fix(research-loop-cap): resolve the data root in code so the loop can run

CLAUDE_PLUGIN_DATA is empty in the Bash tool's process env, and the Phase 5
bash snippet is the cap's only caller. resolveLedgerPath() returned null there
and allowTurn() failed closed, so the budget gate denied turn 1 of every real
run: the loop this delivery exists to bound could never spend a turn, and the
pre-registered measurement could not be run at all.

resolveDataRoot() is now the single root for everything the loop writes --
CLAUDE_PLUGIN_DATA when the harness sets it, ~/.claude/voyage when it does
not. Three consumers resolve through it, which is the point: the cap ledger,
the PreToolUse hook's scope-marker lookup, and the command's bash snippets.
A writer and a reader that resolved the root separately are what made the
enforcement hook allow unconditionally in every real run while CLAUDE.md and
docs/architecture.md called it enforcing.

Same root cause, same commit:
- Marker write and remove now share ONE absolute-path guard and one root; the
  write requires a non-empty CLAUDE_CODE_SESSION_ID before composing the path
  (unset, the marker was named `.json`, which no lookup matches and no TTL
  sweep cleans up).
- The per-turn gates resolve VOYAGE_ROOT with a plugin-cache fallback and
  reserve exit 2 for "gate could not run". Interpolating an empty
  ${CLAUDE_PLUGIN_ROOT} ran `node /lib/...` -> exit 1, which the contract read
  as "privacy gate says no" -- an unsatisfiable rewrite loop no query could
  clear.

Two now-unreachable deny branches are removed rather than left as dead safety
claims (allowTurn's no_plugin_data_dir; the hook's uncountable-ledger deny).
The fail-closed stance stays where it is still real: a ledger that cannot be
WRITTEN denies the turn.

Verified end-to-end through the real bash snippets and the real hook with both
variables stripped and HOME sandboxed: marker written under the fallback root,
8 turns spent, 9th denied, hook exits 2, and exits 0 again after removal.
Note: the fallback exit-2 branch fires against the installed v5.9.1 cache,
which predates lib/util/research-loop-cap.mjs -- correct behaviour, and it
clears when the plugin is reinstalled.

Review findings 2670c10a, fbd6d534, 93550dfb.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011vPSXe88qp5aqWUqbDNWoF

hooks/scripts/pre-agent-cap.mjs

@@ -19,7 +19,11 @@
 //
 // Scope key — the property that makes this safe to wire globally:
 //   session_id + a scope marker file that only the Phase 5 loop writes, at
-//   ${CLAUDE_PLUGIN_DATA}/trekresearch-loop-scope/<session_id>.json:
+//   <data root>/trekresearch-loop-scope/<session_id>.json, where the data root
+//   comes from research-loop-cap.mjs's resolveDataRoot() — the same function
+//   the writer resolves through, because a writer and a reader that resolve
+//   the root separately are a hook that enforces nothing while reporting that
+//   it does:
 //       { "runId": "<run id>", "startedAt": "<ISO-8601>" }
 //   No marker for this session => out of scope => allow, unconditionally. An
 //   unrelated session must never be denied because some other run spent its
@@ -28,9 +32,10 @@
 // Fail-open vs fail-closed, deliberately split:
 //   - Out of scope (no marker, no session_id, unparsable stdin, stale marker,
 //     kill switch, STORM off) => exit 0. Fail OPEN.
-//   - In scope but the ledger cannot be read (CLAUDE_PLUGIN_DATA absent) =>
-//     exit 2. Fail CLOSED, mirroring research-loop-cap.mjs's own stance: a
-//     budget control that cannot count must not grant.
+//   - In scope and over budget => exit 2. Fail CLOSED, mirroring
+//     research-loop-cap.mjs's own stance: a budget control that cannot count
+//     must not grant. (The former "CLAUDE_PLUGIN_DATA absent" deny is gone —
+//     the root now always resolves, so that branch could no longer fire.)
 //
 // Counting is read-only. The ledger is append-only and written solely by
 // research-loop-cap.mjs's allowTurn(); if this hook appended, the cap would
@@ -43,7 +48,7 @@ import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
-const { resolveLedgerPath, resolveMaxConvTurns, isStormEnabled, MAX_TOTAL_DIMENSIONS } =
+const { resolveLedgerPath, resolveDataRoot, resolveMaxConvTurns, isStormEnabled, MAX_TOTAL_DIMENSIONS } =
   await import(join(HERE, '..', '..', 'lib', 'util', 'research-loop-cap.mjs'));
 
 const SCOPE_DIRNAME = 'trekresearch-loop-scope';
@@ -77,11 +82,10 @@ try {
 const sessionId = input?.session_id;
 if (!sessionId || typeof sessionId !== 'string') allow();
 
-// 4. Resolve the scope marker. VOYAGE_CAP_SCOPE_DIR exists so the marker
-//    location stays addressable when CLAUDE_PLUGIN_DATA is being tested as
-//    absent; in production both point at the same plugin data directory.
-const scopeDir = env.VOYAGE_CAP_SCOPE_DIR || env.CLAUDE_PLUGIN_DATA;
-if (!scopeDir) allow();
+// 4. Resolve the scope marker through the writer's own root resolution.
+//    VOYAGE_CAP_SCOPE_DIR stays as a test/override seam; unset, this lands on
+//    exactly the directory the Phase 5 snippet writes into.
+const scopeDir = env.VOYAGE_CAP_SCOPE_DIR || resolveDataRoot(env);
 
 const markerPath = join(scopeDir, SCOPE_DIRNAME, `${sessionId}.json`);
 if (!existsSync(markerPath)) allow();
@@ -109,14 +113,6 @@ if (!Number.isFinite(startedAt) || Date.now() - startedAt > ttlMs) {
 
 // 6. The ledger is the only source of truth for turns spent.
 const ledgerPath = resolveLedgerPath(env);
-if (!ledgerPath) {
-  deny(
-    `  Session ${sessionId} is inside a Phase 5 research loop (run ${marker.runId}),\n` +
-    `  but CLAUDE_PLUGIN_DATA is not set, so the turn ledger cannot be read.\n` +
-    `  A budget control that cannot count does not grant. Set CLAUDE_PLUGIN_DATA,\n` +
-    `  or set VOYAGE_DISABLE_CAP_HOOK=1 to disable this hook.`,
-  );
-}
 
 function countTurns(path, runId) {
   if (!existsSync(path)) return 0;