fix: guard session_ids with optional chaining to prevent crash

boulderState?.session_ids.includes() only guards boulderState, not
session_ids. If boulder.json is corrupted or missing the field,
session_ids is undefined and .includes() crashes silently, losing
subagent results.

Changes:
- readBoulderState: validate parsed JSON is object, default session_ids to []
- atlas hook line 427: boulderState?.session_ids?.includes
- atlas hook line 655: boulderState?.session_ids?.includes
- prometheus-md-only line 93: boulderState?.session_ids?.includes
- appendSessionId: guard with ?. and initialize to [] if missing

Fixes #1672

src/hooks/atlas/event-handler.ts

@@ -41,7 +41,7 @@ export function createAtlasEventHandler(input: {
 
       // Read boulder state FIRST to check if this session is part of an active boulder
       const boulderState = readBoulderState(ctx.directory)
-      const isBoulderSession = boulderState?.session_ids.includes(sessionID) ?? false
+      const isBoulderSession = boulderState?.session_ids?.includes(sessionID) ?? false
 
       const isBackgroundTaskSession = subagentSessions.has(sessionID)
 

src/hooks/atlas/tool-execute-after.ts

@@ -65,7 +65,7 @@ export function createToolExecuteAfterHandler(input: {
       if (boulderState) {
         const progress = getPlanProgress(boulderState.active_plan)
 
-        if (toolInput.sessionID && !boulderState.session_ids.includes(toolInput.sessionID)) {
+        if (toolInput.sessionID && !boulderState.session_ids?.includes(toolInput.sessionID)) {
           appendSessionId(ctx.directory, toolInput.sessionID)
           log(`[${HOOK_NAME}] Appended session to boulder`, {
             sessionID: toolInput.sessionID,

src/hooks/prometheus-md-only/agent-resolution.ts

@@ -43,7 +43,7 @@ export function getAgentFromSession(sessionID: string, directory: string): strin
 
   // Check boulder state (persisted across restarts) - fixes #927
   const boulderState = readBoulderState(directory)
-  if (boulderState?.session_ids.includes(sessionID) && boulderState.agent) {
+  if (boulderState?.session_ids?.includes(sessionID) && boulderState.agent) {
     return boulderState.agent
   }