# Transactional book cron runs and prompt-scanner false positives

## Why the collector must be read-only

Hermes runs a cron `script` before assembling and executing the agent task. If the script increments `next_fragment` and the assembled prompt is then blocked, times out, or fails before writing outputs, the state counter advances although no digest exists. Later runs silently skip that fragment.

Use this transaction boundary:

1. Collector reads `state.json`, resolves the current manifest entry, and emits JSON plus source text.
2. Agent creates the per-fragment report.
3. Agent appends the same report to the accumulating Markdown without deleting prior content/frontmatter.
4. Agent verifies both writes.
5. Agent updates `state.json` to the processed fragment plus one.

For recovery, compare state against concrete artifacts (`chapter_NN...` and the accumulating file), reset to the first missing fragment, then run once and verify all three artifacts: report, accumulation, and state.

## Cron injection scanner false positives with attached skills

Cron checks both the job prompt and, when skills are attached, the assembled prompt. Legitimate skill prose can contain a phrase matching a deception/prompt-injection signature even when the job prompt is clean.

Diagnostic sequence:

1. Read the cron output record and note whether it says the **assembled prompt** was blocked.
2. Inspect the job prompt and attached skill bodies for the named signature and invisible Unicode.
3. If the skills are optional and the cron prompt can be fully self-contained, detach them and copy only the task-relevant requirements into neutral prose.
4. Rephrase any accidental signature in the job prompt; do not disable security scanning.
5. Run the job once manually and verify `last_status`, output files, accumulating Markdown, and state progression.

Avoid recording the blocked run as completed work. When repeat accounting has already consumed failed executions, adjust the remaining run count so every intended fragment still gets one successful processing run, while avoiding an unnecessary completion-only delivery unless requested.