instar 1.2.54 → 1.2.55

package/.claude/skills/autonomous/hooks/autonomous-stop-hook.sh

@@ -4,167 +4,306 @@
 # Prevents session exit when autonomous mode is active.
 # Feeds the goal and task list back to continue working.
 #
-# SESSION-SCOPED: Only blocks the session that activated autonomous mode.
-# Other sessions on the same machine pass through unaffected.
+# TOPIC-KEYED OWNERSHIP (primary): the autonomous job is identified by the
+# TOPIC it serves, not by the Claude session UUID. The topic is a stable
+# "street address" — when a session hits the memory limit and restarts, its
+# UUID rotates (a new badge) but instar respawns it into the SAME tmux session
+# name, and the topic-session registry still maps that name to the same topic.
+# So whoever is running in the topic's session is recognized as continuing the
+# job, restart or no restart. This fixes the silent-failure bug where a restart
+# rotated the UUID, mismatched the state file, and let autonomy die unnoticed.
 #
-# RESPECTS:
-# - Session isolation (only blocks the autonomous session)
-# - Emergency stop signals (user says "stop everything")
-# - Duration expiry
-# - Genuine completion (all tasks done, promise output)
+# LIVENESS-GATED BACKSTOP (rare): when topic resolution is unavailable (no tmux,
+# or the topic isn't in the registry) the hook falls back to session-id matching.
+# A session-id mismatch is then gated by a liveness check on the recorded owner
+# (is its transcript still growing?) — a dead owner is adopted, a live one is
+# left alone. This is the demoted role of the old liveness idea: a thin edge
+# guard, not the main mechanism.
+#
+# RECOVERY NOTE: on an actual restart-and-resume (topic verified, but the
+# session UUID changed) the hook emits ONE user-facing one-line note and an
+# audit record, then records the new UUID so the note never repeats.
+#
+# RESPECTS: emergency stop, duration expiry, genuine completion (promise).
 
-set -euo pipefail
+set -uo pipefail   # NOTE: -e intentionally omitted; field lookups for optional
+                   # frontmatter keys are expected to "fail" (grep finds nothing)
+                   # and must not abort the hook. Each critical step guards itself.
 
 # Read hook input from stdin
 HOOK_INPUT=$(cat)
 
-# Check if autonomous mode is active
 STATE_FILE=".instar/autonomous-state.local.md"
+REGISTRY_FILE=".instar/topic-session-registry.json"
+RECOVERY_AUDIT=".instar/autonomous-recovery.jsonl"
+LIVENESS_SECS="${INSTAR_AUTONOMOUS_LIVENESS_SECS:-120}"
 
 if [[ ! -f "$STATE_FILE" ]]; then
   # No active autonomous session — allow exit
   exit 0
 fi
 
-# Parse YAML frontmatter
+# Parse YAML frontmatter (between the first two --- lines)
 FRONTMATTER=$(sed -n '/^---$/,/^---$/{ /^---$/d; p; }' "$STATE_FILE")
 
-ACTIVE=$(echo "$FRONTMATTER" | grep '^active:' | sed 's/active: *//')
+# Safe frontmatter field reader — never trips pipefail when a key is absent.
+fm_get() {
+  local key="$1"
+  printf '%s\n' "$FRONTMATTER" | grep "^${key}:" | head -1 | sed "s/^${key}: *//" | tr -d '"' || true
+}
+
+ACTIVE=$(fm_get active)
 if [[ "$ACTIVE" != "true" ]]; then
   exit 0
 fi
 
-# SESSION ISOLATION: Only block the session that started autonomous mode.
-# Uses self-bootstrapping: if no session_id in state file yet, the FIRST
-# session to trigger the hook claims it. All other sessions see a mismatch.
-STATE_SESSION=$(echo "$FRONTMATTER" | grep '^session_id:' | sed 's/^session_id: *//' | tr -d '"' || true)
+# ── Inputs from the hook ──────────────────────────────────────────────
+HOOK_SESSION=$(printf '%s' "$HOOK_INPUT" | jq -r '.session_id // ""' 2>/dev/null || echo "")
+TRANSCRIPT_PATH=$(printf '%s' "$HOOK_INPUT" | jq -r '.transcript_path // ""' 2>/dev/null || echo "")
 
-# VALIDATE: If state has a session_id but it's not a valid UUID, treat as empty.
-# Claude sometimes writes a custom string instead of the real $CLAUDE_CODE_SESSION_ID.
-# Non-UUID values will never match the real hook session_id, causing the hook to
-# fail-open and allow premature exit. By clearing invalid values, we fall through
-# to self-bootstrap, which captures the REAL session_id from the first hook call.
+# If hook has no session_id → fail OPEN (unknown context, don't trap)
+if [[ -z "$HOOK_SESSION" ]]; then
+  echo "⚠️  Autonomous mode: No session_id in hook input — fail-open (allowing exit)" >&2
+  exit 0
+fi
+
+# ── State fields ──────────────────────────────────────────────────────
+REPORT_TOPIC=$(fm_get report_topic)
+# Channel that owns this job — recovery note routes here. Default telegram for
+# back-compat (state files written before channel-neutral delivery existed).
+REPORT_CHANNEL=$(fm_get report_channel)
+[[ -z "$REPORT_CHANNEL" ]] && REPORT_CHANNEL="telegram"
+STATE_SESSION=$(fm_get session_id)
+ITERATION=$(fm_get iteration)
+DURATION_SECONDS=$(fm_get duration_seconds)
+STARTED_AT=$(fm_get started_at)
+COMPLETION_PROMISE=$(fm_get completion_promise)
+
+# Validate recorded session_id is a real UUID. Claude sometimes writes a custom
+# string instead of $CLAUDE_CODE_SESSION_ID; non-UUID values are treated as
+# empty so the session-match backstop self-bootstraps from the real UUID.
 UUID_REGEX='^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
 if [[ -n "$STATE_SESSION" ]] && ! [[ "$STATE_SESSION" =~ $UUID_REGEX ]]; then
-  echo "[autonomous] Invalid session_id in state file (not UUID): '$STATE_SESSION' — falling back to self-bootstrap" >&2
+  echo "[autonomous] Invalid session_id in state file (not UUID): '$STATE_SESSION' — clearing" >&2
   STATE_SESSION=""
 fi
 
-HOOK_SESSION=$(echo "$HOOK_INPUT" | jq -r '.session_id // ""' 2>/dev/null || echo "")
-
-# If hook has no session_id → fail OPEN (unknown context, don't trap)
-if [[ -z "$HOOK_SESSION" ]]; then
-  echo "⚠️  Autonomous mode: No session_id in hook input — fail-open (allowing exit)" >&2
-  exit 0
+# ── Resolve MY topic (the stable address) ─────────────────────────────
+# Test/override seam: INSTAR_HOOK_TMUX_SESSION (if the var is set at all, even
+# empty, it wins — empty means "no tmux"). INSTAR_HOOK_NO_TMUX=1 forces empty.
+resolve_my_tmux() {
+  if [[ "${INSTAR_HOOK_NO_TMUX:-}" == "1" ]]; then
+    echo ""
+    return
+  fi
+  if [[ -n "${INSTAR_HOOK_TMUX_SESSION+x}" ]]; then
+    echo "${INSTAR_HOOK_TMUX_SESSION}"
+    return
+  fi
+  tmux display-message -p '#S' 2>/dev/null || echo ""
+}
+MY_TMUX=$(resolve_my_tmux)
+
+# Reverse-lookup: which tmux session owns REPORT_TOPIC per the registry?
+OWNER_TMUX=""
+if [[ -n "$REPORT_TOPIC" ]] && [[ -f "$REGISTRY_FILE" ]]; then
+  OWNER_TMUX=$(REPORT_TOPIC="$REPORT_TOPIC" python3 -c "
+import json, os
+try:
+    reg = json.load(open('$REGISTRY_FILE'))
+    print((reg.get('topicToSession') or {}).get(os.environ['REPORT_TOPIC'], ''))
+except Exception:
+    print('')
+" 2>/dev/null || echo "")
 fi
 
-# SELF-BOOTSTRAP: If state has no session_id yet, claim it from this hook call.
-# The first session to fire the hook becomes the autonomous session.
-if [[ -z "$STATE_SESSION" ]]; then
-  # Atomic claim: write session_id to state file
-  TEMP_FILE="${STATE_FILE}.claim.$$"
-  sed "s/^session_id:.*/session_id: \"${HOOK_SESSION}\"/" "$STATE_FILE" > "$TEMP_FILE"
-  mv "$TEMP_FILE" "$STATE_FILE"
-  STATE_SESSION="$HOOK_SESSION"
-  echo "[autonomous] Session $HOOK_SESSION claimed autonomous mode" >&2
+# ── Ownership decision ────────────────────────────────────────────────
+# OWNER=true means: this session IS the autonomous worker; block its exit.
+# OWNER_METHOD records how we decided (topic | session | bootstrap | adopt-dead).
+OWNER="false"
+OWNER_METHOD=""
+RESTART_DETECTED="false"
+
+if [[ -n "$MY_TMUX" ]] && [[ -n "$OWNER_TMUX" ]]; then
+  # Topic resolution is conclusive.
+  if [[ "$MY_TMUX" == "$OWNER_TMUX" ]]; then
+    OWNER="true"; OWNER_METHOD="topic"
+    # Restart? Recorded UUID is a real UUID but differs from the live one.
+    if [[ -n "$STATE_SESSION" ]] && [[ "$STATE_SESSION" != "$HOOK_SESSION" ]]; then
+      RESTART_DETECTED="true"
+    fi
+  else
+    # Registry says topic T is served by a different session → not me.
+    exit 0
+  fi
+else
+  # ── Backstop: topic unresolved (no tmux, or topic not in registry) ──
+  if [[ -z "$STATE_SESSION" ]]; then
+    # Self-bootstrap: first session to fire claims the job.
+    OWNER="true"; OWNER_METHOD="bootstrap"
+  elif [[ "$STATE_SESSION" == "$HOOK_SESSION" ]]; then
+    OWNER="true"; OWNER_METHOD="session"
+  else
+    # Session-id mismatch with no topic signal. Gate on recorded owner liveness.
+    OWNER_ALIVE="false"
+    if [[ -n "$TRANSCRIPT_PATH" ]]; then
+      OWNER_TRANSCRIPT="$(dirname "$TRANSCRIPT_PATH")/${STATE_SESSION}.jsonl"
+      if [[ -f "$OWNER_TRANSCRIPT" ]]; then
+        NOW_E=$(date +%s)
+        # GNU stat (-c %Y) first — Linux is the common host (and CI). BSD stat
+        # (-f %m) second for macOS. NOTE: GNU `stat -f` is filesystem mode and
+        # SUCCEEDS with non-numeric output, so BSD-first would mask the GNU path
+        # on Linux and feed garbage into the arithmetic below. The numeric guard
+        # is the backstop: a non-numeric mtime is treated as 0 (very old → dead).
+        MTIME=$(stat -c %Y "$OWNER_TRANSCRIPT" 2>/dev/null || stat -f %m "$OWNER_TRANSCRIPT" 2>/dev/null || echo 0)
+        [[ "$MTIME" =~ ^[0-9]+$ ]] || MTIME=0
+        AGE=$(( NOW_E - MTIME ))
+        if [[ $MTIME -gt 0 ]] && [[ $AGE -lt $LIVENESS_SECS ]]; then
+          OWNER_ALIVE="true"
+        fi
+      fi
+    fi
+    if [[ "$OWNER_ALIVE" == "true" ]]; then
+      # A genuinely different, live session owns this — don't steal.
+      exit 0
+    fi
+    # Recorded owner is dead/unknown → adopt the job.
+    OWNER="true"; OWNER_METHOD="adopt-dead"; RESTART_DETECTED="true"
+  fi
 fi
 
-# Different session → allow exit (fail-open for non-autonomous sessions)
-if [[ "$STATE_SESSION" != "$HOOK_SESSION" ]]; then
+if [[ "$OWNER" != "true" ]]; then
   exit 0
 fi
 
-# Same session — this IS the autonomous session, proceed with block logic
-
-ITERATION=$(echo "$FRONTMATTER" | grep '^iteration:' | sed 's/iteration: *//')
-DURATION_SECONDS=$(echo "$FRONTMATTER" | grep '^duration_seconds:' | sed 's/duration_seconds: *//')
-STARTED_AT=$(echo "$FRONTMATTER" | grep '^started_at:' | sed 's/started_at: *//' | tr -d '"')
-COMPLETION_PROMISE=$(echo "$FRONTMATTER" | grep '^completion_promise:' | sed 's/completion_promise: *//' | tr -d '"')
-REPORT_TOPIC=$(echo "$FRONTMATTER" | grep '^report_topic:' | sed 's/report_topic: *//' | tr -d '"')
+# ── This IS the autonomous session. Terminal checks first. ────────────
 
 # Validate iteration
 if [[ ! "$ITERATION" =~ ^[0-9]+$ ]]; then
   echo "⚠️  Autonomous mode: State file corrupted (bad iteration)" >&2
-  rm "$STATE_FILE"
+  rm -f "$STATE_FILE"
   exit 0
 fi
 
-# Check duration expiry
+# Duration expiry. Fail-SAFE: if started_at can't be parsed (START_EPOCH falls
+# back to 0/empty), do NOT expire — an unparseable timestamp must never cause a
+# premature exit (that is the very failure class this hook exists to prevent).
+REMAINING_MIN=""
 if [[ "$DURATION_SECONDS" =~ ^[0-9]+$ ]] && [[ $DURATION_SECONDS -gt 0 ]]; then
-  START_EPOCH=$(date -j -f "%Y-%m-%dT%H:%M:%SZ" "$STARTED_AT" +%s 2>/dev/null || date -d "$STARTED_AT" +%s 2>/dev/null || echo "0")
-  NOW_EPOCH=$(date +%s)
-  ELAPSED=$(( NOW_EPOCH - START_EPOCH ))
-  if [[ $ELAPSED -ge $DURATION_SECONDS ]]; then
-    echo "⏰ Autonomous mode: Duration expired ($ELAPSED seconds elapsed)."
-    echo "   Session is free to exit."
-    rm "$STATE_FILE"
-    exit 0
+  START_EPOCH=$(date -u -j -f "%Y-%m-%dT%H:%M:%SZ" "$STARTED_AT" +%s 2>/dev/null || date -d "$STARTED_AT" +%s 2>/dev/null || echo "0")
+  if [[ "$START_EPOCH" =~ ^[0-9]+$ ]] && [[ $START_EPOCH -gt 0 ]]; then
+    NOW_EPOCH=$(date +%s)
+    ELAPSED=$(( NOW_EPOCH - START_EPOCH ))
+    if [[ $ELAPSED -ge $DURATION_SECONDS ]]; then
+      echo "⏰ Autonomous mode: Duration expired ($ELAPSED seconds elapsed)."
+      echo "   Session is free to exit."
+      rm -f "$STATE_FILE"
+      exit 0
+    fi
+    REMAINING=$(( DURATION_SECONDS - ELAPSED ))
+    REMAINING_MIN=$(( REMAINING / 60 ))
+  else
+    echo "[autonomous] started_at unparseable ('$STARTED_AT') — skipping duration-expiry check (fail-safe: keep running)" >&2
   fi
-  REMAINING=$(( DURATION_SECONDS - ELAPSED ))
-  REMAINING_MIN=$(( REMAINING / 60 ))
 fi
 
-# Check for emergency stop (look in recent messages)
-# The MessageSentinel handles this at the messaging layer, but also check here
+# Emergency stop
 if [[ -f ".instar/autonomous-emergency-stop" ]]; then
   echo "🛑 Autonomous mode: Emergency stop detected."
-  rm "$STATE_FILE"
+  rm -f "$STATE_FILE"
   rm -f ".instar/autonomous-emergency-stop"
   exit 0
 fi
 
-# Get transcript and check for completion promise
-TRANSCRIPT_PATH=$(echo "$HOOK_INPUT" | jq -r '.transcript_path' 2>/dev/null || echo "")
-
+# Completion promise (genuine completion)
 if [[ -n "$TRANSCRIPT_PATH" ]] && [[ -f "$TRANSCRIPT_PATH" ]]; then
-  # Check last assistant message for completion promise
   LAST_LINE=$(grep '"role":"assistant"' "$TRANSCRIPT_PATH" 2>/dev/null | tail -1 || echo "")
-
   if [[ -n "$LAST_LINE" ]]; then
-    LAST_OUTPUT=$(echo "$LAST_LINE" | jq -r '
-      .message.content |
-      map(select(.type == "text")) |
-      map(.text) |
-      join("\n")
+    LAST_OUTPUT=$(printf '%s' "$LAST_LINE" | jq -r '
+      .message.content | map(select(.type == "text")) | map(.text) | join("\n")
     ' 2>/dev/null || echo "")
-
-    # Check for completion promise in <promise> tags
     if [[ -n "$COMPLETION_PROMISE" ]] && [[ "$COMPLETION_PROMISE" != "null" ]]; then
-      PROMISE_TEXT=$(echo "$LAST_OUTPUT" | perl -0777 -pe 's/.*?<promise>(.*?)<\/promise>.*/$1/s; s/^\s+|\s+$//g; s/\s+/ /g' 2>/dev/null || echo "")
-
+      PROMISE_TEXT=$(printf '%s' "$LAST_OUTPUT" | perl -0777 -pe 's/.*?<promise>(.*?)<\/promise>.*/$1/s; s/^\s+|\s+$//g; s/\s+/ /g' 2>/dev/null || echo "")
       if [[ -n "$PROMISE_TEXT" ]] && [[ "$PROMISE_TEXT" = "$COMPLETION_PROMISE" ]]; then
         echo "✅ Autonomous mode: Completion promise detected — <promise>$COMPLETION_PROMISE</promise>"
         echo "   Session is free to exit. Good work!"
-        rm "$STATE_FILE"
+        rm -f "$STATE_FILE"
         exit 0
       fi
     fi
   fi
 fi
 
-# Not complete — block exit and feed task list back
+# ── Not terminal: we are continuing. Handle restart-resume recovery note. ──
+# Always reconcile the recorded session_id to the live one (so the backstop and
+# restart-detection stay accurate). Emit the one-line note exactly once, only
+# when a real restart was detected (topic-verified or dead-owner adoption).
+record_session_id() {
+  local new_id="$1"
+  local tmp="${STATE_FILE}.sid.$$"
+  if grep -q '^session_id:' "$STATE_FILE"; then
+    sed "s/^session_id:.*/session_id: \"${new_id}\"/" "$STATE_FILE" > "$tmp" && mv "$tmp" "$STATE_FILE"
+  fi
+}
+
+# Channel-neutral delivery seam. The hook does NOT assume Telegram — it routes
+# the note to whatever channel owns the job. Telegram is wired here; the other
+# channels are owned by the unified notification layer tracked in the Channel
+# Parity initiative. Either way the durable audit record below is the source of
+# truth, so a not-yet-wired channel never silently misfires to Telegram.
+deliver_recovery_note() {
+  local channel="$1" target="$2" text="$3"
+  [[ -z "$target" ]] && return 0
+  case "$channel" in
+    telegram)
+      if [[ -x ".instar/scripts/telegram-reply.sh" ]]; then
+        printf '%s\n' "$text" | .instar/scripts/telegram-reply.sh "$target" >/dev/null 2>&1 || true
+      elif [[ -x ".claude/scripts/telegram-reply.sh" ]]; then
+        printf '%s\n' "$text" | .claude/scripts/telegram-reply.sh "$target" >/dev/null 2>&1 || true
+      fi
+      ;;
+    *)
+      # slack | whatsapp | imessage | future — delivered by the unified notify
+      # layer (Channel Parity initiative). Recorded to the audit trail above.
+      echo "[autonomous] recovery note for channel '$channel' recorded to audit; live delivery pending the Channel Parity initiative" >&2
+      ;;
+  esac
+}
+
+if [[ "$RESTART_DETECTED" == "true" ]] && [[ "$STATE_SESSION" != "$HOOK_SESSION" ]]; then
+  ITER_LABEL="${ITERATION:-?}"
+  NOTE="Heads up — my session restarted mid-run and I've picked the autonomous job back up (topic ${REPORT_TOPIC:-?}, iteration ${ITER_LABEL}). No action needed."
+  # Durable, channel-neutral audit record (always).
+  TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+  printf '{"ts":"%s","event":"restart-resume","channel":"%s","topic":"%s","oldSession":"%s","newSession":"%s","method":"%s","iteration":"%s"}\n' \
+    "$TS" "$REPORT_CHANNEL" "${REPORT_TOPIC:-}" "$STATE_SESSION" "$HOOK_SESSION" "$OWNER_METHOD" "$ITER_LABEL" >> "$RECOVERY_AUDIT" 2>/dev/null || true
+  # Best-effort user-facing delivery via the channel that owns the job.
+  deliver_recovery_note "$REPORT_CHANNEL" "$REPORT_TOPIC" "$NOTE"
+  echo "[autonomous] restart-resume: channel=$REPORT_CHANNEL topic=${REPORT_TOPIC:-?} old=$STATE_SESSION new=$HOOK_SESSION method=$OWNER_METHOD" >&2
+fi
+
+# Reconcile recorded session_id to live (covers restart, bootstrap, adopt).
+if [[ "$STATE_SESSION" != "$HOOK_SESSION" ]]; then
+  record_session_id "$HOOK_SESSION"
+fi
+
+# ── Continue the job: increment iteration, feed the task back. ────────
 NEXT_ITERATION=$((ITERATION + 1))
 
-# Extract prompt (everything after closing ---)
 PROMPT_TEXT=$(awk '/^---$/{i++; next} i>=2' "$STATE_FILE")
-
 if [[ -z "$PROMPT_TEXT" ]]; then
   echo "⚠️  Autonomous mode: State file has no task content" >&2
-  rm "$STATE_FILE"
+  rm -f "$STATE_FILE"
   exit 0
 fi
 
-# Update iteration counter
-TEMP_FILE="${STATE_FILE}.tmp.$$"
-sed "s/^iteration: .*/iteration: $NEXT_ITERATION/" "$STATE_FILE" > "$TEMP_FILE"
-mv "$TEMP_FILE" "$STATE_FILE"
+TEMP_FILE="${STATE_FILE}.iter.$$"
+sed "s/^iteration: .*/iteration: $NEXT_ITERATION/" "$STATE_FILE" > "$TEMP_FILE" && mv "$TEMP_FILE" "$STATE_FILE"
 
 # ── Progress Report Check ──
-# Check if it's time to send a progress report
-REPORT_INTERVAL=$(echo "$FRONTMATTER" | grep '^report_interval:' | sed 's/report_interval: *//' | tr -d '"')
-LAST_REPORT_AT=$(echo "$FRONTMATTER" | grep '^last_report_at:' | sed 's/last_report_at: *//' | tr -d '"')
+REPORT_INTERVAL=$(fm_get report_interval)
+LAST_REPORT_AT=$(fm_get last_report_at)
 
-# Convert report interval to seconds
 REPORT_INTERVAL_SECS=1800  # default 30 minutes
 if [[ "$REPORT_INTERVAL" =~ ^([0-9]+)m$ ]]; then
   REPORT_INTERVAL_SECS=$(( ${BASH_REMATCH[1]} * 60 ))
@@ -174,37 +313,30 @@ fi
 
 REPORT_DUE="false"
 NOW_EPOCH=$(date +%s)
-
-if [[ -z "$LAST_REPORT_AT" ]] || [[ "$LAST_REPORT_AT" == "null" ]] || [[ "$LAST_REPORT_AT" == '""' ]]; then
-  # No report sent yet — due if we've been running for at least one interval
+if [[ -z "$LAST_REPORT_AT" ]] || [[ "$LAST_REPORT_AT" == "null" ]]; then
   if [[ -n "$STARTED_AT" ]]; then
-    START_EPOCH_R=$(date -j -f "%Y-%m-%dT%H:%M:%SZ" "$STARTED_AT" +%s 2>/dev/null || date -d "$STARTED_AT" +%s 2>/dev/null || echo "0")
+    START_EPOCH_R=$(date -u -j -f "%Y-%m-%dT%H:%M:%SZ" "$STARTED_AT" +%s 2>/dev/null || date -d "$STARTED_AT" +%s 2>/dev/null || echo "0")
     ELAPSED_SINCE_START=$(( NOW_EPOCH - START_EPOCH_R ))
     if [[ $ELAPSED_SINCE_START -ge $REPORT_INTERVAL_SECS ]]; then
       REPORT_DUE="true"
     fi
   fi
 else
-  # Check time since last report
-  LAST_REPORT_EPOCH=$(date -j -f "%Y-%m-%dT%H:%M:%SZ" "$LAST_REPORT_AT" +%s 2>/dev/null || date -d "$LAST_REPORT_AT" +%s 2>/dev/null || echo "0")
+  LAST_REPORT_EPOCH=$(date -u -j -f "%Y-%m-%dT%H:%M:%SZ" "$LAST_REPORT_AT" +%s 2>/dev/null || date -d "$LAST_REPORT_AT" +%s 2>/dev/null || echo "0")
   ELAPSED_SINCE_REPORT=$(( NOW_EPOCH - LAST_REPORT_EPOCH ))
   if [[ $ELAPSED_SINCE_REPORT -ge $REPORT_INTERVAL_SECS ]]; then
     REPORT_DUE="true"
   fi
 fi
 
-# If report is due, update last_report_at in state file
 REPORT_DIRECTIVE=""
 if [[ "$REPORT_DUE" == "true" ]]; then
   REPORT_NOW=$(date -u +%Y-%m-%dT%H:%M:%SZ)
-  # Update or add last_report_at in frontmatter
   if grep -q '^last_report_at:' "$STATE_FILE"; then
-    TEMP_FILE2="${STATE_FILE}.tmp2.$$"
-    sed "s/^last_report_at: .*/last_report_at: \"$REPORT_NOW\"/" "$STATE_FILE" > "$TEMP_FILE2"
-    mv "$TEMP_FILE2" "$STATE_FILE"
+    TEMP_FILE2="${STATE_FILE}.rpt.$$"
+    sed "s/^last_report_at: .*/last_report_at: \"$REPORT_NOW\"/" "$STATE_FILE" > "$TEMP_FILE2" && mv "$TEMP_FILE2" "$STATE_FILE"
   else
-    # Add last_report_at before the closing ---
-    TEMP_FILE2="${STATE_FILE}.tmp2.$$"
+    TEMP_FILE2="${STATE_FILE}.rpt.$$"
     sed "0,/^---$/! { /^---$/i\\
 last_report_at: \"$REPORT_NOW\"
 }" "$STATE_FILE" > "$TEMP_FILE2" 2>/dev/null && mv "$TEMP_FILE2" "$STATE_FILE" || true

package/.claude/skills/autonomous/scripts/setup-autonomous.sh

@@ -10,6 +10,7 @@ set -euo pipefail
 GOAL=""
 DURATION="4h"
 REPORT_TOPIC=""
+REPORT_CHANNEL="telegram"   # channel that owns this job; recovery note routes here (telegram|slack|whatsapp|imessage)
 LEVEL_UP="false"
 TASKS=""
 COMPLETION_PROMISE=""
@@ -29,6 +30,10 @@ while [[ $# -gt 0 ]]; do
       REPORT_TOPIC="$2"
       shift 2
       ;;
+    --report-channel)
+      REPORT_CHANNEL="$2"
+      shift 2
+      ;;
     --level-up)
       LEVEL_UP="true"
       shift
@@ -102,6 +107,7 @@ duration_seconds: $DURATION_SECONDS
 started_at: "$STARTED_AT"
 end_at: "$END_AT"
 report_topic: "$REPORT_TOPIC"
+report_channel: "$REPORT_CHANNEL"
 report_interval: "$REPORT_INTERVAL"
 last_report_at: ""
 level_up: $LEVEL_UP

package/dist/core/PostUpdateMigrator.d.ts

@@ -157,6 +157,25 @@ export declare class PostUpdateMigrator {
      * longer matches the stock fingerprint is left untouched.
      */
     private migrateBuildSkillMethodology;
+    /**
+     * Update the deployed autonomous stop hook to the topic-keyed version.
+     *
+     * The old hook keyed autonomous-session ownership on the Claude session UUID;
+     * a memory-limit restart rotated the UUID, mismatched the state file, and let
+     * the still-running session exit — autonomy died silently. The new hook keys
+     * on the TOPIC (a stable address that survives restarts), demotes session-id
+     * matching to a liveness-gated backstop, and emits a one-line recovery note.
+     *
+     * installAutonomousSkill() is install-if-missing, so existing agents never get
+     * this through init — a dedicated migration is the only path (Migration Parity
+     * Standard, "updating existing skill content").
+     *
+     * Idempotent + conservative: only re-copies the bundled hook when the installed
+     * copy (a) lacks the new "topic-session-registry" marker AND (b) still looks
+     * like the stock hook (contains "Autonomous Mode Stop Hook"). A customized hook
+     * that no longer matches the stock fingerprint is left untouched.
+     */
+    private migrateAutonomousStopHookTopicKeyed;
     /**
      * Deploy any missing built-in skills (e.g., guardian job skills added after initial setup).
      * Non-destructive — only writes SKILL.md files that don't already exist.

package/dist/core/PostUpdateMigrator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PostUpdateMigrator.d.ts","sourceRoot":"","sources":["../../src/core/PostUpdateMigrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAiCH,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAIjC,MAAM,WAAW,eAAe;IAC9B,wBAAwB;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,kCAAkC;IAClC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAiB;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU,CAAiC;gBAEvC,MAAM,EAAE,cAAc;IAIlC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IAoB5B;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAItC;;;;;;OAMG;IACG,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAIjC,OAAO,CAAC,aAAa;IAOrB;;;OAGG;IACH,OAAO,IAAI,eAAe;IAsC1B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,0BAA0B;IAsElC,OAAO,CAAC,0BAA0B;IAmDlC,OAAO,CAAC,uBAAuB;IAwE/B,OAAO,CAAC,4CAA4C;IAmEpD,OAAO,CAAC,yBAAyB;IAqGjC;;;;;;;;;;OAUG;IACG,YAAY,IAAI,OAAO,CAAC,eAAe,CAAC;YA4BhC,uBAAuB;IAkGrC,OAAO,CAAC,0BAA0B;IAkGlC,OAAO,CAAC,0BAA0B;IAkElC,OAAO,CAAC,oBAAoB;IAqH5B,OAAO,CAAC,8BAA8B;IA2EtC;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,0BAA0B;IA8BlC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,4BAA4B;IAwBpC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IA2B1B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,yBAAyB;IA4HjC;6EACyE;IACzE,OAAO,CAAC,wBAAwB;IAShC;sDACkD;IAClD,OAAO,CAAC,wBAAwB;IAQhC;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAwKpB;;;;;;;;OAQG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI;IA6CvE;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAgEzB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAkChC;;;;;;;;;OASG;IACH,OAAO,CAAC,wBAAwB;IAoEhC;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAiE5B;;;;;OAKG;IACH,OAAO,CAAC,2BAA2B;IA8BnC;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAwGhC;;;;;;OAMG;IACH,OAAO,CAAC,8BAA8B;IAwDtC,OAAO,CAAC,0BAA0B;IA8DlC;;;OAGG;IACH,OAAO,CAAC,eAAe;IAkxBvB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,kCAAkC;IAiG1C;;;OAGG;IACH,OAAO,CAAC,cAAc;IA6ItB;;;OAGG;IACH,OAAO,CAAC,eAAe;IAqQvB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAqFrB;;;OAGG;IACH;;;OAGG;IACH;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,wBAAwB;IAmEhC,OAAO,CAAC,wBAAwB;IAqChC,OAAO,CAAC,gBAAgB;IAiBxB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,CAAC,qBAAqB;IAkE7B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,0BAA0B;IAgDlC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAkC5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;IA2C1B;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,oBAAoB;IAgC5B;;;OAGG;IACH,OAAO,CAAC,aAAa;IAyBrB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAqC9B;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,qBAAqB,GAAG,yBAAyB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,8BAA8B,GAAG,2BAA2B,GAAG,4BAA4B,GAAG,iBAAiB,GAAG,0BAA0B,GAAG,wBAAwB,GAAG,iBAAiB,GAAG,0BAA0B,GAAG,uBAAuB,GAAG,iBAAiB,GAAG,MAAM;IAqB/a,oFAAoF;IACpF,iCAAiC,IAAI,MAAM;IAI3C,6EAA6E;IAC7E,yBAAyB,IAAI,MAAM;IAInC,OAAO,CAAC,mBAAmB;IAoY3B,OAAO,CAAC,wBAAwB;IAmEhC,OAAO,CAAC,2BAA2B;IA0DnC,OAAO,CAAC,yBAAyB;IAuGjC,OAAO,CAAC,2BAA2B;IAqInC,OAAO,CAAC,qBAAqB;IAqP7B,OAAO,CAAC,uBAAuB;IA6H/B,OAAO,CAAC,qBAAqB;IAsH7B,OAAO,CAAC,2BAA2B;IA8GnC,OAAO,CAAC,iCAAiC;IA6DzC,OAAO,CAAC,4BAA4B;IA4LpC;;;;;;;;;;OAUG;IACH;;;;;;;;;;;OAWG;IAEH,gBAAuB,iCAAiC,EAAE,WAAW,CAAC,MAAM,CAAC,CA4B1E;IAEH;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,8BAA8B;IAiHtC,OAAO,CAAC,uBAAuB;IA4B/B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAczB,OAAO,CAAC,sBAAsB;IAwC9B,OAAO,CAAC,iBAAiB;IAwBzB,OAAO,CAAC,mBAAmB;IAoB3B,OAAO,CAAC,8BAA8B;IAoHtC,OAAO,CAAC,+BAA+B;IAmJvC,OAAO,CAAC,oBAAoB;IAO5B,OAAO,CAAC,qBAAqB;IA4N7B,OAAO,CAAC,qBAAqB;IA4H7B,OAAO,CAAC,6BAA6B;IAyKrC,OAAO,CAAC,0BAA0B;IAgClC,OAAO,CAAC,gBAAgB;IAqFxB,OAAO,CAAC,6BAA6B;CAoCtC"}
+{"version":3,"file":"PostUpdateMigrator.d.ts","sourceRoot":"","sources":["../../src/core/PostUpdateMigrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAiCH,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC3B,MAAM,yBAAyB,CAAC;AAIjC,MAAM,WAAW,eAAe;IAC9B,wBAAwB;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,kCAAkC;IAClC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAiB;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU,CAAiC;gBAEvC,MAAM,EAAE,cAAc;IAIlC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IAoB5B;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI;IAItC;;;;;;OAMG;IACG,eAAe,CACnB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAIjC,OAAO,CAAC,aAAa;IAOrB;;;OAGG;IACH,OAAO,IAAI,eAAe;IAuC1B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,0BAA0B;IAsElC,OAAO,CAAC,0BAA0B;IAmDlC,OAAO,CAAC,uBAAuB;IAwE/B,OAAO,CAAC,4CAA4C;IAmEpD,OAAO,CAAC,yBAAyB;IAqGjC;;;;;;;;;;OAUG;IACG,YAAY,IAAI,OAAO,CAAC,eAAe,CAAC;YA4BhC,uBAAuB;IAkGrC,OAAO,CAAC,0BAA0B;IAkGlC,OAAO,CAAC,0BAA0B;IAkElC,OAAO,CAAC,oBAAoB;IAqH5B,OAAO,CAAC,8BAA8B;IA2EtC;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,0BAA0B;IA8BlC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,4BAA4B;IAwBpC;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,mCAAmC;IA2B3C;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IA2B1B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,yBAAyB;IA4HjC;6EACyE;IACzE,OAAO,CAAC,wBAAwB;IAShC;sDACkD;IAClD,OAAO,CAAC,wBAAwB;IAQhC;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAwKpB;;;;;;;;OAQG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI;IA6CvE;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAgEzB;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAkChC;;;;;;;;;OASG;IACH,OAAO,CAAC,wBAAwB;IAoEhC;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAiE5B;;;;;OAKG;IACH,OAAO,CAAC,2BAA2B;IA8BnC;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAwGhC;;;;;;OAMG;IACH,OAAO,CAAC,8BAA8B;IAwDtC,OAAO,CAAC,0BAA0B;IA8DlC;;;OAGG;IACH,OAAO,CAAC,eAAe;IAkxBvB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,kCAAkC;IAiG1C;;;OAGG;IACH,OAAO,CAAC,cAAc;IA6ItB;;;OAGG;IACH,OAAO,CAAC,eAAe;IAqQvB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAqFrB;;;OAGG;IACH;;;OAGG;IACH;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,wBAAwB;IAmEhC,OAAO,CAAC,wBAAwB;IAqChC,OAAO,CAAC,gBAAgB;IAiBxB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,CAAC,qBAAqB;IAkE7B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,0BAA0B;IAgDlC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAkC5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;IA2C1B;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,oBAAoB;IAgC5B;;;OAGG;IACH,OAAO,CAAC,aAAa;IAyBrB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAqC9B;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,qBAAqB,GAAG,yBAAyB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,wBAAwB,GAAG,8BAA8B,GAAG,2BAA2B,GAAG,4BAA4B,GAAG,iBAAiB,GAAG,0BAA0B,GAAG,wBAAwB,GAAG,iBAAiB,GAAG,0BAA0B,GAAG,uBAAuB,GAAG,iBAAiB,GAAG,MAAM;IAqB/a,oFAAoF;IACpF,iCAAiC,IAAI,MAAM;IAI3C,6EAA6E;IAC7E,yBAAyB,IAAI,MAAM;IAInC,OAAO,CAAC,mBAAmB;IAoY3B,OAAO,CAAC,wBAAwB;IAmEhC,OAAO,CAAC,2BAA2B;IA0DnC,OAAO,CAAC,yBAAyB;IAuGjC,OAAO,CAAC,2BAA2B;IAqInC,OAAO,CAAC,qBAAqB;IAqP7B,OAAO,CAAC,uBAAuB;IA6H/B,OAAO,CAAC,qBAAqB;IAsH7B,OAAO,CAAC,2BAA2B;IA8GnC,OAAO,CAAC,iCAAiC;IA6DzC,OAAO,CAAC,4BAA4B;IA4LpC;;;;;;;;;;OAUG;IACH;;;;;;;;;;;OAWG;IAEH,gBAAuB,iCAAiC,EAAE,WAAW,CAAC,MAAM,CAAC,CA4B1E;IAEH;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,8BAA8B;IAiHtC,OAAO,CAAC,uBAAuB;IA4B/B;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAczB,OAAO,CAAC,sBAAsB;IAwC9B,OAAO,CAAC,iBAAiB;IAwBzB,OAAO,CAAC,mBAAmB;IAoB3B,OAAO,CAAC,8BAA8B;IAoHtC,OAAO,CAAC,+BAA+B;IAmJvC,OAAO,CAAC,oBAAoB;IAO5B,OAAO,CAAC,qBAAqB;IA4N7B,OAAO,CAAC,qBAAqB;IA4H7B,OAAO,CAAC,6BAA6B;IAyKrC,OAAO,CAAC,0BAA0B;IAgClC,OAAO,CAAC,gBAAgB;IAqFxB,OAAO,CAAC,6BAA6B;CAoCtC"}

package/dist/core/PostUpdateMigrator.js

@@ -142,6 +142,7 @@ export class PostUpdateMigrator {
         this.autoMigrateLegacyJobsJson(result);
         this.migrateSkillPortHardcoding(result);
         this.migrateBuildSkillMethodology(result);
+        this.migrateAutonomousStopHookTopicKeyed(result);
         this.migrateSelfKnowledgeTree(result);
         this.migrateSoulMd(result);
         this.migrateAgentMdSections(result);
@@ -1103,6 +1104,50 @@ export class PostUpdateMigrator {
             result.errors.push(`skills/build/SKILL.md methodology migration: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
+    /**
+     * Update the deployed autonomous stop hook to the topic-keyed version.
+     *
+     * The old hook keyed autonomous-session ownership on the Claude session UUID;
+     * a memory-limit restart rotated the UUID, mismatched the state file, and let
+     * the still-running session exit — autonomy died silently. The new hook keys
+     * on the TOPIC (a stable address that survives restarts), demotes session-id
+     * matching to a liveness-gated backstop, and emits a one-line recovery note.
+     *
+     * installAutonomousSkill() is install-if-missing, so existing agents never get
+     * this through init — a dedicated migration is the only path (Migration Parity
+     * Standard, "updating existing skill content").
+     *
+     * Idempotent + conservative: only re-copies the bundled hook when the installed
+     * copy (a) lacks the new "topic-session-registry" marker AND (b) still looks
+     * like the stock hook (contains "Autonomous Mode Stop Hook"). A customized hook
+     * that no longer matches the stock fingerprint is left untouched.
+     */
+    migrateAutonomousStopHookTopicKeyed(result) {
+        try {
+            const deployed = path.join(this.config.projectDir, '.claude', 'skills', 'autonomous', 'hooks', 'autonomous-stop-hook.sh');
+            if (!fs.existsSync(deployed))
+                return; // installAutonomousSkill handles fresh installs
+            const current = fs.readFileSync(deployed, 'utf8');
+            if (current.includes('topic-session-registry'))
+                return; // already topic-keyed — idempotent
+            if (!current.includes('Autonomous Mode Stop Hook')) {
+                result.skipped.push('skills/autonomous/hooks/autonomous-stop-hook.sh: customized — left untouched');
+                return;
+            }
+            const bundled = path.join(__dirname, '..', '..', '.claude', 'skills', 'autonomous', 'hooks', 'autonomous-stop-hook.sh');
+            if (!fs.existsSync(bundled))
+                return;
+            const next = fs.readFileSync(bundled, 'utf8');
+            if (next.includes('topic-session-registry')) {
+                fs.writeFileSync(deployed, next);
+                fs.chmodSync(deployed, 0o755);
+                result.upgraded.push('skills/autonomous/hooks/autonomous-stop-hook.sh (topic-keyed ownership + recovery note)');
+            }
+        }
+        catch (err) {
+            result.errors.push(`autonomous stop hook topic-keying migration: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
     /**
      * Deploy any missing built-in skills (e.g., guardian job skills added after initial setup).
      * Non-destructive — only writes SKILL.md files that don't already exist.