Find Handoff

---
description: "Recover a lost handoff after `/clear`: find the save-point file or resume prompt. Read-only: checks `MEMORY_DIR/handoffs/`, then a bounded scan of recent transcripts, then confirms before resuming. Use when: 'find my handoff', 'recover the handoff', 'I lost the resume prompt', 'forgot to copy the resume prompt', 'I cleared without saving the prompt', 'where's my handoff', 'recover after /clear', 'get back the handoff'. A session that ended mid-work goes to /session-flow:keep-going."
user-invocable: true
disable-model-invocation: false
shell: bash
metadata:
  workflow-stage: session
  summary: Recover a lost handoff or resume prompt after /clear
---

## Pre-computed context

Default-location handoffs (this repo): !`ls -1t .work/handoffs/*-handoff-*.md 2>/dev/null | head -5 || echo "none at default .work/handoffs/"`
Transcript project dirs (recent): !`ls -1dt "$HOME/.claude/projects/"*/ 2>/dev/null | head -8 || echo "none"`

## Context. Gather first

Take `session-id` and `branch` only. This skill's detection ladder reads the filesystem, not git
state. Probe commands, the one-command-per-call and treat-failure-as-unknown rules, and the
`$`-expansion rationale, including that bare `$HOME` is the one form observed to survive the
worktree-isolation guard while `${HOME}` is refused:
[`${CLAUDE_PLUGIN_ROOT}/reference/gather.md`](${CLAUDE_PLUGIN_ROOT}/reference/gather.md).

# Find handoff

## Purpose

Recover a handoff whose **resume prompt was never copied.** The canonical failure: a session
writes a save-point via `/session-flow:handoff`, the operator runs `/clear`, but forgets to copy
the dashed-rail resume prompt, so the fresh session starts with zero context and no path to the
handoff on disk. This skill runs a **read-only** detection ladder that finds the lost handoff (file
or prompt-only), confirms it with the operator, then routes to the normal resume path.

It exists because ad-hoc recovery is filesystem-plus-transcript archaeology that is easy to get
wrong: `/clear` keeps the same project directory but opens a **new** transcript file, so the
pre-clear content sits in a sibling, never in the current session's own file.

## The detection contract this keys off

`/session-flow:handoff`'s output shape is a **stable detection contract** (documented in
[`${CLAUDE_PLUGIN_ROOT}/reference/save-point.md`](${CLAUDE_PLUGIN_ROOT}/reference/save-point.md)
"Detection contract"). This skill depends on three DETECTION signals, in precision order, plus one
resolution input, `Handoff origin:`, described after them:

1. **The file directive**. `Read @<path>/handoffs/<TS>-handoff-<topic>.md …`. It embeds the exact
   path to recover and survives verbatim into transcript JSONL, so it is the highest-precision key
   for a **file-based** handoff. **Two path forms qualify:** an absolute path (what the producer
   emits) and a repo-relative path (what older handoffs on disk carry). Match the directive on its
   `…handoffs/<TS>-handoff-…` shape, which both forms share, and let them diverge only at the
   existence check (step 3). The shape-2 directive
   continues past `then continue them.` with an invoke-the-skill sentence; older directives end
   there. Neither the sentence's presence nor its absence is a signal.
2. **The copy instruction + its rail pair**, the literal
   `` `/clear`, then copy everything between the dashed lines `` line and the two `─` (U+2500)
   rails under it. For a **prompt-only** handoff there is no file and no directive; the resume
   content is inline between the rails, and the transcript is the only record, so this is the
   primary key for that branch. A prompt can hold four rails, not two: when a goal applies, a
   second pair headed by its own `Type /goal` instruction line sits above or below the resume
   region. That goal region is not a signal, since the resume region is always present and keys
   the recovery; it is part of the unit recovered (below), and a scan that assumes exactly two
   rails in a prompt misses or truncates it.
3. **`Prior session: <UUID>`** and the `type: handoff` frontmatter (structure doc), corroborating
   signal that pins the session chain. Corroboration only: the file-mode shape emits the
   `Prior session:` line, but the producer's prompt-only checklist does not require it, so its
   absence never disqualifies a prompt-only candidate.

**`Handoff origin:` is a resolution input, not a detection signal.** It cannot admit or reject a
candidate, a block is already qualified by the three signals above before it is read, so it is
deliberately outside that numbered list, and outside the conditional-signal slot the `/loop` re-arm
note holds below. What the ladder depends on it for is step 3's existence check: it names the
repository and repo-relative path that let a ROOTED directive survive a machine or checkout change,
which is the one failure an absolute path has that a relative one does not. Only the file-mode
shape emits it, and only alongside an absolute directive, so its absence disqualifies nothing:
prompt-only never emits it, and a repo-relative directive never has one. It
has two forms on disk and both are read: the shape-2 two-slot form
`Handoff origin: <remote URL> <repo-relative path>` (a slot with whitespace double-quoted) and the
legacy form `Handoff origin: <identity>, relative path <path>.`.

**A shape-2 file stores its own resume prompt.** Files carrying `handoff_shape: 2` end with a
`## Resume prompt` section holding the rails prompt exactly as it was emitted (both regions when a
goal applied), so rung 1 can hand back the prompt from the file alone, without a transcript
(`${CLAUDE_PLUGIN_ROOT}/scripts/save_point.py emit <file>`; see rung 1). A `type: handoff` file
that still carries a `<!-- FILL` slot is an unfinished skeleton the producer never completed; it
is named as such and never presented as the lost handoff.

**The resume prompt this skill recovers is the resume region PLUS the goal region (when one
applies) PLUS every below-rail `/loop` re-arm message** (save-point.md "Detection contract"). The
goal region is a second rail pair headed by the `Type /goal` instruction line, above or below the
resume region; recover both regions in the order emitted, each with its own instruction line. The
`/loop` re-arm sits outside every region: a command is recognized only at a message's start, so
the producer emits it as a separate follow-up message and places its instruction below the bottom
rail. Recovering only the resume region would therefore hand back a continuation whose goal is
gone or that runs once and silently drops the loop, the same failures the producer's goal and
re-arm rules exist to prevent. The note is a fourth, **conditional** signal: present only when the
lost session was running under `/loop`, so its absence disqualifies nothing, and a **repeatable**
one, since the producer emits a separate re-arm message per surviving loop, so "found one" is never
"found them all".

## The recovery ladder. Read-only throughout

1. **Known-location glob first (no transcript needed).** Resolve `<memory_dir>/handoffs/` for the
   **current repo**,
   never the literal `.work`. Read
   [reference/rung-1-known-location.md](reference/rung-1-known-location.md) before globbing: it owns
   the fallback-root rule and when it applies, the `type: handoff` frontmatter filter, the
   unfinished-skeleton skip, the mtime ranking, the short-circuit bar and where a short-circuit
   jumps to, how a shape-2 candidate's stored `## Resume prompt` is printed, and the
   repo-correlation check that stops a merely recent candidate from being presented as this
   work's. A strong, recent candidate ends the ladder here.

2. **Transcript scan. Bounded, recency-ranked, cross-repo.** Enumerate `~/.claude/projects/*/`
   project dirs (the lost session may have run in a **different** repo, so scan all of them, not
   only the current project's dir), rank `.jsonl` by mtime, and take the top handful. **Bound the
   scan**, a full recursive grep over every transcript is slow enough to time out; an mtime-sorted
   candidate list is mandatory, not optional. **Exclude the current session's own transcript**
   (the session id gathered above): `/clear` opened a new file in the same project
   dir, so the pre-clear content is a sibling, never this file.

3. **Marker detection over candidate tails (grep, read-only).** Read
   [reference/rung-3-marker-detection.md](reference/rung-3-marker-detection.md) before scanning any
   candidate tail: it owns the three marker forms, the two-stage assistant-text-only acceptance,
   the rails-block reconstruction, the below-rail `/loop` re-arm capture, the JSON-unescape step
   that keeps the surfaced prompt readable, and the read-only bounds on the scan. A run that
   resolved at rung 1 never needs it.

4. **Confirm before resuming. Hard gate.** Surface the found handoff's **metadata only**: the
   recovered file path (or the original `Read @…` directive as found), topic, date, and the
   `session_id` chain (file mode) or the inline resume prompt (prompt-only mode), the path is the
   thing being recovered, and the operator cannot verify the candidate without it. **Surface the
   captured `/loop` re-arm notes with it, all of them, on both modes, whenever any were found**,
   and say plainly that each re-arm is its own follow-up message sent after the continuation is
   under way. Dropping one here loses that loop just as surely as never recovering the prompt. Ask
   for an explicit yes/no and **stop**. Do not read the file's body, `/clear`, or execute the
   resume prompt before the operator confirms. Resuming the **wrong** handoff is worse than
   recovering none.

   **UNRESOLVED candidates are presented, not suppressed.** A candidate whose directive named a file
   that could not be located is surfaced alongside the resolved ones and labeled `UNRESOLVED`,
   carrying the directive verbatim, the filename, and any `Handoff origin:` line. Name the reason
   precisely rather than reporting "the file is missing"; those are different failures, and
   reporting absence for either of them is what makes this expensive to diagnose:
   - **Rootless**. The path has no root, and the transcript `cwd` it was resolved against did not
     hold it. Say which `cwd` was tried. Closing it takes one fact: the operator names the
     repository the work was in, and the relative path resolves under it.
   - **Rooted**. The path is absolute and nothing is at it on THIS machine, which is what a resume
     on a different machine or checkout looks like. Say the absolute path that was tried, and the
     repository the `Handoff origin:` line named. Closing it takes the local checkout of that
     repository.

   An UNRESOLVED candidate never auto-wins over a resolved one, and it is never the default answer
   when a resolved candidate exists.
5. **Chain validation (file mode).** Validate each frontmatter pointer against what it actually
   names:
   - `session_id` identifies the **emitting** session. Compare it with the source transcript when
     the candidate came from the transcript scan. On a glob-only recovery (step 1 jumped straight
     to step 4 with no transcript in hand), locate the producer transcript by that `session_id`,
     transcript files are named `<session_id>.jsonl` under `~/.claude/projects/*/`, and compare
     against that; when it cannot be found, say so and present the candidate as unvalidated rather
     than blocking or guessing.
   - `previous_handoff` deliberately names the **predecessor** in the chain (structure doc "Chain
     continuity"), not the emitting transcript. Validate it against the named prior handoff file,
     never against the source transcript, or a valid chained handoff looks inconsistent.
   On a mismatch, flag it and let the operator decide, never silently splice an unrelated session
   into the chain.
6. **Hand off to the resume path.** On confirmation:
   - **Clean save-point** → read the handoff file and continue its remaining next steps (the normal
     `/session-flow:handoff` resume path). For a prompt-only recovery, continue from the inline
     prompt.
   - **Ended mid-work** (the recovered state shows interrupted, in-flight work rather than a
     deliberate save-point) → hand off by invoking `/session-flow:keep-going` via the Skill tool, which recovers and continues
     interrupted work.

## Read-only + redaction. Hard invariants

- **Read-only through the confirm gate.** Detection and everything before the operator's
  confirmation writes nothing, never `/clear`s, never executes the resume. **After** confirmation,
  control passes to the selected resume path (the handoff's next steps, or
  `/session-flow:keep-going`), which acts normally, the read-only guarantee covers the recovery,
  not the resumed work.
- **Redaction-aware.** Transcripts and handoff files can contain secrets. Quote **only** the resume
  prompt, its rails regions plus every below-rail `/loop` re-arm note, and the handoff metadata;
  **never** dump raw transcript content. The re-arm notes are no exception: each quotes the
  operator's original loop prompt verbatim, which can carry a token, so they go through the same pass as
  everything else rather than riding along unscanned. Apply the same
  shape-marker redaction the producer uses (`save-point.md` "Redaction pass"): replace any
  secret / token / credential / connection string / PII with a shape marker (`<REDACTED: API key>`),
  never the value. A value acceptable in-session is not acceptable to re-surface from a transcript.
- **The `Handoff origin:` value is a named credential vector, and it takes a different treatment from
  the bullet above.** It can carry a git remote URL, and a remote embeds its credential in the URL's
  userinfo component (`https://<token>@host/…`), where it reads as a path segment rather than as a
  secret. This skill surfaces that value at the confirm gate and derives a widening root from it, so
  it is checked for an `@` ahead of its host before either. **Drop the userinfo and keep the rest. Do
  NOT replace the URL with a shape marker.** The shape-marker rule above assumes the whole value is
  secret and unneeded downstream; a remote URL is the opposite. Its host and path are not secret and
  they are what makes the value useful: this line is the input that re-resolves a rooted miss, so a
  `<REDACTED: remote URL>` marker would destroy the identity recovery depends on and turn a
  credential leak into a failed recovery. So `https://<token>@github.com/<owner>/<repo>.git` is
  surfaced as `https://github.com/<owner>/<repo>.git`, never a marker; when the userinfo boundary is
  not clear (`save-point.md` `<repo-identity>` gives the test), surface the repository name alone
  rather than guessing. The producer strips it at emit time, but older handoffs on disk may carry
  it unstripped. Recovery is exactly where an unsanitized one arrives.

## Boundaries. Pick the right sibling

- **`/session-flow:handoff`**, the producer. Writes the save-point + resume prompt this skill
  recovers. find-handoff writes nothing during recovery.
- **`/session-flow:keep-going`**. Recovers and continues **off-thread / interrupted** work. When
  the lost session ended mid-work, this skill hands there. keep-going covers the case where the
  handoff path is *known* but work was interrupted; find-handoff covers the disjoint case where the
  path itself is lost.
- **`/session-flow:orient`**. Reads durable state (including handoffs) whose location is already
  known, for a where-we-stand briefing. find-handoff is the recovery step for when that location is
  unknown.

## What this skill does NOT do

- **Writes nothing during recovery**, no files, no memory, no `/clear`, no resume execution
  before the confirm gate. Post-confirmation work belongs to the selected resume path, not to this
  skill's recovery ladder.
- **Does not dump raw transcript content**. Surfaces only the resume prompt (its rails regions plus
  the below-rail `/loop` re-arm notes) + metadata, redacted.
- **Does not auto-resume**. The confirm-before-resume gate is mandatory; wrong-handoff resumption
  is worse than none.
- **Does not scan unbounded**. The transcript scan is mtime-sorted and capped; it never grep-walks
  every transcript on the machine.
- **Does not diagnose the interruption** or recover off-thread work; that is
  `/session-flow:keep-going`.

## Spoke paths

The `reference/` files write the plugin's root directory as `<plugin-root>`, which is
`${CLAUDE_PLUGIN_ROOT}`. Put that path in place of the placeholder before running a command or
writing it into a brief. Those files arrive through the Read tool as plain bytes, so a `${…}` token
in them would reach the Bash tool unsubstituted, and the Bash tool's environment has no
`CLAUDE_PLUGIN_ROOT` to expand it from. Basis: the plugins reference,
<https://code.claude.com/docs/en/plugins-reference#where-each-variable-resolves>, verified
2026-09-30; recheck when that table adds supporting files to where a `${…}` reference resolves.

## Gotchas

- **`/clear` writes a NEW transcript file** in the **same** project directory. The pre-clear
  content is in a sibling `.jsonl`; searching only the current session's file finds nothing. Always
  exclude the current `$CLAUDE_CODE_SESSION_ID` and scan siblings. Verified 2026-09-06 against
  Claude Code 2.1.263, on two bases:
  [Commands](https://code.claude.com/docs/en/commands), where `/clear` starts a new conversation
  with empty context, and
  [Data usage](https://code.claude.com/docs/en/data-usage#data-retention), where transcripts are
  stored per project under `~/.claude/projects/`. A listing of one project directory
  (`ls ~/.claude/projects/<project>/*.jsonl`) shows the sibling files that scan reads. Recheck when
  either page stops carrying those statements, or when a listing of a project directory no longer
  returns one `.jsonl` per conversation.
- **The template placeholder is a false positive.** `Read @<handoffs-dir>/<TS>-handoff-<topic>.md`
  appears verbatim in any transcript that read `save-point.md` into context. Discard matches
  containing the template's placeholder tokens; keep only concrete resolved paths. The prompt-only
  template, the `─` rails plus a placeholder body and a literal `Prior session: <UUID>`, is the
  same false positive; reject a block on those specific tokens, and require a concrete session
  UUID (not the `<UUID>` placeholder) on any `Prior session:` line before surfacing. **Never
  blanket-reject angle brackets**. Valid prompts carry `<REDACTED: …>` shape markers and code
  syntax.
- **A repo-relative directive resolves by inference.** Directives come in two forms: absolute
  (what the producer emits) and repo-relative (what older handoffs on disk carry), so both keep
  arriving. For the rootless form, read the `cwd` field of the transcript the directive was found
  in and resolve against that. Checking existence from the current session's cwd falsely reports
  a cross-repo handoff missing. But that resolution assumes the producer's cwd *was* the
  repository it wrote into, which is untrue for exactly the sessions this skill exists to rescue:
  a session working in a repo that is not cwd's project root. So a rootless miss is UNRESOLVED,
  not absent. Surface it with its directive and say the path has no root, never that the file is
  missing.
- **Markers in user messages, tool results, and tool INPUTS are not handoffs.** A pasted sample or
  an echoed doc puts the rails on a `"type":"user"` line, and an assistant `Write`/`Edit` call
  carrying rails in its file content serializes on a `"type":"assistant"` line. The same-line role
  check is only the cheap pre-filter; confirm on the per-candidate decode that the marker sits in
  an assistant `text` content entry, not a `tool_use` input.
- **Near-identical mtimes.** Multiple sessions can write within seconds; mtime cannot rank them.
  The directive / rails / `Prior session:` markers break the tie, not the timestamp.
- **Handoff files live in gitignored dirs far from `$HOME`**, and `memory_dir` is
  consumer-configurable, so the filesystem glob can miss them. Transcripts are the reliable index:
  they record the exact path (file mode) or the whole prompt (prompt-only), regardless of where the
  file lived.
- **Prompt-only handoffs have no file at all.** Do not error on a missing file, the resume content
  is inline between the rails in the transcript, and that is the recovery.
- **The goal region is a second rail pair, and recovering only the first pair loses it.** A prompt
  with a goal holds four rails: the `Type /goal` region and the `/clear` region, in either order.
  Take each region by its own instruction line and rail pair, so the goal condition comes back with
  the resume prompt instead of a continuation that has forgotten its goal. A file stores both, so
  rung 1 returns them; a transcript scan has to keep reading past the first bottom rail.
- **The `/loop` re-arm sits OUTSIDE every region, and recovering only the regions loses it.** The
  goal comes back with the goal region; the loop re-arm cannot be inside any region, because a
  command is only recognized at a message's start and the re-arm has to be its own message.
  Recover the note anchored to the bottom rail and surface it at the confirm gate, or the
  recovered continuation runs exactly once and the recurring behavior dies silently, which is the
  failure the producer's re-arm rule was written to stop.
- **A background-launch save-point is not a lost handoff.** `continue-in-background` uses the same
  save-point engine, so its file looks identical, but its rails prompt was delivered, to the
  launched agent, and resuming it manually duplicates work already running in the background.
  Screen candidates via the producer transcript's launch signature, correlated to the exact file
  the launch's resume directive references, never session-wide, since one session can produce
  both a manual handoff and a later background launch under the same `session_id`, and never on
  the `continue-<topic>` slug alone (topic-only: same-topic files all match; ambiguous unless it
  uniquely resolves). "Successful" always means verified-visible. Transcript evidence the agent
  appeared, never exit-0 alone, since the producer itself warns a zero-exit launch can be
  invisible; unverified → ambiguous, keep the candidate. Exclusion also turns on the
  continuation's CURRENT state, because historical visibility is launch-time only, and that state
  must be read with **`claude agents --json --all`**. The bare `--json` lists active sessions only,
  so a continuation that COMPLETED SUCCESSFULLY is absent from it and indistinguishable there from
  one that died; treating that absence as failure surfaces a finished continuation's save-point as
  a lost handoff, which invites redoing done work and can bury the older manual handoff. Apply
  step 1's four-way resolution: live → exclude (running); terminal and completed → exclude, saying
  it FINISHED and pointing at that session's output; terminal and not completed → keep, as the
  restart artifact; absent even from `--all` → UNKNOWN (the history is bounded), keep, and do not
  call it a failure.
  Prompt-only continuations screen the same way, bound by content: a rails block whose exact
  prompt a verifiably successful `claude --bg` launch delivered (the producer writes it to a temp
  file in the same transcript first) was delivered, not lost, a later launch of a different
  prompt never disqualifies an earlier manual block.