@rubytech/create-realagent-code 0.1.568 → 0.1.570

package/payload/platform/plugins/admin/hooks/quote-pdf-bash-gate.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# quote-pdf-bash-gate — PreToolUse gate on Bash.
+#
+# quote-render-gate refuses a hand-authored client quote at browser-pdf-save.
+# An agent holding Bash reaches the same outcome with any HTML-to-PDF converter
+# and meets no control at all — the specialist that produced the 2026-08-05
+# quote holds Bash, Write, Edit and browser-pdf-save, and quote-engine-gate
+# refuses only execution of the two persisted quoting scripts.
+#
+# This gate refuses a Bash command that produces a PDF from an HTML under a
+# gated quote path. It matches structurally on the paths in the command, never
+# on the converter's name, so the rule is binary-independent: wkhtmltopdf,
+# chromium --print-to-pdf, weasyprint and anything else are all covered by the
+# same two conditions.
+#
+# Scope mirrors quote-render-gate: the customer documents scope and a job's
+# quote / Quotations buckets. jobs/<jobId>/pricing/ is excluded — it holds the
+# internal priced breakdown.
+#
+# Exit codes: 0 = allow, 2 = block (stderr shown to the agent). Fail OPEN on an
+# uninspectable call (Bash is a general-purpose tool and the agent never
+# controls this hook's stdin, so failing open opens no bypass while never
+# bricking unrelated commands). No task numbers or internal refs in
+# operator-visible text.
+
+set -uo pipefail
+
+# No envelope (tty or empty stdin) → allow: cannot inspect, must not brick Bash.
+if [ -t 0 ]; then exit 0; fi
+INPUT=$(cat)
+[ -z "$INPUT" ] && exit 0
+
+DECISION=$(INPUT="$INPUT" python3 - <<'PY' 2>/dev/null || true
+import os, json, re, sys
+
+try:
+    d = json.loads(os.environ["INPUT"])
+except Exception:
+    sys.exit(0)
+if (d.get("tool_name", "") or "") != "Bash":
+    sys.exit(0)
+cmd = (d.get("tool_input", {}) or {}).get("command", "") or ""
+if not cmd:
+    sys.exit(0)
+
+# A gated source: an .html under the customer documents scope or a job quote
+# bucket. The filename class admits spaces (the filed quotes carry them) but
+# stops at a quote character or a shell separator, so one command path cannot
+# swallow the next. Quote characters are written \x22 / \x27 because this block
+# sits inside a bash command substitution, which parses quotes even in a
+# quoted heredoc.
+GATED_HTML = re.compile(
+    r'(?:memory/users/[^/\x22\x27\s]+/documents/[^\x22\x27;|&]*\.html'
+    r'|jobs/[^/\x22\x27\s]+/(?:quote|Quotations)/[^\x22\x27;|&]*\.html)'
+)
+if not GATED_HTML.search(cmd):
+    sys.exit(0)
+# Naming a PDF anywhere in the same command is what turns a read into a
+# production. `cat q.html` names none and passes.
+if not re.search(r'\.pdf\b', cmd):
+    sys.exit(0)
+print("block")
+PY
+)
+
+[ "$DECISION" = "block" ] || exit 0
+
+echo "[quote-render] op=bypass reason=bash-pdf-production" >&2
+echo "Blocked: a client quote PDF must come from the quote-render tool, not from a converter run by hand. Run quote-render for this job — it files the document and its render receipt — then print the client HTML path it returns." >&2
+exit 2

package/payload/platform/plugins/admin/hooks/quote-render-gate.sh

@@ -1,18 +1,30 @@
 #!/usr/bin/env bash
 # quote-render-gate — PreToolUse gate on browser-pdf-save.
 #
-# A customer only ever receives the two client-facing quote documents from the
-# customer documents scope (memory/users/<phone>/documents/). This gate refuses
-# to print one to PDF unless the deterministic quote-render tool actually
-# produced it — proven by the render receipt quote-render writes on success
-# (quoting/jobs/<jobId>/render-receipt.json). No receipt for the job means the
-# quote was hand-authored off the deterministic path, so the fixed-layout
-# guarantee and the reconcile/margin/link gates never ran; the PDF is refused and
-# the bypass is surfaced as [quote-render] op=bypass, not delivered.
+# A client-facing quote reaches a customer only when the deterministic
+# quote-render tool produced that exact document. The tool writes a render
+# receipt on success (quoting/jobs/<jobId>/render-receipt.json) naming the
+# documents it filed; this gate resolves the PDF's source HTML and requires its
+# content to match one of the client-facing documents that receipt names.
 #
-# Scope: only a .pdf under memory/users/<phone>/documents/ named
-# quote-<jobId>.pdf or quote-<jobId>-breakdown.pdf is gated. Every other PDF —
-# brochures, invoices, the admin-scope internal view — passes untouched.
+# Scope — three shapes, all resolved against the account dir:
+#   memory/users/<phone>/documents/quote-<jobId>[-breakdown].pdf
+#   jobs/<jobId>/quote/<anything>.pdf
+#   jobs/<jobId>/Quotations/<anything>.pdf
+# jobs/<jobId>/pricing/ is deliberately absent: it holds the internal priced
+# breakdown, always excluded with the admin-scope internal view. Every other PDF
+# — brochures, works orders, invoices — passes untouched.
+#
+# Why identity rather than existence. A receipt proves a render happened for the
+# job, not that this file is its output. On the 2026-08-05 bypass the job's
+# figures were rewritten after the render and the delivered document was written
+# later still, so an existence check would have authorised the print. Comparing
+# content, not paths, keeps an operator copy of a rendered document passing while
+# hand-authored content fails. filed.internal is not client-facing and is never a
+# permitted match.
+#
+# A missing source HTML blocks: the pipeline files the PDF beside the HTML it
+# printed from, so no local source means no proof of renderer origin.
 #
 # Exit codes: 0 = allow, 2 = block (stderr shown to the agent). Fail OPEN on an
 # uninspectable call (browser-pdf-save is a general-purpose tool; the bypass we
@@ -27,48 +39,104 @@ if [ -t 0 ]; then exit 0; fi
 INPUT=$(cat)
 [ -z "$INPUT" ] && exit 0
 
-# Print the jobId of a gated client-quote artefact, or nothing for any other
-# call. The customer documents scope is a path convention, so match on it
-# structurally rather than resolving symlinks.
-JOBID=$(INPUT="$INPUT" python3 - <<'PY' 2>/dev/null || true
-import os, json, re, sys
+# Prints nothing for an out-of-scope call, "allow" for a reconciling document,
+# or "block <reason> <jobId>".
+DECISION=$(INPUT="$INPUT" ACCT="$PWD" python3 - <<'PY' 2>/dev/null || true
+import os, json, re, sys, hashlib
+
 try:
     d = json.loads(os.environ["INPUT"])
 except Exception:
     sys.exit(0)
-tool = d.get("tool_name", "") or ""
-if not tool.endswith("browser-pdf-save"):
+if not (d.get("tool_name", "") or "").endswith("browser-pdf-save"):
     sys.exit(0)
 path = (d.get("tool_input", {}) or {}).get("path", "") or ""
 if not path:
     sys.exit(0)
 norm = os.path.normpath(path)
+
+# The customer documents scope and the jobs bucket are path conventions, so
+# match on them structurally rather than resolving symlinks.
+jobid = None
 m = re.search(r'(?:^|/)memory/users/[^/]+/documents/quote-(.+?)(?:-breakdown)?\.pdf$', norm)
-if not m:
+if m:
+    jobid = m.group(1)
+else:
+    # `.+` rather than `[^/]+`: the bucket is matched recursively, so one mkdir
+    # cannot walk a hand-authored quote out of scope. The write gate and the
+    # Bash gate match the same buckets recursively; all three must agree.
+    m = re.search(r'(?:^|/)jobs/([^/]+)/(?:quote|Quotations)/.+\.pdf$', norm)
+    if m:
+        jobid = m.group(1)
+if jobid is None:
+    sys.exit(0)
+
+# A jobId is a single path segment. A separator or traversal in it never keys a
+# legitimate receipt, so treat it as a bypass rather than resolving a stray file.
+if "/" in jobid or ".." in jobid:
+    print("block bad-jobid " + jobid)
     sys.exit(0)
-print(m.group(1))
+
+base = os.environ.get("ACCT") or os.getcwd()
+abs_pdf = norm if os.path.isabs(norm) else os.path.join(base, norm)
+sibling = abs_pdf[:-4] + ".html"
+if not os.path.isfile(sibling):
+    print("block no-source-html " + jobid)
+    sys.exit(0)
+
+
+def sha256(p):
+    h = hashlib.sha256()
+    with open(p, "rb") as fh:
+        for chunk in iter(lambda: fh.read(1 << 16), b""):
+            h.update(chunk)
+    return h.hexdigest()
+
+
+try:
+    with open(os.path.join(base, "quoting", "jobs", jobid, "render-receipt.json")) as fh:
+        filed = (json.load(fh) or {}).get("filed") or {}
+except Exception:
+    print("block not-receipt-filed " + jobid)
+    sys.exit(0)
+
+try:
+    want = sha256(sibling)
+except Exception:
+    print("block no-source-html " + jobid)
+    sys.exit(0)
+
+for key in ("quote", "breakdown"):
+    cand = filed.get(key)
+    if not isinstance(cand, str) or not cand:
+        continue
+    cpath = cand if os.path.isabs(cand) else os.path.join(base, cand)
+    try:
+        if sha256(cpath) == want:
+            print("allow")
+            sys.exit(0)
+    except Exception:
+        continue
+print("block not-receipt-filed " + jobid)
 PY
 )
 
-# Not a gated client-quote artefact → allow.
-[ -z "$JOBID" ] && exit 0
+case "$DECISION" in
+  ""|allow) exit 0 ;;
+esac
 
-# A jobId is a single path segment. A separator or traversal in it never keys a
-# legitimate receipt, so treat it as a bypass rather than resolving a stray file.
-case "$JOBID" in
-  */*|*..*)
-    echo "[quote-render] op=bypass jobId=$JOBID reason=bad-jobid" >&2
+REASON=$(printf '%s' "$DECISION" | cut -d' ' -f2)
+JOBID=$(printf '%s' "$DECISION" | cut -d' ' -f3-)
+echo "[quote-render] op=bypass jobId=$JOBID reason=$REASON" >&2
+case "$REASON" in
+  no-source-html)
+    echo "Blocked: this client quote PDF has no source document beside it, so there is nothing to check it against. Produce the quote with the quote-render tool, which files the document and its render receipt, then print the path it returns." >&2
+    ;;
+  bad-jobid)
     echo "Blocked: this looks like a client quote PDF but its name does not resolve to a job. Produce the quote with the quote-render tool, which files the document and its render receipt, then print the path it returns." >&2
-    exit 2
+    ;;
+  *)
+    echo "Blocked: this client quote was not produced by the quote-render tool, so its fixed layout and the reconcile, margin-leak and link-liveness gates never ran. Run quote-render for this job (it files the document and its receipt), then print the client HTML path it returns to PDF." >&2
     ;;
 esac
-
-# The receipt lives beside the job's figures, written by quote-render only after
-# every gate passed. Its presence is the proof the deterministic path ran.
-if [ -f "$PWD/quoting/jobs/$JOBID/render-receipt.json" ]; then
-  exit 0
-fi
-
-echo "[quote-render] op=bypass jobId=$JOBID detail=client quote PDF has no render receipt" >&2
-echo "Blocked: this client quote was not produced by the quote-render tool, so its fixed layout and the reconcile, margin-leak and link-liveness gates never ran. Run quote-render for this job (it files the document and its receipt), then print the client HTML path it returns to PDF." >&2
 exit 2

package/payload/platform/plugins/admin/hooks/quote-render-pdf-conformance.sh

@@ -30,6 +30,184 @@ if [ -t 0 ]; then exit 0; fi
 INPUT=$(cat)
 [ -z "$INPUT" ] && exit 0
 
+# --- log sink ---------------------------------------------------------------
+# A hook's stderr on exit 0 is not an observable sink: measured 2026-08-06 on the
+# laptop's sitedesk-code install, no bracketed hook line has ever reached
+# server.log (live or rotated) or the JSONL transcripts. The sibling inject hooks
+# each write their own file under the resolved log dir; the header conformance
+# line below does the same, so a clean run is distinguishable from a check that
+# never ran. The ladder mirrors mailbox-inject.sh: LOG_DIR is stamped only on the
+# rc-spawn path, CLAUDE_SESSION_MANAGER_PERSIST_DIR is on the systemd unit and
+# resolves to the same directory, ACCOUNT_DIR/logs is the last resort.
+ACCT_DIR=""
+if [ -n "${ACCOUNT_DIR:-}" ] && [ -d "${ACCOUNT_DIR}" ]; then ACCT_DIR="$ACCOUNT_DIR"; fi
+LOGD=""
+if [ -n "${LOG_DIR:-}" ] && [ -d "${LOG_DIR}" ]; then
+  LOGD="$LOG_DIR"
+elif [ -n "${CLAUDE_SESSION_MANAGER_PERSIST_DIR:-}" ] && [ -d "${CLAUDE_SESSION_MANAGER_PERSIST_DIR}/logs" ]; then
+  LOGD="$CLAUDE_SESSION_MANAGER_PERSIST_DIR/logs"
+elif [ -n "$ACCT_DIR" ] && [ -d "$ACCT_DIR/logs" ]; then
+  LOGD="$ACCT_DIR/logs"
+fi
+SID=$(printf '%s' "$INPUT" | python3 -c 'import json,sys
+try:
+    print(json.load(sys.stdin).get("session_id","") or "?")
+except Exception:
+    print("?")' 2>/dev/null)
+SID=${SID:-?}
+NOW_ISO=$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || echo "?")
+
+emit_log() {
+  local line="$NOW_ISO [quote-render] $1 session=$SID"
+  if [ -n "$LOGD" ]; then
+    # stderr redirect FIRST: with the append first, bash emits its own
+    # "Permission denied" on an unwritable log before 2>/dev/null takes effect,
+    # and that escapes to the hook's stderr on every print.
+    printf '%s\n' "$line" 2>/dev/null >> "$LOGD/quote-render-conformance.log" || true
+  fi
+  echo "$line" >&2 || true
+}
+
+# --- per-physical-page running-header conformance ---------------------------
+# Chrome decides physical pagination at print time, so a document whose header is
+# a hand-placed div next to a hand-placed page break loses that header on any page
+# the content bled onto. This stage is deliberately receipt-free and path-
+# agnostic: template-seeded documents (budget estimates, valuations, works
+# orders, survey sheets) never pass through the quote renderer and so have no
+# receipt, and they are exactly the documents that reproduce the fault.
+#
+# It only ever gates a document that DECLARES a running header in a @page top
+# margin box, so a brochure or any document without one is never blocked.
+HRESULT=$(INPUT="$INPUT" BASE="$PWD" python3 - <<'PY' 2>/dev/null || true
+import os, json, re, sys, subprocess, html as htmlmod
+
+def out(s):
+    print(s)
+    sys.exit(0)
+
+try:
+    d = json.loads(os.environ["INPUT"])
+except Exception:
+    sys.exit(0)  # uninspectable envelope -> fail open
+if not (d.get("tool_name", "") or "").endswith("browser-pdf-save"):
+    sys.exit(0)
+pdf = (d.get("tool_input", {}) or {}).get("path", "") or ""
+if not pdf or not os.path.isfile(pdf):
+    sys.exit(0)  # PDF not written -> nothing to inspect
+base = os.path.basename(pdf)
+
+# Source HTML: the render receipt for a gated client quote, else the sibling
+# .html beside the PDF. The sibling is the documented browser-pdf-save
+# convention (invoicing.md step 4, document-management.md step 4: print the HTML
+# to an absolute .pdf path alongside it, same name).
+src = ""
+m = re.search(r'(?:^|/)memory/users/[^/]+/documents/quote-(.+?)(-breakdown)?\.pdf$',
+              os.path.normpath(pdf))
+if m and "/" not in m.group(1) and ".." not in m.group(1):
+    try:
+        r = json.load(open(os.path.join(os.environ["BASE"], "quoting", "jobs",
+                                        m.group(1), "render-receipt.json")))
+        src = (r.get("filed", {}) or {}).get("breakdown" if m.group(2) else "quote", "")
+    except Exception:
+        src = ""
+if not src or not os.path.isfile(src):
+    sib = os.path.splitext(pdf)[0] + ".html"
+    src = sib if os.path.isfile(sib) else ""
+if not src:
+    out("LOG|op=pdf-header-conformance file=%s pagesChecked=0 reason=no-source-html" % base)
+try:
+    doc = open(src, encoding="utf-8", errors="replace").read()
+except Exception:
+    out("LOG|op=pdf-header-conformance file=%s pagesChecked=0 reason=no-source-html" % base)
+
+# The marker is the literal string content of a @top-* box. A content:url() logo
+# box carries no text and is skipped: only extractable text can be asserted per
+# page. EVERY declaration of each box is considered, not just the first, because
+# @page :first declares the same boxes with empty content to suppress them on
+# page 1 and CSS does not fix the order of the two rules — taking the first match
+# alone would read the suppression rule as "no running header" and silently skip
+# the check on any document that declared :first before @page.
+def unesc(s):
+    s = htmlmod.unescape(s)
+    s = re.sub(r'\\([0-9a-fA-F]{1,6})\s?', lambda g: chr(int(g.group(1), 16)), s)
+    return s.replace('\\"', '"').replace("\\\\", "\\").strip()
+
+marker = ""
+for box in ("top-center", "top-right", "top-left"):
+    for mm in re.finditer(r'@' + box + r'\s*\{[^}]*?content\s*:\s*"((?:[^"\\]|\\.)*)"', doc, re.S):
+        cand = unesc(mm.group(1))
+        if len(cand) >= 4:
+            marker = cand
+            break
+    if marker:
+        break
+if not marker:
+    out("LOG|op=pdf-header-conformance file=%s pagesChecked=0 reason=no-running-header" % base)
+
+try:
+    info = subprocess.run(["pdfinfo", pdf], capture_output=True, text=True, timeout=20)
+    pages = int(re.search(r'^Pages:\s+(\d+)', info.stdout, re.M).group(1))
+except Exception:
+    out("LOG|op=pdf-header-conformance file=%s pagesChecked=0 reason=no-poppler" % base)
+
+# The marker must be found in the TOP BAND of the page, not anywhere on it. A
+# running footer routinely repeats the same reference as the header (the GLS
+# footer is "… Builders Est. 1987 · Quote <ref>"), so a whole-page text match
+# reports a header on a page that has only a footer — measured on a real
+# 10-page print, where page 1 matched on its footer alone while its header was
+# correctly suppressed by @page :first. Cropping to the top 12% of the page
+# covers a top margin as deep as 30mm on A4 and excludes the footer entirely.
+sz = re.search(r'^Page size:\s+([\d.]+) x ([\d.]+)', info.stdout, re.M)
+pw, ph = (float(sz.group(1)), float(sz.group(2))) if sz else (595.0, 842.0)
+band = max(1, int(ph * 0.12))
+crop = ["-x", "0", "-y", "0", "-W", str(int(pw) + 1), "-H", str(band)]
+
+# @page :first suppresses the margin boxes on page 1, which carries its own
+# masthead instead; without it every physical page is expected to carry one.
+first = 2 if re.search(r'@page\s*:first', doc) else 1
+if pages < first:
+    out("LOG|op=pdf-header-conformance file=%s pages=%d pagesChecked=0 reason=single-page"
+        % (base, pages))
+
+def norm(s):
+    return re.sub(r'\s+', ' ', s).strip()
+
+want = norm(marker)
+missing = []
+for p in range(first, pages + 1):
+    try:
+        t = subprocess.run(["pdftotext", "-f", str(p), "-l", str(p)] + crop + [pdf, "-"],
+                           capture_output=True, text=True, timeout=20).stdout
+    except Exception:
+        out("LOG|op=pdf-header-conformance file=%s pagesChecked=0 reason=no-poppler" % base)
+    if want not in norm(t):
+        missing.append(p)
+
+checked = pages - first + 1
+if missing:
+    print("LOG|op=pdf-header-conformance file=%s pages=%d pagesChecked=%d pagesHeaderless=%d"
+          % (base, pages, checked, len(missing)))
+    out("HBLOCK|%s|pagesHeaderless=%d pages=%s"
+        % (base, len(missing), ",".join(str(x) for x in missing)))
+out("LOG|op=pdf-header-conformance file=%s pages=%d pagesChecked=%d pagesHeaderless=0"
+    % (base, pages, checked))
+PY
+)
+
+while IFS= read -r hline; do
+  case "$hline" in
+    LOG\|*) emit_log "${hline#LOG|}" ;;
+    HBLOCK\|*)
+      hrest=${hline#HBLOCK|}
+      hfile=${hrest%%|*}
+      hdetail=${hrest#*|}
+      emit_log "op=bypass file=$hfile reason=pdf-header-conformance detail=$hdetail"
+      echo "Blocked: this printed document has physical pages carrying no running header, so it would go out with unbranded pages ($hdetail). The header must be a property of the page itself, a page margin box, not a header block placed next to a declared page break, because the browser decides the real page boundaries at print time. Fix the document's print CSS, print it again, and check every page." >&2
+      exit 2
+      ;;
+  esac
+done <<< "$HRESULT"
+
 RESULT=$(INPUT="$INPUT" BASE="$PWD" python3 - <<'PY' 2>/dev/null || true
 import os, json, re, sys, urllib.request
 

package/payload/platform/plugins/admin/mcp/dist/lib/roster-census.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roster-census.d.ts","sourceRoot":"","sources":["../../src/lib/roster-census.ts"],"names":[],"mappings":"AAmCA,MAAM,WAAW,iBAAiB;IAChC,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC;IACrB;;;uDAGmD;IACnD,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;;uBAImB;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB;;;qBAGiB;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB;;;;4EAIwE;IACxE,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B;;qEAEiE;IACjE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;oEAEgE;IAChE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB;;;;sEAIkE;IAClE,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAyCD,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,kBAAkB,CAqC5E"}
+{"version":3,"file":"roster-census.d.ts","sourceRoot":"","sources":["../../src/lib/roster-census.ts"],"names":[],"mappings":"AAmCA,MAAM,WAAW,iBAAiB;IAChC,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC;IACrB;;;uDAGmD;IACnD,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;;uBAImB;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB;;;qBAGiB;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB;;;;4EAIwE;IACxE,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B;;qEAEiE;IACjE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;oEAEgE;IAChE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB;;;;sEAIkE;IAClE,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAoFD,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,kBAAkB,CAsC5E"}

package/payload/platform/plugins/admin/mcp/dist/lib/roster-census.js

@@ -10,6 +10,49 @@ function markdownIn(dir) {
         return [];
     return readdirSync(dir).filter((entry) => entry.endsWith(".md"));
 }
+/** The `name:` value from a card's frontmatter, or null. CRLF-tolerant and
+ *  quote-stripping, the same idiom `specialist-roster.ts` and `spawn-context.ts`
+ *  use, so all three agree on what a card is called. A card that cannot be read
+ *  — a dangling registry symlink, EACCES, a directory at the path — yields
+ *  null, which is the honest answer to "does this resolve?". */
+function frontmatterName(file) {
+    let raw;
+    try {
+        raw = readFileSync(file, "utf8");
+    }
+    catch {
+        return null;
+    }
+    const fm = raw.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+    if (!fm)
+        return null;
+    const m = fm[1].match(/^name:\s*(.*?)\r?$/m);
+    if (!m)
+        return null;
+    let value = m[1].trim();
+    if ((value.startsWith('"') && value.endsWith('"')) ||
+        (value.startsWith("'") && value.endsWith("'"))) {
+        value = value.slice(1, -1);
+    }
+    return value || null;
+}
+/** Every subagent name the CLI can resolve from `registryDir`.
+ *
+ *  Task 2469 — keyed on the frontmatter `name`, not the filename. Those differ
+ *  by construction for a bundle-scoped card: `glsmith--order-clerk.md`
+ *  registers `order-clerk`, and `order-clerk` is also what AGENTS.md declares,
+ *  so asking for `<rosterName>.md` missed all four of GLS's clerks while every
+ *  one of them dispatched. For a bare card the filename stem and the name are
+ *  equal, so nothing about that class changes. */
+function resolvableNames(registryDir) {
+    const names = new Set();
+    for (const filename of markdownIn(registryDir)) {
+        const name = frontmatterName(join(registryDir, filename));
+        if (name !== null)
+            names.add(name);
+    }
+    return names;
+}
 function subdirs(dir) {
     if (!existsSync(dir))
         return [];
@@ -45,10 +88,13 @@ export function runRosterCensus(input) {
     }
     // Task 2460 — measured against the registry, not the source directory. Those
     // two disagreed on the account that filed that task: 13 authored, 12
-    // registered, and this line reported zero orphans three times. existsSync
-    // follows symlinks, so a dangling registry link reads as absent, which is
-    // correct — it does not resolve.
-    const orphaned = declared.filter((name) => !existsSync(join(input.registryDir, `${name}.md`)));
+    // registered, and this line reported zero orphans three times.
+    //
+    // Task 2469 — and measured by the name the registry actually resolves rather
+    // than by filename. A dangling link still reads as absent, because reading it
+    // throws and yields no name.
+    const resolvable = resolvableNames(input.registryDir);
+    const orphaned = declared.filter((name) => !resolvable.has(name));
     const durable = new Set();
     for (const dir of input.durableDirs) {
         for (const filename of markdownIn(dir))

package/payload/platform/plugins/admin/mcp/dist/lib/roster-census.js.map

@@ -1 +1 @@
-{"version":3,"file":"roster-census.js","sourceRoot":"","sources":["../../src/lib/roster-census.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAkFjC;;;;uDAIuD;AACvD,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SAC7C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SACtC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,iBAAiB,CACxB,oBAA4B,EAC5B,iBAA0B;IAE1B,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3C,4EAA4E;IAC5E,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,wEAAwE;IACxE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,0EAA0E;IAC1E,6EAA6E;IAC7E,cAAc;IACd,OAAO,UAAU,CAAC,oBAAoB,CAAC;SACpC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;SACrC,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CACvF,CAAC;AACN,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAwB;IACtD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC;QACzC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC;QAC1C,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EAAE,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,6EAA6E;IAC7E,qEAAqE;IACrE,0EAA0E;IAC1E,0EAA0E;IAC1E,iCAAiC;IACjC,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAC9B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAC7D,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACpC,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC5C,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAC7D,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CACrC,CAAC;IAEF,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,MAAM;QACzB,YAAY,EAAE,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM;QAC/C,QAAQ;QACR,SAAS;QACT,aAAa,EAAE,iBAAiB,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,iBAAiB,CAAC;KACtF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"roster-census.js","sourceRoot":"","sources":["../../src/lib/roster-census.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAkFjC;;;;uDAIuD;AACvD,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;gEAIgE;AAChE,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC7C,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxB,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;QACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,IAAI,IAAI,CAAC;AACvB,CAAC;AAED;;;;;;;kDAOkD;AAClD,SAAS,eAAe,CAAC,WAAmB;IAC1C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1D,IAAI,IAAI,KAAK,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SAC7C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SACtC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,iBAAiB,CACxB,oBAA4B,EAC5B,iBAA0B;IAE1B,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3C,4EAA4E;IAC5E,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,wEAAwE;IACxE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,0EAA0E;IAC1E,6EAA6E;IAC7E,cAAc;IACd,OAAO,UAAU,CAAC,oBAAoB,CAAC;SACpC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;SACrC,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CACvF,CAAC;AACN,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAwB;IACtD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC;QACzC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC;QAC1C,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EAAE,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,6EAA6E;IAC7E,qEAAqE;IACrE,+DAA+D;IAC/D,EAAE;IACF,6EAA6E;IAC7E,8EAA8E;IAC9E,6BAA6B;IAC7B,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAElE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACpC,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC5C,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAC7D,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CACrC,CAAC;IAEF,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,MAAM;QACzB,YAAY,EAAE,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM;QAC/C,QAAQ;QACR,SAAS;QACT,aAAa,EAAE,iBAAiB,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,iBAAiB,CAAC;KACtF,CAAC;AACJ,CAAC"}

package/payload/platform/plugins/admin/skills/a4-print-documents/SKILL.md

@@ -62,10 +62,21 @@ Each glassmorphism section needs its own screenshot — you cannot reuse a print
 4. **Capture the specific element** with `browser-screenshot` passing the element's CSS selector (e.g. `.cover`, `.backpage`) — the selector clips to that element, not the full page.
 5. **Save the PNG** alongside the HTML, named for the section it replaces (e.g. `cover-print.png`, `backpage-print.png`).
 6. **Restore** hidden elements and overflow with `browser-evaluate` after capture.
-7. **Verify** the saved PNG visually — confirm no scrollbars, no UI chrome, correct dimensions.
+7. **Verify** the saved PNG — confirm no scrollbars, no UI chrome, correct dimensions. Do not compose your own rasterise or cleanup shell for this or for the PDF check below. A hand-written removal whose target is a shell variable joined to a wildcard is a target Claude Code's `dangerousRemoval` check cannot resolve, and that check ignores bypass-permissions mode, so the call stalls behind a card no channel operator can answer.
 
 After capturing all print images, save the final PDF with `browser-pdf-save` to the output path.
 
+### Verifying the saved PDF
+
+Check the produced PDF with the shipped inspector rather than a hand-composed `pdfinfo`/`pdftoppm` shell:
+
+    PDF=/abs/path/to/output.pdf \
+      node "$PLATFORM_ROOT/plugins/admin/skills/a4-print-documents/pdf-inspect.mjs"
+
+It prints the page count, the page size in points, and one absolute PNG path per page, then exits 0. Read those PNGs to confirm the rendered result. Pass `OUT=/abs/dir` to render into a stable directory (it clears only its own prior `pg-*.png` output); pass `DPI=<n>` to change the default 150. A non-zero exit means nothing was rendered.
+
+Never write your own rasterise shell for this. Such shells converge on a cleanup step whose removal target is a scratch-dir variable joined to a wildcard, and that target is refused by a check bypass-permissions mode cannot override, so the resulting card stalls the session invisibly.
+
 ## Page margins, page numbers, and running footers
 
 Use `@page` margin boxes for page numbers and running footers — not `position: fixed` elements.

package/payload/platform/plugins/admin/skills/a4-print-documents/pdf-inspect.mjs

@@ -0,0 +1,113 @@
+#!/usr/bin/env node
+/**
+ * pdf-inspect.mjs — the A4 print-document PDF check.
+ *
+ * Prints a PDF's page count and page size, rasterises every page to PNG, and
+ * prints the absolute PNG paths. No shell, ever.
+ *
+ * This ships with the platform rather than being written out by the agent at
+ * dispatch time, because the agent-authored version was the defect. Each
+ * specialist composed its own rasterise shell, and the shape it converged on
+ * was a `cd`, a scratch-dir variable, a forced removal of that variable joined
+ * to a PNG wildcard, then pdfinfo and pdftoppm.
+ * The removal target there is a shell variable plus a glob, which Claude Code's
+ * static analyser cannot resolve; its `dangerousRemoval` check is
+ * `bypassImmune: true`, so no permission rule and no permission mode
+ * pre-approves it. The card it raises inside a background subagent has no
+ * prompt surface a channel operator can reach, and the session stalls
+ * (Task 2476). Precedent: e-sign/stamp.mjs under Task 1921.
+ *
+ * Every external command runs through execFileSync with an argv array, so no
+ * shell parses any argument: no glob expansion, no variable expansion, no word
+ * splitting anywhere in this path.
+ *
+ * Invocation (the skill's PDF verify step):
+ *
+ *   PDF=<abs path to pdf> [OUT=<abs dir>] [DPI=<n>] \
+ *     node "$PLATFORM_ROOT/plugins/admin/skills/a4-print-documents/pdf-inspect.mjs"
+ *
+ * With no OUT the output directory is created by mkdtempSync and is fresh per
+ * run. With OUT the directory is reused, and this script's own prior output is
+ * removed by unlinkSync on absolute paths built from readdirSync — never `rm`,
+ * never a glob.
+ *
+ * Exit 0 prints one record line then the absolute PNG paths, one per line:
+ *
+ *   [pdf-inspect] pages=<n> pageSize=<w>x<h>pts dpi=<n> outDir=<abs> pngs=<n>
+ *
+ * Any non-zero exit means nothing was rendered.
+ */
+
+import { execFileSync } from 'node:child_process'
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, statSync, unlinkSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, isAbsolute } from 'node:path'
+
+const TAG = '[pdf-inspect]'
+/** Every PNG this script writes starts here. The cleanup below removes only
+ *  files matching this prefix, so a caller-supplied OUT holding other work is
+ *  never touched. */
+const PREFIX = 'pg'
+
+function die(message) {
+  process.stderr.write(`${TAG} error=${message}\n`)
+  process.exit(1)
+}
+
+const pdf = process.env.PDF
+if (!pdf) die('PDF is required (absolute path to the pdf)')
+if (!isAbsolute(pdf)) die(`PDF must be an absolute path, got ${JSON.stringify(pdf)}`)
+if (!existsSync(pdf)) die(`no such file: ${pdf}`)
+
+const dpi = process.env.DPI ? Number(process.env.DPI) : 150
+if (!Number.isFinite(dpi) || dpi <= 0) die(`DPI must be a positive number, got ${JSON.stringify(process.env.DPI)}`)
+
+let outDir = process.env.OUT
+if (outDir) {
+  if (!isAbsolute(outDir)) die(`OUT must be an absolute path, got ${JSON.stringify(outDir)}`)
+  mkdirSync(outDir, { recursive: true })
+  // Reused directory: remove THIS script's prior output by absolute path.
+  // readdirSync gives literal names, so nothing here is ever a pattern.
+  for (const name of readdirSync(outDir)) {
+    if (name.startsWith(`${PREFIX}-`) && name.endsWith('.png')) {
+      unlinkSync(join(outDir, name))
+    }
+  }
+} else {
+  // Fresh per run, so there is no prior output to remove.
+  outDir = mkdtempSync(join(tmpdir(), 'pdf-inspect-'))
+}
+
+function run(bin, args) {
+  try {
+    return execFileSync(bin, args, { encoding: 'utf8' })
+  } catch (err) {
+    if (err && err.code === 'ENOENT') die(`${bin} not found — install poppler-utils`)
+    die(`${bin} failed: ${err instanceof Error ? err.message : String(err)}`)
+  }
+}
+
+const info = run('pdfinfo', [pdf])
+const pagesMatch = info.match(/^Pages:\s+(\d+)$/m)
+const sizeMatch = info.match(/^Page size:\s+([\d.]+) x ([\d.]+) pts/m)
+if (!pagesMatch) die('pdfinfo reported no page count')
+const pages = Number(pagesMatch[1])
+if (pages < 1) die(`pdf has ${pages} pages`)
+const pageSize = sizeMatch ? `${sizeMatch[1]}x${sizeMatch[2]}` : 'unknown'
+
+run('pdftoppm', ['-r', String(dpi), '-png', pdf, join(outDir, PREFIX)])
+
+const pngs = readdirSync(outDir)
+  .filter((n) => n.startsWith(`${PREFIX}-`) && n.endsWith('.png'))
+  .sort()
+  .map((n) => join(outDir, n))
+
+if (pngs.length === 0) die('pdftoppm wrote no PNGs')
+for (const p of pngs) {
+  if (statSync(p).size === 0) die(`empty PNG: ${p}`)
+}
+
+process.stdout.write(
+  `${TAG} pages=${pages} pageSize=${pageSize}pts dpi=${dpi} outDir=${outDir} pngs=${pngs.length}\n`,
+)
+for (const p of pngs) process.stdout.write(`${p}\n`)