7D,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CACrC,CAAC;IAEF,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,MAAM;QACzB,YAAY,EAAE,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM;QAC/C,QAAQ;QACR,SAAS;QACT,aAAa,EAAE,iBAAiB,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,iBAAiB,CAAC;KACtF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"roster-census.js","sourceRoot":"","sources":["../../src/lib/roster-census.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAkFjC;;;;uDAIuD;AACvD,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;gEAIgE;AAChE,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC7C,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxB,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;QACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,IAAI,IAAI,CAAC;AACvB,CAAC;AAED;;;;;;;kDAOkD;AAClD,SAAS,eAAe,CAAC,WAAmB;IAC1C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1D,IAAI,IAAI,KAAK,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SAC7C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SACtC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,iBAAiB,CACxB,oBAA4B,EAC5B,iBAA0B;IAE1B,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3C,4EAA4E;IAC5E,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,wEAAwE;IACxE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,0EAA0E;IAC1E,6EAA6E;IAC7E,cAAc;IACd,OAAO,UAAU,CAAC,oBAAoB,CAAC;SACpC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;SACrC,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CACvF,CAAC;AACN,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAwB;IACtD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC;QACzC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC;QAC1C,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EAAE,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,6EAA6E;IAC7E,qEAAqE;IACrE,+DAA+D;IAC/D,EAAE;IACF,6EAA6E;IAC7E,8EAA8E;IAC9E,6BAA6B;IAC7B,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAElE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACpC,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC5C,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAC7D,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CACrC,CAAC;IAEF,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,MAAM;QACzB,YAAY,EAAE,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM;QAC/C,QAAQ;QACR,SAAS;QACT,aAAa,EAAE,iBAAiB,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,iBAAiB,CAAC;KACtF,CAAC;AACJ,CAAC"}

package/payload/platform/plugins/admin/skills/whats-new/SKILL.md

@@ -9,6 +9,14 @@ Invoked by the admin agent directly.
 
 This is the platform's release timeline, newest first. Each entry shows the date it shipped and the version it shipped in, so you can tell the operator how current their install is. To compare, read the installed version from `capabilities-here` and match it against the versions below. Keep answers high level and in plain English; this is a summary, not a full commit log.
 
+## 2026-08-06 (0.1.569)
+
+- Every account's safeguards are now brought up to date on each install. They used to be written once when the account was created and never revisited, so an account could be missing a protection that every other account had, with nothing reporting the gap.
+- A customer quote can now only be produced by the specialist that owns it. Other assistants were writing quote documents by hand, bypassing the template and the renderer entirely; writes to a quote from anything else are now refused, including producing the PDF through the shell.
+- A specialist you wrote for your own account is dispatchable again. The roster was matching on filenames rather than the name declared inside the file, so cards that looked registered could not actually be reached and the work fell to a general-purpose assistant instead.
+- Two new standing checks: one counts work written into an owned area by the wrong specialist, the other reconciles quotes that were sent against the records of what was actually rendered.
+- A quote's running header no longer depends on where the author happened to put page breaks, so it appears on every page rather than the ones that were hand-marked.
+
 ## 2026-08-06 (0.1.568)
 
 - Answers reach the conversation they came from again. An answer was being routed by who the account's admin is rather than by the conversation it was sent to, so a public agent's reply could go nowhere and an admin answer could strand with nothing said about it. Delivery now returns to the door the message arrived on, and every failure to find one is named rather than passing silently. If you rolled an install back because of this, you can move forward again.

package/payload/platform/scripts/__tests__/mailbox-inject-registered.test.sh

@@ -11,7 +11,7 @@
 # a comment and proves nothing about what the lib would write.
 set -uo pipefail
 DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROV="$DIR/../lib/provision-account-dir.sh"
+PROV="$DIR/../../templates/account-settings.json"
 BACKFILL="$DIR/../lib/account-settings-mailbox-inject.sh"
 SETUP="$DIR/../setup-account.sh"
 PASS=0; FAIL=0
@@ -22,7 +22,7 @@ bad() { echo "FAIL: $1" >&2; FAIL=$((FAIL+1)); }
 # What provision-account-dir.sh writes into the settings heredoc. HOOKS_PATH is
 # assigned there as the literal string $PLATFORM_ROOT/plugins/admin/hooks, so the
 # resolved command is the same string the backfill lib holds.
-PROV_LINE='{ "type": "command", "command": "bash $HOOKS_PATH/mailbox-inject.sh" }'
+PROV_LINE='{ "type": "command", "command": "bash $PLATFORM_ROOT/plugins/admin/hooks/mailbox-inject.sh" }'
 RESOLVED='bash $PLATFORM_ROOT/plugins/admin/hooks/mailbox-inject.sh'
 
 if /usr/bin/grep -qF "$PROV_LINE" "$PROV"; then
@@ -53,10 +53,10 @@ fi
 
 # HOOKS_PATH must still resolve to the path the backfill lib assumes; if someone
 # repoints it, the two writers silently disagree and every account gets two hooks.
-if /usr/bin/grep -qF 'HOOKS_PATH="\$PLATFORM_ROOT/plugins/admin/hooks"' "$PROV"; then
-  ok "HOOKS_PATH resolves to the path the backfill lib assumes"
+if ! /usr/bin/grep -q 'HOOKS_PATH' "$PROV"; then
+  ok "the template carries no unresolved hook-path indirection"
 else
-  bad "HOOKS_PATH in $PROV no longer matches the backfill lib assumption"
+  bad "$PROV still carries a HOOKS_PATH indirection, so the two writers can drift"
 fi
 
 if /usr/bin/grep -qF 'account-settings-mailbox-inject.sh' "$SETUP"; then

package/payload/platform/scripts/__tests__/preference-hooks-registered.test.sh

@@ -1,7 +1,9 @@
 #!/usr/bin/env bash
 set -uo pipefail
 DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-LIB="$DIR/../lib/provision-account-dir.sh"
+# The provision-time source of the hook set is the template provision_account_dir
+# copies verbatim, not a heredoc inside the writer.
+LIB="$DIR/../../templates/account-settings.json"
 PASS=0; FAIL=0; FAILED=()
 c(){ if grep -qF "$1" "$LIB"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$2"); fi; }
 c 'preference-consult-gate.sh' "gate registered"

package/payload/platform/scripts/__tests__/public-surface-registered.test.sh

@@ -7,7 +7,7 @@
 # append a second copy to every house account on every install.
 set -uo pipefail
 DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROV="$DIR/../lib/provision-account-dir.sh"
+PROV="$DIR/../../templates/account-settings.json"
 BACKFILL="$DIR/../lib/account-settings-public-surface.sh"
 SETUP="$DIR/../setup-account.sh"
 PASS=0; FAIL=0
@@ -15,7 +15,7 @@ PASS=0; FAIL=0
 ok()  { echo "PASS: $1"; PASS=$((PASS+1)); }
 bad() { echo "FAIL: $1" >&2; FAIL=$((FAIL+1)); }
 
-PROV_LINE='{ "type": "command", "command": "bash $HOOKS_PATH/public-tool-surface.sh" }'
+PROV_LINE='{ "type": "command", "command": "bash $PLATFORM_ROOT/plugins/admin/hooks/public-tool-surface.sh" }'
 RESOLVED='bash $PLATFORM_ROOT/plugins/admin/hooks/public-tool-surface.sh'
 
 if [ "$(/usr/bin/grep -cF "$PROV_LINE" "$PROV")" = "3" ]; then
@@ -75,10 +75,10 @@ else
   bad "backfill _PUBSURFACE_CMD is not '$RESOLVED' in $BACKFILL"
 fi
 
-if /usr/bin/grep -qF 'HOOKS_PATH="\$PLATFORM_ROOT/plugins/admin/hooks"' "$PROV"; then
-  ok "HOOKS_PATH resolves to the path the backfill lib assumes"
+if ! /usr/bin/grep -q 'HOOKS_PATH' "$PROV"; then
+  ok "the template carries no unresolved hook-path indirection"
 else
-  bad "HOOKS_PATH in $PROV no longer matches the backfill lib assumption"
+  bad "$PROV still carries a HOOKS_PATH indirection, so the two writers can drift"
 fi
 
 if /usr/bin/grep -qF 'account-settings-public-surface.sh' "$SETUP"; then

package/payload/platform/scripts/__tests__/quote-ownership-contract.test.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# The client quote document has exactly one owner, and that ownership is a
+# capability as well as a claim.
+#
+# A hand-orchestrated quote reached a customer because the quoter's own card
+# disclaimed document work ("not a document edit for another agent"), so the
+# admin's routing to a general content specialist was correct against it. The
+# guarantee that replaced that prose is a capability: the quote tools are
+# granted to the quoter's card and to no other, so no other agent can produce a
+# receipt-bearing quote by any route.
+#
+# Covers:
+#   A. the quoter's body claims ownership of the document's presentation
+#   B. the disclaimer that sent document work elsewhere is gone
+#   C. the description front-matter carries the same claim (the roster text the
+#      admin reads at dispatch time)
+#   D. quote-render / quote-engine-run are granted to the quoter
+#   E. no other card in the tree grants either tool
+
+set -u
+
+ROOT="$(cd "$(dirname "$0")/../../.." && pwd)"
+QUOTER="$ROOT/premium-plugins/sitedesk/agents/sitedesk--quoter.md"
+
+PASS=0
+FAIL=0
+ok()  { echo "PASS: $1"; PASS=$((PASS + 1)); }
+bad() { echo "FAIL: $1" >&2; FAIL=$((FAIL + 1)); }
+
+if [ ! -f "$QUOTER" ]; then
+  echo "FAIL: quoter card missing at $QUOTER" >&2
+  exit 1
+fi
+
+# Body = everything outside the frontmatter block.
+BODY="$(sed -n '/^---$/,/^---$/!p' "$QUOTER")"
+DESC="$(grep -m1 '^description:' "$QUOTER" || true)"
+
+for word in layout "cover page" photograph "running header" correction; do
+  if printf '%s' "$BODY" | grep -qi -- "$word"; then
+    ok "A: body claims $word"
+  else
+    bad "A: body does not claim $word"
+  fi
+done
+
+if grep -q 'not a document edit for another agent' "$QUOTER"; then
+  bad "B: the document-edit disclaimer is still present"
+else
+  ok "B: document-edit disclaimer absent"
+fi
+
+if printf '%s' "$DESC" | grep -qi 'owns the client quote document'; then
+  ok "C: description carries the ownership claim"
+else
+  bad "C: description does not carry the ownership claim"
+fi
+
+TOOLS="$(grep -m1 '^tools:' "$QUOTER" || true)"
+for t in quote-render quote-engine-run; do
+  if printf '%s' "$TOOLS" | grep -q -- "$t"; then
+    ok "D: quoter grants $t"
+  else
+    bad "D: quoter does not grant $t"
+  fi
+done
+
+STRAY=0
+while IFS= read -r card; do
+  [ "$card" = "$QUOTER" ] && continue
+  line="$(grep -m1 '^tools:' "$card" || true)"
+  if printf '%s' "$line" | grep -qE 'quote-render|quote-engine-run'; then
+    echo "  stray grant: $card" >&2
+    STRAY=$((STRAY + 1))
+  fi
+done < <(find "$ROOT/premium-plugins" "$ROOT/platform/templates/specialists/agents" -name '*.md' -type f 2>/dev/null)
+
+if [ "$STRAY" -eq 0 ]; then
+  ok "E: no other card grants a quote tool"
+else
+  bad "E: $STRAY other card(s) grant a quote tool"
+fi
+
+echo "──────── quote ownership contract summary ────────"
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]

package/payload/platform/scripts/lib/__tests__/account-settings-reconcile.test.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# reconcile_all_accounts_settings converges every account's hook set against the
+# shipped template and states the divergence count on every run.
+#
+# provision_account_dir writes the account's .claude/settings.json at provision
+# time only, and the upgrade path re-provisions the house account and no other.
+# An account created before a hook was added therefore runs a stale hook set
+# indefinitely, silently — which is how a client-quote gate came to be
+# registered on one of four accounts on a live install. Five one-hook backfill
+# libs were written that way, each after a different hook was found missing.
+# This lib converges the whole set instead.
+#
+# Covers:
+#   A. an account missing a template hook converges  → status=updated
+#   B. an already-matching account is left alone     → status=already-set
+#   C. an account with no settings file is seeded    → status=absent-seeded
+#   D. an unparseable file is reported, not rewritten → status=rewrite-failed
+#   E. the summary line is emitted on a re-run, stating its count
+#   F. the summary line counts the divergent accounts
+
+set -u
+
+LIB="$(cd "$(dirname "$0")/.." && pwd)/account-settings-reconcile.sh"
+if [ ! -f "$LIB" ]; then
+  echo "FAIL: $LIB missing" >&2
+  exit 1
+fi
+# shellcheck disable=SC1090
+. "$LIB"
+
+TMP=$(mktemp -d)
+trap 'rm -rf "$TMP"' EXIT
+
+TPL="$TMP/account-settings.json"
+printf '{"hooks":{"PreToolUse":[{"matcher":"Write","hooks":[{"type":"command","command":"bash a.sh"}]}]}}' > "$TPL"
+
+ACCTS="$TMP/accounts"
+mk() { mkdir -p "$ACCTS/$1/.claude"; printf '{}' > "$ACCTS/$1/account.json"; }
+
+PASS=0
+FAIL=0
+ok()  { echo "PASS: $1"; PASS=$((PASS + 1)); }
+bad() { echo "FAIL: $1" >&2; FAIL=$((FAIL + 1)); }
+
+mk stale;   printf '{"hooks":{"PreToolUse":[]}}' > "$ACCTS/stale/.claude/settings.json"
+mk current; cp "$TPL" "$ACCTS/current/.claude/settings.json"
+mk fresh
+mk broken;  printf 'not json' > "$ACCTS/broken/.claude/settings.json"
+
+OUT="$(MAXY_ACCOUNT_SETTINGS_TEMPLATE="$TPL" reconcile_all_accounts_settings "$ACCTS" 2>&1)"
+
+printf '%s' "$OUT" | grep -q 'account=stale status=updated' \
+  && ok "A: stale account converged" || bad "A: stale account not converged"
+printf '%s' "$OUT" | grep -q 'account=current status=already-set' \
+  && ok "B: matching account left alone" || bad "B: matching account not already-set"
+printf '%s' "$OUT" | grep -q 'account=fresh status=absent-seeded' \
+  && ok "C: missing settings seeded" || bad "C: missing settings not seeded"
+printf '%s' "$OUT" | grep -q 'account=broken status=rewrite-failed' \
+  && ok "D: unparseable file reported" || bad "D: unparseable file not reported"
+[ "$(cat "$ACCTS/broken/.claude/settings.json")" = "not json" ] \
+  && ok "D: unparseable file left untouched" || bad "D: unparseable file was rewritten"
+printf '%s' "$OUT" | grep -q 'accounts=4 divergent=3' \
+  && ok "F: summary counts the divergent accounts" || bad "F: wrong summary — $OUT"
+
+# The converged accounts stay converged; the unparseable one never does, which
+# is the standing signal.
+OUT2="$(MAXY_ACCOUNT_SETTINGS_TEMPLATE="$TPL" reconcile_all_accounts_settings "$ACCTS" 2>&1)"
+printf '%s' "$OUT2" | grep -q 'accounts=4 divergent=1' \
+  && ok "E: re-run states its count" || bad "E: wrong re-run summary — $OUT2"
+
+echo "──────── account-settings-reconcile summary ────────"
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" -eq 0 ]

package/payload/platform/scripts/lib/account-settings-reconcile.sh

@@ -0,0 +1,88 @@
+# account-settings-reconcile.sh — converge every account's Claude Code project
+# settings against the shipped template, and state the divergence count.
+#
+# provision_account_dir writes <accountDir>/.claude/settings.json from
+# platform/templates/account-settings.json at provision time only. The upgrade
+# path re-provisions the house account and no other, so an account created
+# before a hook was added runs a stale hook set indefinitely, and nothing says
+# so. A client-quote delivery gate was registered on one of four accounts on a
+# live install for exactly that reason, and the account it was missing from was
+# the one that quotes.
+#
+# Five one-hook backfill libs were written the same way, each after a different
+# hook was found missing on a live account: owned-dirs, askgate,
+# pdf-conformance, mailbox-inject, public-surface. This lib converges the whole
+# set instead, so a hook added to the template reaches every existing account on
+# the next install without a sixth bespoke backfill.
+#
+# Requires jq. Idempotent. Never echoes file contents. Fail-open: an unusable
+# file logs a status and is left untouched, never rewritten from a guess.
+#
+# Sourced by setup-account.sh; also runnable standalone for a manual repair.
+
+# ensure_account_settings <settings_file> <template_file>
+# Returns 0 when the file already matched the template, 1 when it diverged
+# (seeded, updated, unwritable, or unparseable). Logs exactly one
+#   [settings-reconcile] account=<id> status=<already-set|updated|absent-seeded|rewrite-failed|no-template>
+ensure_account_settings() {
+  local f="$1" tpl="$2"
+  local acct
+  acct="$(basename "$(dirname "$(dirname "$f")")")"
+
+  if [ ! -f "$tpl" ]; then
+    echo "[settings-reconcile] account=$acct status=no-template"
+    return 1
+  fi
+
+  if [ ! -f "$f" ]; then
+    mkdir -p "$(dirname "$f")" 2>/dev/null || true
+    if cp "$tpl" "$f" 2>/dev/null; then
+      echo "[settings-reconcile] account=$acct status=absent-seeded"
+    else
+      echo "[settings-reconcile] account=$acct status=rewrite-failed"
+    fi
+    return 1
+  fi
+
+  # Compare canonical forms, so key order and whitespace never read as drift.
+  # An empty result means jq refused the file; that is reported, not repaired —
+  # an unparseable settings file may carry an operator edit worth keeping, and
+  # this pass never destroys what it cannot read.
+  local before after
+  before="$(jq -S . "$f" 2>/dev/null || true)"
+  after="$(jq -S . "$tpl" 2>/dev/null || true)"
+  if [ -z "$before" ] || [ -z "$after" ]; then
+    echo "[settings-reconcile] account=$acct status=rewrite-failed"
+    return 1
+  fi
+  if [ "$before" = "$after" ]; then
+    echo "[settings-reconcile] account=$acct status=already-set"
+    return 0
+  fi
+
+  if cp "$tpl" "$f" 2>/dev/null; then
+    echo "[settings-reconcile] account=$acct status=updated"
+  else
+    echo "[settings-reconcile] account=$acct status=rewrite-failed"
+  fi
+  return 1
+}
+
+# reconcile_all_accounts_settings <accounts_dir>
+# Standing check + durable backfill across every account carrying an
+# account.json. Emits one status line per account plus one summary line on every
+# run, including a zero count — silence is not evidence of convergence.
+reconcile_all_accounts_settings() {
+  local accts="$1"
+  local tpl="${MAXY_ACCOUNT_SETTINGS_TEMPLATE:-${TEMPLATES_DIR:-}/account-settings.json}"
+  local n=0 divergent=0 acct
+  if [ -d "$accts" ]; then
+    for acct in "$accts"/*/; do
+      [ -f "$acct/account.json" ] || continue
+      n=$((n + 1))
+      ensure_account_settings "$acct/.claude/settings.json" "$tpl" || divergent=$((divergent + 1))
+    done
+  fi
+  echo "[settings-reconcile] accounts=$n divergent=$divergent"
+  return 0
+}