fix: address review — terminal phase guard, explicit marker var, test coverage

- Guard against overwriting terminal phases (PHASE:done, PHASE:merged)
  in on-stop-failure.sh to prevent false failures from same-turn race
- Declare sf_phase_marker explicitly in StopFailure block instead of
  relying on phase_marker from PostToolUse block
- Add authentication_failed test (10c) and terminal phase guard tests
  (10g, 10h)
- Fix fragile nested command substitution in test 10f fail() message

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lib/agent-session.sh

@@ -130,7 +130,10 @@ create_agent_session() {
   if [ -n "$phase_file" ]; then
     local stop_failure_hook_script="${FACTORY_ROOT}/lib/hooks/on-stop-failure.sh"
     if [ -x "$stop_failure_hook_script" ]; then
-      local stop_failure_hook_cmd="${stop_failure_hook_script} ${phase_file} ${phase_marker}"
+      # phase_marker is defined in the PostToolUse block above; redeclare so
+      # this block is self-contained if that block is ever removed.
+      local sf_phase_marker="/tmp/phase-changed-${session}.marker"
+      local stop_failure_hook_cmd="${stop_failure_hook_script} ${phase_file} ${sf_phase_marker}"
       if [ -f "$settings" ]; then
         jq --arg cmd "$stop_failure_hook_cmd" '
           if (.hooks.StopFailure // [] | any(.[]; .hooks[]?.command == $cmd))

lib/hooks/on-stop-failure.sh

@@ -25,6 +25,14 @@ reason=$(printf '%s' "$input" | jq -r '
 ' 2>/dev/null)
 [ -z "$reason" ] && reason="unknown"
 
+# Guard: do not overwrite a terminal phase. If Claude wrote PHASE:done via a
+# tool call and then hit a rate limit while generating the rest of its response,
+# the PostToolUse hook already recorded the correct terminal phase.
+existing=$(head -1 "$phase_file" 2>/dev/null | tr -d '[:space:]')
+case "$existing" in
+  PHASE:done|PHASE:merged) exit 0 ;;
+esac
+
 # Write phase file immediately — orchestrator reads first line as phase sentinel
 printf 'PHASE:failed\nReason: api_error: %s\n' "$reason" > "$phase_file"