feat: auto-capture Claude Code sessions via Stop hook

Add deploy/hooks/capture_stop.py — a Claude Code Stop hook that reads
the transcript JSONL, extracts the last user prompt, and POSTs to the
AtoCore /interactions endpoint in conservative mode (reinforce=false).

Conservative mode means: capture only, no automatic reinforcement or
extraction into the review queue. Kill switch: ATOCORE_CAPTURE_DISABLED=1.

Also: note build_sha cosmetic issue after restore in runbook, update
project status docs to reflect drill pass and auto-capture wiring.

17 new tests (243 total, all passing).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/backup-restore-procedure.md

@@ -247,6 +247,18 @@ for i in 1 2 3 4 5 6 7 8 9 10; do
 done
 ```
 
+**Note on build_sha after restore:** The one-shot `docker compose run`
+container does not carry the build provenance env vars that `deploy.sh`
+exports at deploy time. After a restore, `/health` will report
+`build_sha: "unknown"` until you re-run `deploy.sh` or manually
+re-deploy. This is cosmetic — the data is correctly restored — but if
+you need `build_sha` to be accurate, run a redeploy after the restore:
+
+```bash
+cd /srv/storage/atocore/app
+bash deploy/dalidou/deploy.sh
+```
+
 ### Post-restore verification
 
 ```bash

docs/current-state.md

@@ -244,12 +244,16 @@ This separation is healthy:
 
 ## Immediate Next Focus
 
-1. Re-run the full backup/restore drill on Dalidou with the
-   Chroma bind-mount fix in place (end-to-end green, not the
-   partial pass from 2026-04-09)
-2. Turn on auto-capture of Claude Code sessions in conservative
-   mode now that the restore path is trustworthy
-3. Use the new T420-side organic routing layer in real OpenClaw workflows
+1. ~~Re-run the full backup/restore drill~~ — DONE 2026-04-11,
+   full pass (db, registry, chroma, integrity all true)
+2. ~~Turn on auto-capture of Claude Code sessions in conservative
+   mode~~ — DONE 2026-04-11, Stop hook wired via
+   `deploy/hooks/capture_stop.py` → `POST /interactions`
+   with `reinforce=false`; kill switch via
+   `ATOCORE_CAPTURE_DISABLED=1`
+3. Run a short real-use pilot with auto-capture on, verify
+   interactions are landing in Dalidou, review quality
+4. Use the new T420-side organic routing layer in real OpenClaw workflows
 4. Tighten retrieval quality for the now fully ingested active project corpora
 5. Move to Wave 2 trusted-operational ingestion instead of blindly widening raw corpus further
 6. Keep the new engineering-knowledge architecture docs as implementation guidance while avoiding premature schema work

docs/next-steps.md

@@ -20,24 +20,14 @@ This working list should be read alongside:
 
 ## Immediate Next Steps
 
-1. Re-run the backup/restore drill on Dalidou with the Chroma
-   bind-mount fix in place
-   - the 2026-04-09 drill was a PARTIAL PASS: db restore + marker
-     reversal worked cleanly, but the Chroma step failed with
-     `OSError [Errno 16] Device or resource busy` because
-     `shutil.rmtree` cannot unlink a Docker bind-mounted volume
-   - fix landed immediately after: `restore_runtime_backup()` now
-     clears the destination's CONTENTS and uses
-     `copytree(dirs_exist_ok=True)`, and the regression test
-     `test_restore_chroma_does_not_unlink_destination_directory`
-     asserts the destination inode is stable
-   - need a green end-to-end run with `--chroma` actually
-     working in-container before enabling write-path automation
-2. Turn on auto-capture of Claude Code sessions once the drill
-   re-run is clean
-   - conservative mode: Stop hook posts to `/interactions`,
-     no auto-extraction into review queue without review cadence
-     in place
+1. ~~Re-run the backup/restore drill~~ — DONE 2026-04-11, full pass
+2. ~~Turn on auto-capture of Claude Code sessions~~ — DONE 2026-04-11,
+   Stop hook via `deploy/hooks/capture_stop.py` → `POST /interactions`
+   with `reinforce=false`; kill switch: `ATOCORE_CAPTURE_DISABLED=1`
+2a. Run a short real-use pilot with auto-capture on
+   - verify interactions are landing in Dalidou
+   - check prompt/response quality and truncation
+   - confirm fail-open: no user-visible impact when Dalidou is down
 3. Use the T420 `atocore-context` skill and the new organic routing layer in
    real OpenClaw workflows
    - confirm `auto-context` feels natural