Routines: unattended cloud runs hang indefinitely on sensitive-file prompts for `.claude/` writes (PreToolUse allow does not override)

## Summary

Unattended **Routines** (cloud) hang indefinitely when the session writes to a path under `.claude/`. A sensitive-file approval prompt is raised, nobody is there to answer it, and the run stalls until it is killed. All work done in the run is lost.

This is the unattended counterpart of #16762 and #43001 (both closed and locked). Those describe an *interactive* annoyance — the prompt reappears and "always allow" does not persist. In an unattended run the same mechanism is not an annoyance, it is **silent total loss**, and there is no configuration that avoids it.

Filing a new issue as the bot on those threads instructs.

## Why this is worth separating from #16762 / #43001

| | #16762 / #43001 (interactive) | This report (unattended Routines) |
|---|---|---|
| Symptom | Prompt reappears every session | Run hangs until killed |
| Cost | Press a key | Every change in the run is discarded |
| Visible? | Yes, immediately | **No.** The run just never finishes |
| Workaround | Press the key | None via configuration (see below) |

## Measured occurrences

Three runs on my account, all stalled on a write under `.claude/`:

| Date (JST) | Routine | Stalled for |
|---|---|---|
| 2026-08-21 | health check (daily) | 5h 27m |
| 2026-08-21 | night shift | 7h 12m |
| 2026-08-23 | health check (daily) | **13h 24m** |

The 2026-08-23 run is the clearest case. **The routine completed all of its work** — it ran the full check and produced its result (`FAIL 0 / WARN 1`) — and then hung on the single step of writing that result to `.claude/HANDOFF.md`. **Not one character was delivered.** Session: `cse_01BxwQoYGGtAPaW2pN8EPsZt`.

## What does not work

1. **`PreToolUse` hook returning `allow` does not override it.** The hook fires normally — the run log for the 08-23 session shows `hook_started` ×23 and `hook_response` ×23 — and the prompt still appears. This matters for diagnosis: it is easy to conclude "my hook isn't running" and spend a long time fixing the wrong thing. The hook *is* running; the sensitive-file check wins.

This is consistent with #43001's observation that the sensitive-file check appears to run before permission settings are consulted.

2. **Switching tools does not avoid it.** Writing with a Bash heredoc (`cat >> .claude/... <<'EOF'`) is blocked the same way as `Edit`/`Write`. The classification is on the **target path**, not the tool.

3. **Reads are not affected.** `head`/`Read` on the same file work. Only writes are blocked.

## Contradiction with the documentation

[Automate work with routines](https://code.claude.com/docs/en/routines) states:

> Routines run autonomously as full Claude Code cloud sessions: there is no permission-mode picker and **no approval prompts during a run**.

That is what I built around, and it is not what happens. Either the docs should note the sensitive-path exception, or unattended runs should not raise this prompt.

## Steps to reproduce

1. Create a Routine (cloud) on a repository that contains a `.claude/` directory.
2. Give the prompt a step that writes to a file under `.claude/`, e.g. append a line to `.claude/HANDOFF.md`.
3. Optionally add a `PreToolUse` hook that returns `allow` for that path, to confirm it does not help.
4. Let the routine fire on its schedule (unattended — do not open the session).
5. The run reaches the write step and stops. It stays there until the run is terminated.

## Expected behaviour

In an unattended run, one of:

- the sensitive-file check is skipped (the run has no human to consult), **or**
- a `PreToolUse` hook returning `allow` overrides it, **or**
- the tool call is **denied immediately** so the session can handle the failure and still report.

Any of the three is workable. **Blocking on a prompt that can never be answered is the one behaviour that cannot be handled**, because the run cannot even report why it failed.

Denying fast would be my preference: an unattended agent can route around a denial, but it cannot route around an unanswerable question.

## Workaround (for anyone hitting this)

Move the write target outside `.claude/`. I moved my routines' report file to `docs/auto-reports/` and the hangs stopped. Reads from `.claude/` can stay as they are.

## Environment

- Claude Code Routines (cloud, research preview), Anthropic-managed environment
- Routines on schedule triggers, `persist_session: false`
- Models: `claude-sonnet-5` (health check), `claude-opus-5` (night shift)

Start by reproducing the scheduled cloud Routine write to `.claude/HANDOFF.md`, with and without the `PreToolUse` hook, and compare it with the documented behavior in Automate work with routines. Trace the sensitive-file approval and unattended-run entry points to determine which behavior is supported. Done means an unattended write no longer waits indefinitely and the run reports a completed or denied result.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.