fix: resolve skills across all three install roots, not ~/.claude/skills alone (1.4.0)

.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "overnight-insight-discovery",
       "source": "./plugins/overnight-insight-discovery",
       "description": "Overnight autonomous B-vs-C parallel insight discovery that surfaces genuinely ah-ha findings from data, with a cohort-conditional novelty gate, an observational-analysis validity gate (composition / leak / anchor-timing / marker-vs-lever), adaptive tuning, and an agent-review-panel loop.",
-      "version": "1.1.1"
+      "version": "1.2.0"
     },
     {
       "name": "overnight-review-client-delivery",
@@ -46,7 +46,7 @@
       "name": "schedule-poll-orchestrator-pattern",
       "source": "./plugins/schedule-poll-orchestrator-pattern",
       "description": "Fire-ASAP orchestrator pattern for multi-track autonomous overnight workflows on scheduled triggers \u2014 a self-rescheduling poll loop that consolidates the moment all tracks report complete, and survives a 12-20h session end. Companion safety pattern.",
-      "version": "1.0.0"
+      "version": "1.0.1"
     },
     {
       "name": "observational-analysis-rigor",

README.md

@@ -164,6 +164,7 @@ All three plugins encode patterns from real overnight runs. `overnight-review-cl
 
 ## Version history
 
+- **2026-08-06** — `overnight-insight-discovery` → **v1.2.0** and `schedule-poll-orchestrator-pattern` → **v1.0.1** (both manifests each + bundle `VERSION` → 1.4.0): fixes the single-root skill-path bug in two places. A skill installed as a **plugin** lives at `~/.claude/plugins/cache/<marketplace>/<plugin>/<version>/`, not at `~/.claude/skills/<name>/`, so anything that reaches a skill through the `~/.claude/skills/` root alone misses on a plugin install. **The one with teeth**: `overnight-insight-discovery`'s Phase 0.Y toolchain pre-flight decided whether the skill was installed with a single `test -f ~/.claude/skills/overnight-insight-discovery/SKILL.md`. On a plugin install that test fails, and the failure path is a tap-out with `[ENV_BLOCKER]` reporting no skill tree — a failed lookup reported as an install-state finding. It now probes all three roots (`$CLAUDE_PLUGIN_ROOT`, `~/.claude/skills/`, then the plugin cache), ranks cache hits on the **version** segment alone rather than whole-path `sort -V` (the marketplace segment sorts first, so `aaa-mkt/2.5.0` would otherwise lose to `zzz-mkt/1.0.0`), uses `find` instead of a glob (zsh's `nomatch` fails a non-matching glob before `2>/dev/null` applies), and prints "not found — tried <the three paths>" rather than anything that reads as "not installed". **The cosmetic ones**: three dead see-also links in `schedule-poll-orchestrator-pattern` pointed at `~/.claude/skills/<name>/SKILL.md` files a reader on a plugin install cannot open — now plain skill names with a GitHub URL where the source repo is known — and one `~/.claude/skills/`-rooted self-reference in `overnight-insight-discovery`'s v1.3.2 changelog entry. **Deliberately unchanged**: every `~/.claude/skills/**` mention in § "Autonomous-safe skill edits" and its Phase G summary. Those are the path patterns that fire a sensitive-file permission prompt in Claude Code, which is a fact about the prompt system and not about where this skill is installed; broadening them would break the contract they encode. `CLAUDE_PLUGIN_ROOT` alone is not the fix — it is frequently unset in the shell a step actually runs in, and it points at the running plugin's own root, so it can never reach a sibling plugin.
 - **2026-08-06** — `overnight-multi-issue-implementation` → **v1.3.1** (SKILL + both manifests + bundle `VERSION`): drops an unsourceable figure from the entry below. The "never truncate a findings payload" lesson described the lost finding as sitting in a "553-line pre-registration". That was true of the document the reviewer read; five blocking findings were then fixed on the branch before it merged, roughly doubling it, and it now stands at about 1,100 lines — a figure with no vintage attached, in a document the skill's own readers cannot re-derive it from. The length was decoration; "a pre-registration that had no power statement anywhere" carries the whole point, so the count is gone rather than dated. The same audit **retracted a rate**: "about one in four" is no longer claimed, because the host repo reopened its own count (a sixth instance surfaced, and two of the five were documents written from scratch). It now reads "common enough to budget a round for, not a measured rate". Everything else checked out against the source — the six-findings/five-arrived split, the ±0.03-versus-0.17 margin behind "about five times finer", and the 269 → 314 test counts are all recorded in the run's own handoffs. This is the skill's own "a fix ships a fresh instance of the defect it repairs" rule firing on the release that introduced it.
 - **2026-08-06** — `overnight-multi-issue-implementation` → **v1.3.0** (SKILL + both manifests + bundle `VERSION`, which had drifted a patch behind): seven lessons from a single overnight run of 17 items — 20 merged PRs, 4 orchestrated workflows, 91 subagents, ~11 hours. **Never `.slice()` a findings payload** (three reviewers returned six critical findings; the merging agent received five, and every visible signal still said the gate had worked — make the actor count what it received against what it answered, and keep the run journal as the recovery path). **Coordinating with sessions you do not control**: claim your intent and your file list on a shared in-repo board before you start, append rather than replace, and don't take the claim down while your PRs are open. **Amend a running orchestration through a file on disk, not the script** — editing the script changes every agent prompt and a resume then re-runs completed work instead of replaying it from cache. A **third kind of collision** neither pre-flight audit can see (the same piece of work under two names, in a live session's uncommitted tree). **Baseline numbers in your own brief go stale mid-run** — measure, never quote. **What an autonomous run may and may not decide** (an assumption is a default, not a ruling; for pre-registered questions disclose rather than compute; an un-run unit is "no result", not "inconclusive"; production changes only in the reverting direction and only on unanimous authorisation from the run's own reviewers, with anything that is not a revert still waiting for a person; merging is a separate grant from changing production). And a **verbatim line for every reviewer prompt** — "Check whether this change ships a fresh instance of the defect it repairs." — which caught five of the twenty merged PRs, every one by re-deriving a number rather than by reading the diff.
 - **2026-07-17** — `overnight-multi-issue-implementation` → **v1.2.0** (SKILL + manifests, fixing a manifest-version drift): adds **Phase 0 — backlog triage + owner-ruling application** for unvalidated issue clusters (triage biased against dismissal with adversarial verification of dismissals only; owner cut-line ratification via an interactive review page; rulings baked as greppable issue comments before any build; decision-session / build-session split with a wave-ordered kickoff prompt; follow-up ruling rounds handled additively; successor-before-close sequencing). Also documents that the close-keyword issue trap fires from **docs-only planning PR bodies** ("then close #N" in a kickoff-prompt addendum closes the live tracker on merge). Extracted from a real large-backlog triage-and-rulings run. Cross-links the new [`interactive-feedback-report`](https://github.com/wan-huiyan/interactive-feedback-report) skill.

VERSION

@@ -1 +1 @@
-1.3.1
+1.4.0

plugins/overnight-insight-discovery/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "overnight-insight-discovery",
   "description": "Overnight autonomous B-vs-C parallel insight discovery that surfaces genuinely ah-ha findings from data, with a cohort-conditional novelty gate, an observational-analysis validity gate (composition / leak / anchor-timing / marker-vs-lever), adaptive tuning, and an agent-review-panel loop.",
-  "version": "1.1.1",
+  "version": "1.2.0",
   "author": {
     "name": "wan-huiyan"
   },

plugins/overnight-insight-discovery/SKILL.md

@@ -16,10 +16,22 @@ description: |
   exploratory-data-analysis), single-track LLM exploration (use deep-research), or work that
   needs user input mid-stream.
 author: wan-huiyan + Claude Code
-version: 1.8.0
-date: 2026-07-08
+version: 1.9.0
+date: 2026-08-06
 
 # Changelog
+# 1.9.0 (2026-08-06 — plugin-install path resolution)
+#   The Phase 0.Y toolchain pre-flight decided whether this skill was installed by
+#   testing one path, ~/.claude/skills/overnight-insight-discovery/SKILL.md. A plugin
+#   install creates no such directory — it unpacks under
+#   ~/.claude/plugins/cache/<marketplace>/<plugin>/<version>/ — so a healthy plugin
+#   install failed the check and the track tapped out with [ENV_BLOCKER] claiming there
+#   was no skill tree. The check now probes $CLAUDE_PLUGIN_ROOT, then ~/.claude/skills/,
+#   then the plugin cache (ranked on the version path segment alone, via find not a
+#   glob), and on a miss says "not found — tried <the three paths>" instead of anything
+#   that reads as proof the skill is absent. The ~/.claude/skills/** patterns in
+#   § "Autonomous-safe skill edits" are deliberately unchanged: those describe which
+#   paths fire a sensitive-file permission prompt, not where this skill lives.
 # 1.8.0 (2026-07-08 — analytical VALIDITY gate)
 #   Adds references/observational_analysis_rigor.md — an 8-step validity protocol
 #   (leak-free cohort · probe outcome−anchor before an event-anchored design ·
@@ -761,14 +773,36 @@ Patterns that survived the first production run are canonical here.
 
 ## Version history
 
+- **v1.9.0** (2026-08-06, plugin-install path resolution) — The Phase 0.Y
+  toolchain pre-flight decided whether this skill was installed by testing one
+  path, `~/.claude/skills/overnight-insight-discovery/SKILL.md`. A plugin
+  install does not create that directory — it unpacks under
+  `~/.claude/plugins/cache/<marketplace>/<plugin>/<version>/` — so a perfectly
+  healthy plugin install failed the check, and the track tapped out with
+  `[ENV_BLOCKER]` claiming there was no skill tree. `CLAUDE_PLUGIN_ROOT` does
+  not rescue this: it is often unset in the shell the check runs in, and it
+  points at the running plugin's own root, so it can never reach a sibling.
+  The check now probes all three install roots in order and, when it finds
+  nothing, prints "not found — tried <the three paths>" rather than anything
+  that reads as proof the skill is absent. Two details in the snippet look
+  fussy but each fixes a real defect, so do not simplify them away: it ranks
+  candidates on the **version** path segment alone (the marketplace segment comes first, so a
+  plain `sort -V` over whole paths would let `aaa-mkt/2.5.0` lose to
+  `zzz-mkt/1.0.0`), and it uses `find` rather than a shell glob (zsh's
+  `nomatch` fails a non-matching glob at expansion time, before `2>/dev/null`
+  can suppress anything). Also removed a `~/.claude/skills/`-rooted
+  self-reference from the v1.3.2 entry below. The permission-prompt path
+  patterns in § "Autonomous-safe skill edits" are unchanged and still name
+  `~/.claude/skills/**` deliberately — that section is about which paths fire
+  a sensitive-file dialog, not about where this skill lives.
 - **v1.7.0** (2026-04-21, post-S99 pre-dispatch stall) — Added **Phase 0.X pre-dispatch confirmation gate** (`references/phase_0_predispatch_gate.md`). S99 dispatch prep hit two mid-run stalls: (1) the `schedule` skill's 1-hour cron minimum conflicted with an inherited 30-min polling spec; (2) branch-checkout question for remote agents surfaced ad-hoc. Both required user intervention at the worst possible moment (mid-dispatch). New gate runs at Phase 0 closeout, surfaces all confirmation-requiring items in ONE batched `AskUserQuestion` call, and either proceeds silently (if zero deltas) or applies user redirects before firing. Covers 5 canonical item types: dispatch-mechanism deviations · blast-radius confirmation · branch-checkout question · probe-result surprises that changed planned behaviour · skill/remote-sync status reminder. Config knob `predispatch_gate.mode: ask|skip_and_log` — skip mode records items to morning_summary §0 for CI-style unattended runs. User feedback driving v1.7: "update the overnight workflow skill so next time we don't need user intervention mid run, if we have something to confirm, ask at the beginning of the session."
 - **v1.4.1** (2026-04-17, post-v2 phone-readability ask) — Added **"Phone-readable bundle"** section (Phase F addendum). Deliverables ship as client-facing HTMLs + markdown docs that are awkward to read on mobile via GitHub or Drive separately (Drive's HTML preview can't resolve relative asset paths across files). New build step emits a **single self-contained HTML** with all deliverables inline + chart PNGs base64-embedded + mobile-optimised CSS with sticky top nav. Drag-to-Drive workflow → user reads on phone. Template in project repo at `scripts/build_drive_bundle.py`. Triggered by S92 user ask "how can I easily read them on my phone". Private-repo Vercel/Netlify/Pages considered but rejected (public by default); Google Drive upload is simplest-private-path. v1.5 roadmap candidate: auto-upload bundle to IAP-protected Cloud Run for team-shared review.
 - **v1.3.2** (2026-04-17, post-v2 sensitive-file-prompt block) — Added
   **"Autonomous-safe skill edits" contract** for Phase G. Second production
   run hit a sensitive-file permission prompt when claudeception tried to
-  directly edit `~/.claude/skills/overnight-insight-discovery/references/
-  phase_b_review_loop.md` mid-run — a dialog the autonomous overnight
-  session couldn't resolve until morning. New contract: during autonomous
+  directly edit this skill's own `references/phase_b_review_loop.md` mid-run
+  — a dialog the autonomous overnight session couldn't resolve until
+  morning. New contract: during autonomous
   runs, Phase G writes proposed skill-update diffs to
   `docs/overnight/<date>/skill_updates/` (project-local, no prompts) and
   lists them in morning_summary §4 for batched post-run review and apply.

plugins/overnight-insight-discovery/references/ccr_env_toolchain_preflight.md

@@ -11,8 +11,11 @@ of writing) is a **bare** Claude Code container:
 - No `bq` CLI
 - No `gcloud` SDK / ADC flow (user's personal ADC does not propagate)
 - No Python data stack (pandas / scipy / statsmodels / xgboost / matplotlib)
-- No plugin/skill tree — `~/.claude/skills/overnight-insight-discovery/` does
-  not exist, so Skill-tool invocations fail silently
+- No plugin/skill tree at any install root — the skill is present under
+  none of `$CLAUDE_PLUGIN_ROOT`, `~/.claude/skills/`, or
+  `~/.claude/plugins/cache/`, so Skill-tool invocations fail silently.
+  Check all three before concluding the skill is absent: a plugin install
+  populates only the third.
 - Tools you *think* are auto-included by "being an autonomous Claude Code
   agent" are in fact gated by the trigger's `allowed_tools` list. If you
   don't list `RemoteTrigger` explicitly, the dispatched agent cannot call it
@@ -66,8 +69,19 @@ python3.11 -c "import pandas, scipy, statsmodels, xgboost, matplotlib, seaborn,
 # Project-specific auth — service account, NOT user's personal ADC
 test -f "$GOOGLE_APPLICATION_CREDENTIALS" && echo "SA key present"
 
-# Skill tree
-test -f ~/.claude/skills/overnight-insight-discovery/SKILL.md
+# Skill tree — probe ALL THREE install roots. A plugin install creates
+# neither of the first two, so checking ~/.claude/skills/ alone reports a
+# perfectly healthy plugin install as a missing skill and tap-outs the run.
+S="${CLAUDE_PLUGIN_ROOT:+${CLAUDE_PLUGIN_ROOT}/SKILL.md}"
+[ -f "$S" ] || S="$HOME/.claude/skills/overnight-insight-discovery/SKILL.md"
+[ -f "$S" ] || S="$(find -L "$HOME/.claude/plugins/cache" -mindepth 4 -maxdepth 4 \
+    -path '*/overnight-insight-discovery/*/SKILL.md' 2>/dev/null \
+  | awk -F/ '{print $(NF-1)"\t"$0}' | sort -V -k1,1 | tail -1 | cut -f2-)"
+if [ -f "$S" ]; then
+  echo "overnight-insight-discovery SKILL.md: $S"
+else
+  echo "overnight-insight-discovery SKILL.md: not found — tried \$CLAUDE_PLUGIN_ROOT/, ~/.claude/skills/overnight-insight-discovery/, and ~/.claude/plugins/cache"
+fi
 
 # gh CLI + git
 gh --version

plugins/schedule-poll-orchestrator-pattern/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "schedule-poll-orchestrator-pattern",
   "description": "Fire-ASAP orchestrator pattern for multi-track autonomous overnight workflows dispatched via scheduled triggers (RemoteTrigger / CronCreate). Replaces a fixed `t+Nh` consolidation timer with a self-rescheduling poll loop that exits to consolidation at the first poll where all parallel tracks report `phase: complete`, and lets a scheduled successor survive a 12-20h session end. Distinct from successor-handoff (in-session parent polling a subagent); this is for scheduled-trigger orchestrators that must outlive their session.",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "author": { "name": "wan-huiyan" },
   "repository": "https://github.com/wan-huiyan/overnight-workflows",
   "license": "MIT",

plugins/schedule-poll-orchestrator-pattern/SKILL.md

@@ -16,8 +16,8 @@ description: |
   (in-session parent polling a subagent) — this is for scheduled-trigger
   orchestrators that need to survive session ends.
 author: Claude Code
-version: 1.0.0
-date: 2026-04-21
+version: 1.0.1
+date: 2026-08-06
 ---
 
 # Schedule-Poll Orchestrator Pattern
@@ -206,10 +206,23 @@ v5 the client ah-ha insight run (2026-04-21):
 
 ## References
 
-- [`successor-handoff`](~/.claude/skills/successor-handoff/SKILL.md) —
-  sibling skill for in-session parent orchestrators.
-- [`claude-code-delayed-execution`](~/.claude/skills/claude-code-delayed-execution/SKILL.md)
-  — choosing between CronCreate and RemoteTrigger dispatch mechanisms.
-- [`overnight-insight-discovery`](~/.claude/skills/overnight-insight-discovery/SKILL.md)
-  — reference consumer of this pattern (Phase F / RESUME_MORNING.md).
+- The **`successor-handoff`** skill — sibling skill for in-session parent
+  orchestrators. Source:
+  [wan-huiyan/context-baton](https://github.com/wan-huiyan/context-baton/blob/main/plugins/successor-handoff/SKILL.md).
+- The **`claude-code-delayed-execution`** skill — choosing between CronCreate
+  and RemoteTrigger dispatch mechanisms.
+- The **`overnight-insight-discovery`** skill — reference consumer of this
+  pattern (Phase F / RESUME_MORNING.md). Source:
+  [wan-huiyan/overnight-workflows](https://github.com/wan-huiyan/overnight-workflows/blob/main/plugins/overnight-insight-discovery/SKILL.md).
 - Pattern origin: the client v5 overnight run session S98 (2026-04-21).
+
+## Version history
+
+- **v1.0.1** (2026-08-06) — The three References entries above were markdown
+  links to `~/.claude/skills/<name>/SKILL.md`. That path only exists when a
+  skill was copied in by hand; a plugin install puts it under
+  `~/.claude/plugins/cache/<marketplace>/<plugin>/<version>/`, so the links
+  pointed at a file most readers cannot open. There is no local path that
+  resolves under every install method, so they are now plain skill names plus
+  a GitHub URL where the source repo is known.
+- **v1.0.0** (2026-04-21) — Initial release.