diff --git a/.abcd/development/brief/02-constraints/03-invariants.md b/.abcd/development/brief/02-constraints/03-invariants.md
index 60c19439e5..5e13616426 100644
--- a/.abcd/development/brief/02-constraints/03-invariants.md
+++ b/.abcd/development/brief/02-constraints/03-invariants.md
@@ -117,6 +117,25 @@ The following are non-negotiable invariants — any architectural choice that vi
    status branch holding a standing announcement it has not asked about. The
    prompt hook shows the announcements, the doubts and the release holds from
    the last completed fetch, from disk alone, and asks the network nothing.
+   The away mode (itd-2610180912189125) is the person's word that sessions
+   work on while they are away: setting it (`abcd mode autonomous`) invokes,
+   for as long as it holds, the stop check's one read of the forge at each
+   turn's end, at most one listing of the open pull requests through the
+   forge client (`gh pr list`: head and base branch, author, body, merge
+   state, review decision and check rollup), every open one when the
+   person's forge login is known, so another person's pull request can be
+   told from the session's own, and the person's own alone when it is not,
+   under a ten-second deadline, with
+   no cache, so a run of eight blocked stops costs up to eight bounded
+   listings. A listing that fails or is late is named as not read, never
+   hidden, and the check judges from disk alone: every pushed branch of the
+   session's own is compared with the last-fetched default branch, naming
+   when it was fetched, and a reservation is never reported as carried by no
+   pull request. Whenever the away mode does not hold, the stop check reads disk
+   only, and no turn's end touches the network, held by
+   `TestPresentReadsDiskOnly`
+   ([adr-2610181003541997](../../decisions/adrs/2610181003541997-the-away-mode-s-stop-check-reads-the.md),
+   which refines adr-38 for this verb's meaning alone).
    Inbound, abcd listens on a network only through the dashboard, only while
    someone has started it on purpose, and only for the people let in: it
    listens on this computer's own Tailscale addresses alone, never every
diff --git a/.abcd/development/brief/04-surfaces/01-ahoy.md b/.abcd/development/brief/04-surfaces/01-ahoy.md
index 361c799e3a..d5574cb84a 100644
--- a/.abcd/development/brief/04-surfaces/01-ahoy.md
+++ b/.abcd/development/brief/04-surfaces/01-ahoy.md
@@ -659,7 +659,7 @@ carries the prompt-router entries it expects. Neither install nor uninstall ever
 mutates it: the manifest is plugin-static. A missing or malformed manifest
 surfaces as a non-resolvable diagnostic.
 
-The shipped manifest wires seven event types, and every event command is a
+The shipped manifest wires nine event types, and every event command is a
 resolving shim rather than a plain binary call. Five of them self-provision.
 `UserPromptSubmit`, `PreToolUse`, `PostToolUse` and `PreCompact` each attempt
 `hooks/bootstrap.sh` only when the plugin-root binary is missing, recording the
@@ -668,8 +668,10 @@ window. `UserPromptSubmit`, the hook that runs on every message, declares a
 120-second `timeout`, the time a salvage on a slow link has before the host
 cancels it; `PreToolUse`, `PostToolUse` and `PreCompact` declare none and take
 the host's ten-minute default, so a slow first download finishes there. `SessionStart`
-declares 240 seconds, the script's worst case with room to spare, and
-`SessionEnd` and `SubagentStop` declare none. Every event that runs the script,
+declares 240 seconds, the script's worst case with room to spare,
+`SessionEnd`, `SubagentStop` and `StopFailure` declare none, and `Stop` declares
+30 seconds, room for the away mode's stop check to make its one forge listing
+under its own ten-second deadline and its git reads. Every event that runs the script,
 `SessionStart` included, names a `statusMessage` the host shows as its spinner
 text while the hook runs, so the wait is never a silent stall: the salvage
 itself sends the script's output nowhere. The message states no duration,
@@ -689,6 +691,12 @@ capture (iss-2608210934566223). Each resolves the plugin root, then `PATH`, then
 says in one line that the transcript was not captured. `SubagentStop` never
 returns a non-zero code of its own beyond that refusal, because exit 2 is the
 host's BLOCKING status on that event and would stop the sub-agent finishing.
+`Stop` and `StopFailure`, which carry the away mode's stop check
+(spc-2610180914469489), download nothing either: both fire at a turn's end, where
+a fetch would hold the session, and each resolves the plugin root, then `PATH`,
+then says in one line what did not happen, with exit 1, never the `Stop`
+event's blocking 2: `Stop` that the stop check did not run, `StopFailure` that
+a turn ended on an API error was not recorded.
 
 **The `PATH` rung is owned-only** (GHSA-gx3m-3224-qqcv, CWE-426). It accepts only
 an absolute resolution out of a directory that is neither under the shim's
diff --git a/.abcd/development/brief/04-surfaces/08-abcd.md b/.abcd/development/brief/04-surfaces/08-abcd.md
index e3d24a553b..b1ee3efb4d 100644
--- a/.abcd/development/brief/04-surfaces/08-abcd.md
+++ b/.abcd/development/brief/04-surfaces/08-abcd.md
@@ -22,14 +22,15 @@ answer.
 
 | Verb | Bucket | Status |
 |---|---|---|
-| `mode` | — | shipped |
 | `peers` | — | shipped |
 
 This is the bare command's chapter, so the rule compares its table with the
 command tree in neither direction: the surfaces index is what covers the
-top-level verbs. The rows are the two top-level verbs this chapter documents
-beneath the board, and neither registers a sub-verb of its own. The record-id
-form is a positional on the root, not a sub-verb.
+top-level verbs. The row is the top-level verb this chapter documents beneath
+the board, and it registers no sub-verb of its own. `abcd mode`, which stores
+the badge's state and keeps the away mode, has its own chapter,
+[`26-mode.md`](26-mode.md). The record-id form is a positional on the root,
+not a sub-verb.
 
 ## What ships today
 
@@ -621,12 +622,6 @@ _Generated from the command tree; a drift test fails `go test` when this appendi
 | `--version` | bool |
 | `--view` | string |
 
-### `abcd mode`
-
-Sub-verbs: none.
-
-Flags: none.
-
 ### `abcd peers`
 
 Sub-verbs: none.
diff --git a/.abcd/development/brief/04-surfaces/17-guard.md b/.abcd/development/brief/04-surfaces/17-guard.md
index 420fef1656..2e61ae0b47 100644
--- a/.abcd/development/brief/04-surfaces/17-guard.md
+++ b/.abcd/development/brief/04-surfaces/17-guard.md
@@ -3,8 +3,10 @@
 A destructive shell command typed by accident costs a person hours: a force
 push that erases a colleague's commits, an `rm -rf` with an unlucky glob, a
 `git clean` over uncommitted work. `/abcd:guard` catches those before they run
-and says what to run instead. It writes nothing, and it costs nothing to have
-on: an unrecognised command passes through untouched.
+and says what to run instead. It writes nothing but the record of a branch an
+agent creates and, when it admits abcd's own question where the badge shows,
+the waiting-on mode and the marker saying a question is open (both below), and
+it costs nothing to have on: an unrecognised command passes through untouched.
 
 Two things use it. A person or a script asks it about one command line. A
 compatible agent harness asks it about every command the agent is about to run,
@@ -206,6 +208,64 @@ them, is not a decision: the question runs and the hook says so on exit 1, the
 same fail-open-loud contract below. The manifest's pre-tool-use matcher names the
 shell tool and the question tool, and nothing else.
 
+**While the person is away** (spc-2610180914469489, "The question reroute";
+dcn-2610180937177502, dcn-2610181003477194), the gate reads the away record
+(`internal/core/autonomy`, the person's word that they are away, set through
+`abcd mode`) before anything above. While it holds, every call to the question
+tool is refused with the host's deny and one reason, whatever the chip: abcd's
+question or another
+tool's, chipped or not, and a questions field the check cannot read alike,
+from any working copy of the repository. Nothing past the away check runs, so
+no mode is set from a chip and no question is marked open; the badge's
+chip-set path is never reached while away. The reason names none of the asking
+rules, so the agent reroutes the question rather than redrafting it. It routes
+the question by the act it asks about (`autonomy.QuestionRoute`, which carries
+the list of acts only the person may approve): such an act is queued with
+the queue `abcd mode` keeps for their return, and the session carries on with
+other work. The acts are an embargo close's approval digest, the embargo
+triage verdict, the drain's hand-back, the confirmed apply verb for remote
+configuration, a release sign-off (a cut, or a step of one, that asks for the
+person by name or that no standing instruction of theirs allows; a standing
+permission for automatic cuts stands, and the away mode adds none), pushing,
+opening or merging a pull request without a standing instruction of the
+person's (the away mode is never that instruction), publishing, a visibility
+change or an outward comment or message, a new dependency, a secret, a
+credential or an App, a step only a website or a browser can do, a
+destructive act, anything that spends money, and any other act a command page
+or a brief invariant names as the person's. Every other question, product or
+technical, is decided and recorded with `abcd decide`, with its grounds and
+how to reverse it. **Nothing detects the act mechanically:** the agent
+classifies its own question from the reason's list, and the guard's registry
+entries enforce only what they name, a force push and a skipped hook among
+them. An away record or lock the store refuses reads as not away: the question
+is checked as if the person were present, and the hook says so on stderr,
+with exit 1 where it would otherwise admit the question silently.
+
+## The created-branch recorder
+
+The pre-tool-use hook also records each branch a shell command creates, for
+the away mode's reading of the session's own branches (itd-2610180912189125,
+spc-2610180914469489 step 3). The stacked drain branches of 2026-10-17 were cut
+with a plain `git worktree add` and left no upstream, no entry in the
+coordinating copy's reflog, no run state and no record id, so nothing else could
+tell they were the session's. Before the guard judges the command, the hook
+reads it for `git worktree add -b|-B <b>`, `git switch -c|-C <b>`, `git checkout
+-b|-B <b>` and `git branch <b>` (each recorded only when no branch of that name
+exists yet), a bare `git worktree add <path>` (the branch git names after the
+folder) and `git worktree add <path> <branch>`, and `git branch -m|-M <old>
+<new>`, which carries a record from the old name to the new. Branch names match
+as whole names, so `feat/x` never stands for `feat/x2`. A word a substitution
+or a variable prints is read as no branch.
+
+The record is kept whether or not the person is away, under the working copy's
+key (the reservations' copy key) in the away store, `~/.abcd.noindex/away/<root-sha>/`,
+written under the store's lock through its atomic writer, in a list capped at
+the hundred most recent, the oldest dropped. The recorder records and **refuses
+nothing**: a store it cannot write leaves one stderr line and the command goes
+on to the guard's own judgement, and a checkout abcd does not manage (no
+`.abcd/` at its root or at its main worktree's) records nothing. A record made for a command that then fails names a branch that does
+not exist, and the away mode's reading ignores it.
+
 ## Fail-open-loud
 
 A broken guard never bricks a session and never silently stops protecting one.
diff --git a/.abcd/development/brief/04-surfaces/26-mode.md b/.abcd/development/brief/04-surfaces/26-mode.md
new file mode 100644
index 0000000000..fcc9de183d
--- /dev/null
+++ b/.abcd/development/brief/04-surfaces/26-mode.md
@@ -0,0 +1,121 @@
+# `/abcd:mode` — Whose Answer the Loop Waits On, and the Away Mode
+
+`/abcd:mode` holds two facts the agent loop is judged by. The first is the
+waiting-on state behind the status line's badge: `managed`, `facilitator` or
+`product-thinker`, stored per checkout at `.abcd/.work.local/mode`, printed by
+bare `abcd mode` and set by `abcd mode <state>` (itd-200, spc-70). The badge,
+who sets it and when it resets are described with the board that shows it, in
+[`08-abcd.md`](08-abcd.md) ("The presence line" and "The badge is true at
+every stop"). The second is the away mode, below: the person's word that they
+are away and sessions should work on (itd-2610180912189125,
+spc-2610180914469489).
+
+## Sub-verbs
+
+> _Machine-checked (`surface_coverage`, spc-27): each row records the verb's
+> adr-40 bucket (`lint` / `review` / `audit` / `gate`, or `—` for a
+> non-assessment verb) and its existence (`shipped` / `staged`). The existence
+> fact is verified against the committed command-tree snapshot in both
+> directions. The bucket cell is checked for membership of the closed adr-40
+> vocabulary only: the snapshot carries no bucket field, so a bucket that is
+> wrong but legal passes, and that cell stays a review-grain claim._
+
+| Verb | Bucket | Status |
+|---|---|---|
+| `autonomous` | — | shipped |
+| `back` | — | shipped |
+| `queue` | — | shipped |
+
+## The away mode
+
+Beside the badge, and never a fourth word, the away mode records the person's
+word that they are away and sessions should work on. Setting it records, once
+for every working copy of the repository on the machine, who set it (the
+holder name reservations resolve without a network read, else git's
+`user.name`), from which working copy, when, and when it ends. The record
+lives in `~/.abcd.noindex/away/<root-sha>/`, keyed on the root commit as the worktree
+store is.
+
+**When it ends.** The end is a clock time (its next occurrence, local time)
+or a timestamp, or nothing, which leaves the record open-ended. Every record
+ends seven days after it was set at most, so an end past that, or one already
+past, is refused with nothing written. The person may also say that pushes
+wait for their return; that word is kept in the record, narrows what sessions
+do, and grants nothing. A prompt never ends the mode; its time does, or the
+person's word that they are back.
+
+**The queue and the return.** While the record holds, a session keeps a step
+for the person's return instead of asking them: an act only the person may
+approve. On their return the record is ended by word, which prints one plain
+line per queued step, per item handed back and per recorded stop (a stop at
+the host's cap labelled "possibly forced by the cap"), records who ended it and
+from which working copy, and closes the record, on a record whose time has
+passed as on one that holds.
+
+**It grants no rights.** The person's own standing instruction stays what
+decides whether a session commits, pushes, or opens or merges a pull request.
+
+**The lock and the checks.** Every change to the record holds a lock file
+beside it and re-reads the record inside the lock, so two writers never lose
+an update and a check that read the record before the person came back never
+writes it back; only ending the mode goes around a lock it cannot have
+(below). The record and the lock are used only when each is a regular file
+this account owns that no one else can write, within 64 KiB: one that fails
+those checks, or does not parse, reads as not away, and queueing a step
+refuses it, naming the file. Setting the mode refuses the same, except that it
+carries a record merely past 64 KiB, letting its oldest lines go.
+
+**Ending never refuses on the record.** The person's word that they are back
+ends the mode whatever state the record or its lock is in. A record past
+64 KiB is printed whole and kept with its oldest lines let go; one that does
+not parse, or is not safely this account's, is replaced by a closed record,
+printing nothing from it; and a lock not had within two seconds, or not safe
+to take, is gone around, closing without it. Each is named on its own line.
+
+**The badge while away.** While the record holds, parking the badge on the
+product thinker or the technical facilitator is refused, naming
+`abcd decide`, since a stop parked on a person who is away is a question
+nobody answers.
+
+Every refusal of the away verbs exits 2 with nothing written: an unreadable
+or past end, one past seven days, a checkout without the local tier (checked
+only when setting the mode), no checkout, a queued step with no record holding
+or with no words, and, when setting the mode or queueing a step, a lock not
+had within two seconds and a record or lock that fails the checks. Ending the
+mode refuses only where there is no checkout, no home or no root commit to key
+the record on. None makes a network request.
+
+<!-- surface-appendix:begin — generated from the command tree by `go generate ./internal/surface/cli`; never edit by hand -->
+
+## Appendix: the shipped surface
+
+_Generated from the command tree; a drift test fails `go test` when this appendix and the tree disagree. It lists flags and sub-verbs only. What each flag means is in the [CLI reference](../../../../docs/reference/cli/commands.md), and exit codes, output fields and behaviour are the prose's to state._
+
+### `abcd mode`
+
+Sub-verbs: `abcd mode autonomous`, `abcd mode back`, `abcd mode queue`.
+
+Flags: none.
+
+### `abcd mode autonomous`
+
+Sub-verbs: none.
+
+| Flag | Type |
+|---|---|
+| `--hold-pushes` | bool |
+| `--until` | string |
+
+### `abcd mode back`
+
+Sub-verbs: none.
+
+Flags: none.
+
+### `abcd mode queue`
+
+Sub-verbs: none.
+
+Flags: none.
+
+<!-- surface-appendix:end -->
diff --git a/.abcd/development/brief/04-surfaces/README.md b/.abcd/development/brief/04-surfaces/README.md
index 7ae7677dbc..1c00d4274a 100644
--- a/.abcd/development/brief/04-surfaces/README.md
+++ b/.abcd/development/brief/04-surfaces/README.md
@@ -34,7 +34,7 @@ are wiring rather than user-facing surface are listed separately under
 | 23 | `/abcd:reading` | shipped | Assemble what a cold reading may see, prove it, and validate what comes back | [`23-reading.md`](23-reading.md) |
 | 24 | `/abcd:decide` | shipped | Record a decision as one file that merges cleanly, list every decision newest first, or mint an ADR with its id, date and skeleton | [`24-decide.md`](24-decide.md) |
 | 25 | `/abcd:worktree` | staged | Keep session and agent worktrees in a machine-scoped store rather than beside the checkout (design target — [itd-2609091014076309](../../intents/planned/itd-2609091014076309-session-and-agent-worktrees-live-in-a.md)) | [`../05-internals/03-configuration.md` § The worktree store](../05-internals/03-configuration.md#the-worktree-store) |
-| 26 | `/abcd:mode` | shipped | Say whose answer the agent loop is waiting on, so the status line and the board show it | [`08-abcd.md`](08-abcd.md) |
+| 26 | `/abcd:mode` | shipped | Say whose answer the agent loop is waiting on, so the status line and the board show it, or that you are away and sessions should work on | [`26-mode.md`](26-mode.md) |
 | 27 | `/abcd:implement` | shipped | Share one autonomous run between two sessions: claim a record before its lane, keep the second session inside its bounds, and compare the ways of dividing the work from the run log | [`27-implement.md`](27-implement.md) |
 | 28 | `/abcd:peers` | shipped | See what the sibling worktrees and local branches hold before capturing, fixing or filing anything | [`08-abcd.md`](08-abcd.md) |
 | 29 | `/abcd:report` | shipped | Tell abcd about a defect or propose an enhancement from a repository it manages, into an inbox in your own account | [`29-report.md`](29-report.md) |
diff --git a/.abcd/development/brief/05-internals/03-configuration.md b/.abcd/development/brief/05-internals/03-configuration.md
index 6ae7592fd4..22f20b95e4 100644
--- a/.abcd/development/brief/05-internals/03-configuration.md
+++ b/.abcd/development/brief/05-internals/03-configuration.md
@@ -1326,14 +1326,20 @@ names a `statusMessage`, the host's spinner text while the hook runs, because th
 salvage sends the script's output nowhere; the text states no duration, since
 those limits differ. A test pins every event's timeout and the message
 (`internal/surface/cli/hooks_timeout_test.go`). `SessionEnd` and
-`SubagentStop` are the two
+`SubagentStop` are among the four
 exceptions and download nothing at all: each fires where the harness cancels a slow
 hook rather than wait — one as the session exits, the other inside a live session as
 a sub-agent finishes — so a fetch there races that cancellation and loses the
 transcript the hook exists to capture (iss-2608210934566223). Both resolve the
 plugin root, then PATH, then say the transcript was not captured. `SubagentStop`
 additionally never exits non-zero beyond that refusal, because exit 2 is the host's
-BLOCKING code on that event.
+BLOCKING code on that event. `Stop` and `StopFailure` carry the away
+mode's stop check (`hook stop`, `hook stop-failure`, spc-2610180914469489) and fire
+at a turn's end, where a fetch would hold the session; each resolves the plugin
+root, then PATH, then says what did not happen, at exit 1, never `Stop`'s
+blocking 2: `Stop` that the stop check did not run, `StopFailure` that a turn
+ended on an API error was not recorded. `Stop` declares a 30-second `timeout`, room for the check's one forge
+listing under its own ten-second deadline; `StopFailure` declares none.
 
 `SessionEnd` carries `hook session-end`, which stages the session's own transcript;
 `SubagentStop` carries `hook subagent-stop`, which stages a finished sub-agent's
diff --git a/.abcd/development/decisions/adrs/2610181003541997-the-away-mode-s-stop-check-reads-the.md b/.abcd/development/decisions/adrs/2610181003541997-the-away-mode-s-stop-check-reads-the.md
new file mode 100644
index 0000000000..af25e1fb3b
--- /dev/null
+++ b/.abcd/development/decisions/adrs/2610181003541997-the-away-mode-s-stop-check-reads-the.md
@@ -0,0 +1,87 @@
+---
+id: adr-2610181003541997
+slug: the-away-mode-s-stop-check-reads-the
+status: proposed
+date: 2026-10-18
+supersedes: null
+superseded_by: null
+related_intents: [itd-2610180912189125]
+related_rfcs: []
+related_adrs: [adr-38]
+---
+
+# ADR-2610181003541997: The away mode's stop check reads the forge once, as its documented meaning
+
+## Context
+
+Brief invariant 7 says abcd asks the network nothing on its own: implicit
+checks read disk only, and a fetch happens only when the user invokes a verb
+or flag whose documented meaning is that fetch
+([adr-38](0038-implicit-checks-are-disk-only.md)). The stop check of
+itd-2610180912189125 runs from the host's Stop hook at every turn's end, which
+no one invokes by name.
+
+Two of the four kinds of owed work live only on the forge: whether a
+session's own pull request is behind its base or failing its checks, and
+whether one carries a reservation's work. Plan review round 2 showed that the
+disk cannot answer the first in the night: the last-fetched default branch is
+stale, so a pull request that fell behind after the last fetch never reads as
+behind (blocker 2, dcn-2610181003464379). The drain's own reads of the remote
+were written into invariant 7 the same way, as the documented meaning of its
+verb.
+
+## Decision
+
+We will treat setting the away mode (`abcd mode autonomous`, which the
+person runs or asks a session to run, and which grants no push rights,
+dcn-2610181016510153) as invoking the stop check's forge read while the mode holds:
+at most one pull-request listing per check (head and base branch, author,
+body, merge state, review decision and check rollup, at most 200 pull
+requests), under a ten-second deadline. When the person's forge login is
+known (the holder name reservations resolve without a network read), the
+listing covers every open pull request in the repository, not only the
+person's: the reader needs other people's pull requests to tell a branch
+whose open pull request another person authored from the session's own, and
+to leave it out. When the login is unknown, the listing asks for the
+person's own pull requests alone (`--author @me`) and that rule is not
+applied. There is no cache, so a run of
+eight blocks costs up to eight listings, each bounded by the deadline; a
+reuse cache is remaining work of itd-2610170638184486 (dcn-2610181017056307).
+
+We will keep the check disk-only whenever the away mode does not hold: no
+turn's end while the person is present touches the network.
+
+We will name a failed or late read, never hide it: the check fails open to
+the disk kinds alone, with the pull requests named as not read. A branch
+with a pull request is then compared on disk with the last-fetched default
+branch, naming the fetch time, and a reservation is never reported as
+uncarried, so a failed read cannot lead a session to open a duplicate pull
+request (plan review round 3).
+
+We will add this listing to invariant 7 as the away mode's documented
+meaning, beside the drain's.
+
+## Alternatives Considered
+
+- **Disk only, always.** Keeps invariant 7 untouched. Rejected: "behind" is
+  then measured against a default branch nothing refreshes overnight, and a
+  reservation's carrying pull request cannot be seen, so the stall the slice
+  fixes (iss-2610170619247185) recurs on exactly the pull requests that fell
+  behind in the night.
+- **A fetch of the default branch at each check.** Answers "behind" from
+  disk after a fetch. Rejected: it is a network read all the same, it still
+  cannot see checks, reviews or links, and it would run while the person is
+  present unless also confined to the away mode.
+- **One listing per check while away, chosen.** One call, bounded in time,
+  and only inside a window the person opened.
+
+## Consequences
+
+- Invariant 7 gains a third verb-scoped meaning; the zero-network test
+  harness must show the present-mode check makes no forge call
+  (TestPresentReadsDiskOnly).
+- The forge client must be signed in for the away check to read pull
+  requests; when it is not, the check says so and judges from disk, which the
+  intent's scope conditions already name.
+- A later intent that wants the forge read while the person is present needs
+  its own amendment; this record does not cover it.
diff --git a/.abcd/development/decisions/adrs/README.md b/.abcd/development/decisions/adrs/README.md
index d372cbac8a..084dce4990 100644
--- a/.abcd/development/decisions/adrs/README.md
+++ b/.abcd/development/decisions/adrs/README.md
@@ -215,4 +215,5 @@ The intent lint (a Go implementation) extends to verify these reciprocally.
 | [adr-2610150729333337](2610150729333337-a-status-branch-moves-without-a.md) | A status branch moves without a preflight receipt | proposed | 2026-10-15 |
 | [adr-2610161621415708](2610161621415708-abcd-s-command-guard-steers-agents-an-os.md) | Unattended runs abcd launches execute inside an OS sandbox | proposed | 2026-10-16 |
 | [adr-2610161733400551](2610161733400551-a-reviewer-in-a-model-matrix-run-never.md) | A reviewer or judge in a model-matrix run is told nothing about which model wrote the copy it judges | proposed | 2026-10-16 |
+| [adr-2610181003541997](2610181003541997-the-away-mode-s-stop-check-reads-the.md) | The away mode's stop check reads the forge once, as its documented meaning | proposed | 2026-10-18 |
 <!-- /index -->
diff --git a/.abcd/development/intents/drafts/itd-2610170638184486-every-abcd-session-keeps-a-checklist-on.md b/.abcd/development/intents/drafts/itd-2610170638184486-every-abcd-session-keeps-a-checklist-on.md
index d03d8ab38c..52b5691114 100644
--- a/.abcd/development/intents/drafts/itd-2610170638184486-every-abcd-session-keeps-a-checklist-on.md
+++ b/.abcd/development/intents/drafts/itd-2610170638184486-every-abcd-session-keeps-a-checklist-on.md
@@ -81,7 +81,71 @@ unowned pull request.
 
 ## Acceptance Criteria
 
-> _Required (the itd-1 discipline): add at least one Given-When-Then bullet describing the verifiable bar for "shipped" before this draft can be planned._
+_Draft for the product thinker to walk in the planning interview: derived by
+the agent on 2026-10-18 from the press release and the decisions below, none
+of it yet confirmed. The away mode, the stop check and the question reroute
+are criteria of itd-2610180912189125, the slice that builds on this draft,
+and are not repeated here. The last three move with the phone and the shared
+options if the split proposed for Thursday is confirmed._
+
+- **Given** Alice, the product thinker, has said the sessions work on until
+  09:00, **when** a session writes its checklist, **then** the file in its
+  working copy's local tier holds the design decisions signed off, whether
+  the technical facilitator is set to auto, the kinds of choice still raised
+  with a person, each item waiting and on whom, its trigger promises, and the
+  work it owns, read from its reservations, its pull requests and its
+  branches.
+- **Given** a session with a checklist, **when** it starts or its context is
+  compacted, **then** the last complete checklist is added to its context by
+  the session-start hook, the compact source included.
+- **Given** a session killed while writing its checklist, or a reboot,
+  **when** the next session starts in that working copy, **then** it reads and
+  is given the last complete checklist, never a truncated or empty one, and an
+  unreadable file falls back to the last good copy and says so.
+- **Given** a checklist promise "when pull request 42 merges, add the
+  wrapper", **when** the session next looks (at a start, a wake or a stop
+  check) after 42 has merged, **then** the promise is named as its next item,
+  with no watcher process kept running.
+- **Given** a session whose items all wait on something outside, **when** it
+  records the wait, **then** its checklist names what each item waits for and
+  when it looks again, sooner than half its reservations' lease, and its state
+  reads waiting, never stopped.
+- **Given** Alice is about to leave, **when** the orchestrating session runs
+  the blocker sweep, **then** every session writes into its checklist any
+  undecided design decision, step only a person's hands can do, work it
+  depends on from another session, and credential missing or expiring, the
+  orchestrator puts them to Alice together, and it says the run is likely to
+  stay autonomous only once every session reports none open.
+- **Given** the sweep finds a credential that expires before the window ends,
+  **when** the session records it, **then** the checklist holds its kind, its
+  scope and its expiry, and never its value or anything that retrieves it.
+- **Given** Alice comes back, **when** they read what the sessions left them,
+  **then** they see two short lists across every session: the steps only
+  their own hands can do, and the decisions taken while they were away, each
+  with its grounds and how to reverse it.
+- **Given** Nia, the technical facilitator, is set to auto, **when** a session
+  meets a technical trade-off, **then** it decides and records it; **and
+  given** Nia is set to a person and is present, **when** the trade-off is one
+  of security, performance or compatibility, **then** it is raised with them,
+  and any other is decided and recorded.
+- **Given** a feature whose design trade-offs are listed in its checklist,
+  **when** a session asks whether the human design work for it is done,
+  **then** the answer is yes only when every genuine trade-off has a recorded
+  answer from the product thinker.
+- **Given** a session's state shown to a person, **when** what the session
+  wrote about itself disagrees with what the machine can see (its claim
+  renewal, its process, its last commit), **then** the state shown follows
+  the machine, with the session's own words beside it as a hint.
+- **Given** the private shared option is on, **when** a session writes its
+  checklist, **then** the checklist is shared in full by default, and a person
+  can narrow what is shared.
+- **Given** the public option is on, **when** it publishes a checklist,
+  **then** nothing carrying the id of an advisory not yet published leaves the
+  machine, by the same check announcements apply.
+- **Given** the phone app on the private shared option, **when** a session's
+  work would otherwise stop on a question, **then** the person whose role it
+  belongs to (product questions to Alice, technical trade-offs to Nia) is
+  notified, and can only choose among the options offered or add a note.
 
 ## Scope Split
 
@@ -103,6 +167,61 @@ session's interview on 2026-10-17:
   one line, what it waits on, when it was last seen), published only when it
   changes and only after the session has written its checklist; and each
   autonomous session's own credential.
+- **The first slice (itd-2610180912189125, which builds on this draft):** the
+  away mode held by abcd and repeated at start, compaction and prompt, the
+  stop check, and the question reroute, carved out on 2026-10-18 as the fix
+  for iss-2610170619247185 so the security and bug-fix release waits on it
+  alone (dcn-2610180913379049, dcn-2610180913388445). Its away mode grants
+  no rights; the person's standing instruction decides what is pushed
+  (dcn-2610181016510153). This draft keeps the rest and reuses the slice's
+  away record and hook path.
+- **Moved back from the first slice by its review round 1 (2026-10-18,
+  dcn-2610180937181929), named remaining work of this draft:**
+  - the report shown once on the first prompt after the away mode ends: the
+    queued steps, the decisions recorded in the window and the stops the
+    host forced, with who ended the mode and from which working copy;
+  - the window's decisions gathered from every working copy, by `abcd
+    decide` appending each decision's id to the away record under its lock
+    while the window is open, since sibling worktrees hold their own
+    decision records;
+  - the status line naming the away mode and its end;
+  - a bare `abcd mode` printing the away record, the queue and the owed
+    items with no plugin host;
+  - the brief's surface text for these.
+
+  The slice keeps `abcd mode back` printing the queue and the recorded stops,
+  one plain line each, so nothing queued goes unread meanwhile.
+- **Moved back from the first slice by its trim after review round 2
+  (2026-10-18, dcn-2610181016510153 and dcn-2610181017056307, on the release
+  orchestrator's ruling), named remaining work of this draft:**
+  - making the away mode the person's act alone, should a later design give
+    it rights worth guarding: the guard entry refusing an agent's `abcd mode
+    autonomous` (the binary on PATH and the plugin root's), and its routes
+    through `sh -c` and a script file a shell runs; the shell-write refusal
+    on the away store under `~/.abcd.noindex/away/`; the file-tool refusal,
+    with the PreToolUse matcher gaining `Edit`, `Write`, `MultiEdit` and
+    `NotebookEdit`; the refused attempts recorded in the store, shown on the
+    person's next prompt and listed by `abcd mode back`; and the live checks
+    that the person's `!` command reaches no pre-tool hook and that a
+    message relayed from another session starting with `!` is not run as a
+    shell command. The slice's away mode grants no push rights, and the
+    person's standing instruction decides what is sent, so none of this
+    holds up the stall fix; and since the OS fence (spc-2610161751056096)
+    covers only runner-launched agents, it stays a mistake filter in the
+    person's own sessions;
+  - the guard reading `go run ./cmd/abcd` (go's flags stepped over, an
+    `@<version>` allowed) and a built `abcd-<goos>-<arch>` as `abcd`, for
+    every entry that names the program, `abcd-source-ledger-flip` included,
+    which commands/guard.md today names as unseen. It widens what every
+    entry matches, so it gets its own security review here rather than
+    riding on the cut;
+  - a reuse cache for the away stop check's forge listing (a listing younger
+    than ten minutes reused, and on a failed read a cached listing younger
+    than half the default lease used with its age named), so a run of blocks
+    costs one call; the slice makes one uncached listing per check under a
+    ten-second deadline;
+  - anything `abcd mode back` prints beyond one plain line per queued step
+    and recorded stop: grouping, formatting or a summary of the window.
 
 ## Decisions
 
diff --git a/.abcd/development/intents/shipped/itd-2610180912189125-a-session-told-to-work-on-while-its.md b/.abcd/development/intents/shipped/itd-2610180912189125-a-session-told-to-work-on-while-its.md
new file mode 100644
index 0000000000..52348bbb0d
--- /dev/null
+++ b/.abcd/development/intents/shipped/itd-2610180912189125-a-session-told-to-work-on-while-its.md
@@ -0,0 +1,394 @@
+---
+id: itd-2610180912189125
+slug: a-session-told-to-work-on-while-its
+spec_id: spc-2610180914469489
+kind: standalone
+suggested_kind: null
+reclassification_history: []
+builds_on: [itd-2610170638184486]
+severity: critical
+impact: additive
+origin: researcher-authored
+production_mode: hand-written
+related_issues: [iss-2610170619247185]
+---
+
+# A session left to work on never stops while it has work
+
+## Press Release
+
+> A session told to work on while its person is away keeps working until they are back. Alice, a solo founder who is also the product thinker, leaves for the evening and says the sessions should work on until 09:00, running one command or asking a session to. abcd records that once for the repository, with who set it and when it ends, and repeats it to every session at each start, after each compaction and with every prompt, so no summary and no relay between sessions can drop it. A session that tries to end its turn while it still has work it can do alone (a reservation whose work is not yet handed in, a pull request of its own that has fallen behind or is failing, a branch it has not pushed, a branch stacked on another change that is still open) is handed the next of those items instead. One with nothing left to do takes the next ready item, and may stop only with its next look scheduled before its reservations need renewing. A question it would have put to Alice is decided and recorded instead, and an act only Alice may approve (an advisory's approval, a publication, a push her standing instructions do not allow, a new dependency, a secret, a browser step) is queued for their return. The mode itself grants nothing: what a session may push stays whatever Alice's own instructions say. When Alice is back and says so, the mode ends and they see the queued steps and any stop the host forced; from then on nothing is refused, and a stop with work left is only pointed out.
+
+## Why This Matters
+
+On the night of 2026-10-16 every session had been told to work on until the
+morning, and one sat idle for about ten of eleven and a half hours while it
+held work it could do alone (iss-2610170619247185). The instruction lived only
+in chat: relayed by a peer, overridden in the session's reading when the
+product thinker came back for an hour, then dropped by a compaction summary.
+The session ended its turn on a question nobody was there to answer, and a
+Claude Code session runs only when something sends it input, so nothing ran
+until a peer's message six hours later. The same night a coordinating session
+held three finished steps behind a merge order when only their landing order
+was fixed (dcn-2610180905291297).
+
+This is the smallest slice of the checklist draft (itd-2610170638184486) that
+removes the stall's core cause, carved out so the security and bug-fix release
+waits on it alone (dcn-2610180913379049, dcn-2610180913388445). It needs
+nothing on the shared remote, so it does not wait on the coordination intent (itd-2610170634394993).
+
+## Mechanism
+
+We expect an autonomous run to stop stalling because the three ways the
+session of 2026-10-16 went quiet are each closed where the host gives abcd a
+hook: the instruction to work on becomes a record abcd repeats at every start,
+compaction and prompt rather than context a summary can drop; ending a turn
+with owed work is refused at the Stop hook, the one point every quiet spell
+passes through; and a question to an absent person is refused before it can
+leave the session waiting. Shown wrong if, in an away window of at least six
+hours with owed work seeded at its start, a session following the slice is
+idle (no tool call) for more than one hour while owed work remains, or ends
+its turn on a question to the person.
+
+## Scope Conditions
+
+- A repository abcd manages, with the local tier and abcd's plugin hooks <!-- cond: cond-2610180914466989 -->
+  installed in the host that runs its sessions.
+- A host that runs a Stop hook and honours its block decision, a session-start <!-- cond: cond-2610180914464633 -->
+  hook on compaction and a prompt hook, as Claude Code documents them; on a
+  host without them the mode is still recorded and shown, and nothing is
+  enforced.
+- Sessions on one computer: the away record is held per repository on that <!-- cond: cond-2610180914460950 -->
+  machine, so a session on another computer or in the cloud does not see it.
+- The stop check's pull-request reading, made only while the person is away, <!-- cond: cond-2610180914462056 -->
+  needs the forge client signed in; when it cannot read the forge in time it
+  judges from disk alone, and says so.
+- A session that keeps working through the host: the check refuses a stop, it <!-- cond: cond-2610180914469321 -->
+  cannot start a session that is not running. A turn the host ends on an API
+  error, such as a rate limit, fires no Stop hook and cannot be continued: it
+  is recorded, and only a wake the session had already scheduled resumes it.
+- Known residual: a sibling working copy's branch that no worktree holds any <!-- cond: cond-2610181530194405 -->
+  more still reads as this session's own when both copies commit with the same
+  email, because nothing on disk tells them apart.
+
+## What's In Scope
+
+- **The away mode.** `abcd mode autonomous [--until <time>]
+  [--hold-pushes]` records who set
+  it, from which working copy, when, and when it ends, at most seven days
+  on; `abcd mode back` ends it, prints one line per queued step and recorded
+  stop, and records who ended it. One record per repository on the machine, shared by every
+  working copy, changed only under a lock (dcn-2610180913399042,
+  dcn-2610180913399499, dcn-2610180937181736).
+- **It grants nothing.** The person's own standing instruction stays the
+  authority to commit, push, and open or merge a pull request, as before.
+  Where owed work needs a push, the stop check tells the session to push if
+  its standing instruction allows; a queued push hands nothing back, so the
+  item stays owed and a stop the host's cap forces is recorded. Only when the
+  person has said pushes wait (`--hold-pushes`, which narrows and grants
+  nothing) does a queued push hand back a branch's unpushed item, and only
+  once its head contains the base's last-fetched tip and has a receipt; never
+  a behind, failing or under-review item, a reservation alone or a renewal.
+  The person's line counts the queued steps and the handed-back items. The
+  person sets the mode, or a session does on their word
+  (dcn-2610181016510153, dcn-2610181035355741).
+- **Repeated, never summarised away.** While it holds, the session-start hook
+  (every source, compaction included) and the prompt hook (every prompt) add
+  one short block to the session's context (dcn-2610180913406972), and the
+  prompt hook shows the person one line naming the away mode and `abcd mode
+  back`, and after a window lapses with anything unread, one line pointing
+  at `abcd mode back` (dcn-2610180937181736, dcn-2610181003474765).
+- **The stop check.** A plugin Stop hook asks `abcd hook stop`. While the
+  person is away a session is only working or waiting: a turn's end with owed
+  work is refused, naming the next item, and a stop is allowed only with a
+  wake that fires, the host's lateness included, within half an hour while
+  work is owed and before its reservations need renewing, and a wake
+  releases an unchanged set of work the session can do itself at most twice
+  in a row; the host's cap of eight continuations is the outer bound, and a
+  stop it may have forced is recorded.
+  A StopFailure hook records a turn ended by an API error. While the person
+  is present the check reads disk only and points the work out
+  (dcn-2610180913413137, dcn-2610180913421109, dcn-2610180936577720,
+  dcn-2610180936579498, dcn-2610180937175629, dcn-2610181003455731,
+  dcn-2610181003484631, dcn-2610181035361997).
+- **Owed work**, in exactly these terms: a live reservation under this
+  working copy's key whose renewal is due or whose work no open pull request
+  carries yet; an open pull request of the session's own that is behind its
+  base (by the forge's merge state while away) or failing its checks; a
+  branch of its own with commits not pushed; and a branch of its own stacked
+  on a change that is still open, while it is behind, failing, awaiting
+  review or unverified, since only its landing waits for the base. A branch
+  is the session's own when this copy checked it out or the session created
+  it, and it holds a recent commit of this checkout's; when it is a lane of
+  a run whose reservation is live under this copy's key; or when such a
+  reservation links it by its head branch or a closing trailer. Never the
+  default branch, a tag, or another person's pull request
+  (dcn-2610180913416683, dcn-2610180936568358, dcn-2610180936571036,
+  dcn-2610181003463367, dcn-2610181003467233, dcn-2610181003464379,
+  dcn-2610181003488355).
+- **The question reroute.** While the person is away, the guard refuses every
+  question on the host's question tool. A question about an act only the
+  person may approve (a per-act approval or ruling such as an embargo
+  close's digest, an embargo triage verdict or a drain hand-back, pushing,
+  opening or merging a pull request without a standing instruction that
+  allows it, a publication, outward message or
+  visibility change, a new dependency, a secret, credential or App, a
+  website or browser step, a destructive act, a spend, or any act a command
+  page or invariant names as the person's) is queued with `abcd mode queue
+  "<step>"`; every other question is decided and recorded with `abcd decide`
+  (dcn-2610180913431493, dcn-2610180937177502, dcn-2610181003477194,
+  dcn-2610181016510153).
+
+## What's Out of Scope
+
+- The rest of itd-2610170638184486: the per-session checklist, trigger
+  promises, abcd's own timed wakes, the pre-run blocker sweep, the shared and
+  published options and the phone.
+- Idle time a coordinator sees across sessions, which comes with the
+  coordination intent's (itd-2610170634394993) central view in `abcd status`.
+- Moved back to itd-2610170638184486 by review round 1
+  (dcn-2610180937181929): the report shown once on the person's return (the
+  queue, the window's decisions gathered across working copies, the recorded
+  stops and who ended the mode), the status line naming the away mode, and
+  the bare `abcd mode` print of the record, the queue and the owed items.
+- Moved back to itd-2610170638184486 by the trim after review round 2
+  (dcn-2610181016510153, dcn-2610181017056307): making the away mode the
+  person's act alone (the guard entry refusing an agent's `abcd mode
+  autonomous` and its routes, the away store's shell-write and file-tool
+  refusals, the refused attempts recorded and shown, and the live checks of
+  the person's `!` command and a relayed `!`); the guard reading `go run
+  ./cmd/abcd` and built binaries as `abcd` for every entry; the away forge
+  listing's reuse cache; and any `abcd mode back` print beyond one plain
+  line per queued step and recorded stop.
+- Any push right granted by the away mode: it grants none.
+- Starting or waking a session that is not running.
+- Each autonomous session's own forge credential, owned by the coordination
+  intent (itd-2610170634394993).
+
+## Acceptance Criteria
+
+- **Given** Alice, the product thinker, runs `abcd mode autonomous --until
+  09:00` in one working copy at 20:00, **when** a session in a sibling working
+  copy of the same repository starts, **then** its context carries the away
+  block naming 09:00 and who set it, with no message from any peer.
+- **Given** the away mode holds, **when** a session's context is compacted,
+  **then** the session-start hook fired with source `compact` adds the away
+  block again, and so does the prompt hook on the next prompt.
+- **Given** the away mode holds and the session's own pull request, opened
+  and checked out in its working copy before the mode was set, is behind the
+  default branch, **when** the session tries to end its turn, **then** the
+  stop is blocked and the reason names that pull request as the next item and
+  says how many items remain.
+- **Given** the away mode holds and a branch the session cut with `git
+  worktree add -b`, with no upstream and no record id, is stacked on a pull request
+  that is still open and is behind the default branch, **when** the session
+  tries to end its turn, **then** the stop is blocked and the reason asks for
+  the merge from the default branch, the fixes, the review and the preflight
+  now, and says only the landing waits for the base (dcn-2610180905291297); **and when** the branch
+  is up to date, green and has a preflight receipt, **then** it is waiting on
+  its base and is not owed.
+- **Given** the away mode holds and the session holds a live reservation whose
+  work no open pull request carries, or a branch with unpushed commits,
+  **when** it tries to end its turn, **then** the stop is blocked naming that
+  item.
+- **Given** the stop was blocked and the session replied "awaiting the
+  person" with no tool call and no wake, **when** it tries to stop again with
+  the owed set unchanged, **then** the stop is blocked again; **and when** the
+  host's cap of continuations ends the turn, **then** it is recorded as
+  stopped with work owed, shown when Alice runs `abcd mode back`.
+- **Given** the away mode holds and nothing is owed, **when** the session tries
+  to stop with no qualifying wake, **then** the stop is blocked, telling it to
+  take the next ready item first and only then schedule its next look before
+  its earliest reservation renewal is due; a wake set for 09:00 the next
+  morning, or a background shell task, does not qualify; **and when** it stops
+  with a wake that fires in time, **then** the stop is allowed and the
+  session is waiting, with that time kept as its next look.
+- **Given** no away mode holds (Alice is at the terminal), **when** a session
+  with owed work ends its turn, **then** the stop is allowed, one line shown
+  to Alice names the owed work read from disk, and the forge is not called.
+- **Given** the away mode holds, **when** the agent puts a product question to
+  Alice on the host's question tool, under any chip, **then** the guard
+  refuses it, telling the agent to decide and record it with `abcd decide`
+  and carry on; **and when** it asks Alice to approve closing a security
+  advisory, **then** the same refusal tells it that an act only Alice may
+  approve is queued with `abcd mode queue`, and it never supplies the
+  approval itself.
+- **Given** the away mode holds, **when** Alice sends any prompt, **then** one
+  line shown to Alice names the away mode, its end, who set it and `abcd
+  mode back`.
+- **Given** the away mode holds and the session has an unpushed branch of
+  its own and no standing instruction from Alice allowing a push, **when**
+  it tries to end its turn, **then** the stop is blocked with a reason that
+  says to push only if a standing instruction allows and otherwise to queue
+  the push, never naming the away mode as permission; **and when** it
+  queues a step naming that branch, **then** the branch is still named as
+  owed, a stop the host's cap forces is recorded, and the step is shown when
+  Alice runs `abcd mode back`.
+- **Given** Alice set the away mode with `--hold-pushes` and the session's
+  unpushed branch has the default branch's last-fetched tip merged in and a
+  preflight receipt for its head, **when** it queues a step naming that
+  branch, **then** the branch's unpushed item is handed back and the line
+  shown to Alice counts it; **and given** instead a pull request of its own
+  that is behind, merged locally and queued, **then** it stays owed.
+- **Given** the away mode holds, a pull request of the session's own stays
+  behind, and the session has set a cron that fires every ten minutes,
+  **when** it tries to stop with the owed set unchanged a third time in a
+  row, **then** the stop is blocked naming that pull request.
+- **Given** a session sets the away mode on a message relayed from another
+  session, **when** Alice sends her next prompt, **then** the line shown to
+  her names who set it, from which working copy, and `abcd mode back`, and
+  no session has gained any right to push.
+- **Given** a window that ended at 09:00 with one queued step, **when** Alice
+  sends her first prompt at 10:00 without having run `abcd mode back`,
+  **then** one line shown to Alice counts the queued step and names `abcd
+  mode back`.
+- **Given** the away mode holds and a branch this copy only checked out to
+  review another person's pull request, or a run lane whose run's
+  reservation has lapsed, **when** the session tries to end its turn,
+  **then** neither is named as owed.
+- **Given** a window in which one step was queued and the host forced one
+  stop, **when** Alice runs `abcd mode back`, **then** they see the queued
+  step and the stop, and the mode ends recording who ended it.
+- **Given** a stop check reading the forge while Alice runs `abcd mode back`
+  in another session, **when** the check finishes, **then** the mode stays
+  ended.
+- **Given** the away mode holds, **when** a turn ends on a rate limit, **then**
+  the stop and its error type are recorded and shown when Alice runs `abcd
+  mode back`.
+- **Given** `--until` names a time already past or more than seven days
+  ahead, or the repository has no local tier, **when** `abcd mode autonomous`
+  runs, **then** it refuses, names the reason, and writes nothing.
+- **Given** the forge cannot be read within ten seconds during a stop check,
+  **when** the session tries to stop while away, **then** the check judges
+  from the disk kinds alone, saying the pull requests were not read.
+- **Given** the slice is built, **when** a live Claude Code session with the
+  plugin from the branch runs an away window with seeded owed work, a
+  compaction and an attempted stop, **then** a captured transcript shows the
+  away block at start and after compaction, the blocked stop naming the next
+  item, an unpushed branch's queued push still named without
+  `--hold-pushes` and handed back with it once its head is verified, the
+  third unchanged stop with a ten-minute wake blocked, and the refused
+  question.
+
+## SOTA
+
+Surveyed 2026-10-18 against the host's current hook reference
+(https://code.claude.com/docs/en/hooks) and the record:
+
+- **The host's Stop hook with a block decision:** documented and current.
+  Adopted as the only point every quiet spell passes through; the host bounds
+  it with `stop_hook_active` and a cap of eight consecutive continuations,
+  reset by each tool call.
+- **The host's session-scoped scheduled wakes** (CronCreate, ScheduleWakeup,
+  `/loop`), reported to a Stop hook as `session_crons`: young. Adopted only as
+  evidence that a waiting session will look again; abcd schedules nothing.
+- **Re-injection through the session-start hook's compact source and the
+  prompt hook:** documented. Adopted for the away block, as the checklist
+  draft's format decision already chose for the checklist.
+- **A supervisor process that restarts or prompts idle sessions:** a common
+  pattern, not adopted: it needs a process that stays alive, which the
+  coordination intent's (itd-2610170634394993) on-demand pass rules out, and it cannot tell owed work
+  from a finished session without the same reading this slice adds.
+- **The host's agent-team idle hook (TeammateIdle):** young, bound to one agent
+  team in one session, so it cannot reach sessions in separate working copies.
+  Not adopted.
+
+Path taken: 2. The host's hooks are the native floor; the away record, the
+owed-work reading and the verdict are abcd's, behind a core seam that a
+second host's hooks can call.
+
+## Open Questions
+
+_None. Every question of the slice was settled on delegation; the decisions
+are listed below._
+
+## Decisions
+
+Each is the facilitator's, on delegation, and restates the product thinker's
+ruling or the ground it rests on; the full text is in the decision record.
+
+1. **Fixed first** (dcn-2610180913379049): the stall is fixed before the
+   security and bug-fix release, not deferred.
+2. **Its own intent** (dcn-2610180913388445): the slice builds on the
+   checklist draft rather than planning it.
+3. **The away record** (dcn-2610180913399042): set by a verb, by the person
+   or a session on their word, ended by its time or the person's word, never
+   by a prompt; restored by decision 28 after decision 19 narrowed it.
+4. **Per repository on the machine** (dcn-2610180913399499).
+5. **Repeated at start, compaction and every prompt**
+   (dcn-2610180913406972).
+6. **Owed work** (dcn-2610180913416683): four kinds, read from disk and one
+   forge listing; brief invariant 7 gains the clause.
+7. **The stop check and its bound** (dcn-2610180913413137).
+8. **Nothing owed means a scheduled look** (dcn-2610180913421109).
+9. **No question waits while away** (dcn-2610180913431493).
+10. **Host-agnostic core, reachable without a host**
+    (dcn-2610180913445272); its status-line and bare-print halves moved by
+    decision 18.
+
+Review round 1 of 2026-10-18 refined them:
+
+11. **"Own" without a window, this copy's reservations only**
+    (dcn-2610180936568358).
+12. **Stacked branches cleared; the forge read only while away**
+    (dcn-2610180936571036).
+13. **Away means working or waiting** (dcn-2610180936577720, following
+    dcn-2610180720541206).
+14. **A wake qualifies by its next fire time** (dcn-2610180936579498).
+15. **API-error stops recorded; prose questions blocked once**
+    (dcn-2610180937175629).
+16. **Questions routed by the act** (dcn-2610180937177502).
+17. **The record's lock, checks and seven-day cap** (dcn-2610180937181736).
+18. **The return report, status line and bare print move to the draft**
+    (dcn-2610180937181929), superseding the return lists of the planning
+    walk.
+
+Review round 2 of 2026-10-18 refined them again:
+
+19. **Only the person sets the away mode; narrow push rights; a mistake
+    filter** (dcn-2610181003456444, on the ground of dcn-2610171112384712),
+    refining decision 3; superseded by
+    decision 28.
+20. **A wake qualifies within a ceiling, the host's lateness included**
+    (dcn-2610181003455731).
+21. **Behind is the forge's merge state while away** (dcn-2610181003464379).
+22. **Created branches recorded; stale and review-only branches not own**
+    (dcn-2610181003463367).
+23. **Linked only by head branch or a closing trailer**
+    (dcn-2610181003467233).
+24. **The person-only acts completed, with a catch-all**
+    (dcn-2610181003477194).
+25. **A lapsed window points at `abcd mode back`** (dcn-2610181003474765).
+26. **The block count resets only when the host is not continuing**
+    (dcn-2610181003484631).
+27. **The clearing rule names review and works without receipts**
+    (dcn-2610181003488355).
+
+The trim after review round 2, on the release orchestrator's ruling:
+
+28. **The away mode grants no push rights; the person-only guard moves to
+    the draft** (dcn-2610181016510153), superseding decision 19.
+29. **The slice trimmed to what closes the issue, with what moved listed**
+    (dcn-2610181017056307), refining decision 18.
+
+Review round 3 of 2026-10-18 narrowed two of them:
+
+30. **A queued push hands nothing back unless the person said pushes wait,
+    and then only a verified branch's unpushed item** (dcn-2610181035355741),
+    refining decision 28.
+31. **A wake releases an unchanged set of work the session can do itself at
+    most twice in a row** (dcn-2610181035361997), refining decisions 13 and
+    20.
+
+The invariant 7 amendment is recorded as adr-2610181003541997 (proposed),
+amended by the trim to one uncached listing per check.
+
+## Audit Notes
+
+<!-- abcd-review: OWED receipt=rcp-6da79a9df4b4 -->
+Fidelity review OWED (receipt rcp-6da79a9df4b4).
+<!-- abcd-review-end receipt=rcp-6da79a9df4b4 -->
+
+## Grounds
+
+- pursued: we expect an autonomous session to stop going idle with owed work, because the instruction to work on becomes a record abcd repeats at start, compaction and prompt, and the Stop hook refuses a turn's end while owed work exists; shown wrong if, in a six-hour away window with seeded owed work, a session following the slice is idle over an hour while owed work remains, or ends its turn on a question to the person
diff --git a/.abcd/development/release-gate/manifest.json b/.abcd/development/release-gate/manifest.json
index 1cca9a0b14..aa419dba7f 100644
--- a/.abcd/development/release-gate/manifest.json
+++ b/.abcd/development/release-gate/manifest.json
@@ -47,6 +47,7 @@
     ".abcd/development/brief/04-surfaces/07-library.md",
     ".abcd/development/brief/04-surfaces/16-lint.md",
     ".abcd/development/brief/04-surfaces/37-memory.md",
+    ".abcd/development/brief/04-surfaces/26-mode.md",
     ".abcd/development/brief/04-surfaces/23-reading.md",
     ".abcd/development/brief/04-surfaces/09-reflect.md",
     ".abcd/development/brief/04-surfaces/29-report.md",
diff --git a/.abcd/development/release/surface.json b/.abcd/development/release/surface.json
index 92c5316af3..eab0157258 100644
--- a/.abcd/development/release/surface.json
+++ b/.abcd/development/release/surface.json
@@ -1516,7 +1516,7 @@
       "hidden": false,
       "group": "agents",
       "block": "agents",
-      "sentence": "Judge a shell command against the hazard registry before it runs: Writes nothing; refuses a hazard through check, hook or approve, and an unknown sub-verb.",
+      "sentence": "Judge a shell command against the hazard registry before it runs: Writes branch records and a question's mode; refuses a hazard and an unknown sub-verb.",
       "flags": []
     },
     {
@@ -1566,7 +1566,7 @@
       "path": "abcd guard hook",
       "hidden": false,
       "block": "agents",
-      "sentence": "Judge the shell command in a host's pre-tool-use payload: Writes nothing; refuses a hazard or a badly built question with the host's deny.",
+      "sentence": "Judge the shell command in a host's pre-tool-use payload: Writes branch records and a question's mode; refuses a hazard or a badly built question.",
       "flags": []
     },
     {
@@ -1786,6 +1786,16 @@
       "hidden": false,
       "flags": []
     },
+    {
+      "path": "abcd hook stop",
+      "hidden": false,
+      "flags": []
+    },
+    {
+      "path": "abcd hook stop-failure",
+      "hidden": false,
+      "flags": []
+    },
     {
       "path": "abcd hook subagent-stop",
       "hidden": false,
@@ -3402,6 +3412,39 @@
       "sentence": "Print or set whose answer the agent loop is waiting on: Writes the state only when setting it; refuses an unknown state or a checkout with no local tier.",
       "flags": []
     },
+    {
+      "path": "abcd mode autonomous",
+      "hidden": false,
+      "sentence": "Record that the person is away and sessions work on, until a time or open-ended: Writes the away record; refuses an end already past or past seven days.",
+      "flags": [
+        {
+          "name": "hold-pushes",
+          "shorthand": "",
+          "type": "bool",
+          "required": false,
+          "hidden": false
+        },
+        {
+          "name": "until",
+          "shorthand": "",
+          "type": "string",
+          "required": false,
+          "hidden": false
+        }
+      ]
+    },
+    {
+      "path": "abcd mode back",
+      "hidden": false,
+      "sentence": "End the away mode, printing what was queued and recorded one line each: Writes its ending whatever the record's or lock's state; refuses outside a git checkout.",
+      "flags": []
+    },
+    {
+      "path": "abcd mode queue",
+      "hidden": false,
+      "sentence": "Queue one step for the person's return while they are away: Writes the away record; refuses when no away record holds.",
+      "flags": []
+    },
     {
       "path": "abcd peers",
       "hidden": false,
diff --git a/.abcd/development/research/notes/2026-08-15-decomposition-calibration.md b/.abcd/development/research/notes/2026-08-15-decomposition-calibration.md
index 6e3c6f4176..83f8536a81 100644
--- a/.abcd/development/research/notes/2026-08-15-decomposition-calibration.md
+++ b/.abcd/development/research/notes/2026-08-15-decomposition-calibration.md
@@ -2518,3 +2518,45 @@ The proposal: when abcd's plugin was updated, offer the person to run setup agai
 | setup changes nothing without the person's yes | trust rule | existing consent rules; no new record |
 
 Verdict: SPLIT. The initial routing proposed one intent (FILE-AS-IS) with the what-changed summary inside it; the product thinker chose to split the summary into its own record, so the routing did not survive as proposed. Both drafts carry `builds_on: [itd-111, itd-105]`. The product thinker then asked for the two new drafts and the two shipped intents they build on to be one bundle; a bundle can only join records not yet shipped, so the two drafts are to be planned as one bundle, linked to the shipped pair through `builds_on`.
+
+## 2026-10-18: every session keeps a checklist on disk (facilitator-on-delegation, routing not yet put to the product thinker)
+
+| part | type | home |
+|---|---|---|
+| the away mode with an owner and an end time, repeated at every start, compaction and prompt; the stop check that refuses to end a turn with owed work while the person is away; the question reroute and the queue of steps for the person's hands | capability | intent itd-2610180912189125 (planned, spc-2610180914469489), the first slice, which builds on the draft |
+| the per-session checklist on disk and its re-injection; waits per item; trigger promises; timed wakes; the states working, waiting and stopped | capability | itd-2610170638184486 (draft) |
+| the pre-run blocker sweep, asked by message | capability | the same draft, by the product thinker's choice |
+| the two lists for the person's return across sessions | capability | the same draft; the slice's per-repository form moved back here in its review round 1 (dcn-2610180937181929), leaving it only `abcd mode back` printing the queue |
+| the technical facilitator set to auto or to a person, and whether a feature's design work is done | capability | the same draft, reading the existing `facilitator.mode` of itd-2610150602547271; no second toggle |
+| the private shared option, the public option and the phone | capability | proposed as its own intent in the bundle; split not filed |
+| the checklist records a credential's kind, scope and expiry, never its value or anything that retrieves it | trust rule | proposed ADR and brief invariant clause at planning; not filed |
+| a public upload passes the embargo check | cited | brief invariant 22; no new rule |
+| the stop check's one forge listing per check, made only while the person is away | rule clause | brief invariant 7, amended by the slice's step 3 (step 6 before its review round 1) |
+| a wait holds one item, never the session, and a declared dependency holds only the landing | stance | proposed principle; not filed |
+| a state shown to a person follows what the machine sees, and the agent's own words are a hint | stance | the coordination intent's decision 6 and the principle `enforcement-claims-are-facts`, cited; no new principle |
+| the checklist's JSON format and its crash-safe write | plumbing | the brief's internals, through `internal/fsutil`'s atomic writer |
+| idle time per session for a coordinator; each autonomous session's own credential | capability | the coordination intent (headless agents coordinate through the shared remote), not this draft |
+
+Verdict: SPLIT, proposed. The routing is the agent's and has not been put to
+the product thinker; it is graded as unconfirmed until the planning interview
+on 2026-10-23. Only the first slice was filed, on the orchestrating session's
+instruction, so the security and bug-fix release can wait on it alone
+(dcn-2610180913379049, dcn-2610180913388445). The other proposed records (the
+shared-options and phone intent, the credential ADR, the waiting principle)
+are described in the facilitator's note for Thursday and filed only once the
+routing is confirmed.
+
+Typed links: itd-2610180912189125 builds on the draft and is the remedy home
+of iss-2610170619247185 with it; the coordination intent is the bundle
+sibling, kept apart by the draft's scope split. Advisory reversal flags: none.
+Two refinements of the issue's remedy wording are recorded rather than
+flagged: the away record is held per repository on the machine rather than
+per checkout (dcn-2610180913399499), and a coordinator's view of idle time
+comes through the coordination intent's central view rather than `abcd
+peers`.
+
+The initial routing moved once before filing. The draft first held the stop
+check and the away mode inside the checklist itself; carving them into a
+separate intent followed from the release cut waiting on them, and from
+planning the draft before its criteria are walked being the worse of the two
+routes.
diff --git a/.abcd/development/specs/closed/spc-2610180914469489-a-session-told-to-work-on-while-its.md b/.abcd/development/specs/closed/spc-2610180914469489-a-session-told-to-work-on-while-its.md
new file mode 100644
index 0000000000..0ad864308d
--- /dev/null
+++ b/.abcd/development/specs/closed/spc-2610180914469489-a-session-told-to-work-on-while-its.md
@@ -0,0 +1,1572 @@
+---
+id: spc-2610180914469489
+slug: a-session-told-to-work-on-while-its
+intent: itd-2610180912189125
+origin: researcher-authored
+production_mode: hand-written
+---
+# A session left to work on never stops while it has work
+
+## Summary
+
+Delivers itd-2610180912189125, the first slice of the checklist draft
+(itd-2610170638184486) and the fix for iss-2610170619247185. Trimmed after
+review round 2 to what closes the issue (dcn-2610181017056307), and
+narrowed by review round 3 (dcn-2610181035355741, dcn-2610181035361997).
+Three parts:
+
+- **The away record.** `abcd mode autonomous [--until <time>]
+  [--hold-pushes]`, `abcd mode back` and `abcd mode queue "<step>"` keep one
+  away record per repository on
+  the machine, changed only under a lock and lapsing at its end, seven days
+  at most. The session-start hook (every source, `compact` included) and the
+  prompt hook repeat it to the agent while it holds, and the prompt hook
+  shows the person one line saying so, naming `abcd mode back`. The mode
+  grants no rights: the person's own standing instruction stays the
+  authority to commit, push and open or merge a pull request
+  (dcn-2610181016510153).
+- **The stop check.** A plugin Stop hook runs `abcd hook stop`. While the
+  record holds, a session is only working or waiting: a turn's end is blocked
+  while owed work exists, naming the next item, and is allowed only with a
+  wake that fires, the host's lateness included, within half an hour while
+  work is owed and before the session's reservations need renewing, and a
+  wake releases an unchanged set of work the session can do itself at most
+  twice in a row. The host's
+  cap of eight consecutive continuations is the outer bound. A StopFailure
+  hook records a turn the host ends on an API error. While the person is
+  present the check reads disk only and points the work out.
+- **The question reroute.** While the record holds, the guard refuses every
+  question on the host's question tool. An act only the person may approve
+  goes to the queue; every other question is decided and recorded with `abcd
+  decide`. `abcd mode back` prints the queue and the recorded stops, one line
+  each.
+
+Every behaviour is built test-first: each step names its tests, written and
+watched failing before its code. The last step is a live Claude Code session
+capture, because the hook mechanics are the host's and a unit test cannot
+prove them (principle evaluate-at-the-user-surface).
+
+Moved out by review round 1 (dcn-2610180937181929) and by the trim after
+round 2 (dcn-2610181016510153, dcn-2610181017056307), back to the checklist
+draft as named remaining work: the report shown once on the person's return,
+the status line, the bare `abcd mode` print, making the away mode the
+person's act alone (the guard entries, their other routes and the refused
+attempts), the guard's reading of `go run ./cmd/abcd` and built binaries as
+`abcd`, and the forge listing's reuse cache. "Trim after round 2" below
+lists each.
+
+## Design
+
+### The host mechanics this rests on
+
+Read on 2026-10-18 at https://code.claude.com/docs/en/hooks (the old
+docs.claude.com hooks page redirects there):
+
+- **Stop.** The hook "runs when the main Claude Code agent has finished
+  responding" and not on a user interrupt. Its input carries
+  `stop_hook_active`, "true when Claude Code is already continuing as a result
+  of a stop hook", and `last_assistant_message`, the text of Claude's final
+  response. It also carries `background_tasks` (each with `id`, `type` such as
+  `shell`, `subagent`, `monitor` or `workflow`, and `status`) and
+  `session_crons` (each with `id`, `schedule` as a cron expression such as
+  `0 9 * * 1-5`, `recurring` and `prompt`); both are present only when the
+  host's task registry is reachable. Output `{"decision": "block", "reason":
+  …}` prevents the stop. Claude Code caps this at eight consecutive
+  continuations, overriding the next block; the count resets each time Claude
+  calls a tool, and `CLAUDE_CODE_STOP_HOOK_BLOCK_CAP` raises it. Read again on
+  2026-10-18 ("Stop decision control"): `hookSpecificOutput.additionalContext`
+  is "Non-error feedback for Claude. The conversation continues so Claude can
+  act on it, but unlike `decision: "block"` it is shown in the transcript as
+  hook feedback rather than a hook error"; use it "when the hook is working as
+  designed", and it "keeps the conversation going through the same loop
+  protections as `decision: "block"`, namely the `stop_hook_active` input and
+  the 8-consecutive-continuation cap, but the transcript labels it `Stop hook
+  feedback` and no hook error notification is shown". The stop check blocks
+  with `{"hookSpecificOutput":{"hookEventName":"Stop","additionalContext":…}}`
+  (Diff review round 1, item 7).
+- **StopFailure.** Fires instead of Stop "when the turn ends due to an API
+  error"; its matcher is the error type (`rate_limit`, `overloaded`,
+  `server_error` and others). It cannot block, and its output is ignored.
+  Its input carries `error`, "the error type and is used for matcher
+  filtering", with optional `error_details` and `last_assistant_message`
+  (here the API error string); "StopFailure hooks have no decision control".
+  `abcd hook stop-failure` reads `error`.
+- **SessionStart.** The matcher values include `compact` ("auto or manual
+  compaction"). Plain stdout, or `hookSpecificOutput.additionalContext`, is
+  added to Claude's context.
+- **UserPromptSubmit.** Plain stdout or `additionalContext` is added beside
+  the prompt, as a system reminder.
+- **Universal output.** `systemMessage` is a "warning message shown to the
+  user".
+- **Where a prompt comes from.** The prompt hook also fires on turns the
+  host starts on its own and on a message another session sends, and its
+  input has no field naming the prompt's origin, so a hook cannot tell the
+  person's word from a relayed one.
+
+Read on 2026-10-18 at https://code.claude.com/docs/en/scheduled-tasks:
+
+- **Scheduled tasks.** "All times are interpreted in your local timezone",
+  not UTC. A recurring task "starts each run late by up to half the gap to
+  the next run, and by at most 30 minutes", except `*/5 * * * *`, which runs
+  15 seconds sooner; a one-shot task set for `:00` or `:30` runs up to 90
+  seconds early, and one set for any other minute is not shifted. Day of
+  week takes `0` or `7` for Sunday, and when both day fields are restricted
+  either matches, "standard vixie-cron semantics". `CronList` rows show each
+  task's next run.
+
+abcd's hook manifest already registers SessionStart with no matcher, so
+compaction already runs `abcd hook session-start`. It has no Stop or
+StopFailure entry, and its PreToolUse entry matches the shell tool and the
+host's question tool.
+
+### The away record
+
+- **Where it lives.** One JSON file per repository on the machine, in the
+  away store, `~/.abcd.noindex/away/<root-sha>/`, keyed on the repository's
+  root commit as the worktree store is (dcn-2610180913399499), with a lock
+  file beside it. The same folder holds each working copy's list of branches
+  it created (dcn-2610181003463367). Everything in it is written through
+  fsutil's atomic writer.
+- **What it holds.** Who set it: the holder name reservations cache, without
+  a network read, falling back to git's `user.name`, and the working copy it
+  was set from. It also holds the start, the end, whether the person said
+  pushes wait (`--hold-pushes`), the queue of steps for the person, the items
+  the stop check handed back (branch and head), the stops recorded (with work
+  owed, with no next look, or on an API error with its type, each at the cap
+  labelled "possibly forced by the cap"; a stop identical to the last one
+  recorded is kept as that entry with a count and the last time, so a wake
+  every ten minutes cannot push the record past its 64 KiB check), and, once
+  ended by word, who ended it and from which working copy.
+- **The lock** (dcn-2610180937181736). Every read-modify-write (`mode
+  autonomous`, `mode back`, `mode queue`, a recorded stop, a recorded
+  branch) holds `fsutil.WithFileLock` on the lock file and re-reads the
+  record inside it. The stop check reads the record and lists the forge
+  outside the lock, then takes it, re-reads, and records its stop only if the
+  record still holds, so a check that began while away never writes away
+  back after `abcd mode back`. A lock not had within two seconds: the verbs
+  refuse naming it, and the hooks allow the stop and say so on stderr.
+- **Ownership and permissions.** The record and the lock file are used only
+  when each is a regular file this account owns that no one else can write,
+  within 64 KiB: the checks `rules.json` already gets. A record that fails
+  them, or does not parse, reads as not away (failing open, with a stderr
+  line), and a verb asked to change it refuses naming the file.
+- **When it ends.** It holds while now is before its end. It ends with `abcd
+  mode back`, or when its time passes. A human prompt never ends it
+  (dcn-2610180913399042).
+- **The stale-record cap.** An open-ended record ends seven days after it was
+  set, and `--until` may name no later time; a later one is refused with
+  nothing written. A run of several days, like the standing run of 2026-10-15
+  through 2026-10-17, fits; a forgotten record lapses.
+- **Seen by the person.** While the record holds, the prompt hook adds a
+  one-line `systemMessage` on every prompt: away until when, set by whom and
+  from which working copy, "N steps queued, M items handed back", and the
+  literal `abcd mode back` as the way to end it (dcn-2610181035355741). The away block tells the agent to run `abcd mode back` only on the
+  person's word in its session (dcn-2610181003474765).
+- **A lapsed window with anything unread.** While a record whose end has
+  passed is not yet closed and holds a queued step or a recorded stop, the
+  prompt hook shows the person one line on every prompt counting them and
+  naming `abcd mode back`, until that verb closes the record
+  (dcn-2610181003474765).
+- **Ending it.** `abcd mode back` prints one plain line per queued step, per
+  handed-back item and per recorded stop (its label and count included),
+  records who ended the mode and
+  from which working copy, and ends the record; on a record whose time has
+  passed it prints the same and closes it. Nothing more is printed: the
+  report on return moved to the checklist draft.
+- **The badge.** The three-word badge in `internal/core/mode` is untouched.
+  While the record holds, `abcd mode product-thinker` and `abcd mode
+  facilitator` are refused, naming `abcd decide`, since a badge parked on the
+  person is a question waiting for them (dcn-2610180913431493).
+
+### Who sets it, and what it grants
+
+**It grants nothing** (dcn-2610181016510153, superseding
+dcn-2610181003456444). The person's own standing instruction stays the
+authority to commit, push, and open or merge a pull request, exactly as
+before the mode existed. The away mode only keeps a session working while
+owed work exists and turns its questions into recorded decisions or queued
+steps; it is never treated as permission. The away block says so, in those
+words.
+
+**Who sets it.** The person, with their own command (at a terminal, or with
+`!` in the session), or a session on the person's word in that session, as
+dcn-2610180913399042 first said. Nothing checks which: the prompt hook cannot
+tell the person's message from one another session relays. Because the mode
+grants no rights, a mode set on a relayed word only keeps sessions working
+and deciding instead of asking, and the person sees who set it, from which
+working copy, and `abcd mode back` on their next prompt.
+
+**Pushes held** (dcn-2610181035355741). `--hold-pushes` is the person's word
+that pushes wait for their return. It only narrows what sessions do and grants
+nothing, so dcn-2610181016510153 stands: like the mode, nothing can check who
+ran it, and set on a relayed word it can at worst make sessions queue pushes
+they could have sent. It is the only thing that lets a queued push hand an
+item back (Owed work, below).
+
+**Why the guard entries left the slice.** Round 2's choice (a) made setting
+the mode the person's act alone, because the mode then carried push rights.
+The OS sandbox of spc-2610161751056096 fences only the agents abcd's runner
+launches, never the person's own interactive sessions, which are the ones
+that stalled. There, the guard entries would only ever be a mistake filter
+(adr-42, dcn-2610171112384712), so their two days would buy a trust claim the plan cannot make.
+With no push rights in the mode there is nothing for them to protect in this
+slice. Making the mode the person's act alone (the guard entry, its other
+routes, the store's shell-write and file-tool refusals, the refused
+attempts, and the capture's checks of the `!` path), and the guard reading
+`go run ./cmd/abcd` and built binaries as `abcd` for every entry, the ledger
+flip included, are named remaining work of itd-2610170638184486; the second
+is a security-relevant widening that gets its own review there.
+
+### Owed work
+
+Owed work is four kinds (dcn-2610180913416683, refined by
+dcn-2610180936568358, dcn-2610180936571036 and, in review round 2,
+dcn-2610181003463367, dcn-2610181003467233, dcn-2610181003464379 and
+dcn-2610181003488355):
+
+1. a live reservation under this copy's key whose renewal is due, or whose
+   work no open pull request carries yet;
+2. an open pull request of the session's own that is behind its base or
+   failing its checks;
+3. a branch of its own with commits not pushed;
+4. a branch of its own stacked on a change that is still open, while it
+   needs work (the clearing rule below).
+
+- **What "own" means.** A branch is the session's own when one of these
+  holds (dcn-2610181003463367):
+  - this working copy's HEAD reflog has checked it out;
+  - the session created it: when the guard's pre-tool hook sees this session
+    run `git worktree add -b|-B <b>`, `git switch -c|-C <b>`, `git checkout
+    -b|-B <b>` or `git branch <b>`, and no branch named `<b>` exists yet, it
+    records `<b>` under this copy's key in the away store, under the store's
+    lock, whether or not the person is away. A bare `git worktree add <path>`
+    records the branch git names after the folder, `git worktree add <path>
+    <existing>` records `<existing>`, and `git branch -m|-M <old> <new>`
+    carries a record from `<old>` to `<new>`; branch names match as whole
+    tokens, and the file is capped (the builder sets the bound, oldest
+    dropped). The hook only records; it refuses nothing, and a
+    failed write leaves the command allowed with a stderr line. This is how
+    the stacked drain branches of 2026-10-17 (`feat/drain-step11` and its
+    siblings) are seen: cut with a plain `git worktree add`, they had no
+    upstream, no entry in this copy's reflog, no run state and no record id
+    in their names. A record made for a command that then failed names a
+    branch that does not exist, and is ignored;
+  - it is the branch of a lane in a run state this copy's local tier holds
+    (`.abcd/.work.local/run/<run-id>/state.json`), while that run's
+    reservation is live under this copy's key;
+  - it is the head branch of an open pull request linked to a reservation
+    under this copy's key (the link below).
+- **Live, not stale.** A branch owned through the reflog or a recorded
+  creation counts only while it holds a commit authored by this checkout's
+  `user.email` within the last 14 days, or a live reservation under this
+  copy's key links it. A finished or abandoned run's lanes never count. So
+  the five lanes of 2026-10-12 this checkout still holds, from runs that
+  stopped at implement and never landed, are not owed forever, and the
+  nothing-owed row stays reachable.
+- **Never own.** The default branch; a tag; a branch whose open pull request
+  another person authored (the listing's author is not the person); and a
+  branch this copy only checked out to review, which the authorship rule
+  above leaves out, since it holds none of this checkout's commits. A
+  sibling copy's branch is none of the routes above, so it never holds this
+  session.
+- **Which copy.** A session's copy is the worktree it started in: the
+  session-start hook notes the worktree root of its payload's `cwd` per
+  session id in the away store, and the recorder and the stop check read the
+  copy key, local tier and session state from that root, so a session that
+  changes directory into a worktree it just made keeps its copy key; a
+  session with no note uses its payload `cwd`'s worktree.
+- **The reservation filter and link** (dcn-2610181003467233). A reservation
+  counts only when its copy key is this copy's (the view's `Copy ==
+  CopyThis`). A pull request carries a reservation's work when the record id
+  appears in its head branch's name or on a `Resolves:` or `Delivers:` line
+  of its body, matched on word boundaries, so iss-5 never matches iss-50. A
+  `Refs:` line, which the issue-resolution gate (RS004) requires of any pull
+  request that only names an issue, carries the work only when the head
+  branch is already own by another route, and never makes a branch own: a
+  sibling copy's pull request that mentions the record neither leaves this
+  session waiting nor becomes its branch. A renewal is due halfway between
+  the reservation's latest claim or renewal and its expiry.
+- **Behind** (dcn-2610181003464379). While away, a pull request is behind
+  when the listing's merge state (`mergeStateStatus`) is `BEHIND`, which the
+  forge measures against its base as it stands now, not against the
+  last-fetched default branch, which nothing refreshes overnight. `DIRTY` (a
+  conflicting pull request) is owed as behind too, and `UNKNOWN` reads as not
+  read. GitHub reports `BEHIND` only where the base requires branches to be up
+  to date, so the live capture's lab base requires it. Only a
+  branch with no pull request is compared on disk, with the last-fetched
+  default branch, and the reason names when that ref was last fetched.
+- **Finding a stacked branch.** An own branch is stacked when its open pull
+  request's base is not the default branch, or, with no pull request, when
+  the nearest other own branch whose tip is an ancestor of its tip is not
+  contained in the last-fetched default branch.
+- **The clearing rule for a stacked branch** (dcn-2610180936571036, refined
+  by dcn-2610181003488355). One whose base is still open is owed only while
+  any of these holds: it is behind its base (its merge state, or with no
+  pull request its base's tip on disk); its checks are failing; a review of
+  its head is outstanding (the listing's review decision is
+  `CHANGES_REQUESTED`, or for a run's lane its run state records no passing
+  review of its head), since the coordination prep's decision that a
+  declared dependency constrains only the landing (dcn-2610180905291297) says its review runs now;
+  or it is not verified. Verified means a preflight receipt naming its head
+  in any worktree (`landing.Receipt`) where the repository mints receipts
+  (a receipt folder exists in one of its worktrees); in a repository without
+  them, its pull request's checks passing in the listing; with no pull
+  request there either, it is judged on the other conditions alone and the
+  reason says it was not verified. Otherwise it is waiting on its base,
+  which is not owed: only its landing waits.
+- **Unpushed.** An own branch with commits not on its upstream, or, with no
+  upstream configured, not in any remote-tracking ref. A branch whose
+  upstream is gone (merged and deleted on the remote, a squash merge
+  included) never counts.
+- **Queued pushes, and the one hand-back** (dcn-2610181035355741, refining
+  dcn-2610181016510153). The mode grants no push, so an item whose next act
+  is a push (an unpushed branch, a reservation whose work no pull request
+  carries, a behind or failing pull request once its local fix is committed)
+  may be one the session has no standing instruction to send.
+  - **By default a queued push hands nothing back.** The item stays owed and
+    the stop stays blocked; a session with no standing instruction to push
+    ends at the host's cap, and the stop is recorded for the person.
+  - **Only with `--hold-pushes`** does a queued step hand anything back. A
+    step naming an own branch, on the same word-boundary match as the link,
+    removes only that branch's unpushed item, and only while the disk shows
+    the rest clear: its head contains its base's last-fetched tip (the
+    default branch, or a stacked branch's base branch as it stands on disk),
+    and a preflight receipt names the head (`landing.Receipt`) where the
+    repository mints receipts. Where it mints none, the clearing rule's
+    equivalent, passing checks in the listing, can only name a pushed
+    commit, so nothing is handed back there.
+  - **Never handed back:** a pull request that is behind (or `DIRTY`) or
+    failing, which the forge reads so until the push; a stacked branch the
+    clearing rule still owes; a review outstanding; a reservation named by
+    its record id alone; a renewal. So a behind pull request whose merge is
+    committed locally stays owed with pushes held and ends at the cap,
+    recorded: the instance of 2026-10-16 shows up in the morning instead of
+    passing as nothing owed.
+  - The conditions are re-read at every check. The stop check records each
+    item it hands back (branch and head) in the away record under its lock,
+    once per branch and head, for the person's line and `abcd mode back`.
+- **What is read, and when (invariant 7,
+  adr-2610181003541997).** While the person is present the check reads disk
+  only: renewals due (reservations as last fetched, `claim.LastFetched`) and
+  unpushed own branches. It never calls the forge, so no turn's end touches
+  the network. While away it adds at most one `gh pr list` of the open pull
+  requests, every open one when the person's forge login is known (so a
+  branch whose pull request another person authored is left out of "own"),
+  the person's own alone when it is not (head and base branch, author,
+  body, merge state, review decision, check rollup; each field among those
+  `internal/ghcontract` pins) under a ten-second deadline. On a failure or
+  timeout it fails open to the disk kinds, naming the pull requests as not
+  read: a branch with a pull request is compared on disk with the
+  last-fetched default branch, naming the fetch time, and a reservation is
+  never reported as uncarried, so no duplicate pull request is opened. There
+  is no cache: a run of eight blocks costs up to eight
+  listings, each bounded by the deadline (the reuse cache is remaining work
+  of the checklist draft). Brief invariant 7 gains this listing as the away
+  mode's documented meaning, as the drain's listing is, by
+  adr-2610181003541997.
+- **Order.** The next item is the first of: a renewal due, a failing pull
+  request, a behind one, a stacked branch, an unpushed branch, unhanded work.
+
+### The stop verdict
+
+`autonomy.Judge(record, owed, payload, session, now) Verdict` is pure.
+
+**The allowed states while away** (dcn-2610180936577720): working (the stop
+is blocked) or waiting (the stop is allowed with a qualifying wake, whose
+next fire time is the next look). abcd never allows a stop with work owed
+and no qualifying wake; "stopped" happens only when the host's cap overrides
+a block, and is then recorded. Stopped is allowed, and flagged, only while
+the person is present.
+
+**The deadline** (dcn-2610181003455731, refining dcn-2610180936579498). The
+earlier of: the earliest renewal due among the live reservations under this
+copy's key, minus `lease.Skew`; and now plus a ceiling, 30 minutes while work
+is owed and one hour when none is. The ceiling closes the long-lease hole: a
+release reservation's 24-hour lease puts its renewal 12 hours on, and a
+`0 7 * * *` cron seen at 21:00 would otherwise qualify and leave the session
+idle for ten hours with work owed.
+
+**The qualifying wake.** A `session_crons` entry qualifies when its latest
+fire time is no later than the deadline. The latest fire time is the next
+time its schedule matches after now, read in the machine's local time as the
+host reads it, plus the most the host may run it late: for a recurring task,
+half the gap from that match to the following one, at most 30 minutes, and
+nothing for exactly `*/5 * * * *`; a one-shot task is taken as matched, since
+the host only runs one early. So an hourly cron whose next match is 3 minutes
+before the deadline does not qualify (it may run 30 minutes late), and with
+owed work the longest a session can wait is the 30-minute ceiling.
+
+The next fire time comes from a five-field cron parser of abcd's own (minute,
+hour, day of month, month, day of week; lists, ranges, steps, `a-b/n` and
+`*`; 7 is Sunday as 0 is). It follows vixie cron, as the host says it does:
+when both day fields are restricted either matches, and a day field written
+from `*` (`*/n` included) counts as unrestricted for that rule. It steps
+minute by minute in absolute time, converting each minute to local wall-clock
+time, from now to the deadline plus an hour (for the following match), so at
+most a few hundred steps; a wall-clock minute skipped by a daylight-saving
+change never matches, and one repeated by it matches at its first
+occurrence. An expression it cannot parse never qualifies. A background task
+never counts on its own while away. No new dependency.
+
+**The session's state.** One file per session id in the local tier
+(`.abcd/.work.local/autonomy/sessions/<session-id>.json`; an id outside
+`[A-Za-z0-9_-]{1,128}` is refused and the stop allowed with a stderr line)
+holds the state, the next look, the owed-set fingerprint, the last question
+message's hash, the count of consecutive blocks, and the wake count with its
+own fingerprint of the capped items (below).
+
+**The wake count** (dcn-2610181035361997, refining dcn-2610180936577720 and
+dcn-2610181003455731). The capped items are the owed kinds the session can
+act on itself: a pull request that is behind or failing, an unpushed branch,
+a stacked branch the clearing rule still owes, and a reservation whose work
+no pull request carries (which the review's list did not name, but opening
+that pull request is the same kind of act as a push). A renewal that is only
+due, and an item waiting only on the forge (a stacked branch whose one unmet
+condition is its checks still running), are not capped. An allow by row 3
+while any capped item is owed adds one to the wake count; a change in the
+capped items' fingerprint sets it to zero. The count compares the capped
+items alone, so a renewal falling due or done neither resets it nor adds to
+it.
+
+While away, the rows are read in order and the first that matches decides:
+
+| # | condition | verdict |
+|---|---|---|
+| 1 | `last_assistant_message` ends on a line ending in `?`, not yet blocked for this message | block with the reroute's reason (working) |
+| 2 | owed, set changed or first block this session | block: next item and count (working) |
+| 3 | owed, set unchanged, qualifying wake, and no capped item owed or the wake count below two | allow (waiting; next look kept; the wake count adds one if a capped item is owed) |
+| 4 | owed, set unchanged, qualifying wake, a capped item owed and the wake count at two | block: next item; the set has not moved over two wakes, so a wake no longer releases this stop (working) |
+| 5 | owed, set unchanged, no qualifying wake | block: next item, and if it cannot move, take another or schedule a look before the deadline (working) |
+| 6 | none owed, qualifying wake | allow (waiting; next look kept) |
+| 7 | none owed, no qualifying wake | block: take the next ready item first (reserve it), and only if none can be taken alone, schedule a look before the deadline (working) |
+
+So a `*/10 * * * *` cron set once and an unchanged behind pull request give
+two waiting spells of up to ten minutes each, then blocks until the item
+moves or the host's cap records the stop; each later wake starts a turn that
+is blocked the same way, and the identical stops collapse into one recorded
+entry with a count.
+
+- **An item that needs a push** (dcn-2610181016510153, refined by
+  dcn-2610181035355741). Without `--hold-pushes` the reason says: do the
+  local work, then push if your standing instruction allows; queue only if
+  the person has said pushes wait, and a push you may not send stays owed,
+  so queue it with `abcd mode queue "<step>"` for the person and take
+  another item meanwhile. With `--hold-pushes` it says: the person has said
+  pushes wait; finish the local work (the merge from the base, the
+  preflight), then queue the push naming the branch. It never says the away
+  mode allows the push.
+- **`stop_hook_active`** decides no row, so both values are covered by every
+  row. It alone drives the count (dcn-2610181003484631, refining
+  dcn-2610180936577720): a block with it `false` sets the count to one, and
+  with it `true` adds one. A change in the owed set no longer resets the
+  count, since the host's count does not: in the round-2 scenario a renewal
+  falling due at the sixth block would have reset abcd to one, and the host's
+  override at its ninth would have found abcd at three, unrecorded. The block
+  whose count passes the cap (eight, or `CLAUDE_CODE_STOP_HOOK_BLOCK_CAP`
+  when set) records "stopped with work owed" (rows 2, 4 and 5) or "stopped
+  with no next look" (row 7) in the away record, labelled "possibly forced by the
+  cap", because the host's count also resets on a tool call abcd cannot see.
+  The count so errs toward recording a stop that did not happen, never
+  toward missing one, and step 7 checks where the host's count resets.
+- **Present.** With owed work (the disk kinds only), allow with a
+  `systemMessage` naming the work (stopped, flagged); with none, allow
+  silently. No forge call.
+- **The front door.** `abcd hook stop` maps the payload and writes the host's
+  JSON. A malformed payload, an unreadable record or a lock not had allows
+  the stop and says so on stderr, following the guard's fail-open-loud
+  contract. A stop is never blocked on abcd's own fault. The Stop entry in
+  `hooks/hooks.json` carries a timeout of 30 seconds, room for the
+  ten-second listing and the git reads.
+- **StopFailure** (dcn-2610180937175629). `abcd hook stop-failure`, while
+  the record holds, records "stopped on an API error" with the error type,
+  under the lock. It cannot continue the session; the scope conditions name
+  the gap.
+
+### The question reroute
+
+`questionGate` (`internal/surface/cli/guard_question.go`) reads the away
+record first. While it holds, it denies every question-tool call, abcd's or
+another tool's, with one reason whatever the chip (dcn-2610180937177502).
+The classification is by the act asked about, which the reason lists, so the
+agent routes it (dcn-2610181003477194, extended by dcn-2610181016510153):
+
+- **Queued for the person** with `abcd mode queue "<step>"`, carrying on with
+  other work meanwhile, is a question about an act only the person may
+  approve:
+  - an approval or ruling the repository binds to the person per act: an
+    embargo close's `--approve <digest>`, which `commands/embargo.md` says is
+    passed only after the person, in this session, has read the text and
+    said yes, and never supplied on the agent's own; the embargo triage
+    verdict ("the verdict is the person's decision", `commands/embargo.md`);
+    the drain's hand-back ("a hand-back is a person's decision",
+    `commands/drain.md`); the confirmed apply verb for remote configuration
+    (brief invariant 10); a release sign-off;
+  - pushing, opening or merging a pull request without a standing
+    instruction of the person's that allows it; the away mode is never that
+    instruction;
+  - publishing anything, changing a repository's visibility, or posting a
+    comment or message outward, other than a pull request a standing
+    instruction allows;
+  - adding a dependency;
+  - a secret, a credential or an App;
+  - a step only a website or a browser can do;
+  - a destructive act: deleting what the session did not create, overwriting
+    uncommitted work, a force push, discarding a peer's work;
+  - anything that spends money;
+  - any other act a command page or a brief invariant names as the person's.
+- **Decided and recorded** with `abcd decide`, with its grounds and how to
+  reverse it, is every other question.
+
+**A release sign-off** is a cut, or a step of one, that asks for the person
+by name, or that no standing instruction of theirs allows. A standing
+permission for automatic cuts stands; the away mode adds none.
+
+**Nothing detects the act mechanically.** The agent classifies its own
+question from the refusal's list, and the guard's existing entries enforce
+only what they name, a force push and a skipped hook among them; the rest of
+the list rests on the agent following it, as the person-only rules on the
+command pages already do.
+
+The away block repeats this list and that the mode grants nothing. No mode
+is set and no question is marked open.
+
+## Settled here
+
+Choices made while building step 1 on 2026-10-18 where this record is
+silent, each the narrowest reading that meets the step. Each is the build
+lane's choice, recorded for review; none changes a test the step names.
+
+- 2026-10-18 (lane's choice, for review): **Setting the mode again keeps
+  what is unread.** `abcd mode autonomous` on a record that holds, or that
+  lapsed and is not yet closed, writes a new record (who set it, from which
+  copy, a new start and end, `--hold-pushes` as given this time) and carries
+  over its queued steps, handed-back items and recorded stops, since nothing
+  has printed them yet. The seven-day cap counts from the new start: setting
+  the mode is a deliberate act, and the cap is there for a forgotten record.
+  A closed record's items, already printed by `abcd mode back`, are not
+  carried.
+- 2026-10-18 (lane's choice, for review): **`abcd mode queue` needs a record
+  that holds.** With none, or one lapsed, it is refused (exit 2) and the
+  reason says to ask the person instead, since there is no return to queue
+  for. A step's whitespace is folded so it prints as one line, and a step
+  over 500 characters is refused, so one step cannot fill the 64 KiB record.
+- 2026-10-18 (lane's choice, for review): **Who set it.** The holder name
+  reservations resolve with no network read (`claim.ReaderHolder`), else
+  the name git would author a commit with (`identity.EffectiveIdentity`,
+  which reads `user.name` after git's own overrides), else nothing, shown as
+  "someone git does not name". The working copy is its root as git names it,
+  shown in the tilde form.
+- 2026-10-18 (lane's choice, for review): **Every refusal is exit 2 with
+  nothing written**, a lock not had within two seconds included: each is
+  "this invocation cannot be honoured", as the badge's refusals are.
+- 2026-10-18 (lane's choice, for review): **The lock is checked on every
+  read, not only on writes.** A lock file that is a symlink, another
+  account's, writable by others or over 64 KiB reads as not away for the
+  hooks as well as refusing the verbs, as TestRecordOwnershipFailsOpen
+  names. Reading never creates the store; the first write creates its
+  folders owner-only.
+- 2026-10-18 (lane's choice, for review): **"Shown in the away block" is
+  `Record.Terms`.** Step 1 has no away block yet (step 2 prints it), so the
+  record's plain statement (until when, set by whom from which copy, that
+  pushes wait when `--hold-pushes` is set, that the mode grants no rights,
+  and how it ends) is `Record.Terms`, which `abcd mode autonomous` prints and
+  step 2's block can repeat.
+- 2026-10-18 (lane's choice, for review): **Sibling files go through the
+  store.** The created-branch list (step 3) and the session's start-copy
+  note (step 2) live in the same folder; `Store.ReadFile` and
+  `Store.WriteFile`, called inside `Store.WithLock`, give them the record's
+  ownership, size and atomic-write terms. Their names and shapes are those
+  steps' to choose.
+- 2026-10-18 (lane's choice, for review): **The badge's refusal reads the
+  record at the verb.** `mode.RefuseParkWhileAway` is pure and the CLI reads
+  the away record for it, so `internal/core/mode` keeps no knowledge of the
+  away store; the guard's chip-set path is left to step 6, whose gate denies
+  every question while away before that path is reached.
+- 2026-10-18 (lane's choice, for review): **`abcd mode` gets its own brief
+  chapter**, `04-surfaces/26-mode.md`, beyond the step's named packages.
+  Once the verb registers sub-verbs, record-lint's `surface_coverage` rule
+  requires a chapter named for it with a sub-verbs table, so the away mode's
+  surface text lives there, the register's row 26 points at it, and
+  `08-abcd.md` keeps the badge and points at the new chapter. The three
+  sub-verbs' sentences and the queue's worked example go in
+  `internal/core/surface`, as every visible verb's do.
+- 2026-10-18 (step 6 lane's choice, for review): **The away check comes
+  before decoding.** "Every question-tool call" is read literally: a
+  questions field the check cannot read is refused with the same reason
+  while away, rather than running on the loud fail-open status, since a
+  question nobody is there to answer stalls the session whatever its shape.
+  A payload whose outer JSON does not decode still fails open, because the
+  hook then has no working directory to find the record by.
+- 2026-10-18 (step 6 lane's choice, for review): **The reason names none of
+  the asking rules.** Its head line says the person is away and that no
+  question is put to them whatever its chip and whoever wrote it, then
+  `autonomy.QuestionRoute`: the queue route with the person-only acts, the
+  decide route, and that nothing detects the act. A reason that also listed
+  the question's field findings would invite a redraft instead of a
+  reroute.
+- 2026-10-18 (step 6 lane's choice, for review): **The text lives in
+  `internal/core/autonomy`.** `PersonOnlyActs` and `QuestionRoute` are
+  additive exports beside the record, so step 2's away block and step 5's
+  row 1 ("block with the reroute's reason") can repeat the same list rather
+  than a copy that drifts.
+- 2026-10-18 (step 6 lane's choice, for review): **An unreadable away record
+  is loud at the question gate.** A record or lock the store refuses reads as
+  not away, the question is checked as if the person were present, and one
+  line names the record: folded into the reason when the gate denies, and
+  with exit 1 (the guard's fail-open-loud status) when it would otherwise
+  admit silently. Where the gate already answered on stdout with the rows
+  note, it keeps exit 0, since exit 1 would drop the note. Outside a
+  checkout, with no root commit or no home, nobody is away and nothing is
+  said.
+- 2026-10-18 (step 6 lane's choice, for review): **The badge's chip-set path
+  needs no code of its own.** The away check returns the deny before the
+  chip is read, so no mode is set and no question marked open while away;
+  TestAwayQuestionSetsNoMode holds it. Beyond the step's named packages,
+  `commands/guard.md`, `commands/mode.md` and the guard hook's help text
+  gain a sentence each, since each describes the gate and would otherwise
+  misstate it while away.
+- 2026-10-18 (lane 2's choice, steps 3 and 4, for review): **The
+  created-branch list holds a hundred names**, the oldest dropped
+  (`autonomy.MaxCreatedBranches`): a hundred names at git's 255-byte limit
+  stay well within the store's 64 KiB per file. A rename keeps the record's
+  place and time.
+- 2026-10-18 (lane 2's choice, for review): **The recorder reads literal
+  words only, and runs before the registry loads.** A word a substitution or
+  a variable prints makes the command no act; `git -C <dir>` is stepped over,
+  not followed, and every name is judged against the session copy's
+  repository. It runs ahead of the registry, so a disabled or unloaded
+  registry does not stop a branch being recorded. `git worktree add <path>
+  <commit-ish>` records the name when it is a branch or resolves to nothing
+  (git then creates it), never a tag or an object name; `--detach` and
+  `--orphan` record nothing; `git branch -c|-C` is recorded as a creation.
+- 2026-10-18 (lane 2's choice, for review): **The copy is the payload
+  `cwd`'s worktree until step 2's start-copy note lands.** The recorder
+  resolves it in one function (`awayCopyRoot` in `internal/surface/cli`) for
+  step 2 to route through its note, and `autonomy.ReadOwed` takes the copy
+  root from its caller (`ReadOptions.Root`).
+- 2026-10-18 (lane 2's choice, for review): **The away listing lists every
+  open pull request, not only the person's,** so a branch whose pull request
+  another person authored can be told apart: the person is the holder name
+  reservations resolve without a network read (`claim.ReaderHolder`), and
+  when that is unknown the listing asks `--author @me` and that rule is not
+  applied. At most 200 are listed. The ADR's decision says "the person's
+  open pull requests"; invariant 7's clause says "the open pull requests".
+- 2026-10-18 (lane 2's choice, for review): **"Recent" is a commit beyond
+  the default branch whose author email is this checkout's, made or
+  rewritten (the later of its author and committer dates) within 14 days.**
+  A live reservation links a branch by its name too (the record id on word
+  boundaries), not only through a pull request. The reflog route reads both
+  ends of each `checkout: moving from A to B` line and the branch checked out
+  now.
+- 2026-10-18 (lane 2's choice, for review): **A stacked branch whose base
+  has moved on is still found without a pull request:** the branch they share
+  a commit with, outside the default branch, is its base when that commit
+  was the other branch's own tip by its reflog (set there other than by the
+  branch's creation, which tells a base from a branch cut from it). A stacked
+  branch is one `stacked` item naming what it needs, never a separate behind
+  or failing item; a stacked pull request with no checks reported, where no
+  receipts are minted, is not verified and owed.
+- 2026-10-18 (lane 2's choice, for review): **When the listing fails, "a
+  branch with a pull request" is read as an own branch with an upstream that
+  is not gone**, compared on disk with the last-fetched default branch; the
+  fetch time is the default branch's reflog, else `claim.LastFetched`.
+- 2026-10-18 (lane 2's choice, for review): **A release reservation
+  (`rel-…`) is never owed as uncarried work,** since no pull request carries
+  a release; its renewal due still counts.
+- 2026-10-18 (lane 2's choice, for review): **A queued step names a branch
+  as a whole name in which `.`, `_`, `/` and `-` continue the name,** so
+  `feat/p` is never found in `feat/p-2`: stricter than the record id's word
+  boundary, where `-` ends the id so `fix/iss-5-x` names iss-5. `ReadOwed`
+  records each hand-back itself (`Store.RecordHandBack`), and the unpushed
+  item's reason is the fact alone; the push wording is the verdict's (step 5).
+- 2026-10-18 (lane 2's choice, for review): **The run states are read
+  leniently, for their lanes alone**, rather than through the loop's strict
+  decoder: a run counts while a spec step is pending or a lane is not done,
+  and a lane counts while its stage is not done, discarded or handed back.
+  `landing.GHContext` was added beside `landing.GH` to bind the forge client
+  to the ten-second deadline, and the guard's `abcd guard` and `abcd guard
+  hook` sentences now name the branch record they write.
+
+Choices made while building steps 2 and 5 on 2026-10-18, by build lane 1,
+each recorded for review; none changes a test the steps name.
+
+- 2026-10-18 (lane 1's choice, for review): **The start-copy note.** The
+  session-start hook notes a session's start worktree in the away store's
+  `sessions.json` only in a checkout with `.abcd/` at its root, and only the
+  first time for a session id, so a compaction or resume run after the
+  session changed into a worktree it made keeps the start. Notes older than
+  30 days, and past 256, are dropped. `autonomy.ResolveCopy` reads it back
+  for the stop check and for step 3's recorder.
+- 2026-10-18 (lane 1's choice, for review): **The prompt hook's read.** It
+  reads the away record through the live drain's root-commit lookup, so the
+  router still makes one such lookup a prompt, and appends the away block
+  after the rules, the memory notes and the status block. The block's words
+  come from the owner-only home store, never a tracked file, which is why
+  the session-start hook may print it on stdout where its notices stay on
+  stderr.
+- 2026-10-18 (lane 1's choice, for review): **The person's lines.** While
+  the record holds: "abcd: away until <time>, set by <who> from <copy>; N
+  steps queued, M items handed back. `abcd mode back` ends it." (with
+  "pushes wait for you" under `--hold-pushes`). Lapsed and unclosed: one
+  line counting the queued steps and recorded stops, as the plan names, not
+  the hand-backs. Both are `Record.PersonLine` and `Record.LapsedLine`.
+- 2026-10-18 (lane 1's choice, for review): **The owed seam.** The plan
+  names no reader, so the stop hook takes the owed set through one function
+  value, `stopOwedReader` in `internal/surface/cli/hook_stop.go`, shaped as
+  step 4's `autonomy.ReadOwed` (asked with the start copy, the record, the
+  home and the clock; the record not holding means disk only). Until step
+  4's reader fills it, it reads nothing owed. Recording a hand-back is
+  idempotent per branch and head, so the reader and the front door may both
+  record one.
+- 2026-10-18 (lane 1's choice, for review): **Two fields on `Owed`.**
+  `NextRenewal`, the earliest renewal due among the live reservations under
+  this copy's key, due or not yet, which the deadline needs and no owed item
+  carries; and `HandedBack`, the items a queued step handed back, which the
+  verdict judges. Both are additive.
+- 2026-10-18 (lane 1's choice, for review): **The hand-back at the
+  verdict.** `Judge` accepts a hand-back only while away, under
+  `--hold-pushes`, and only of an unpushed branch's item naming its branch
+  and head; any other item the reader hands back is put back among the owed
+  items. The front door records each accepted one under the lock.
+- 2026-10-18 (lane 1's choice, for review): **Rows the plan leaves open.**
+  The prose-question block (row 1) does not take the owed set as seen, so
+  the next check names it; at the cap it records nothing, since the plan
+  names rows 2, 4, 5 and 7. A block past the cap leaves the session's state
+  "stopped". The push sentence goes with an unpushed branch, an uncarried
+  reservation, and a behind or failing pull request, the items whose next
+  act the plan calls a push. The next look is the earliest-matching
+  qualifying wake; a recurring task with no following match by the deadline
+  plus an hour is taken as up to 30 minutes late.
+- 2026-10-18 (lane 1's choice, for review): **The parser's edges.** Names
+  (`MON`), `@` forms and a step on a single value are not read, so they
+  never qualify. The day-of-month and day-of-week "written from `*`" rule
+  takes a field starting with `*`.
+- 2026-10-18 (lane 1's choice, for review): **abcd's own faults allow.**
+  Present, the session's state is neither read nor written. Away, a session
+  state that cannot be read or saved, and an owed set the reader could not
+  return, allow the stop with a stderr line, as a malformed payload does. A
+  StopFailure error type outside `[a-z][a-z0-9_]{0,63}` is recorded as
+  `unknown`. `hooks/stop.sh` and `hooks/stop-failure.sh` never download the
+  binary, as `hooks/subagent-stop.sh` does not, and exit 1 when it is
+  missing, never the Stop event's blocking 2; the brief's hook paragraphs
+  name them among the exceptions.
+- 2026-10-18 (lane 1's choice, for review): **One text for the person-only
+  acts.** The away block and the prose-question block carry
+  `autonomy.QuestionRoute()`, step 6's statement of the list. Until that
+  lane's branch merges, `internal/core/autonomy/question_placeholder.go`
+  stands in for its `question.go` with exactly its text; it is deleted at
+  the merge.
+
+Choices made while integrating the three lanes on 2026-10-18, each recorded
+for review; none changes a test a step names.
+
+- 2026-10-18 (integration's choice, for review): **The placeholder went in
+  the merge.** Step 6's `question.go` and lane 1's
+  `question_placeholder.go` declared the same names word for word, so the
+  placeholder was removed in the merge commit that brought step 6 in, to
+  keep every commit building.
+- 2026-10-18 (integration's choice, for review): **The stop hook owns the
+  hand-back record.** Lane 2's reader recorded a hand-back as it found one,
+  and lane 1's front door recorded each the verdict accepted. `ReadOwed` now
+  records nothing: it moves the handed-back item from `Owed.Items` into
+  `Owed.HandedBack`, the verdict accepts it (`Verdict.HandBacks`), and the
+  stop hook records what was accepted under the lock, once per branch and
+  head. One owner, and an item the verdict puts back among the owed is never
+  recorded as handed back. This replaces lane 2's "`ReadOwed` records each
+  hand-back itself" and lane 1's "the reader and the front door may both
+  record one" above. `ReadOwed` also fills `Owed.NextRenewal`, present or
+  away, from the same halfway point its renewal items use.
+- 2026-10-18 (integration's choice, for review): **The seam is wired.** The
+  stop hook's `stopOwedReader` defaults to `autonomy.ReadOwed` and is asked
+  with `autonomy.ReadOptions`; lane 1's stand-in type is gone.
+- 2026-10-18 (integration's choice, for review): **The recorder keys on the
+  start copy.** `awayCopyRoot` resolves the copy through
+  `autonomy.ResolveCopy` with the hook payload's session id, falling back
+  to the payload cwd's worktree when the session has no note or the store
+  cannot be opened, so the branch list and the stop check read the same
+  copy's key.
+- 2026-10-18 (integration's choice, for review): **The ADR says what the
+  listing covers.** adr-2610181003541997, still proposed, now says the
+  listing covers every open pull request when the person's forge login is
+  known, and the person's own alone when it is not, as lane 2's reader does
+  and invariant 7's clause now says too; lane 2's note above on the
+  mismatch is answered by it.
+
+- 2026-10-18 (fix round 1's choice, for review): **"Managed" reaches a
+  linked worktree's main worktree.** Every away hook and the recorder act
+  only where `.abcd/` is a directory at the checkout's root or, for a
+  linked worktree, at its main worktree's root (`autonomy.Managed`). The
+  second half keeps a session that changed into a worktree it made (whose
+  branch may predate `.abcd/`, or whose `.abcd/` was never committed)
+  checked; one `git rev-parse --git-common-dir` is the only cost, paid only
+  in a linked worktree with no `.abcd/`. A checkout whose `.git` is a folder
+  with no `.abcd/` beside it is told from the marker alone, with no git. The recorder now asks the same
+  question instead of the local tier, which a fresh worktree lacks.
+- 2026-10-18 (fix round 1's choice, for review): **A landed no-upstream
+  branch is told by a merge first.** `git cherry` alone misses a squash of
+  several commits (its patch matches none of them), so the reader first
+  merges the branch into the last-fetched default branch without writing
+  anything (`merge-tree --write-tree`, merge drivers replaced as the conflict
+  probe replaces them): no change is landed, a change is owed. Only a
+  conflicting merge falls to `git cherry`, landed when every commit is
+  upstream by patch id, and otherwise a note. So a genuinely unpushed branch
+  whose change conflicts with the default branch is a note, not an item: the
+  phantom-stop failure the review found is worse than this one, which other
+  items (its reservation, uncarried) still cover.
+- 2026-10-18 (fix round 1's choice, for review): **The record's parts have
+  their own bounds.** Stops past 24 KiB (JSON) let the one seen least
+  recently go, and hand-backs past 8 KiB the oldest, each counted
+  (`dropped_stops`, `dropped_handed_back`) and printed by `mode back`; the
+  queue past 24 KiB refuses the next step (`ErrQueueFull`, exit 2), since a
+  queued step is the person's to read and is never cut. Only Begin carrying,
+  or Back closing, a record already past 64 KiB lets queued steps go
+  (`dropped_queue`), and Back prints every line first. Three fields are
+  added to the record, omitted when zero; `schema_version` stays 1.
+- 2026-10-18 (fix round 1's choice, for review): **Back replaces what it
+  cannot trust.** A record that does not parse, names another schema or is
+  not safely this account's (a symlink, writable by others, another
+  account's) is replaced by a closed record through the store's atomic
+  writer, which replaces a link rather than writing through it, and nothing
+  from it is printed. A record with parts of the wrong shape is read for the
+  rest. A lock not had within its two seconds, or not safe to take, is gone
+  around: the write is atomic, and a re-read catches a writer that held the
+  lock and wrote after, closing again (three tries). `autonomous` and `queue`
+  still refuse such a record, naming `mode back`.
+- 2026-10-18 (fix round 1's choice, for review): **A due renewal's deadline
+  is its lapse.** The reader reports `Owed.WakeBy`: each live reservation's
+  renewal while not yet due, and its lapse once due, the earliest. The
+  deadline reads it less the skew (falling back to `NextRenewal` for a set
+  built without it), so a renewal only due releases on a wake that fires
+  before the lease lapses, as "Owed work" has it.
+- 2026-10-18 (fix round 1's choice, for review): **The budget counts from
+  the hook's start.** The owed read has 14 seconds from the hook's start
+  (the root lookups included); the forge listing's ten seconds sit inside
+  it. A reading cut short sets `Owed.Incomplete`; `Judge` then allows the
+  stop with a line naming what was not read and, while away, records it as
+  `check-incomplete`. This changes the design in one respect: under heavy
+  load a stop with work owed may now be allowed, recorded and shown, where
+  before the hook was killed at 30 seconds and the stop went unrecorded.
+
+## Footprint
+
+- packages: internal/core/autonomy, internal/core/mode, internal/core/guard, internal/surface/cli, hooks, commands/mode.md, commands/guard.md, .abcd/development/brief/02-constraints/03-invariants.md, .abcd/development/brief/04-surfaces/08-abcd.md, .abcd/development/brief/04-surfaces/17-guard.md
+- tests: internal/core/autonomy, internal/core/mode, internal/core/guard, internal/surface/cli
+
+## Steps
+
+1. The away record, its store, its lock and its verbs
+   - packages: internal/core/autonomy, internal/core/mode, internal/surface/cli, commands/mode.md, .abcd/development/brief/04-surfaces/08-abcd.md
+   - tests: internal/core/autonomy, internal/core/mode, internal/surface/cli
+   - Watched failing first: TestAwayRecordSharedAcrossWorktrees (`abcd mode
+     autonomous --until 09:00` writes one record in the away store that a
+     sibling worktree reads, with who set it and from which copy);
+     TestUntilClockTimeAndTimestamp;
+     TestUntilRefusedPastOrNoTierOrNoCheckout (nothing written);
+     TestStaleRecordCapSevenDays (an open-ended record reads as ended seven
+     days on, and `--until` beyond that is refused);
+     TestModeBackPrintsQueueAndStops (one plain line per queued step and per
+     recorded stop, the "possibly forced by the cap" label included, and the
+     ender and copy recorded; also on a record whose time has passed);
+     TestRecordPastEndReadsEnded; TestQueueAppends;
+     TestHoldPushesRecorded (`--hold-pushes` is kept in the record, shown in
+     the away block, and grants nothing); TestRepeatedStopCollapses (a stop
+     identical to the last recorded one adds to its count and last time
+     instead of a new entry);
+     TestConcurrentWritesUnderLock (two `mode queue` calls racing keep both
+     steps, and a stop recorded after `mode back` re-reads inside the lock
+     and does not turn the mode back on); TestRecordOwnershipFailsOpen (a
+     record or lock that is a symlink, not this account's, writable by
+     others, or over 64 KiB reads as not away, and a verb refuses naming
+     it); TestBadgeRefusedWhileAway; the badge's three-word vocabulary test
+     passes unchanged. The plugin page and the brief's `abcd mode` surface
+     text describe the three verbs and `--hold-pushes` and say the mode
+     grants no rights, the person's standing instruction deciding what is
+     pushed, and `go generate ./internal/surface/cli` refreshes the derived
+     appendix. This step also fixes the shapes of `Record` and of `Owed`
+     (the owed items, each with its kind, whether it is capped, and its
+     branch or record id) in `internal/core/autonomy`, so steps 3 and 4 and
+     steps 5 and 6 can run in two lanes against them.
+   - landed: 2e859ad4b
+2. Repeated to the agent, shown to the person
+   - packages: internal/surface/cli
+   - tests: internal/surface/cli
+   - Watched failing first: TestSessionStartAwayBlockEverySource (`startup`,
+     `resume` and `compact` print the away block while the record holds,
+     nothing when it does not, and the block says the mode grants nothing,
+     carries the person-only act list and the rule to run `abcd mode back`
+     only on the person's word); TestPromptRouterAwayBlockEveryPrompt (a
+     second prompt in the same session too, outside the loader's dedup
+     ledger); TestPromptRouterAwaySystemMessage (one line the person sees on
+     every prompt while it holds, naming who set it, from which copy, the
+     count of queued steps and of handed-back items, and the literal `abcd
+     mode back`); TestSessionStartNotesCopy (the session's start worktree is
+     noted per session id, and a later hook run from a worktree the session
+     made reads the start copy's key); TestPromptRouterLapsedWindowLine (a
+     lapsed, unclosed record with a queued step or a recorded stop shows one
+     line naming `abcd mode back` on every prompt until `mode back` closes
+     it, and one with neither shows nothing); all inside the hook's existing
+     deadline.
+   - landed: 472488938
+3. The created-branch recorder
+   - packages: internal/core/guard, internal/core/autonomy, internal/surface/cli, commands/guard.md, .abcd/development/brief/04-surfaces/17-guard.md
+   - tests: internal/core/guard, internal/core/autonomy, internal/surface/cli
+   - Watched failing first: TestBranchRecorderOnCreate (`git worktree add -b
+     feat/x ../x`, `git switch -c feat/y` and `git checkout -B feat/z`
+     record the branch under this copy's key, whether or not the person is
+     away, only when no branch of that name exists, and `git checkout -b
+     main` on an existing `main` records nothing); TestBranchRecorderOtherForms
+     (`git branch feat/w`, a bare `git worktree add ../v` recording `v`, and
+     `git worktree add ../u feat/u` on an existing branch are recorded; `git
+     branch -m feat/w feat/w2` carries the record; `feat/x` is not matched
+     inside `feat/x2`; the file stays within its cap); TestBranchRecorderNeverRefuses
+     (the command is allowed whatever the recorder does, and a store it cannot
+     write leaves a stderr line); TestBranchRecorderUnderLock (two recordings
+     racing keep both). commands/guard.md and the brief's guard chapter say
+     the hook records a created branch and refuses nothing for it.
+   - landed: 710b9626b
+4. Owed work, and invariant 7's clause
+   - packages: internal/core/autonomy, .abcd/development/brief/02-constraints/03-invariants.md
+   - tests: internal/core/autonomy
+   - Watched failing first, against real git repositories in temp folders
+     and a fake forge listing pinned to `internal/ghcontract`'s fields:
+     TestOwnBranchFromReflogWithoutWindow (checked out before the mode was
+     set, with a recent commit of this checkout's, still own);
+     TestOwnBranchFromRecordedCreation (a branch cut with `git worktree add
+     -b`, absent from this copy's reflog, with no upstream and no record id,
+     is own once recorded); TestOwnBranchFromLiveRunLane (a lane of a run
+     whose reservation is live under this copy's key is own; a lane of a run
+     whose reservation lapsed, or of a finished run, is not);
+     TestOwnBranchFromLinkedReservation; TestStaleOwnBranchNotOwed (a
+     reflog or recorded branch whose newest commit of this checkout's is
+     older than 14 days, with no live reservation, is not owed);
+     TestReviewCheckoutNotOwn (a branch checked out to review, holding only
+     another author's commits, and the head of a pull request another person
+     authored, are never own); TestSiblingBranchNotOwn;
+     TestReservationCopyKeyFilter (a sibling copy's live reservation is not
+     owed); TestReservationLinkByHeadOrClosingTrailer (the record id in the
+     head branch or a `Resolves:`/`Delivers:` line links; a green linked
+     pull request is not owed until renewal is due);
+     TestRecordIDWordBoundary (iss-5 does not match iss-50 in a branch name
+     or a trailer); TestRefsLineCarriesOnlyOwnBranch (a `Refs:` line on a
+     sibling copy's pull request neither carries the work nor makes its
+     branch own; on an own branch's pull request it carries it);
+     TestBehindFromMergeState (a pull request whose merge state is `BEHIND`
+     is owed while the local default branch is stale and shows it current;
+     one `DIRTY` is owed as behind; one `CLEAN` is not; `UNKNOWN` reads as
+     not read); TestStackedBranchFoundWithoutPullRequest;
+     TestStackedBranchClearingRule (owed while behind its base, failing,
+     with a review outstanding, or unverified; waiting on its base
+     otherwise); TestClearingRuleReview (`CHANGES_REQUESTED` in the listing,
+     and a run lane with no passing review of its head, are owed);
+     TestClearingRuleWithoutReceipts (in a repository with no receipt
+     folder, passing checks verify; with no pull request the reason says it
+     was not verified); TestUnpushedSkipsGoneUpstream (a squash-merged
+     branch whose upstream is gone is not owed); TestQueuedPushHandsItemBack
+     (without `--hold-pushes` a queued step hands nothing back, the
+     unpushed branch staying owed; with it, a step naming an unpushed branch
+     whose head contains the base's last-fetched tip and has a receipt hands
+     back that branch's unpushed item, and the hand-back is recorded once
+     per branch and head; with it, none is handed back when the head lacks
+     the base tip, has no receipt, or the repository mints no receipts; nor
+     a pull request behind, `DIRTY` or failing whose fix is committed
+     locally; nor a stacked branch the clearing rule owes; nor one with
+     `CHANGES_REQUESTED`; nor a reservation queued by record id alone; nor a
+     renewal due; iss-5 queued does not hand back iss-50);
+     TestPresentReadsDiskOnly (zero forge calls while present);
+     TestForgeListingDeadline (a hung listing ends at ten seconds, and the
+     check fails open to the disk kinds with a "not read" note: a branch with
+     a pull request is compared on disk naming the fetch time, and a
+     reservation is never reported as uncarried);
+     TestOwedOrderFixed. Brief invariant 7 gains the away mode's one listing
+     per check and its deadline, citing adr-2610181003541997.
+   - landed: 1ad31a522
+5. The stop verdict, the Stop and StopFailure hooks
+   - packages: internal/core/autonomy, internal/surface/cli, hooks
+   - tests: internal/core/autonomy, internal/surface/cli
+   - Watched failing first: TestJudgeRows (each of the seven away rows and
+     both present rows, each with `stop_hook_active` true and false);
+     TestWakeReleasesUnchangedSetTwice (with `*/10 * * * *` and an
+     unchanged behind pull request, the first two stops with the wake are
+     allowed and the third is blocked, and so is each later one; the same
+     for failing, unpushed, stacked-not-clear and uncarried items; a set of
+     only a renewal due, or of a stacked branch waiting only on running
+     checks, keeps releasing; a renewal falling due between the wakes
+     neither resets nor adds to the count; a change in the capped items
+     resets it; the count and its fingerprint are read back from the
+     session's state file by a new hook process);
+     TestJudgeEscapeBoundReproducesNoStall (owed, unchanged, `true`, no wake:
+     blocked, not allowed); TestJudgeCapRecordsStop (the block passing the
+     cap, and an override from the environment, records the stop labelled
+     "possibly forced by the cap"); TestCountResetsOnlyOnInactive (a change
+     in the owed set at the sixth block does not reset the count, and the
+     ninth consecutive block still records the stop; a block with
+     `stop_hook_active` false sets it to one); TestPushItemReasonDefersToStandingInstruction
+     (without `--hold-pushes` the reason for an unpushed branch says to push
+     if the standing instruction allows, to queue only if the person has said
+     pushes wait, and that a queued push stays owed; with it, to finish the
+     local work and then queue; neither names the away mode as permission); TestDeadlineCeiling (with
+     work owed and no reservation, now plus 30 minutes; with nothing owed,
+     now plus one hour; with a renewal due sooner, that minus the skew);
+     TestCronNextFire (lists, ranges, steps, both day fields, an unparsable
+     expression never qualifies); TestCronDayOfWeekSeven (7 matches Sunday
+     as 0 does); TestCronRangeStep (`10-50/20` matches minutes 10, 30 and
+     50); TestCronStarStepInDayField (`0 9 */2 * 1` matches only days that
+     are both odd-numbered and Monday, since a field written from `*` counts
+     as unrestricted, while `0 9 1 * 1` matches either);
+     TestCronDaylightSaving (in Europe/London, `30 1 * * *` has no match on
+     the spring-forward day and matches once, at its first occurrence, on
+     the fall-back day); TestQualifyingWakeDistantCron (a release
+     reservation with a 24-hour lease claimed at 20:00, and `0 7 * * *` seen
+     at 21:00: does not qualify); TestQualifyingWakeJitter (an hourly cron
+     whose next match is 3 minutes before the deadline does not qualify;
+     `*/5 * * * *` and `*/10 * * * *` do; a one-shot at the deadline does);
+     TestQualifyingWakeRecurringCron (`*/30 * * * *` with nothing owed
+     does); TestQualifyingWakeAfterLeaseLapse (a wake past the earliest
+     renewal due minus the skew does not); TestBackgroundTaskNotAWake (a
+     `shell` task running `sleep 36000` or a `tail -f` does not count);
+     TestNextLookStored; TestProseQuestionBlockedOnce; TestNothingOwedReason
+     (names taking the next ready item first); TestSessionIDShape;
+     TestHookStopOutput (a block only on a block, written since Diff review
+     round 1 as the Stop feedback `hookSpecificOutput.additionalContext`, a
+     `systemMessage` while present; a malformed payload, an unreadable record
+     or a held lock allows with a stderr line); TestHookStopFailureRecords
+     (the error type recorded while away, nothing written while present);
+     `hooks/hooks.json` gains Stop and StopFailure entries, the Stop entry
+     with a 30-second timeout, and `hooks/stop.sh`
+     and `hooks/stop-failure.sh` take the same bootstrap and home checks as
+     `hooks/subagent-stop.sh` (the hook-shape tests cover them); `go generate
+     ./internal/surface/cli` refreshes the derived appendix.
+   - landed: 5d754f95b
+6. The question reroute
+   - packages: internal/surface/cli, internal/core/autonomy, .abcd/development/brief/04-surfaces/17-guard.md
+   - tests: internal/surface/cli, internal/core/autonomy
+   - Watched failing first: TestAwayQuestionDeniedOneReason (a Product-chip,
+     a Tech-chip, a Setup-chip and an unchipped question, and another tool's,
+     get the same reason); TestAwayReasonListsPersonOnlyActs (the reason
+     names every act in the list: the embargo `--approve` digest, the
+     embargo triage verdict, the drain's hand-back, the remote-configuration
+     apply verb, a release sign-off and its meaning, pushing, opening or
+     merging a pull request without a standing instruction, an outward
+     comment or message, and the catch-all; that the away mode is no
+     standing instruction; and the route to `abcd mode queue` for those and
+     to `abcd decide` for the rest); TestAwayQuestionSetsNoMode (no mode
+     set, no marker written); TestPresentQuestionGateUnchanged. The brief's
+     guard chapter says what the gate does while away, and that nothing
+     detects the act mechanically.
+   - landed: 2d27610df
+7. The live session capture
+   - packages: none (evidence only, kept in the local tier)
+   - tests: a live Claude Code session with the plugin built from the branch
+   - In a lab checkout, seed one behind pull request checked out before the
+     mode is set, one stacked branch made with `git worktree add -b` in the
+     session, and one unpushed branch, and record the transcript. It must
+     show: the mode set and the away block on start, with the person's line
+     naming who set it and `abcd mode back`; a manual `/compact` followed by
+     the block again; an attempted stop blocked naming the behind pull
+     request; a reply with no tool call blocked again rather than allowed;
+     the stacked branch's item; the unpushed branch's reason deferring to the
+     standing instruction, and, with none given and no `--hold-pushes`, the
+     push queued and the item still named; with `--hold-pushes` and a
+     receipt for its head, the item handed back and the person's line
+     counting it; a cron set for the next morning refused as a wake
+     and one inside the deadline accepted, with abcd's computed fire time
+     compared with the `next run` the host's `CronList` row shows; a
+     `*/10 * * * *` cron with the owed set unchanged releasing twice and the
+     third stop blocked; nine
+     blocks in a row with no tool call, then the same with one tool call in
+     between, to see where the host's count resets; a question refused with
+     the one reason; the window left to lapse with a queued step, and the
+     next prompt's line naming `abcd mode back`; and `abcd mode back`
+     printing the queue and the recorded stops. Repeat with the mode off to
+     show the stop allowed and flagged with no forge call. Capture before and
+     after the change on the same checkout, as the release lesson on host
+     fixes requires.
+   - landed: d0249f356
+
+## Live captures
+
+Run on 2026-10-18, 13:44 to 14:02 BST, with Claude Code 2.1.302
+(`claude-opus-5-5`), against the branch at f403910ac. API spend for all the
+runs together: about 1.70 USD.
+
+**The harness.** Everything sits in one scratch folder, `<scratch>`, outside
+every working tree:
+
+- `<scratch>/plugin` is `git archive f403910ac`. Its binary rung `abcd` is a
+  wrapper that runs `<scratch>/abcd-stall`, which is `go build ./cmd/abcd` at
+  f403910ac, with `HOME=<scratch>/home`, so the away store and every other
+  file of abcd's lands there. The before capture uses `<scratch>/plugin-before`
+  and `<scratch>/abcd-before`, the same build at the branch's merge base
+  646f2fb04.
+- `<scratch>/repo` is the lab checkout. It holds `CLAUDE.md` with abcd's
+  marker block, `.abcd/config.json` and a gitignored local tier. Its bare
+  origin is `<scratch>/origin.git`. `feat/x` was made in this checkout with
+  `git checkout -b`, so its HEAD reflog holds it, then pushed once, then given
+  a second commit by `user.email` that was not pushed. The checkout then went
+  back to `main`.
+- `<scratch>/pathbin` comes first on PATH. It holds a stub `gh` that logs
+  every call and answers `pr list` with `[]`, so no real forge is touched. It
+  also holds the same `abcd` wrapper, for the session's own `abcd mode queue`.
+- `claude -p` runs with `--plugin-dir`, `--setting-sources project,local`,
+  `--output-format stream-json --verbose --include-hook-events`,
+  `--no-session-persistence`, `--permission-prompts none`, a narrow
+  `--allowedTools` (never `git push`, so no capture shows a push clearing an
+  item) and `--max-budget-usd 3` (`<scratch>/run-session.sh`). The runs that
+  need several prompts in one session, or `/compact`, use stream-json input
+  through `<scratch>/drive.py`, which sends each prompt only after the turn
+  before it has ended.
+- Transcripts are `<scratch>/transcripts/<n>.jsonl`, with `.stderr` beside
+  each, and `<scratch>/summarise.py` turns each into `<n>.summary.txt`.
+  Nothing under the account's own Claude configuration was edited.
+
+The person's `!` command and a relayed `!` are not checked here. Those checks
+moved to the checklist draft with the guard entries ("Trim after round 2").
+
+**0. Before the change** (`0-before`). The merge-base plugin, the same lab and
+the same owed `feat/x`, with the prompt "Say hello and stop." There is no Stop
+hook: the session answers "Hello!" and the turn ends (`turns=1`). This is the
+stall.
+
+**1. Present, no away record** (`1-present`). The prompt is "Say hello and
+stop." SessionStart and the prompt hook add nothing. The Stop hook allows the
+stop with `{"systemMessage":"abcd: stopped with work owed (1 item); next:
+branch feat/x has commits not pushed …"}`, and the host shows it as "Stop
+says: …". The stub `gh` was never called. Verdict: as designed.
+
+**2. Away, no standing instruction to push** (`2-away`). The record was set
+with `abcd mode autonomous --until 15:45` (two hours ahead), then the same
+prompt was sent.
+
+- SessionStart:startup returns the `## AWAY` block, with "grants no rights",
+  the person-only list and "Run `abcd mode back` only on the person's word in
+  this session".
+- The prompt hook's `systemMessage` is "abcd: away until 2026-10-18 15:45 BST,
+  set by Alice from repo; 0 steps queued, 0 items handed back.
+  `abcd mode back` ends it.", and the host shows it to the person.
+- The first Stop is blocked: `{"decision":"block","reason":"abcd: the person
+  is away and work is owed (1 item). Next: branch feat/x has commits not
+  pushed … Do the local work, then push if your standing instruction allows;
+  queue only if the person has said pushes wait. A push you may not send stays
+  owed: queue it with abcd mode queue …"}`.
+- Claude goes on. It says the away mode is no standing instruction and runs
+  `abcd mode queue "Push branch feat/x …"`.
+- With no `--hold-pushes`, the queued push hands nothing back. The next stop
+  is blocked again, adding "If it cannot move, take another or schedule a look
+  before 14:15 BST", which is the 30-minute ceiling.
+- Every later reply has no tool call, and each one is blocked rather than
+  allowed. After ten blocks the host prints "A hook blocked the turn from
+  ending 9 consecutive times — overriding and ending turn."
+- The stub `gh` logged ten `pr list … --author @me` calls, one per check.
+- The away record holds the queued step and one stop, `work-owed`,
+  `possibly_forced_by_cap: true`, with count 2. The two are blocks 9 and 10:
+  abcd's count ran 1 to 10, since `stop_hook_active` stayed true across the
+  tool call.
+
+Verdict: as designed. One block, a tool call, then nine blocks with no tool
+call before the host overrode the stop. So **the host's count resets on a
+tool call and overrides at the ninth block since**, which is the eighth
+continuation. abcd's count does not see that reset, so it records the cap one
+block early as well as at the real one. That errs toward recording, as the
+spec says.
+
+**3. A question while away.** Print mode does not offer the host's question
+tool. `AskUserQuestion` is missing from the session's tool list even with
+`--tools AskUserQuestion,Bash,Read`, and missing again in stream-json input
+mode. **The live refusal by the host was therefore not captured.**
+
+- *Live* (`3-question`): asked to use AskUserQuestion, the session cannot. It
+  follows the away block instead: it decides the choice itself, intends to
+  record it with `abcd decide`, queues the push, and is blocked to the cap
+  again. That is ten more `gh` calls for ten checks.
+- *Hook level* (`3b-question-hook`): an AskUserQuestion PreToolUse payload was
+  sent through `sh <scratch>/plugin/hooks/pre-tool-use.sh`, the command the
+  host runs. It returns `permissionDecision: "deny"` with "Blocked by the abcd
+  guard (question tool): the person is away (abcd mode autonomous), so no
+  question is put to them, whatever its chip and whoever wrote it. Route the
+  question by the act it asks about …", followed by the full person-only list
+  and the route to `abcd decide`.
+
+Verdict: the reroute text is right at the hook. The host side remains to
+capture in an interactive session.
+
+**4. Compaction re-injection** (`4-compact`). Stream-json input sent "Say
+hello and stop." and then `/compact`.
+
+- The first stop is blocked, and Claude queues the push.
+- The second stop is blocked and names the deadline "before 14:19 BST".
+  Claude then calls CronCreate with a one-shot `13 14 18 10 *`, and the host
+  answers "Next run: Oct 18 2:13pm".
+- The third stop is allowed silently. The session state reads `waiting`,
+  `next_look` `2026-10-18T14:13:00+01:00` (the host's own next run) and
+  `wakes: 1`.
+- `/compact` (trigger `manual`) runs PreCompact, and then
+  **SessionStart:compact returns the `## AWAY` block again**.
+
+Verdict: as designed, captured live.
+
+**5. Cron wakes, compared with the host** (`5-cron`). Three prompts went to one
+session, each sent after the turn before it ended.
+
+- *Turn 1.* CronCreate `0 7 * * *`. The host's CronList row is "Every day at
+  7:00 AM (recurring) [session-only], next run Oct 19 7:30am". abcd computes
+  the same latest fire time: the 07:00 match plus the host's lateness, at most
+  30 minutes. The first stop is blocked (the first block of the session). The
+  second, with only the morning cron, is **refused as a wake**: it is blocked
+  with "schedule a look before 14:21 BST". Claude then adds `*/10 * * * *`;
+  the host lists "next run Oct 18 2:01pm" (13:51 now). abcd's bound is the
+  14:00 match plus half the gap, 14:05, before the 14:21 deadline, and the
+  host's 14:01 falls inside it. That stop is **allowed** (wake 1).
+- *Turn 2*, with the owed set unchanged: allowed (wake 2).
+- *Turn 3*: blocked with "The set has not moved over two wakes, so a wake no
+  longer releases this stop: move the item, or take another." Then nine
+  one-word replies with no tool call. The host overrides at the ninth block,
+  and abcd's count reaches nine at that same block and records the stop.
+- 13 `gh` calls for 13 checks.
+
+A first attempt sent all three prompts at once. The host merged them into
+one turn, which gave nine blocks in a row with no tool call and the host's
+override at the ninth. Its transcript was overwritten by the rerun, and its
+one recorded stop stays in the record's count.
+
+Verdict: as designed. The `*/10` wake released twice and the third stop was
+blocked, and abcd's fire times agree with what the host lists.
+
+**6. `--hold-pushes`, a stacked branch, the hand-back** (`6-hold-stacked`).
+
+- *Setup.* `abcd mode autonomous --until 14:01 --hold-pushes` (eight minutes
+  ahead; the queue and the stop were kept). A hand-made receipt file named
+  `feat/x`'s head went into `.abcd/.work.local/preflight-receipts/`.
+- *Prompt 1.* The session runs `git worktree add -b feat/stacked
+  <scratch>/wt-stacked feat/x`. The pre-tool hook records the branch.
+- *First stop.* `feat/x` is already handed back: an earlier queued step names
+  it, its head contains `origin/main` and has a receipt. Only the new branch
+  is owed: "work is owed (1 item). Next: branch feat/stacked has commits not
+  pushed … With --hold-pushes the person has said pushes wait: finish the
+  local work …, then queue the push naming the branch, as \`abcd mode queue
+  "push feat/stacked"\`."
+- The stacked condition itself is not owed: the receipt and an equal base tip
+  meet the clearing rule. So the item shown is the stacked branch's unpushed
+  one.
+- Claude queues "push feat/stacked", and the next stop hands that back too.
+  Nothing is owed, so row 7 blocks with "take the next ready item first …
+  schedule a look before 14:54 BST", which is the one-hour ceiling.
+- Claude creates a one-shot cron for 14:37 (host: "Next run: Oct 18 2:37pm"),
+  and the stop is allowed.
+- *Prompt 2.* The person's line reads "pushes wait for you; 4 steps queued,
+  **2 items handed back**". The stop is allowed silently.
+
+Verdict: as designed.
+
+**7. The window lapsed** (`7-lapsed`, after 14:01).
+
+- The prompt hook shows "abcd: the away window ended at 2026-10-18 14:01 BST
+  with 4 steps queued and 2 stops recorded, not yet read. `abcd mode back`
+  prints them and closes it."
+- The stop is checked as present: allowed with "stopped with work owed (2
+  items); next: branch feat/stacked has commits not pushed …".
+- No `gh` call.
+
+**8. StopFailure** (`8-stopfailure-hook`, hook level). Triggering a real API
+error was not possible cheaply, so a payload `{"hook_event_name":
+"StopFailure","error":"rate_limit",…}` was sent through `sh
+<scratch>/plugin/hooks/stop-failure.sh` while away. It exits 0 with no output,
+and the record gains `{"kind":"api-error","error_type":"rate_limit"}`. **A
+live StopFailure was not captured**, so the host's field name is not proven
+here.
+
+**9. `abcd mode back`** (`9-mode-back`, run by hand). It prints one line per
+queued step (four), per handed-back item ("handed back: feat/x at
+512f75b1df8a", the same for feat/stacked), and per recorded stop ("stopped
+with work owed, possibly forced by the cap: … (6 times, first … 13:46 BST,
+last … 13:52 BST)", "stopped on an API error (rate_limit) …"). It ends with
+"the away window ended at 2026-10-18 14:01 BST; closed by Alice from repo".
+
+**Not captured, and why.**
+
+- The behind pull request: the stub forge answers `[]`, and a real lab base
+  that requires up-to-date branches was out of reach here.
+- The host's question refusal live: print mode has no question tool (above).
+- A live StopFailure.
+- A push clearing an item: pushes were withheld on purpose.
+
+**Seen in passing, none of them blocking.**
+
+- The item's text repeats itself: "branch feat/x has commits not pushed
+  (feat/x has commits not pushed)", in the reason, in the person's message
+  and in the recorded stop.
+- The host marks the first block of each turn with a notification "Stop hook
+  error occurred · ctrl+o to see", although the hook exited 0 with outcome
+  `success` and empty stderr. That wording is the host's, but a person sees
+  it.
+- The stops' count overstates the forced stops: 6 recorded against 4 the host
+  forced, from the early record when a tool call reset the host's count.
+- Bounded by the cap, the blocked session repeats itself. In `3-question` it
+  called the hook "faulty" for keeping a queued push owed, which is the
+  designed behaviour without `--hold-pushes`.
+
+### Re-capture after diff review round 1 (9962906df)
+
+Run on 2026-10-18, 15:05 to 15:10 BST, with the same Claude Code and model,
+against the branch at 9962906df. The binary `<scratch>/abcd-stall` and the
+plugin copy `<scratch>/plugin` (a fresh `git archive 9962906df`, with the same
+wrapper rung) were rebuilt. The away store and the lab's local tier were
+cleared, `feat/stacked` and its worktree removed, so `feat/x` again has one
+unpushed commit (512f75b) and the lab is the managed checkout it was
+(`.abcd/config.json` beside `.git`). API spend for the four runs: about
+0.72 USD. Transcripts: `<scratch>/transcripts/2-away-r2`, `2b-away-hold-r2`,
+`1-present-r2` and `3-unmanaged-r2`, each as `.jsonl`, `.stderr` and
+`.summary.txt`.
+
+**2-away-r2** (away record set with `abcd mode autonomous --until 17:05`,
+prompt "Say hello and stop.").
+
+- The stop is still prevented. The Stop hook answers `{"hookSpecificOutput":
+  {"hookEventName":"Stop","additionalContext":"abcd: the person is away and
+  work is owed (1 item). Next: branch feat/x has commits not pushed. Do the
+  local work, then push if your standing instruction allows; …"}}`, and the
+  session goes on to queue the push. Thirteen Stop hooks ran and none ended
+  the turn until the host's cap: "A hook blocked the turn from ending 9
+  consecutive times — overriding and ending turn."
+- The output uses `hookSpecificOutput.additionalContext`, with no `decision`
+  or `reason` field.
+- The host shows no "Stop hook error occurred": `hook error` and `Stop hook
+  feedback` match nothing in the stream-json or the stderr (0 and 0). The one
+  `notification` in the stream is the cap's own (`stop-hook-block-cap`).
+- The item names `feat/x` once: "Next: branch feat/x has commits not pushed."
+  The doubled "(feat/x has commits not pushed)" of the earlier run is gone.
+- The stub `gh` logged 13 `pr list` calls for 13 Stop hooks, one per check.
+- The model's own `abcd decide` call was denied by the narrow `--allowedTools`
+  (a `permission_denied` event); the hook has no part in that.
+
+**2b-away-hold-r2** (the same, with `--hold-pushes`). Without `--hold-pushes`
+the reason only carries the generic `abcd mode queue "<step>"` placeholder,
+so the branch quoting is checked here. The first Stop output ends: "queue the
+push naming the branch, as `abcd mode queue 'push feat/x'`." The branch is a
+single quoted shell word. No hook error (0 matches), 10 Stop hooks, 10 `gh`
+calls, ended by the host's cap.
+
+**1-present-r2** (no away record). The stop is allowed. The hook returns
+`{"systemMessage":"abcd: stopped with work owed (1 item); next: branch feat/x
+has commits not pushed."}`, shown as the informational "Stop says: …". No
+hook error, and the stub `gh` was never called (0 calls).
+
+**3-unmanaged-r2** (a copy of the lab in a sibling folder with `.abcd/`
+removed and `feat/x` still unpushed; the away record from the lab was in
+force). The Stop hook prints nothing (`exit=0`, empty output), the prompt hook
+adds nothing, the turn ends after one reply ("Hello!"), no abcd text appears
+in the stream, and the stub `gh` was never called.
+
+Verdict: the block holds, the host's error notice is gone, and the item text
+no longer repeats. One thing to know: a Stop that follows the queued push,
+when nothing is owed, still continues the session ("take the next ready item
+first …"), since that wording is a continuation prompt.
+
+## Size
+
+Re-estimated after review round 3 at 7.5 working days of work, up from the
+5.75 written after the trim (dcn-2610181017056307):
+
+| step | days | after the trim |
+|---|---|---|
+| 1. The away record, its store, its lock and its verbs | 1.0 | 0.75 |
+| 2. Repeated to the agent, shown to the person | 0.75 | 0.5 |
+| 3. The created-branch recorder | 0.5 | 0.25 |
+| 4. Owed work, and invariant 7's clause | 2.25 | 1.75 |
+| 5. The stop verdict, the Stop and StopFailure hooks | 1.75 | 1.5 |
+| 6. The question reroute | 0.5 | 0.5 |
+| 7. The live session capture | 0.75 | 0.5 |
+| total | 7.5 | 5.75 |
+
+Round 3 adds: in step 1 `--hold-pushes`, the collapsed repeated stops and
+fixing the `Record` and `Owed` shapes; in step 2 the counts on the person's
+line and the session's start-copy note; in step 3 the other branch-creating
+forms, the rename and the cap; in step 4 the hand-back's base-tip and
+receipt conditions with their real-git cases, `DIRTY` and `UNKNOWN`, and the
+fail-open terms; in step 5 the wake count and its row; in step 7 the
+hand-back and wake-count checks. The rest of the rise is the Sonnet
+reviewer's point that 5.75 days was thin for about 60 tests on real-git
+fixtures: that reviewer planned about seven days before these additions, the
+Opus reviewer found the elapsed figure credible, and 7.5 is the honest
+figure with both.
+
+**Why not four.** About four working days of work is not reachable by
+scoping alone. Steps 3 to 5 carry 4.5 days, and every rule in them answers a
+review finding: the created-branch, stale-ownership and `Refs:` rules
+(round-2 blockers 3 to 5), the merge state (blocker 2), the deadline and
+cron cases (blocker 1), and the hand-back and wake count (round-3 F1 and
+F2). Cutting any of them reopens a finding, and the stacked-branch rules are
+the issue's second instance. The elapsed time can be shorter: `Judge` is
+pure over the owed set, so once step 1 fixes `Record` and `Owed`, steps 3
+and 4 (2.75 days) run in one lane while steps 2, 5 and 6 (3.0 days) run in
+another, which puts the critical path at about 4.75 days with the capture
+after both. Whether to run two lanes is the release orchestrator's choice.
+
+Round 2 estimated eight days for seven steps, round 1 five days for six; the
+first plan wrote no size down.
+
+## Review round 1
+
+On 2026-10-18 an Opus and Sonnet pair reviewed the plan as frozen at
+82b928305, with the verdict "fix the plan first". Each item and how it was
+handled:
+
+| # | finding | handled |
+|---|---|---|
+| 1 | the ownership rule misses both instances; stacked-branch clearing | fixed: "own" without a window, from the reflog, a run's lanes or a linked reservation; the clearing rule; stacked found without a pull request; gone upstreams skipped (dcn-2610180936568358, dcn-2610180936571036) |
+| 2 | the escape bound reproduces the stall | fixed: an unchanged owed set is allowed only with a qualifying wake, else blocked again, the host's cap the outer bound with the stop recorded; `stop_hook_active` decides no row, so the missing row is covered (dcn-2610180936577720) |
+| 3 | a wake's timing is never checked | fixed: next fire time from abcd's own cron parser, before the earliest renewal due minus the skew; background tasks never count; distant, recurring and stale-shell rows tested (dcn-2610180936579498) |
+| 4 | the reroute approves acts only the person may approve | fixed: classified by the act with the listed person-only acts, the embargo `--approve` digest included; the chip no longer routes (dcn-2610180937177502) |
+| 5 | stopping while away contradicts the coordination decision (dcn-2610180720541206) | fixed: while away only working or waiting with a qualifying wake; the next look stored in the session's state (dcn-2610180936577720) |
+| 6 | concurrent writes lose updates | fixed: `fsutil.WithFileLock` with a re-read inside it; ownership and permission checks; an unreadable record fails open (dcn-2610180937181736) |
+| 7 | a stale record traps the person | fixed in part: capped at seven days rather than 24 hours, since the record's standing run of 2026-10-15 to 2026-10-17 would not fit 24 hours and requiring `--until` contradicts the open-ended ruling; the person sees a line on every prompt rather than past a threshold; the agent runs `abcd mode back` only on the person's word (dcn-2610180937181736) |
+| 8 | the return list reads one working copy's decisions | moved: the return list leaves the slice with the split, and the fix (`abcd decide` appending each id to the away record under its lock) moves with it (dcn-2610180937181929) |
+| 9 | present mode undefined; per-turn forge call | fixed: present reads disk only with no forge call; away listing under a ten-second deadline with a cache (dcn-2610180936571036) |
+| 10 | reservations: no link, no copy filter | fixed: the record id in the head branch or a body trailer links them; only this copy's key counts (dcn-2610180936568358) |
+| 11 | StopFailure and prose questions | fixed: a StopFailure entry records the stop and its type, the gap named in the scope conditions; a prose question is blocked once (dcn-2610180937175629) |
+| 12 | waiting does not look for other work | fixed: the nothing-owed reason says to take the next ready item first (dcn-2610180936577720) |
+| 13 | a refused session can lift away mode for all | fixed in part: `abcd mode back` records who ended it and from which copy, and the away block allows it only on the person's word; showing it on return moved with the return report (dcn-2610180937181736, dcn-2610180937181929) |
+| size | no size written; five days more honest | fixed: re-estimated at five days, per step above |
+| split | move step 6 and the return half of step 5 | made: the return report, the status line, the bare print and their brief text moved to the checklist draft; kept here, because the slice's own behaviour needs them, are `abcd mode back` printing the queue, invariant 7's clause and the shipped verbs' docs (dcn-2610180937181929) |
+
+## Review round 2
+
+On 2026-10-18 an Opus and Sonnet pair re-reviewed the plan as frozen at
+d04bc92fc, with the verdict "fix the plan first". They found round 1's items
+2, 5, 6, 11, 12 and 13 fixed, item 7 sufficient, and items 8, 9 and 10
+narrowed by the findings below. Each item and how it was handled:
+
+| # | finding | handled |
+|---|---|---|
+| (a) | away mode as the person's ask to push is not safe: the prompt hook cannot tell a relayed message from the person's, so an agent could grant itself and every copy seven days of push rights | fixed: guard entries refuse every route to setting the mode the guard reads (the binary by any of its names, a `go run` of `cmd/abcd`, `sh -c`, a script file, a shell write into the away store, the file tools), so the person sets it with `!` or at a terminal; refused attempts are recorded and shown; the grant is narrow and its exclusions stated (never the default branch, a tag, a release cut, another person's pull request, a review-only branch, a force push); the guard is called a mistake filter, the OS fence the boundary for launched agents only (dcn-2610171112384712); the capture checks the `!` path and a relayed `!`, with the no-push fallback named if they break the premise (dcn-2610181003456444) |
+| (b) | the cap count can miss a forced stop when the owed set changes | fixed: the count resets only on `stop_hook_active` false, a stop at the cap is labelled "possibly forced by the cap", and the capture checks where the host resets (dcn-2610181003484631) |
+| (c) | cron in local time is correct; add a capture check | fixed: the capture compares abcd's computed fire time with the host's listed next run (dcn-2610181003455731) |
+| 1 | the wake deadline still allows the stall, through long leases and the host's lateness | fixed: the deadline is the earlier of the renewal due minus the skew and now plus 30 minutes while owed (one hour when not); a recurring cron's fire time adds half its gap, at most 30 minutes; TestQualifyingWakeDistantCron is pinned to a 24-hour lease; daylight saving, day-of-week 7, `a-b/n` and `*/n` in a day field are tested (dcn-2610181003455731) |
+| 2 | "behind" is measured against a default branch nothing refreshes overnight | fixed: while away, behind is the listing's merge state; only a branch with no pull request is compared on disk, naming the fetch time (dcn-2610181003464379) |
+| 3 | instance 2 is still missed: the stacked drain branches have no upstream, reflog entry, run state or record id | fixed: the pre-tool hook records a branch the session creates (`git worktree add -b`, `git switch -c`, `git checkout -b`) under this copy's key in the away store, only when no branch of that name exists; the capture seeds one (dcn-2610181003463367) |
+| 4 | a `Refs:` line is a mention, not a carrier, and iss-5 matches iss-50 | fixed: linked by head branch, `Resolves:` or `Delivers:` on word boundaries; a `Refs:` line carries only for an already-own branch and never confers ownership (dcn-2610181003467233) |
+| 5 | stale ownership leaves abandoned lanes and pruned branches owed forever | fixed: a run lane counts only while its run's reservation is live under this copy's key, finished runs' lanes never; a reflog or recorded branch only with a commit of this checkout's in the last 14 days or a live linked reservation (dcn-2610181003463367) |
+| 6 | the person-only list is incomplete | fixed: the embargo triage verdict, the drain's hand-back, the remote-configuration apply verb, a push or merge beyond own branches, outward comments and messages, and a catch-all added; release sign-off defined beside the standing permission for automatic cuts; stated that nothing detects the act mechanically and the existing guards enforce only what they name (dcn-2610181003477194) |
+| 7 | the queue goes unread when the window lapses | fixed: a lapsed, unclosed record with anything unread shows a line naming `abcd mode back` on every prompt until closed, and the away line carries the literal verb (dcn-2610181003474765) |
+| minor | the clearing rule needs abcd's preflight receipt | fixed: where a repository mints no receipts, passing checks verify; with no pull request the reason says unverified (dcn-2610181003488355) |
+| minor | the clearing rule leaves out review | fixed: an outstanding review (`CHANGES_REQUESTED`, or a run lane with no passing review of its head) keeps a stacked branch owed (dcn-2610181003488355) |
+| minor | the intent still lists a superseded decision | fixed: dcn-2610180913431985 removed from the intent's list; its successor dcn-2610180937181929 stays |
+| minor | mint an ADR for the invariant 7 amendment | made: adr-2610181003541997, proposed |
+| size | not a finding; re-estimated for the fixes | eight working days, step by step above |
+
+## Trim after round 2
+
+On 2026-10-18 the release orchestrator ruled that the plan take the fallback
+and be trimmed to what closes iss-2610170619247185, aiming at about four
+working days, because the security and bug-fix cut waits on this slice. The
+reviewer added which items stay. Two decisions record it:
+dcn-2610181016510153 (the away mode grants no push rights; supersedes
+dcn-2610181003456444) and dcn-2610181017056307 (the trim and what moved).
+
+**What stays** is what serves the three things the issue needs: (i) a
+session with owed work cannot end its turn silently (the Stop hook, the
+ownership rules, the qualifying wake, the cap handling); (ii) questions
+reroute by the act (decided with `abcd decide`, or queued when only the
+person may approve); (iii) the away record (set, ended, lapsing,
+re-injected at start, compaction and prompt, with its lock).
+
+**What moved** to itd-2610170638184486, as named remaining work, and why:
+
+| moved | why |
+|---|---|
+| the guard entry refusing an agent's `abcd mode autonomous`, and its routes through `sh -c` and script files | the mode grants no rights now, so there is nothing for it to guard in this slice; and the OS fence (spc-2610161751056096) never covers the person's interactive sessions, so it could not become a boundary for the sessions that stalled |
+| the guard reading `go run ./cmd/abcd` and built `abcd-<goos>-<arch>` binaries as `abcd`, for every entry, the ledger flip included | a security-relevant widening of what every entry matches, which deserves its own review in the checklist work, not a ride on this cut |
+| the shell-write and file-tool refusals on the away store, and the PreToolUse matcher gaining the file tools | they only protected the person-only setting |
+| the refused attempts: recorded, shown on the next prompt, listed by `abcd mode back` | they only reported the person-only setting |
+| the capture's checks of the person's `!` command and of a relayed `!` | they tested the push-rights premise the fallback removes; the checklist work needs them when it makes the mode person-only |
+| the away forge listing's ten-minute reuse cache and its stale-cache fallback | tuning: each away check makes one listing under its ten-second deadline, and a failed read judges from disk, naming the pull requests as not read, so nothing is hidden; a run of eight blocks costs up to eight bounded listings |
+| `abcd mode back` printing more than one plain line per queued step and per recorded stop | the report on return is already the checklist draft's; the plain lines keep the queue read |
+
+**Added by the fallback** (dcn-2610181016510153): the reason for an item that
+needs a push tells the session to push if its standing instruction allows
+and otherwise to queue the push, never treating the away mode as
+permission; a queued step that names the item's branch or record id hands it
+back for the window, a branch only while it holds commits to push; and the
+person-only acts gain pushing, opening or merging a pull request without a
+standing instruction. Without the hand-back, a session with no standing
+instruction to push would be blocked on its unpushed branch until the host's
+cap. Review round 3 found that hand-back an exemption the session could
+grant itself, and narrowed it to `--hold-pushes` and a verified branch's
+unpushed item alone (below).
+
+**Each round-2 item after the trim:**
+
+| # | round-2 finding | state after the trim |
+|---|---|---|
+| (a) | away mode as the person's ask to push is not safe | closed by the fallback the review named: the mode grants no push rights, so a relayed word cannot grant any; the guard entries that answered it the other way moved out with dcn-2610181003456444, which dcn-2610181016510153 supersedes. A mode set on a relayed word only keeps sessions working and deciding, and the person sees who set it on the next prompt |
+| (b) | the cap count can miss a forced stop | kept: the count resets only on `stop_hook_active` false, the stop at the cap is labelled "possibly forced by the cap", and the capture checks where the host resets (step 5, step 7) |
+| (c) | cron in local time; a capture check | kept: the capture compares abcd's fire time with the host's `CronList` next run (step 7) |
+| 1 | the wake deadline still allows the stall | kept whole: the ceiling, the host's lateness, the 24-hour-lease case and the daylight-saving, day-7, `a-b/n` and `*/n` cases (step 5) |
+| 2 | "behind" against a stale default branch | kept: the forge's merge state while away, disk only for a branch with no pull request (step 4); the listing loses only its reuse cache, and invariant 7's clause and adr-2610181003541997, amended while proposed, say one listing per check |
+| 3 | instance 2 missed: the stacked drain branches | kept, in any mode: the pre-tool hook records a created branch, now its own step 3, and it refuses nothing; the capture seeds one (step 7) |
+| 4 | `Refs:` as a carrier; iss-5 matching iss-50 | kept: linked by head branch or a closing trailer on word boundaries, a `Refs:` line carrying only for an already-own branch (step 4) |
+| 5 | stale ownership | kept: run lanes only while their reservation is live, reflog and recorded branches only with a commit of this checkout's in 14 days (step 4) |
+| 6 | the person-only list is incomplete | kept, and extended by the fallback: pushing, opening or merging a pull request without a standing instruction joins it, replacing "a push or merge beyond the session's own branches" (step 6) |
+| 7 | the queue goes unread when the window lapses | kept: the every-prompt line and the lapsed-window line, both naming `abcd mode back`; the lapsed line now counts queued steps and recorded stops, the refused attempts having moved (step 2) |
+| minor | the clearing rule needs abcd's receipt | kept: passing checks verify where no receipts are minted (step 4) |
+| minor | the clearing rule leaves out review | kept: an outstanding review keeps a stacked branch owed (step 4) |
+| minor | the intent lists a superseded decision | unchanged, still fixed; dcn-2610181003456444 is now superseded too and the intent says so |
+| minor | mint an ADR for invariant 7 | kept: adr-2610181003541997, proposed, amended to drop the cache from its decision |
+| size | re-estimate | 5.75 days, step by step under Size; about four is the elapsed time with two lanes, not the work |
+
+**Round-1 items the trim touches:** item 9 (the per-turn forge call) stays
+fixed, since present mode makes no call and the away call is bounded, though
+no longer cached; item 13 keeps the recorded ender, while showing it on
+return had already moved; items 6, 7 and 11 are kept whole.
+
+**No blocker is reopened.** Nothing the review made essential to (i) to
+(iii) was cut. The items kept against the trim's pressure, and why, are
+listed in dcn-2610181017056307: each is the fix of a finding above.
+
+## Review round 3
+
+On 2026-10-18 an Opus and Sonnet pair reviewed the plan as frozen at
+600c109d6, with the verdict "ready to build once F1 and F2 are in". They
+found the round-2 mapping, the ADR and invariant 7's clause, the recorder
+and the two-lane estimate sound. Each item and how it was handled:
+
+| # | finding | handled |
+|---|---|---|
+| F1 | the queued-push hand-back lets the session exempt itself, replaying the first instance: a behind pull request merged locally and queued was handed back and stayed behind all night; it also covered stacked branches, reservations and renewals, and the person's line did not count it | fixed: by default a queued push hands nothing back, the item stays owed and the cap records the stop; only `abcd mode autonomous --hold-pushes`, which narrows and grants nothing (dcn-2610181016510153 stands), allows a hand-back, and then only of a branch's unpushed item while its head contains the base's last-fetched tip and has a receipt (or the clearing rule's equivalent, which an unpushed head never meets); never a behind, failing or under-review item, a reservation alone or a renewal; the person's line says "N steps queued, M items handed back"; TestQueuedPushHandsItemBack covers each case, the no-flag case included (dcn-2610181035355741) |
+| F2 | a cheap wake keeps a stall alive: a `*/10` cron set once releases an unchanged owed set at every wake | fixed: an unchanged set of capped items (behind, failing, unpushed, stacked-not-clear, and an uncarried reservation, added as the same kind of act) is released by a qualifying wake at most twice in a row, then blocked, the cap recording the stop; a renewal only due or an item waiting on running checks keeps releasing; the count and its fingerprint live in the session's state file in the local tier; TestWakeReleasesUnchangedSetTwice; repeated identical stops collapse into one entry so the record stays within 64 KiB (dcn-2610181035361997) |
+| minor | the behind kind: `DIRTY` and `UNKNOWN` | handed to the builder, and written into Owed work and TestBehindFromMergeState: `DIRTY` owed as behind, `UNKNOWN` not read |
+| minor | the recorder's forms: `git branch <b>`, a bare `git worktree add <path>`, `git worktree add <path> <existing>`, a record carried across `git branch -m` or `-M`, whole-token names, a capped file | handed to the builder, and written into "own" and TestBranchRecorderOtherForms; the cap's bound is the builder's |
+| minor | the copy key from a worktree's working directory | handed to the builder, and written into Owed work ("Which copy") and TestSessionStartNotesCopy; the note's shape is the builder's |
+| minor | fail-open when the listing fails, stated in the spec and the ADR | handed to the builder, and written into "What is read", TestForgeListingDeadline and adr-2610181003541997: a branch with a pull request compared on disk naming the fetch time, a reservation never reported as uncarried |
+| minor | a Stop hook timeout of about 30 seconds | handed to the builder, and written into the front door and step 5 |
+| minor | `Record` and `Owed` fixed in step 1 so the lanes can run in parallel | handed to the builder, and written into step 1 and Size |
+| size | Sonnet: 5.75 days thin, about seven; Opus: 3.75 days elapsed credible | re-estimated at 7.5 days of work with round 3's additions, about 4.75 elapsed in two lanes (Size) |
+
+No fourth review round: the two deltas are checked on the next commit by
+hand.
+
+## Diff review round 1
+
+On 2026-10-18 an Opus and Sonnet pair reviewed the built slice's diff at
+f403910ac (against e4cca1e38), with the verdict "fix first", every major
+reproduced. The fix round added the release orchestrator's three hard
+requirements to majors 1, 3 and 6. Each item and how it was handled:
+
+| # | finding | handled |
+|---|---|---|
+| major 1 | the Stop hook acted in every git repository, not only managed ones | fixed: Stop, StopFailure, the session-start and prompt away paths and the branch recorder return at once outside a managed checkout (`autonomy.Managed`), with no output, no file under abcd's home, no session note or state, and no git at all where the checkout's .git is a folder (the nearest .git entry is found without git); TestHookStopUnmanagedRepoSilent, TestAwayHooksLeaveUnmanagedRepoAlone (93d34a1ef, e1d64652a, 1eec1addc) |
+| major 2 | a squash-merged branch with no upstream read as unpushed for 14 days | fixed: a merge into the default branch that changes nothing is landed, a conflicting one falls to `git cherry`, and the undecidable is a note; TestNoUpstreamLandedBranchNotOwed, TestNoUpstreamUnlandedBranchOwed, TestNoUpstreamUndecidedBranchNoted (546c22e40) |
+| major 3 | a full record kept the person from ending the mode | fixed: AddStop collapses an identical stop anywhere and rotates past its bound; hand-backs rotate; the queue refuses past its bound; Back ends a record past its bound, unparsable, partly unparsable, not safely this account's or behind a busy or unsafe lock, printing what it can and naming the rest; Begin carries a full record fitted; TestAddStopCollapsesAnywhere, TestRecordStaysWithinBoundInUse, TestBackEndsAnyRecord, TestBackWithLockHeld, TestBeginCarriesAFullRecord, TestModeBackEndsAnUnreadableRecord (e101881f2) |
+| major 4 | a failed `git worktree add <path> <existing>` recorded a peer's branch | fixed at record time: a name a worktree has checked out is skipped; TestBranchRecorderSkipsBranchCheckedOutElsewhere (fa7f6a8f2). At read time a reflog branch another worktree holds is not own (minor 4's fix); a recorded one stays own, since a worktree the session made holds its branch by design |
+| major 5 | a row-1 block past the cap recorded nothing | fixed: work owed when anything is, else no next look; TestRowOnePastCapRecordsStop (e0d16ae76) |
+| major 6 | the stop check overran the hook's 30-second timeout | fixed: every git call of the read is bound to a 14-second budget from the hook's start; the stack-base search is linear; a reading cut short allows the stop, named and recorded; TestStackBaseSearchLinear, TestReadOwedHonoursDeadline, TestIncompleteReadAllows, TestHookStopBudgetFailsOpen (31b5ac337). A design change, stated under Settled here |
+| 7 | `decision: "block"` shows "Stop hook error occurred" | fixed after reading the hooks reference again (quoted under the host mechanics): a block is `hookSpecificOutput.additionalContext`; TestHookStopBlockIsFeedback (060d25335); the live capture re-run is the orchestrator's |
+| 8 | the reason repeated itself | fixed at the source: the reader's reason is the item's words; TestReasonSaysItOnce and the end-to-end exact line (e0d16ae76, e1d64652a) |
+| minor 1 | a due renewal never released on a wake | fixed: the deadline reads `Owed.WakeBy`; TestDueRenewalReleasesOnWake builds the set with the reader, and TestWakeReleasesUnchangedSetTwice no longer uses an impossible state (3e4676f32) |
+| minor 2 | the 200-listing truncation was silent | fixed: a note, and no reservation reported uncarried from a truncated listing; TestForgeListingAtLimitTruncated (231a6984f) |
+| minor 3 | carried counted other people's pull requests | fixed: the carried check applies findOwn's fork and author filter; TestCarriedOnlyByOwnPullRequest (29f62682b) |
+| minor 4 | the review-only exclusion leaned on author email | fixed for the case the machine can tell: a reflog branch another worktree has checked out is not own; TestReviewCheckoutSameEmailNotOwn (29f62682b). A sibling's branch no worktree holds any more still reads as own on one email: nothing on disk tells it apart |
+| minor 5 | a branch name in a suggested shell command | fixed: each interpolated word is one shell word (`shellquote.Single` unless plain), the renewal's `abcd reserve` too; names were already cleaned by termsafe; TestSuggestedQueueCommandQuotesBranch (e0d16ae76) |
+| minor 6 | `hook stop` had no `recover` | fixed: a panic allows the stop with a stderr line, and StopFailure records nothing; TestHookStopPanicAllows (61f1e0e40) |
+| minor 7 | overcounted recorded stops | left as the spec allows, labelled "possibly forced by the cap" |
+| minor 8 | SubagentStop under `--no-session-persistence` | outside the slice; not handled in this round |
+| own | the end-to-end test made its bare origin by hand | fixed: `gittest.InitBare`, which TestNoTestMakesABareRepositoryByHand requires (3b8b14fac) |
diff --git a/.abcd/work/decisions/dcn-2610180913379049-the-overnight-stall-is-fixed-first-not.md b/.abcd/work/decisions/dcn-2610180913379049-the-overnight-stall-is-fixed-first-not.md
new file mode 100644
index 0000000000..91fdddb376
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913379049-the-overnight-stall-is-fixed-first-not.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913379049
+slug: the-overnight-stall-is-fixed-first-not
+date: 2026-10-18
+---
+2026-10-18 — The overnight stall is fixed first, not deferred (facilitator-on-delegation, iss-2610170619247185 and itd-2610170638184486 planning prep): the critical record of the session that sat idle overnight is not given a one-cycle deferral; the security and bug-fix release waits for the smallest slice that removes its core cause, filed as itd-2610180912189125. This rests on the product thinker's standing rulings, restated: of 2026-10-11, that a major finding is fixed before a cut, never deferred, and building carries on; of 2026-10-12, that when a deferred question is all that stands between an intent and its plan, the facilitator decides it on delegation and plans it; of 2026-10-17, that in an autonomous run the agent decides and records rather than ending on a wait for the person. The stop check itself is the product thinker's settled design, in the checklist draft's decisions of 2026-10-17: a stop with work owed is refused only while they are recorded as away, and while they are present it is allowed and pointed out. It agrees with the coordination prep's decision that this fix ships as the bundle's first slice without waiting on the coordination intent (grounds: iss-2610170619247185 remedy; itd-2610170638184486 decisions; the coordination prep's ship-first decision of 2026-10-18)
diff --git a/.abcd/work/decisions/dcn-2610180913388445-the-stall-fix-is-its-own-intent-not-a.md b/.abcd/work/decisions/dcn-2610180913388445-the-stall-fix-is-its-own-intent-not-a.md
new file mode 100644
index 0000000000..375967382a
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913388445-the-stall-fix-is-its-own-intent-not-a.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913388445
+slug: the-stall-fix-is-its-own-intent-not-a
+date: 2026-10-18
+---
+2026-10-18 — The stall fix is its own intent, not a spec of the checklist draft (facilitator-on-delegation, itd-2610180912189125 planning): the slice (the away mode held by abcd, the stop check, and the question reroute) is filed as itd-2610180912189125, which builds on itd-2610170638184486, rather than planned as a first spec of that draft closed with a remainder; planning the draft would move it to planned before the product thinker has walked its criteria on Thursday, and its open trade-offs (the phone, the shared options) would then sit inside a planned record. A separate intent keeps the split with the coordination intent unchanged, since the slice touches nothing on the shared remote, and follows the precedent of itd-2610150602547271, filed as the first slice of itd-97. The idle time a coordinator sees stays out of the slice and comes with the coordination intent's central view (grounds: brief invariant 17; itd-2610150602547271; itd-2610170638184486 scope split; the coordination prep's ship-first decision)
diff --git a/.abcd/work/decisions/dcn-2610180913399042-the-away-mode-is-a-record-of-the-person.md b/.abcd/work/decisions/dcn-2610180913399042-the-away-mode-is-a-record-of-the-person.md
new file mode 100644
index 0000000000..25246bed7e
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913399042-the-away-mode-is-a-record-of-the-person.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913399042
+slug: the-away-mode-is-a-record-of-the-person
+date: 2026-10-18
+---
+2026-10-18 — The away mode is a record of the person's absence, set by a verb and ended only by its time or by their word (facilitator-on-delegation, itd-2610180912189125 planning): abcd mode autonomous [--until <time>] records who set it (the holder name reservations already resolve from caller-local facts), when, and when it ends, where --until takes a clock time (its next occurrence, local time) or a full timestamp and a time already past is refused; without --until it is open-ended until abcd mode back. It sits beside the waiting-on badge, whose three words stay a closed set, and is not a fourth word. A human prompt during the window does not end it, since a brief return overrode the instruction on 2026-10-16 and a prompt from a peer looks the same. An agent sets it on the person's word in its session, and one set covers every working copy, so no peer has to relay it. This restates the product thinker's 2026-10-17 ruling that they say they are away, until a set time or open-ended, and say when they are back (grounds: itd-2610170638184486 decisions; iss-2610170619247185; brief invariant 10; internal/core/mode)
diff --git a/.abcd/work/decisions/dcn-2610180913399499-the-away-mode-is-held-once-per.md b/.abcd/work/decisions/dcn-2610180913399499-the-away-mode-is-held-once-per.md
new file mode 100644
index 0000000000..d8345a321b
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913399499-the-away-mode-is-held-once-per.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913399499
+slug: the-away-mode-is-held-once-per
+date: 2026-10-18
+---
+2026-10-18 — The away mode is held once per repository on the machine, not per working copy (facilitator-on-delegation, itd-2610180912189125 planning): the record lives in abcd's machine store under the repository's root commit, beside the worktree store's key, so every working copy of the repository and every session in it reads the same record; the issue's remedy words it per checkout, but the stall began with an instruction relayed by a peer between sessions in separate working copies, and the person's absence is a fact about them, not about one copy. It is not machine-wide, so a repository the person never left running is unaffected. A session on another computer or in the cloud does not see it until the checklist draft's shared options land (grounds: iss-2610170619247185 what happened; AGENTS.md worktree store; principle the-users-directory-is-theirs)
diff --git a/.abcd/work/decisions/dcn-2610180913406972-the-away-mode-is-repeated-to-the-session.md b/.abcd/work/decisions/dcn-2610180913406972-the-away-mode-is-repeated-to-the-session.md
new file mode 100644
index 0000000000..f35c60d6f6
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913406972-the-away-mode-is-repeated-to-the-session.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913406972
+slug: the-away-mode-is-repeated-to-the-session
+date: 2026-10-18
+---
+2026-10-18 — The away mode is repeated to the session at every start, after every compaction and with every prompt (facilitator-on-delegation, itd-2610180912189125 planning): while it holds, the session-start hook says it on every source, compact included, and the prompt hook says it with every prompt, outside the rule loader's once-per-session ledger, as one short block: away until when and set by whom, the rule to decide and record rather than wait, and the next owed item. The host documents that a SessionStart hook fires with source compact after compaction and that its plain stdout or additionalContext, like a UserPromptSubmit hook's, is added to Claude's context. The instruction of 2026-10-16 was lost because it lived only in the context a compaction summarised (grounds: code.claude.com/docs/en/hooks SessionStart matcher compact and UserPromptSubmit additionalContext; principle durable-state-lives-where-the-platform-says-it-survives; iss-2610170619247185)
diff --git a/.abcd/work/decisions/dcn-2610180913413137-the-stop-check-refuses-only-while-the.md b/.abcd/work/decisions/dcn-2610180913413137-the-stop-check-refuses-only-while-the.md
new file mode 100644
index 0000000000..386caf4ac2
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913413137-the-stop-check-refuses-only-while-the.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913413137
+slug: the-stop-check-refuses-only-while-the
+date: 2026-10-18
+---
+2026-10-18 — The stop check refuses only while the person is away and is bounded so it never spins (facilitator-on-delegation, itd-2610180912189125 planning): a plugin Stop hook asks abcd, which blocks the stop with the host's decision block and a reason naming the next owed item and how many remain, only while the away mode holds and owed work exists. While the person is present the stop is allowed and, with work owed, pointed out in one line through the host's systemMessage. If the host says the session is already continuing because of a stop hook and the owed set is unchanged since this session's last block, the stop is allowed and recorded as stopped with work owed, shown on the person's return; the host's own cap of eight consecutive continuations, reset by each tool call, is the outer bound. The host documents stop_hook_active as the field to check so a hook never blocks on a condition that will not resolve. The session states are the bundle's: working, waiting, stopped. This restates the product thinker's 2026-10-17 stop-check ruling (grounds: code.claude.com/docs/en/hooks Stop input and Stop decision control; itd-2610170638184486 decisions)
diff --git a/.abcd/work/decisions/dcn-2610180913416683-owed-work-is-four-kinds-read-from-disk.md b/.abcd/work/decisions/dcn-2610180913416683-owed-work-is-four-kinds-read-from-disk.md
new file mode 100644
index 0000000000..9d68028058
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913416683-owed-work-is-four-kinds-read-from-disk.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913416683
+slug: owed-work-is-four-kinds-read-from-disk
+date: 2026-10-18
+---
+2026-10-18 — Owed work is four kinds, read from disk and one forge listing (facilitator-on-delegation, itd-2610180912189125 planning): a session owes work it can do alone when it has (1) a live reservation whose renewal is due or whose work no open pull request carries yet; (2) an open pull request of its own that is behind the default branch or failing its checks; (3) a branch of its own with commits not pushed; (4) a branch of its own stacked on a change that is still open, whose merge from the default branch, fixes, review and preflight are owed now, since a declared dependency holds only its landing. A branch is the session's own when its working copy's own HEAD history has had it checked out since the window began, so a sibling copy's branches never count. The reservations are read as last fetched, behind against the last-fetched default branch, and the pull requests' states from one listing of the person's open pull requests through the forge client per stop check, which becomes part of the away mode's documented meaning in brief invariant 7, as the drain's listing is; a failed listing falls back to the disk kinds and says so. The next item is the first of: a renewal due, a failing pull request, a behind one, a stacked branch, an unpushed branch, unhanded work (grounds: iss-2610170619247185 remedy and second instance; the coordination prep's decision that a declared dependency constrains only the landing; brief invariant 7; internal/core/claim)
diff --git a/.abcd/work/decisions/dcn-2610180913421109-a-session-with-nothing-owed-stops-only.md b/.abcd/work/decisions/dcn-2610180913421109-a-session-with-nothing-owed-stops-only.md
new file mode 100644
index 0000000000..f5ec127348
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913421109-a-session-with-nothing-owed-stops-only.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913421109
+slug: a-session-with-nothing-owed-stops-only
+date: 2026-10-18
+---
+2026-10-18 — A session with nothing owed stops only with its next look scheduled (facilitator-on-delegation, itd-2610180912189125 planning): while the away mode holds, a stop with no owed work is allowed when the host reports a scheduled wake for the session or a background task in flight, and is then waiting; otherwise it is blocked once, asking the session to schedule its next look sooner than half its reservations' lease (under an hour for the two-hour lease) through the host's own scheduling, and the bound in the stop-check decision applies. The host documents that its Stop input carries session_crons (wakes from CronCreate, ScheduleWakeup and /loop) and background_tasks so a hook can tell a finished session from one paused for work that will wake it. abcd starts no process of its own and schedules nothing itself. The check covers the overnight gap after the two-hour watcher ended; the checklist draft's own timed wakes and trigger promises stay there. It matches the coordination prep's decision that a waiting session wakes before half its lease, and the product thinker's ruling that a waiting session records when it looks again and is never kept spinning (grounds: code.claude.com/docs/en/hooks Stop input; itd-2610170638184486 decisions; iss-2610170619247185 idle spans)
diff --git a/.abcd/work/decisions/dcn-2610180913431493-while-the-person-is-away-no-question.md b/.abcd/work/decisions/dcn-2610180913431493-while-the-person-is-away-no-question.md
new file mode 100644
index 0000000000..9060b213d6
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913431493-while-the-person-is-away-no-question.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913431493
+slug: while-the-person-is-away-no-question
+date: 2026-10-18
+---
+2026-10-18 — While the person is away no question waits for them (facilitator-on-delegation, itd-2610180912189125 planning): while the away mode holds, the guard refuses every question on the host's question tool, abcd's or another tool's, because a question nobody is there to answer stalls the session. A product or technical question is refused with a reason telling the agent to decide it, record it with abcd decide marked as decided on delegation with its grounds and how to reverse it, and carry on; a step only the person's hands can do (a browser step, a secret, a new App) is refused with a reason telling the agent to queue it with abcd mode queue "<step>" and carry on with other work. abcd mode product-thinker or facilitator is refused the same way. Decisions in the window are not asked first, technical trade-offs included, since the product thinker ruled on 2026-10-17 that in an autonomous run the agent decides and records and only steps that need them on the website wait (grounds: iss-2610170619247185 remedy; itd-2610170638184486 framing; internal/surface/cli guard question check)
diff --git a/.abcd/work/decisions/dcn-2610180913431985-the-person-s-return-shows-two-lists.md b/.abcd/work/decisions/dcn-2610180913431985-the-person-s-return-shows-two-lists.md
new file mode 100644
index 0000000000..31db379e1f
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913431985-the-person-s-return-shows-two-lists.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913431985
+slug: the-person-s-return-shows-two-lists
+date: 2026-10-18
+---
+2026-10-18 — The person's return shows two lists derived from what already exists (facilitator-on-delegation, itd-2610180912189125 planning): when the away mode ends, by its time passing or abcd mode back, the next prompt shows once the steps queued for the person's hands and the decisions recorded in the window, each with its text, which the reroute asks to carry its grounds and how to reverse it, plus any stop recorded with work owed. The decisions are the decision records whose time-ordered ids fall inside the window, so no second store of decisions is kept; the queue is the only new list and lives in the away record. The draft's richer lists for the person's return stay in itd-2610170638184486 (grounds: principle one-canonical-primitive; adr-45 time-ordered ids; itd-2610170638184486 press release)
diff --git a/.abcd/work/decisions/dcn-2610180913444971-a-session-s-checklist-is-one-json-file.md b/.abcd/work/decisions/dcn-2610180913444971-a-session-s-checklist-is-one-json-file.md
new file mode 100644
index 0000000000..355f0529e2
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913444971-a-session-s-checklist-is-one-json-file.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913444971
+slug: a-session-s-checklist-is-one-json-file
+date: 2026-10-18
+---
+2026-10-18 — A session's checklist is one JSON file per working copy in its local tier (facilitator-on-delegation, itd-2610170638184486 planning prep): the checklist the draft describes is kept per working copy, since the checkout is the unit of isolation and the coordination prep keys one central-view line per working copy, in that copy's local tier, never in a tracked folder, and its re-injection reuses the slice's session-start and prompt-hook path; the away mode itself is not copied into it but read from the repository's one away record (grounds: AGENTS.md concurrent sessions and working-tree layout; the draft's format decision; the coordination prep's per-working-copy decision; itd-2610180912189125)
diff --git a/.abcd/work/decisions/dcn-2610180913445272-the-slice-keeps-the-core-host-agnostic.md b/.abcd/work/decisions/dcn-2610180913445272-the-slice-keeps-the-core-host-agnostic.md
new file mode 100644
index 0000000000..aedd1ad535
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913445272-the-slice-keeps-the-core-host-agnostic.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913445272
+slug: the-slice-keeps-the-core-host-agnostic
+date: 2026-10-18
+---
+2026-10-18 — The slice keeps the core host-agnostic and is reachable without a host (facilitator-on-delegation, itd-2610180912189125 planning): the away record, the owed-work reading and the stop verdict are a core package returning data, and the front doors format it: abcd hook stop maps the host's Stop payload and answers in its decision format, and a bare abcd mode prints the away record, the queue and the owed items, so the check runs with no plugin host present. The plugin's hook manifest gains a Stop entry with the same bootstrap and home checks as its other hooks, and the status line names the away mode and its end, so the person never wrongly believes agents are working or waiting. Nothing is written under the host's own settings directory (grounds: brief invariant 3; AGENTS.md transport-agnostic core and wired or it isn't done; the product thinker's ruling of 2026-10-05 that nothing in the host's settings calls abcd beyond the consented status line; itd-2610170638184486 decisions)
diff --git a/.abcd/work/decisions/dcn-2610180913455828-a-promise-tied-to-a-trigger-is-a.md b/.abcd/work/decisions/dcn-2610180913455828-a-promise-tied-to-a-trigger-is-a.md
new file mode 100644
index 0000000000..6f41d646d1
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913455828-a-promise-tied-to-a-trigger-is-a.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913455828
+slug: a-promise-tied-to-a-trigger-is-a
+date: 2026-10-18
+---
+2026-10-18 — A promise tied to a trigger is a checklist entry checked when the session looks, never a watcher (facilitator-on-delegation, itd-2610170638184486 planning prep): a promise such as 'when that pull request merges, add the wrapper' is written into the checklist with its trigger, read by the session at each start, wake and stop check, and its wake is the host's scheduled wake that the slice's stop check already reads; abcd keeps no process alive for it. The two-hour watcher of 2026-10-16 ended with the promise unkept, and the coordination prep settled that every deadline is derived when records are read, with no process that must stay alive (grounds: iss-2610170619247185; the coordination prep's on-demand pass decision; code.claude.com/docs/en/hooks Stop input session_crons)
diff --git a/.abcd/work/decisions/dcn-2610180913466436-the-pre-run-blocker-sweep-asks-four.md b/.abcd/work/decisions/dcn-2610180913466436-the-pre-run-blocker-sweep-asks-four.md
new file mode 100644
index 0000000000..bb6c2c51e0
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913466436-the-pre-run-blocker-sweep-asks-four.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913466436
+slug: the-pre-run-blocker-sweep-asks-four
+date: 2026-10-18
+---
+2026-10-18 — The pre-run blocker sweep asks four fixed kinds and reports the run likely autonomous only when none is open (facilitator-on-delegation, itd-2610170638184486 planning prep): before or as an autonomous run starts, the orchestrating session asks each session by message, as the product thinker chose, for (1) a design decision not yet made, (2) a step only a person's hands can do, (3) work it depends on from another session, and (4) a credential missing or expiring within the window; each session writes its answers into its checklist, the orchestrator puts them to the person together, and says the run is likely to stay autonomous only once every session reports none open. The kinds are the four the draft's press release names; the message route stays within the coordination prep's bound that a question put to a person may travel by message (grounds: itd-2610170638184486 press release and scope split; the coordination prep's stance-bound decision; iss-2610170619247185, every blocker known at 20:48)
diff --git a/.abcd/work/decisions/dcn-2610180936568358-a-session-s-own-branches-are-named-by.md b/.abcd/work/decisions/dcn-2610180936568358-a-session-s-own-branches-are-named-by.md
new file mode 100644
index 0000000000..53b5a6b70b
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180936568358-a-session-s-own-branches-are-named-by.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180936568358
+slug: a-session-s-own-branches-are-named-by
+date: 2026-10-18
+---
+2026-10-18 — A session's own branches are named by three facts with no window bound, and only this copy's reservations count (facilitator-on-delegation, itd-2610180912189125 review round 1; refines dcn-2610180913416683): a branch other than the default branch is the session's own when (a) this working copy's HEAD reflog has checked it out at any time, (b) it is the branch of a lane recorded in a run state this copy's local tier holds (the implement loop's lanes, which build and drain cut with git worktree add, so they never reach the coordinating copy's reflog), or (c) it is the head branch of an open pull request linked to a live reservation held under this copy's key. A reservation counts only when its copy key is this copy's, so a sibling copy's reservation never holds this session. A pull request carries a reservation's work when the record id appears in its head branch's name or on a Refs:, Resolves: or Delivers: line of its body. The window bound is dropped because both instances of iss-2610170619247185 escaped it: the pull requests that fell behind were opened and last checked out before any window began, and the stacked drain lanes lived in worktrees of their own (grounds: the plan review of 2026-10-18 by an Opus and Sonnet pair, findings 1 and 10; internal/core/claim copy key; internal/core/implement/loop lane worktrees; iss-2610170619247185)
diff --git a/.abcd/work/decisions/dcn-2610180936571036-a-stacked-branch-is-owed-only-while-it.md b/.abcd/work/decisions/dcn-2610180936571036-a-stacked-branch-is-owed-only-while-it.md
new file mode 100644
index 0000000000..265ab6a771
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180936571036-a-stacked-branch-is-owed-only-while-it.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180936571036
+slug: a-stacked-branch-is-owed-only-while-it
+date: 2026-10-18
+---
+2026-10-18 — A stacked branch is owed only while it needs work, and the forge is read only while the person is away, under a deadline (facilitator-on-delegation, itd-2610180912189125 review round 1; refines dcn-2610180913416683): an own branch is stacked when its open pull request's base is not the default branch, or, with no pull request, when the nearest other own branch whose tip is an ancestor of its tip is not contained in the last-fetched default branch. A stacked branch whose base is still open is owed only while it is behind its base's tip or the last-fetched default branch, its checks are failing, or no preflight receipt names its head in any worktree (the receipts the landing step already reads); otherwise it is waiting on its base, which is not owed. An unpushed branch has commits not on its upstream or, with none configured, not in any remote-tracking ref; a branch whose upstream is gone (merged and deleted on the remote, a squash merge included) is never counted. While the person is present the check reads disk only (a reservation's renewal due and unpushed own branches) and never calls the forge, so brief invariant 7 holds on every turn. While away it makes at most one pull-request listing under a ten-second deadline; a listing younger than ten minutes is reused rather than repeated, and on a failure or timeout one younger than half the default lease is used with its age named, else the disk kinds alone with the pull requests named as not read (grounds: the plan review of 2026-10-18, findings 1 and 9; brief invariant 7; internal/core/landing receipt lookup)
diff --git a/.abcd/work/decisions/dcn-2610180936577720-while-the-person-is-away-a-session-is.md b/.abcd/work/decisions/dcn-2610180936577720-while-the-person-is-away-a-session-is.md
new file mode 100644
index 0000000000..9add66cd61
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180936577720-while-the-person-is-away-a-session-is.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180936577720
+slug: while-the-person-is-away-a-session-is
+date: 2026-10-18
+---
+2026-10-18 — While the person is away a session is only working or waiting, and abcd never allows a stop with work owed (facilitator-on-delegation, itd-2610180912189125 review round 1; supersedes the bound in dcn-2610180913413137 and refines dcn-2610180913421109): while away a stop is allowed only when the session has a qualifying wake and either nothing is owed or the owed set is unchanged since this session's last block; it then reads waiting, and the wake's next fire time is kept as its next look in the session's own state file in the local tier, beside the owed-set fingerprint and a count of consecutive blocks. Every other stop while away is blocked, whatever stop_hook_active says, naming the next item, or with nothing owed asking the session to take the next ready item first and only then schedule its next look. The host's cap of eight consecutive continuations, or the cap its documented environment variable sets, is the outer bound, and the block abcd counts as reaching it records stopped with work owed in the away record. The old row that allowed an unchanged owed set once stop_hook_active was true reproduced the stall, since a reply of awaiting the person with no tool call ended the turn until morning. This matches the coordination prep's decision that while the person is away a session with work never stops and one with nothing it can do is waiting with its next look, and the draft's ruling that stopped is allowed only while the person is present (grounds: the plan review of 2026-10-18, findings 2, 5 and 12; code.claude.com/docs/en/hooks Stop input and continuation cap; itd-2610170638184486 decisions)
diff --git a/.abcd/work/decisions/dcn-2610180936579498-a-wake-qualifies-only-when-its-next-fire.md b/.abcd/work/decisions/dcn-2610180936579498-a-wake-qualifies-only-when-its-next-fire.md
new file mode 100644
index 0000000000..04c33f6e97
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180936579498-a-wake-qualifies-only-when-its-next-fire.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180936579498
+slug: a-wake-qualifies-only-when-its-next-fire
+date: 2026-10-18
+---
+2026-10-18 — A wake qualifies only when its next fire time falls before the session's earliest renewal due, and a background task never counts (facilitator-on-delegation, itd-2610180912189125 review round 1; refines dcn-2610180913421109): a session_crons entry qualifies when the next time its cron expression matches after now, read in the machine's local time, is no later than the earliest renewal due among the live reservations under this copy's key minus the lease skew allowance, a renewal being due halfway between a reservation's claim or last renewal and its expiry; with no live reservation it must fire within half the default lease. The next fire time comes from a small five-field cron parser of abcd's own (minute, hour, day of month, month, day of week, with lists, ranges, steps and the wildcard), since the host documents schedule as a cron expression and a new dependency would need sign-off; an expression it cannot parse never qualifies. A background task does not count on its own while the person is away, since a shell task such as a long sleep or a tail that never ends reports as in flight however distant its wake. So a cron at 09:00 seen at 21:00, or a wake that fires after a lease lapses, no longer passes (grounds: the plan review of 2026-10-18, finding 3; code.claude.com/docs/en/hooks session_crons and background_tasks fields; internal/core/lease; AGENTS.md new dependencies need sign-off)
diff --git a/.abcd/work/decisions/dcn-2610180937175629-an-api-error-stop-is-recorded-and-a-turn.md b/.abcd/work/decisions/dcn-2610180937175629-an-api-error-stop-is-recorded-and-a-turn.md
new file mode 100644
index 0000000000..0f4bb1b0d4
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180937175629-an-api-error-stop-is-recorded-and-a-turn.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180937175629
+slug: an-api-error-stop-is-recorded-and-a-turn
+date: 2026-10-18
+---
+2026-10-18 — An API-error stop is recorded, and a turn ending on a prose question while away is blocked once (facilitator-on-delegation, itd-2610180912189125 review round 1): the plugin's hook manifest gains a StopFailure entry, which the host fires instead of Stop when a turn ends on an API error such as a rate limit and whose output it ignores, so it cannot continue the session; while the person is away abcd records the stop and the host's error type in the away record, and the slice's scope conditions name that such a turn is recorded, not resumed, except by a wake the session had already scheduled. While away, a stop whose last_assistant_message ends on a line ending in a question mark is blocked once per message with the reroute's reason (decide and record it, or queue it when it is an act only the person may approve), before the verdict's other rows apply (grounds: the plan review of 2026-10-18, finding 11; code.claude.com/docs/en/hooks StopFailure and Stop input; iss-2610170619247185, whose session ended its turn on a question)
diff --git a/.abcd/work/decisions/dcn-2610180937177502-while-the-person-is-away-a-question-is.md b/.abcd/work/decisions/dcn-2610180937177502-while-the-person-is-away-a-question-is.md
new file mode 100644
index 0000000000..0f4d788bf7
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180937177502-while-the-person-is-away-a-question-is.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180937177502
+slug: while-the-person-is-away-a-question-is
+date: 2026-10-18
+---
+2026-10-18 — While the person is away a question is routed by the act it asks about, not by its chip (facilitator-on-delegation, itd-2610180912189125 review round 1; supersedes the chip routing in dcn-2610180913431493): the guard still refuses every question on the host's question tool while the away mode holds, now with one reason whatever the chip. It tells the agent to queue with abcd mode queue, and carry on with other work, a question about any act only the person may approve: an approval the repository binds to the person per act (an embargo close's --approve digest, which commands/embargo.md says is never supplied unless the person has read the text and said yes in that session; a release sign-off); publishing anything or changing a repository's visibility; adding a dependency; a secret, a credential or an App; a step only a website or a browser can do; a destructive act (deleting what the session did not create, overwriting uncommitted work, a force push, discarding a peer's work); and anything that spends money. Every other question is decided and recorded with abcd decide, with its grounds and how to reverse it. The away mode, set on the person's word, is their ask for the session to commit and push its own branches and open their pull requests, which is the owed work itself; merging follows the repository's own rule. The Setup chip marks the setup interview's questions (visibility, keys, oracles), not a step only the person can take, so routing by chip would have sent an embargo approval, or the creation of a new App asked under a Product chip, to be decided by the agent (grounds: the plan review of 2026-10-18, finding 4; commands/embargo.md approval one per act; brief invariant 22; AGENTS.md new dependencies and commits; internal/surface/cli guard question chips)
diff --git a/.abcd/work/decisions/dcn-2610180937181736-the-away-record-is-changed-only-under-a.md b/.abcd/work/decisions/dcn-2610180937181736-the-away-record-is-changed-only-under-a.md
new file mode 100644
index 0000000000..454f923837
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180937181736-the-away-record-is-changed-only-under-a.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180937181736
+slug: the-away-record-is-changed-only-under-a
+date: 2026-10-18
+---
+2026-10-18 — The away record is changed only under a lock, read only when it is safely the account's, and capped at seven days (facilitator-on-delegation, itd-2610180912189125 review round 1; refines dcn-2610180913399042): every read-modify-write of the record (setting, ending, queueing, a recorded stop) holds fsutil.WithFileLock on a lock file beside it and re-reads the record inside the lock, so a stop check that read away before a slow forge listing cannot write away back after the person ended it, and two queued steps cannot lose one; the forge listing runs outside the lock, and a lock not had within two seconds allows the stop and says so on stderr. The record and its lock are used only when each is a regular file this account owns that no one else can write, within 64 KiB, the checks rules.json already gets; a record failing them, or failing to parse, reads as not away, failing open, and a verb asked to change it refuses naming the file. An open-ended record ends seven days after it was set, and --until may name no later time, so a forgotten record lapses while a run of several days, such as the standing run of 2026-10-15 through 2026-10-17, still fits; a 24-hour cap would have ended that run midway, and requiring --until would contradict the product thinker's ruling that the mode may be open-ended. While the record holds, the prompt hook adds a one-line systemMessage the person sees on every prompt naming the away mode, its end, who set it and how to end it; the away block tells the agent to run abcd mode back only on the person's word in its session; and abcd mode back records who ended the mode and from which working copy (grounds: the plan review of 2026-10-18, findings 6, 7 and 13; internal/fsutil file lock; AGENTS.md rules.json ownership checks; iss-2610170619247185 standing run; the draft's ruling that the state is always shown plainly)
diff --git a/.abcd/work/decisions/dcn-2610180937181929-the-person-s-return-report-the-status.md b/.abcd/work/decisions/dcn-2610180937181929-the-person-s-return-report-the-status.md
new file mode 100644
index 0000000000..2a502d7705
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180937181929-the-person-s-return-report-the-status.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180937181929
+slug: the-person-s-return-report-the-status
+date: 2026-10-18
+---
+2026-10-18 — The person's return report, the status line and the bare abcd mode print move from the slice back to the checklist draft (facilitator-on-delegation, itd-2610180912189125 review round 1; supersedes dcn-2610180913431985 for the slice, and the status-line and bare-print halves of dcn-2610180913445272): both reviewers of 2026-10-18 recommended the split, so the security and bug-fix cut waits only on the away record, the stop check and the question reroute. The spec's step 6 and the return half of its step 5 leave the slice: the report shown once on the first prompt after the window ends (the queue, the window's decisions and the recorded stops); the window's decisions gathered from every working copy by abcd decide appending each id to the away record under its lock (review finding 8); showing on return who ended the mode (finding 13); the status line naming the away mode and its end; a bare abcd mode printing the record, the queue and the owed items; and the brief's surface text for them. They become named remaining work in the scope of itd-2610170638184486. The slice keeps what its own behaviour needs: abcd mode back prints the queue and the recorded stops as it ends the record, so a queued step is never unread; brief invariant 7 gains the away mode's forge listing; and the plugin page and the brief's surface chapters describe the verbs and hooks the slice ships, so nothing it ships is undocumented. The slice is re-estimated at five working days (grounds: the plan review of 2026-10-18, size and split; the coordination prep's decision that the cut waits on this slice alone; AGENTS.md wired or it isn't done; brief invariant 7)
diff --git a/.abcd/work/decisions/dcn-2610181003455731-a-wake-qualifies-only-when-it-fires-the.md b/.abcd/work/decisions/dcn-2610181003455731-a-wake-qualifies-only-when-it-fires-the.md
new file mode 100644
index 0000000000..a934003fed
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610181003455731-a-wake-qualifies-only-when-it-fires-the.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610181003455731
+slug: a-wake-qualifies-only-when-it-fires-the
+date: 2026-10-18
+---
+2026-10-18 — A wake qualifies only when it fires, the host's lateness included, within a short ceiling (facilitator-on-delegation, itd-2610180912189125 review round 2, blocker 1 and choice (c); refines dcn-2610180936579498): the deadline is the earlier of the earliest renewal due among this copy's live reservations minus lease.Skew, and now plus a ceiling of 30 minutes while work is owed or one hour when none is, because a release reservation's 24-hour lease put its renewal 12 hours on and let a 07:00 cron seen at 21:00 qualify. The fire time compared with it is the next match, read in the machine's local time, plus the latest the host may run it: for a recurring task, half the gap to its following match, at most 30 minutes, and nothing for `*/5 * * * *`; a one-shot task is taken as matched, since the host only ever runs one early. The parser follows vixie cron, as the host says it does: a day field written from `*` (`*/n`) counts as unrestricted for the either-day rule, 7 is Sunday as 0 is, and `a-b/n` steps a range. The live capture compares the computed fire time with the next run the host lists (grounds: plan review round 2, blocker 1 and choice (c); the host's scheduled-tasks page on jitter, local time and day-of-week; the release reservation's default lease in the reserve verb)
diff --git a/.abcd/work/decisions/dcn-2610181003456444-only-the-person-sets-the-away-mode-its.md b/.abcd/work/decisions/dcn-2610181003456444-only-the-person-sets-the-away-mode-its.md
new file mode 100644
index 0000000000..c5e9b564da
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610181003456444-only-the-person-sets-the-away-mode-its.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610181003456444
+slug: only-the-person-sets-the-away-mode-its
+date: 2026-10-18
+---
+2026-10-18 — Only the person sets the away mode, its push rights are narrow, and the guard's refusal is a mistake filter (facilitator-on-delegation, itd-2610180912189125 review round 2, choice (a); refines dcn-2610180913399042, replacing its clause that an agent sets the mode on the person's word): the prompt hook cannot tell the person's message from one another session relays, and its input names no origin, so a relayed word could let an agent grant itself, and every copy, push rights. So the guard refuses every route to setting the mode that it reads: `abcd mode autonomous` by the binary on PATH, the plugin root's binary or a built `abcd-<goos>-<arch>`; a `go run` of a package ending in `cmd/abcd`; any of them inside `sh -c` or in a script file a shell runs (adr-2610091150447054); a shell write into the away store under `~/.abcd.noindex/away/`; and an Edit or Write tool call on a path inside it. The person sets the mode with their own `!` command, which the host runs directly without going through Claude and so without the pre-tool hook, or at a terminal. A refused attempt is recorded in the store and shown to the person on the next prompt. What the mode grants is the session committing and pushing its own branches and opening their pull requests; never the default branch, a tag, a release cut, another person's pull request, a branch this copy only checked out to review, or a force push; merging follows the repository's own rule. This is chosen over the fallback, and is enough for now, because the grant only governs an agent that follows refusals: one that ignores them can push without any mode, so no shape of the mode adds a boundary inside the person's own session; the guard stops a refusal-following agent from granting itself on a relayed word; the rights are narrow, and every push is reversible and visible on the forge; and the record (who set it and from which copy) and the recorded refusals leave a trail the person reads on return. The guard stays a mistake filter (adr-42, and the decision of 2026-10-17 on the default branch that keeps the headless approver one, naming the OS fence as the boundary). That fence (spc-2610161751056096) is the boundary only for agents abcd's runner launches, whose writes to abcd's home it confines to their own worktree; it does not fence the person's own interactive session, where the stall happened, so there the narrow grant and the trail are the mitigation. The fallback (the mode grants no push rights, and the person's own standing instruction stays the authority to push) applies instead if the live capture shows that a message relayed from another session can run as a `!` command, or that an agent's tool call can reach the host's shell mode (grounds: plan review round 2, choice (a), and the coordinator's two addenda; the host's interactive-mode page, which says shell mode runs commands directly without going through Claude and outside the sandbox that applies to Claude's commands; the abcd-source-ledger-flip guard entry; adr-2610161621415708)
diff --git a/.abcd/work/decisions/dcn-2610181003463367-a-branch-is-the-session-s-own-only-while.md b/.abcd/work/decisions/dcn-2610181003463367-a-branch-is-the-session-s-own-only-while.md
new file mode 100644
index 0000000000..610fb59002
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610181003463367-a-branch-is-the-session-s-own-only-while.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610181003463367
+slug: a-branch-is-the-session-s-own-only-while
+date: 2026-10-18
+---
+2026-10-18 — A branch is the session's own only while it is live and this copy's, and a branch the session creates is recorded as its own (facilitator-on-delegation, itd-2610180912189125 review round 2, blockers 3 and 5 and choice (a)'s exclusions; refines dcn-2610180936568358): when the guard's pre-tool hook sees this session run `git worktree add -b|-B <b>`, `git switch -c|-C <b>` or `git checkout -b|-B <b>`, it records `<b>` under this copy's key in the away store, under its lock, and only when no branch of that name exists yet, whether or not the person is away, because the stacked drain branches of 2026-10-17 were cut with a plain `git worktree add` before any window and carried no upstream, reflog entry, run state or record id. Stale ownership is bounded: a run's lane counts only while its run's reservation is live under this copy's key, and a finished or abandoned run's lanes never count; a branch owned through the reflog or a recorded creation counts only while it holds a commit authored by this checkout's `user.email` within the last 14 days, or a live reservation under this copy's key links it. Never own: the default branch, a tag, a branch whose open pull request another person authored, and a branch this copy only checked out to review, which the authorship rule leaves out (grounds: plan review round 2, blockers 3 and 5; lanes are cut from the default branch; the 60 run states and the five unlanded lanes of 2026-10-12 in this checkout)
diff --git a/.abcd/work/decisions/dcn-2610181003464379-while-the-person-is-away-a-pull-request.md b/.abcd/work/decisions/dcn-2610181003464379-while-the-person-is-away-a-pull-request.md
new file mode 100644
index 0000000000..f2d5fea567
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610181003464379-while-the-person-is-away-a-pull-request.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610181003464379
+slug: while-the-person-is-away-a-pull-request
+date: 2026-10-18
+---
+2026-10-18 — While the person is away, a pull request is behind when the forge says so (facilitator-on-delegation, itd-2610180912189125 review round 2, blocker 2; refines dcn-2610180936571036): the stop check reads "behind" from the merge state (`mergeStateStatus` BEHIND) in its one pull-request listing, not from the last-fetched default branch, which nothing refreshes overnight, so a pull request that fell behind after the last fetch still reads as owed. Only a branch with no pull request is compared on disk, and the reason names when that ref was last fetched (grounds: plan review round 2, blocker 2; the pinned pull-request fields in internal/ghcontract)
diff --git a/.abcd/work/decisions/dcn-2610181003467233-a-pull-request-carries-a-reservation-s.md b/.abcd/work/decisions/dcn-2610181003467233-a-pull-request-carries-a-reservation-s.md
new file mode 100644
index 0000000000..562b57a389
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610181003467233-a-pull-request-carries-a-reservation-s.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610181003467233
+slug: a-pull-request-carries-a-reservation-s
+date: 2026-10-18
+---
+2026-10-18 — A pull request carries a reservation's work only through its head branch or a closing trailer (facilitator-on-delegation, itd-2610180912189125 review round 2, blocker 4; refines dcn-2610180936568358): the link is the record id in the pull request's head branch name, or on a `Resolves:` or `Delivers:` line of its body, matched on word boundaries so that iss-5 never matches iss-50. A `Refs:` line, which the issue-resolution gate requires of any pull request that only names an issue, carries the work only when the head branch is already this copy's own by another route, and never makes a branch own, so a sibling copy's pull request that mentions the record neither leaves this session waiting nor becomes its branch (grounds: plan review round 2, blocker 4; the RS004 rule in scripts/check-issue-resolution.sh)
diff --git a/.abcd/work/decisions/dcn-2610181003474765-a-window-that-lapsed-with-anything.md b/.abcd/work/decisions/dcn-2610181003474765-a-window-that-lapsed-with-anything.md
new file mode 100644
index 0000000000..4be374bafe
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610181003474765-a-window-that-lapsed-with-anything.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610181003474765
+slug: a-window-that-lapsed-with-anything
+date: 2026-10-18
+---
+2026-10-18 — A window that lapsed with anything unread points the person at abcd mode back (facilitator-on-delegation, itd-2610180912189125 review round 2, blocker 7; refines dcn-2610180937181736): while a record whose end has passed is not yet closed and holds a queued step, a recorded stop or a refused attempt, the prompt hook shows the person one line on every prompt that counts them and names the literal `abcd mode back`, until that verb closes the record; the line shown while away carries the literal `abcd mode back` too, so the person never has to recall the verb (grounds: plan review round 2, blocker 7; dcn-2610180937181929, which kept the queue's print in the slice so that no queued step goes unread)
diff --git a/.abcd/work/decisions/dcn-2610181003477194-the-acts-only-the-person-may-approve-are.md b/.abcd/work/decisions/dcn-2610181003477194-the-acts-only-the-person-may-approve-are.md
new file mode 100644
index 0000000000..4a2b6841fc
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610181003477194-the-acts-only-the-person-may-approve-are.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610181003477194
+slug: the-acts-only-the-person-may-approve-are
+date: 2026-10-18
+---
+2026-10-18 — The acts only the person may approve are completed, end in a catch-all, and are classified by the agent (facilitator-on-delegation, itd-2610180912189125 review round 2, blocker 6; refines dcn-2610180937177502): the list the question reroute queues gains the embargo triage verdict (commands/embargo.md), the drain's hand-back (commands/drain.md), the confirmed apply verb for remote configuration (brief invariant 10), a push or merge beyond the session's own branches (the default branch, a tag, a release cut, another person's pull request, a branch only checked out to review), and a comment or message posted outward other than the session's own pull request, and it ends with any act a command page or a brief invariant names as the person's. A release sign-off is a cut, or a step of one, that asks for the person by name or that no standing instruction of theirs allows; a standing permission for automatic cuts stands, and the away mode adds none. Nothing detects the act mechanically: the agent classifies its own question from the refusal's list, and the guard's existing entries enforce only what they name, a force push and a skipped hook among them (grounds: plan review round 2, blocker 6; commands/embargo.md; commands/drain.md; brief invariant 10)
diff --git a/.abcd/work/decisions/dcn-2610181003484631-abcd-s-count-of-blocks-resets-only-when.md b/.abcd/work/decisions/dcn-2610181003484631-abcd-s-count-of-blocks-resets-only-when.md
new file mode 100644
index 0000000000..6ca7d2c046
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610181003484631-abcd-s-count-of-blocks-resets-only-when.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610181003484631
+slug: abcd-s-count-of-blocks-resets-only-when
+date: 2026-10-18
+---
+2026-10-18 — abcd's count of blocks resets only when the host is not already continuing (facilitator-on-delegation, itd-2610180912189125 review round 2, choice (b); refines dcn-2610180936577720): the count is set to one on a block with `stop_hook_active` false and adds one with it true; a change in the owed set no longer resets it, since the host's count does not, and a reset abcd made on one could leave a stop the host forced unrecorded. A stop recorded at the cap is labelled "possibly forced by the cap", because the host's count also resets on a tool call abcd cannot see, and the live capture checks where the host's count resets (grounds: plan review round 2, choice (b); the host's hooks page on the Stop cap)
diff --git a/.abcd/work/decisions/dcn-2610181003488355-a-stacked-branch-s-clearing-rule.md b/.abcd/work/decisions/dcn-2610181003488355-a-stacked-branch-s-clearing-rule.md
new file mode 100644
index 0000000000..6832c041be
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610181003488355-a-stacked-branch-s-clearing-rule.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610181003488355
+slug: a-stacked-branch-s-clearing-rule
+date: 2026-10-18
+---
+2026-10-18 — A stacked branch's clearing rule includes review and works without abcd's preflight (facilitator-on-delegation, itd-2610180912189125 review round 2, minor findings; refines dcn-2610180936571036): a stacked branch whose base is still open is also owed while a review of its head is outstanding, that is, while the away listing shows the forge's review decision as CHANGES_REQUESTED or, for a run's lane, its run state records no passing review of its head, since the coordination prep's decision that a declared dependency constrains only the landing says its review runs now. Verified means a preflight receipt naming its head where the repository mints receipts (a receipt folder exists in one of its worktrees); in a repository without them, its pull request's checks passing in the away listing; and with no pull request there either, the branch is judged on being behind and on review alone, and the reason says it was not verified (grounds: plan review round 2, minor findings; the receipt lookup in internal/core/landing)
diff --git a/.abcd/work/decisions/dcn-2610181016510153-the-away-mode-grants-no-push-rights-the.md b/.abcd/work/decisions/dcn-2610181016510153-the-away-mode-grants-no-push-rights-the.md
new file mode 100644
index 0000000000..0767b57b82
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610181016510153-the-away-mode-grants-no-push-rights-the.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610181016510153
+slug: the-away-mode-grants-no-push-rights-the
+date: 2026-10-18
+---
+2026-10-18 — The away mode grants no push rights: the person's own standing instruction stays the authority to commit, push, and open or merge a pull request, exactly as before the mode existed (facilitator-on-delegation on the release orchestrator's ruling, itd-2610180912189125 after plan review round 2; supersedes dcn-2610181003456444, round 2's choice (a), and with it the guard entries that made setting the mode the person's act alone). The OS sandbox of spc-2610161751056096 fences only the agents abcd's runner launches, never the person's own interactive sessions, so for the sessions that actually stalled on 2026-10-16 the guard entries would never become a boundary, and their two days would buy a trust claim the plan cannot make. The fallback dcn-2610181003456444 already named is taken now, not on the live capture's evidence. Where the stop check finds owed work that needs a push (an unpushed branch, a reservation whose work no pull request carries, a behind or failing pull request once its local fix is committed), its reason tells the session to push if its standing instruction allows, and otherwise to queue the push with abcd mode queue for the person's return; a queued step that names the item's branch or record id, on word boundaries, hands that item back to the person for the rest of the window (a branch only while it holds commits its upstream lacks, so only the push waits), and the stop check stops naming it. The away mode is never treated as permission. The person-only acts gain pushing, opening or merging a pull request without a standing instruction that allows it. Who sets the mode returns to dcn-2610180913399042: the person, or a session on their word in that session; since the mode grants nothing, a mode set on a relayed word only keeps sessions working and deciding instead of asking, and the person sees who set it, from which working copy, and the literal abcd mode back on their next prompt. Making the mode the person's act alone moves to itd-2610170638184486 as named remaining work: the guard entry refusing an agent's abcd mode autonomous, its other routes (sh -c and script files), the shell-write and file-tool refusals on the away store, the refused attempts recorded and shown, the capture's checks of the person's ! command and of a relayed !, and the guard reading go run ./cmd/abcd and built abcd-<goos>-<arch> binaries as abcd for every entry, the ledger flip included, a security-relevant widening that gets its own review there (grounds: the release orchestrator's ruling of 2026-10-18 and the reviewer's addendum, both recommending the fallback; spc-2610161751056096 and adr-2610161621415708, which fence launched agents only; iss-2610170619247185, whose standing instruction already allowed pushes and auto-merge; the fallback clause of dcn-2610181003456444)
diff --git a/.abcd/work/decisions/dcn-2610181017056307-the-overnight-stall-slice-is-trimmed-to.md b/.abcd/work/decisions/dcn-2610181017056307-the-overnight-stall-slice-is-trimmed-to.md
new file mode 100644
index 0000000000..9108a5e0a1
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610181017056307-the-overnight-stall-slice-is-trimmed-to.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610181017056307
+slug: the-overnight-stall-slice-is-trimmed-to
+date: 2026-10-18
+---
+2026-10-18 — The overnight-stall slice is trimmed to what closes iss-2610170619247185 and nothing else (facilitator-on-delegation on the release orchestrator's ruling, itd-2610180912189125 after plan review round 2; refines dcn-2610180937181929): it keeps (i) a session with owed work cannot end its turn silently, through the Stop hook stop check with the ownership rules, the qualifying wake and the cap handling the reviews required; (ii) questions rerouted by the act, every other question decided with abcd decide and the person-only acts queued; and (iii) the away record set, ended, lapsing after at most seven days, re-injected at start, compaction and every prompt, under its lock. Moved to itd-2610170638184486 as named remaining work: the person-only guard step (dcn-2610181016510153), with the guard's reading of go run ./cmd/abcd and built binaries as abcd; the ten-minute reuse cache of the away forge listing and its stale-cache fallback, so each away check makes at most one listing under its ten-second deadline and a failed read judges from disk naming the pull requests as not read (adr-2610181003541997, still proposed, amended to match); abcd mode back printing more than one plain line per queued step and per recorded stop (any grouping, formatting or window summary); and the refused-attempt lines on the prompt. Kept despite the trim, because a review finding's fix rests on each: the created-branch list recorded in any mode (round-2 blocker 3, the drain's stacked branches, instance 2 of the issue); the Refs rule and word-boundary matching (blocker 4); the stale-ownership bounds (blocker 5); the wake deadline with the host's lateness and the cron cases (blocker 1); the forge's merge state for behind, with the one bounded listing and invariant 7's clause (blocker 2); the person-only acts list (blocker 6); the every-prompt line and the lapsed-window line naming abcd mode back (blocker 7); the block count and its possibly-forced label (round-2 (b)); the clearing rule's review and receipt terms (round-2 minors); the record's lock, ownership checks and seven-day cap (round-1 findings 6 and 7); the recorded ender (round-1 finding 13); the StopFailure record and the prose-question block (round-1 finding 11); and the badge verbs refused while away, which keeps a question from waiting on the person through the badge (dcn-2610180913431493). Re-estimated at 5.75 working days over seven steps, down from eight; about four is not reachable without reopening blockers 1 to 5, since the owed-work reading and the stop verdict with its cron parser carry 3.5 days between them and every rule in them answers a finding; the verdict is pure over the owed set, so two lanes could bring the elapsed time to about four days if the release orchestrator chooses (grounds: the release orchestrator's ruling of 2026-10-18 and the reviewer's addendum listing what stays; the spec's review rounds 1 and 2; AGENTS.md wired or it isn't done)
diff --git a/.abcd/work/decisions/dcn-2610181035355741-a-queued-push-hands-nothing-back-unless.md b/.abcd/work/decisions/dcn-2610181035355741-a-queued-push-hands-nothing-back-unless.md
new file mode 100644
index 0000000000..1f3f3ce784
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610181035355741-a-queued-push-hands-nothing-back-unless.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610181035355741
+slug: a-queued-push-hands-nothing-back-unless
+date: 2026-10-18
+---
+2026-10-18 — A queued push hands nothing back unless the person said pushes wait, and then only the unpushed item of a verified branch (facilitator-on-delegation, itd-2610180912189125 plan review round 3, finding F1; refines dcn-2610181016510153, whose grant of no push rights stands): by default a step queued with abcd mode queue hands nothing back, so the item stays owed and the stop stays blocked; the reason for an item that needs a push says to push if the standing instruction allows and to queue only if the person has said pushes wait, and a session with no instruction to push ends at the host's cap with the stop recorded for the person. A hand-back happens only when the away record carries the person's word that pushes wait, set with abcd mode autonomous --hold-pushes. The flag narrows what sessions do and grants nothing, so set on a relayed word it can at worst make sessions queue pushes they could have sent. Even then a queued step naming an own branch, on word boundaries, removes only that branch's unpushed item, and only while the disk shows the rest clear: its head contains its base's last-fetched tip, and a preflight receipt names the head where the repository mints receipts; where none are minted the clearing rule's equivalent, passing checks in the listing, can name only a pushed commit, so nothing is handed back there. It never removes a pull request that is behind or failing, a stacked branch the clearing rule still owes, a review outstanding, a reservation named by its record id alone, or a renewal, so a behind pull request whose merge is committed locally stays owed with pushes held and ends at the cap, recorded. The stop check records each hand-back in the away record under its lock, abcd mode back prints them, and the every-prompt line counts the queued steps and the handed-back items. TestQueuedPushHandsItemBack covers each case, the no-flag case handing nothing back (grounds: plan review round 3, finding F1, raised by both reviewers: the hand-back as written let a session exempt itself, replaying the first instance of iss-2610170619247185, where a behind pull request stayed behind all night; and it crossed the coordination intent's decisions that a stacked branch is cleared only by its merge and receipt and that a reservation's renewal must not lapse)
diff --git a/.abcd/work/decisions/dcn-2610181035361997-a-qualifying-wake-releases-an-unchanged.md b/.abcd/work/decisions/dcn-2610181035361997-a-qualifying-wake-releases-an-unchanged.md
new file mode 100644
index 0000000000..07d766dcf0
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610181035361997-a-qualifying-wake-releases-an-unchanged.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610181035361997
+slug: a-qualifying-wake-releases-an-unchanged
+date: 2026-10-18
+---
+2026-10-18 — A qualifying wake releases an unchanged set of work the session can do itself at most twice in a row (facilitator-on-delegation, itd-2610180912189125 plan review round 3, finding F2; refines dcn-2610180936577720 and dcn-2610181003455731): while away, a stop whose owed set is unchanged is allowed with a qualifying wake at most twice while any capped item stays unchanged, and the third such stop is blocked naming the next item; the block counts toward the host's cap, whose forced stop is recorded. The capped items are the kinds the session can act on itself: a pull request that is behind or failing, an unpushed branch, a stacked branch the clearing rule still owes, and a reservation whose work no pull request carries, which the review's list did not name but which is the same kind of act as a push. A renewal that is only due, and an item waiting only on the forge, such as checks still running, keep releasing on a qualifying wake. The count compares the capped items alone, so a renewal falling due or done neither resets it nor adds to it, and a change in the capped items resets it; the count and a fingerprint of the capped items are kept in the session's state file in the local tier (.abcd/.work.local/autonomy/sessions/<session-id>.json), and TestWakeReleasesUnchangedSetTwice shows the third consecutive unchanged stop with a wake blocked. Repeated identical recorded stops are kept as one entry with a count and the last time, so a cron that wakes the session every ten minutes cannot grow the away record past its 64 KiB check, which would read as not away (grounds: plan review round 3, finding F2: with a */10 cron set once, each wake found the set unchanged and was allowed, and a behind pull request stayed behind for eleven hours, meeting the intent's falsifier)
diff --git a/.abcd/work/issues/open/iss-2610222021318139-the-away-mode-stop-hook-allows-a-stop.md b/.abcd/work/issues/open/iss-2610222021318139-the-away-mode-stop-hook-allows-a-stop.md
new file mode 100644
index 0000000000..da830e4975
--- /dev/null
+++ b/.abcd/work/issues/open/iss-2610222021318139-the-away-mode-stop-hook-allows-a-stop.md
@@ -0,0 +1,15 @@
+---
+schema_version: 1
+id: "iss-2610222021318139"
+slug: "the-away-mode-stop-hook-allows-a-stop"
+severity: "minor"
+category: "bug"
+source: "impl-review"
+found_during: "abcd-50 review pair of the RootCommit adaptation on PR #1101"
+origin: researcher-authored
+production_mode: hand-written
+found_at: "internal/surface/cli/hook_stop.go"
+remedy: "On a Resolve error that is not ErrNoRootCommit, keep allowing the stop but print one stderr line naming git's failure (and record it in the away record where the store is reachable); fix the comment at hook_stop.go:139 and the matching drop in owedread.go:427."
+---
+
+The away-mode Stop hook allows a stop silently when git does not answer for the repository's root commit. Resolve now returns ErrNoRootAnswer or ErrGitTimedOut (wrapped) instead of ErrNoRootCommit, and hook_stop.go returns nil on any Resolve error under a comment that says the folder is not a checkout abcd can key a store on. On a loaded machine where the rev-list is killed, an away session stops with nothing on stderr and nothing in the away record, though the hook's help says every allowed stop is explained. owedread.go drops the same error the same way, so recorded branches leave the stop check without a note.
diff --git a/.abcd/work/issues/open/iss-2610170619247185-an-autonomous-session-sat-idle-overnight.md b/.abcd/work/issues/resolved/iss-2610170619247185-an-autonomous-session-sat-idle-overnight.md
similarity index 86%
rename from .abcd/work/issues/open/iss-2610170619247185-an-autonomous-session-sat-idle-overnight.md
rename to .abcd/work/issues/resolved/iss-2610170619247185-an-autonomous-session-sat-idle-overnight.md
index 334a358804..35d78c50e7 100644
--- a/.abcd/work/issues/open/iss-2610170619247185-an-autonomous-session-sat-idle-overnight.md
+++ b/.abcd/work/issues/resolved/iss-2610170619247185-an-autonomous-session-sat-idle-overnight.md
@@ -8,9 +8,15 @@ source: "user-observation"
 found_during: "autonomous overnight run 2026-10-16"
 origin: researcher-authored
 production_mode: hand-written
+related_intents: [itd-2610170638184486, itd-2610180912189125]
 found_at: "the agent loop between turns in an autonomous run"
 lapsed_at: "2026-10-16T19:48:14Z"
 remedy: "Make an autonomous run abcd state rather than chat: an 'abcd mode autonomous --until <time>' state per checkout that the prompt and session-start hooks inject (so compaction and peer relays cannot drop it); a Stop hook that, while that state holds, refuses to end a turn that has owed work (its reservations, its behind or failing pull requests, its unpushed branches) and names the next item, bounded by the host's stop_hook_active flag; the question check rerouting a product question in that state to 'abcd decide' with only website-only steps queued for the morning; and idle time per session in 'abcd peers' so a coordinator sees a stall."
+resolution: "Fixed by the away mode (itd-2610180912189125): while the person is marked away, a session that tries to end its turn with work it owns still owed is sent back to it, a waiting session must have a timely wake, questions are routed by the act to a recorded decision or the person's return queue, and the away record is repeated at every start, compaction and prompt so it never lives only in context. Proved by live Claude Code captures recorded in spc-2610180914469489."
+impact: fix
+resolved_by:
+  intent: "itd-2610180912189125"
+  spec: "spc-2610180914469489"
 ---
 
 An agent session told to work autonomously overnight sat idle for about ten of the eleven and a half hours between 20:48 BST on 2026-10-16 and 07:13 BST on 2026-10-17, while it held owed work it could have done alone.
diff --git a/.gitleaksignore b/.gitleaksignore
index 96e74fe3d4..20199338cf 100644
--- a/.gitleaksignore
+++ b/.gitleaksignore
@@ -9,6 +9,12 @@
 # the constant is renamed at the branch tip.
 268da6f4aa61b7ef3cb58a886a3f4c6225009410:internal/core/capture/findingkey_test.go:generic-api-key:17
 
+# Commit 710b9626b added the away mode's created-branch test (itd-2610180912189125)
+# with `testCopyKey = "<32 hex>"`, and generic-api-key reads the `Key = "…"`
+# assignment as a credential. The value is a dummy copy key; the tip builds
+# it at runtime instead.
+710b9626ba07debc4e9c7e3f73eedaf81221b9f2:internal/core/autonomy/branches_test.go:generic-api-key:10
+
 # Commit 2ec0d0370 added a restore-command test constant
 # (iss-2610171250466572), `key = "0123…4567"`, a made-up root-commit object
 # name that keys the worktree store's path, and generic-api-key reads the
diff --git a/commands/guard.md b/commands/guard.md
index 97e9b03634..9c84d67bc2 100644
--- a/commands/guard.md
+++ b/commands/guard.md
@@ -1,6 +1,6 @@
 ---
 name: guard
-description: "Judge a shell command against the hazard registry before it runs: Writes nothing; refuses a hazard through check, hook or approve, and an unknown sub-verb."
+description: "Judge a shell command against the hazard registry before it runs: Writes branch records and a question's mode; refuses a hazard and an unknown sub-verb."
 argument-hint: "[check [--command <command>] | hook | approve --dir <dir>]"
 block: agents
 user-invocable: false
@@ -9,8 +9,11 @@ user-invocable: false
 # `/abcd:guard` shell-hazard check
 
 Decide whether a shell command is safe to run, using abcd's hazard registry —
-the bundled hazard entries merged with this repo's `.abcd/guard.json`. This
-command performs **zero writes**.
+the bundled hazard entries merged with this repo's `.abcd/guard.json`. The
+check performs **zero writes**. The hook writes the record of a branch the
+session creates (below), and refuses nothing for it; when it admits abcd's own
+question where the badge shows, it also writes the waiting-on mode and the
+marker saying a question is open (below).
 
 ## `check` — decide one command
 
@@ -78,6 +81,20 @@ hands it to the agent. A notice the hook printed before it blocked, such as a
 repository guard file that did not load, leads the reason, because the host
 discards the hook's stderr when it exits 0.
 
+Before it judges a shell command, the hook records the branches the command
+creates, for the away mode's reading of which branches are the session's own
+(`/abcd:mode`): `git worktree add -b|-B <b>`, `git switch -c|-C <b>`, `git
+checkout -b|-B <b>` and `git branch <b>`, each only when no branch of that name
+exists yet; a bare `git worktree add <path>`, recorded as the branch git names
+after the folder, and `git worktree add <path> <branch>`; and `git branch
+-m|-M <old> <new>`, which carries a record from the old name to the new. It
+records them whether or not the person is away, under the working copy's key in
+the away store (`~/.abcd.noindex/away/<root-sha>/`), matched by whole name, in a
+list of the hundred most recent. The recorder **refuses nothing**: a store it
+cannot write leaves one stderr line and the command goes on to the check as
+before, and a record made for a command that then fails names a branch that
+does not exist, which the reading ignores.
+
 On the host's question tool the hook checks abcd's own questions instead of
 consulting the registry. A question is abcd's when a header is in abcd's chip
 grammar (a role word, then `Q` and the question's number, such as `Product Q2`)
@@ -125,6 +142,23 @@ warns loudly. So is a payload the hook cannot decode at all: where it names the
 question tool the warning says the question runs, and where no tool name can be
 read the warning names no tool.
 
+While the away mode holds (`/abcd:mode autonomous`), the hook refuses every
+question on the host's question tool whose payload it can decode, before any
+of the checks above, abcd's or another tool's, whatever its chip, with one
+reason, and sets no mode and marks nothing open; a payload it cannot decode
+runs with the loud warning above, away or not. The reason routes the question by the act it asks about: an act
+only the person may approve (an embargo `--approve` digest or triage verdict,
+the drain's hand-back, the remote-configuration apply verb, a release sign-off,
+pushing, opening or merging a pull request without a standing instruction,
+publishing or posting outward, a new dependency, a secret, a credential or an
+App, a website step, a destructive act, spending, or any other act a command
+page or a brief invariant names as the person's) is queued with
+`/abcd:mode queue "<step>"`, and every other question is decided and recorded
+with `/abcd:decide`. Nothing detects the act: the agent classifies its own
+question from the reason's list. An away record that cannot be read safely
+reads as not away, and the hook says so on stderr, with the warning status
+only where it would otherwise admit the question silently.
+
 Anything the adapter cannot turn into a decision — an unreadable payload, a tool
 call that is neither a shell command nor a question, a registry that does not
 load — allows the command and warns loudly. A guard that cannot answer never
diff --git a/commands/mode.md b/commands/mode.md
index 0e56363301..366644d931 100644
--- a/commands/mode.md
+++ b/commands/mode.md
@@ -1,7 +1,7 @@
 ---
 name: mode
 description: "Print or set whose answer the agent loop is waiting on: Writes the state only when setting it; refuses an unknown state or a checkout with no local tier."
-argument-hint: "[managed|facilitator|product-thinker]"
+argument-hint: "[managed|facilitator|product-thinker|autonomous|back|queue]"
 block: agents
 user-invocable: false
 ---
@@ -37,7 +37,9 @@ and it marks the question open. The answer resets the state to `managed`: the
 plugin's hook on the question tool's result resets it when the answer comes
 back, and on a host that does not run that hook the prompt hook resets it on
 the next human message. Either says so once on stderr, so you do not set it
-back yourself.
+back yourself. While the away mode below holds, the guard refuses every
+question instead, whatever its chip, and sets nothing: its reason says which
+acts to queue and that every other question is decided with `abcd decide`.
 
 **The agent, at a stop that is not a question.** When you stop to obtain a
 verdict any other way, such as a hand-off or a step the person runs, record
@@ -65,6 +67,69 @@ named, and nothing is written. The state lives per checkout at
 one the set form refuses (exit 2) and creates nothing — say so, and point at
 `/abcd:ahoy install` if the user wanted this repository managed.
 
+## The away mode — `autonomous`, `queue`, `back`
+
+The person's word that they are away and sessions should work on until they
+are back. It sits beside the badge and is not a fourth word. One record holds
+it for every working copy of the repository on this machine, in
+`~/.abcd.noindex/away/<root-sha>/record.json`, changed under its lock, which
+only `back` goes around when it cannot have it.
+
+**The away mode grants no rights.** The person's own standing instruction
+stays what decides whether a session commits, pushes, or opens or merges a
+pull request, exactly as before. Never read the away mode as permission.
+
+Set it when the person says they are away — they run it themselves, or you
+run it on their word in this session:
+
+```bash
+"${CLAUDE_PLUGIN_ROOT}/abcd" mode autonomous --until 09:00 --json
+```
+
+`--until` takes a clock time (its next occurrence, local time) or a timestamp
+(`2026-10-19T09:00`, or RFC 3339). Without it the mode is open-ended; every
+record ends seven days after it was set at most, and an `--until` past that,
+or one already past, is refused (exit 2) with nothing written. Add
+`--hold-pushes` only when the person says pushes wait for their return: it
+narrows what sessions do and grants nothing. Tell the user the `terms` the
+verb prints. A prompt never ends the mode.
+
+While it holds, an act only the person may approve is queued for their
+return instead of asked, and you carry on with other work:
+
+```bash
+"${CLAUDE_PLUGIN_ROOT}/abcd" mode queue "<step>" --json
+```
+
+A queue with no away record holding is refused (exit 2): ask the person
+instead, the product thinker or the technical facilitator, whichever the
+question is for. While the mode holds, `mode product-thinker` and `mode facilitator`
+are refused too, naming `abcd decide`: decide the question and record it, or
+queue the act.
+
+End it only when the person who was away, the product thinker or the
+technical facilitator, says in this session that they are back:
+
+```bash
+"${CLAUDE_PLUGIN_ROOT}/abcd" mode back
+```
+
+It prints one plain line per queued step, per item handed back and per
+recorded stop (a stop at the host's cap is labelled "possibly forced by the
+cap"), records who ended it and from which working copy, and closes the
+record; on a record whose time has passed it prints the same and closes it.
+Relay every line to the user. A record or lock that is not a regular file this
+account owns that no one else can write, or a record that does not parse, is
+refused by `autonomous` and `queue` (exit 2), naming the file; so is one past
+64 KiB, except that `autonomous` carries a record merely past 64 KiB, letting
+its oldest lines go. `back` ends the mode
+whatever state the record is in: one past 64 KiB is printed whole and kept
+with its oldest lines let go and counted; one that does not parse, or is not
+safely this account's, is replaced by a closed record, printing nothing from
+it; a lock not had in time is gone around. Each is named on its own line:
+relay those too. A queue that is full is refused (exit 2) and never cut: say
+so, and carry on with other work.
+
 ## Where the host has no status surface
 
 The set form prints one line naming whose answer is owed — for example `abcd:
diff --git a/docs/reference/cli/commands.md b/docs/reference/cli/commands.md
index 1db2b5d713..1b3c1bf412 100644
--- a/docs/reference/cli/commands.md
+++ b/docs/reference/cli/commands.md
@@ -1609,7 +1609,7 @@ abcd embark probe ../lifeboat
 
 ### `abcd guard`
 
-Judge a shell command against the hazard registry before it runs: Writes nothing; refuses a hazard through check, hook or approve, and an unknown sub-verb.
+Judge a shell command against the hazard registry before it runs: Writes branch records and a question's mode; refuses a hazard and an unknown sub-verb.
 
 **Usage:** `abcd guard`
 
@@ -1850,7 +1850,7 @@ heredoc (`abcd guard check <<'EOF'` ... `EOF`) passes it through untouched.
 
 #### `abcd guard hook`
 
-Judge the shell command in a host's pre-tool-use payload: Writes nothing; refuses a hazard or a badly built question with the host's deny.
+Judge the shell command in a host's pre-tool-use payload: Writes branch records and a question's mode; refuses a hazard or a badly built question.
 
 **Usage:** `abcd guard hook`
 
@@ -1913,7 +1913,11 @@ product-thinker, Tech and Setup to facilitator), so it is never refused on
 the mode, and the question is marked open in the local tier; the answer
 resets the mode to managed, from `abcd hook question-answered` on the
 question tool's PostToolUse or else on the next human message. A questions
-field the hook cannot read lets the question run and warns loudly.
+field the hook cannot read lets the question run and warns loudly. While
+the away mode holds (`abcd mode autonomous`), every question is refused
+first, whatever its chip, with one reason that routes it by the act it asks
+about: an act only the person may approve to `abcd mode queue`, every other
+question to `abcd decide`; no mode is set and nothing is marked open.
 
 ### `abcd help`
 
@@ -4087,6 +4091,88 @@ all. With --json the notice is a field. Both forms make no network request.
 Exit 2 on a refusal — an unknown state, no local tier, or no checkout —
 and nothing is written on any of them.
 
+The away mode sits beside the badge, not as a fourth word: `abcd mode
+autonomous [--until <time>] [--hold-pushes]` records that the person is away,
+`abcd mode queue "<step>"` keeps a step for their return, and `abcd mode back`
+ends it and prints what was queued and recorded. While it holds, setting
+`product-thinker` or `facilitator` is refused (exit 2), naming `abcd decide`:
+a stop parked on a person who is away is a question nobody answers. The away
+mode grants no rights; the person's standing instruction decides what is pushed.
+
+#### `abcd mode autonomous`
+
+Record that the person is away and sessions work on, until a time or open-ended: Writes the away record; refuses an end already past or past seven days.
+
+**Usage:** `abcd mode autonomous [flags]`
+
+Record that the person is away, for every working copy of this repository on
+this machine: who set it (the holder name reservations resolve without a
+network read, else git's user.name), from which working copy, and when it ends.
+
+--until takes a clock time (its next occurrence, local time, as 09:00) or a
+timestamp (2026-10-19T09:00, or RFC 3339). Without it the mode is open-ended,
+and every record ends seven days after it was set at most: an --until past that,
+or one already past, is refused. --hold-pushes records the person's word that
+pushes wait for their return; it narrows what sessions do and grants nothing.
+
+The away mode grants no rights: the person's own standing instruction decides
+what is committed, pushed, and opened or merged as a pull request. It ends at its
+time or with `abcd mode back`; a prompt never ends it. Setting it again keeps
+whatever is queued or recorded and not yet read.
+
+The record lives in ~/.abcd.noindex/away/<root-sha>/record.json, keyed on the repository's
+root commit, and is changed under its lock, which only `abcd mode back` goes
+around. A record merely past its 64 KiB is carried, its oldest lines let go.
+Exit 2 on a refusal (an unreadable or past --until, one past seven days, no local
+tier, no checkout, or a record or lock that is not safely this account's) with
+nothing written. No network request.
+
+**Flags:**
+
+```
+      --hold-pushes    the person's word that pushes wait for their return (grants nothing)
+      --until string   when the mode ends: a clock time (09:00) or a timestamp; open-ended (seven days at most) when omitted
+```
+
+#### `abcd mode back`
+
+End the away mode, printing what was queued and recorded one line each: Writes its ending whatever the record's or lock's state; refuses outside a git checkout.
+
+**Usage:** `abcd mode back`
+
+End the away mode: print one plain line per queued step, per item handed back
+and per recorded stop (a stop at the host's cap is labelled "possibly forced by
+the cap"), record who ended it and from which working copy, and close the record.
+On a record whose time has already passed it prints the same and closes it. With
+no record, or one already closed, it says there is nothing to end.
+
+A session runs it only on the person's word in that session. It ends the mode
+whatever state the record is in: one past its 64 KiB is printed whole and kept
+with its oldest lines let go and counted; one that does not parse, or is not
+safely this account's, is replaced by a closed record, printing nothing from
+it; and a lock not had in time is gone around. Each is named on its own line.
+No network request.
+
+#### `abcd mode queue`
+
+Queue one step for the person's return while they are away: Writes the away record; refuses when no away record holds.
+
+**Usage:** `abcd mode queue <step>`
+
+Queue one step for the person's return, while the away mode holds: an act only
+the person may approve, which a session queues instead of asking, then carries on
+with other work. `abcd mode back` prints each queued step on one line.
+
+Exit 2 when no away record holds (ask the person instead), on an empty step or one
+over 500 characters, when the queue is full (it is never cut), and when the record
+or its lock is not safely this account's, with nothing written. No network request.
+
+**Example:**
+
+```
+abcd mode queue "approve the embargo close for the example advisory"
+```
+
 ### `abcd peers`
 
 List what sibling worktrees and branches hold that this checkout lacks, and the reservations: Writes the fetched reservations; refuses outside a git checkout.
diff --git a/hooks/hooks.json b/hooks/hooks.json
index 406c3b00ec..f06e0ba9e3 100644
--- a/hooks/hooks.json
+++ b/hooks/hooks.json
@@ -78,6 +78,27 @@
           }
         ]
       }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "timeout": 30,
+            "command": "sh \"${CLAUDE_PLUGIN_ROOT}/hooks/stop.sh\""
+          }
+        ]
+      }
+    ],
+    "StopFailure": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "sh \"${CLAUDE_PLUGIN_ROOT}/hooks/stop-failure.sh\""
+          }
+        ]
+      }
     ]
   }
 }
diff --git a/hooks/stop-failure.sh b/hooks/stop-failure.sh
new file mode 100644
index 0000000000..fe3aa397ac
--- /dev/null
+++ b/hooks/stop-failure.sh
@@ -0,0 +1,4 @@
+#!/bin/sh
+# abcd's StopFailure hook. hooks/hooks.json runs this file with sh, so the host's
+# hook-error line names this short command rather than the whole script.
+r="${CLAUDE_PLUGIN_ROOT:-}"; [ -n "$r" ] || exit 0; z=""; case "${HOME:-}" in /*) if [ -e "$HOME/.abcd" ] || [ -L "$HOME/.abcd" ]; then z=1; fi ;; esac; if [ -n "$z" ]; then if [ -f "$r/abcd" ] && [ -x "$r/abcd" ]; then exec "$r/abcd" hook stop-failure; fi; if [ -e "$HOME/.abcd.noindex" ] || [ -L "$HOME/.abcd.noindex" ]; then printf '%s\n' 'abcd: Both ~/.abcd and ~/.abcd.noindex exist, so abcd has written nothing and moves neither. Keep the one you want, named ~/.abcd.noindex, and take the other out of your home folder, reconnect the working copies kept there with `find ~/.abcd.noindex/worktrees -type d -exec test -e {}/.git \; -prune -exec test -f {}/.git \; -exec git -C {} worktree repair \;` (each `repair: gitdir incorrect` line it prints is a link it fixed), then run abcd again.' >&2; else printf '%s\n' 'abcd: abcd'\''s folder is now ~/.abcd.noindex, a name the Mac'\''s search indexer passes over, and ~/.abcd still stands, so abcd has written nothing. Rename it with `mv ~/.abcd ~/.abcd.noindex`, reconnect the working copies kept there with `find ~/.abcd.noindex/worktrees -type d -exec test -e {}/.git \; -prune -exec test -f {}/.git \; -exec git -C {} worktree repair \;` (each `repair: gitdir incorrect` line it prints is a link it fixed), then run abcd again.' >&2; fi; exit 1; fi; g=""; if [ -f "$r/abcd" ] && [ -x "$r/abcd" ]; then g="$r/abcd"; fi; if [ -z "$g" ]; then c=$(command -v abcd 2>/dev/null); if [ -n "$c" ]; then y=""; case "$c" in /*) dd=${c%/*}; [ -n "$dd" ] || dd=/; d=$(cd -P "$dd" 2>/dev/null && pwd -P); if [ -z "$d" ]; then y="its directory could not be resolved"; else q=$(pwd -P); case "$d/" in "$q"/*) y="it lives inside the working tree" ;; esac; fi; if [ -z "$y" ]; then case "$(/bin/ls -ld "$d" 2>/dev/null)" in ????????w*) y="its directory is world-writable" ;; esac; fi; if [ -z "$y" ]; then case "$(/bin/ls -ldL "$c" 2>/dev/null)" in ????????w*) y="the binary itself is world-writable" ;; esac; fi ;; *) y="it did not resolve to an absolute path" ;; esac; if [ -z "$y" ]; then o=""; w=""; e="${HOME:-}/.abcd.noindex/path-entry"; if [ -n "${HOME:-}" ] && [ -f "$e" ]; then if [ -L "${HOME}/.abcd.noindex" ]; then w=2; elif [ -n "$(find "$e" -maxdepth 0 -type f -user "$(id -un 2>/dev/null)" ! -perm -0020 ! -perm -0002 2>/dev/null)" ]; then while IFS= read -r ln || [ -n "$ln" ]; do case "$ln" in path=*) if [ "${ln#path=}" = "$c" ]; then o=1; fi ;; esac; done < "$e"; else w=1; fi; fi; if [ "$w" = 2 ]; then y="~/.abcd.noindex is a symlink, so its path-entry record is not read (replace the link with a real directory)"; elif [ -n "$w" ]; then y="its ~/.abcd.noindex/path-entry record is not owned by you or is writable by others"; else [ -n "$o" ] || y="~/.abcd.noindex/path-entry does not record it as the abcd installed here"; fi; fi; if [ -n "$y" ]; then p=$(printf '%s' "$c" | tr -d '\000-\037\177'); printf '%s\n' "abcd: ignoring the abcd found on PATH at $p because $y — a hook runs only the abcd recorded in ~/.abcd.noindex/path-entry by the documented install, from an ordinary user directory such as ~/.local/bin that neither the project nor another local user can replace; re-run the install per https://github.com/intentdriven/abcd#install to record it" >&2; else g="$c"; fi; fi; fi; if [ -n "$g" ]; then exec "$g" hook stop-failure; fi; printf '%s\n' "abcd: the plugin binary is missing, so a turn ended on an API error was not recorded — install per https://github.com/intentdriven/abcd#install" >&2; exit 1
diff --git a/hooks/stop.sh b/hooks/stop.sh
new file mode 100644
index 0000000000..a59b3772a3
--- /dev/null
+++ b/hooks/stop.sh
@@ -0,0 +1,4 @@
+#!/bin/sh
+# abcd's Stop hook. hooks/hooks.json runs this file with sh, so the host's
+# hook-error line names this short command rather than the whole script.
+r="${CLAUDE_PLUGIN_ROOT:-}"; [ -n "$r" ] || exit 0; z=""; case "${HOME:-}" in /*) if [ -e "$HOME/.abcd" ] || [ -L "$HOME/.abcd" ]; then z=1; fi ;; esac; if [ -n "$z" ]; then if [ -f "$r/abcd" ] && [ -x "$r/abcd" ]; then exec "$r/abcd" hook stop; fi; if [ -e "$HOME/.abcd.noindex" ] || [ -L "$HOME/.abcd.noindex" ]; then printf '%s\n' 'abcd: Both ~/.abcd and ~/.abcd.noindex exist, so abcd has written nothing and moves neither. Keep the one you want, named ~/.abcd.noindex, and take the other out of your home folder, reconnect the working copies kept there with `find ~/.abcd.noindex/worktrees -type d -exec test -e {}/.git \; -prune -exec test -f {}/.git \; -exec git -C {} worktree repair \;` (each `repair: gitdir incorrect` line it prints is a link it fixed), then run abcd again.' >&2; else printf '%s\n' 'abcd: abcd'\''s folder is now ~/.abcd.noindex, a name the Mac'\''s search indexer passes over, and ~/.abcd still stands, so abcd has written nothing. Rename it with `mv ~/.abcd ~/.abcd.noindex`, reconnect the working copies kept there with `find ~/.abcd.noindex/worktrees -type d -exec test -e {}/.git \; -prune -exec test -f {}/.git \; -exec git -C {} worktree repair \;` (each `repair: gitdir incorrect` line it prints is a link it fixed), then run abcd again.' >&2; fi; exit 1; fi; g=""; if [ -f "$r/abcd" ] && [ -x "$r/abcd" ]; then g="$r/abcd"; fi; if [ -z "$g" ]; then c=$(command -v abcd 2>/dev/null); if [ -n "$c" ]; then y=""; case "$c" in /*) dd=${c%/*}; [ -n "$dd" ] || dd=/; d=$(cd -P "$dd" 2>/dev/null && pwd -P); if [ -z "$d" ]; then y="its directory could not be resolved"; else q=$(pwd -P); case "$d/" in "$q"/*) y="it lives inside the working tree" ;; esac; fi; if [ -z "$y" ]; then case "$(/bin/ls -ld "$d" 2>/dev/null)" in ????????w*) y="its directory is world-writable" ;; esac; fi; if [ -z "$y" ]; then case "$(/bin/ls -ldL "$c" 2>/dev/null)" in ????????w*) y="the binary itself is world-writable" ;; esac; fi ;; *) y="it did not resolve to an absolute path" ;; esac; if [ -z "$y" ]; then o=""; w=""; e="${HOME:-}/.abcd.noindex/path-entry"; if [ -n "${HOME:-}" ] && [ -f "$e" ]; then if [ -L "${HOME}/.abcd.noindex" ]; then w=2; elif [ -n "$(find "$e" -maxdepth 0 -type f -user "$(id -un 2>/dev/null)" ! -perm -0020 ! -perm -0002 2>/dev/null)" ]; then while IFS= read -r ln || [ -n "$ln" ]; do case "$ln" in path=*) if [ "${ln#path=}" = "$c" ]; then o=1; fi ;; esac; done < "$e"; else w=1; fi; fi; if [ "$w" = 2 ]; then y="~/.abcd.noindex is a symlink, so its path-entry record is not read (replace the link with a real directory)"; elif [ -n "$w" ]; then y="its ~/.abcd.noindex/path-entry record is not owned by you or is writable by others"; else [ -n "$o" ] || y="~/.abcd.noindex/path-entry does not record it as the abcd installed here"; fi; fi; if [ -n "$y" ]; then p=$(printf '%s' "$c" | tr -d '\000-\037\177'); printf '%s\n' "abcd: ignoring the abcd found on PATH at $p because $y — a hook runs only the abcd recorded in ~/.abcd.noindex/path-entry by the documented install, from an ordinary user directory such as ~/.local/bin that neither the project nor another local user can replace; re-run the install per https://github.com/intentdriven/abcd#install to record it" >&2; else g="$c"; fi; fi; fi; if [ -n "$g" ]; then exec "$g" hook stop; fi; printf '%s\n' "abcd: the plugin binary is missing, so the away mode's stop check did not run — install per https://github.com/intentdriven/abcd#install" >&2; exit 1
diff --git a/internal/core/autonomy/branches.go b/internal/core/autonomy/branches.go
new file mode 100644
index 0000000000..cf545a4fc0
--- /dev/null
+++ b/internal/core/autonomy/branches.go
@@ -0,0 +1,240 @@
+package autonomy
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"strings"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/core/claim"
+	"github.com/intentdriven/abcd/internal/gitutil"
+)
+
+// MaxCreatedBranches bounds a working copy's created-branch list; past it the
+// oldest record is dropped. A hundred names at git's 255-byte limit stay well
+// within the store's 64 KiB per file (spc-2610180914469489 leaves the bound to
+// the builder).
+const MaxCreatedBranches = 100
+
+// createdSchemaVersion is the created-branch list's shape version.
+const createdSchemaVersion = 1
+
+// createdFile is the store file holding the branches the working copy whose
+// key is copyKey created.
+func createdFile(copyKey string) string { return "branches-" + copyKey + ".json" }
+
+// CreatedBranch is one branch a session in the working copy created, and when
+// it was recorded.
+type CreatedBranch struct {
+	Name string    `json:"name"`
+	At   time.Time `json:"at"`
+}
+
+type createdList struct {
+	SchemaVersion int             `json:"schema_version"`
+	Branches      []CreatedBranch `json:"branches"`
+}
+
+// BranchChangeKind is what a recorded command did to a branch.
+type BranchChangeKind string
+
+const (
+	// BranchCreated is a branch the command creates; RecordCreated keeps it
+	// only when no branch of that name exists yet.
+	BranchCreated BranchChangeKind = "created"
+	// BranchCheckedOut is a branch `git worktree add` checks out in a new
+	// worktree; RecordCreated keeps it when it exists as a branch, or when the
+	// name resolves to nothing at all, so git creates it.
+	BranchCheckedOut BranchChangeKind = "checked-out"
+	// BranchMoved is a rename: a record of From (the current branch of the
+	// command's worktree when "") is carried to Name.
+	BranchMoved BranchChangeKind = "moved"
+)
+
+// BranchChange is one change the created-branch recorder applies.
+type BranchChange struct {
+	Kind BranchChangeKind
+	Name string
+	From string
+}
+
+// CreatedBranches is the created-branch list of the working copy whose key is
+// copyKey, oldest first; empty when none is kept. A list the store's checks
+// refuse, or that does not parse, is ErrUnsafe.
+func (s Store) CreatedBranches(copyKey string) ([]CreatedBranch, error) {
+	raw, err := s.ReadFile(createdFile(copyKey))
+	if errors.Is(err, fs.ErrNotExist) && !errors.Is(err, ErrUnsafe) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	var l createdList
+	if err := json.Unmarshal(raw, &l); err != nil || l.SchemaVersion != createdSchemaVersion {
+		return nil, fmt.Errorf("%w: %s does not parse as a created-branch list", ErrUnsafe, s.Display(createdFile(copyKey)))
+	}
+	return l.Branches, nil
+}
+
+// RecordBranches applies changes, already judged, to the created-branch list
+// of the working copy whose key is copyKey, under the store's lock and with
+// the list re-read inside it: a created or checked-out name is added once, a
+// rename carries the record whose name is From, whole name to whole name, and
+// the list keeps the newest MaxCreatedBranches.
+func (s Store) RecordBranches(copyKey string, changes []BranchChange, now time.Time) error {
+	if len(changes) == 0 {
+		return nil
+	}
+	now = now.Truncate(time.Second)
+	return s.WithLock(func() error {
+		cur, err := s.CreatedBranches(copyKey)
+		if err != nil {
+			return err
+		}
+		next := applyBranchChanges(cur, changes, now)
+		raw, err := json.MarshalIndent(createdList{SchemaVersion: createdSchemaVersion, Branches: next}, "", "  ")
+		if err != nil {
+			return err
+		}
+		return s.WriteFile(createdFile(copyKey), append(raw, '\n'))
+	})
+}
+
+func applyBranchChanges(list []CreatedBranch, changes []BranchChange, now time.Time) []CreatedBranch {
+	index := func(name string) int {
+		for i, b := range list {
+			if b.Name == name {
+				return i
+			}
+		}
+		return -1
+	}
+	for _, c := range changes {
+		switch c.Kind {
+		case BranchCreated, BranchCheckedOut:
+			if c.Name != "" && index(c.Name) < 0 {
+				list = append(list, CreatedBranch{Name: c.Name, At: now})
+			}
+		case BranchMoved:
+			i := index(c.From)
+			if i < 0 || c.Name == "" {
+				continue
+			}
+			if j := index(c.Name); j >= 0 && j != i {
+				list = append(list[:j], list[j+1:]...)
+				i = index(c.From)
+			}
+			list[i].Name = c.Name
+		}
+	}
+	if n := len(list); n > MaxCreatedBranches {
+		list = append([]CreatedBranch(nil), list[n-MaxCreatedBranches:]...)
+	}
+	return list
+}
+
+// RecordCreated is the created-branch recorder the guard's pre-tool hook
+// runs, before the command does, whether or not the person is away: it judges
+// each change against the repository as it stands (a created branch only when
+// no branch of that name exists yet; a checked-out one when it is a branch no
+// worktree has checked out, or names nothing git can resolve) and records
+// what passes under the copy's key (claim.CopyKey, minted as a reservation
+// verb mints it) in the away store. copyRoot is the session's working copy;
+// runDir is where the command runs, whose current branch a rename with no old
+// name renames. A checkout abcd does not manage (Managed), or with no root
+// commit, records nothing and is no error. The error is a store the recorder
+// could not write; it never refuses the command.
+func RecordCreated(copyRoot, runDir string, changes []BranchChange, o Options) error {
+	if len(changes) == 0 {
+		return nil
+	}
+	if !Managed(copyRoot) {
+		return nil
+	}
+	home, err := o.home()
+	if err != nil {
+		return err
+	}
+	st, err := openStore(home, copyRoot)
+	if errors.Is(err, ErrNoRootCommit) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	var keep []BranchChange
+	var checkedOut map[string]bool
+	for _, c := range changes {
+		switch c.Kind {
+		case BranchCreated:
+			if !branchExists(copyRoot, c.Name) {
+				keep = append(keep, c)
+			}
+		case BranchCheckedOut:
+			if checkedOut == nil {
+				checkedOut = worktreeBranches(copyRoot)
+			}
+			// git refuses to check out a branch another worktree has
+			// checked out, and the recorder runs before the command, so
+			// such a name is a peer's branch, not this session's.
+			if checkedOut[c.Name] {
+				continue
+			}
+			if branchExists(copyRoot, c.Name) || !resolves(copyRoot, c.Name) {
+				keep = append(keep, c)
+			}
+		case BranchMoved:
+			if c.From == "" {
+				cur, err := gitutil.Run(runDir, "symbolic-ref", "--quiet", "--short", "HEAD")
+				if err != nil || cur == "" {
+					continue
+				}
+				c.From = cur
+			}
+			keep = append(keep, c)
+		}
+	}
+	if len(keep) == 0 {
+		return nil
+	}
+	key, err := claim.CopyKey(copyRoot)
+	if err != nil {
+		return err
+	}
+	return st.RecordBranches(key, keep, o.now())
+}
+
+// worktreeBranches are the branches the repository's worktrees have checked
+// out, by short name; empty when they cannot be listed.
+func worktreeBranches(root string) map[string]bool {
+	out := map[string]bool{}
+	wts, err := gitutil.ListWorktrees(root, gitutil.MaxWorktreeListing)
+	if err != nil {
+		return out
+	}
+	for _, wt := range wts {
+		if name, ok := strings.CutPrefix(wt.Branch, "refs/heads/"); ok {
+			out[name] = true
+		}
+	}
+	return out
+}
+
+// branchExists reports whether refs/heads/name names a commit in the
+// repository at root.
+func branchExists(root, name string) bool {
+	if name == "" {
+		return false
+	}
+	_, err := gitutil.Run(root, "rev-parse", "--verify", "--quiet", "refs/heads/"+name+"^{commit}")
+	return err == nil
+}
+
+// resolves reports whether name resolves to a commit by any of git's rules
+// (a tag, a remote-tracking ref, an object name).
+func resolves(root, name string) bool {
+	_, err := gitutil.Run(root, "rev-parse", "--verify", "--quiet", "--end-of-options", name+"^{commit}")
+	return err == nil
+}
diff --git a/internal/core/autonomy/branches_test.go b/internal/core/autonomy/branches_test.go
new file mode 100644
index 0000000000..41043600ce
--- /dev/null
+++ b/internal/core/autonomy/branches_test.go
@@ -0,0 +1,103 @@
+package autonomy
+
+import (
+	"fmt"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+// testCopyKey is a copy key's shape, built at runtime so no key-shaped
+// literal sits in source (principles/secret-shaped-fixtures-at-runtime.md).
+var testCopyKey = strings.Repeat("0123456789abcdef", 2)
+
+func testStore(t *testing.T) Store {
+	t.Helper()
+	root, home := managedCopy(t)
+	st, err := openStore(home, root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return st
+}
+
+func names(bs []CreatedBranch) []string {
+	out := make([]string, len(bs))
+	for i, b := range bs {
+		out[i] = b.Name
+	}
+	return out
+}
+
+// TestBranchRecorderUnderLock: recordings racing each other keep every
+// branch, since each re-reads the list inside the store's lock.
+func TestBranchRecorderUnderLock(t *testing.T) {
+	st := testStore(t)
+	now := time.Now()
+	const n = 8
+	var wg sync.WaitGroup
+	errs := make(chan error, n)
+	for i := range n {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			errs <- st.RecordBranches(testCopyKey, []BranchChange{{Kind: BranchCreated, Name: fmt.Sprintf("feat/r%d", i)}}, now)
+		}()
+	}
+	wg.Wait()
+	close(errs)
+	for err := range errs {
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	got, err := st.CreatedBranches(testCopyKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != n {
+		t.Fatalf("racing recordings kept %d branches, want %d: %v", len(got), n, names(got))
+	}
+}
+
+// TestCreatedBranchesCapped: the list keeps at most MaxCreatedBranches, the
+// oldest dropped; a name already kept is not kept twice; a rename carries a
+// record by whole name only; and another copy's key keeps its own list.
+func TestCreatedBranchesCapped(t *testing.T) {
+	st := testStore(t)
+	now := time.Now()
+	for i := range MaxCreatedBranches + 5 {
+		if err := st.RecordBranches(testCopyKey, []BranchChange{{Kind: BranchCreated, Name: fmt.Sprintf("feat/c%03d", i)}}, now.Add(time.Duration(i)*time.Second)); err != nil {
+			t.Fatal(err)
+		}
+	}
+	got, err := st.CreatedBranches(testCopyKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != MaxCreatedBranches || got[0].Name != "feat/c005" {
+		t.Fatalf("the list holds %d, first %q; want %d, first feat/c005", len(got), got[0].Name, MaxCreatedBranches)
+	}
+	if err := st.RecordBranches(testCopyKey, []BranchChange{{Kind: BranchCreated, Name: "feat/c010"}}, now); err != nil {
+		t.Fatal(err)
+	}
+	if got, _ = st.CreatedBranches(testCopyKey); len(got) != MaxCreatedBranches {
+		t.Fatalf("a name already kept was kept again: %d", len(got))
+	}
+	if err := st.RecordBranches(testCopyKey, []BranchChange{{Kind: BranchMoved, From: "feat/c01", Name: "feat/x"}, {Kind: BranchMoved, From: "feat/c011", Name: "feat/c011b"}}, now); err != nil {
+		t.Fatal(err)
+	}
+	got, _ = st.CreatedBranches(testCopyKey)
+	have := map[string]bool{}
+	for _, n := range names(got) {
+		have[n] = true
+	}
+	if have["feat/x"] || !have["feat/c011b"] || have["feat/c011"] {
+		t.Fatalf("a rename must carry a record by its whole name only: %v", names(got))
+	}
+	other, err := st.CreatedBranches("fedcba9876543210fedcba9876543210")
+	if err != nil || len(other) != 0 {
+		t.Fatalf("another copy's list must be its own: %v %v", other, err)
+	}
+}
diff --git a/internal/core/autonomy/cron.go b/internal/core/autonomy/cron.go
new file mode 100644
index 0000000000..726fc70c13
--- /dev/null
+++ b/internal/core/autonomy/cron.go
@@ -0,0 +1,162 @@
+package autonomy
+
+import (
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// ErrCron is a cron expression abcd's parser does not read. Such an
+// expression never qualifies as a wake.
+var ErrCron = errors.New("autonomy: not a five-field cron expression abcd reads")
+
+// Cron is a parsed five-field cron expression: minute, hour, day of month,
+// month and day of week, each a set of the values it matches. It follows
+// vixie cron, as the host says its scheduled tasks do: when both day fields
+// are restricted either matches, and a day field written from `*` (`*/n`
+// included) counts as unrestricted for that rule.
+type Cron struct {
+	minute, hour, dom, month, dow uint64
+	domStar, dowStar              bool
+	// everyFive is exactly `*/5 * * * *`, which the host runs on time.
+	everyFive bool
+}
+
+type cronField struct {
+	lo, hi int
+}
+
+var cronFields = [5]cronField{{0, 59}, {0, 23}, {1, 31}, {1, 12}, {0, 7}}
+
+// parseCron reads a five-field expression: each field a comma list of `*`,
+// `*/n`, `a`, `a-b` or `a-b/n`, in numbers (no names, no `@` forms); day of
+// week takes 0 or 7 for Sunday. Anything else is ErrCron.
+func parseCron(expr string) (Cron, error) {
+	f := strings.Fields(expr)
+	if len(f) != 5 {
+		return Cron{}, fmt.Errorf("%w: %d fields, want 5", ErrCron, len(f))
+	}
+	var sets [5]uint64
+	for i, s := range f {
+		set, err := parseCronField(s, cronFields[i])
+		if err != nil {
+			return Cron{}, fmt.Errorf("%w: field %d: %v", ErrCron, i+1, err)
+		}
+		sets[i] = set
+	}
+	if sets[4]&(1<<7) != 0 {
+		sets[4] = (sets[4] | 1) &^ (1 << 7)
+	}
+	return Cron{
+		minute: sets[0], hour: sets[1], dom: sets[2], month: sets[3], dow: sets[4],
+		domStar:   strings.HasPrefix(f[2], "*"),
+		dowStar:   strings.HasPrefix(f[4], "*"),
+		everyFive: strings.Join(f, " ") == "*/5 * * * *",
+	}, nil
+}
+
+func parseCronField(s string, r cronField) (uint64, error) {
+	var set uint64
+	for _, item := range strings.Split(s, ",") {
+		if item == "" {
+			return 0, errors.New("an empty list item")
+		}
+		rng, stepText, hasStep := strings.Cut(item, "/")
+		step := 1
+		if hasStep {
+			n, err := cronNumber(stepText)
+			if err != nil || n < 1 {
+				return 0, fmt.Errorf("step %q", stepText)
+			}
+			step = n
+		}
+		lo, hi := r.lo, r.hi
+		switch {
+		case rng == "*":
+		case strings.Contains(rng, "-"):
+			a, b, _ := strings.Cut(rng, "-")
+			x, err1 := cronNumber(a)
+			y, err2 := cronNumber(b)
+			if err1 != nil || err2 != nil || x > y {
+				return 0, fmt.Errorf("range %q", rng)
+			}
+			lo, hi = x, y
+		default:
+			if hasStep {
+				return 0, fmt.Errorf("a step on a single value %q", item)
+			}
+			x, err := cronNumber(rng)
+			if err != nil {
+				return 0, fmt.Errorf("value %q", rng)
+			}
+			lo, hi = x, x
+		}
+		if lo < r.lo || hi > r.hi {
+			return 0, fmt.Errorf("%q is outside %d-%d", item, r.lo, r.hi)
+		}
+		for v := lo; v <= hi; v += step {
+			set |= 1 << uint(v)
+		}
+	}
+	return set, nil
+}
+
+func cronNumber(s string) (int, error) {
+	if s == "" || len(s) > 2 {
+		return 0, errors.New("not a number")
+	}
+	for _, c := range s {
+		if c < '0' || c > '9' {
+			return 0, errors.New("not a number")
+		}
+	}
+	return strconv.Atoi(s)
+}
+
+// matches reports whether the wall-clock minute w (in its own location)
+// matches the expression.
+func (c Cron) matches(w time.Time) bool {
+	if c.minute&(1<<uint(w.Minute())) == 0 || c.hour&(1<<uint(w.Hour())) == 0 || c.month&(1<<uint(w.Month())) == 0 {
+		return false
+	}
+	domOK := c.dom&(1<<uint(w.Day())) != 0
+	dowOK := c.dow&(1<<uint(w.Weekday())) != 0
+	if c.domStar || c.dowStar {
+		return domOK && dowOK
+	}
+	return domOK || dowOK
+}
+
+// Next is the first time strictly after from, and no later than until, at
+// which the expression matches, read in loc's wall-clock time (nil means the
+// machine's local time, as the host reads its tasks). It steps minute by
+// minute in absolute time, so a wall-clock minute a daylight-saving change
+// skips never matches, and one it repeats matches only at its first
+// occurrence.
+func (c Cron) Next(from, until time.Time, loc *time.Location) (time.Time, bool) {
+	if loc == nil {
+		loc = time.Local
+	}
+	for t := from.Truncate(time.Minute).Add(time.Minute); !t.After(until); t = t.Add(time.Minute) {
+		w := t.In(loc)
+		if c.matches(w) && !repeatedWallMinute(t, loc) {
+			return t, true
+		}
+	}
+	return time.Time{}, false
+}
+
+// repeatedWallMinute reports whether t's wall-clock minute in loc already
+// happened earlier, as the hour after a fall-back change repeats the one
+// before it.
+func repeatedWallMinute(t time.Time, loc *time.Location) bool {
+	_, now := t.In(loc).Zone()
+	_, before := t.Add(-24 * time.Hour).In(loc).Zone()
+	d := time.Duration(before-now) * time.Second
+	if d <= 0 {
+		return false
+	}
+	return t.Add(-d).In(loc).Format("2006-01-02 15:04") == t.In(loc).Format("2006-01-02 15:04")
+}
diff --git a/internal/core/autonomy/cron_test.go b/internal/core/autonomy/cron_test.go
new file mode 100644
index 0000000000..9521951ff9
--- /dev/null
+++ b/internal/core/autonomy/cron_test.go
@@ -0,0 +1,162 @@
+package autonomy
+
+import (
+	"testing"
+	"time"
+)
+
+// cronNext is the next match of expr strictly after from, searched to until,
+// read in loc.
+func cronNext(t *testing.T, expr string, from, until time.Time, loc *time.Location) (time.Time, bool) {
+	t.Helper()
+	c, err := parseCron(expr)
+	if err != nil {
+		t.Fatalf("parseCron(%q): %v", expr, err)
+	}
+	return c.Next(from, until, loc)
+}
+
+// matchesIn lists the minutes of the day (as "HH:MM") on which expr matches,
+// stepping from the start of day to its end in loc.
+func matchDays(t *testing.T, expr string, from time.Time, days int, loc *time.Location) []string {
+	t.Helper()
+	c, err := parseCron(expr)
+	if err != nil {
+		t.Fatalf("parseCron(%q): %v", expr, err)
+	}
+	var got []string
+	end := from.AddDate(0, 0, days)
+	for cur := from; ; {
+		n, ok := c.Next(cur, end, loc)
+		if !ok {
+			break
+		}
+		got = append(got, n.In(loc).Format("2006-01-02 Mon 15:04"))
+		cur = n
+	}
+	return got
+}
+
+// TestCronNextFire: lists, ranges, steps and both day fields give the next
+// fire time; an expression it cannot parse never qualifies.
+func TestCronNextFire(t *testing.T) {
+	loc := london(t)
+	now := at(t, "2026-10-18 21:07") // a Sunday
+	for _, c := range []struct {
+		expr string
+		want string
+	}{
+		{"*/10 * * * *", "2026-10-18 21:10"},
+		{"0 9 * * 1-5", "2026-10-19 09:00"},
+		{"15,45 * * * *", "2026-10-18 21:15"},
+		{"0 22-23 * * *", "2026-10-18 22:00"},
+		{"0 0 1 * *", "2026-11-01 00:00"},
+		{"30 6 * 11 *", "2026-11-01 06:30"},
+		{"0 7 19 * 3", "2026-10-19 07:00"}, // the 19th (a Monday) or a Wednesday: the 19th first
+		{"0 7 25 * 3", "2026-10-21 07:00"}, // the 25th or a Wednesday: Wednesday the 21st first
+		{"8 21 * * *", "2026-10-18 21:08"},
+		{"7 21 * * *", "2026-10-19 21:07"}, // strictly after now
+	} {
+		got, ok := cronNext(t, c.expr, now, now.AddDate(0, 1, 0), loc)
+		if !ok {
+			t.Errorf("%q: no match", c.expr)
+			continue
+		}
+		if s := got.In(loc).Format("2006-01-02 15:04"); s != c.want {
+			t.Errorf("%q: next %s, want %s", c.expr, s, c.want)
+		}
+	}
+	for _, bad := range []string{"", "* * * *", "* * * * * *", "60 * * * *", "* 24 * * *", "* * 0 * *", "* * * 13 *",
+		"* * * * 8", "a * * * *", "*/0 * * * *", "5-1 * * * *", "1,,2 * * * *", "0 9 * * MON", "@daily", "-1 * * * *"} {
+		if _, err := parseCron(bad); err == nil {
+			t.Errorf("parseCron(%q) parsed; want refused", bad)
+		}
+		if _, _, ok := latestFire(SessionCron{Schedule: bad, Recurring: true}, now, now.Add(time.Hour), loc); ok {
+			t.Errorf("an unparsable %q gave a fire time", bad)
+		}
+	}
+}
+
+// TestCronDayOfWeekSeven: 7 matches Sunday as 0 does.
+func TestCronDayOfWeekSeven(t *testing.T) {
+	loc := london(t)
+	from := at(t, "2026-10-12 00:00") // a Monday
+	for _, expr := range []string{"0 9 * * 7", "0 9 * * 0", "0 9 * * 6-7"} {
+		got := matchDays(t, expr, from, 7, loc)
+		found := false
+		for _, g := range got {
+			if g == "2026-10-18 Sun 09:00" {
+				found = true
+			}
+		}
+		if !found {
+			t.Errorf("%q does not match Sunday: %v", expr, got)
+		}
+	}
+	if got := matchDays(t, "0 9 * * 7", from, 7, loc); len(got) != 1 {
+		t.Errorf("0 9 * * 7 matched %v, want Sunday alone", got)
+	}
+}
+
+// TestCronRangeStep: 10-50/20 matches minutes 10, 30 and 50.
+func TestCronRangeStep(t *testing.T) {
+	loc := london(t)
+	from := at(t, "2026-10-18 20:59")
+	got := matchDays(t, "10-50/20 21 18 10 *", from, 1, loc)
+	want := []string{"2026-10-18 Sun 21:10", "2026-10-18 Sun 21:30", "2026-10-18 Sun 21:50"}
+	if len(got) != len(want) {
+		t.Fatalf("10-50/20 matched %v, want %v", got, want)
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("10-50/20 matched %v, want %v", got, want)
+		}
+	}
+}
+
+// TestCronStarStepInDayField: `0 9 */2 * 1` matches only days both
+// odd-numbered and Monday, since a field written from `*` counts as
+// unrestricted; `0 9 1 * 1` matches either.
+func TestCronStarStepInDayField(t *testing.T) {
+	loc := london(t)
+	from := at(t, "2026-10-31 23:00")
+	got := matchDays(t, "0 9 */2 * 1", from, 30, loc)
+	for _, g := range got {
+		d, _ := time.ParseInLocation("2006-01-02 Mon 15:04", g, loc)
+		if d.Weekday() != time.Monday || d.Day()%2 != 1 {
+			t.Errorf("0 9 */2 * 1 matched %s, which is not an odd-numbered Monday", g)
+		}
+	}
+	// November 2026: Mondays 2, 9, 16, 23, 30; the odd ones are the 9th and 23rd.
+	if len(got) != 2 || got[0] != "2026-11-09 Mon 09:00" || got[1] != "2026-11-23 Mon 09:00" {
+		t.Errorf("0 9 */2 * 1 matched %v, want the 9th and the 23rd", got)
+	}
+	either := matchDays(t, "0 9 1 * 1", from, 30, loc)
+	// The 1st (a Sunday) and every Monday: 1, 2, 9, 16, 23, 30.
+	if len(either) != 6 || either[0] != "2026-11-01 Sun 09:00" {
+		t.Errorf("0 9 1 * 1 matched %v, want the 1st and every Monday", either)
+	}
+}
+
+// TestCronDaylightSaving: in Europe/London, `30 1 * * *` has no match on the
+// spring-forward day and matches once, at its first occurrence, on the
+// fall-back day.
+func TestCronDaylightSaving(t *testing.T) {
+	loc := london(t)
+	spring := time.Date(2026, 3, 29, 0, 0, 0, 0, loc)
+	if got, ok := cronNext(t, "30 1 * * *", spring, spring.Add(23*time.Hour), loc); ok {
+		t.Errorf("spring-forward day: 30 1 * * * matched at %s, a minute that never happens", got)
+	}
+	fall := time.Date(2026, 10, 25, 0, 0, 0, 0, loc)
+	end := fall.Add(24 * time.Hour)
+	first, ok := cronNext(t, "30 1 * * *", fall, end, loc)
+	if !ok {
+		t.Fatal("fall-back day: no match")
+	}
+	if _, off := first.In(loc).Zone(); off != 3600 {
+		t.Errorf("fall-back day: matched %s, want the first occurrence (BST)", first.In(loc).Format(time.RFC3339))
+	}
+	if again, ok := cronNext(t, "30 1 * * *", first, end, loc); ok {
+		t.Errorf("fall-back day: matched again at %s; the repeated minute matches once", again.In(loc).Format(time.RFC3339))
+	}
+}
diff --git a/internal/core/autonomy/doc.go b/internal/core/autonomy/doc.go
new file mode 100644
index 0000000000..e1d4081a2f
--- /dev/null
+++ b/internal/core/autonomy/doc.go
@@ -0,0 +1,188 @@
+// Package autonomy is the away mode: the person's word that they are away and
+// sessions should work on, held once per repository on the machine, and the
+// shapes the stop check reads (itd-2610180912189125, spc-2610180914469489).
+//
+// It is a library: it returns values and errors, and never prints. The front
+// doors (`abcd mode autonomous|back|queue`, and later the hooks) format what it
+// returns.
+//
+// # The away store
+//
+// One folder per repository, keyed on the repository's root commit as the
+// worktree store is, below abcd's home: `away/<root-sha>/` (Store.Dir,
+// Store.Rel). Every working copy of the repository reads the same folder. It
+// holds:
+//
+//   - record.json (RecordFile, Store.RecordPath): the Record;
+//   - lock (LockFile, Store.LockPath): the one lock every read-modify-write in
+//     the folder holds, the record's and any sibling file's alike;
+//   - sibling files other parts of the slice add (a working copy's created
+//     branches, a session's start copy), read and written through
+//     Store.ReadFile and Store.WriteFile inside Store.WithLock.
+//
+// Every file in it is used only when it is a regular file this account owns
+// that no one else can write, within MaxFileBytes (64 KiB), and only through
+// folders no one else can change: the checks a user-layer rules.json gets.
+// A file failing them is ErrUnsafe, naming the file. Writes go through
+// fsutil's atomic writer.
+//
+// # The lock
+//
+// Store.WithLock holds fsutil.WithFileLock on the lock file for at most
+// LockTimeout (two seconds); past it the call returns ErrLockBusy. Store.Update
+// re-reads the record inside the lock, hands it to the caller's function, and
+// writes what that returns, so two writers never lose an update and a check
+// that read the record before a slow forge listing never writes away back
+// after `abcd mode back` (Store.RecordStop records only while the re-read
+// record still holds).
+//
+// # Failing open
+//
+// Store.Away is the hooks' read: an unreadable or unsafe record (or lock)
+// reads as not away, with the reason returned for a stderr line. A verb asked
+// to change such a record refuses, naming the file, except Back: ending the
+// mode never depends on the record (end.go). A record past its bound is
+// printed whole and kept fitted (Record.Fit); one that does not parse, names
+// another schema or is not safely this account's is replaced by a closed
+// record, printing nothing from it; parts of the wrong shape are left out;
+// and a lock not had within LockTimeout, or not safe to take, is gone
+// around, the atomic write re-checked. BackResult.Notes names each.
+//
+// # Record
+//
+// Record is the away record. Its fields, as written to record.json:
+//
+//	schema_version  1
+//	set_by          who set it (Who.Name): the holder name reservations
+//	                resolve without a network read, else git's user.name
+//	set_from        the working copy it was set from (Who.Copy, its root)
+//	start, until    when it was set and when it ends
+//	open_ended      set without --until (until is then start plus MaxWindow)
+//	hold_pushes     the person said pushes wait (--hold-pushes); it narrows
+//	                and grants nothing
+//	queue           []QueuedStep: steps for the person (`abcd mode queue`)
+//	handed_back     []HandBack: items the stop check handed back, by branch
+//	                and head, once each
+//	stops           []Stop: the stops recorded, a stop identical to one
+//	                already recorded, anywhere, kept as that entry with a
+//	                count and the last time
+//	dropped_*       what was let go to stay within MaxFileBytes, counted:
+//	                the oldest stops and hand-backs past their own bounds,
+//	                and queued steps only when SetAway carries, or Back
+//	                closes, a record past its bound; a queue past its bound
+//	                refuses the next step (ErrQueueFull) instead
+//	closed          *Closing: once ended by word, who ended it and from
+//	                which copy
+//
+// A record holds (Record.Holds) while it is not closed and now is before
+// Record.Ends, which is never more than MaxWindow (seven days) after its
+// start, whatever is stored. Past its end and not yet closed it is lapsed
+// (Record.Lapsed). A human prompt never ends it.
+//
+// # Owed
+//
+// Owed is the stop check's input: the owed items, each an OwedItem with its
+// OwedKind, whether it is capped (an item the session can act on itself, which
+// a wake releases at most twice in a row), and its branch or record id (plus
+// its pull request and head where it has them). The kinds, in the order the
+// next item is chosen (owedKinds): a renewal due, a failing pull request, a
+// behind one, a stacked branch, an unpushed branch, and a reservation whose
+// work no pull request carries. Owed.Fingerprint and Owed.CappedFingerprint
+// compare two owed sets item by item, ignoring order and reasons.
+// Owed.NextRenewal is the earliest renewal due among the live reservations
+// under this copy's key (zero when none), Owed.WakeBy the latest a wake may
+// fire for them (a renewal not yet due, or the lapse of one already due, so
+// a renewal only due keeps releasing on a wake), and Owed.HandedBack the items a
+// queued step handed back, which the verdict accepts only under
+// --hold-pushes and only for an unpushed branch's item with its head.
+//
+// # The stop verdict
+//
+// Judge(record, owed, input, session, now) is the stop check's verdict, pure:
+// present, it allows (with a SystemMessage naming owed work); away, the seven
+// rows of the plan decide, from the owed set, the host's payload (StopInput:
+// stop_hook_active, the last message, session_crons, background_tasks, the
+// host's cap) and the session's SessionState. A wake qualifies
+// (qualifyingWake) when a session cron's latest fire time (latestFire: its
+// next match, by abcd's own five-field cron parser, parseCron, plus the
+// host's lateness) is no later than wakeDeadline. The session's state lives in
+// the copy's local tier (SessionsDir, LoadSession, SaveSession), keyed by a
+// session id ValidSessionID accepts. The session-start hook notes each
+// session's start copy in the store (Store.NoteSessionCopy); ResolveCopy
+// reads it back.
+//
+// # The created-branch list
+//
+// The guard's pre-tool hook records the branches a session creates
+// (spc-2610180914469489 step 3) through RecordCreated(copyRoot, runDir,
+// changes, Options), whether or not the person is away: a BranchCreated name
+// only when no branch of that name exists yet, a BranchCheckedOut one (`git
+// worktree add <path> [<branch>]`) when it is a branch no worktree has
+// checked out (git refuses that command, which runs after the recorder) or
+// names nothing git resolves, and a BranchMoved rename carrying a record by whole name. The list
+// is createdFile(copyKey) in the away store, keyed on the working copy's
+// reservation copy key (claim.CopyKey), written under the store's lock
+// (Store.RecordBranches) and capped at MaxCreatedBranches, the oldest
+// dropped; Store.CreatedBranches reads it. A checkout abcd does not manage
+// (Managed: no `.abcd/` at its root, nor at its main worktree's) records
+// nothing, and every away hook returns at once there.
+//
+// # Reading the owed work
+//
+// ReadOwed is the stop check's one seam onto owed work:
+//
+//	func ReadOwed(ctx context.Context, o ReadOptions) (Owed, error)
+//
+// o.Root is the session's working copy and o.Record the away record as the
+// check read it. While o.Record does not hold at o.Now the person is present
+// and ReadOwed reads disk only: renewals due and unpushed own branches, with
+// no forge call. While it holds, ReadOwed adds one `gh pr list` of the open
+// pull requests (o.Forge, landing.GHContext by default) under ForgeDeadline
+// (ten seconds, o.ForgeDeadline in a test), for failing, behind (the forge's
+// merge state: BEHIND, and DIRTY as behind; UNKNOWN is a note), stacked and
+// uncarried work. A listing that fails or is late is a note, and the check
+// judges from disk alone: a pushed branch is compared with the last-fetched
+// default branch, naming the fetch, and no reservation is reported uncarried
+// (adr-2610181003541997).
+//
+// A branch is the session's own when this copy's HEAD reflog has checked it
+// out or the copy's created-branch list holds it, either only while it holds
+// a commit of this checkout's author email made within StaleWindow (14 days)
+// or a live reservation under this copy's key links it; when it is a lane of
+// an unfinished run in this copy's local tier whose reservation is live under
+// this copy's key; or when it heads an open pull request of the person's that
+// a live reservation under this copy's key links. Never the default branch,
+// nor a branch whose open pull request another person authored. A pull
+// request carries a reservation's work when the record id is in its head
+// branch's name or on a Resolves: or Delivers: line of its body, on word
+// boundaries; a Refs: line carries it only for a head already own.
+//
+// A stacked branch (its pull request's base is not the default branch, or,
+// with none, its nearest own ancestor branch is not in the default branch) is
+// owed by the clearing rule alone: while it is behind its base, failing, has a
+// review outstanding (CHANGES_REQUESTED, or a run lane with no passing review
+// of its head) or is not verified (a preflight receipt naming its head where
+// the repository mints receipts, else passing checks); an item whose only
+// unmet condition is checks still running is not capped. With --hold-pushes,
+// an unpushed own branch a queued step names as a whole name, whose head
+// contains its base's last-fetched tip and has a receipt, is handed back:
+// moved out of Owed.Items into Owed.HandedBack. ReadOwed records nothing:
+// the verdict accepts the hand-back (Verdict.HandBacks) and the stop hook
+// records it, once per branch and head (Store.RecordHandBack), so a
+// hand-back has one owner. Owed.NextRenewal is filled present or away. The
+// items come sorted by owedKinds' order. The
+// error is a root that is not a working copy; anything else ReadOwed could
+// not read is a note in Owed.Notes.
+//
+// Every git call ReadOwed makes is bound to ctx, and the stack-base search
+// reads each own branch's reflog once a check and walks each branch's own
+// history once, so its cost grows with the branches, not their pairs. A
+// context that ends before everything is read stops the reading where it
+// is: Owed.Incomplete is set, a note says what was not read, and Judge
+// allows the stop with a line naming it, recording a StopCheckIncomplete
+// while away. A branch with no upstream and no commit in any remote branch
+// is owed only when merging it into the last-fetched default branch would
+// change it; one squash- or rebase-merged already is not, and one that
+// cannot be told is a note. A listing at its limit of 200 may be truncated:
+// a note says so, and no reservation is reported uncarried from it.
+package autonomy
diff --git a/internal/core/autonomy/end.go b/internal/core/autonomy/end.go
new file mode 100644
index 0000000000..75cd02cb1a
--- /dev/null
+++ b/internal/core/autonomy/end.go
@@ -0,0 +1,171 @@
+package autonomy
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/fsutil"
+)
+
+// end.go — ending the away mode whatever state its record is in (the diff
+// review's major 3, spc-2610180914469489 "Diff review round 1"): a record
+// past its bound, partly or wholly unparsable, not safely this account's, or
+// behind a lock held past its timeout never keeps the person from ending
+// the mode. Setting the mode again carries a record past its bound too.
+
+// lenientCap bounds the lenient read: far past MaxFileBytes, so a record a
+// harness or an older build left over its bound is still read and closed.
+const lenientCap = 4 << 20
+
+// lenientRead is the record as far as it could be read, and notes saying
+// what could not.
+type lenientRead struct {
+	rec *Record
+	// unreadable is a file that stands there but yielded no record to trust:
+	// it does not parse, names another schema, is past lenientCap, or is not
+	// safely this account's. Nothing from it is printed.
+	unreadable bool
+	// partial is a record that parsed with parts of it of the wrong shape,
+	// which were left out.
+	partial bool
+	notes   []string
+}
+
+// readLenient reads the record as Back needs it: whatever can be trusted,
+// with a note for everything else. Only an absent record reads as none.
+func (s Store) readLenient() lenientRead {
+	name := s.Display(RecordFile)
+	raw, refusal, err := fsutil.ReadHomeDeclaration(s.home, s.Rel()+"/"+RecordFile, lenientCap)
+	switch {
+	case refusal == fsutil.DeclarationAbsent && errors.Is(err, fs.ErrNotExist):
+		return lenientRead{}
+	case refusal == fsutil.DeclarationOK:
+	case refusal == fsutil.DeclarationAbsent || refusal == fsutil.DeclarationUnreadable:
+		return lenientRead{unreadable: true, notes: []string{fmt.Sprintf("%s could not be read (%s), so nothing from it is printed", name, refusalWords(refusal, err))}}
+	default:
+		return lenientRead{unreadable: true, notes: []string{fmt.Sprintf("%s is not safely this account's (it %s), so nothing from it is printed", name, refusalWords(refusal, err))}}
+	}
+	var r Record
+	err = json.Unmarshal(raw, &r)
+	var typeErr *json.UnmarshalTypeError
+	out := lenientRead{rec: &r}
+	switch {
+	case errors.As(err, &typeErr):
+		out.partial = true
+		out.notes = append(out.notes, fmt.Sprintf("parts of %s could not be read (the field %q is not of its shape) and are left out", name, typeErr.Field))
+	case err != nil:
+		return lenientRead{unreadable: true, notes: []string{fmt.Sprintf("%s could not be read (it does not parse), so nothing from it is printed", name)}}
+	}
+	if r.SchemaVersion != SchemaVersion {
+		return lenientRead{unreadable: true, notes: []string{fmt.Sprintf("%s could not be read (schema_version %d, this abcd reads %d), so nothing from it is printed", name, r.SchemaVersion, SchemaVersion)}}
+	}
+	if len(raw) > MaxFileBytes {
+		out.notes = append(out.notes, fmt.Sprintf("%s held %d bytes, past its %d KiB; every line is printed, and the oldest are let go from the record kept", name, len(raw), MaxFileBytes>>10))
+	}
+	return out
+}
+
+// closedStub is the least closed record that ends the mode: prev's who,
+// from where and window when prev is known, and the closing.
+func closedStub(prev *Record, who Who, now time.Time) *Record {
+	r := &Record{SchemaVersion: SchemaVersion, Start: now.Truncate(time.Second), Until: now.Truncate(time.Second)}
+	if prev != nil {
+		r.SetBy, r.SetFrom, r.Start, r.Until, r.OpenEnded, r.HoldPushes = prev.SetBy, prev.SetFrom, prev.Start, prev.Until, prev.OpenEnded, prev.HoldPushes
+	}
+	r.Close(who, now)
+	return r
+}
+
+func (s Store) writeRecord(r *Record) error {
+	raw, err := json.MarshalIndent(r, "", "  ")
+	if err != nil {
+		return err
+	}
+	return s.WriteFile(RecordFile, append(raw, '\n'))
+}
+
+// endRecord is Back's work on the record, under the lock or, when the lock
+// cannot be had, without it: it prints what can be read, closes, fits and
+// writes; a record it cannot write whole, or cannot read at all, is replaced
+// by a closed stub.
+func (s Store) endRecord(res *BackResult, who Who, now time.Time) (*Record, error) {
+	lr := s.readLenient()
+	res.Notes = append(res.Notes, lr.notes...)
+	if lr.unreadable {
+		res.State = "unreadable"
+		stub := closedStub(nil, who, now)
+		if err := s.writeRecord(stub); err != nil {
+			return nil, err
+		}
+		res.Notes = append(res.Notes, "it was replaced with a closed record")
+		return stub, nil
+	}
+	cur := lr.rec
+	if cur == nil || cur.Closed != nil {
+		res.State = "none"
+		return cur, nil
+	}
+	res.State = "lapsed"
+	if cur.Holds(now) {
+		res.State = "away"
+	}
+	res.Lines = cur.Lines()
+	cur.Close(who, now)
+	cur.Fit()
+	if err := s.writeRecord(cur); err != nil {
+		stub := closedStub(cur, who, now)
+		if err2 := s.writeRecord(stub); err2 != nil {
+			return nil, err
+		}
+		res.Notes = append(res.Notes, fmt.Sprintf("the closed record could not be written whole (%s); a closed record without its lines was written instead", err))
+		return stub, nil
+	}
+	return cur, nil
+}
+
+// endUnlocked is endRecord for a lock that could not be had: the write is
+// atomic, and a writer that held the lock and wrote after it is caught by
+// re-reading and closing again, a few times.
+func (s Store) endUnlocked(res *BackResult, who Who, now time.Time) (*Record, error) {
+	var rec *Record
+	var err error
+	for try := 0; try < 3; try++ {
+		*res = BackResult{State: res.State, Lines: res.Lines, Notes: res.Notes}
+		if try > 0 {
+			time.Sleep(100 * time.Millisecond)
+		}
+		first := try == 0
+		var r BackResult
+		rec, err = s.endRecord(&r, who, now)
+		if err != nil {
+			return nil, err
+		}
+		if first {
+			*res = BackResult{State: r.State, Lines: r.Lines, Notes: append(res.Notes, r.Notes...)}
+		}
+		time.Sleep(50 * time.Millisecond)
+		if again := s.readLenient(); again.unreadable || again.rec == nil || again.rec.Closed != nil {
+			return rec, nil
+		}
+	}
+	return rec, nil
+}
+
+// carryRead is SetAway's read under the lock: a record past its bound is
+// carried (begin fits it); one that is unreadable, partial or not safely
+// this account's is refused, naming the file, for `abcd mode back` to end.
+func (s Store) carryRead() (*Record, error) {
+	lr := s.readLenient()
+	if lr.unreadable || lr.partial {
+		return nil, fmt.Errorf("%w: %s; `abcd mode back` ends it", ErrUnsafe, lr.notes[0])
+	}
+	if lr.rec != nil {
+		if err := s.vetLock(); err != nil {
+			return nil, err
+		}
+	}
+	return lr.rec, nil
+}
diff --git a/internal/core/autonomy/forge.go b/internal/core/autonomy/forge.go
new file mode 100644
index 0000000000..0c2383b661
--- /dev/null
+++ b/internal/core/autonomy/forge.go
@@ -0,0 +1,163 @@
+package autonomy
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/core/landing"
+	"github.com/intentdriven/abcd/internal/fsutil"
+	"github.com/intentdriven/abcd/internal/gitutil"
+	"github.com/intentdriven/abcd/internal/termsafe"
+)
+
+// ForgeDeadline bounds the away check's one pull-request listing
+// (adr-2610181003541997): past it the check judges from disk alone.
+const ForgeDeadline = 10 * time.Second
+
+// prListLimit is how many open pull requests the listing asks for.
+const prListLimit = 200
+
+// prListFields are the fields the listing reads, each among those
+// internal/ghcontract pins for `gh pr list --json`.
+var prListFields = []string{
+	"number", "headRefName", "headRefOid", "baseRefName", "author", "body",
+	"mergeStateStatus", "reviewDecision", "statusCheckRollup", "isCrossRepository",
+}
+
+// Forge runs the forge client (`gh`) with args from dir, bound to ctx, and
+// returns its stdout: landing.GHContext, or a test's fake.
+type Forge func(ctx context.Context, dir string, args ...string) (string, error)
+
+// pullRequest is one open pull request as the listing reads it.
+type pullRequest struct {
+	Number            int    `json:"number"`
+	HeadRefName       string `json:"headRefName"`
+	HeadRefOid        string `json:"headRefOid"`
+	BaseRefName       string `json:"baseRefName"`
+	Body              string `json:"body"`
+	MergeStateStatus  string `json:"mergeStateStatus"`
+	ReviewDecision    string `json:"reviewDecision"`
+	IsCrossRepository bool   `json:"isCrossRepository"`
+	Author            struct {
+		Login string `json:"login"`
+	} `json:"author"`
+	StatusCheckRollup []checkEntry `json:"statusCheckRollup"`
+}
+
+// checkEntry is one entry of a check rollup: a check run (status and
+// conclusion) or a commit status (state).
+type checkEntry struct {
+	Status     string `json:"status"`
+	Conclusion string `json:"conclusion"`
+	State      string `json:"state"`
+}
+
+// checksState is what a pull request's checks say as a whole.
+type checksState int
+
+const (
+	checksNone checksState = iota
+	checksPassing
+	checksPending
+	checksFailing
+)
+
+// checks reads the rollup: failing when any entry failed, else pending when
+// any has not finished, else passing when there is any entry at all.
+func (p pullRequest) checks() checksState {
+	if len(p.StatusCheckRollup) == 0 {
+		return checksNone
+	}
+	pending := false
+	for _, c := range p.StatusCheckRollup {
+		switch strings.ToUpper(c.Conclusion) {
+		case "FAILURE", "CANCELLED", "TIMED_OUT", "ACTION_REQUIRED", "STARTUP_FAILURE":
+			return checksFailing
+		}
+		switch strings.ToUpper(c.State) {
+		case "FAILURE", "ERROR":
+			return checksFailing
+		case "PENDING", "EXPECTED":
+			pending = true
+		}
+		if c.Status != "" && !strings.EqualFold(c.Status, "COMPLETED") {
+			pending = true
+		}
+	}
+	if pending {
+		return checksPending
+	}
+	return checksPassing
+}
+
+// listing is the one forge read of a check: the open pull requests, or why
+// they were not read.
+type listing struct {
+	read   bool
+	unread string
+	prs    []pullRequest
+	// mine is whether every listed pull request is the person's (a listing
+	// by `--author @me`, made when the person's forge name is not known).
+	mine bool
+	// truncated is a listing that returned exactly prListLimit pull
+	// requests, so more may be open than it shows: a pull request it does
+	// not show is unknown, never absent.
+	truncated bool
+}
+
+// listOpen makes the listing under deadline: every open pull request when the
+// person's forge name is known, so another person's can be told apart, else
+// only theirs (`--author @me`).
+func listOpen(ctx context.Context, forge Forge, dir, person string, deadline time.Duration) listing {
+	ctx, cancel := context.WithTimeout(ctx, deadline)
+	defer cancel()
+	args := []string{"pr", "list", "--state", "open", "--limit", strconv.Itoa(prListLimit), "--json", strings.Join(prListFields, ",")}
+	mine := person == ""
+	if mine {
+		args = append(args, "--author", "@me")
+	}
+	out, err := forge(ctx, dir, args...)
+	switch {
+	case err != nil && (ctx.Err() != nil || errors.Is(err, context.DeadlineExceeded)):
+		return listing{unread: fmt.Sprintf("the forge did not answer within %s", deadline)}
+	case errors.Is(err, landing.ErrNoForgeClient):
+		return listing{unread: "the forge client `gh` is not installed"}
+	case err != nil:
+		return listing{unread: termsafe.CleanProseLine(gitutil.ScrubURLCredentials(fsutil.RedactHome(err.Error())), 200)}
+	}
+	var prs []pullRequest
+	if err := json.Unmarshal([]byte(out), &prs); err != nil {
+		return listing{unread: "the forge's listing of the pull requests does not parse"}
+	}
+	return listing{read: true, prs: prs, mine: mine, truncated: len(prs) >= prListLimit}
+}
+
+// byHead is the open pull request whose head is branch in this repository
+// (a fork's pull request whose branch shares the name is not it), preferring
+// the person's own.
+func (l listing) byHead(branch, person string) (pullRequest, bool) {
+	var found pullRequest
+	ok := false
+	for _, p := range l.prs {
+		if p.IsCrossRepository || p.HeadRefName != branch {
+			continue
+		}
+		if l.authoredBy(p, person) {
+			return p, true
+		}
+		if !ok {
+			found, ok = p, true
+		}
+	}
+	return found, ok
+}
+
+// authoredBy reports whether p is the person's.
+func (l listing) authoredBy(p pullRequest, person string) bool {
+	return l.mine || strings.EqualFold(p.Author.Login, person)
+}
diff --git a/internal/core/autonomy/judge.go b/internal/core/autonomy/judge.go
new file mode 100644
index 0000000000..b487f11ebd
--- /dev/null
+++ b/internal/core/autonomy/judge.go
@@ -0,0 +1,355 @@
+package autonomy
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/shellquote"
+	"github.com/intentdriven/abcd/internal/termsafe"
+)
+
+// DefaultBlockCap is the host's cap on consecutive stop-hook continuations:
+// after eight in a row it overrides the next block and ends the turn
+// (CLAUDE_CODE_STOP_HOOK_BLOCK_CAP raises it).
+const DefaultBlockCap = 8
+
+// MaxWakesUnchanged is how many wakes in a row may release an unchanged set
+// of capped items (dcn-2610181035361997).
+const MaxWakesUnchanged = 2
+
+// The session states while away (dcn-2610180936577720): working (the stop is
+// blocked), waiting (allowed with a qualifying wake), and stopped (the host's
+// cap overrode a block, recorded).
+const (
+	StateWorking = "working"
+	StateWaiting = "waiting"
+	StateStopped = "stopped"
+)
+
+// StopInput is what the Stop hook's payload carries, as the front door maps
+// it, and the two values it reads from the machine for the verdict.
+type StopInput struct {
+	SessionID            string
+	StopHookActive       bool
+	LastAssistantMessage string
+	SessionCrons         []SessionCron
+	BackgroundTasks      []BackgroundTask
+	// Cap is the host's continuation cap; 0 means DefaultBlockCap. The front
+	// door reads CLAUDE_CODE_STOP_HOOK_BLOCK_CAP.
+	Cap int
+	// Location is the zone the host reads its tasks' schedules in; nil means
+	// the machine's local time.
+	Location *time.Location
+}
+
+// Verdict is the stop check's answer.
+type Verdict struct {
+	// Block holds the stop, with Reason handed to the agent.
+	Block  bool
+	Reason string
+	// SystemMessage is the line shown to the person on an allow while
+	// present with work owed (stopped, flagged).
+	SystemMessage string
+	// Row is the away row that decided (1 to 7), or 0 while present.
+	Row int
+	// State is the session's state to save, when Save is set (while away).
+	State SessionState
+	Save  bool
+	// Stop is a stop to record in the away record: the block passing the
+	// host's cap, possibly forced by it.
+	Stop *Stop
+	// HandBacks are the hand-backs the verdict accepted, to record in the
+	// away record under its lock, once per branch and head.
+	HandBacks []OwedItem
+}
+
+// Judge is the stop verdict, pure over the away record, the owed set, the
+// host's payload, the session's state and now. rec not holding at now is the
+// person present: with owed work the stop is allowed with a line naming it,
+// and with none silently. While away the rows of the plan are read in order
+// and the first that matches decides:
+//
+//  1. the last message ends on a line ending in `?`, not yet blocked for
+//     this message: block with the reroute's reason;
+//  2. owed, the set changed (or the first check): block, naming the next
+//     item and the count;
+//  3. owed, unchanged, a qualifying wake, and no capped item owed or the wake
+//     count below two: allow (waiting; the wake count adds one if a capped
+//     item is owed);
+//  4. owed, unchanged, a qualifying wake, a capped item owed and the wake
+//     count at two: block;
+//  5. owed, unchanged, no qualifying wake: block;
+//  6. none owed, a qualifying wake: allow (waiting);
+//  7. none owed, no qualifying wake: block, taking the next ready item first.
+//
+// stop_hook_active decides no row; it alone drives the count of consecutive
+// blocks (false sets it to one, true adds one), and the block whose count
+// passes the cap is recorded as a stop possibly forced by the cap.
+func Judge(rec *Record, owed Owed, in StopInput, st SessionState, now time.Time) Verdict {
+	away := rec.Holds(now)
+	if owed.Incomplete {
+		// The check ran out of its time budget: it fails open, allowing the
+		// stop with a line naming what was not read, and, while away,
+		// recording the stop. The session's state is left as it was.
+		v := Verdict{SystemMessage: incompleteLine(owed)}
+		if away {
+			v.Stop = &Stop{Kind: StopCheckIncomplete, Detail: incompleteDetail(owed)}
+		}
+		return v
+	}
+	owed, handBacks := settleHandBacks(rec, owed, away)
+	if !away {
+		if owed.Empty() {
+			return Verdict{}
+		}
+		return Verdict{SystemMessage: presentLine(owed)}
+	}
+
+	next := st
+	next.SchemaVersion = SchemaVersion
+	if cfp := owed.CappedFingerprint(); cfp != next.WakeFingerprint {
+		next.Wakes, next.WakeFingerprint = 0, cfp
+	}
+	fp := owed.Fingerprint()
+	changed := fp != st.Fingerprint
+	next.Fingerprint = fp
+	deadline := wakeDeadline(owed, now)
+	_, look, wake := qualifyingWake(in.SessionCrons, now, deadline, in.Location)
+
+	v := Verdict{Save: true, HandBacks: handBacks}
+	qhash := ""
+	if endsOnQuestion(in.LastAssistantMessage) {
+		qhash = hashText(in.LastAssistantMessage)
+	}
+	switch {
+	case qhash != "" && qhash != st.QuestionHash:
+		v.Row, v.Reason = 1, questionReason()
+		next.QuestionHash = qhash
+		// The owed set is not taken as seen: the next check names it.
+		next.Fingerprint = st.Fingerprint
+	case !owed.Empty() && changed:
+		v.Row, v.Reason = 2, owedReason(rec, owed, "")
+	case !owed.Empty() && wake && (!owed.HasCapped() || next.Wakes < MaxWakesUnchanged):
+		v.Row = 3
+		if owed.HasCapped() {
+			next.Wakes++
+		}
+	case !owed.Empty() && wake:
+		v.Row, v.Reason = 4, owedReason(rec, owed,
+			"The set has not moved over two wakes, so a wake no longer releases this stop: move the item, or take another.")
+	case !owed.Empty():
+		v.Row, v.Reason = 5, owedReason(rec, owed,
+			fmt.Sprintf("If it cannot move, take another or schedule a look before %s (a cron that fires by then, the host's lateness included).", clock(deadline, in.Location)))
+	case wake:
+		v.Row = 6
+	default:
+		v.Row = 7
+		v.Reason = fmt.Sprintf("abcd: the person is away and nothing is owed: take the next ready item first (reserve it with `abcd reserve <id>`); only if none can be taken alone, schedule a look before %s (a cron that fires by then, the host's lateness included).",
+			clock(deadline, in.Location))
+	}
+
+	if v.Reason == "" {
+		v.Block = false
+		next.State, next.NextLook, next.Blocks = StateWaiting, look, 0
+		v.State = next
+		return v
+	}
+	v.Block = true
+	next.State, next.NextLook = StateWorking, time.Time{}
+	if in.StopHookActive {
+		next.Blocks++
+	} else {
+		next.Blocks = 1
+	}
+	limit := in.Cap
+	if limit <= 0 {
+		limit = DefaultBlockCap
+	}
+	if next.Blocks > limit {
+		row := v.Row
+		if row == 1 {
+			// A question blocked past the cap is a stop like any other:
+			// with work owed, or with none and no look scheduled.
+			row = 7
+			if !owed.Empty() {
+				row = 2
+			}
+		}
+		switch row {
+		case 2, 4, 5:
+			item, _ := owed.Next()
+			v.Stop = &Stop{Kind: StopWorkOwed, Detail: describeItem(item), PossiblyForcedByCap: true}
+			next.State = StateStopped
+		case 7:
+			v.Stop = &Stop{Kind: StopNoNextLook, PossiblyForcedByCap: true}
+			next.State = StateStopped
+		}
+	}
+	v.State = next
+	return v
+}
+
+// settleHandBacks applies the hand-back rule at the verdict (F1,
+// dcn-2610181035355741): only while away and only under --hold-pushes is an
+// item handed back, and then only an unpushed branch's item with its head;
+// every other item the reader handed back is put back among the owed items.
+func settleHandBacks(rec *Record, owed Owed, away bool) (Owed, []OwedItem) {
+	if len(owed.HandedBack) == 0 {
+		return owed, nil
+	}
+	items := append([]OwedItem(nil), owed.Items...)
+	var accepted []OwedItem
+	for _, h := range owed.HandedBack {
+		if away && rec.HoldPushes && h.Kind == OwedUnpushed && h.Branch != "" && h.Head != "" {
+			accepted = append(accepted, h)
+			continue
+		}
+		items = append(items, h)
+	}
+	owed.Items, owed.HandedBack = items, nil
+	return owed, accepted
+}
+
+// endsOnQuestion reports whether the message's last line, trailing space and
+// emphasis marks aside, ends in a question mark.
+func endsOnQuestion(msg string) bool {
+	return strings.HasSuffix(strings.TrimRight(msg, " \t\r\n*_"), "?")
+}
+
+func hashText(s string) string {
+	sum := sha256.Sum256([]byte(s))
+	return hex.EncodeToString(sum[:16])
+}
+
+func questionReason() string {
+	return "abcd: your last message ends on a question, and the person is away, so no one will answer it. Do not ask it.\n" + QuestionRoute()
+}
+
+func owedReason(rec *Record, owed Owed, tail string) string {
+	item, _ := owed.Next()
+	var b strings.Builder
+	fmt.Fprintf(&b, "abcd: the person is away and work is owed (%s). Next: %s.", count(len(owed.Items), "item", "items"), describeItem(item))
+	if needsPush(item.Kind) {
+		b.WriteString(" " + pushWords(rec, item))
+	}
+	if tail != "" {
+		b.WriteString(" " + tail)
+	}
+	for _, n := range owed.Notes {
+		b.WriteString(" " + termsafe.CleanProseLine(n, 256))
+	}
+	return b.String()
+}
+
+// needsPush reports whether an item's next act, once the local work is done,
+// is a push (or opening a pull request, the same kind of act).
+func needsPush(k OwedKind) bool {
+	switch k {
+	case OwedUnpushed, OwedUncarried, OwedBehind, OwedFailing:
+		return true
+	}
+	return false
+}
+
+// pushWords is the reason's sentence for an item that needs a push
+// (dcn-2610181016510153, refined by dcn-2610181035355741). It defers to the
+// person's standing instruction and never names the away mode as leave.
+func pushWords(rec *Record, item OwedItem) string {
+	if rec != nil && rec.HoldPushes {
+		target := "<branch>"
+		if item.Branch != "" {
+			target = clean(item.Branch)
+		}
+		return fmt.Sprintf("With --hold-pushes the person has said pushes wait: finish the local work (the merge from the base, the preflight), then queue the push naming the branch, as `abcd mode queue %s`.", shellWord("push "+target))
+	}
+	return "Do the local work, then push if your standing instruction allows; queue only if the person has said pushes wait. A push you may not send stays owed: queue it with `abcd mode queue \"<step>\"` for the person and take another item meanwhile."
+}
+
+// shellWord is s as one word of a command the reason suggests: as it is when
+// it holds only characters no shell reads specially, else single-quoted
+// (shellquote.Single), so a branch name or record id holding `$(…)`, a
+// backquote or a quote cannot run anything when the suggestion is pasted.
+func shellWord(s string) string {
+	if s != "" && strings.IndexFunc(s, func(r rune) bool {
+		return !(r >= 'a' && r <= 'z' || r >= 'A' && r <= 'Z' || r >= '0' && r <= '9' || strings.ContainsRune("._/-", r))
+	}) < 0 {
+		return s
+	}
+	return shellquote.Single(s)
+}
+
+// describeItem names an owed item in plain words: the reader's reason when it
+// wrote one, which already names the item, else words built from its fields.
+func describeItem(i OwedItem) string {
+	if i.Reason != "" {
+		return termsafe.CleanProseLine(i.Reason, 256)
+	}
+	pr := ""
+	if i.PR > 0 {
+		pr = fmt.Sprintf("pull request #%d", i.PR)
+		if i.Branch != "" {
+			pr += " (" + clean(i.Branch) + ")"
+		}
+	}
+	var s string
+	switch i.Kind {
+	case OwedRenewal:
+		s = "the reservation on " + clean(i.Record) + " is due for renewal"
+	case OwedFailing:
+		s = orBranch(pr, i.Branch) + " is failing its checks"
+	case OwedBehind:
+		s = orBranch(pr, i.Branch) + " is behind its base"
+	case OwedStacked:
+		s = "branch " + clean(i.Branch) + " is stacked on a change still open and needs work"
+	case OwedUnpushed:
+		s = "branch " + clean(i.Branch) + " has commits not pushed"
+	case OwedUncarried:
+		s = "the reservation on " + clean(i.Record) + " has no open pull request carrying its work"
+	default:
+		s = clean(string(i.Kind)) + " " + clean(i.Branch+i.Record)
+	}
+	return s
+}
+
+func orBranch(pr, branch string) string {
+	if pr != "" {
+		return pr
+	}
+	return "branch " + clean(branch)
+}
+
+// incompleteDetail is what an incomplete reading's notes say was not read.
+func incompleteDetail(owed Owed) string {
+	for _, n := range owed.Notes {
+		if strings.Contains(n, "ran out of its time budget") {
+			return termsafe.CleanProseLine(n, 256)
+		}
+	}
+	return "the check ran out of its time budget"
+}
+
+// incompleteLine is the person's line on a stop allowed because the check ran
+// out of its time budget.
+func incompleteLine(owed Owed) string {
+	line := "abcd: the stop was allowed: " + incompleteDetail(owed)
+	if item, ok := owed.Next(); ok {
+		line += "; work read as owed so far: " + describeItem(item)
+	}
+	return line + "."
+}
+
+// presentLine is the person's line on a stop while present with work owed.
+func presentLine(owed Owed) string {
+	item, _ := owed.Next()
+	return fmt.Sprintf("abcd: stopped with work owed (%s); next: %s.", count(len(owed.Items), "item", "items"), describeItem(item))
+}
+
+func clock(t time.Time, loc *time.Location) string {
+	if loc == nil {
+		loc = time.Local
+	}
+	return t.In(loc).Format("15:04 MST")
+}
diff --git a/internal/core/autonomy/judge_test.go b/internal/core/autonomy/judge_test.go
new file mode 100644
index 0000000000..181c95e574
--- /dev/null
+++ b/internal/core/autonomy/judge_test.go
@@ -0,0 +1,618 @@
+package autonomy
+
+import (
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+// judge_test.go — step 5 of spc-2610180914469489: the stop verdict, pure over
+// the owed set, the session's state and the host's payload.
+
+func awayRec(now time.Time, holdPushes bool) *Record {
+	r, err := begin(nil, alice, now.Add(-time.Hour), time.Time{}, holdPushes)
+	if err != nil {
+		panic(err)
+	}
+	return r
+}
+
+var (
+	behindPR    = OwedItem{Kind: OwedBehind, Capped: true, Branch: "feat/behind", PR: 12, Head: "aaaa"}
+	failingPR   = OwedItem{Kind: OwedFailing, Capped: true, Branch: "feat/failing", PR: 13, Head: "bbbb"}
+	unpushedBr  = OwedItem{Kind: OwedUnpushed, Capped: true, Branch: "feat/unpushed", Head: "cccc"}
+	stackedBr   = OwedItem{Kind: OwedStacked, Capped: true, Branch: "feat/stacked", Head: "dddd"}
+	uncarried   = OwedItem{Kind: OwedUncarried, Capped: true, Record: "iss-5"}
+	renewalDue  = OwedItem{Kind: OwedRenewal, Record: "iss-7"}
+	stackedWait = OwedItem{Kind: OwedStacked, Branch: "feat/waiting", Head: "eeee"} // waiting only on running checks
+)
+
+func owedOf(items ...OwedItem) Owed { return Owed{Items: items} }
+
+func crons(exprs ...string) []SessionCron {
+	var out []SessionCron
+	for i, e := range exprs {
+		out = append(out, SessionCron{ID: "c" + string(rune('0'+i)), Schedule: e, Recurring: true, Prompt: "look"})
+	}
+	return out
+}
+
+// judgeAt runs Judge read in London, on a minute boundary.
+func judgeAt(t *testing.T, rec *Record, owed Owed, in StopInput, st SessionState, now time.Time) Verdict {
+	t.Helper()
+	if in.Location == nil {
+		in.Location = london(t)
+	}
+	return Judge(rec, owed, in, st, now)
+}
+
+// TestJudgeRows: each of the seven away rows and both present rows, each with
+// stop_hook_active true and false.
+func TestJudgeRows(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	rec := awayRec(now, false)
+	owed := owedOf(behindPR)
+	seen := SessionState{Fingerprint: owed.Fingerprint(), WakeFingerprint: owed.CappedFingerprint()}
+	none := Owed{}
+	seenNone := SessionState{Fingerprint: none.Fingerprint(), WakeFingerprint: none.CappedFingerprint()}
+	wake := crons("*/10 * * * *")
+
+	for _, active := range []bool{false, true} {
+		for _, c := range []struct {
+			name  string
+			rec   *Record
+			owed  Owed
+			in    StopInput
+			st    SessionState
+			row   int
+			block bool
+			state string
+			want  []string
+		}{
+			{"1 prose question", rec, owed, StopInput{LastAssistantMessage: "Done.\nShall I merge it?\n"}, seen, 1, true, StateWorking, []string{"abcd decide", "abcd mode queue"}},
+			{"2 owed, first block", rec, owed, StopInput{SessionCrons: wake}, SessionState{}, 2, true, StateWorking, []string{"feat/behind", "#12", "1 item"}},
+			{"2 owed, set changed", rec, owedOf(behindPR, unpushedBr), StopInput{SessionCrons: wake}, seen, 2, true, StateWorking, []string{"feat/behind", "2 items"}},
+			{"3 owed, unchanged, wake", rec, owed, StopInput{SessionCrons: wake}, seen, 3, false, StateWaiting, nil},
+			{"4 owed, unchanged, wake, two wakes", rec, owed, StopInput{SessionCrons: wake}, withWakes(seen, 2), 4, true, StateWorking, []string{"feat/behind", "two wakes"}},
+			{"5 owed, unchanged, no wake", rec, owed, StopInput{}, seen, 5, true, StateWorking, []string{"feat/behind", "take another", "schedule a look before"}},
+			{"6 none, wake", rec, none, StopInput{SessionCrons: crons("*/30 * * * *")}, seenNone, 6, false, StateWaiting, nil},
+			{"7 none, no wake", rec, none, StopInput{}, seenNone, 7, true, StateWorking, []string{"next ready item", "reserve", "schedule a look before"}},
+			{"present, owed", nil, owed, StopInput{}, SessionState{}, 0, false, "", nil},
+			{"present, none", nil, none, StopInput{}, SessionState{}, 0, false, "", nil},
+		} {
+			c.in.StopHookActive = active
+			v := judgeAt(t, c.rec, c.owed, c.in, c.st, now)
+			name := c.name
+			if active {
+				name += " (stop_hook_active)"
+			}
+			if v.Row != c.row || v.Block != c.block {
+				t.Errorf("%s: row %d block %v, want row %d block %v (reason %q)", name, v.Row, v.Block, c.row, c.block, v.Reason)
+				continue
+			}
+			if c.rec != nil && v.State.State != c.state {
+				t.Errorf("%s: state %q, want %q", name, v.State.State, c.state)
+			}
+			for _, w := range c.want {
+				if !strings.Contains(v.Reason, w) {
+					t.Errorf("%s: the reason misses %q: %q", name, w, v.Reason)
+				}
+			}
+			if !c.block && v.Reason != "" {
+				t.Errorf("%s: an allow carries a reason: %q", name, v.Reason)
+			}
+		}
+	}
+	// Present: with owed work, allowed with a line naming it; with none, silent.
+	v := judgeAt(t, nil, owed, StopInput{}, SessionState{}, now)
+	if v.Block || !strings.Contains(v.SystemMessage, "feat/behind") || v.Save {
+		t.Errorf("present with work owed: %+v; want allowed, a line naming the work, nothing saved", v)
+	}
+	if v := judgeAt(t, nil, Owed{}, StopInput{}, SessionState{}, now); v.Block || v.SystemMessage != "" || v.Save {
+		t.Errorf("present with nothing owed: %+v; want a silent allow", v)
+	}
+	// A lapsed record is present.
+	lapsed := awayRec(now.Add(-8*24*time.Hour), false)
+	if v := judgeAt(t, lapsed, owed, StopInput{}, seen, now); v.Block || v.Row != 0 {
+		t.Errorf("a lapsed record judged as away: %+v", v)
+	}
+}
+
+func withWakes(s SessionState, n int) SessionState { s.Wakes = n; return s }
+
+// sequence runs Judge over a run of stops, carrying the state through a save
+// and a load of the session's state file, as a new hook process would.
+type sequence struct {
+	t    *testing.T
+	rec  *Record
+	root string
+	id   string
+	now  time.Time
+}
+
+func newSequence(t *testing.T, rec *Record, now time.Time) *sequence {
+	return &sequence{t: t, rec: rec, root: t.TempDir(), id: "sess-1", now: now}
+}
+
+func (s *sequence) stop(owed Owed, in StopInput) Verdict {
+	s.t.Helper()
+	st, err := LoadSession(s.root, s.id)
+	if err != nil {
+		s.t.Fatal(err)
+	}
+	v := judgeAt(s.t, s.rec, owed, in, st, s.now)
+	if v.Save {
+		if err := SaveSession(s.root, s.id, v.State); err != nil {
+			s.t.Fatal(err)
+		}
+	}
+	s.now = s.now.Add(10 * time.Minute)
+	return v
+}
+
+// TestWakeReleasesUnchangedSetTwice: with `*/10 * * * *` and an unchanged
+// capped item, the first two stops with the wake are allowed and the third
+// and each later one blocked; a set of only a renewal due, or of a stacked
+// branch waiting only on running checks, keeps releasing; a renewal falling
+// due between the wakes neither resets nor adds to the count; a change in the
+// capped items resets it; the count is read back from the state file.
+func TestWakeReleasesUnchangedSetTwice(t *testing.T) {
+	now := at(t, "2026-10-18 21:01")
+	wake := StopInput{SessionCrons: crons("*/10 * * * *")}
+	for _, item := range []OwedItem{behindPR, failingPR, unpushedBr, stackedBr, uncarried} {
+		s := newSequence(t, awayRec(now, false), now)
+		owed := owedOf(item)
+		if v := s.stop(owed, wake); v.Row != 2 {
+			t.Fatalf("%s: the first stop is row %d, want the first block", item.Kind, v.Row)
+		}
+		for i, want := range []bool{false, false, true, true, true} {
+			v := s.stop(owed, wake)
+			if v.Block != want {
+				t.Errorf("%s: wake %d: block %v, want %v (row %d)", item.Kind, i+1, v.Block, want, v.Row)
+			}
+		}
+	}
+	for _, item := range []OwedItem{renewalDue, stackedWait} {
+		s := newSequence(t, awayRec(now, false), now)
+		owed := owedOf(item)
+		if item.Kind == OwedRenewal {
+			// As the reader produces a renewal due: its renewal time past,
+			// its lease lapsing in three hours, past the six stops ten minutes
+			// apart (TestDueRenewalReleasesOnWake).
+			owed.NextRenewal, owed.WakeBy = now.Add(-time.Hour), now.Add(3*time.Hour)
+		}
+		s.stop(owed, wake)
+		for i := 0; i < 5; i++ {
+			if v := s.stop(owed, wake); v.Block {
+				t.Errorf("%s (not capped): wake %d blocked (row %d); want it to keep releasing", item.Kind, i+1, v.Row)
+			}
+		}
+	}
+	// A renewal falling due between the wakes: the full set changes (one
+	// block), the capped count neither resets nor adds.
+	s := newSequence(t, awayRec(now, false), now)
+	s.stop(owedOf(behindPR), wake)
+	if v := s.stop(owedOf(behindPR), wake); v.Block {
+		t.Fatal("first wake blocked")
+	}
+	if v := s.stop(owedOf(behindPR, renewalDue), wake); v.Row != 2 {
+		t.Fatalf("a renewal falling due is row %d, want the set-changed block", v.Row)
+	}
+	if v := s.stop(owedOf(behindPR, renewalDue), wake); v.Block {
+		t.Errorf("second wake after a renewal fell due blocked: the renewal reset or added to the count")
+	}
+	if v := s.stop(owedOf(behindPR, renewalDue), wake); !v.Block || v.Row != 4 {
+		t.Errorf("third wake: row %d block %v, want row 4", v.Row, v.Block)
+	}
+	// A change in the capped items resets it.
+	if v := s.stop(owedOf(failingPR, renewalDue), wake); v.Row != 2 {
+		t.Fatalf("a changed capped set is row %d, want 2", v.Row)
+	}
+	for i := 0; i < 2; i++ {
+		if v := s.stop(owedOf(failingPR, renewalDue), wake); v.Block {
+			t.Errorf("after the capped set changed, wake %d blocked: the count did not reset", i+1)
+		}
+	}
+	st, _ := LoadSession(s.root, s.id)
+	if st.Wakes != 2 || st.WakeFingerprint != owedOf(failingPR).CappedFingerprint() {
+		t.Errorf("state file holds wakes=%d fp=%q", st.Wakes, st.WakeFingerprint)
+	}
+}
+
+// TestJudgeEscapeBoundReproducesNoStall: owed, unchanged, stop_hook_active,
+// no wake: blocked, not allowed.
+func TestJudgeEscapeBoundReproducesNoStall(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	owed := owedOf(behindPR)
+	st := SessionState{Fingerprint: owed.Fingerprint(), WakeFingerprint: owed.CappedFingerprint(), Blocks: 3}
+	v := judgeAt(t, awayRec(now, false), owed, StopInput{StopHookActive: true}, st, now)
+	if !v.Block {
+		t.Fatalf("owed, unchanged, stop_hook_active, no wake: allowed (%+v)", v)
+	}
+}
+
+// TestJudgeCapRecordsStop: the block passing the cap, and one passing a cap
+// the environment raised, records the stop labelled possibly forced by the
+// cap; rows 2, 4 and 5 as work owed, row 7 as no next look.
+func TestJudgeCapRecordsStop(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	rec := awayRec(now, false)
+	owed := owedOf(behindPR)
+	seen := SessionState{Fingerprint: owed.Fingerprint(), WakeFingerprint: owed.CappedFingerprint()}
+	for _, c := range []struct {
+		cap, blocks int
+		record      bool
+	}{{0, 7, false}, {0, 8, true}, {0, 12, true}, {12, 8, false}, {12, 12, true}} {
+		st := seen
+		st.Blocks = c.blocks
+		v := judgeAt(t, rec, owed, StopInput{StopHookActive: true, Cap: c.cap}, st, now)
+		if !v.Block {
+			t.Fatalf("cap %d after %d blocks: allowed", c.cap, c.blocks)
+		}
+		if got := v.Stop != nil; got != c.record {
+			t.Errorf("cap %d after %d blocks: stop recorded %v, want %v", c.cap, c.blocks, got, c.record)
+			continue
+		}
+		if c.record && (v.Stop.Kind != StopWorkOwed || !v.Stop.PossiblyForcedByCap || !strings.Contains(v.Stop.Detail, "feat/behind")) {
+			t.Errorf("cap %d: recorded %+v", c.cap, v.Stop)
+		}
+		if c.record && v.State.State != StateStopped {
+			t.Errorf("cap %d: state %q after the cap, want stopped", c.cap, v.State.State)
+		}
+	}
+	none := Owed{}
+	st := SessionState{Fingerprint: none.Fingerprint(), WakeFingerprint: none.CappedFingerprint(), Blocks: 8}
+	v := judgeAt(t, rec, none, StopInput{StopHookActive: true}, st, now)
+	if v.Row != 7 || v.Stop == nil || v.Stop.Kind != StopNoNextLook || !v.Stop.PossiblyForcedByCap {
+		t.Errorf("row 7 past the cap: row %d stop %+v; want stopped with no next look", v.Row, v.Stop)
+	}
+}
+
+// TestCountResetsOnlyOnInactive: a change in the owed set at the sixth block
+// does not reset the count, and the ninth consecutive block still records the
+// stop; a block with stop_hook_active false sets it to one.
+func TestCountResetsOnlyOnInactive(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	s := newSequence(t, awayRec(now, false), now)
+	var v Verdict
+	for i := 1; i <= 9; i++ {
+		owed := owedOf(behindPR)
+		if i >= 6 {
+			owed = owedOf(behindPR, renewalDue)
+		}
+		v = s.stop(owed, StopInput{StopHookActive: i > 1})
+		if !v.Block || v.State.Blocks != i {
+			t.Fatalf("block %d: block %v count %d", i, v.Block, v.State.Blocks)
+		}
+		if (v.Stop != nil) != (i == 9) {
+			t.Fatalf("block %d: stop recorded %v, want only at the ninth", i, v.Stop != nil)
+		}
+	}
+	v = s.stop(owedOf(behindPR, renewalDue), StopInput{StopHookActive: false})
+	if v.State.Blocks != 1 {
+		t.Errorf("a block with stop_hook_active false leaves the count at %d, want 1", v.State.Blocks)
+	}
+}
+
+// TestPushItemReasonDefersToStandingInstruction: without --hold-pushes the
+// reason for an unpushed branch says to push if the standing instruction
+// allows, to queue only if the person has said pushes wait, and that a queued
+// push stays owed; with it, to finish the local work and then queue; neither
+// names the away mode as permission.
+func TestPushItemReasonDefersToStandingInstruction(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	owed := owedOf(unpushedBr)
+	v := judgeAt(t, awayRec(now, false), owed, StopInput{}, SessionState{}, now)
+	for _, want := range []string{"feat/unpushed", "push if your standing instruction allows", "queue only if the person has said pushes wait", "stays owed", "abcd mode queue"} {
+		if !strings.Contains(v.Reason, want) {
+			t.Errorf("without --hold-pushes the reason misses %q: %q", want, v.Reason)
+		}
+	}
+	h := judgeAt(t, awayRec(now, true), owed, StopInput{}, SessionState{}, now)
+	for _, want := range []string{"feat/unpushed", "the person has said pushes wait", "finish the local work", "then queue the push"} {
+		if !strings.Contains(h.Reason, want) {
+			t.Errorf("with --hold-pushes the reason misses %q: %q", want, h.Reason)
+		}
+	}
+	for _, r := range []string{v.Reason, h.Reason} {
+		low := strings.ToLower(r)
+		for _, bad := range []string{"away mode allows", "away mode permits", "allowed by the away mode", "you may push"} {
+			if strings.Contains(low, bad) {
+				t.Errorf("the reason names the away mode as permission (%q): %q", bad, r)
+			}
+		}
+	}
+}
+
+// TestJudgeHandBackOnlyUnderHoldPushes: the verdict accepts a hand-back only
+// of an unpushed branch's item, with its head, under --hold-pushes; any other
+// item handed back stays owed (F1, dcn-2610181035355741).
+func TestJudgeHandBackOnlyUnderHoldPushes(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	wake := StopInput{SessionCrons: crons("*/10 * * * *")}
+	handed := Owed{HandedBack: []OwedItem{unpushedBr}}
+	v := judgeAt(t, awayRec(now, true), handed, wake, SessionState{}, now)
+	if len(v.HandBacks) != 1 || v.HandBacks[0].Branch != "feat/unpushed" || v.Row != 6 {
+		t.Errorf("with --hold-pushes an unpushed item handed back: hand-backs %v row %d, want accepted and nothing owed", v.HandBacks, v.Row)
+	}
+	v = judgeAt(t, awayRec(now, false), handed, wake, SessionState{}, now)
+	if len(v.HandBacks) != 0 || !v.Block || !strings.Contains(v.Reason, "feat/unpushed") {
+		t.Errorf("without --hold-pushes: hand-backs %v block %v; want none accepted and the item still owed", v.HandBacks, v.Block)
+	}
+	for _, item := range []OwedItem{behindPR, failingPR, stackedBr, uncarried, renewalDue, {Kind: OwedUnpushed, Capped: true, Branch: "feat/nohead"}} {
+		v := judgeAt(t, awayRec(now, true), Owed{HandedBack: []OwedItem{item}}, wake, SessionState{}, now)
+		if len(v.HandBacks) != 0 || !v.Block {
+			t.Errorf("%s %s handed back under --hold-pushes: accepted %v block %v; want it kept owed", item.Kind, item.Branch, v.HandBacks, v.Block)
+		}
+	}
+}
+
+// TestDeadlineCeiling: with work owed and no reservation, now plus 30
+// minutes; with nothing owed, now plus one hour; with a renewal due sooner,
+// that minus the skew.
+func TestDeadlineCeiling(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	if got := wakeDeadline(owedOf(behindPR), now); !got.Equal(now.Add(30 * time.Minute)) {
+		t.Errorf("owed, no reservation: %s", got)
+	}
+	if got := wakeDeadline(Owed{}, now); !got.Equal(now.Add(time.Hour)) {
+		t.Errorf("nothing owed: %s", got)
+	}
+	soon := Owed{NextRenewal: now.Add(20 * time.Minute)}
+	if got := wakeDeadline(soon, now); !got.Equal(now.Add(15 * time.Minute)) {
+		t.Errorf("renewal in 20 minutes: deadline %s, want 15 minutes on", got)
+	}
+	late := Owed{Items: []OwedItem{behindPR}, NextRenewal: now.Add(12 * time.Hour)}
+	if got := wakeDeadline(late, now); !got.Equal(now.Add(30 * time.Minute)) {
+		t.Errorf("renewal in 12 hours: deadline %s, want the ceiling", got)
+	}
+}
+
+// TestQualifyingWakeDistantCron: a release reservation with a 24-hour lease
+// claimed at 20:00, and `0 7 * * *` seen at 21:00: does not qualify.
+func TestQualifyingWakeDistantCron(t *testing.T) {
+	loc := london(t)
+	claimed := at(t, "2026-10-18 20:00")
+	now := at(t, "2026-10-18 21:00")
+	owed := Owed{Items: []OwedItem{uncarried}, NextRenewal: claimed.Add(12 * time.Hour)}
+	if _, _, ok := qualifyingWake(crons("0 7 * * *"), now, wakeDeadline(owed, now), loc); ok {
+		t.Error("0 7 * * * seen at 21:00 qualified with work owed")
+	}
+	if _, _, ok := qualifyingWake(crons("0 7 * * *"), now, wakeDeadline(Owed{NextRenewal: owed.NextRenewal}, now), loc); ok {
+		t.Error("0 7 * * * seen at 21:00 qualified with nothing owed")
+	}
+}
+
+// TestQualifyingWakeJitter: an hourly cron whose next match is 3 minutes
+// before the deadline does not qualify; `*/5 * * * *` and `*/10 * * * *` do;
+// a one-shot at the deadline does.
+func TestQualifyingWakeJitter(t *testing.T) {
+	loc := london(t)
+	now := at(t, "2026-10-18 21:00")
+	deadline := wakeDeadline(owedOf(behindPR), now) // 21:30
+	if _, _, ok := qualifyingWake(crons("27 * * * *"), now, deadline, loc); ok {
+		t.Error("an hourly cron at 21:27 qualified for a 21:30 deadline; it may run 30 minutes late")
+	}
+	for _, e := range []string{"*/5 * * * *", "*/10 * * * *"} {
+		if _, _, ok := qualifyingWake(crons(e), now, deadline, loc); !ok {
+			t.Errorf("%q did not qualify", e)
+		}
+	}
+	oneShot := []SessionCron{{ID: "once", Schedule: "30 21 18 10 *", Recurring: false}}
+	if _, look, ok := qualifyingWake(oneShot, now, deadline, loc); !ok || !look.Equal(deadline) {
+		t.Errorf("a one-shot at the deadline: ok %v look %s", ok, look)
+	}
+	// */5 runs on time, any other every-five-minutes form gets half its gap.
+	_, lateFive, _ := latestFire(SessionCron{Schedule: "*/5 * * * *", Recurring: true}, now, deadline, loc)
+	if !lateFive.Equal(now.Add(5 * time.Minute)) {
+		t.Errorf("*/5 latest fire %s, want its match", lateFive)
+	}
+	_, lateTen, _ := latestFire(SessionCron{Schedule: "*/10 * * * *", Recurring: true}, now, deadline, loc)
+	if !lateTen.Equal(now.Add(15 * time.Minute)) {
+		t.Errorf("*/10 latest fire %s, want its match plus five minutes", lateTen)
+	}
+}
+
+// TestQualifyingWakeRecurringCron: `*/30 * * * *` with nothing owed does.
+func TestQualifyingWakeRecurringCron(t *testing.T) {
+	loc := london(t)
+	now := at(t, "2026-10-18 21:05")
+	if _, look, ok := qualifyingWake(crons("*/30 * * * *"), now, wakeDeadline(Owed{}, now), loc); !ok || !look.Equal(at(t, "2026-10-18 21:30")) {
+		t.Errorf("*/30 with nothing owed: ok %v look %s", ok, look)
+	}
+}
+
+// TestQualifyingWakeAfterLeaseLapse: a wake past the earliest renewal due
+// minus the skew does not.
+func TestQualifyingWakeAfterLeaseLapse(t *testing.T) {
+	loc := london(t)
+	now := at(t, "2026-10-18 21:00")
+	owed := Owed{Items: []OwedItem{renewalDue}, NextRenewal: now.Add(12 * time.Minute)} // deadline 21:07
+	if _, _, ok := qualifyingWake([]SessionCron{{Schedule: "10 21 * * *"}}, now, wakeDeadline(owed, now), loc); ok {
+		t.Error("a one-shot at 21:10 qualified past a renewal due at 21:12 less the skew")
+	}
+	if _, _, ok := qualifyingWake([]SessionCron{{Schedule: "6 21 * * *"}}, now, wakeDeadline(owed, now), loc); !ok {
+		t.Error("a one-shot at 21:06 did not qualify before 21:07")
+	}
+}
+
+// TestBackgroundTaskNotAWake: a shell task running `sleep 36000` or a
+// `tail -f` does not count.
+func TestBackgroundTaskNotAWake(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	owed := owedOf(behindPR)
+	st := SessionState{Fingerprint: owed.Fingerprint(), WakeFingerprint: owed.CappedFingerprint()}
+	in := StopInput{BackgroundTasks: []BackgroundTask{
+		{ID: "t1", Type: "shell", Status: "running", Command: "sleep 36000"},
+		{ID: "t2", Type: "shell", Status: "running", Command: "tail -f /var/log/syslog"},
+	}}
+	if v := judgeAt(t, awayRec(now, false), owed, in, st, now); !v.Block || v.Row != 5 {
+		t.Errorf("background tasks counted as a wake: row %d block %v", v.Row, v.Block)
+	}
+	none := Owed{}
+	st = SessionState{Fingerprint: none.Fingerprint(), WakeFingerprint: none.CappedFingerprint()}
+	if v := judgeAt(t, awayRec(now, false), none, in, st, now); !v.Block || v.Row != 7 {
+		t.Errorf("background tasks counted as a wake with nothing owed: row %d", v.Row)
+	}
+}
+
+// TestNextLookStored: a waiting verdict keeps the wake's next fire time as
+// the next look.
+func TestNextLookStored(t *testing.T) {
+	now := at(t, "2026-10-18 21:01")
+	s := newSequence(t, awayRec(now, false), now)
+	none := Owed{}
+	v := s.stop(none, StopInput{SessionCrons: crons("*/10 * * * *")})
+	if v.Block || v.State.State != StateWaiting || !v.State.NextLook.Equal(at(t, "2026-10-18 21:10")) {
+		t.Fatalf("waiting verdict: %+v", v.State)
+	}
+	st, _ := LoadSession(s.root, s.id)
+	if !st.NextLook.Equal(at(t, "2026-10-18 21:10")) || st.State != StateWaiting {
+		t.Errorf("state file: next look %s state %q", st.NextLook, st.State)
+	}
+}
+
+// TestProseQuestionBlockedOnce: a last message ending on a question is
+// blocked once; the same message again goes on to the other rows.
+func TestProseQuestionBlockedOnce(t *testing.T) {
+	now := at(t, "2026-10-18 21:01")
+	s := newSequence(t, awayRec(now, false), now)
+	in := StopInput{LastAssistantMessage: "Should I rebase onto main?  \n\n", SessionCrons: crons("*/10 * * * *")}
+	if v := s.stop(Owed{}, in); v.Row != 1 || !v.Block {
+		t.Fatalf("first: row %d", v.Row)
+	}
+	in.StopHookActive = true
+	if v := s.stop(Owed{}, in); v.Row == 1 {
+		t.Errorf("the same question was blocked twice")
+	}
+	in.LastAssistantMessage = "I merged it. Is CI green? I'll check.\n"
+	if v := s.stop(Owed{}, in); v.Row == 1 {
+		t.Errorf("a message not ending on a question line was blocked as one")
+	}
+	in.LastAssistantMessage = "Next question:\nwhich base should it use?"
+	if v := s.stop(Owed{}, in); v.Row != 1 {
+		t.Errorf("a new question was not blocked: row %d", v.Row)
+	}
+}
+
+// TestNothingOwedReason names taking the next ready item first.
+func TestNothingOwedReason(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	v := judgeAt(t, awayRec(now, false), Owed{}, StopInput{}, SessionState{}, now)
+	if v.Row != 7 || !strings.Contains(v.Reason, "take the next ready item first") || !strings.Contains(v.Reason, "abcd reserve") {
+		t.Errorf("row %d reason %q", v.Row, v.Reason)
+	}
+	if strings.Index(v.Reason, "next ready item") > strings.Index(v.Reason, "schedule a look") {
+		t.Errorf("the reason offers the look before the next item: %q", v.Reason)
+	}
+}
+
+// TestSessionIDShape: a session id outside [A-Za-z0-9_-]{1,128} is refused.
+func TestSessionIDShape(t *testing.T) {
+	root := t.TempDir()
+	for _, ok := range []string{"a", "abc-DEF_123", strings.Repeat("x", 128), "0b9c1d2e-aaaa-bbbb-cccc-0123456789ab"} {
+		if !ValidSessionID(ok) {
+			t.Errorf("%q refused", ok)
+		}
+		if err := SaveSession(root, ok, SessionState{State: StateWorking}); err != nil {
+			t.Errorf("SaveSession(%q): %v", ok, err)
+		}
+	}
+	for _, bad := range []string{"", "../x", "a/b", "a.b", strings.Repeat("x", 129), "a b", "x\n"} {
+		if ValidSessionID(bad) {
+			t.Errorf("%q accepted", bad)
+		}
+		if err := SaveSession(root, bad, SessionState{}); err == nil {
+			t.Errorf("SaveSession(%q) wrote", bad)
+		}
+		if _, err := LoadSession(root, bad); err == nil {
+			t.Errorf("LoadSession(%q) read", bad)
+		}
+	}
+	p, _ := sessionStatePath(root, "abc")
+	if want := filepath.Join(root, ".abcd", ".work.local", "autonomy", "sessions", "abc.json"); p != want {
+		t.Errorf("state path %s, want %s", p, want)
+	}
+}
+
+// TestReasonSaysItOnce: an item's words appear once, in the agent's reason,
+// the person's line and the recorded stop alike, with the reader's reason as
+// it writes it.
+func TestReasonSaysItOnce(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	item := OwedItem{Kind: OwedUnpushed, Capped: true, Branch: "feat/x", Head: "cccc", Reason: "branch feat/x has commits not pushed"}
+	owed := owedOf(item)
+	if got, want := presentLine(owed), "abcd: stopped with work owed (1 item); next: branch feat/x has commits not pushed."; got != want {
+		t.Errorf("the person's line:\n got %q\nwant %q", got, want)
+	}
+	v := judgeAt(t, awayRec(now, false), owed, StopInput{}, SessionState{}, now)
+	if want := "abcd: the person is away and work is owed (1 item). Next: branch feat/x has commits not pushed. Do the local work"; !strings.HasPrefix(v.Reason, want) {
+		t.Errorf("the reason:\n got %q\nwant it to begin %q", v.Reason, want)
+	}
+	seen := SessionState{Fingerprint: owed.Fingerprint(), WakeFingerprint: owed.CappedFingerprint(), Blocks: DefaultBlockCap}
+	v = judgeAt(t, awayRec(now, false), owed, StopInput{StopHookActive: true}, seen, now)
+	if v.Stop == nil || v.Stop.Detail != "branch feat/x has commits not pushed" {
+		t.Errorf("the recorded stop: %+v", v.Stop)
+	}
+}
+
+// TestSuggestedQueueCommandQuotesBranch: a branch name holding `$(…)`, a
+// backquote or a single quote, all legal in a refname, reaches the suggested
+// `abcd mode queue` command as one single-quoted shell word.
+func TestSuggestedQueueCommandQuotesBranch(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	for branch, want := range map[string]string{
+		"feat/x":                   "`abcd mode queue 'push feat/x'`",
+		"feat/$(touch${IFS}pwned)": "`abcd mode queue 'push feat/$(touch${IFS}pwned)'`",
+		"feat/`id`":                "`abcd mode queue 'push feat/`id`'`",
+		"feat/it's":                `abcd mode queue 'push feat/it'\''s'`,
+	} {
+		item := OwedItem{Kind: OwedUnpushed, Capped: true, Branch: branch, Head: "cccc"}
+		v := judgeAt(t, awayRec(now, true), owedOf(item), StopInput{}, SessionState{}, now)
+		if !strings.Contains(v.Reason, want) {
+			t.Errorf("branch %q: the reason lacks %s:\n%s", branch, want, v.Reason)
+		}
+	}
+}
+
+// TestRowOnePastCapRecordsStop: a question blocked once more past the cap
+// records the stop: work owed when anything is, else no next look.
+func TestRowOnePastCapRecordsStop(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	rec := awayRec(now, false)
+	for _, c := range []struct {
+		owed Owed
+		kind StopKind
+	}{{owedOf(behindPR), StopWorkOwed}, {Owed{}, StopNoNextLook}} {
+		st := SessionState{Fingerprint: c.owed.Fingerprint(), WakeFingerprint: c.owed.CappedFingerprint(), Blocks: DefaultBlockCap}
+		v := judgeAt(t, rec, c.owed, StopInput{StopHookActive: true, LastAssistantMessage: "Shall I merge it?"}, st, now)
+		if v.Row != 1 || !v.Block {
+			t.Fatalf("row %d block %v, want row 1 blocked", v.Row, v.Block)
+		}
+		if v.Stop == nil || v.Stop.Kind != c.kind || !v.Stop.PossiblyForcedByCap || v.State.State != StateStopped {
+			t.Errorf("row 1 past the cap with %d owed: stop %+v state %q, want %s", len(c.owed.Items), v.Stop, v.State.State, c.kind)
+		}
+	}
+}
+
+// TestIncompleteReadAllows: a reading the time budget cut short allows the
+// stop, present or away, naming what was not read to the person; while away
+// it records the stop.
+func TestIncompleteReadAllows(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	owed := Owed{Items: []OwedItem{behindPR}, Incomplete: true, Notes: []string{"the check ran out of its time budget before reading 3 of 9 own branches"}}
+	for _, away := range []bool{true, false} {
+		var rec *Record
+		if away {
+			rec = awayRec(now, false)
+		}
+		v := judgeAt(t, rec, owed, StopInput{}, SessionState{}, now)
+		if v.Block || !strings.Contains(v.SystemMessage, "3 of 9 own branches") {
+			t.Errorf("away %v: block %v message %q, want allowed and named", away, v.Block, v.SystemMessage)
+		}
+		if got := v.Stop != nil && v.Stop.Kind == StopCheckIncomplete; got != away {
+			t.Errorf("away %v: stop %+v", away, v.Stop)
+		}
+	}
+}
diff --git a/internal/core/autonomy/lines.go b/internal/core/autonomy/lines.go
new file mode 100644
index 0000000000..b81d10446b
--- /dev/null
+++ b/internal/core/autonomy/lines.go
@@ -0,0 +1,49 @@
+package autonomy
+
+import (
+	"fmt"
+	"strings"
+)
+
+// PersonLine is the one line the prompt hook shows the person on every prompt
+// while the record holds: until when, set by whom and from which working
+// copy, the counts of queued steps and handed-back items, and the literal
+// `abcd mode back` as the way to end it (dcn-2610181035355741).
+func (r *Record) PersonLine() string {
+	until := showTime(r.Ends())
+	if r.OpenEnded {
+		until += " (open-ended)"
+	}
+	hold := ""
+	if r.HoldPushes {
+		hold = "; pushes wait for you"
+	}
+	return fmt.Sprintf("abcd: away until %s, set by %s from %s%s; %s queued, %s handed back. `abcd mode back` ends it.",
+		until, showWho(r.SetBy), showCopy(r.SetFrom), hold,
+		count(len(r.Queue), "step", "steps"), count(len(r.HandedBack), "item", "items"))
+}
+
+// LapsedLine is the one line the prompt hook shows the person on every prompt
+// while the record has lapsed unclosed holding a queued step or a recorded
+// stop, and "" otherwise (dcn-2610181003474765).
+func (r *Record) LapsedLine() string {
+	if len(r.Queue) == 0 && len(r.Stops) == 0 {
+		return ""
+	}
+	var parts []string
+	if n := len(r.Queue); n > 0 {
+		parts = append(parts, count(n, "step", "steps")+" queued")
+	}
+	if n := len(r.Stops); n > 0 {
+		parts = append(parts, count(n, "stop", "stops")+" recorded")
+	}
+	return fmt.Sprintf("abcd: the away window ended at %s with %s, not yet read. `abcd mode back` prints them and closes it.",
+		showTime(r.Ends()), strings.Join(parts, " and "))
+}
+
+func count(n int, one, many string) string {
+	if n == 1 {
+		return "1 " + one
+	}
+	return fmt.Sprintf("%d %s", n, many)
+}
diff --git a/internal/core/autonomy/owed.go b/internal/core/autonomy/owed.go
new file mode 100644
index 0000000000..16fb6540ac
--- /dev/null
+++ b/internal/core/autonomy/owed.go
@@ -0,0 +1,149 @@
+package autonomy
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// OwedKind is one of the four kinds of owed work, the reservation kind split
+// in two (a renewal due, and work no pull request carries) and the pull
+// request kind split in two (failing, behind).
+type OwedKind string
+
+const (
+	// OwedRenewal is a live reservation under this copy's key whose renewal
+	// is due. It is never capped.
+	OwedRenewal OwedKind = "renewal"
+	// OwedFailing is an open pull request of the session's own failing its
+	// checks.
+	OwedFailing OwedKind = "failing"
+	// OwedBehind is an open pull request of the session's own behind its base
+	// (or conflicting).
+	OwedBehind OwedKind = "behind"
+	// OwedStacked is an own branch stacked on a change still open, while the
+	// clearing rule owes it.
+	OwedStacked OwedKind = "stacked"
+	// OwedUnpushed is an own branch with commits not pushed.
+	OwedUnpushed OwedKind = "unpushed"
+	// OwedUncarried is a live reservation under this copy's key whose work no
+	// open pull request carries yet.
+	OwedUncarried OwedKind = "uncarried"
+)
+
+// owedKinds returns the kinds in the order the next item is chosen.
+func owedKinds() []OwedKind {
+	return []OwedKind{OwedRenewal, OwedFailing, OwedBehind, OwedStacked, OwedUnpushed, OwedUncarried}
+}
+
+func kindRank(k OwedKind) int {
+	for i, o := range owedKinds() {
+		if o == k {
+			return i
+		}
+	}
+	return len(owedKinds())
+}
+
+// OwedItem is one owed item.
+type OwedItem struct {
+	Kind OwedKind `json:"kind"`
+	// Capped marks an item the session can act on itself, which a qualifying
+	// wake releases at most twice in a row (dcn-2610181035361997).
+	Capped bool `json:"capped"`
+	// Branch is the branch the item is about, when it is about one.
+	Branch string `json:"branch,omitempty"`
+	// Record is the reservation's record id, when the item is about one.
+	Record string `json:"record,omitempty"`
+	// PR is the pull request's number, when the item has one.
+	PR int `json:"pr,omitempty"`
+	// Head is the branch's head commit, when known.
+	Head string `json:"head,omitempty"`
+	// Reason says, in plain words, why the item is owed and what to do. It is
+	// not part of the item's identity.
+	Reason string `json:"reason,omitempty"`
+}
+
+func (i OwedItem) key() string {
+	return strings.Join([]string{string(i.Kind), i.Branch, i.Record, strconv.Itoa(i.PR), i.Head}, "\x00")
+}
+
+// Owed is the owed set a stop check judges.
+type Owed struct {
+	Items []OwedItem `json:"items"`
+	// Notes say what was not read and how the set was judged instead, such
+	// as pull requests not read when the forge listing failed.
+	Notes []string `json:"notes,omitempty"`
+	// NextRenewal is the earliest renewal due among the live reservations
+	// under this copy's key, due or not yet; zero when there is none. The
+	// stop verdict's deadline is it less lease.Skew, when that is sooner than
+	// the ceiling (dcn-2610181003455731).
+	NextRenewal time.Time `json:"next_renewal,omitempty"`
+	// WakeBy is the latest a wake may fire for this copy's live
+	// reservations: the earliest of each one's renewal while it is not yet
+	// due, and its lapse once it is. A renewal already due is owed, and a
+	// wake before the lease lapses releases it as the spec has it; zero when
+	// there is no reservation, and wakeDeadline then reads NextRenewal.
+	WakeBy time.Time `json:"wake_by,omitempty"`
+	// HandedBack are the items a queued step handed back this check, taken
+	// out of Items by the reader (dcn-2610181035355741). The verdict accepts
+	// only an unpushed branch's item, with its head, under --hold-pushes,
+	// and puts any other back among the owed items.
+	HandedBack []OwedItem `json:"handed_back,omitempty"`
+	// Incomplete is a reading the check's time budget cut short: Notes say
+	// what was not read, and the verdict allows the stop, naming it, rather
+	// than judge from part of the work.
+	Incomplete bool `json:"incomplete,omitempty"`
+}
+
+// Empty reports whether nothing is owed.
+func (o Owed) Empty() bool { return len(o.Items) == 0 }
+
+// HasCapped reports whether any owed item is capped.
+func (o Owed) HasCapped() bool {
+	for _, i := range o.Items {
+		if i.Capped {
+			return true
+		}
+	}
+	return false
+}
+
+// Next is the item the session is handed: the first by owedKinds' order, the
+// items of one kind in the order they were given.
+func (o Owed) Next() (OwedItem, bool) {
+	if len(o.Items) == 0 {
+		return OwedItem{}, false
+	}
+	best := 0
+	for i := 1; i < len(o.Items); i++ {
+		if kindRank(o.Items[i].Kind) < kindRank(o.Items[best].Kind) {
+			best = i
+		}
+	}
+	return o.Items[best], true
+}
+
+// Fingerprint identifies the owed set by its items' kind, branch, record,
+// pull request and head, whatever their order and reasons.
+func (o Owed) Fingerprint() string { return fingerprint(o.Items, false) }
+
+// CappedFingerprint is Fingerprint over the capped items alone, so a renewal
+// falling due or done does not change it.
+func (o Owed) CappedFingerprint() string { return fingerprint(o.Items, true) }
+
+func fingerprint(items []OwedItem, cappedOnly bool) string {
+	keys := make([]string, 0, len(items))
+	for _, i := range items {
+		if cappedOnly && !i.Capped {
+			continue
+		}
+		keys = append(keys, i.key())
+	}
+	sort.Strings(keys)
+	sum := sha256.Sum256([]byte(strings.Join(keys, "\n")))
+	return hex.EncodeToString(sum[:16])
+}
diff --git a/internal/core/autonomy/owedread.go b/internal/core/autonomy/owedread.go
new file mode 100644
index 0000000000..69025ec144
--- /dev/null
+++ b/internal/core/autonomy/owedread.go
@@ -0,0 +1,1093 @@
+package autonomy
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/core/claim"
+	"github.com/intentdriven/abcd/internal/core/identity"
+	"github.com/intentdriven/abcd/internal/core/landing"
+	"github.com/intentdriven/abcd/internal/fsutil"
+	"github.com/intentdriven/abcd/internal/gitutil"
+)
+
+// StaleWindow bounds ownership through the reflog or a recorded creation: such
+// a branch is the session's own only while it holds a commit of this
+// checkout's made within it, or a live reservation links it
+// (dcn-2610181003463367).
+const StaleWindow = 14 * 24 * time.Hour
+
+// ReadOptions carry what ReadOwed reads; every seam's zero value reads the
+// machine.
+type ReadOptions struct {
+	// Root is the session's working copy: the root of the worktree the
+	// session started in.
+	Root string
+	// Record is the away record as the stop check read it, nil when there is
+	// none. The forge is read only while it holds at Now; its queue and
+	// HoldPushes decide what a queued push hands back.
+	Record *Record
+	// Home is the home directory the away store lives under; "" means the
+	// process's own.
+	Home string
+	// Now is the clock; nil means time.Now.
+	Now func() time.Time
+	// Forge runs the forge client; nil means landing.GHContext.
+	Forge Forge
+	// ForgeDeadline bounds the listing; zero means ForgeDeadline.
+	ForgeDeadline time.Duration
+	// Reservations reads the reservations as last fetched, with no network;
+	// nil means claim.View.
+	Reservations func(root string, now time.Time) (claim.Snapshot, error)
+	// Person is the person's forge name, which tells their pull requests
+	// from another person's; "" means the holder name reservations resolve
+	// without a network read (claim.ReaderHolder), and when that is unknown
+	// too the listing asks for the person's own pull requests alone.
+	Person string
+	// Email is this checkout's author email, which tells its commits from
+	// another author's; "" means the email git would author a commit with.
+	Email string
+}
+
+func (o ReadOptions) now() time.Time {
+	if o.Now != nil {
+		return o.Now()
+	}
+	return time.Now()
+}
+
+// ReadOwed is the owed work of the working copy at o.Root
+// (spc-2610180914469489, "Owed work"): the stop check's one reading.
+//
+// While the person is present (o.Record does not hold) it reads disk only:
+// renewals due and unpushed own branches, and never calls the forge. While
+// away it adds one listing of the open pull requests under ForgeDeadline,
+// for failing, behind, stacked and uncarried work; a listing that fails or
+// is late is named in Owed.Notes and the check judges from disk alone
+// (adr-2610181003541997). With --hold-pushes, an unpushed own branch a queued
+// step names, whose head contains its base's last-fetched tip and has a
+// preflight receipt, is handed back: moved out of Owed.Items into
+// Owed.HandedBack, for the verdict to accept and the stop hook to record.
+// Owed.NextRenewal is the earliest renewal due among the live reservations
+// under this copy's key, due or not yet, present or away.
+//
+// The error is a root that is not a working copy; every other failure to read
+// something is a note, and the set is judged without it.
+func ReadOwed(ctx context.Context, o ReadOptions) (Owed, error) {
+	if o.Root == "" {
+		return Owed{}, errors.New("autonomy: no working copy to read the owed work of")
+	}
+	root, err := gitutil.CheckoutRoot(o.Root, StoreName)
+	if err != nil {
+		return Owed{}, err
+	}
+	home := o.Home
+	if home == "" {
+		if home, err = os.UserHomeDir(); err != nil {
+			home = ""
+		}
+	}
+	r := &owedReader{
+		ctx:   ctx,
+		root:  root,
+		home:  home,
+		now:   o.now(),
+		email: o.Email,
+		rec:   o.Record,
+	}
+	r.away = o.Record.Holds(r.now)
+	if r.email == "" {
+		if id, err := identity.EffectiveIdentity(root); err == nil {
+			r.email = id.Email
+		}
+	}
+	r.readRefs()
+	r.readReservations(o)
+	if r.away {
+		r.person = o.Person
+		if r.person == "" {
+			r.person = claim.ReaderHolder(root, claim.Options{Home: home})
+		}
+		forge := o.Forge
+		if forge == nil {
+			forge = landing.GHContext
+		}
+		deadline := o.ForgeDeadline
+		if deadline <= 0 {
+			deadline = ForgeDeadline
+		}
+		r.list = listOpen(ctx, forge, root, r.person, deadline)
+		if !r.list.read {
+			r.note("the pull requests were not read (%s), so the check judged from disk alone", r.list.unread)
+		}
+		if r.list.truncated {
+			r.note("the forge listed %d open pull requests, its limit, so the listing may be truncated: a reservation no listed pull request carries is not counted as uncarried", len(r.list.prs))
+		}
+	}
+	r.receiptsMinted = receiptsMinted(root)
+	r.readLanes()
+	r.findOwn()
+	r.branchItems()
+	r.reservationItems()
+	r.handBack()
+	sort.SliceStable(r.items, func(i, j int) bool {
+		a, b := r.items[i], r.items[j]
+		if ka, kb := kindRank(a.Kind), kindRank(b.Kind); ka != kb {
+			return ka < kb
+		}
+		if a.Branch != b.Branch {
+			return a.Branch < b.Branch
+		}
+		return a.Record < b.Record
+	})
+	return Owed{Items: r.items, Notes: r.notes, NextRenewal: r.nextRenewal, WakeBy: r.wakeBy, HandedBack: r.handed, Incomplete: r.incomplete}, nil
+}
+
+// owedReader is one ReadOwed's state.
+type owedReader struct {
+	ctx        context.Context
+	root, home string
+	now        time.Time
+	away       bool
+	email      string
+	person     string
+	rec        *Record
+
+	def     string // the default branch's full ref as last fetched
+	defName string // its branch name
+	defTip  string
+
+	branches map[string]*localBranch
+	mine     []claim.Reservation
+	list     listing
+	lanes    map[string]laneState
+
+	receiptsMinted bool
+	own            map[string]bool
+	stacks         *stackIndex       // read once, for diskStackBase
+	incomplete     bool              // the time budget ran out before everything was read
+	stackBase      map[string]string // a branch's base's tip on disk, for the hand-back
+
+	items       []OwedItem
+	handed      []OwedItem // handed back by a queued step, for the verdict to accept
+	nextRenewal time.Time  // the earliest renewal due among r.mine
+	wakeBy      time.Time  // the latest a wake may fire for r.mine (Owed.WakeBy)
+	notes       []string
+}
+
+type localBranch struct {
+	name, head   string
+	upstream     string
+	upstreamGone bool
+}
+
+type laneState struct {
+	key     string
+	reviews []laneReview
+}
+
+type laneReview struct {
+	head string
+	pass bool
+}
+
+func (r *owedReader) note(format string, a ...any) {
+	r.notes = append(r.notes, fmt.Sprintf(format, a...))
+}
+
+// git runs one git command bound to the check's context: past its deadline
+// git is killed and the call fails.
+func (r *owedReader) git(args ...string) (string, error) {
+	return gitutil.RunLimitedContext(r.ctx, r.root, 1<<20, args...)
+}
+
+// ancestor reports whether a is an ancestor of b; false when git cannot say,
+// the deadline passed included.
+func (r *owedReader) ancestor(a, b string) bool {
+	if a == "" || b == "" {
+		return false
+	}
+	_, err := r.git("merge-base", "--is-ancestor", a, b)
+	return err == nil
+}
+
+// expired reports whether the check's time budget has run out.
+func (r *owedReader) expired() bool { return r.ctx.Err() != nil }
+
+// ranOut marks the reading incomplete, once noting what was not read: the
+// verdict then allows the stop, naming it (spc-2610180914469489, "Diff review
+// round 1", major 6).
+func (r *owedReader) ranOut(what string) {
+	if !r.incomplete {
+		r.note("the check ran out of its time budget before reading %s", what)
+	}
+	r.incomplete = true
+}
+
+// readRefs reads the default branch as last fetched and every local branch
+// with its head and upstream.
+func (r *owedReader) readRefs() {
+	r.def = gitutil.DefaultRef(r.root)
+	switch {
+	case strings.HasPrefix(r.def, "refs/remotes/"):
+		parts := strings.SplitN(strings.TrimPrefix(r.def, "refs/remotes/"), "/", 2)
+		if len(parts) == 2 {
+			r.defName = parts[1]
+		}
+	case strings.HasPrefix(r.def, "refs/heads/"):
+		r.defName = strings.TrimPrefix(r.def, "refs/heads/")
+	}
+	if r.def != "" {
+		r.defTip, _ = r.git("rev-parse", "--verify", "--quiet", r.def+"^{commit}")
+		r.defTip = strings.TrimSpace(r.defTip)
+	}
+	r.branches = map[string]*localBranch{}
+	out, err := r.git("for-each-ref", "--format=%(refname:short)%00%(objectname)%00%(upstream)%00%(upstream:track)", "refs/heads")
+	if err != nil {
+		r.note("the local branches could not be listed")
+		return
+	}
+	for _, line := range strings.Split(out, "\n") {
+		f := strings.Split(line, "\x00")
+		if len(f) != 4 || f[0] == "" {
+			continue
+		}
+		r.branches[f[0]] = &localBranch{name: f[0], head: f[1], upstream: f[2], upstreamGone: strings.Contains(f[3], "gone")}
+	}
+}
+
+// readReservations keeps the live reservations under this copy's key.
+func (r *owedReader) readReservations(o ReadOptions) {
+	view := o.Reservations
+	if view == nil {
+		view = claim.View
+	}
+	snap, err := view(r.root, r.now)
+	if err != nil {
+		r.note("the reservations as last fetched could not be read")
+		return
+	}
+	for _, res := range snap.Reservations {
+		if res.Copy == claim.CopyThis && res.State == claim.StateLive {
+			r.mine = append(r.mine, res)
+		}
+	}
+}
+
+func (r *owedReader) liveMine(id string) bool {
+	for _, res := range r.mine {
+		if res.Record == id {
+			return true
+		}
+	}
+	return false
+}
+
+// receiptsMinted reports whether the repository mints preflight receipts: a
+// receipt folder exists in one of its worktrees.
+func receiptsMinted(root string) bool {
+	wts, err := gitutil.ListWorktrees(root, gitutil.MaxWorktreeListing)
+	if err != nil {
+		return false
+	}
+	for _, wt := range wts {
+		if wt.Bare {
+			continue
+		}
+		if fi, err := os.Lstat(filepath.Join(wt.Path, filepath.FromSlash(landing.ReceiptsRelDir))); err == nil && fi.IsDir() {
+			return true
+		}
+	}
+	return false
+}
+
+func (r *owedReader) hasReceipt(head string) bool {
+	if head == "" {
+		return false
+	}
+	p, err := landing.Receipt(r.root, head)
+	return err == nil && p != ""
+}
+
+// runIDRe is a run's directory name (loop.ValidRunID's shape).
+var runIDRe = regexp.MustCompile(`^run-[0-9]{16}$`)
+
+// runFile is what the owed reading needs of a run's state file, read
+// leniently: the loop owns the file, and this reads only its lanes.
+type runFile struct {
+	Key     string            `json:"key"`
+	Pending []json.RawMessage `json:"pending"`
+	Lanes   []struct {
+		Branch     string `json:"branch"`
+		Stage      string `json:"stage"`
+		Validation []struct {
+			HeadSHA    string `json:"head_sha"`
+			Validators []struct {
+				Pass bool `json:"pass"`
+			} `json:"validators"`
+		} `json:"validation"`
+	} `json:"lanes"`
+}
+
+const runRelDir = ".abcd/.work.local/run"
+
+// readLanes keeps the open lanes of every unfinished run in this copy's local
+// tier whose reservation is live under this copy's key.
+func (r *owedReader) readLanes() {
+	r.lanes = map[string]laneState{}
+	rt, err := os.OpenRoot(r.root)
+	if err != nil {
+		return
+	}
+	defer rt.Close()
+	entries, err := fs.ReadDir(rt.FS(), runRelDir)
+	if err != nil {
+		return
+	}
+	for _, e := range entries {
+		if !e.IsDir() || !runIDRe.MatchString(e.Name()) {
+			continue
+		}
+		raw, err := fsutil.ReadGuardedInRoot(rt, runRelDir+"/"+e.Name()+"/state.json", 8<<20)
+		if err != nil {
+			continue
+		}
+		var run runFile
+		if json.Unmarshal(raw, &run) != nil || !r.liveMine(run.Key) {
+			continue
+		}
+		finished := len(run.Pending) == 0
+		for _, l := range run.Lanes {
+			if l.Stage != "done" && l.Stage != "discarded" {
+				finished = false
+			}
+		}
+		if finished {
+			continue
+		}
+		for _, l := range run.Lanes {
+			if l.Branch == "" || l.Stage == "done" || l.Stage == "discarded" || l.Stage == "handed-back" {
+				continue
+			}
+			ls := laneState{key: run.Key}
+			for _, v := range l.Validation {
+				pass := len(v.Validators) > 0
+				for _, val := range v.Validators {
+					pass = pass && val.Pass
+				}
+				ls.reviews = append(ls.reviews, laneReview{head: v.HeadSHA, pass: pass})
+			}
+			r.lanes[l.Branch] = ls
+		}
+	}
+}
+
+// reflogBranches are the branches this working copy's HEAD reflog has
+// checked out, and the one checked out now.
+func (r *owedReader) reflogBranches() []string {
+	var out []string
+	if cur, err := r.git("symbolic-ref", "--quiet", "--short", "HEAD"); err == nil && strings.TrimSpace(cur) != "" {
+		out = append(out, strings.TrimSpace(cur))
+	}
+	log, err := r.git("reflog", "show", "-n", "5000", "--format=%gs", "HEAD", "--")
+	if err != nil {
+		return out
+	}
+	for _, line := range strings.Split(log, "\n") {
+		rest, ok := strings.CutPrefix(strings.TrimSpace(line), "checkout: moving from ")
+		if !ok {
+			continue
+		}
+		from, to, ok := strings.Cut(rest, " to ")
+		if !ok {
+			continue
+		}
+		out = append(out, from, to)
+	}
+	return out
+}
+
+// recordedBranches are the branches this copy's sessions created, as the
+// guard's pre-tool hook recorded them.
+func (r *owedReader) recordedBranches() []string {
+	key := claim.OwnCopyKey(r.root)
+	if key == "" || r.home == "" {
+		return nil
+	}
+	st, err := openStore(r.home, r.root)
+	if err != nil {
+		return nil
+	}
+	list, err := st.CreatedBranches(key)
+	if err != nil {
+		r.note("this copy's created-branch list could not be read (%s)", err)
+		return nil
+	}
+	var out []string
+	for _, b := range list {
+		out = append(out, b.Name)
+	}
+	return out
+}
+
+// authoredRecently reports whether branch holds, beyond the default branch, a
+// commit of this checkout's author email made or rewritten within
+// StaleWindow.
+func (r *owedReader) authoredRecently(b *localBranch) bool {
+	if r.email == "" {
+		return false
+	}
+	args := []string{"log", "-n", "200", "--format=%ae%x09%at%x09%ct", b.head}
+	if r.defTip != "" {
+		args = append(args, "--not", r.defTip)
+	}
+	out, err := r.git(append(args, "--")...)
+	if err != nil {
+		return false
+	}
+	cutoff := r.now.Add(-StaleWindow).Unix()
+	for _, line := range strings.Split(out, "\n") {
+		f := strings.Split(line, "\t")
+		if len(f) != 3 || !strings.EqualFold(f[0], r.email) {
+			continue
+		}
+		at, _ := strconv.ParseInt(f[1], 10, 64)
+		ct, _ := strconv.ParseInt(f[2], 10, 64)
+		if max(at, ct) >= cutoff {
+			return true
+		}
+	}
+	return false
+}
+
+// linksByName reports whether a branch's name carries the id of a live
+// reservation under this copy's key.
+func (r *owedReader) linksByName(branch string) bool {
+	for _, res := range r.mine {
+		if mentionsID(branch, res.Record) {
+			return true
+		}
+	}
+	return false
+}
+
+// prLinks reports whether p carries the work of the reservation id: the id in
+// its head branch's name or on a Resolves: or Delivers: line of its body, or
+// on a Refs: line when its head is already own.
+func (r *owedReader) prLinks(p pullRequest, id string, headOwn bool) bool {
+	if mentionsID(p.HeadRefName, id) || trailerMentions(p.Body, closingKeys, id) {
+		return true
+	}
+	return headOwn && trailerMentions(p.Body, refsKeys, id)
+}
+
+// findOwn names the session's own branches (dcn-2610180936568358,
+// dcn-2610181003463367): the reflog's and the recorded ones while live, the
+// live runs' lanes, and the heads of the person's open pull requests linked
+// to a live reservation under this copy's key; never the default branch, nor
+// a branch whose open pull request another person authored.
+func (r *owedReader) findOwn() {
+	r.own = map[string]bool{}
+	var linkedHeads []string
+	if r.list.read {
+		for _, p := range r.list.prs {
+			if p.IsCrossRepository || !r.list.authoredBy(p, r.person) {
+				continue
+			}
+			for _, res := range r.mine {
+				if r.prLinks(p, res.Record, false) {
+					linkedHeads = append(linkedHeads, p.HeadRefName)
+					break
+				}
+			}
+		}
+	}
+	linked := map[string]bool{}
+	for _, h := range linkedHeads {
+		linked[h] = true
+	}
+	reflog, recorded := r.reflogBranches(), r.recordedBranches()
+	isRecorded := map[string]bool{}
+	for _, n := range recorded {
+		isRecorded[n] = true
+	}
+	elsewhere := r.checkedOutElsewhere()
+	candidates := append(reflog, recorded...)
+	for i, name := range candidates {
+		b, ok := r.branches[name]
+		if !ok || r.own[name] {
+			continue
+		}
+		// A branch this copy only checked out once, which another worktree
+		// has checked out now, is that worktree's: sibling copies on one
+		// machine share the author email, so the email cannot tell. One
+		// this copy's sessions recorded creating, or a worktree they made
+		// for it, is still this copy's.
+		if elsewhere[name] && !isRecorded[name] && !linked[name] {
+			continue
+		}
+		if r.expired() {
+			r.ranOut(fmt.Sprintf("which branches are this copy's own (%d of %d not checked)", len(candidates)-i, len(candidates)))
+			break
+		}
+		if linked[name] || r.linksByName(name) || r.authoredRecently(b) {
+			r.own[name] = true
+		}
+	}
+	for name := range r.lanes {
+		if _, ok := r.branches[name]; ok {
+			r.own[name] = true
+		}
+	}
+	for _, h := range linkedHeads {
+		r.own[h] = true
+	}
+	delete(r.own, r.defName)
+	if r.list.read && !r.list.mine && r.person != "" {
+		for name := range r.own {
+			if p, ok := r.list.byHead(name, r.person); ok && !r.list.authoredBy(p, r.person) {
+				delete(r.own, name)
+			}
+		}
+	}
+}
+
+// checkedOutElsewhere are the branches a worktree other than this copy has
+// checked out.
+func (r *owedReader) checkedOutElsewhere() map[string]bool {
+	out := map[string]bool{}
+	wts, err := gitutil.ListWorktrees(r.root, gitutil.MaxWorktreeListing)
+	if err != nil {
+		return out
+	}
+	here, _ := os.Stat(r.root)
+	for _, wt := range wts {
+		name, ok := strings.CutPrefix(wt.Branch, "refs/heads/")
+		if !ok {
+			continue
+		}
+		if fi, err := os.Stat(wt.Path); err == nil && here != nil && os.SameFile(fi, here) {
+			continue
+		}
+		out[name] = true
+	}
+	return out
+}
+
+func (r *owedReader) ownNames() []string {
+	names := make([]string, 0, len(r.own))
+	for n := range r.own {
+		names = append(names, n)
+	}
+	sort.Strings(names)
+	return names
+}
+
+// fetchedAt names when the default branch was last fetched.
+func (r *owedReader) fetchedAt() string {
+	if r.def != "" {
+		if out, err := r.git("reflog", "show", "-n", "1", "--format=%ct", r.def, "--"); err == nil {
+			if s, err := strconv.ParseInt(strings.TrimSpace(out), 10, 64); err == nil && s > 0 {
+				return showTime(time.Unix(s, 0))
+			}
+		}
+	}
+	if t := claim.LastFetched(r.root); !t.IsZero() {
+		return showTime(t)
+	}
+	return "an unknown time"
+}
+
+// stackWalk bounds how far back diskStackBase looks in a branch's own
+// history (its commits not in the last-fetched default branch).
+const stackWalk = 1000
+
+// stackIndex is what diskStackBase reads once a check, so finding every own
+// branch's base takes a fixed number of git calls a branch rather than one a
+// pair: the own branches by their current head, and by each tip their reflog
+// set other than by creating the branch.
+type stackIndex struct {
+	heads map[string][]string // a commit -> the own branches whose head it is
+	tips  map[string][]string // a commit -> the own branches it was a set tip of
+}
+
+func (r *owedReader) stackIdx() *stackIndex {
+	if r.stacks != nil {
+		return r.stacks
+	}
+	idx := &stackIndex{heads: map[string][]string{}, tips: map[string][]string{}}
+	for _, name := range r.ownNames() {
+		c, ok := r.branches[name]
+		if !ok || r.expired() {
+			continue
+		}
+		idx.heads[c.head] = append(idx.heads[c.head], name)
+		out, err := r.git("reflog", "show", "-n", "1000", "--format=%H%x09%gs", "refs/heads/"+name, "--")
+		if err != nil {
+			continue
+		}
+		seen := map[string]bool{}
+		for _, line := range strings.Split(out, "\n") {
+			h, msg, _ := strings.Cut(line, "\t")
+			if h == "" || seen[h] || strings.HasPrefix(msg, "branch: Created from") {
+				continue
+			}
+			seen[h] = true
+			idx.tips[h] = append(idx.tips[h], name)
+		}
+	}
+	r.stacks = idx
+	return idx
+}
+
+// diskStackBase is the nearest other own branch whose tip is in b's own
+// history (an ancestor of b's head not in the last-fetched default branch),
+// or nil. A base that has moved on since b was cut no longer has its tip
+// there, so it is found too by a commit of b's own history that was the
+// other branch's tip (its reflog set it there other than by creating the
+// branch, which tells the base from a branch cut from it) and is still in
+// its history. One walk of b's own history, newest first in topological
+// order, finds the nearest; the reflogs are read once a check (stackIdx).
+func (r *owedReader) diskStackBase(b *localBranch) *localBranch {
+	args := []string{"rev-list", "--topo-order", "-n", strconv.Itoa(stackWalk), b.head}
+	if r.defTip != "" {
+		args = append(args, "--not", r.defTip)
+	}
+	out, err := r.git(append(args, "--")...)
+	if err != nil {
+		return nil
+	}
+	idx := r.stackIdx()
+	pick := func(names []string) *localBranch {
+		for _, n := range names {
+			if c, ok := r.branches[n]; ok && n != b.name && c.head != b.head {
+				return c
+			}
+		}
+		return nil
+	}
+	history := strings.Fields(out)
+	for _, h := range history {
+		if c := pick(idx.heads[h]); c != nil {
+			return c
+		}
+	}
+	for _, h := range history {
+		if h == b.head {
+			continue
+		}
+		for _, n := range idx.tips[h] {
+			c, ok := r.branches[n]
+			if !ok || n == b.name || r.ancestor(b.head, c.head) || !r.ancestor(h, c.head) {
+				continue
+			}
+			return c
+		}
+	}
+	return nil
+}
+
+// baseTipOnDisk is a base branch's tip as it stands on disk: the local branch,
+// else its remote-tracking ref.
+func (r *owedReader) baseTipOnDisk(base string) string {
+	if b, ok := r.branches[base]; ok {
+		return b.head
+	}
+	out, err := r.git("rev-parse", "--verify", "--quiet", "refs/remotes/origin/"+base+"^{commit}")
+	if err != nil {
+		return ""
+	}
+	return strings.TrimSpace(out)
+}
+
+func (r *owedReader) lanePassed(branch, head string) (isLane, passed bool) {
+	ls, ok := r.lanes[branch]
+	if !ok {
+		return false, false
+	}
+	for _, v := range ls.reviews {
+		if v.head == head && v.pass {
+			return true, true
+		}
+	}
+	return true, false
+}
+
+func (r *owedReader) add(i OwedItem) { r.items = append(r.items, i) }
+
+// branchItems judges each own branch: failing and behind pull requests,
+// stacked branches by the clearing rule, and unpushed commits.
+func (r *owedReader) branchItems() {
+	r.stackBase = map[string]string{}
+	names := r.ownNames()
+	for i, name := range names {
+		if r.expired() {
+			r.ranOut(fmt.Sprintf("%d of %d own branches (from %s on)", len(names)-i, len(names), name))
+			return
+		}
+		b := r.branches[name]
+		head := ""
+		if b != nil {
+			head = b.head
+		}
+		var p pullRequest
+		hasPR := false
+		if r.away && r.list.read {
+			p, hasPR = r.list.byHead(name, r.person)
+			if hasPR && head == "" {
+				head = p.HeadRefOid
+			}
+		}
+		if r.away {
+			r.forgeItems(name, b, head, p, hasPR)
+		}
+		if b != nil && r.unpushed(b) {
+			r.add(OwedItem{Kind: OwedUnpushed, Capped: true, Branch: name, Head: head,
+				Reason: fmt.Sprintf("branch %s has commits not pushed", name)})
+		}
+	}
+}
+
+// forgeItems is the away half of a branch's judgement.
+func (r *owedReader) forgeItems(name string, b *localBranch, head string, p pullRequest, hasPR bool) {
+	// Stacked: its pull request's base is not the default branch, or, with no
+	// pull request read, its nearest own ancestor branch is not in the
+	// default branch.
+	base, baseTip := "", ""
+	switch {
+	case hasPR && p.BaseRefName != "" && p.BaseRefName != r.defName:
+		base, baseTip = p.BaseRefName, r.baseTipOnDisk(p.BaseRefName)
+	case !hasPR && b != nil:
+		if sb := r.diskStackBase(b); sb != nil {
+			base, baseTip = sb.name, sb.head
+		}
+	}
+	if base != "" {
+		r.stackBase[name] = baseTip
+		r.stacked(name, head, base, baseTip, p, hasPR)
+		return
+	}
+	if hasPR {
+		if p.checks() == checksFailing {
+			r.add(OwedItem{Kind: OwedFailing, Capped: true, Branch: name, PR: p.Number, Head: head,
+				Reason: fmt.Sprintf("pull request #%d (%s) is failing its checks: fix them", p.Number, name)})
+		}
+		switch strings.ToUpper(p.MergeStateStatus) {
+		case "BEHIND":
+			r.add(OwedItem{Kind: OwedBehind, Capped: true, Branch: name, PR: p.Number, Head: head,
+				Reason: fmt.Sprintf("pull request #%d (%s) is behind its base: merge it in", p.Number, name)})
+		case "DIRTY":
+			r.add(OwedItem{Kind: OwedBehind, Capped: true, Branch: name, PR: p.Number, Head: head,
+				Reason: fmt.Sprintf("pull request #%d (%s) conflicts with its base: merge it in and resolve the conflicts", p.Number, name)})
+		case "UNKNOWN", "":
+			r.note("the merge state of pull request #%d (%s) was not read (the forge has not computed it)", p.Number, name)
+		}
+		return
+	}
+	// The listing failed: a pushed branch is compared on disk with the
+	// last-fetched default branch, naming when it was fetched.
+	if !r.list.read && b != nil && b.upstream != "" && !b.upstreamGone && r.defTip != "" && !r.ancestor(r.defTip, b.head) {
+		r.add(OwedItem{Kind: OwedBehind, Capped: true, Branch: name, Head: head,
+			Reason: fmt.Sprintf("%s is behind %s as last fetched (fetched %s), compared on disk because the pull requests were not read: merge it in",
+				name, gitutil.ShortRef(r.def), r.fetchedAt())})
+	}
+}
+
+// stacked applies the clearing rule (dcn-2610180936571036,
+// dcn-2610181003488355): a branch stacked on a change still open is owed while
+// it is behind its base, failing, with a review outstanding, or not verified;
+// otherwise only its landing waits for its base.
+func (r *owedReader) stacked(name, head, base, baseTip string, p pullRequest, hasPR bool) {
+	var needs []string
+	capped := false
+	need := func(what string, forgeOnly bool) {
+		needs = append(needs, what)
+		capped = capped || !forgeOnly
+	}
+	notVerified := ""
+	checks := checksNone
+	if hasPR {
+		checks = p.checks()
+		switch strings.ToUpper(p.MergeStateStatus) {
+		case "BEHIND", "DIRTY":
+			need("the merge from its base", false)
+		case "UNKNOWN", "":
+			r.note("the merge state of pull request #%d (%s) was not read (the forge has not computed it)", p.Number, name)
+		}
+		if checks == checksFailing {
+			need("the fixes for its failing checks", false)
+		}
+		if strings.EqualFold(p.ReviewDecision, "CHANGES_REQUESTED") {
+			need("the review (changes are requested)", false)
+		}
+	} else if baseTip != "" && !r.ancestor(baseTip, head) {
+		need(fmt.Sprintf("the merge from its base (%s as it stands on disk)", base), false)
+	}
+	if isLane, passed := r.lanePassed(name, head); isLane && !passed {
+		need("the review of its head", false)
+	}
+	switch {
+	case r.receiptsMinted:
+		if !r.hasReceipt(head) {
+			need("the preflight (no receipt names its head)", false)
+		}
+	case hasPR && checks == checksPending:
+		need("its checks, still running", true)
+	case hasPR && checks == checksNone:
+		need("verification (no checks reported, and no receipts are minted here)", false)
+	case !hasPR:
+		notVerified = "it was not verified: no receipts are minted here and it has no pull request read"
+	}
+	if len(needs) == 0 {
+		if notVerified != "" {
+			r.note("%s is waiting on its base %s; %s", name, base, notVerified)
+		}
+		return
+	}
+	reason := fmt.Sprintf("%s is stacked on %s, still open, and needs now: %s; only its landing waits for its base",
+		name, base, strings.Join(needs, ", "))
+	if notVerified != "" {
+		reason += "; " + notVerified
+	}
+	r.add(OwedItem{Kind: OwedStacked, Capped: capped, Branch: name, PR: p.Number, Head: head, Reason: reason})
+}
+
+// unpushed reports whether b holds commits not on its upstream, or, with no
+// upstream configured, not in any remote-tracking ref and not already landed
+// in the default branch (r.landed). A branch whose upstream is gone never
+// counts.
+func (r *owedReader) unpushed(b *localBranch) bool {
+	if b.upstream != "" {
+		if b.upstreamGone {
+			return false
+		}
+		out, err := r.git("rev-list", "--count", b.upstream+".."+b.head, "--")
+		n, _ := strconv.Atoi(strings.TrimSpace(out))
+		return err == nil && n > 0
+	}
+	out, err := r.git("rev-list", "-n", "1", b.head, "--not", "--remotes", "--")
+	if err != nil || strings.TrimSpace(out) == "" {
+		return false
+	}
+	switch r.landed(b) {
+	case landedYes:
+		return false
+	case landedUnknown:
+		if r.expired() {
+			r.ranOut("whether " + b.name + " has landed")
+			return false
+		}
+		r.note("%s has commits in no remote branch and no upstream, and could not be told landed in %s or not (there is no default branch to compare with, or its change conflicts with it and its commits' patches are not all there), so it is not counted as unpushed",
+			b.name, r.defLabel())
+		return false
+	}
+	return true
+}
+
+// landedness is whether a branch's work is already in the default branch.
+type landedness int
+
+const (
+	landedNo landedness = iota
+	landedYes
+	landedUnknown
+)
+
+// maxLandedOutput bounds the merge and patch reads of r.landed.
+const maxLandedOutput = 1 << 20
+
+// landed decides whether a branch with no upstream and commits in no remote
+// branch has nonetheless landed in the default branch as last fetched: the
+// usual shape of a branch pushed without -u, squash- or rebase-merged, and
+// its remote branch deleted and pruned. Merging it into the default branch
+// (`merge-tree --write-tree`, writing nothing, with the repository's merge
+// drivers replaced by git's built-in merge, as the conflict probe pins them)
+// changing nothing is landed, which covers a squash of several commits; a
+// clean merge that changes the tree is not landed. A merge that conflicts,
+// or fails, falls to `git cherry`: every commit already upstream by patch id
+// ('-' lines only) is landed, which covers a single commit main has edited
+// over since; otherwise it cannot be told. No default branch to compare with
+// cannot be told either.
+func (r *owedReader) landed(b *localBranch) landedness {
+	if r.defTip == "" || r.expired() {
+		return landedUnknown
+	}
+	if overrides, err := gitutil.MergeDriverOverrides(r.root); err == nil {
+		args := append(overrides, "-c", "merge.union.driver="+gitutil.BuiltinMergeDriver(), "-c", "merge.renormalize=false",
+			"merge-tree", "--write-tree", "--name-only", "--no-messages", "-z", r.defTip, b.head)
+		out, conflicted, err := gitutil.RunCappedExitOne(r.root, maxLandedOutput, args...)
+		if err == nil && !conflicted {
+			tree, _, _ := strings.Cut(string(out), "\x00")
+			tree = strings.TrimSpace(tree)
+			defTree, terr := r.git("rev-parse", "--verify", "--quiet", r.defTip+"^{tree}")
+			if gitutil.IsFullSHA(tree) && terr == nil {
+				if tree == strings.TrimSpace(defTree) {
+					return landedYes
+				}
+				return landedNo
+			}
+		}
+	}
+	out, err := gitutil.RunLimitedContext(r.ctx, r.root, maxLandedOutput, "cherry", r.defTip, b.head)
+	if err != nil {
+		return landedUnknown
+	}
+	lines := 0
+	for _, line := range strings.Split(out, "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		lines++
+		if !strings.HasPrefix(line, "- ") {
+			return landedUnknown
+		}
+	}
+	if lines == 0 {
+		return landedUnknown
+	}
+	return landedYes
+}
+
+// defLabel names the default branch as last fetched, for a note.
+func (r *owedReader) defLabel() string {
+	if r.def == "" {
+		return "the default branch"
+	}
+	return gitutil.ShortRef(r.def) + " as last fetched"
+}
+
+// reservationItems judges this copy's live reservations: a renewal due
+// halfway between the latest claim or renewal and the expiry, and, while away
+// with the listing read, work no open pull request carries (a release
+// subject, which no pull request carries, aside).
+func (r *owedReader) reservationItems() {
+	for _, res := range r.mine {
+		half := res.ClaimedAt.Add(res.EffectiveExpiry.Sub(res.ClaimedAt) / 2)
+		if r.nextRenewal.IsZero() || half.Before(r.nextRenewal) {
+			r.nextRenewal = half
+		}
+		need := half
+		if !r.now.Before(half) {
+			need = res.EffectiveExpiry
+		}
+		if r.wakeBy.IsZero() || need.Before(r.wakeBy) {
+			r.wakeBy = need
+		}
+		if !r.now.Before(half) {
+			r.add(OwedItem{Kind: OwedRenewal, Record: res.Record,
+				Reason: fmt.Sprintf("the reservation of %s is due for renewal (it lapses %s): renew it with `abcd reserve %s`",
+					res.Record, showTime(res.EffectiveExpiry), shellWord(res.Record))})
+		}
+		if !r.away || !r.list.read || strings.HasPrefix(res.Record, "rel-") {
+			continue
+		}
+		carried := false
+		for _, p := range r.list.prs {
+			// Only a pull request findOwn would count carries: in this
+			// repository, and the person's.
+			if p.IsCrossRepository || !r.list.authoredBy(p, r.person) {
+				continue
+			}
+			if r.prLinks(p, res.Record, r.own[p.HeadRefName]) {
+				carried = true
+				break
+			}
+		}
+		if !carried && !r.list.truncated {
+			r.add(OwedItem{Kind: OwedUncarried, Capped: true, Record: res.Record,
+				Reason: fmt.Sprintf("no open pull request carries the work of %s yet: finish it and open one", res.Record)})
+		}
+	}
+}
+
+// handBack is the one hand-back (dcn-2610181035355741): only with
+// --hold-pushes, a queued step naming an own branch hands back that branch's
+// unpushed item, while its head contains its base's last-fetched tip and a
+// preflight receipt names it where the repository mints receipts. Each is
+// moved from the owed items to r.handed for the verdict, which accepts it;
+// the stop hook records what the verdict accepted, once per branch and head,
+// so the reader records nothing.
+func (r *owedReader) handBack() {
+	if !r.away || !r.rec.HoldPushes || len(r.rec.Queue) == 0 || !r.receiptsMinted {
+		return
+	}
+	kept := r.items[:0]
+	for _, it := range r.items {
+		if it.Kind != OwedUnpushed || !r.queued(it.Branch) {
+			kept = append(kept, it)
+			continue
+		}
+		baseTip := r.defTip
+		if t, ok := r.stackBase[it.Branch]; ok {
+			baseTip = t
+		}
+		if baseTip == "" || !r.ancestor(baseTip, it.Head) || !r.hasReceipt(it.Head) {
+			kept = append(kept, it)
+			continue
+		}
+		r.handed = append(r.handed, it)
+	}
+	r.items = kept
+}
+
+// queued reports whether a queued step names branch as a whole name.
+func (r *owedReader) queued(branch string) bool {
+	for _, q := range r.rec.Queue {
+		if namesBranch(q.Step, branch) {
+			return true
+		}
+	}
+	return false
+}
+
+// mentionsID reports whether text names the record id on word boundaries:
+// iss-5 is never found in iss-50, and is found in feat/iss-5-x.
+func mentionsID(text, id string) bool {
+	if id == "" {
+		return false
+	}
+	return regexp.MustCompile(`(?:^|[^A-Za-z0-9])` + regexp.QuoteMeta(id) + `(?:$|[^A-Za-z0-9])`).MatchString(text)
+}
+
+// namesBranch reports whether text names branch as a whole name: the
+// characters around it cannot continue a branch name, so feat/p is never
+// found in feat/p-2 or feat/p2.
+func namesBranch(text, branch string) bool {
+	if branch == "" {
+		return false
+	}
+	return regexp.MustCompile(`(?:^|[^A-Za-z0-9._/-])` + regexp.QuoteMeta(branch) + `(?:$|[^A-Za-z0-9._/-]|[.](?:$|\s))`).MatchString(text)
+}
+
+var (
+	closingKeys = []string{"resolves", "delivers"}
+	refsKeys    = []string{"refs"}
+)
+
+// trailerMentions reports whether body has a line keyed by one of keys
+// (`Resolves: …`, any case) naming id on word boundaries.
+func trailerMentions(body string, keys []string, id string) bool {
+	for _, line := range strings.Split(body, "\n") {
+		k, v, ok := strings.Cut(strings.TrimSpace(line), ":")
+		if !ok {
+			continue
+		}
+		for _, want := range keys {
+			if strings.EqualFold(strings.TrimSpace(k), want) && mentionsID(v, id) {
+				return true
+			}
+		}
+	}
+	return false
+}
diff --git a/internal/core/autonomy/owedread_test.go b/internal/core/autonomy/owedread_test.go
new file mode 100644
index 0000000000..bc3e8086c1
--- /dev/null
+++ b/internal/core/autonomy/owedread_test.go
@@ -0,0 +1,1278 @@
+package autonomy
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/core/claim"
+	"github.com/intentdriven/abcd/internal/ghcontract"
+	"github.com/intentdriven/abcd/internal/gittest"
+)
+
+const fixtureEmail = "fixture@example.invalid"
+
+// fakePR is one open pull request the fake forge lists, in the shape `gh pr
+// list --json` prints it.
+type fakePR struct {
+	Number            int              `json:"number"`
+	HeadRefName       string           `json:"headRefName"`
+	HeadRefOid        string           `json:"headRefOid"`
+	BaseRefName       string           `json:"baseRefName"`
+	Author            map[string]any   `json:"author"`
+	Body              string           `json:"body"`
+	MergeStateStatus  string           `json:"mergeStateStatus"`
+	ReviewDecision    string           `json:"reviewDecision"`
+	StatusCheckRollup []map[string]any `json:"statusCheckRollup"`
+	IsCrossRepository bool             `json:"isCrossRepository"`
+}
+
+var (
+	rollupGreen   = []map[string]any{{"__typename": "CheckRun", "name": "ci", "status": "COMPLETED", "conclusion": "SUCCESS"}}
+	rollupFailing = []map[string]any{{"__typename": "CheckRun", "name": "ci", "status": "COMPLETED", "conclusion": "FAILURE"}}
+	rollupRunning = []map[string]any{{"__typename": "CheckRun", "name": "ci", "status": "IN_PROGRESS", "conclusion": ""}}
+)
+
+func pr(n int, head, base, author string) fakePR {
+	return fakePR{Number: n, HeadRefName: head, BaseRefName: base, Author: map[string]any{"login": author},
+		MergeStateStatus: "CLEAN", StatusCheckRollup: rollupGreen}
+}
+
+// fakeForge answers the one listing a stop check makes, refusing a field the
+// real forge client refuses (internal/ghcontract).
+type fakeForge struct {
+	t     *testing.T
+	mu    sync.Mutex
+	prs   []fakePR
+	calls int
+	hang  bool
+	err   error
+	ctxs  []context.Context
+}
+
+func (f *fakeForge) run(ctx context.Context, dir string, args ...string) (string, error) {
+	f.mu.Lock()
+	f.calls++
+	f.ctxs = append(f.ctxs, ctx)
+	f.mu.Unlock()
+	if err := ghcontract.Check(args); err != nil {
+		f.t.Errorf("the listing asks the forge for a field it refuses: %v", err)
+		return "", err
+	}
+	if len(args) < 2 || args[0] != "pr" || args[1] != "list" {
+		f.t.Errorf("the stop check's one forge call is a pull-request listing; got %v", args)
+	}
+	if f.hang {
+		<-ctx.Done()
+		return "", ctx.Err()
+	}
+	if f.err != nil {
+		return "", f.err
+	}
+	raw, err := json.Marshal(f.prs)
+	return string(raw), err
+}
+
+// fx is a managed checkout with an origin, the default branch pushed and
+// fetched, a fake forge and the reservations as last fetched.
+type fx struct {
+	t      *testing.T
+	repo   *gittest.Repo
+	root   string
+	home   string
+	origin string
+	now    time.Time
+	forge  *fakeForge
+	res    []claim.Reservation
+	email  string
+	files  int // the files commitOn has added, for the next one's name
+}
+
+func newFx(t *testing.T) *fx {
+	t.Helper()
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	repo := gittest.NewRepo(t)
+	repo.Commit("seed")
+	root, err := filepath.EvalSymlinks(repo.Root())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(filepath.Join(root, ".abcd", ".work.local"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	f := &fx{t: t, repo: repo, root: root, home: home, now: time.Now().Truncate(time.Second), email: fixtureEmail}
+	f.forge = &fakeForge{t: t}
+	f.origin = filepath.Join(t.TempDir(), "origin.git")
+	gittest.InitBare(t, f.origin)
+	f.git("remote", "add", "origin", f.origin)
+	f.git("push", "-q", "origin", "main")
+	f.git("remote", "set-head", "origin", "main")
+	return f
+}
+
+func (f *fx) git(args ...string) string { f.t.Helper(); return f.repo.Git(args...) }
+
+// gitIn runs git in the fixture with stdin, under the fixture's isolated
+// environment.
+func (f *fx) gitIn(stdin string, args ...string) string {
+	f.t.Helper()
+	cmd := exec.Command("git", append([]string{"-C", f.root}, args...)...)
+	cmd.Env = f.repo.Env()
+	cmd.Stdin = strings.NewReader(stdin)
+	out, err := cmd.Output()
+	if err != nil {
+		f.t.Fatalf("git %v: %v", args, err)
+	}
+	return strings.TrimSpace(string(out))
+}
+
+// treeWith is branch's tree with one file added, written to the object store.
+func (f *fx) treeWith(branch, name, content string) string {
+	f.t.Helper()
+	blob := f.gitIn(content, "hash-object", "-w", "--stdin")
+	entries := f.git("ls-tree", branch+"^{tree}")
+	if entries != "" {
+		entries += "\n"
+	}
+	return f.gitIn(entries+"100644 blob "+blob+"\t"+name+"\n", "mktree")
+}
+
+// commitOn records a commit on branch without checking it out, by author
+// (the fixture's own when ""), and returns it. The commit adds a file of its
+// own, so its change is real: a commit that changes nothing has, by
+// definition, already landed wherever its branch is merged.
+func (f *fx) commitOn(branch, msg, author string) string {
+	f.t.Helper()
+	f.files++
+	tree := f.treeWith(branch, fmt.Sprintf("f-%d.txt", f.files), msg+"\n")
+	args := []string{}
+	if author != "" {
+		args = append(args, "-c", "user.email="+author, "-c", "user.name="+strings.Split(author, "@")[0])
+	}
+	args = append(args, "commit-tree", tree, "-p", branch, "-m", msg)
+	c := f.git(args...)
+	f.git("update-ref", "refs/heads/"+branch, c)
+	return c
+}
+
+// own checks branch out in this copy and back, so its HEAD reflog holds it.
+func (f *fx) own(branch string) {
+	f.t.Helper()
+	f.git("checkout", "-q", branch)
+	f.git("checkout", "-q", "main")
+}
+
+func (f *fx) push(branch string) { f.t.Helper(); f.git("push", "-q", "-u", "origin", branch) }
+
+func (f *fx) head(branch string) string {
+	f.t.Helper()
+	return f.git("rev-parse", "refs/heads/"+branch)
+}
+
+func (f *fx) mintReceipts() string {
+	f.t.Helper()
+	dir := filepath.Join(f.root, ".abcd", ".work.local", "preflight-receipts")
+	if err := os.MkdirAll(dir, 0o700); err != nil {
+		f.t.Fatal(err)
+	}
+	return dir
+}
+
+func (f *fx) receipt(sha string) {
+	f.t.Helper()
+	if err := os.WriteFile(filepath.Join(f.mintReceipts(), sha), []byte("ok\n"), 0o600); err != nil {
+		f.t.Fatal(err)
+	}
+}
+
+func (f *fx) reserve(id, copy string, claimed, expiry time.Time) {
+	f.res = append(f.res, claim.Reservation{Record: id, Copy: copy, State: claim.StateLive, ClaimedAt: claimed, EffectiveExpiry: expiry})
+}
+
+// reserveFresh is a live reservation under this copy's key, claimed an hour
+// ago with a four-hour lease, so its renewal is not due.
+func (f *fx) reserveFresh(id string) {
+	f.reserve(id, claim.CopyThis, f.now.Add(-time.Hour), f.now.Add(3*time.Hour))
+}
+
+func (f *fx) opts() ReadOptions {
+	return ReadOptions{
+		Root:   f.root,
+		Home:   f.home,
+		Now:    func() time.Time { return f.now },
+		Forge:  f.forge.run,
+		Person: "alice",
+		Email:  f.email,
+		Reservations: func(string, time.Time) (claim.Snapshot, error) {
+			return claim.Snapshot{Reservations: f.res}, nil
+		},
+	}
+}
+
+func (f *fx) awayRecord(hold bool, steps ...string) *Record {
+	f.t.Helper()
+	o := Options{Home: f.home, Now: func() time.Time { return f.now }, Who: func(string) string { return "alice" }}
+	rec, err := SetAway(f.root, "", hold, o)
+	if err != nil {
+		f.t.Fatal(err)
+	}
+	for _, s := range steps {
+		if rec, err = QueueStep(f.root, s, o); err != nil {
+			f.t.Fatal(err)
+		}
+	}
+	return rec
+}
+
+// read is ReadOwed while away (with a fresh away record) or present.
+func (f *fx) read(away bool) Owed {
+	f.t.Helper()
+	o := f.opts()
+	if away {
+		o.Record = f.awayRecord(false)
+	}
+	return f.readWith(o)
+}
+
+func (f *fx) readWith(o ReadOptions) Owed {
+	f.t.Helper()
+	owed, err := ReadOwed(context.Background(), o)
+	if err != nil {
+		f.t.Fatal(err)
+	}
+	return owed
+}
+
+func has(o Owed, kind OwedKind, key string) bool {
+	_, ok := find(o, kind, key)
+	return ok
+}
+
+func find(o Owed, kind OwedKind, key string) (OwedItem, bool) {
+	for _, i := range o.Items {
+		if i.Kind == kind && (i.Branch == key || i.Record == key) {
+			return i, true
+		}
+	}
+	return OwedItem{}, false
+}
+
+func describe(o Owed) string {
+	var b strings.Builder
+	for _, i := range o.Items {
+		b.WriteString(string(i.Kind) + ":" + i.Branch + i.Record + " ")
+	}
+	b.WriteString("notes=" + strings.Join(o.Notes, " | "))
+	return b.String()
+}
+
+// TestOwnBranchFromReflogWithoutWindow: a branch checked out before the mode
+// was set, with a recent commit of this checkout's, is still own.
+func TestOwnBranchFromReflogWithoutWindow(t *testing.T) {
+	f := newFx(t)
+	f.git("branch", "feat/a")
+	f.commitOn("feat/a", "work", "")
+	f.push("feat/a")
+	f.own("feat/a")
+	f.now = f.now.Add(6 * time.Hour) // the mode is set long after the checkout
+	p := pr(1, "feat/a", "main", "alice")
+	p.MergeStateStatus = "BEHIND"
+	f.forge.prs = []fakePR{p}
+	owed := f.read(true)
+	if it, ok := find(owed, OwedBehind, "feat/a"); !ok || it.PR != 1 || !it.Capped {
+		t.Fatalf("the branch checked out before the window must be own and owed as behind: %s", describe(owed))
+	}
+}
+
+// TestOwnBranchFromRecordedCreation: a branch cut with `git worktree add -b`,
+// absent from this copy's reflog, with no upstream and no record id, is own
+// once recorded.
+func TestOwnBranchFromRecordedCreation(t *testing.T) {
+	f := newFx(t)
+	wt := filepath.Join(t.TempDir(), "s")
+	f.git("worktree", "add", "-q", "-b", "feat/s", wt)
+	if err := os.WriteFile(filepath.Join(wt, "s.txt"), []byte("stacked\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	f.git("-C", wt, "add", "s.txt")
+	f.git("-C", wt, "commit", "-q", "-m", "stacked work")
+	if owed := f.read(false); has(owed, OwedUnpushed, "feat/s") {
+		t.Fatalf("an unrecorded branch in another worktree is not own: %s", describe(owed))
+	}
+	st, err := openStore(f.home, f.root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	key, err := claim.CopyKey(f.root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := st.RecordBranches(key, []BranchChange{{Kind: BranchCreated, Name: "feat/s"}}, f.now); err != nil {
+		t.Fatal(err)
+	}
+	if owed := f.read(false); !has(owed, OwedUnpushed, "feat/s") {
+		t.Fatalf("a recorded creation is own, and its unpushed commit owed: %s", describe(owed))
+	}
+}
+
+// writeRun lays a run state in this copy's local tier: key, its lanes'
+// branches and stages, and whether a spec step is still pending.
+func (f *fx) writeRun(id, key string, pending bool, lanes ...map[string]any) {
+	f.t.Helper()
+	dir := filepath.Join(f.root, ".abcd", ".work.local", "run", id)
+	if err := os.MkdirAll(dir, 0o700); err != nil {
+		f.t.Fatal(err)
+	}
+	st := map[string]any{"schema_version": 9, "run_id": id, "key": key, "lanes": lanes, "pending": []any{}}
+	if pending {
+		st["pending"] = []any{map[string]any{"spec_step": 2}}
+	}
+	raw, _ := json.Marshal(st)
+	if err := os.WriteFile(filepath.Join(dir, "state.json"), raw, 0o600); err != nil {
+		f.t.Fatal(err)
+	}
+}
+
+// TestOwnBranchFromLiveRunLane: a lane of a run whose reservation is live
+// under this copy's key is own; a lane of a run whose reservation lapsed, or
+// of a finished run, is not.
+func TestOwnBranchFromLiveRunLane(t *testing.T) {
+	f := newFx(t)
+	f.git("branch", "feat/lane")
+	f.commitOn("feat/lane", "lane work", "bob@example.invalid")
+	f.writeRun("run-0000000000000001", "itd-1", false, map[string]any{"id": "lane-1", "branch": "feat/lane", "stage": "validate"})
+	f.reserveFresh("itd-1")
+	if owed := f.read(false); !has(owed, OwedUnpushed, "feat/lane") {
+		t.Fatalf("a live run's lane is own: %s", describe(owed))
+	}
+	f.res[0].State = claim.StateExpired
+	if owed := f.read(false); has(owed, OwedUnpushed, "feat/lane") {
+		t.Fatalf("a lane whose run's reservation lapsed is not own: %s", describe(owed))
+	}
+	f.res[0].State = claim.StateLive
+	f.writeRun("run-0000000000000001", "itd-1", false, map[string]any{"id": "lane-1", "branch": "feat/lane", "stage": "done"})
+	if owed := f.read(false); has(owed, OwedUnpushed, "feat/lane") {
+		t.Fatalf("a finished run's lane is not own: %s", describe(owed))
+	}
+}
+
+// TestOwnBranchFromLinkedReservation: the head branch of an open pull request
+// a closing trailer links to a reservation under this copy's key is own.
+func TestOwnBranchFromLinkedReservation(t *testing.T) {
+	f := newFx(t)
+	f.reserveFresh("iss-7")
+	p := pr(3, "fix/other", "main", "alice")
+	p.Body = "Fixes the thing.\n\nResolves: iss-7\nAssisted-by: x"
+	p.StatusCheckRollup = rollupFailing
+	f.forge.prs = []fakePR{p}
+	owed := f.read(true)
+	if it, ok := find(owed, OwedFailing, "fix/other"); !ok || it.PR != 3 {
+		t.Fatalf("the linked pull request's head is own, and failing is owed: %s", describe(owed))
+	}
+	if has(owed, OwedUncarried, "iss-7") {
+		t.Fatalf("the linked pull request carries the reservation's work: %s", describe(owed))
+	}
+}
+
+// TestStaleOwnBranchNotOwed: a reflog or recorded branch whose newest commit
+// of this checkout's is older than 14 days, with no live reservation, is not
+// owed; a live reservation linking it keeps it owed.
+func TestStaleOwnBranchNotOwed(t *testing.T) {
+	f := newFx(t)
+	f.git("branch", "feat/old")
+	f.commitOn("feat/old", "old work", "")
+	f.own("feat/old")
+	f.git("branch", "feat/iss-9-old")
+	f.commitOn("feat/iss-9-old", "old linked work", "")
+	f.own("feat/iss-9-old")
+	f.now = f.now.Add(20 * 24 * time.Hour)
+	f.reserveFresh("iss-9")
+	owed := f.read(false)
+	if has(owed, OwedUnpushed, "feat/old") {
+		t.Fatalf("a branch with no commit of this checkout's in 14 days is not owed: %s", describe(owed))
+	}
+	if !has(owed, OwedUnpushed, "feat/iss-9-old") {
+		t.Fatalf("a live reservation linking a stale branch keeps it owed: %s", describe(owed))
+	}
+}
+
+// TestReviewCheckoutNotOwn: a branch checked out to review, holding only
+// another author's commits, and the head of a pull request another person
+// authored, are never own.
+func TestReviewCheckoutNotOwn(t *testing.T) {
+	f := newFx(t)
+	f.git("branch", "feat/review")
+	f.commitOn("feat/review", "their work", "bob@example.invalid")
+	f.own("feat/review")
+	f.git("branch", "feat/theirs")
+	f.commitOn("feat/theirs", "their work", "bob@example.invalid")
+	f.commitOn("feat/theirs", "my suggestion", "")
+	f.own("feat/theirs")
+	p := pr(5, "feat/theirs", "main", "bob")
+	p.MergeStateStatus = "BEHIND"
+	f.forge.prs = []fakePR{p}
+	owed := f.read(true)
+	for _, b := range []string{"feat/review", "feat/theirs"} {
+		for _, i := range owed.Items {
+			if i.Branch == b {
+				t.Fatalf("%s is never own: %s", b, describe(owed))
+			}
+		}
+	}
+}
+
+// TestSiblingBranchNotOwn: a branch a sibling working copy cut and works on
+// is none of this copy's routes, so it never holds this session.
+func TestSiblingBranchNotOwn(t *testing.T) {
+	f := newFx(t)
+	wt := filepath.Join(t.TempDir(), "sib")
+	f.git("worktree", "add", "-q", "-b", "feat/sib", wt)
+	f.git("-C", wt, "commit", "-q", "--allow-empty", "-m", "sibling work")
+	st, _ := openStore(f.home, f.root)
+	if err := st.RecordBranches("fedcba9876543210fedcba9876543210", []BranchChange{{Kind: BranchCreated, Name: "feat/sib"}}, f.now); err != nil {
+		t.Fatal(err)
+	}
+	f.forge.prs = []fakePR{pr(8, "feat/sib", "main", "alice")}
+	f.forge.prs[0].StatusCheckRollup = rollupFailing
+	owed := f.read(true)
+	for _, i := range owed.Items {
+		if i.Branch == "feat/sib" {
+			t.Fatalf("a sibling copy's branch is not own: %s", describe(owed))
+		}
+	}
+}
+
+// TestReservationCopyKeyFilter: a sibling copy's live reservation is not
+// owed; this copy's is, as uncarried work and, half through, as a renewal.
+func TestReservationCopyKeyFilter(t *testing.T) {
+	f := newFx(t)
+	f.reserve("iss-1", "", f.now.Add(-3*time.Hour), f.now.Add(time.Hour))
+	if owed := f.read(true); !owed.Empty() {
+		t.Fatalf("a sibling copy's reservation is not owed: %s", describe(owed))
+	}
+	f.res[0].Copy = claim.CopyThis
+	owed := f.read(true)
+	if !has(owed, OwedUncarried, "iss-1") || !has(owed, OwedRenewal, "iss-1") {
+		t.Fatalf("this copy's reservation, half through and carried by nothing: %s", describe(owed))
+	}
+	if it, _ := find(owed, OwedRenewal, "iss-1"); it.Capped {
+		t.Fatalf("a renewal is never capped")
+	}
+	if it, _ := find(owed, OwedUncarried, "iss-1"); !it.Capped {
+		t.Fatalf("uncarried work is capped")
+	}
+}
+
+// TestNextRenewalEarliestLive: Owed.NextRenewal is the earliest renewal due
+// (halfway between the latest claim and the expiry) among the live
+// reservations under this copy's key, due or not yet, which the stop
+// verdict's deadline needs; a sibling copy's or a lapsed reservation does not
+// count, and with none it is zero. It is filled while present too, since it
+// is read from disk.
+func TestNextRenewalEarliestLive(t *testing.T) {
+	f := newFx(t)
+	if owed := f.read(true); !owed.NextRenewal.IsZero() {
+		t.Fatalf("with no reservation NextRenewal is zero, got %s", owed.NextRenewal)
+	}
+	// due in 1h30: claimed an hour ago, expiring in four hours
+	f.reserve("iss-1", claim.CopyThis, f.now.Add(-time.Hour), f.now.Add(4*time.Hour))
+	// due in 30m, but a sibling copy's
+	f.reserve("iss-2", "", f.now.Add(-time.Hour), f.now.Add(2*time.Hour))
+	// due in 45m: claimed 15 minutes ago, a two-hour lease
+	f.reserve("iss-3", claim.CopyThis, f.now.Add(-15*time.Minute), f.now.Add(105*time.Minute))
+	// lapsed
+	f.res = append(f.res, claim.Reservation{Record: "iss-4", Copy: claim.CopyThis, State: claim.StateExpired,
+		ClaimedAt: f.now.Add(-5 * time.Hour), EffectiveExpiry: f.now.Add(-time.Hour)})
+	want := f.now.Add(45 * time.Minute)
+	for _, away := range []bool{true, false} {
+		if got := f.read(away).NextRenewal; !got.Equal(want) {
+			t.Fatalf("away=%v: NextRenewal = %s, want iss-3's due %s", away, got, want)
+		}
+	}
+	// a renewal already due still counts: it is the earliest
+	f.reserve("iss-5", claim.CopyThis, f.now.Add(-3*time.Hour), f.now.Add(time.Hour))
+	if got, want := f.read(true).NextRenewal, f.now.Add(-time.Hour); !got.Equal(want) {
+		t.Fatalf("a renewal already due is the earliest: NextRenewal = %s, want %s", got, want)
+	}
+}
+
+// TestReservationLinkByHeadOrClosingTrailer: the record id in the head branch
+// or on a Resolves: or Delivers: line links; a green linked pull request is
+// not owed until renewal is due.
+func TestReservationLinkByHeadOrClosingTrailer(t *testing.T) {
+	f := newFx(t)
+	f.reserveFresh("iss-11")
+	f.reserveFresh("iss-12")
+	f.reserveFresh("itd-13")
+	a := pr(1, "fix/iss-11-thing", "main", "alice")
+	b := pr(2, "fix/y", "main", "alice")
+	b.Body = "Delivers: itd-13"
+	c := pr(3, "fix/z", "main", "alice")
+	c.Body = "Mentions iss-12 in passing."
+	f.forge.prs = []fakePR{a, b, c}
+	owed := f.read(true)
+	if has(owed, OwedUncarried, "iss-11") || has(owed, OwedUncarried, "itd-13") || !has(owed, OwedUncarried, "iss-12") {
+		t.Fatalf("head branch and closing trailer link; a mention does not: %s", describe(owed))
+	}
+	if len(owed.Items) != 1 {
+		t.Fatalf("green linked pull requests are not owed: %s", describe(owed))
+	}
+	f.now = f.now.Add(2 * time.Hour)
+	owed = f.read(true)
+	if !has(owed, OwedRenewal, "iss-11") || !has(owed, OwedRenewal, "itd-13") {
+		t.Fatalf("once half through, each renewal is due: %s", describe(owed))
+	}
+}
+
+// TestRecordIDWordBoundary: iss-5 does not match iss-50 in a branch name or a
+// trailer.
+func TestRecordIDWordBoundary(t *testing.T) {
+	f := newFx(t)
+	f.reserveFresh("iss-5")
+	p := pr(4, "fix/iss-50", "main", "alice")
+	p.Body = "Resolves: iss-50"
+	p.StatusCheckRollup = rollupFailing
+	f.forge.prs = []fakePR{p}
+	owed := f.read(true)
+	if !has(owed, OwedUncarried, "iss-5") || has(owed, OwedFailing, "fix/iss-50") {
+		t.Fatalf("iss-5 is not iss-50: %s", describe(owed))
+	}
+	if !mentionsID("feat/iss-5", "iss-5") || mentionsID("feat/iss-50", "iss-5") || !mentionsID("Resolves: iss-5, iss-6", "iss-5") {
+		t.Fatalf("the word-boundary match is wrong")
+	}
+}
+
+// TestRefsLineCarriesOnlyOwnBranch: a Refs: line on a sibling copy's pull
+// request neither carries the work nor makes its branch own; on an own
+// branch's pull request it carries it.
+func TestRefsLineCarriesOnlyOwnBranch(t *testing.T) {
+	f := newFx(t)
+	f.reserveFresh("iss-20")
+	sib := pr(1, "feat/sib", "main", "alice")
+	sib.Body = "Refs: iss-20"
+	sib.StatusCheckRollup = rollupFailing
+	f.forge.prs = []fakePR{sib}
+	owed := f.read(true)
+	if !has(owed, OwedUncarried, "iss-20") || has(owed, OwedFailing, "feat/sib") {
+		t.Fatalf("a Refs: line on a branch not own carries nothing and owns nothing: %s", describe(owed))
+	}
+	f.git("branch", "feat/mine")
+	f.commitOn("feat/mine", "work", "")
+	f.push("feat/mine")
+	f.own("feat/mine")
+	mine := pr(2, "feat/mine", "main", "alice")
+	mine.Body = "Refs: iss-20"
+	f.forge.prs = []fakePR{sib, mine}
+	if owed := f.read(true); has(owed, OwedUncarried, "iss-20") {
+		t.Fatalf("a Refs: line on an own branch's pull request carries the work: %s", describe(owed))
+	}
+}
+
+// TestBehindFromMergeState: a pull request whose merge state is BEHIND is
+// owed while the local default branch is stale and shows it current; DIRTY is
+// owed as behind; CLEAN is not; UNKNOWN reads as not read.
+func TestBehindFromMergeState(t *testing.T) {
+	for _, c := range []struct {
+		state string
+		owed  bool
+	}{{"BEHIND", true}, {"DIRTY", true}, {"CLEAN", false}, {"UNKNOWN", false}} {
+		t.Run(c.state, func(t *testing.T) {
+			f := newFx(t)
+			f.git("branch", "feat/a")
+			f.commitOn("feat/a", "work", "")
+			f.push("feat/a")
+			f.own("feat/a")
+			p := pr(1, "feat/a", "main", "alice")
+			p.MergeStateStatus = c.state
+			f.forge.prs = []fakePR{p}
+			owed := f.read(true)
+			if has(owed, OwedBehind, "feat/a") != c.owed {
+				t.Fatalf("merge state %s: owed as behind = %v, want %v: %s", c.state, !c.owed, c.owed, describe(owed))
+			}
+			if c.state == "UNKNOWN" && !strings.Contains(strings.Join(owed.Notes, " "), "not read") {
+				t.Fatalf("UNKNOWN must be said as not read: %s", describe(owed))
+			}
+		})
+	}
+}
+
+// stack makes feat/base (own, pushed, one commit off main) and feat/top on it
+// (own, pushed, one commit more).
+func (f *fx) stack() {
+	f.t.Helper()
+	f.git("branch", "feat/base")
+	f.commitOn("feat/base", "base work", "")
+	f.push("feat/base")
+	f.own("feat/base")
+	f.git("branch", "feat/top", "feat/base")
+	f.commitOn("feat/top", "top work", "")
+	f.push("feat/top")
+	f.own("feat/top")
+}
+
+// TestStackedBranchFoundWithoutPullRequest: with no pull request, a branch
+// whose nearest own ancestor branch is not in the default branch is stacked,
+// and owed while behind that base.
+func TestStackedBranchFoundWithoutPullRequest(t *testing.T) {
+	f := newFx(t)
+	f.stack()
+	f.commitOn("feat/base", "base moves on", "")
+	owed := f.read(true)
+	it, ok := find(owed, OwedStacked, "feat/top")
+	if !ok || !strings.Contains(it.Reason, "feat/base") {
+		t.Fatalf("feat/top is stacked on feat/base and behind it: %s", describe(owed))
+	}
+	if has(owed, OwedStacked, "feat/base") {
+		t.Fatalf("feat/base stands on the default branch, not stacked: %s", describe(owed))
+	}
+}
+
+// TestStackedBranchClearingRule: a stacked branch is owed while behind its
+// base, failing, with a review outstanding, or unverified; waiting on its base
+// otherwise.
+func TestStackedBranchClearingRule(t *testing.T) {
+	cases := []struct {
+		name    string
+		mutate  func(*fakePR)
+		receipt bool
+		owed    bool
+	}{
+		{"behind", func(p *fakePR) { p.MergeStateStatus = "BEHIND" }, true, true},
+		{"failing", func(p *fakePR) { p.StatusCheckRollup = rollupFailing }, true, true},
+		{"review", func(p *fakePR) { p.ReviewDecision = "CHANGES_REQUESTED" }, true, true},
+		{"unverified", func(p *fakePR) {}, false, true},
+		{"waiting", func(p *fakePR) {}, true, false},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			f := newFx(t)
+			f.stack()
+			f.mintReceipts()
+			if c.receipt {
+				f.receipt(f.head("feat/top"))
+			}
+			base := pr(1, "feat/base", "main", "alice")
+			top := pr(2, "feat/top", "feat/base", "alice")
+			c.mutate(&top)
+			f.forge.prs = []fakePR{base, top}
+			owed := f.read(true)
+			if has(owed, OwedStacked, "feat/top") != c.owed {
+				t.Fatalf("%s: stacked owed = %v, want %v: %s", c.name, !c.owed, c.owed, describe(owed))
+			}
+			if has(owed, OwedBehind, "feat/top") || has(owed, OwedFailing, "feat/top") {
+				t.Fatalf("a stacked branch is judged by the clearing rule alone: %s", describe(owed))
+			}
+		})
+	}
+}
+
+// TestClearingRuleReview: CHANGES_REQUESTED in the listing, and a run lane
+// with no passing review of its head, are owed.
+func TestClearingRuleReview(t *testing.T) {
+	f := newFx(t)
+	f.stack()
+	f.receipt(f.head("feat/top"))
+	f.forge.prs = []fakePR{pr(1, "feat/base", "main", "alice"), pr(2, "feat/top", "feat/base", "alice")}
+	f.reserveFresh("itd-2")
+	lane := func(head string, pass bool) map[string]any {
+		return map[string]any{"id": "lane-1", "branch": "feat/top", "stage": "validate", "validation": []any{
+			map[string]any{"round": 1, "head_sha": head, "validators": []any{map[string]any{"role": "r", "pass": pass}}},
+		}}
+	}
+	f.writeRun("run-0000000000000002", "itd-2", true, lane("0000000000000000000000000000000000000000", true))
+	if owed := f.read(true); !has(owed, OwedStacked, "feat/top") {
+		t.Fatalf("a lane with no passing review of its head is owed: %s", describe(owed))
+	}
+	f.writeRun("run-0000000000000002", "itd-2", true, lane(f.head("feat/top"), false))
+	if owed := f.read(true); !has(owed, OwedStacked, "feat/top") {
+		t.Fatalf("a lane whose review of its head did not pass is owed: %s", describe(owed))
+	}
+	f.writeRun("run-0000000000000002", "itd-2", true, lane(f.head("feat/top"), true))
+	if owed := f.read(true); has(owed, OwedStacked, "feat/top") {
+		t.Fatalf("a lane with a passing review of its head waits on its base: %s", describe(owed))
+	}
+	f.forge.prs[1].ReviewDecision = "CHANGES_REQUESTED"
+	if owed := f.read(true); !has(owed, OwedStacked, "feat/top") {
+		t.Fatalf("CHANGES_REQUESTED is owed: %s", describe(owed))
+	}
+}
+
+// TestClearingRuleWithoutReceipts: in a repository with no receipt folder,
+// passing checks verify; checks still running owe it uncapped; with no pull
+// request the reason says it was not verified.
+func TestClearingRuleWithoutReceipts(t *testing.T) {
+	f := newFx(t)
+	f.stack()
+	f.forge.prs = []fakePR{pr(1, "feat/base", "main", "alice"), pr(2, "feat/top", "feat/base", "alice")}
+	if owed := f.read(true); has(owed, OwedStacked, "feat/top") {
+		t.Fatalf("passing checks verify where no receipts are minted: %s", describe(owed))
+	}
+	f.forge.prs[1].StatusCheckRollup = rollupRunning
+	owed := f.read(true)
+	it, ok := find(owed, OwedStacked, "feat/top")
+	if !ok || it.Capped {
+		t.Fatalf("checks still running owe it, not capped: %s", describe(owed))
+	}
+	f.forge.prs = nil
+	owed = f.read(true)
+	if has(owed, OwedStacked, "feat/top") || !strings.Contains(strings.Join(owed.Notes, " "), "not verified") {
+		t.Fatalf("with no pull request it is judged on the rest, and said not verified: %s", describe(owed))
+	}
+	f.commitOn("feat/base", "base moves on", "")
+	owed = f.read(true)
+	if it, ok := find(owed, OwedStacked, "feat/top"); !ok || !strings.Contains(it.Reason, "not verified") {
+		t.Fatalf("owed for being behind, the reason says it was not verified: %s", describe(owed))
+	}
+}
+
+// TestUnpushedSkipsGoneUpstream: a squash-merged branch whose upstream is gone
+// is not owed.
+func TestUnpushedSkipsGoneUpstream(t *testing.T) {
+	f := newFx(t)
+	f.git("branch", "feat/g")
+	f.commitOn("feat/g", "work", "")
+	f.push("feat/g")
+	f.own("feat/g")
+	f.commitOn("feat/g", "more", "")
+	if owed := f.read(false); !has(owed, OwedUnpushed, "feat/g") {
+		t.Fatalf("a commit not on the upstream is owed: %s", describe(owed))
+	}
+	f.git("push", "-q", "origin", "--delete", "feat/g")
+	f.git("fetch", "-q", "--prune", "origin")
+	if owed := f.read(false); has(owed, OwedUnpushed, "feat/g") {
+		t.Fatalf("a branch whose upstream is gone is not owed: %s", describe(owed))
+	}
+}
+
+// TestQueuedPushHandsItemBack: without --hold-pushes a queued step hands
+// nothing back; with it, a step naming an unpushed branch whose head contains
+// the base's last-fetched tip and has a receipt hands that branch's unpushed
+// item back, recorded once per branch and head; nothing else is handed back.
+func TestQueuedPushHandsItemBack(t *testing.T) {
+	setup := func(t *testing.T) *fx {
+		f := newFx(t)
+		f.git("branch", "feat/p")
+		f.commitOn("feat/p", "work", "")
+		f.own("feat/p")
+		f.receipt(f.head("feat/p"))
+		return f
+	}
+	readWith := func(f *fx, hold bool, steps ...string) Owed {
+		o := f.opts()
+		o.Record = f.awayRecord(hold, steps...)
+		return f.readWith(o)
+	}
+	handedBack := func(t *testing.T, f *fx) []HandBack {
+		st, _ := openStore(f.home, f.root)
+		rec, err := st.Read()
+		if err != nil {
+			t.Fatal(err)
+		}
+		return rec.HandedBack
+	}
+
+	t.Run("no hold-pushes", func(t *testing.T) {
+		f := setup(t)
+		if owed := readWith(f, false, "push feat/p"); !has(owed, OwedUnpushed, "feat/p") {
+			t.Fatalf("without --hold-pushes a queued push hands nothing back: %s", describe(owed))
+		}
+		if hb := handedBack(t, f); len(hb) != 0 {
+			t.Fatalf("nothing is recorded as handed back: %v", hb)
+		}
+	})
+	t.Run("hold-pushes verified", func(t *testing.T) {
+		f := setup(t)
+		owed := readWith(f, true, "push feat/p")
+		if has(owed, OwedUnpushed, "feat/p") {
+			t.Fatalf("a verified branch's queued push is handed back: %s", describe(owed))
+		}
+		if len(owed.HandedBack) != 1 || owed.HandedBack[0].Kind != OwedUnpushed ||
+			owed.HandedBack[0].Branch != "feat/p" || owed.HandedBack[0].Head != f.head("feat/p") {
+			t.Fatalf("the handed-back item goes to the verdict in Owed.HandedBack, with its branch and head: %+v", owed.HandedBack)
+		}
+		// The verdict accepts a hand-back and the stop hook records it; the
+		// reader records nothing, so one owner writes it once.
+		if hb := handedBack(t, f); len(hb) != 0 {
+			t.Fatalf("the reader records no hand-back itself: %+v", hb)
+		}
+	})
+	t.Run("hold-pushes base moved", func(t *testing.T) {
+		f := setup(t)
+		f.commitOn("main", "main moves on", "")
+		f.git("push", "-q", "origin", "main")
+		if owed := readWith(f, true, "push feat/p"); !has(owed, OwedUnpushed, "feat/p") {
+			t.Fatalf("a head lacking the base's tip is not handed back: %s", describe(owed))
+		}
+	})
+	t.Run("hold-pushes no receipt", func(t *testing.T) {
+		f := setup(t)
+		f.commitOn("feat/p", "more", "")
+		if owed := readWith(f, true, "push feat/p"); !has(owed, OwedUnpushed, "feat/p") {
+			t.Fatalf("a head with no receipt is not handed back: %s", describe(owed))
+		}
+	})
+	t.Run("hold-pushes mints no receipts", func(t *testing.T) {
+		f := setup(t)
+		if err := os.RemoveAll(f.mintReceipts()); err != nil {
+			t.Fatal(err)
+		}
+		if owed := readWith(f, true, "push feat/p"); !has(owed, OwedUnpushed, "feat/p") {
+			t.Fatalf("a repository that mints no receipts hands nothing back: %s", describe(owed))
+		}
+	})
+	t.Run("hold-pushes behind and failing pull requests", func(t *testing.T) {
+		f := setup(t)
+		for _, b := range []string{"feat/b", "feat/f"} {
+			f.git("branch", b)
+			f.commitOn(b, "work", "")
+			f.push(b)
+			f.own(b)
+			f.commitOn(b, "local fix", "")
+			f.receipt(f.head(b))
+		}
+		behind := pr(1, "feat/b", "main", "alice")
+		behind.MergeStateStatus = "DIRTY"
+		failing := pr(2, "feat/f", "main", "alice")
+		failing.StatusCheckRollup = rollupFailing
+		f.forge.prs = []fakePR{behind, failing}
+		owed := readWith(f, true, "push feat/b", "push feat/f")
+		if !has(owed, OwedBehind, "feat/b") || !has(owed, OwedFailing, "feat/f") {
+			t.Fatalf("a behind or failing pull request stays owed though its fix is queued: %s", describe(owed))
+		}
+	})
+	t.Run("hold-pushes stacked and review", func(t *testing.T) {
+		f := setup(t)
+		f.stack()
+		f.commitOn("feat/top", "unpushed", "")
+		f.receipt(f.head("feat/top"))
+		top := pr(2, "feat/top", "feat/base", "alice")
+		top.ReviewDecision = "CHANGES_REQUESTED"
+		f.forge.prs = []fakePR{pr(1, "feat/base", "main", "alice"), top}
+		owed := readWith(f, true, "push feat/top")
+		if !has(owed, OwedStacked, "feat/top") {
+			t.Fatalf("a stacked branch the clearing rule owes, a review outstanding, stays owed: %s", describe(owed))
+		}
+	})
+	t.Run("hold-pushes reservation and renewal", func(t *testing.T) {
+		f := setup(t)
+		f.reserve("iss-30", claim.CopyThis, f.now.Add(-3*time.Hour), f.now.Add(time.Hour))
+		owed := readWith(f, true, "open the pull request for iss-30", "renew iss-30")
+		if !has(owed, OwedUncarried, "iss-30") || !has(owed, OwedRenewal, "iss-30") {
+			t.Fatalf("a reservation queued by its id, and a renewal, are never handed back: %s", describe(owed))
+		}
+	})
+	t.Run("hold-pushes word boundary", func(t *testing.T) {
+		f := setup(t)
+		f.git("branch", "feat/iss-50")
+		f.commitOn("feat/iss-50", "work", "")
+		f.own("feat/iss-50")
+		f.receipt(f.head("feat/iss-50"))
+		if owed := readWith(f, true, "push feat/iss-5"); !has(owed, OwedUnpushed, "feat/iss-50") {
+			t.Fatalf("iss-5 queued does not hand back iss-50: %s", describe(owed))
+		}
+	})
+}
+
+// TestPresentReadsDiskOnly: while the person is present the check makes no
+// forge call, and reads renewals due and unpushed own branches only.
+func TestPresentReadsDiskOnly(t *testing.T) {
+	f := newFx(t)
+	f.git("branch", "feat/a")
+	f.commitOn("feat/a", "work", "")
+	f.own("feat/a")
+	f.reserve("iss-3", claim.CopyThis, f.now.Add(-3*time.Hour), f.now.Add(time.Hour))
+	f.forge.prs = []fakePR{pr(1, "feat/a", "main", "alice")}
+	owed := f.read(false)
+	if f.forge.calls != 0 {
+		t.Fatalf("present: %d forge calls, want none", f.forge.calls)
+	}
+	if !has(owed, OwedUnpushed, "feat/a") || !has(owed, OwedRenewal, "iss-3") || has(owed, OwedUncarried, "iss-3") {
+		t.Fatalf("present reads renewals due and unpushed branches only: %s", describe(owed))
+	}
+	// A record past its end is not away either.
+	o := f.opts()
+	rec := f.awayRecord(false)
+	o.Record = rec
+	o.Now = func() time.Time { return rec.Ends().Add(time.Minute) }
+	f.readWith(o)
+	if f.forge.calls != 0 {
+		t.Fatalf("a lapsed record is not away: %d forge calls", f.forge.calls)
+	}
+}
+
+// TestForgeListingDeadline: the listing runs under a ten-second deadline; a
+// hung listing ends at it, and the check fails open to the disk kinds with a
+// "not read" note: a branch with a pull request is compared on disk naming
+// the fetch time, and a reservation is never reported as uncarried.
+func TestForgeListingDeadline(t *testing.T) {
+	f := newFx(t)
+	f.git("branch", "feat/a")
+	f.commitOn("feat/a", "work", "")
+	f.push("feat/a")
+	f.own("feat/a")
+	f.commitOn("main", "main moves on", "")
+	f.git("push", "-q", "origin", "main")
+	f.reserveFresh("iss-4")
+
+	f.forge.err = errors.New("gh: not signed in")
+	o := f.opts()
+	o.Record = f.awayRecord(false)
+	start := time.Now()
+	f.readWith(o)
+	if len(f.forge.ctxs) != 1 {
+		t.Fatalf("one listing per check, got %d", len(f.forge.ctxs))
+	}
+	dl, ok := f.forge.ctxs[0].Deadline()
+	if !ok || dl.Sub(start) > ForgeDeadline+time.Second || dl.Sub(start) < ForgeDeadline-time.Second {
+		t.Fatalf("the listing's deadline is %v from the start, want %v", dl.Sub(start), ForgeDeadline)
+	}
+
+	f.forge.err = nil
+	f.forge.hang = true
+	o.ForgeDeadline = 300 * time.Millisecond
+	start = time.Now()
+	owed := f.readWith(o)
+	if took := time.Since(start); took > 5*time.Second {
+		t.Fatalf("a hung listing must end at its deadline; the check took %v", took)
+	}
+	notes := strings.Join(owed.Notes, " ")
+	if !strings.Contains(notes, "not read") {
+		t.Fatalf("a failed listing is named as not read: %s", describe(owed))
+	}
+	it, ok := find(owed, OwedBehind, "feat/a")
+	if !ok || !strings.Contains(it.Reason, "origin/main") || !strings.Contains(it.Reason, "fetched") {
+		t.Fatalf("a pushed branch is compared on disk with the default branch, naming the fetch: %s", describe(owed))
+	}
+	if has(owed, OwedUncarried, "iss-4") {
+		t.Fatalf("a reservation is never reported uncarried when the listing failed: %s", describe(owed))
+	}
+}
+
+// TestOwedOrderFixed: the items come in the fixed order, and the next item is
+// the first of a renewal due, a failing pull request, a behind one, a stacked
+// branch, an unpushed branch and unhanded work.
+func TestOwedOrderFixed(t *testing.T) {
+	f := newFx(t)
+	f.stack()
+	f.commitOn("feat/base", "base moves on", "")
+	f.git("branch", "feat/u")
+	f.commitOn("feat/u", "work", "")
+	f.own("feat/u")
+	for _, b := range []string{"feat/fail", "feat/behind"} {
+		f.git("branch", b)
+		f.commitOn(b, "work", "")
+		f.push(b)
+		f.own(b)
+	}
+	failing := pr(3, "feat/fail", "main", "alice")
+	failing.StatusCheckRollup = rollupFailing
+	behind := pr(4, "feat/behind", "main", "alice")
+	behind.MergeStateStatus = "BEHIND"
+	f.forge.prs = []fakePR{behind, failing}
+	f.reserve("iss-40", claim.CopyThis, f.now.Add(-3*time.Hour), f.now.Add(time.Hour))
+	owed := f.read(true)
+	var kinds []OwedKind
+	for _, i := range owed.Items {
+		if len(kinds) == 0 || kinds[len(kinds)-1] != i.Kind {
+			kinds = append(kinds, i.Kind)
+		}
+	}
+	want := owedKinds()
+	if len(kinds) != len(want) {
+		t.Fatalf("kinds %v, want each of %v once in order: %s", kinds, want, describe(owed))
+	}
+	for i := range want {
+		if kinds[i] != want[i] {
+			t.Fatalf("kinds %v, want %v", kinds, want)
+		}
+	}
+	if next, _ := owed.Next(); next.Kind != OwedRenewal {
+		t.Fatalf("the next item is the renewal: %+v", next)
+	}
+}
+
+// change commits content to file on branch, checking it out and back to
+// main, and returns the commit.
+func (f *fx) change(branch, file, content string) string {
+	f.t.Helper()
+	f.git("checkout", "-q", branch)
+	f.repo.Write(file, content)
+	f.git("add", "--", file)
+	f.git("commit", "-q", "-m", "change "+file+" on "+branch)
+	c := f.git("rev-parse", "HEAD")
+	f.git("checkout", "-q", "main")
+	return c
+}
+
+// squashLand squash-merges branch into main, pushes main, and deletes and
+// prunes the remote branch the branch was pushed to without -u.
+func (f *fx) squashLand(branch string) {
+	f.t.Helper()
+	f.git("push", "-q", "origin", branch) // no -u: no upstream configured
+	f.git("merge", "-q", "--squash", branch)
+	f.git("commit", "-q", "-m", "squash "+branch)
+	f.git("push", "-q", "origin", "main")
+	f.git("push", "-q", "origin", "--delete", branch)
+	f.git("fetch", "-q", "--prune", "origin")
+}
+
+// TestNoUpstreamLandedBranchNotOwed: a branch pushed without -u, then
+// squash-merged with its remote branch deleted and pruned, has no upstream
+// and no commit in any remote ref, but its work is already in the default
+// branch: it is not owed, whether it held several commits (the squash's
+// patch matches none of them) or one that main has since edited over.
+func TestNoUpstreamLandedBranchNotOwed(t *testing.T) {
+	t.Run("multi-commit squash", func(t *testing.T) {
+		f := newFx(t)
+		f.git("branch", "feat/sq")
+		f.change("feat/sq", "a.txt", "one\n")
+		f.change("feat/sq", "b.txt", "two\n")
+		f.own("feat/sq")
+		f.squashLand("feat/sq")
+		f.change("main", "c.txt", "later\n")
+		f.git("push", "-q", "origin", "main")
+		f.git("fetch", "-q", "origin")
+		if owed := f.read(false); has(owed, OwedUnpushed, "feat/sq") || strings.Contains(describe(owed), "feat/sq") {
+			t.Fatalf("a squash-merged, pruned branch is not owed: %s", describe(owed))
+		}
+	})
+	t.Run("one commit edited over since", func(t *testing.T) {
+		f := newFx(t)
+		f.git("branch", "feat/one")
+		f.change("feat/one", "a.txt", "one\n")
+		f.own("feat/one")
+		f.squashLand("feat/one")
+		f.change("main", "a.txt", "one, edited\n")
+		f.git("push", "-q", "origin", "main")
+		f.git("fetch", "-q", "origin")
+		if owed := f.read(false); has(owed, OwedUnpushed, "feat/one") || strings.Contains(describe(owed), "feat/one") {
+			t.Fatalf("a landed commit main has edited over since is not owed: %s", describe(owed))
+		}
+	})
+}
+
+// TestNoUpstreamUnlandedBranchOwed: a no-upstream branch holding a commit
+// whose change the default branch lacks is still owed.
+func TestNoUpstreamUnlandedBranchOwed(t *testing.T) {
+	f := newFx(t)
+	f.git("branch", "feat/new")
+	f.change("feat/new", "n.txt", "new\n")
+	f.own("feat/new")
+	f.change("main", "m.txt", "moved on\n")
+	f.git("push", "-q", "origin", "main")
+	f.git("fetch", "-q", "origin")
+	if owed := f.read(false); !has(owed, OwedUnpushed, "feat/new") {
+		t.Fatalf("an unpushed, unlanded branch is owed: %s", describe(owed))
+	}
+}
+
+// TestNoUpstreamUndecidedBranchNoted: a no-upstream branch whose change
+// conflicts with the default branch and whose patch is not upstream cannot
+// be told landed or not: it is named in a note, not owed.
+func TestNoUpstreamUndecidedBranchNoted(t *testing.T) {
+	f := newFx(t)
+	f.change("main", "a.txt", "base\n")
+	f.git("push", "-q", "origin", "main")
+	f.git("branch", "feat/c")
+	f.change("feat/c", "a.txt", "theirs\n")
+	f.own("feat/c")
+	f.change("main", "a.txt", "ours\n")
+	f.git("push", "-q", "origin", "main")
+	f.git("fetch", "-q", "origin")
+	owed := f.read(false)
+	if has(owed, OwedUnpushed, "feat/c") {
+		t.Fatalf("an undecidable branch is not owed: %s", describe(owed))
+	}
+	if !strings.Contains(strings.Join(owed.Notes, " "), "feat/c") {
+		t.Fatalf("an undecidable branch is named in a note: %s", describe(owed))
+	}
+}
+
+// TestForgeListingAtLimitTruncated: a listing that returns exactly its limit
+// may be truncated, so a note says so and a reservation no listed pull
+// request carries is not reported as uncarried; one short of the limit is
+// whole, and the reservation is.
+func TestForgeListingAtLimitTruncated(t *testing.T) {
+	for _, n := range []int{prListLimit, prListLimit - 1} {
+		f := newFx(t)
+		f.reserveFresh("iss-77")
+		for i := 0; i < n; i++ {
+			f.forge.prs = append(f.forge.prs, pr(1000+i, fmt.Sprintf("other/%d", i), "main", "bob"))
+		}
+		owed := f.read(true)
+		notes := strings.Join(owed.Notes, " ")
+		if n == prListLimit {
+			if has(owed, OwedUncarried, "iss-77") || !strings.Contains(notes, "truncated") {
+				t.Errorf("a listing at its limit of %d: %s", n, describe(owed))
+			}
+			continue
+		}
+		if !has(owed, OwedUncarried, "iss-77") || strings.Contains(notes, "truncated") {
+			t.Errorf("a listing of %d, under its limit: %s", n, describe(owed))
+		}
+	}
+}
+
+// manyOwnBranches makes n own branches, each with a commit of the fixture's
+// own not in any remote, none with a pull request.
+func (f *fx) manyOwnBranches(n int) {
+	f.t.Helper()
+	for i := 0; i < n; i++ {
+		b := fmt.Sprintf("feat/m%02d", i)
+		f.git("branch", b)
+		f.commitOn(b, "work "+b, "")
+		f.own(b)
+	}
+}
+
+// countGit puts a git on PATH that counts its calls into the returned file.
+func countGit(t *testing.T) func() int {
+	t.Helper()
+	real, err := exec.LookPath("git")
+	if err != nil {
+		t.Skip("git not on PATH")
+	}
+	bin := t.TempDir()
+	log := filepath.Join(t.TempDir(), "calls")
+	script := "#!/bin/sh\necho x >> '" + log + "'\nexec '" + real + "' \"$@\"\n"
+	if err := os.WriteFile(filepath.Join(bin, "git"), []byte(script), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("PATH", bin+string(os.PathListSeparator)+os.Getenv("PATH"))
+	return func() int {
+		raw, _ := os.ReadFile(log)
+		_ = os.WriteFile(log, nil, 0o600)
+		return strings.Count(string(raw), "\n")
+	}
+}
+
+// TestStackBaseSearchLinear: finding the bases of own branches with no pull
+// request (the listing failed) costs git calls in proportion to the
+// branches, not to their pairs: doubling the branches far less than
+// quadruples the calls.
+func TestStackBaseSearchLinear(t *testing.T) {
+	calls := map[int]int{}
+	for _, n := range []int{10, 20} {
+		f := newFx(t)
+		f.manyOwnBranches(n)
+		f.forge.err = errors.New("listing failed")
+		count := countGit(t)
+		count()
+		f.read(true)
+		calls[n] = count()
+	}
+	if calls[20] > calls[10]*3 {
+		t.Fatalf("git calls: %d for 10 branches, %d for 20; want them to grow linearly", calls[10], calls[20])
+	}
+}
+
+// TestReadOwedHonoursDeadline: a check whose time budget runs out stops
+// reading, returns promptly, marks the reading incomplete and says what was
+// not read.
+func TestReadOwedHonoursDeadline(t *testing.T) {
+	f := newFx(t)
+	f.manyOwnBranches(30)
+	f.forge.err = errors.New("listing failed")
+	o := f.opts()
+	o.Record = f.awayRecord(false)
+	ctx, cancel := context.WithTimeout(context.Background(), 150*time.Millisecond)
+	defer cancel()
+	start := time.Now()
+	owed, err := ReadOwed(ctx, o)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if took := time.Since(start); took > 5*time.Second {
+		t.Errorf("the read took %s past a 150ms budget", took)
+	}
+	if !owed.Incomplete || !strings.Contains(strings.Join(owed.Notes, " "), "ran out of its time budget") {
+		t.Fatalf("a read cut short is marked incomplete with a note: incomplete %v, %s", owed.Incomplete, describe(owed))
+	}
+}
+
+// TestDueRenewalReleasesOnWake: a set of only a renewal already due, as the
+// reader produces it (its renewal time past, its lease not yet lapsed), is
+// released by a wake that fires before the lease lapses less the skew, as
+// the spec's "a renewal only due keeps releasing" says; a wake past the
+// lapse does not qualify.
+func TestDueRenewalReleasesOnWake(t *testing.T) {
+	f := newFx(t)
+	f.now = at(t, "2026-10-18 21:01")
+	f.reserve("iss-9", claim.CopyThis, f.now.Add(-3*time.Hour), f.now.Add(time.Hour))
+	f.forge.prs = []fakePR{pr(1, "fix/iss-9", "main", "alice")}
+	rec := f.awayRecord(false)
+	o := f.opts()
+	o.Record = rec
+	owed := f.readWith(o)
+	if len(owed.Items) != 1 || owed.Items[0].Kind != OwedRenewal {
+		t.Fatalf("want only the renewal due: %s", describe(owed))
+	}
+	if d := wakeDeadline(owed, f.now); !d.After(f.now) {
+		t.Fatalf("the deadline for a due renewal is %s, already past at %s", d, f.now)
+	}
+	st := SessionState{}
+	wake := StopInput{SessionCrons: crons("*/10 * * * *"), Location: london(t)}
+	v := Judge(rec, owed, wake, st, f.now)
+	if v.Row != 2 {
+		t.Fatalf("first stop row %d, want 2", v.Row)
+	}
+	for i := 0; i < 3; i++ {
+		v = Judge(rec, owed, wake, v.State, f.now)
+		if v.Block {
+			t.Fatalf("wake %d: a due renewal alone blocked (row %d); want it released", i+1, v.Row)
+		}
+	}
+	late := StopInput{SessionCrons: crons("0 23 * * *"), Location: london(t)}
+	if v := Judge(rec, owed, late, v.State, f.now); !v.Block {
+		t.Errorf("a wake past the lease's lapse released the stop")
+	}
+}
+
+// TestReviewCheckoutSameEmailNotOwn: on one machine sibling copies share the
+// author email, so a branch this copy once checked out to review, which a
+// sibling worktree now has checked out, holds commits of "this checkout's"
+// email; it is the sibling's, not this copy's own, and is not owed here.
+func TestReviewCheckoutSameEmailNotOwn(t *testing.T) {
+	f := newFx(t)
+	f.git("branch", "feat/sibling")
+	f.commitOn("feat/sibling", "sibling's work", "")
+	f.own("feat/sibling") // checked out here once, to look at it
+	sib := filepath.Join(t.TempDir(), "sib")
+	f.git("worktree", "add", "-q", sib, "feat/sibling")
+	if owed := f.read(false); has(owed, OwedUnpushed, "feat/sibling") {
+		t.Fatalf("a branch a sibling worktree has checked out is not this copy's own: %s", describe(owed))
+	}
+}
+
+// TestCarriedOnlyByOwnPullRequest: a reservation is carried only by a pull
+// request findOwn would count: in this repository and the person's; a fork's
+// or another person's pull request naming it does not carry it.
+func TestCarriedOnlyByOwnPullRequest(t *testing.T) {
+	for _, c := range []struct {
+		name string
+		p    fakePR
+	}{
+		{"another person's", func() fakePR { p := pr(1, "fix/x", "main", "bob"); p.Body = "Resolves: iss-21"; return p }()},
+		{"a fork's", func() fakePR {
+			p := pr(2, "fix/iss-21", "main", "alice")
+			p.IsCrossRepository = true
+			return p
+		}()},
+	} {
+		f := newFx(t)
+		f.reserveFresh("iss-21")
+		f.forge.prs = []fakePR{c.p}
+		if owed := f.read(true); !has(owed, OwedUncarried, "iss-21") {
+			t.Errorf("%s pull request carried the reservation: %s", c.name, describe(owed))
+		}
+	}
+}
diff --git a/internal/core/autonomy/question.go b/internal/core/autonomy/question.go
new file mode 100644
index 0000000000..391c364ba0
--- /dev/null
+++ b/internal/core/autonomy/question.go
@@ -0,0 +1,51 @@
+package autonomy
+
+import "strings"
+
+// The question reroute (spc-2610180914469489, "The question reroute";
+// dcn-2610180937177502, dcn-2610181003477194, dcn-2610181016510153).
+//
+// While the away record holds, no question waits for the person: the guard
+// refuses every call to the host's question tool, whatever its chip, and its
+// reason routes the question by the act it asks about. An act only the person
+// may approve is queued for their return with `abcd mode queue`; every other
+// question is decided and recorded with `abcd decide`. Nothing detects the act
+// mechanically: the agent classifies its own question from the list, and the
+// guard's registry entries enforce only what they name. The text lives here,
+// beside the record, so every front door that repeats the list (the guard's
+// refusal, the away block, the stop check's refusal of a question asked in
+// prose) says the same thing.
+
+// personOnlyActs are the acts only the person may approve, in the spec's
+// order, each one line, the catch-all last.
+var personOnlyActs = []string{
+	"an embargo close's `--approve <digest>`, passed only after the person has read the text and said yes in their own session: never supply it on your own",
+	"the embargo triage verdict, which is the person's decision",
+	"the drain's hand-back, which is a person's decision",
+	"the confirmed apply verb for remote configuration",
+	"a release sign-off: a cut, or a step of one, that asks for the person by name, or that no standing instruction of theirs allows (a standing permission for automatic cuts stands, and the away mode adds none)",
+	"pushing, opening or merging a pull request without a standing instruction of the person's that allows it: the away mode is never that instruction",
+	"publishing anything, changing a repository's visibility, or posting a comment or message outward, other than a pull request a standing instruction allows",
+	"adding a dependency",
+	"a secret, a credential or an App",
+	"a step only a website or a browser can do",
+	"a destructive act: deleting what the session did not create, overwriting uncommitted work, a force push, discarding a peer's work",
+	"anything that spends money",
+	"any other act a command page or a brief invariant names as the person's",
+}
+
+// QuestionRoute is how a question is routed while the person is away, one
+// line each: the queue route and the person-only acts, then the decide route
+// for every other question, then that nothing detects the act and the away
+// mode grants nothing. A front door puts its own head line above it.
+func QuestionRoute() string {
+	var b strings.Builder
+	b.WriteString("Route the question by the act it asks about, not by its chip.\n")
+	b.WriteString("Queue it with `abcd mode queue \"<step>\"` for the person's return, and carry on with other work, when it asks about an act only the person may approve:\n")
+	for _, a := range personOnlyActs {
+		b.WriteString("- " + a + ";\n")
+	}
+	b.WriteString("Decide every other question yourself, product and technical alike, and record it with `abcd decide \"<text>\"`, with its grounds and how to reverse it; then carry on.\n")
+	b.WriteString("Nothing detects the act for you: classify your own question from this list. The away mode grants no rights, so it never allows an act on the list.")
+	return b.String()
+}
diff --git a/internal/core/autonomy/question_test.go b/internal/core/autonomy/question_test.go
new file mode 100644
index 0000000000..1d603c6eeb
--- /dev/null
+++ b/internal/core/autonomy/question_test.go
@@ -0,0 +1,67 @@
+package autonomy
+
+import (
+	"strings"
+	"testing"
+)
+
+// TestAwayReasonListsPersonOnlyActs (spc-2610180914469489, step 6): the
+// reroute's reason names every act only the person may approve, each a
+// phrase the spec's list carries, says that the away mode is no standing
+// instruction, sends those acts to `abcd mode queue` and every other question
+// to `abcd decide`, and says nothing detects the act mechanically.
+func TestAwayReasonListsPersonOnlyActs(t *testing.T) {
+	route := QuestionRoute()
+	for _, want := range []struct{ what, phrase string }{
+		{"the embargo --approve digest", "--approve <digest>"},
+		{"the digest is never supplied on the agent's own", "never supply it on your own"},
+		{"the embargo triage verdict", "embargo triage verdict"},
+		{"the drain's hand-back", "drain's hand-back"},
+		{"the remote-configuration apply verb", "apply verb for remote configuration"},
+		{"a release sign-off", "a release sign-off"},
+		{"what a release sign-off means", "asks for the person by name, or that no standing instruction of theirs allows"},
+		{"a standing permission for automatic cuts stands", "standing permission for automatic cuts stands"},
+		{"pushing, opening or merging a pull request", "pushing, opening or merging a pull request without a standing instruction"},
+		{"the away mode is no standing instruction", "the away mode is never that instruction"},
+		{"publishing and visibility", "publishing anything, changing a repository's visibility"},
+		{"an outward comment or message", "posting a comment or message outward"},
+		{"a new dependency", "adding a dependency"},
+		{"secrets and Apps", "a secret, a credential or an App"},
+		{"a website step", "only a website or a browser can do"},
+		{"a destructive act", "a destructive act"},
+		{"a force push", "a force push"},
+		{"a peer's work", "discarding a peer's work"},
+		{"spending", "spends money"},
+		{"the catch-all", "any other act a command page or a brief invariant names as the person's"},
+		{"the queue route", "abcd mode queue \"<step>\""},
+		{"carrying on meanwhile", "carry on with other work"},
+		{"the decide route", "abcd decide"},
+		{"grounds and how to reverse it", "its grounds and how to reverse it"},
+		{"nothing detects the act", "Nothing detects the act"},
+		{"the mode grants nothing", "grants no rights"},
+	} {
+		if !strings.Contains(route, want.phrase) {
+			t.Errorf("the reason does not name %s (%q):\n%s", want.what, want.phrase, route)
+		}
+	}
+	acts := personOnlyActs
+	if len(acts) == 0 {
+		t.Fatal("personOnlyActs is empty")
+	}
+	for _, a := range acts {
+		if !strings.Contains(route, a) {
+			t.Errorf("the reason leaves out the act %q", a)
+		}
+		if strings.Contains(a, "\n") {
+			t.Errorf("an act runs over one line: %q", a)
+		}
+	}
+	if last := acts[len(acts)-1]; !strings.Contains(last, "any other act") {
+		t.Errorf("the list does not end on the catch-all: %q", last)
+	}
+	// The queue route comes before the decide route, so the agent reads
+	// which acts are the person's before it reads that it decides the rest.
+	if q, d := strings.Index(route, "abcd mode queue"), strings.Index(route, "abcd decide"); q < 0 || d < 0 || q > d {
+		t.Errorf("the queue route (at %d) does not come before the decide route (at %d)", q, d)
+	}
+}
diff --git a/internal/core/autonomy/record.go b/internal/core/autonomy/record.go
new file mode 100644
index 0000000000..6ed49e7bde
--- /dev/null
+++ b/internal/core/autonomy/record.go
@@ -0,0 +1,460 @@
+package autonomy
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"github.com/intentdriven/abcd/internal/fsutil"
+	"github.com/intentdriven/abcd/internal/termsafe"
+)
+
+// SchemaVersion is the record's shape version, written as schema_version.
+const SchemaVersion = 1
+
+// MaxWindow is the stale-record cap: a record ends at most seven days after
+// it was set, so a forgotten one lapses while a run of several days fits
+// (dcn-2610180937181736).
+const MaxWindow = 7 * 24 * time.Hour
+
+// MaxStepLen bounds a queued step, in characters, so one step cannot fill the
+// record's 64 KiB.
+const MaxStepLen = 500
+
+// echoCap bounds how much of an untrusted value a message quotes back.
+const echoCap = 64
+
+var (
+	// ErrUntilUnreadable is an --until that is neither a clock time nor a
+	// timestamp.
+	ErrUntilUnreadable = errors.New("autonomy: --until is not a time")
+	// ErrUntilPast is an --until already past.
+	ErrUntilPast = errors.New("autonomy: --until is already past")
+	// ErrUntilBeyondCap is an --until later than seven days on.
+	ErrUntilBeyondCap = errors.New("autonomy: --until is past the seven-day cap")
+	// ErrStepEmpty is a queued step with no words.
+	ErrStepEmpty = errors.New("autonomy: the step is empty")
+	// ErrStepTooLong is a queued step past MaxStepLen.
+	ErrStepTooLong = errors.New("autonomy: the step is too long")
+	// ErrQueueFull is a step the queue has no room for.
+	ErrQueueFull = errors.New("autonomy: the queue is full")
+)
+
+// Who names a person acting on the record and the working copy they act from
+// (its root, as git names it).
+type Who struct {
+	Name string
+	Copy string
+}
+
+// Record is the away record. The package comment lists its fields.
+type Record struct {
+	SchemaVersion int          `json:"schema_version"`
+	SetBy         string       `json:"set_by"`
+	SetFrom       string       `json:"set_from"`
+	Start         time.Time    `json:"start"`
+	Until         time.Time    `json:"until"`
+	OpenEnded     bool         `json:"open_ended"`
+	HoldPushes    bool         `json:"hold_pushes"`
+	Queue         []QueuedStep `json:"queue"`
+	HandedBack    []HandBack   `json:"handed_back"`
+	Stops         []Stop       `json:"stops"`
+	Closed        *Closing     `json:"closed,omitempty"`
+	// DroppedStops, DroppedHandBacks and DroppedSteps count what was let go
+	// to keep the record within MaxFileBytes: the oldest stops (by their
+	// counts) and hand-backs as new ones arrive, and, only when a record
+	// past its bound is carried or closed, the oldest queued steps.
+	DroppedStops     int `json:"dropped_stops,omitempty"`
+	DroppedHandBacks int `json:"dropped_handed_back,omitempty"`
+	DroppedSteps     int `json:"dropped_queue,omitempty"`
+}
+
+// QueuedStep is one step queued for the person's return.
+type QueuedStep struct {
+	Step string    `json:"step"`
+	At   time.Time `json:"at"`
+	From string    `json:"from"`
+}
+
+// HandBack is one owed item the stop check handed back to the person, by its
+// branch and the head it had then.
+type HandBack struct {
+	Branch string    `json:"branch"`
+	Head   string    `json:"head"`
+	At     time.Time `json:"at"`
+}
+
+// StopKind is why a recorded stop happened.
+type StopKind string
+
+const (
+	// StopWorkOwed is a stop with work owed.
+	StopWorkOwed StopKind = "work-owed"
+	// StopNoNextLook is a stop with nothing owed and no next look scheduled.
+	StopNoNextLook StopKind = "no-next-look"
+	// StopAPIError is a turn the host ended on an API error.
+	StopAPIError StopKind = "api-error"
+	// StopCheckIncomplete is a stop allowed because the check's time budget
+	// ran out before it had read the owed work; Detail says what was not
+	// read.
+	StopCheckIncomplete StopKind = "check-incomplete"
+)
+
+// Stop is one recorded stop. Count, First and Last are kept by AddStop: a stop
+// identical to the last one recorded adds to that entry instead of a new one.
+type Stop struct {
+	Kind StopKind `json:"kind"`
+	// ErrorType is the host's error type for StopAPIError (rate_limit, …).
+	ErrorType string `json:"error_type,omitempty"`
+	// Detail is the next item at the stop, in plain words.
+	Detail string `json:"detail,omitempty"`
+	// PossiblyForcedByCap marks a stop at the host's continuation cap.
+	PossiblyForcedByCap bool      `json:"possibly_forced_by_cap,omitempty"`
+	Count               int       `json:"count"`
+	First               time.Time `json:"first"`
+	Last                time.Time `json:"last"`
+}
+
+// Closing is who ended the record by word, from which copy, and when.
+type Closing struct {
+	By   string    `json:"by"`
+	From string    `json:"from"`
+	At   time.Time `json:"at"`
+}
+
+// begin is the record `abcd mode autonomous` writes at now: until zero is
+// open-ended (seven days at most), and otherwise must be after now and no
+// later than seven days on. prev is the record already stored, or nil: an
+// unclosed one's queue, hand-backs and stops are still unread, so they are
+// carried into the new record rather than dropped.
+func begin(prev *Record, who Who, now, until time.Time, holdPushes bool) (*Record, error) {
+	now = now.Truncate(time.Second)
+	r := &Record{
+		SchemaVersion: SchemaVersion,
+		SetBy:         who.Name,
+		SetFrom:       who.Copy,
+		Start:         now,
+		HoldPushes:    holdPushes,
+	}
+	switch {
+	case until.IsZero():
+		r.OpenEnded = true
+		r.Until = now.Add(MaxWindow)
+	case !until.After(now):
+		return nil, fmt.Errorf("%w: %s", ErrUntilPast, showTime(until))
+	case until.After(now.Add(MaxWindow)):
+		return nil, fmt.Errorf("%w: %s is later than seven days from now (%s)", ErrUntilBeyondCap, showTime(until), showTime(now.Add(MaxWindow)))
+	default:
+		r.Until = until
+	}
+	if prev != nil && prev.Closed == nil {
+		r.Queue = append(r.Queue, prev.Queue...)
+		r.HandedBack = append(r.HandedBack, prev.HandedBack...)
+		r.Stops = append(r.Stops, prev.Stops...)
+		r.DroppedStops, r.DroppedHandBacks, r.DroppedSteps = prev.DroppedStops, prev.DroppedHandBacks, prev.DroppedSteps
+	}
+	r.Fit()
+	return r, nil
+}
+
+// The parts' bounds keep a record within MaxFileBytes in use, each in its
+// JSON form: the queue refuses a step past queueBudget, and the stops and
+// hand-backs let their oldest go past theirs. The rest of the record (who,
+// from where, when) is a few hundred bytes.
+const (
+	queueBudget    = 24 << 10
+	stopsBudget    = 24 << 10
+	handBackBudget = 8 << 10
+	// fitBudget is what Fit leaves a record, under MaxFileBytes with room
+	// for the closing Back adds and the newline the store writes.
+	fitBudget = MaxFileBytes - 1<<10
+)
+
+func jsonLen(v any) int {
+	raw, err := json.MarshalIndent(v, "", "  ")
+	if err != nil {
+		return 0
+	}
+	return len(raw)
+}
+
+// oldestStop is the index of the stop seen least recently.
+func (r *Record) oldestStop() int {
+	o := 0
+	for i, s := range r.Stops {
+		if s.Last.Before(r.Stops[o].Last) {
+			o = i
+		}
+	}
+	return o
+}
+
+func (r *Record) dropStop(i int) {
+	r.DroppedStops += max(r.Stops[i].Count, 1)
+	r.Stops = append(r.Stops[:i:i], r.Stops[i+1:]...)
+}
+
+// Fit lets go of what a record past its bound cannot hold, oldest first and
+// counted: stops, then hand-backs, then queued steps. A record within its
+// bound is unchanged. begin fits what it carries and Back what it closes, so
+// neither ever fails on size; Back prints every line before it fits.
+func (r *Record) Fit() {
+	for jsonLen(r) > fitBudget {
+		switch {
+		case len(r.Stops) > 0:
+			r.dropStop(r.oldestStop())
+		case len(r.HandedBack) > 0:
+			r.HandedBack = r.HandedBack[1:]
+			r.DroppedHandBacks++
+		case len(r.Queue) > 0:
+			r.Queue = r.Queue[1:]
+			r.DroppedSteps++
+		default:
+			return
+		}
+	}
+}
+
+// Ends is when the record ends: its stored end, but never later than seven
+// days after its start, whatever is stored.
+func (r *Record) Ends() time.Time {
+	limit := r.Start.Add(MaxWindow)
+	if r.Until.IsZero() || r.Until.After(limit) {
+		return limit
+	}
+	return r.Until
+}
+
+// Holds reports whether the person is away at now: a record, not closed, and
+// now before its end. No record is not away.
+func (r *Record) Holds(now time.Time) bool {
+	return r != nil && r.Closed == nil && now.Before(r.Ends())
+}
+
+// Lapsed reports whether the record's end has passed while it is still
+// unclosed: what is in it has not been read by `abcd mode back`.
+func (r *Record) Lapsed(now time.Time) bool {
+	return r != nil && r.Closed == nil && !now.Before(r.Ends())
+}
+
+// Close ends the record by word: who ended it, from which copy, and when.
+func (r *Record) Close(who Who, now time.Time) {
+	r.Closed = &Closing{By: who.Name, From: who.Copy, At: now.Truncate(time.Second)}
+}
+
+// AddStep queues a step for the person. Its whitespace is folded to single
+// spaces, so it is one line; an empty step, or one past MaxStepLen
+// characters, is refused and nothing is kept.
+func (r *Record) AddStep(step, from string, now time.Time) error {
+	step = strings.Join(strings.Fields(step), " ")
+	if step == "" {
+		return ErrStepEmpty
+	}
+	if n := utf8.RuneCountInString(step); n > MaxStepLen {
+		return fmt.Errorf("%w: %d characters, at most %d", ErrStepTooLong, n, MaxStepLen)
+	}
+	q := append(r.Queue[:len(r.Queue):len(r.Queue)], QueuedStep{Step: step, At: now.Truncate(time.Second), From: from})
+	if jsonLen(q) > queueBudget {
+		return fmt.Errorf("%w: %d steps are queued, as many as the record holds; nothing is dropped, and `abcd mode back` prints them", ErrQueueFull, len(r.Queue))
+	}
+	r.Queue = q
+	return nil
+}
+
+// AddStop records a stop at now. A stop identical to one already recorded,
+// anywhere in the list (same kind, error type, detail, which names the item,
+// and cap label), adds to that entry's count and last time instead, so two
+// copies blocked on different items, alternating, keep two entries. Past
+// stopsBudget the stop seen least recently goes, counted in DroppedStops.
+func (r *Record) AddStop(s Stop, now time.Time) {
+	now = now.Truncate(time.Second)
+	for i := range r.Stops {
+		if sameStop(r.Stops[i], s) {
+			r.Stops[i].Count++
+			r.Stops[i].Last = now
+			return
+		}
+	}
+	s.Count, s.First, s.Last = 1, now, now
+	r.Stops = append(r.Stops, s)
+	for len(r.Stops) > 1 && jsonLen(r.Stops) > stopsBudget {
+		r.dropStop(r.oldestStop())
+	}
+}
+
+func sameStop(a, b Stop) bool {
+	return a.Kind == b.Kind && a.ErrorType == b.ErrorType && a.Detail == b.Detail && a.PossiblyForcedByCap == b.PossiblyForcedByCap
+}
+
+// AddHandBack records an item handed back, once per branch and head; it
+// reports whether this call added it.
+func (r *Record) AddHandBack(branch, head string, now time.Time) bool {
+	for _, h := range r.HandedBack {
+		if h.Branch == branch && h.Head == head {
+			return false
+		}
+	}
+	r.HandedBack = append(r.HandedBack, HandBack{Branch: branch, Head: head, At: now.Truncate(time.Second)})
+	for len(r.HandedBack) > 1 && jsonLen(r.HandedBack) > handBackBudget {
+		r.HandedBack = r.HandedBack[1:]
+		r.DroppedHandBacks++
+	}
+	return true
+}
+
+// Terms are the record's plain statement, one line each: until when, set by
+// whom and from which copy; that pushes wait, when the person said so; that
+// the mode grants no rights, the person's standing instruction deciding; and
+// how it ends.
+func (r *Record) Terms() []string {
+	until := "until " + showTime(r.Ends())
+	if r.OpenEnded {
+		until += " (open-ended, seven days at most)"
+	}
+	lines := []string{fmt.Sprintf("Away %s, set by %s from %s.", until, showWho(r.SetBy), showCopy(r.SetFrom))}
+	if r.HoldPushes {
+		lines = append(lines, "The person said pushes wait for their return (--hold-pushes): finish the local work, then queue the push with `abcd mode queue \"<step>\"`.")
+	}
+	lines = append(lines,
+		"The away mode grants no rights: the person's own standing instruction decides what is committed, pushed, and opened or merged as a pull request.",
+		"It ends at its time or with `abcd mode back`, run only on the person's word.")
+	return lines
+}
+
+// Lines are what `abcd mode back` prints: one plain line per queued step, per
+// handed-back item and per recorded stop, the cap label and count included.
+func (r *Record) Lines() []string {
+	var lines []string
+	for _, q := range r.Queue {
+		lines = append(lines, "queued: "+termsafe.CleanProseLine(q.Step, MaxStepLen*4))
+	}
+	for _, h := range r.HandedBack {
+		lines = append(lines, fmt.Sprintf("handed back: %s at %s", clean(h.Branch), shortHead(h.Head)))
+	}
+	for _, s := range r.Stops {
+		lines = append(lines, stopLine(s))
+	}
+	const kept = "were let go to keep the record within 64 KiB"
+	if r.DroppedSteps > 0 {
+		lines = append(lines, fmt.Sprintf("%s %s", count(r.DroppedSteps, "earlier queued step", "earlier queued steps"), kept))
+	}
+	if r.DroppedHandBacks > 0 {
+		lines = append(lines, fmt.Sprintf("%s %s", count(r.DroppedHandBacks, "earlier item handed back", "earlier items handed back"), kept))
+	}
+	if r.DroppedStops > 0 {
+		lines = append(lines, fmt.Sprintf("%s %s", count(r.DroppedStops, "earlier stop", "earlier stops"), kept))
+	}
+	return lines
+}
+
+func stopLine(s Stop) string {
+	var b strings.Builder
+	switch s.Kind {
+	case StopWorkOwed:
+		b.WriteString("stopped with work owed")
+	case StopNoNextLook:
+		b.WriteString("stopped with no next look")
+	case StopCheckIncomplete:
+		b.WriteString("allowed to stop, the check out of time")
+	case StopAPIError:
+		b.WriteString("stopped on an API error")
+		if s.ErrorType != "" {
+			b.WriteString(" (" + clean(s.ErrorType) + ")")
+		}
+	default:
+		b.WriteString("stopped (" + clean(string(s.Kind)) + ")")
+	}
+	if s.PossiblyForcedByCap {
+		b.WriteString(", possibly forced by the cap")
+	}
+	if s.Detail != "" {
+		b.WriteString(": " + termsafe.CleanProseLine(s.Detail, 256))
+	}
+	if s.Count > 1 {
+		fmt.Fprintf(&b, " (%d times, first %s, last %s)", s.Count, showTime(s.First), showTime(s.Last))
+	} else {
+		b.WriteString(" (" + showTime(s.Last) + ")")
+	}
+	return b.String()
+}
+
+func clean(s string) string { return termsafe.CleanProseLine(s, echoCap*2) }
+
+func shortHead(h string) string {
+	if len(h) > 12 {
+		h = h[:12]
+	}
+	return clean(h)
+}
+
+// showTime renders a time for the person, in the machine's local time.
+func showTime(t time.Time) string { return t.Local().Format("2006-01-02 15:04 MST") }
+
+func showWho(name string) string {
+	if strings.TrimSpace(name) == "" {
+		return "someone git does not name"
+	}
+	return clean(name)
+}
+
+func showCopy(p string) string {
+	if p == "" {
+		return "an unnamed working copy"
+	}
+	return clean(fsutil.DisplayPath(p))
+}
+
+// clockRe is a clock time, H:MM or HH:MM.
+var clockRe = regexp.MustCompile(`^(\d{1,2}):(\d{2})$`)
+
+// localLayouts are the timestamp forms read in now's location; RFC 3339,
+// which names its own offset, is tried first.
+var localLayouts = []string{"2006-01-02T15:04:05", "2006-01-02T15:04", "2006-01-02 15:04:05", "2006-01-02 15:04"}
+
+// parseUntil reads --until against now, in now's location (the machine's
+// local time at the front door): a clock time is its next occurrence after
+// now; a timestamp is RFC 3339 or a date and time read in local time. One
+// that is neither is ErrUntilUnreadable, and one not after now ErrUntilPast.
+func parseUntil(s string, now time.Time) (time.Time, error) {
+	raw := s
+	s = strings.TrimSpace(s)
+	loc := now.Location()
+	if m := clockRe.FindStringSubmatch(s); m != nil {
+		h, _ := strconv.Atoi(m[1])
+		mi, _ := strconv.Atoi(m[2])
+		if h > 23 || mi > 59 {
+			return time.Time{}, unreadable(raw)
+		}
+		y, mo, d := now.Date()
+		t := time.Date(y, mo, d, h, mi, 0, 0, loc)
+		if !t.After(now) {
+			t = time.Date(y, mo, d+1, h, mi, 0, 0, loc)
+		}
+		return t, nil
+	}
+	t, err := time.Parse(time.RFC3339, s)
+	if err != nil {
+		for _, layout := range localLayouts {
+			if t, err = time.ParseInLocation(layout, s, loc); err == nil {
+				break
+			}
+		}
+	}
+	if err != nil {
+		return time.Time{}, unreadable(raw)
+	}
+	if !t.After(now) {
+		return time.Time{}, fmt.Errorf("%w: %s", ErrUntilPast, showTime(t))
+	}
+	return t, nil
+}
+
+func unreadable(raw string) error {
+	return fmt.Errorf("%w: %q is neither a clock time (09:00) nor a timestamp (2026-10-19T09:00, or RFC 3339)",
+		ErrUntilUnreadable, termsafe.CleanProseLine(raw, echoCap))
+}
diff --git a/internal/core/autonomy/record_full_test.go b/internal/core/autonomy/record_full_test.go
new file mode 100644
index 0000000000..037371227d
--- /dev/null
+++ b/internal/core/autonomy/record_full_test.go
@@ -0,0 +1,211 @@
+package autonomy
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+	"time"
+)
+
+// record_full_test.go — the diff review's major 3 (spc-2610180914469489,
+// "Diff review round 1"): a record that fills must never stop the person
+// ending the mode, and normal use must keep it within its 64 KiB.
+
+func recordBytes(t *testing.T, r *Record) int {
+	t.Helper()
+	raw, err := json.MarshalIndent(r, "", "  ")
+	if err != nil {
+		t.Fatal(err)
+	}
+	return len(raw) + 1
+}
+
+// TestAddStopCollapsesAnywhere: two copies blocked on different items,
+// alternating, keep two entries, each counted, not one entry per stop.
+func TestAddStopCollapsesAnywhere(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	r, _ := begin(nil, alice, now, time.Time{}, false)
+	a := Stop{Kind: StopWorkOwed, Detail: "pull request #12 (feat/a) is behind its base", PossiblyForcedByCap: true}
+	b := Stop{Kind: StopWorkOwed, Detail: "pull request #13 (feat/b) is failing its checks", PossiblyForcedByCap: true}
+	for i := 0; i < 200; i++ {
+		s := a
+		if i%2 == 1 {
+			s = b
+		}
+		r.AddStop(s, now.Add(time.Duration(i)*5*time.Minute))
+	}
+	if len(r.Stops) != 2 || r.Stops[0].Count != 100 || r.Stops[1].Count != 100 {
+		t.Fatalf("alternating stops = %d entries %+v, want two of 100 each", len(r.Stops), r.Stops)
+	}
+}
+
+// TestRecordStaysWithinBoundInUse: hundreds of distinct stops and hand-backs
+// rotate out the oldest, counted and named on `mode back`; queued steps stop
+// at their own bound with ErrQueueFull, nothing dropped; the record stays
+// within 64 KiB throughout.
+func TestRecordStaysWithinBoundInUse(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	r, _ := begin(nil, alice, now, time.Time{}, false)
+	long := strings.Repeat("<", 240)
+	for i := 0; i < 600; i++ {
+		r.AddStop(Stop{Kind: StopWorkOwed, Detail: fmt.Sprintf("%d %s", i, long), PossiblyForcedByCap: true}, now.Add(time.Duration(i)*time.Minute))
+		r.AddHandBack(fmt.Sprintf("feat/%d-%s", i, strings.Repeat("x", 100)), strings.Repeat("a", 40), now)
+	}
+	full := false
+	for i := 0; i < 600 && !full; i++ {
+		err := r.AddStep(fmt.Sprintf("%d %s", i, strings.Repeat("<", MaxStepLen-8)), "/work/a", now)
+		if errors.Is(err, ErrQueueFull) {
+			full = true
+		} else if err != nil {
+			t.Fatal(err)
+		}
+	}
+	if !full {
+		t.Fatalf("the queue took 600 steps of %d characters", MaxStepLen)
+	}
+	if n := recordBytes(t, r); n > MaxFileBytes {
+		t.Fatalf("the record holds %d bytes, past %d", n, MaxFileBytes)
+	}
+	if r.DroppedStops == 0 || r.DroppedHandBacks == 0 {
+		t.Fatalf("dropped stops %d, hand-backs %d: want the oldest of each rotated out", r.DroppedStops, r.DroppedHandBacks)
+	}
+	lines := strings.Join(r.Lines(), "\n")
+	for _, want := range []string{fmt.Sprintf("%d earlier stops", r.DroppedStops), fmt.Sprintf("%d earlier items handed back", r.DroppedHandBacks)} {
+		if !strings.Contains(lines, want) {
+			t.Errorf("mode back's lines lack %q", want)
+		}
+	}
+}
+
+// fillRecord writes the stored record as one too full to write back: past
+// the store's bound, as a record from before the bounds, or a harness, can
+// leave it.
+func fillRecord(t *testing.T, st Store, now time.Time) {
+	t.Helper()
+	r, _ := begin(nil, alice, now.Add(-time.Hour), time.Time{}, false)
+	r.Queue = append(r.Queue, QueuedStep{Step: "approve the embargo close", At: now, From: "/work/a"})
+	for i := 0; i < 400; i++ {
+		r.Stops = append(r.Stops, Stop{Kind: StopWorkOwed, Detail: fmt.Sprintf("%d %s", i, strings.Repeat("x", 200)), Count: 1, First: now, Last: now})
+	}
+	raw, _ := json.MarshalIndent(r, "", "  ")
+	if len(raw) <= MaxFileBytes {
+		t.Fatalf("the fixture holds %d bytes, not past the bound", len(raw))
+	}
+	if err := st.WithLock(func() error { return os.WriteFile(st.RecordPath(), raw, 0o600) }); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// TestBackEndsAnyRecord: `abcd mode back` ends the mode whatever state the
+// record is in: past its bound, partly or wholly unparsable, not safely this
+// account's, or with its lock held past the timeout. It prints what could be
+// read, says what could not, and afterwards the record reads closed.
+func TestBackEndsAnyRecord(t *testing.T) {
+	type spoil func(t *testing.T, st Store, now time.Time)
+	for _, c := range []struct {
+		name      string
+		spoil     spoil
+		wantLine  string // a line Back prints
+		wantNote  string // a note Back prints
+		readAfter bool   // the store's own read sees the closed record after
+	}{
+		{"past its bound", fillRecord, "399 xxxxx", "past its 64 KiB", true},
+		{"partly unparsable", func(t *testing.T, st Store, now time.Time) {
+			raw := `{"schema_version":1,"set_by":"alice","start":"` + now.Add(-time.Hour).Format(time.RFC3339) + `","until":"` + now.Add(time.Hour).Format(time.RFC3339) + `","queue":[{"step":"approve the embargo close"}],"stops":"garbled"}`
+			if err := os.WriteFile(st.RecordPath(), []byte(raw), 0o600); err != nil {
+				t.Fatal(err)
+			}
+		}, "approve the embargo close", "could not be read", true},
+		{"unparsable", func(t *testing.T, st Store, now time.Time) {
+			if err := os.WriteFile(st.RecordPath(), []byte("{not json"), 0o600); err != nil {
+				t.Fatal(err)
+			}
+		}, "", "could not be read", true},
+		{"writable by others", func(t *testing.T, st Store, now time.Time) { mustChmod(t, st.RecordPath(), 0o666) }, "", "not safely this account's", true},
+		{"lock writable by others", func(t *testing.T, st Store, now time.Time) { mustChmod(t, st.LockPath(), 0o666) }, "approve the embargo close", "lock", false},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			root, home := managedCopy(t)
+			now := time.Now().Truncate(time.Second)
+			o := fixedOptions(home, now)
+			if _, err := SetAway(root, "", false, o); err != nil {
+				t.Fatal(err)
+			}
+			if _, err := QueueStep(root, "approve the embargo close", o); err != nil {
+				t.Fatal(err)
+			}
+			st, _ := openStore(home, root)
+			c.spoil(t, st, now)
+			res, err := Back(root, o)
+			if err != nil {
+				t.Fatalf("back: %v", err)
+			}
+			all := strings.Join(append(res.Lines, res.Notes...), "\n")
+			if c.wantLine != "" && !strings.Contains(strings.Join(res.Lines, "\n"), c.wantLine) {
+				t.Errorf("back printed %q, want a line with %q", all, c.wantLine)
+			}
+			if !strings.Contains(strings.Join(res.Notes, "\n"), c.wantNote) {
+				t.Errorf("back's notes %q lack %q", res.Notes, c.wantNote)
+			}
+			if c.readAfter {
+				rec, err := st.Read()
+				if err != nil || rec == nil || rec.Closed == nil {
+					t.Fatalf("after back the record reads %+v (%v), want closed", rec, err)
+				}
+				raw, _ := os.ReadFile(st.RecordPath())
+				if len(raw) > MaxFileBytes {
+					t.Errorf("the closed record holds %d bytes", len(raw))
+				}
+			}
+			if _, holds, _ := st.Away(now); holds {
+				t.Errorf("the mode still holds after back")
+			}
+		})
+	}
+}
+
+// TestBackWithLockHeld: a lock held past the timeout does not keep the mode
+// on: back closes the record without it and says so.
+func TestBackWithLockHeld(t *testing.T) {
+	root, home := managedCopy(t)
+	now := time.Now().Truncate(time.Second)
+	o := fixedOptions(home, now)
+	if _, err := SetAway(root, "", false, o); err != nil {
+		t.Fatal(err)
+	}
+	st, _ := openStore(home, root)
+	var res BackResult
+	var berr error
+	if err := st.WithLock(func() error {
+		res, berr = Back(root, o)
+		return nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if berr != nil || res.State != "away" || !strings.Contains(strings.Join(res.Notes, " "), "lock") {
+		t.Fatalf("back with the lock held: %+v (%v)", res, berr)
+	}
+	if rec, err := st.Read(); err != nil || rec.Closed == nil {
+		t.Fatalf("after back the record reads %+v (%v), want closed", rec, err)
+	}
+}
+
+// TestBeginCarriesAFullRecord: setting the mode again over an unclosed record
+// past its bound carries what fits, counting what it dropped.
+func TestBeginCarriesAFullRecord(t *testing.T) {
+	root, home := managedCopy(t)
+	now := time.Now().Truncate(time.Second)
+	o := fixedOptions(home, now)
+	st, _ := openStore(home, root)
+	fillRecord(t, st, now)
+	rec, err := SetAway(root, "", false, o)
+	if err != nil {
+		t.Fatalf("set over a full record: %v", err)
+	}
+	if rec.DroppedStops == 0 || len(rec.Queue) != 1 {
+		t.Errorf("carried %d steps, dropped %d stops", len(rec.Queue), rec.DroppedStops)
+	}
+}
diff --git a/internal/core/autonomy/record_test.go b/internal/core/autonomy/record_test.go
new file mode 100644
index 0000000000..c7de9c1707
--- /dev/null
+++ b/internal/core/autonomy/record_test.go
@@ -0,0 +1,342 @@
+package autonomy
+
+import (
+	"encoding/json"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+)
+
+// london is the zone the clock-time cases are read in: a named zone with a
+// daylight-saving change, so a case that silently used UTC would show.
+func london(t *testing.T) *time.Location {
+	t.Helper()
+	loc, err := time.LoadLocation("Europe/London")
+	if err != nil {
+		t.Skipf("no zoneinfo for Europe/London: %v", err)
+	}
+	return loc
+}
+
+func at(t *testing.T, s string) time.Time {
+	t.Helper()
+	v, err := time.ParseInLocation("2006-01-02 15:04", s, london(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	return v
+}
+
+var alice = Who{Name: "alice", Copy: "/work/abcd"}
+
+// TestUntilClockTimeAndTimestamp: --until takes a clock time, read as its next
+// occurrence in local time, or a full timestamp; a time already past, and one
+// that is neither, are refused.
+func TestUntilClockTimeAndTimestamp(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	for _, c := range []struct {
+		in   string
+		want time.Time
+	}{
+		{"09:00", at(t, "2026-10-19 09:00")},
+		{"9:05", at(t, "2026-10-19 09:05")},
+		{"23:30", at(t, "2026-10-18 23:30")},
+		{"2026-10-20T09:00:00+01:00", at(t, "2026-10-20 09:00")},
+		{"2026-10-20T08:00:00Z", at(t, "2026-10-20 09:00")},
+		{"2026-10-20T09:00", at(t, "2026-10-20 09:00")},
+		{"2026-10-20 09:00", at(t, "2026-10-20 09:00")},
+	} {
+		got, err := parseUntil(c.in, now)
+		if err != nil {
+			t.Errorf("parseUntil(%q): %v", c.in, err)
+			continue
+		}
+		if !got.Equal(c.want) {
+			t.Errorf("parseUntil(%q) = %s, want %s", c.in, got, c.want)
+		}
+	}
+	for _, in := range []string{"", "tomorrow", "25:00", "09:60", "2026-13-01T09:00"} {
+		if _, err := parseUntil(in, now); !errors.Is(err, ErrUntilUnreadable) {
+			t.Errorf("parseUntil(%q) err = %v, want ErrUntilUnreadable", in, err)
+		}
+	}
+	for _, in := range []string{"2026-10-18T20:00", "2026-10-18 21:00"} {
+		if _, err := parseUntil(in, now); !errors.Is(err, ErrUntilPast) {
+			t.Errorf("parseUntil(%q) err = %v, want ErrUntilPast", in, err)
+		}
+	}
+}
+
+// TestStaleRecordCapSevenDays: an open-ended record reads as ended seven days
+// after it was set, an --until past that is refused, and a stored end past
+// the cap (a hand edit) is read as the cap.
+func TestStaleRecordCapSevenDays(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	r, err := begin(nil, alice, now, time.Time{}, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !r.OpenEnded {
+		t.Error("a record set without --until is not marked open-ended")
+	}
+	if want := now.Add(MaxWindow); !r.Ends().Equal(want) {
+		t.Errorf("open-ended record ends %s, want %s", r.Ends(), want)
+	}
+	if !r.Holds(now.Add(MaxWindow - time.Second)) {
+		t.Error("record does not hold one second before its seven days end")
+	}
+	if r.Holds(now.Add(MaxWindow)) {
+		t.Error("record still holds seven days on")
+	}
+	if _, err := begin(nil, alice, now, now.Add(MaxWindow+time.Minute), false); !errors.Is(err, ErrUntilBeyondCap) {
+		t.Errorf("--until past seven days: err = %v, want ErrUntilBeyondCap", err)
+	}
+	if _, err := begin(nil, alice, now, now.Add(MaxWindow), false); err != nil {
+		t.Errorf("--until at exactly seven days refused: %v", err)
+	}
+	edited := *r
+	edited.OpenEnded = false
+	edited.Until = now.Add(30 * 24 * time.Hour)
+	if !edited.Ends().Equal(now.Add(MaxWindow)) {
+		t.Errorf("a stored end thirty days on reads as %s, want the cap", edited.Ends())
+	}
+}
+
+// TestRecordPastEndReadsEnded: a record holds while now is before its end, and
+// past it reads as ended, lapsed until it is closed.
+func TestRecordPastEndReadsEnded(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	r, err := begin(nil, alice, now, now.Add(time.Hour), false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !r.Holds(now.Add(59 * time.Minute)) {
+		t.Error("record does not hold before its end")
+	}
+	if r.Holds(now.Add(time.Hour)) {
+		t.Error("record holds at its end")
+	}
+	if !r.Lapsed(now.Add(2 * time.Hour)) {
+		t.Error("an unclosed record past its end does not read as lapsed")
+	}
+	r.Close(alice, now.Add(3*time.Hour))
+	if r.Lapsed(now.Add(4*time.Hour)) || r.Holds(now.Add(30*time.Minute)) {
+		t.Error("a closed record still reads as lapsed or holding")
+	}
+	var nilRec *Record
+	if nilRec.Holds(now) || nilRec.Lapsed(now) {
+		t.Error("no record reads as away")
+	}
+}
+
+// TestQueueAppends: each queued step is kept in order with where and when it
+// was queued; an empty step or one past the length bound is refused.
+func TestQueueAppends(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	r, err := begin(nil, alice, now, time.Time{}, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := r.AddStep("approve the embargo close", "/work/a", now.Add(time.Minute)); err != nil {
+		t.Fatal(err)
+	}
+	if err := r.AddStep("  push feat/x  ", "/work/b", now.Add(2*time.Minute)); err != nil {
+		t.Fatal(err)
+	}
+	if len(r.Queue) != 2 || r.Queue[0].Step != "approve the embargo close" || r.Queue[1].Step != "push feat/x" {
+		t.Fatalf("queue = %+v", r.Queue)
+	}
+	if r.Queue[1].From != "/work/b" || !r.Queue[1].At.Equal(now.Add(2*time.Minute)) {
+		t.Errorf("queued step lost its copy or time: %+v", r.Queue[1])
+	}
+	if err := r.AddStep("   ", "/work/a", now); !errors.Is(err, ErrStepEmpty) {
+		t.Errorf("empty step: err = %v", err)
+	}
+	if err := r.AddStep(strings.Repeat("x", MaxStepLen+1), "/work/a", now); !errors.Is(err, ErrStepTooLong) {
+		t.Errorf("over-long step: err = %v", err)
+	}
+	if len(r.Queue) != 2 {
+		t.Errorf("a refused step was kept: %d steps", len(r.Queue))
+	}
+
+	// Setting the mode again keeps what is still unread.
+	again, err := begin(r, alice, now.Add(time.Hour), time.Time{}, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(again.Queue) != 2 {
+		t.Errorf("setting the mode again dropped the unread queue: %+v", again.Queue)
+	}
+	r.Close(alice, now.Add(2*time.Hour))
+	fresh, err := begin(r, alice, now.Add(3*time.Hour), time.Time{}, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(fresh.Queue) != 0 {
+		t.Errorf("a closed record's queue, already printed, was carried into a new window: %+v", fresh.Queue)
+	}
+}
+
+// TestRepeatedStopCollapses: a stop identical to the last recorded one adds to
+// its count and last time instead of a new entry; a different stop, or the
+// first one again after a different one, is its own entry.
+func TestRepeatedStopCollapses(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	r, err := begin(nil, alice, now, time.Time{}, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	a := Stop{Kind: StopWorkOwed, Detail: "feat/x is behind main", PossiblyForcedByCap: true}
+	b := Stop{Kind: StopAPIError, ErrorType: "rate_limit"}
+	r.AddStop(a, now.Add(10*time.Minute))
+	r.AddStop(a, now.Add(20*time.Minute))
+	if len(r.Stops) != 1 {
+		t.Fatalf("an identical stop made a new entry: %+v", r.Stops)
+	}
+	if s := r.Stops[0]; s.Count != 2 || !s.First.Equal(now.Add(10*time.Minute)) || !s.Last.Equal(now.Add(20*time.Minute)) {
+		t.Errorf("collapsed stop = %+v, want count 2 with first and last times", s)
+	}
+	r.AddStop(b, now.Add(30*time.Minute))
+	r.AddStop(a, now.Add(40*time.Minute))
+	// An identical stop anywhere in the list collapses into its entry, not
+	// only the one just before it (the diff review's major 3).
+	if len(r.Stops) != 2 || r.Stops[0].Count != 3 || !r.Stops[0].Last.Equal(now.Add(40*time.Minute)) {
+		t.Errorf("stops = %+v, want two entries, the first counted three times", r.Stops)
+	}
+	if r.Stops[1].Count != 1 {
+		t.Errorf("a first stop's count = %d, want 1", r.Stops[1].Count)
+	}
+}
+
+// TestHoldPushesRecorded: --hold-pushes is kept in the record and in its JSON,
+// shown in the record's terms, and changes nothing else: the terms say the
+// mode grants no rights whether or not pushes are held.
+func TestHoldPushesRecorded(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	held, err := begin(nil, alice, now, at(t, "2026-10-19 09:00"), true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	plain, err := begin(nil, alice, now, at(t, "2026-10-19 09:00"), false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !held.HoldPushes || plain.HoldPushes {
+		t.Fatalf("hold_pushes: held=%v plain=%v", held.HoldPushes, plain.HoldPushes)
+	}
+	raw, err := json.Marshal(held)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var back Record
+	if err := json.Unmarshal(raw, &back); err != nil {
+		t.Fatal(err)
+	}
+	if !back.HoldPushes || !strings.Contains(string(raw), `"hold_pushes":true`) {
+		t.Errorf("hold_pushes lost in the round trip: %s", raw)
+	}
+	heldTerms := strings.Join(held.Terms(), "\n")
+	plainTerms := strings.Join(plain.Terms(), "\n")
+	if !strings.Contains(heldTerms, "pushes wait") {
+		t.Errorf("held terms do not say pushes wait:\n%s", heldTerms)
+	}
+	if strings.Contains(plainTerms, "pushes wait") {
+		t.Errorf("terms without --hold-pushes say pushes wait:\n%s", plainTerms)
+	}
+	for _, terms := range []string{heldTerms, plainTerms} {
+		if !strings.Contains(terms, "grants no rights") || !strings.Contains(terms, "standing instruction") {
+			t.Errorf("terms do not say the mode grants no rights and the standing instruction decides:\n%s", terms)
+		}
+		if !strings.Contains(terms, "abcd mode back") {
+			t.Errorf("terms do not name `abcd mode back`:\n%s", terms)
+		}
+	}
+	if held.SetBy != plain.SetBy || !held.Ends().Equal(plain.Ends()) {
+		t.Error("--hold-pushes changed something other than itself")
+	}
+}
+
+// TestBackLinesOnePerItem: the lines `abcd mode back` prints are one per
+// queued step, per handed-back item and per recorded stop, the cap label and
+// the count included.
+func TestBackLinesOnePerItem(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	r, err := begin(nil, alice, now, time.Time{}, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_ = r.AddStep("approve the embargo close", "/work/a", now)
+	_ = r.AddStep("push feat/y", "/work/a", now)
+	if !r.AddHandBack("feat/y", "0123456789abcdef", now) || r.AddHandBack("feat/y", "0123456789abcdef", now) {
+		t.Error("a hand-back is not recorded exactly once per branch and head")
+	}
+	r.AddStop(Stop{Kind: StopWorkOwed, Detail: "feat/x is behind main", PossiblyForcedByCap: true}, now)
+	r.AddStop(Stop{Kind: StopWorkOwed, Detail: "feat/x is behind main", PossiblyForcedByCap: true}, now.Add(time.Hour))
+	r.AddStop(Stop{Kind: StopAPIError, ErrorType: "rate_limit"}, now)
+	lines := r.Lines()
+	if len(lines) != 5 {
+		t.Fatalf("lines = %q, want five", lines)
+	}
+	all := strings.Join(lines, "\n")
+	for _, want := range []string{"approve the embargo close", "push feat/y", "feat/y", "possibly forced by the cap", "2 times", "rate_limit"} {
+		if !strings.Contains(all, want) {
+			t.Errorf("lines miss %q:\n%s", want, all)
+		}
+	}
+	for _, l := range lines {
+		if strings.Contains(l, "\n") {
+			t.Errorf("a line spans lines: %q", l)
+		}
+	}
+}
+
+// TestOwedShape: the owed set's next item follows the fixed order whatever
+// order the items arrive in, its fingerprint ignores order and reasons, and
+// the capped fingerprint reads the capped items alone.
+func TestOwedShape(t *testing.T) {
+	kinds := owedKinds()
+	want := []OwedKind{OwedRenewal, OwedFailing, OwedBehind, OwedStacked, OwedUnpushed, OwedUncarried}
+	if len(kinds) != len(want) {
+		t.Fatalf("kinds = %v", kinds)
+	}
+	for i := range want {
+		if kinds[i] != want[i] {
+			t.Fatalf("kinds = %v, want %v", kinds, want)
+		}
+	}
+	a := Owed{Items: []OwedItem{
+		{Kind: OwedUnpushed, Capped: true, Branch: "feat/z", Head: "c3"},
+		{Kind: OwedBehind, Capped: true, Branch: "feat/x", PR: 7, Head: "a1"},
+		{Kind: OwedRenewal, Record: "iss-5"},
+	}}
+	b := Owed{Items: []OwedItem{a.Items[2], a.Items[0], a.Items[1]}}
+	b.Items[0].Reason = "renewal due at 03:00"
+	if next, ok := a.Next(); !ok || next.Kind != OwedRenewal {
+		t.Errorf("next = %+v, want the renewal", next)
+	}
+	if a.Fingerprint() != b.Fingerprint() {
+		t.Error("the fingerprint depends on order or on a reason")
+	}
+	if !a.HasCapped() {
+		t.Error("HasCapped is false with capped items owed")
+	}
+	c := Owed{Items: a.Items[:2]}
+	if a.CappedFingerprint() != c.CappedFingerprint() {
+		t.Error("a renewal coming or going changed the capped fingerprint")
+	}
+	if a.Fingerprint() == c.Fingerprint() {
+		t.Error("the full fingerprint ignored the renewal")
+	}
+	moved := Owed{Items: []OwedItem{a.Items[0], {Kind: OwedBehind, Capped: true, Branch: "feat/x", PR: 7, Head: "a2"}}}
+	if moved.CappedFingerprint() == c.CappedFingerprint() {
+		t.Error("a new head on a capped item left the capped fingerprint unchanged")
+	}
+	var empty Owed
+	if !empty.Empty() || empty.HasCapped() {
+		t.Error("an empty owed set reads as holding work")
+	}
+	if _, ok := empty.Next(); ok {
+		t.Error("an empty owed set has a next item")
+	}
+}
diff --git a/internal/core/autonomy/session_state.go b/internal/core/autonomy/session_state.go
new file mode 100644
index 0000000000..acc067ad12
--- /dev/null
+++ b/internal/core/autonomy/session_state.go
@@ -0,0 +1,107 @@
+package autonomy
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"os"
+	"path"
+	"path/filepath"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/core/mode"
+	"github.com/intentdriven/abcd/internal/fsutil"
+)
+
+// SessionsDir is the session-state folder below a working copy's root: one
+// file per session id, in the copy's local tier.
+const SessionsDir = mode.TierRelPath + "/autonomy/sessions"
+
+// SessionState is one session's stop-check state, kept between hook runs in
+// SessionsDir/<session-id>.json.
+type SessionState struct {
+	SchemaVersion int `json:"schema_version"`
+	// State is working, waiting or stopped, as the last verdict left it.
+	State string `json:"state,omitempty"`
+	// NextLook is the qualifying wake's next fire time while waiting.
+	NextLook time.Time `json:"next_look,omitempty"`
+	// Fingerprint is the owed set's at the last check (Owed.Fingerprint).
+	Fingerprint string `json:"fingerprint,omitempty"`
+	// QuestionHash is the last prose question blocked, hashed.
+	QuestionHash string `json:"question_hash,omitempty"`
+	// Blocks is the count of consecutive blocks, which stop_hook_active alone
+	// drives (dcn-2610181003484631).
+	Blocks int `json:"blocks"`
+	// Wakes is how many times in a row a wake released an unchanged set of
+	// capped items, and WakeFingerprint those items' fingerprint
+	// (dcn-2610181035361997).
+	Wakes           int    `json:"wakes"`
+	WakeFingerprint string `json:"wake_fingerprint,omitempty"`
+}
+
+// sessionStatePath is the session's state file below the working copy at
+// copyRoot; an id outside [A-Za-z0-9_-]{1,128} is ErrSessionID.
+func sessionStatePath(copyRoot, sessionID string) (string, error) {
+	if !ValidSessionID(sessionID) {
+		return "", ErrSessionID
+	}
+	return filepath.Join(copyRoot, filepath.FromSlash(SessionsDir), sessionID+".json"), nil
+}
+
+// LoadSession reads the session's state below copyRoot, through an os.Root at
+// copyRoot so nothing outside the copy is read; an absent file is the zero
+// state. A file over MaxFileBytes, or one that does not parse, is an error.
+func LoadSession(copyRoot, sessionID string) (SessionState, error) {
+	if !ValidSessionID(sessionID) {
+		return SessionState{}, ErrSessionID
+	}
+	root, err := os.OpenRoot(copyRoot)
+	if err != nil {
+		return SessionState{}, err
+	}
+	defer root.Close()
+	f, err := root.Open(path.Join(SessionsDir, sessionID+".json"))
+	if errors.Is(err, fs.ErrNotExist) {
+		return SessionState{SchemaVersion: SchemaVersion}, nil
+	}
+	if err != nil {
+		return SessionState{}, err
+	}
+	defer f.Close()
+	raw, err := io.ReadAll(io.LimitReader(f, MaxFileBytes+1))
+	if err != nil {
+		return SessionState{}, err
+	}
+	if len(raw) > MaxFileBytes {
+		return SessionState{}, fmt.Errorf("the session state %s is over %d KiB", sessionID, MaxFileBytes>>10)
+	}
+	var st SessionState
+	if err := json.Unmarshal(raw, &st); err != nil || st.SchemaVersion != SchemaVersion {
+		return SessionState{}, fmt.Errorf("the session state %s does not parse", sessionID)
+	}
+	return st, nil
+}
+
+// SaveSession writes the session's state below copyRoot through fsutil's
+// atomic writer, making the folders owner-only on the way.
+func SaveSession(copyRoot, sessionID string, st SessionState) error {
+	if !ValidSessionID(sessionID) {
+		return ErrSessionID
+	}
+	root, err := os.OpenRoot(copyRoot)
+	if err != nil {
+		return err
+	}
+	defer root.Close()
+	if err := root.MkdirAll(SessionsDir, 0o700); err != nil {
+		return err
+	}
+	st.SchemaVersion = SchemaVersion
+	raw, err := json.MarshalIndent(st, "", "  ")
+	if err != nil {
+		return err
+	}
+	return fsutil.WriteFileAtomicInRoot(root, path.Join(SessionsDir, sessionID+".json"), append(raw, '\n'), 0o600)
+}
diff --git a/internal/core/autonomy/sessions.go b/internal/core/autonomy/sessions.go
new file mode 100644
index 0000000000..5139e1e343
--- /dev/null
+++ b/internal/core/autonomy/sessions.go
@@ -0,0 +1,145 @@
+package autonomy
+
+import (
+	"encoding/json"
+	"errors"
+	"io/fs"
+	"os"
+	"regexp"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/gitutil"
+)
+
+// SessionsFile is the away store's note of each session's start copy: the
+// worktree a session started in, keyed by session id, so a hook run after the
+// session changed directory into a worktree it made still reads the start
+// copy's key, local tier and session state ("Which copy").
+const SessionsFile = "sessions.json"
+
+// MaxSessionNotes bounds the notes kept; the oldest go first.
+const MaxSessionNotes = 256
+
+// SessionNoteTTL is how long a note is kept: a session older than this is
+// long over.
+const SessionNoteTTL = 30 * 24 * time.Hour
+
+// sessionIDRe is the shape of a session id abcd keys anything on.
+var sessionIDRe = regexp.MustCompile(`^[A-Za-z0-9_-]{1,128}$`)
+
+// ErrSessionID is a session id outside [A-Za-z0-9_-]{1,128}.
+var ErrSessionID = errors.New("autonomy: the session id is not [A-Za-z0-9_-]{1,128}")
+
+// ValidSessionID reports whether id is one abcd keys a file on.
+func ValidSessionID(id string) bool { return sessionIDRe.MatchString(id) }
+
+// SessionNote is one session's start copy.
+type SessionNote struct {
+	ID   string    `json:"id"`
+	Copy string    `json:"copy"`
+	At   time.Time `json:"at"`
+}
+
+type sessionNotes struct {
+	SchemaVersion int           `json:"schema_version"`
+	Sessions      []SessionNote `json:"sessions"`
+}
+
+func (s Store) readNotes() (sessionNotes, error) {
+	raw, err := s.ReadFile(SessionsFile)
+	if errors.Is(err, fs.ErrNotExist) && !errors.Is(err, ErrUnsafe) {
+		return sessionNotes{SchemaVersion: SchemaVersion}, nil
+	}
+	if err != nil {
+		return sessionNotes{}, err
+	}
+	var n sessionNotes
+	if err := json.Unmarshal(raw, &n); err != nil || n.SchemaVersion != SchemaVersion {
+		return sessionNotes{}, errors.Join(ErrUnsafe, errors.New(s.Display(SessionsFile)+" does not parse"))
+	}
+	return n, nil
+}
+
+// NoteSessionCopy notes copy as the session's start copy, under the store's
+// lock, unless the session already has a note: the first note is the start,
+// so a compaction or resume run from a worktree the session made keeps it.
+// It reports whether it wrote. Notes past SessionNoteTTL, and the oldest past
+// MaxSessionNotes, are dropped.
+func (s Store) NoteSessionCopy(sessionID, copy string, now time.Time) (bool, error) {
+	if !ValidSessionID(sessionID) {
+		return false, ErrSessionID
+	}
+	wrote := false
+	err := s.WithLock(func() error {
+		n, err := s.readNotes()
+		if err != nil {
+			return err
+		}
+		kept := n.Sessions[:0]
+		for _, e := range n.Sessions {
+			if e.ID == sessionID {
+				return nil
+			}
+			if now.Sub(e.At) < SessionNoteTTL {
+				kept = append(kept, e)
+			}
+		}
+		kept = append(kept, SessionNote{ID: sessionID, Copy: copy, At: now.Truncate(time.Second)})
+		if len(kept) > MaxSessionNotes {
+			kept = kept[len(kept)-MaxSessionNotes:]
+		}
+		n.SchemaVersion, n.Sessions = SchemaVersion, kept
+		raw, err := json.MarshalIndent(n, "", "  ")
+		if err != nil {
+			return err
+		}
+		if err := s.WriteFile(SessionsFile, append(raw, '\n')); err != nil {
+			return err
+		}
+		wrote = true
+		return nil
+	})
+	return wrote, err
+}
+
+// SessionCopy is the session's noted start copy, when it has one that is
+// still a directory.
+func (s Store) SessionCopy(sessionID string) (string, bool) {
+	if !ValidSessionID(sessionID) {
+		return "", false
+	}
+	n, err := s.readNotes()
+	if err != nil {
+		return "", false
+	}
+	for _, e := range n.Sessions {
+		if e.ID == sessionID {
+			if fi, err := os.Stat(e.Copy); err == nil && fi.IsDir() {
+				return e.Copy, true
+			}
+			return "", false
+		}
+	}
+	return "", false
+}
+
+// ResolveCopy is the working copy a session acts from: the start copy its
+// session-start noted, else the worktree of cwd; and the away store its
+// repository keys. The store is keyed on the root commit, so every worktree
+// of the repository opens the same one and finds the note.
+func ResolveCopy(cwd, sessionID string, o Options) (string, Store, error) {
+	root, st, err := Resolve(cwd, o)
+	if err != nil {
+		return root, st, err
+	}
+	if c, ok := st.SessionCopy(sessionID); ok {
+		// A noted copy git cannot answer for is not confirmed, and the
+		// session acts from cwd's worktree, as when it is no repository.
+		if top, err := gitutil.Toplevel(c); err == nil {
+			if sha, err := gitutil.RootCommit(top); err == nil && sha == st.RootSHA() {
+				return top, st, nil
+			}
+		}
+	}
+	return root, st, nil
+}
diff --git a/internal/core/autonomy/store.go b/internal/core/autonomy/store.go
new file mode 100644
index 0000000000..92eec01256
--- /dev/null
+++ b/internal/core/autonomy/store.go
@@ -0,0 +1,313 @@
+package autonomy
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"regexp"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/abcdhome"
+	"github.com/intentdriven/abcd/internal/fsutil"
+	"github.com/intentdriven/abcd/internal/gitutil"
+)
+
+const (
+	// StoreDir is the away store's folder below abcd's home; each repository
+	// has StoreDir/<root-sha>/.
+	StoreDir = "away"
+	// RecordFile is the away record's file name in a repository's folder.
+	RecordFile = "record.json"
+	// LockFile is the lock file's name in a repository's folder.
+	LockFile = "lock"
+	// MaxFileBytes is the most any file in the store may hold.
+	MaxFileBytes = 64 << 10
+	// LockTimeout is how long a writer waits for the lock.
+	LockTimeout = 2 * time.Second
+)
+
+var (
+	// ErrUnsafe is a store file that is not a regular file this account owns
+	// that no one else can write, within MaxFileBytes, or that does not parse.
+	ErrUnsafe = errors.New("autonomy: away store file refused")
+	// ErrLockBusy is the store's lock not had within LockTimeout.
+	ErrLockBusy = errors.New("autonomy: away store lock busy")
+	// ErrNoRootCommit is a repository with no root commit to key the store on.
+	ErrNoRootCommit = errors.New("autonomy: the repository has no root commit to key the away store on")
+	// ErrNoHome is a home directory that is unset or not absolute.
+	ErrNoHome = errors.New("autonomy: no home directory for the away store")
+	// ErrRecordFull is a record that would pass MaxFileBytes if written.
+	ErrRecordFull = errors.New("autonomy: the away record would pass 64 KiB")
+)
+
+// Store is one repository's folder in the away store.
+type Store struct {
+	home    string
+	rootSHA string
+}
+
+// openStore is the away store of the repository whose working copy is at
+// repoRoot, below home: keyed on the repository's root commit, so every
+// working copy of it opens the same store. Nothing is created.
+func openStore(home, repoRoot string) (Store, error) {
+	sha, err := gitutil.RootCommit(repoRoot)
+	if err != nil {
+		// Not ErrNoRootCommit: git did not answer, and the store is neither
+		// keyed nor read on a guess.
+		return Store{}, fmt.Errorf("reading the repository's root commit to key the away store on: %w", err)
+	}
+	if !gitutil.IsFullSHA(sha) {
+		return Store{}, ErrNoRootCommit
+	}
+	return StoreAt(home, sha)
+}
+
+// StoreAt is the away store keyed on rootSHA, a full object name, below home.
+func StoreAt(home, rootSHA string) (Store, error) {
+	if home == "" || !filepath.IsAbs(home) {
+		return Store{}, ErrNoHome
+	}
+	if !gitutil.IsFullSHA(rootSHA) {
+		return Store{}, ErrNoRootCommit
+	}
+	return Store{home: home, rootSHA: rootSHA}, nil
+}
+
+// RootSHA is the root commit the store is keyed on.
+func (s Store) RootSHA() string { return s.rootSHA }
+
+// Rel is the store's folder as a slash path relative to the home directory.
+func (s Store) Rel() string { return abcdhome.Rel(StoreDir, s.rootSHA) }
+
+// Dir is the store's folder.
+func (s Store) Dir() string { return abcdhome.Path(s.home, StoreDir, s.rootSHA) }
+
+// RecordPath is the away record's path.
+func (s Store) RecordPath() string { return filepath.Join(s.Dir(), RecordFile) }
+
+// LockPath is the lock file's path.
+func (s Store) LockPath() string { return filepath.Join(s.Dir(), LockFile) }
+
+// Display is a file of the store in the tilde form a message names it by.
+func (s Store) Display(name string) string { return abcdhome.Display(StoreDir, s.rootSHA, name) }
+
+// siblingRe is a sibling file's name: one path segment, no leading dot.
+var siblingRe = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$`)
+
+// ReadFile reads the store file name under the store's checks: a regular
+// file this account owns that no one else can write, within MaxFileBytes,
+// reached through folders no one else can change. An absent file is an error
+// for which errors.Is(err, fs.ErrNotExist) holds; a refused one is ErrUnsafe,
+// naming it. A caller reading to modify holds WithLock around it.
+func (s Store) ReadFile(name string) ([]byte, error) {
+	if !siblingRe.MatchString(name) {
+		return nil, fmt.Errorf("%w: %q is not a store file name", ErrUnsafe, name)
+	}
+	raw, refusal, err := fsutil.ReadHomeDeclaration(s.home, s.Rel()+"/"+name, MaxFileBytes)
+	switch refusal {
+	case fsutil.DeclarationOK:
+		return raw, nil
+	case fsutil.DeclarationAbsent:
+		if errors.Is(err, fs.ErrNotExist) {
+			return nil, err
+		}
+	}
+	return nil, fmt.Errorf("%w: %s %s", ErrUnsafe, s.Display(name), refusalWords(refusal, err))
+}
+
+// WriteFile replaces the store file name through fsutil's atomic writer,
+// creating the store's folders (owner-only) on the way, and refuses data past
+// MaxFileBytes. The caller holds WithLock.
+func (s Store) WriteFile(name string, data []byte) error {
+	if !siblingRe.MatchString(name) || name == LockFile {
+		return fmt.Errorf("%w: %q is not a store file name", ErrUnsafe, name)
+	}
+	if len(data) > MaxFileBytes {
+		return fmt.Errorf("%w: %s would hold %d bytes, at most %d", ErrRecordFull, s.Display(name), len(data), MaxFileBytes)
+	}
+	dir, err := fsutil.EnsureHomeScope(s.home, s.Rel(), abcdhome.DirMode)
+	if err != nil {
+		return fmt.Errorf("opening %s: %w", abcdhome.Display(StoreDir, s.rootSHA), err)
+	}
+	defer dir.Close()
+	if err := fsutil.WriteFileAtomicInRoot(dir, name, data, abcdhome.FileMode); err != nil {
+		return fmt.Errorf("writing %s: %w", s.Display(name), err)
+	}
+	return nil
+}
+
+func refusalWords(r fsutil.DeclarationRefusal, err error) string {
+	switch r {
+	case fsutil.DeclarationNotRegular:
+		return "is not a regular file (a symlink or something else stands there)"
+	case fsutil.DeclarationWritableByOthers:
+		return "is writable by another account"
+	case fsutil.DeclarationForeignOwner:
+		return "is not this account's"
+	case fsutil.DeclarationBehindSymlink:
+		return "is reached through a symlink"
+	case fsutil.DeclarationDirectoryExposed:
+		return "sits in a folder another account can change"
+	}
+	if errors.Is(err, fsutil.ErrTooBig) {
+		return fmt.Sprintf("is over %d KiB", MaxFileBytes>>10)
+	}
+	return "could not be read safely"
+}
+
+// vetLock checks the lock file, when there is one, on the store's terms: a
+// regular file this account owns that no one else can write, within
+// MaxFileBytes.
+func (s Store) vetLock() error {
+	p := s.LockPath()
+	fi, err := os.Lstat(p)
+	if errors.Is(err, fs.ErrNotExist) {
+		return nil
+	}
+	if err != nil {
+		return fmt.Errorf("%w: %s could not be checked", ErrUnsafe, s.Display(LockFile))
+	}
+	if !fi.Mode().IsRegular() {
+		return fmt.Errorf("%w: %s %s", ErrUnsafe, s.Display(LockFile), refusalWords(fsutil.DeclarationNotRegular, nil))
+	}
+	if err := fsutil.CallersAlone(p, fi); err != nil {
+		r := fsutil.DeclarationForeignOwner
+		if errors.Is(err, fsutil.ErrDeclarationWritable) {
+			r = fsutil.DeclarationWritableByOthers
+		}
+		return fmt.Errorf("%w: %s %s", ErrUnsafe, s.Display(LockFile), refusalWords(r, nil))
+	}
+	if fi.Size() > MaxFileBytes {
+		return fmt.Errorf("%w: %s %s", ErrUnsafe, s.Display(LockFile), refusalWords(fsutil.DeclarationUnreadable, fsutil.ErrTooBig))
+	}
+	return nil
+}
+
+// WithLock holds the store's lock across fn: the store's folders are made
+// (owner-only) if absent, the lock file is checked as every store file is,
+// and the lock not had within LockTimeout is ErrLockBusy. fn's error is
+// returned as it is.
+func (s Store) WithLock(fn func() error) error {
+	dir, err := fsutil.EnsureHomeScope(s.home, s.Rel(), abcdhome.DirMode)
+	if err != nil {
+		return fmt.Errorf("opening %s: %w", abcdhome.Display(StoreDir, s.rootSHA), err)
+	}
+	dir.Close()
+	if err := s.vetLock(); err != nil {
+		return err
+	}
+	err = fsutil.WithFileLock(s.LockPath(), LockTimeout, fn)
+	switch {
+	case errors.Is(err, fsutil.ErrLockContention):
+		return fmt.Errorf("%w: %s was not had within %s", ErrLockBusy, s.Display(LockFile), LockTimeout)
+	case errors.Is(err, fsutil.ErrLockPathUnsafe):
+		return fmt.Errorf("%w: %s %s", ErrUnsafe, s.Display(LockFile), refusalWords(fsutil.DeclarationNotRegular, nil))
+	}
+	return err
+}
+
+// Read returns the stored record, or nil when there is none. A record or
+// lock refused by the store's checks, or a record that does not parse, is
+// ErrUnsafe naming the file.
+func (s Store) Read() (*Record, error) {
+	raw, err := s.ReadFile(RecordFile)
+	if errors.Is(err, fs.ErrNotExist) && !errors.Is(err, ErrUnsafe) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	if err := s.vetLock(); err != nil {
+		return nil, err
+	}
+	var r Record
+	if err := json.Unmarshal(raw, &r); err != nil {
+		return nil, fmt.Errorf("%w: %s does not parse", ErrUnsafe, s.Display(RecordFile))
+	}
+	if r.SchemaVersion != SchemaVersion {
+		return nil, fmt.Errorf("%w: %s has schema_version %d, this abcd reads %d", ErrUnsafe, s.Display(RecordFile), r.SchemaVersion, SchemaVersion)
+	}
+	return &r, nil
+}
+
+// Away is the hooks' read, which fails open: the stored record and whether it
+// holds at now. A record that cannot be read safely reads as not away (nil,
+// false) with the reason returned, for one line on stderr.
+func (s Store) Away(now time.Time) (*Record, bool, error) {
+	r, err := s.Read()
+	if err != nil {
+		return nil, false, err
+	}
+	return r, r.Holds(now), nil
+}
+
+// Update is the store's read-modify-write: under the lock it re-reads the
+// record (nil when there is none) and hands it to fn, and writes what fn
+// returns. fn returning nil writes nothing; its error is returned and nothing
+// is written. Update returns the record written, or the one read when nothing
+// was.
+func (s Store) Update(fn func(cur *Record) (*Record, error)) (*Record, error) {
+	return s.update(s.Read, fn)
+}
+
+// update is Update with the read under the lock named.
+func (s Store) update(read func() (*Record, error), fn func(cur *Record) (*Record, error)) (*Record, error) {
+	var out *Record
+	err := s.WithLock(func() error {
+		cur, err := read()
+		if err != nil {
+			return err
+		}
+		next, err := fn(cur)
+		if err != nil {
+			return err
+		}
+		if next == nil {
+			out = cur
+			return nil
+		}
+		raw, err := json.MarshalIndent(next, "", "  ")
+		if err != nil {
+			return err
+		}
+		if err := s.WriteFile(RecordFile, append(raw, '\n')); err != nil {
+			return err
+		}
+		out = next
+		return nil
+	})
+	return out, err
+}
+
+// RecordStop records a stop at now, only if the record re-read inside the
+// lock still holds; it reports whether it wrote.
+func (s Store) RecordStop(st Stop, now time.Time) (bool, error) {
+	wrote := false
+	_, err := s.Update(func(cur *Record) (*Record, error) {
+		if !cur.Holds(now) {
+			return nil, nil
+		}
+		cur.AddStop(st, now)
+		wrote = true
+		return cur, nil
+	})
+	return wrote && err == nil, err
+}
+
+// RecordHandBack records an item handed back (its branch and head) at now,
+// once per branch and head, only if the record re-read inside the lock still
+// holds; it reports whether it wrote.
+func (s Store) RecordHandBack(branch, head string, now time.Time) (bool, error) {
+	wrote := false
+	_, err := s.Update(func(cur *Record) (*Record, error) {
+		if !cur.Holds(now) || !cur.AddHandBack(branch, head, now) {
+			return nil, nil
+		}
+		wrote = true
+		return cur, nil
+	})
+	return wrote && err == nil, err
+}
diff --git a/internal/core/autonomy/store_test.go b/internal/core/autonomy/store_test.go
new file mode 100644
index 0000000000..0b2ab99576
--- /dev/null
+++ b/internal/core/autonomy/store_test.go
@@ -0,0 +1,259 @@
+package autonomy
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/abcdhome"
+	"github.com/intentdriven/abcd/internal/fsutil"
+	"github.com/intentdriven/abcd/internal/gittest"
+	"github.com/intentdriven/abcd/internal/gitutil"
+)
+
+// managedCopy is a checkout with one commit and the local tier, under a HOME
+// the test owns, so the away store is the test's own.
+func managedCopy(t *testing.T) (root, home string) {
+	t.Helper()
+	home = t.TempDir()
+	t.Setenv("HOME", home)
+	repo := gittest.NewRepo(t)
+	repo.Commit("seed")
+	root, err := filepath.EvalSymlinks(repo.Root())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(filepath.Join(root, ".abcd", ".work.local"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	return root, home
+}
+
+func fixedOptions(home string, now time.Time) Options {
+	return Options{
+		Home: home,
+		Now:  func() time.Time { return now },
+		Who:  func(string) string { return "alice" },
+	}
+}
+
+// TestOpenStoreRefusesWhenGitGivesNoRoot: a root commit git did not answer
+// for is not "no root commit". Opening the store stops with git's failure,
+// not ErrNoRootCommit, and the store is never keyed on a guess.
+func TestOpenStoreRefusesWhenGitGivesNoRoot(t *testing.T) {
+	root, home := managedCopy(t)
+	gittest.ShimGit(t, []string{"--max-parents=0"}, "", 128)
+	_, err := openStore(home, root)
+	if !errors.Is(err, gitutil.ErrNoRootAnswer) || errors.Is(err, ErrNoRootCommit) {
+		t.Fatalf("openStore with git failing = %v, want gitutil.ErrNoRootAnswer and not ErrNoRootCommit", err)
+	}
+}
+
+// TestConcurrentWritesUnderLock: queued steps racing keep every step, and a
+// stop recorded after `mode back` re-reads inside the lock and does not turn
+// the mode back on.
+func TestConcurrentWritesUnderLock(t *testing.T) {
+	root, home := managedCopy(t)
+	now := time.Now().Truncate(time.Second)
+	o := fixedOptions(home, now)
+	if _, err := SetAway(root, "", false, o); err != nil {
+		t.Fatal(err)
+	}
+	const n = 8
+	var wg sync.WaitGroup
+	errs := make(chan error, n)
+	for i := range n {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			_, err := QueueStep(root, "step "+string(rune('a'+i)), o)
+			errs <- err
+		}()
+	}
+	wg.Wait()
+	close(errs)
+	for err := range errs {
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	st, err := openStore(home, root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	rec, err := st.Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(rec.Queue) != n {
+		t.Fatalf("queue holds %d steps after %d racing writes", len(rec.Queue), n)
+	}
+
+	// A stop check that read away before `mode back` must not write it back.
+	if _, holds, _ := st.Away(now); !holds {
+		t.Fatal("the record does not hold before `mode back`")
+	}
+	if _, err := Back(root, o); err != nil {
+		t.Fatal(err)
+	}
+	wrote, err := st.RecordStop(Stop{Kind: StopWorkOwed, Detail: "feat/x"}, now.Add(time.Minute))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if wrote {
+		t.Error("a stop was recorded on a record `mode back` had ended")
+	}
+	after, err := st.Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if after.Holds(now.Add(time.Minute)) || len(after.Stops) != 0 {
+		t.Errorf("the late stop turned the mode back on or was kept: %+v", after)
+	}
+	if after.Closed == nil || after.Closed.By != "alice" || after.Closed.From != root {
+		t.Errorf("`mode back` did not record who ended it and from which copy: %+v", after.Closed)
+	}
+}
+
+// TestRecordOwnershipFailsOpen: a record or lock that is a symlink, not this
+// account's, writable by others, or over 64 KiB reads as not away, with the
+// reason naming the file, and a verb asked to change it refuses naming it.
+func TestRecordOwnershipFailsOpen(t *testing.T) {
+	for _, c := range []struct {
+		name  string
+		file  string // RecordFile or LockFile
+		spoil func(t *testing.T, path string)
+	}{
+		{"record symlink", RecordFile, func(t *testing.T, p string) {
+			real := p + ".real"
+			mustRename(t, p, real)
+			if err := os.Symlink(real, p); err != nil {
+				t.Fatal(err)
+			}
+		}},
+		{"record writable by others", RecordFile, func(t *testing.T, p string) { mustChmod(t, p, 0o666) }},
+		{"record over 64 KiB", RecordFile, func(t *testing.T, p string) {
+			raw, err := os.ReadFile(p)
+			if err != nil {
+				t.Fatal(err)
+			}
+			pad := strings.Repeat(" ", MaxFileBytes)
+			if err := os.WriteFile(p, append(raw, pad...), 0o600); err != nil {
+				t.Fatal(err)
+			}
+		}},
+		{"record not this account's", RecordFile, func(t *testing.T, p string) {
+			restore := fsutil.SwapOwnerUIDForTest(func(q string) (uint32, error) {
+				if q == p {
+					return uint32(os.Getuid()) + 1, nil
+				}
+				return fsutil.OwnerUID(q)
+			})
+			t.Cleanup(restore)
+		}},
+		{"record does not parse", RecordFile, func(t *testing.T, p string) {
+			if err := os.WriteFile(p, []byte("{not json"), 0o600); err != nil {
+				t.Fatal(err)
+			}
+		}},
+		{"lock symlink", LockFile, func(t *testing.T, p string) {
+			other := filepath.Join(t.TempDir(), "elsewhere")
+			if err := os.WriteFile(other, nil, 0o600); err != nil {
+				t.Fatal(err)
+			}
+			if err := os.Remove(p); err != nil {
+				t.Fatal(err)
+			}
+			if err := os.Symlink(other, p); err != nil {
+				t.Fatal(err)
+			}
+		}},
+		{"lock writable by others", LockFile, func(t *testing.T, p string) { mustChmod(t, p, 0o666) }},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			root, home := managedCopy(t)
+			now := time.Now().Truncate(time.Second)
+			o := fixedOptions(home, now)
+			if _, err := SetAway(root, "", false, o); err != nil {
+				t.Fatal(err)
+			}
+			st, err := openStore(home, root)
+			if err != nil {
+				t.Fatal(err)
+			}
+			path := st.RecordPath()
+			if c.file == LockFile {
+				path = st.LockPath()
+			}
+			c.spoil(t, path)
+
+			rec, holds, err := st.Away(now)
+			if holds || rec != nil {
+				t.Errorf("a spoilt %s reads as away", c.file)
+			}
+			if err == nil || !strings.Contains(err.Error(), c.file) {
+				t.Errorf("Away err = %v, want one naming %s", err, c.file)
+			}
+			if _, err := QueueStep(root, "push feat/x", o); err == nil || !errors.Is(err, ErrUnsafe) || !strings.Contains(err.Error(), c.file) {
+				t.Errorf("queue on a spoilt %s: err = %v, want ErrUnsafe naming it", c.file, err)
+			}
+			// Ending the mode never depends on the record (the diff review's
+			// major 3): back succeeds, naming the spoilt file in a note, and
+			// the mode no longer holds.
+			res, err := Back(root, o)
+			if err != nil || !strings.Contains(strings.Join(res.Notes, " "), c.file) {
+				t.Errorf("back on a spoilt %s: %+v (%v), want it ended with a note naming the file", c.file, res, err)
+			}
+			if _, holds, _ := st.Away(now); holds {
+				t.Errorf("back on a spoilt %s left the mode holding", c.file)
+			}
+		})
+	}
+}
+
+// TestSetAwayRefusesWithNothingWritten: a past or over-cap --until, a checkout
+// without the local tier, and no checkout at all are refused before the store
+// is touched.
+func TestSetAwayRefusesWithNothingWritten(t *testing.T) {
+	root, home := managedCopy(t)
+	now := time.Now().Truncate(time.Second)
+	o := fixedOptions(home, now)
+	past := now.Add(-time.Hour).Format("2006-01-02T15:04:05Z07:00")
+	far := now.Add(MaxWindow + time.Hour).Format("2006-01-02T15:04:05Z07:00")
+	if _, err := SetAway(root, past, false, o); !errors.Is(err, ErrUntilPast) {
+		t.Errorf("past --until: err = %v", err)
+	}
+	if _, err := SetAway(root, far, false, o); !errors.Is(err, ErrUntilBeyondCap) {
+		t.Errorf("--until past seven days: err = %v", err)
+	}
+	if err := os.RemoveAll(filepath.Join(root, ".abcd")); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := SetAway(root, "", false, o); !errors.Is(err, ErrNoLocalTier) {
+		t.Errorf("no tier: err = %v", err)
+	}
+	if _, err := SetAway(t.TempDir(), "", false, o); err == nil {
+		t.Error("outside a checkout the set was not refused")
+	}
+	if entries, _ := os.ReadDir(abcdhome.Path(home)); len(entries) != 0 {
+		t.Errorf("a refused set left %d entries in the home store", len(entries))
+	}
+}
+
+func mustChmod(t *testing.T, p string, m os.FileMode) {
+	t.Helper()
+	if err := os.Chmod(p, m); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func mustRename(t *testing.T, a, b string) {
+	t.Helper()
+	if err := os.Rename(a, b); err != nil {
+		t.Fatal(err)
+	}
+}
diff --git a/internal/core/autonomy/verbs.go b/internal/core/autonomy/verbs.go
new file mode 100644
index 0000000000..a3fa7bd086
--- /dev/null
+++ b/internal/core/autonomy/verbs.go
@@ -0,0 +1,238 @@
+package autonomy
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/core/claim"
+	"github.com/intentdriven/abcd/internal/core/identity"
+	"github.com/intentdriven/abcd/internal/core/mode"
+	"github.com/intentdriven/abcd/internal/gitutil"
+)
+
+// StoreName is the noun the checkout-root refusals are phrased with.
+const StoreName = "the away store"
+
+var (
+	// ErrNoLocalTier is the set's refusal in a checkout abcd does not manage:
+	// the mode store's own refusal, so a front door maps both alike.
+	ErrNoLocalTier = mode.ErrNoLocalTier
+	// ErrNotAway is a queued step with no away record holding.
+	ErrNotAway = errors.New("autonomy: the person is not away")
+)
+
+// Options carry what the verbs read from the machine; the zero value reads
+// the process's own home, clock and identity.
+type Options struct {
+	// Home is the home directory the away store lives under; "" means the
+	// process's own.
+	Home string
+	// Now is the clock; nil means time.Now.
+	Now func() time.Time
+	// Who names the person acting in the checkout at root; nil means
+	// resolveWho.
+	Who func(root string) string
+}
+
+func (o Options) now() time.Time {
+	if o.Now != nil {
+		return o.Now()
+	}
+	return time.Now()
+}
+
+func (o Options) home() (string, error) {
+	if o.Home != "" {
+		return o.Home, nil
+	}
+	h, err := os.UserHomeDir()
+	if err != nil || h == "" {
+		return "", ErrNoHome
+	}
+	return h, nil
+}
+
+func (o Options) who(root, home string) string {
+	if o.Who != nil {
+		return o.Who(root)
+	}
+	return resolveWho(root, home)
+}
+
+// resolveWho names the person acting in the checkout at root: the holder
+// name reservations resolve without a network read, else git's user.name,
+// else "".
+func resolveWho(root, home string) string {
+	if h := claim.ReaderHolder(root, claim.Options{Home: home}); h != "" {
+		return h
+	}
+	if id, err := identity.EffectiveIdentity(root); err == nil {
+		return id.Name
+	}
+	return ""
+}
+
+// Resolve is the checkout root a caller standing in cwd acts from, the away
+// store its repository keys, and the home it lives under.
+func Resolve(cwd string, o Options) (root string, st Store, err error) {
+	root, err = gitutil.CheckoutRoot(cwd, StoreName)
+	if err != nil {
+		return "", Store{}, err
+	}
+	home, err := o.home()
+	if err != nil {
+		return "", Store{}, err
+	}
+	st, err = openStore(home, root)
+	return root, st, err
+}
+
+// Managed reports whether abcd manages the checkout at root: `.abcd/` is a
+// directory at its root (a symbolic link is not), or root is a linked
+// worktree of a repository whose main worktree has one. A worktree a session
+// makes shares the repository's away store, and a branch cut before `.abcd/`
+// was committed, or a `.abcd/` never committed, leaves it out of the
+// worktree. The away mode's hooks and recorder act only in such a checkout,
+// so a plugin installed for every repository reads nothing, writes nothing,
+// runs no git past naming the roots, and says nothing in any other.
+func Managed(root string) bool {
+	if root == "" {
+		return false
+	}
+	if hasAbcd(root) {
+		return true
+	}
+	if fi, err := os.Lstat(filepath.Join(root, ".git")); err != nil || !fi.Mode().IsRegular() {
+		return false // not a linked worktree: there is no main worktree to ask
+	}
+	common, err := gitutil.RevParseAbsPath(root, "--git-common-dir")
+	if err != nil || filepath.Base(common) != ".git" {
+		return false
+	}
+	return hasAbcd(filepath.Dir(common))
+}
+
+func hasAbcd(root string) bool {
+	fi, err := os.Lstat(filepath.Join(root, ".abcd"))
+	return err == nil && fi.IsDir()
+}
+
+// SetAway is `abcd mode autonomous [--until <time>] [--hold-pushes]` from
+// cwd: until "" is open-ended. A past or unreadable --until, one past seven
+// days, no checkout, and a checkout without the local tier are refused with
+// nothing written; so is a store whose record or lock fails the checks.
+func SetAway(cwd, until string, holdPushes bool, o Options) (*Record, error) {
+	now := o.now()
+	var end time.Time
+	if until != "" {
+		t, err := parseUntil(until, now)
+		if err != nil {
+			return nil, err
+		}
+		end = t
+	}
+	root, err := gitutil.CheckoutRoot(cwd, StoreName)
+	if err != nil {
+		return nil, err
+	}
+	if fi, err := os.Lstat(filepath.Join(root, filepath.FromSlash(mode.TierRelPath))); err != nil || !fi.IsDir() {
+		return nil, fmt.Errorf("%w: %s/ is not a directory in this checkout, so abcd does not manage it and the away mode is not set from it",
+			ErrNoLocalTier, mode.TierRelPath)
+	}
+	_, st, err := Resolve(root, o)
+	if err != nil {
+		return nil, err
+	}
+	who := Who{Name: o.who(root, st.home), Copy: root}
+	// Judge the window before anything is created on disk.
+	if _, err := begin(nil, who, now, end, holdPushes); err != nil {
+		return nil, err
+	}
+	return st.update(st.carryRead, func(cur *Record) (*Record, error) {
+		return begin(cur, who, now, end, holdPushes)
+	})
+}
+
+// BackResult is what `abcd mode back` found and did.
+type BackResult struct {
+	// State is what the record was before: "away" (it held and is now
+	// ended), "lapsed" (its time had passed and it is now closed), or "none"
+	// (no record, or one already closed: nothing to end).
+	State string
+	// Record is the record after the verb, nil when there was none.
+	Record *Record
+	// Lines are the record's lines, printed one each.
+	Lines []string
+	// Notes say what could not be read or done as usual on the way to
+	// ending the mode (a record past its bound, unparsable or not safely
+	// this account's; a lock held past its timeout), one line each.
+	Notes []string
+}
+
+// Back is `abcd mode back` from cwd: under the lock it reads the record's
+// lines, records who ended it and from which copy, and closes it, on a
+// record whose time has passed as on one that holds. It ends the mode
+// whatever state the record is in (end.go): a record past its bound is
+// printed whole and kept fitted; one it cannot read, or not safely this
+// account's, is replaced by a closed record, printing nothing from it; and a
+// lock not had within its timeout, or not safe to take, is gone around,
+// closing without it. Each is named in the result's notes.
+func Back(cwd string, o Options) (BackResult, error) {
+	root, st, err := Resolve(cwd, o)
+	if err != nil {
+		return BackResult{}, err
+	}
+	now := o.now()
+	who := Who{Name: o.who(root, st.home), Copy: root}
+	res := BackResult{State: "none"}
+	ran := false
+	var rec *Record
+	err = st.WithLock(func() error {
+		ran = true
+		var e error
+		rec, e = st.endRecord(&res, who, now)
+		return e
+	})
+	if err != nil && !ran {
+		res = BackResult{State: "none", Notes: []string{fmt.Sprintf("the store's lock was not had (%s), so the record was closed without it", err)}}
+		rec, err = st.endUnlocked(&res, who, now)
+	}
+	res.Record = rec
+	return res, err
+}
+
+// QueueStep is `abcd mode queue "<step>"` from cwd: the step is kept for the
+// person's return while the record holds, and refused otherwise.
+func QueueStep(cwd, step string, o Options) (*Record, error) {
+	root, st, err := Resolve(cwd, o)
+	if err != nil {
+		return nil, err
+	}
+	now := o.now()
+	return st.Update(func(cur *Record) (*Record, error) {
+		if !cur.Holds(now) {
+			return nil, fmt.Errorf("%w: no away record holds, so there is no return to queue the step for; ask the person instead", ErrNotAway)
+		}
+		if err := cur.AddStep(step, root, now); err != nil {
+			return nil, err
+		}
+		return cur, nil
+	})
+}
+
+// AwayAt reads whether the person is away for the checkout at root, failing
+// open: an unreadable record reads as not away, with the reason returned.
+func AwayAt(root string, o Options) (*Record, bool, error) {
+	home, err := o.home()
+	if err != nil {
+		return nil, false, err
+	}
+	st, err := openStore(home, root)
+	if err != nil {
+		return nil, false, err
+	}
+	return st.Away(o.now())
+}
diff --git a/internal/core/autonomy/wake.go b/internal/core/autonomy/wake.go
new file mode 100644
index 0000000000..2036ccfc9b
--- /dev/null
+++ b/internal/core/autonomy/wake.go
@@ -0,0 +1,108 @@
+package autonomy
+
+import (
+	"time"
+
+	"github.com/intentdriven/abcd/internal/core/lease"
+)
+
+const (
+	// OwedCeiling is the furthest a qualifying wake may fire while work is
+	// owed: a session with owed work waits half an hour at most.
+	OwedCeiling = 30 * time.Minute
+	// IdleCeiling is the furthest a qualifying wake may fire while nothing
+	// is owed.
+	IdleCeiling = time.Hour
+	// MaxLateness is the most the host runs a recurring task late: half the
+	// gap to its following run, at most this.
+	MaxLateness = 30 * time.Minute
+)
+
+// SessionCron is one of the host's scheduled tasks for the session, as the
+// Stop payload's session_crons carries it.
+type SessionCron struct {
+	ID        string `json:"id"`
+	Schedule  string `json:"schedule"`
+	Recurring bool   `json:"recurring"`
+	Prompt    string `json:"prompt"`
+}
+
+// BackgroundTask is one in-flight task the Stop payload's background_tasks
+// carries. A background task is never a wake on its own while away: a
+// `sleep 36000` or a `tail -f` would otherwise hold a session idle.
+type BackgroundTask struct {
+	ID          string `json:"id"`
+	Type        string `json:"type"`
+	Status      string `json:"status"`
+	Description string `json:"description,omitempty"`
+	Command     string `json:"command,omitempty"`
+}
+
+// wakeDeadline is the latest a wake may fire for the stop to wait on it: the
+// earlier of Owed.WakeBy (the earliest renewal not yet due among the live
+// reservations under this copy's key, or the lapse of one already due; else
+// Owed.NextRenewal) less lease.Skew, and now plus a ceiling, OwedCeiling while work
+// is owed and IdleCeiling when none is (dcn-2610181003455731).
+func wakeDeadline(owed Owed, now time.Time) time.Time {
+	ceiling := IdleCeiling
+	if !owed.Empty() {
+		ceiling = OwedCeiling
+	}
+	d := now.Add(ceiling)
+	by := owed.WakeBy
+	if by.IsZero() {
+		by = owed.NextRenewal
+	}
+	if !by.IsZero() {
+		if r := by.Add(-lease.Skew); r.Before(d) {
+			d = r
+		}
+	}
+	return d
+}
+
+// latestFire is a task's next match after now, no later than deadline, and
+// the latest the host may run it: for a recurring task the match plus half
+// the gap to the following match, at most MaxLateness, and nothing for
+// exactly `*/5 * * * *`; a one-shot task is taken as matched, since the host
+// only ever runs one early. ok is false for an expression abcd cannot parse
+// or one with no match by the deadline.
+func latestFire(c SessionCron, now, deadline time.Time, loc *time.Location) (match, latest time.Time, ok bool) {
+	cr, err := parseCron(c.Schedule)
+	if err != nil {
+		return time.Time{}, time.Time{}, false
+	}
+	match, ok = cr.Next(now, deadline, loc)
+	if !ok {
+		return time.Time{}, time.Time{}, false
+	}
+	if !c.Recurring || cr.everyFive {
+		return match, match, true
+	}
+	late := MaxLateness
+	if following, found := cr.Next(match, deadline.Add(time.Hour), loc); found {
+		if half := following.Sub(match) / 2; half < late {
+			late = half
+		}
+	}
+	return match, match.Add(late), true
+}
+
+// qualifyingWake is the task whose latest fire time is no later than
+// deadline, the earliest-matching of them, and its next match, the session's
+// next look. ok is false when none qualifies.
+func qualifyingWake(crons []SessionCron, now, deadline time.Time, loc *time.Location) (SessionCron, time.Time, bool) {
+	var best SessionCron
+	var look time.Time
+	found := false
+	for _, c := range crons {
+		match, latest, ok := latestFire(c, now, deadline, loc)
+		if !ok || latest.After(deadline) {
+			continue
+		}
+		if !found || match.Before(look) {
+			best, look, found = c, match, true
+		}
+	}
+	return best, look, found
+}
diff --git a/internal/core/guard/branchacts.go b/internal/core/guard/branchacts.go
new file mode 100644
index 0000000000..afccb569f8
--- /dev/null
+++ b/internal/core/guard/branchacts.go
@@ -0,0 +1,270 @@
+package guard
+
+import (
+	"path"
+	"strings"
+)
+
+// BranchActKind is what a git command does to the branch a BranchAct names.
+type BranchActKind string
+
+const (
+	// BranchCreate is a branch the command creates: `git worktree add
+	// -b|-B <b>`, `git switch -c|-C <b>`, `git checkout -b|-B <b>`, `git
+	// branch <b>` and `git branch -c|-C [<old>] <b>`. The recorder keeps it
+	// only when no branch of that name exists yet.
+	BranchCreate BranchActKind = "create"
+	// BranchCheckout is a branch `git worktree add` checks out in a new
+	// worktree, creating it when it does not exist: a bare `git worktree add
+	// <path>` names the branch after the folder, and `git worktree add <path>
+	// <commit-ish>` names the commit-ish.
+	BranchCheckout BranchActKind = "checkout"
+	// BranchRename is `git branch -m|-M [<old>] <new>`: a record of <old>
+	// (the current branch when From is "") is carried to <new>.
+	BranchRename BranchActKind = "rename"
+)
+
+// BranchAct is one branch a shell command creates, checks out into a new
+// worktree or renames, as the created-branch recorder of the away mode reads
+// it (spc-2610180914469489 step 3). It is a reading of the command line only:
+// whether the branch exists is the recorder's question.
+type BranchAct struct {
+	Kind BranchActKind
+	// Name is the branch the act leaves: the one created, checked out, or
+	// renamed to.
+	Name string
+	// From is a rename's old name, "" for the current branch.
+	From string
+}
+
+// BranchActs reads command for the branches it creates, checks out into a new
+// worktree or renames, in the order written. It refuses nothing and decides
+// nothing: a line the tokenizer cannot split, and a word a substitution or a
+// variable prints, are read as no act at all.
+func BranchActs(command string) []BranchAct {
+	segs, err := tokenize(command)
+	if err != nil {
+		return nil
+	}
+	var out []BranchAct
+	for _, s := range segs {
+		out = append(out, branchActsIn(s.tokens)...)
+	}
+	return out
+}
+
+// gitValueOptions are git's global options that take their value as the next
+// word.
+var gitValueOptions = map[string]bool{
+	"-C": true, "-c": true, "--git-dir": true, "--work-tree": true,
+	"--namespace": true, "--config-env": true, "--super-prefix": true,
+}
+
+func branchActsIn(toks []string) []BranchAct {
+	// A word nothing fixes (a substitution's output, a variable's value)
+	// makes the whole command no act: the recorder only records, and a
+	// branch it cannot name is one it does not record.
+	for _, w := range toks {
+		if isUnknown(w) {
+			return nil
+		}
+	}
+	for len(toks) > 0 && isAssignmentWord(toks[0]) {
+		toks = toks[1:]
+	}
+	if len(toks) == 0 || path.Base(toks[0]) != "git" {
+		return nil
+	}
+	i := 1
+	for i < len(toks) && strings.HasPrefix(toks[i], "-") {
+		if gitValueOptions[toks[i]] {
+			i++
+		}
+		i++
+	}
+	if i >= len(toks) {
+		return nil
+	}
+	sub, args := toks[i], toks[i+1:]
+	switch sub {
+	case "worktree":
+		if len(args) > 0 && args[0] == "add" {
+			return worktreeAddActs(args[1:])
+		}
+	case "switch":
+		return createFlagActs(args, []string{"-c", "-C", "--create", "--force-create"})
+	case "checkout":
+		return createFlagActs(args, []string{"-b", "-B"})
+	case "branch":
+		return branchCommandActs(args)
+	}
+	return nil
+}
+
+// isAssignmentWord is a NAME=value word in command position.
+func isAssignmentWord(w string) bool {
+	eq := strings.IndexByte(w, '=')
+	if eq <= 0 {
+		return false
+	}
+	for j, r := range w[:eq] {
+		if !(r == '_' || r >= 'A' && r <= 'Z' || r >= 'a' && r <= 'z' || j > 0 && r >= '0' && r <= '9') {
+			return false
+		}
+	}
+	return true
+}
+
+// flagValue reads a value-taking option at args[i] spelled one of names:
+// separate (`-b x`), glued to a short name (`-bx`) or after `=` for a long one
+// (`--create=x`). It returns the value and the index of the last word used.
+func flagValue(args []string, i int, names []string) (string, int, bool) {
+	a := args[i]
+	for _, n := range names {
+		switch {
+		case a == n:
+			if i+1 < len(args) {
+				return args[i+1], i + 1, true
+			}
+			return "", i, false
+		case strings.HasPrefix(n, "--") && strings.HasPrefix(a, n+"="):
+			return a[len(n)+1:], i, true
+		case !strings.HasPrefix(n, "--") && len(a) > len(n) && strings.HasPrefix(a, n):
+			return a[len(n):], i, true
+		}
+	}
+	return "", i, false
+}
+
+// createFlagActs is `git switch` or `git checkout`: a branch only when one of
+// the create options names it.
+func createFlagActs(args []string, names []string) []BranchAct {
+	for i := 0; i < len(args); i++ {
+		if args[i] == "--" {
+			return nil
+		}
+		if v, _, ok := flagValue(args, i, names); ok {
+			if plausibleBranch(v) {
+				return []BranchAct{{Kind: BranchCreate, Name: v}}
+			}
+			return nil
+		}
+	}
+	return nil
+}
+
+// worktreeAddValueOptions are `git worktree add`'s options that take the next
+// word, beside -b and -B.
+var worktreeAddValueOptions = map[string]bool{"--reason": true}
+
+func worktreeAddActs(args []string) []BranchAct {
+	var operands []string
+	created := ""
+	for i := 0; i < len(args); i++ {
+		a := args[i]
+		if a == "--" {
+			operands = append(operands, args[i+1:]...)
+			break
+		}
+		if v, j, ok := flagValue(args, i, []string{"-b", "-B"}); ok {
+			created, i = v, j
+			continue
+		}
+		switch {
+		case a == "-d" || a == "--detach" || a == "--orphan":
+			return nil
+		case worktreeAddValueOptions[a]:
+			i++
+		case strings.HasPrefix(a, "-"):
+		default:
+			operands = append(operands, a)
+		}
+	}
+	if created != "" {
+		if plausibleBranch(created) {
+			return []BranchAct{{Kind: BranchCreate, Name: created}}
+		}
+		return nil
+	}
+	var name string
+	switch len(operands) {
+	case 1:
+		name = path.Base(strings.TrimRight(operands[0], "/"))
+	case 2:
+		name = operands[1]
+	default:
+		return nil
+	}
+	if !plausibleBranch(name) {
+		return nil
+	}
+	return []BranchAct{{Kind: BranchCheckout, Name: name}}
+}
+
+// branchPassOptions are `git branch` options a creation may carry; any other
+// option makes the command something else (a listing, a delete, an upstream).
+var branchPassOptions = map[string]bool{
+	"-f": true, "--force": true, "-t": true, "--track": true, "--no-track": true,
+	"-q": true, "--quiet": true, "--create-reflog": true,
+	"--recurse-submodules": true, "--no-recurse-submodules": true,
+}
+
+func branchCommandActs(args []string) []BranchAct {
+	var operands []string
+	move, copyOp := false, false
+	for i, a := range args {
+		if a == "--" {
+			operands = append(operands, args[i+1:]...)
+			break
+		}
+		switch {
+		case a == "-m" || a == "-M" || a == "--move":
+			move = true
+		case a == "-c" || a == "-C" || a == "--copy":
+			copyOp = true
+		case branchPassOptions[a] || strings.HasPrefix(a, "--track="):
+		case strings.HasPrefix(a, "-"):
+			return nil
+		default:
+			operands = append(operands, a)
+		}
+	}
+	for _, o := range operands {
+		if !plausibleBranch(o) {
+			return nil
+		}
+	}
+	switch {
+	case move && copyOp:
+		return nil
+	case move && len(operands) == 1:
+		return []BranchAct{{Kind: BranchRename, Name: operands[0]}}
+	case move && len(operands) == 2:
+		return []BranchAct{{Kind: BranchRename, From: operands[0], Name: operands[1]}}
+	case copyOp && len(operands) == 1:
+		return []BranchAct{{Kind: BranchCreate, Name: operands[0]}}
+	case copyOp && len(operands) == 2:
+		return []BranchAct{{Kind: BranchCreate, Name: operands[1]}}
+	case move || copyOp:
+		return nil
+	case len(operands) == 1 || len(operands) == 2:
+		return []BranchAct{{Kind: BranchCreate, Name: operands[0]}}
+	}
+	return nil
+}
+
+// plausibleBranch is a word that can name a branch: not empty, not an option,
+// at most 255 bytes, with no whitespace, control character, `..`, or any of
+// the characters git refuses in a ref name.
+func plausibleBranch(b string) bool {
+	if b == "" || len(b) > 255 || strings.HasPrefix(b, "-") || strings.Contains(b, "..") ||
+		strings.HasSuffix(b, "/") || strings.HasSuffix(b, ".lock") || b == "@" {
+		return false
+	}
+	for _, r := range b {
+		if r <= ' ' || r == 0x7f || strings.ContainsRune("~^:?*[\\", r) {
+			return false
+		}
+	}
+	return true
+}
diff --git a/internal/core/guard/branchacts_test.go b/internal/core/guard/branchacts_test.go
new file mode 100644
index 0000000000..38b2ac1598
--- /dev/null
+++ b/internal/core/guard/branchacts_test.go
@@ -0,0 +1,55 @@
+package guard
+
+import (
+	"reflect"
+	"testing"
+)
+
+// TestBranchActsForms: the branch-creating forms of git the created-branch
+// recorder reads (spc-2610180914469489 step 3), each read as the branch it
+// names, and the forms that create nothing read as nothing.
+func TestBranchActsForms(t *testing.T) {
+	cases := []struct {
+		cmd  string
+		want []BranchAct
+	}{
+		{"git worktree add -b feat/x ../x", []BranchAct{{Kind: BranchCreate, Name: "feat/x"}}},
+		{"git worktree add -B feat/x ../x main", []BranchAct{{Kind: BranchCreate, Name: "feat/x"}}},
+		{"git worktree add ../x -b feat/x", []BranchAct{{Kind: BranchCreate, Name: "feat/x"}}},
+		{"git switch -c feat/y", []BranchAct{{Kind: BranchCreate, Name: "feat/y"}}},
+		{"git switch --create=feat/y origin/main", []BranchAct{{Kind: BranchCreate, Name: "feat/y"}}},
+		{"git switch -C feat/y", []BranchAct{{Kind: BranchCreate, Name: "feat/y"}}},
+		{"git checkout -B feat/z", []BranchAct{{Kind: BranchCreate, Name: "feat/z"}}},
+		{"git checkout -b feat/z main", []BranchAct{{Kind: BranchCreate, Name: "feat/z"}}},
+		{"git checkout -bfeat/z", []BranchAct{{Kind: BranchCreate, Name: "feat/z"}}},
+		{"git branch feat/w", []BranchAct{{Kind: BranchCreate, Name: "feat/w"}}},
+		{"git branch --no-track feat/w origin/main", []BranchAct{{Kind: BranchCreate, Name: "feat/w"}}},
+		{"git worktree add ../v", []BranchAct{{Kind: BranchCheckout, Name: "v"}}},
+		{"git worktree add ../u feat/u", []BranchAct{{Kind: BranchCheckout, Name: "feat/u"}}},
+		{"git branch -m feat/w feat/w2", []BranchAct{{Kind: BranchRename, From: "feat/w", Name: "feat/w2"}}},
+		{"git branch -M feat/w2", []BranchAct{{Kind: BranchRename, From: "", Name: "feat/w2"}}},
+		{"git -C ../other -c core.x=y checkout -b feat/q", []BranchAct{{Kind: BranchCreate, Name: "feat/q"}}},
+		{"GIT_TRACE=0 git switch -c feat/e", []BranchAct{{Kind: BranchCreate, Name: "feat/e"}}},
+		{"cd ../x && git switch -c feat/a && git branch feat/b", []BranchAct{{Kind: BranchCreate, Name: "feat/a"}, {Kind: BranchCreate, Name: "feat/b"}}},
+		// Nothing created.
+		{"git branch", nil},
+		{"git branch -d feat/w", nil},
+		{"git branch --list feat/*", nil},
+		{"git branch -u origin/main feat/w", nil},
+		{"git checkout feat/w", nil},
+		{"git switch feat/w", nil},
+		{"git worktree add --detach ../d", nil},
+		{"git worktree list", nil},
+		{"echo git checkout -b feat/no", nil},
+		{"git checkout -b \"$(name)\"", nil},
+	}
+	for _, c := range cases {
+		got := BranchActs(c.cmd)
+		if len(got) == 0 && len(c.want) == 0 {
+			continue
+		}
+		if !reflect.DeepEqual(got, c.want) {
+			t.Errorf("BranchActs(%q) = %+v, want %+v", c.cmd, got, c.want)
+		}
+	}
+}
diff --git a/internal/core/guard/sweep_test.go b/internal/core/guard/sweep_test.go
index e53b0e0726..ce6aa724f0 100644
--- a/internal/core/guard/sweep_test.go
+++ b/internal/core/guard/sweep_test.go
@@ -38,9 +38,15 @@ import (
 // Blocks raised to 26 when the installer's refuse_older landed
 // (hooks/bootstrap.sh): its printf argument line, read alone, blocks as
 // program-name-unknown, the same way say_refusal's argument line already did.
+//
+// Warns raised to 33 when the away mode's stop check landed
+// (spc-2610180914469489 step 5): hooks/stop.sh and hooks/stop-failure.sh are
+// the same launcher as hooks/subagent-stop.sh, and each warns as
+// unrecognised-launcher twice, its command line and the file whole, exactly
+// as that one already did.
 const (
 	maxSweepBlocks = 26
-	maxSweepWarns  = 29
+	maxSweepWarns  = 33
 )
 
 func TestFalsePositiveSweepCeiling(t *testing.T) {
diff --git a/internal/core/guard/unknownsites_test.go b/internal/core/guard/unknownsites_test.go
index 8cb12abd86..147a201aaa 100644
--- a/internal/core/guard/unknownsites_test.go
+++ b/internal/core/guard/unknownsites_test.go
@@ -36,6 +36,15 @@ var wordReaders = map[string]string{
 	"firstOperands":      "the rule itself",
 	"firstOperandLimit":  "the rule itself",
 
+	// branchacts.go: the away mode's created-branch recorder, which records
+	// and refuses nothing.
+	"branchActsIn":      "isUnknown on every word: a command with a word nothing fixes is read as no branch act",
+	"branchCommandActs": "exempt: reads only words branchActsIn found known",
+	"createFlagActs":    "exempt: reads only words branchActsIn found known",
+	"flagValue":         "exempt: reads only words branchActsIn found known",
+	"plausibleBranch":   "exempt: reads only words branchActsIn found known",
+	"worktreeAddActs":   "exempt: reads only words branchActsIn found known",
+
 	// match.go
 	"matchSegmentEnv":      "sitesNamed: every place the entry's command can sit; anyProgram marks a name nothing fixes",
 	"exportsAny":           "commandSites and nameCouldBe",
diff --git a/internal/core/landing/primitives.go b/internal/core/landing/primitives.go
index c87aafc99c..8b6d114757 100644
--- a/internal/core/landing/primitives.go
+++ b/internal/core/landing/primitives.go
@@ -100,15 +100,25 @@ var ErrNoForgeClient = errors.New("the forge client `gh` is not installed")
 // that comes from a record or a branch rides in its flag's own argument
 // (--flag=value) at the caller, so none can be read as a flag of its own.
 func GH(dir string, args ...string) (string, error) {
+	return GHContext(context.Background(), dir, args...)
+}
+
+// GHContext is GH bound to ctx as well as to ForgeTimeout: the client is
+// killed at whichever ends first, and a process it started that still holds
+// its output open is waited for at most a second more, so a caller's own
+// deadline (the away mode's stop check, which lists the forge under ten
+// seconds) holds.
+func GHContext(parent context.Context, dir string, args ...string) (string, error) {
 	bin, err := exec.LookPath("gh")
 	if err != nil {
 		return "", ErrNoForgeClient
 	}
-	ctx, cancel := context.WithTimeout(context.Background(), ForgeTimeout)
+	ctx, cancel := context.WithTimeout(parent, ForgeTimeout)
 	defer cancel()
 	cmd := exec.CommandContext(ctx, bin, args...)
 	cmd.Dir = dir
 	cmd.Env = append(gitutil.ScrubbedEnv(), "GH_PROMPT_DISABLED=1", "GH_NO_UPDATE_NOTIFIER=1")
+	cmd.WaitDelay = time.Second
 	return runCapped(cmd, "gh "+strings.Join(args[:min(2, len(args))], " "))
 }
 
diff --git a/internal/core/mode/away.go b/internal/core/mode/away.go
new file mode 100644
index 0000000000..b2c3cc95d4
--- /dev/null
+++ b/internal/core/mode/away.go
@@ -0,0 +1,25 @@
+package mode
+
+import (
+	"errors"
+	"fmt"
+)
+
+// ErrAway is the badge's refusal while the person is away: a loop parked on
+// the facilitator or the product thinker is a question waiting for someone
+// who is not there (dcn-2610180913431493).
+var ErrAway = errors.New("mode: the person is away")
+
+// RefuseParkWhileAway refuses parking the badge on a person while the away
+// mode holds (away true), naming where the question goes instead. Managed is
+// never refused, and nothing is refused while the person is present. The
+// three-word vocabulary is untouched: the away mode is not a fourth word, and
+// whether it holds is the caller's to read (internal/core/autonomy), so this
+// package keeps no knowledge of the away store.
+func RefuseParkWhileAway(s State, away bool) error {
+	if !away || s == Managed {
+		return nil
+	}
+	return fmt.Errorf("%w, so no stop parks on the %s: decide it and record it with `abcd decide`, "+
+		"or queue an act only the person may approve with `abcd mode queue \"<step>\"`, and carry on", ErrAway, s.Addressee())
+}
diff --git a/internal/core/mode/away_test.go b/internal/core/mode/away_test.go
new file mode 100644
index 0000000000..10474c1ad4
--- /dev/null
+++ b/internal/core/mode/away_test.go
@@ -0,0 +1,30 @@
+package mode
+
+import (
+	"errors"
+	"strings"
+	"testing"
+)
+
+// TestBadgeRefusedWhileAway: while the person is away, parking the badge on
+// either person is refused, naming `abcd decide`, since a badge parked on the
+// person is a question waiting for them; `managed` is never refused, and
+// nothing is refused while the person is present (dcn-2610180913431493).
+func TestBadgeRefusedWhileAway(t *testing.T) {
+	for _, s := range []State{ProductThinker, Facilitator} {
+		err := RefuseParkWhileAway(s, true)
+		if !errors.Is(err, ErrAway) {
+			t.Errorf("%s while away: err = %v, want ErrAway", s, err)
+			continue
+		}
+		if !strings.Contains(err.Error(), "abcd decide") || !strings.Contains(err.Error(), "abcd mode queue") {
+			t.Errorf("%s while away: the refusal does not name `abcd decide` and `abcd mode queue`: %v", s, err)
+		}
+		if err := RefuseParkWhileAway(s, false); err != nil {
+			t.Errorf("%s while present refused: %v", s, err)
+		}
+	}
+	if err := RefuseParkWhileAway(Managed, true); err != nil {
+		t.Errorf("managed while away refused: %v", err)
+	}
+}
diff --git a/internal/core/surface/examples.go b/internal/core/surface/examples.go
index e741f19378..0d404cb506 100644
--- a/internal/core/surface/examples.go
+++ b/internal/core/surface/examples.go
@@ -110,6 +110,8 @@ var examples = map[string]string{
 	"abcd library declassify": "abcd library declassify example-paper-2026",
 	"abcd library ingest":     "abcd library ingest https://example.com/paper.pdf",
 
+	"abcd mode queue": `abcd mode queue "approve the embargo close for the example advisory"`,
+
 	"abcd memory add":    `abcd memory add --title "The tests need the race flag" --recall test --recall race --by Example:model-1 < note.txt`,
 	"abcd memory remove": "abcd memory remove mem-2609010000000001",
 
diff --git a/internal/core/surface/sentences.go b/internal/core/surface/sentences.go
index 542f48be84..d70d997258 100644
--- a/internal/core/surface/sentences.go
+++ b/internal/core/surface/sentences.go
@@ -139,13 +139,13 @@ var sentences = map[string]string{
 		"Writes nothing; refuses a lifeboat whose manifest does not verify.",
 
 	"abcd guard": "Judge a shell command against the hazard registry before it runs: " +
-		"Writes nothing; refuses a hazard through check, hook or approve, and an unknown sub-verb.",
+		"Writes branch records and a question's mode; refuses a hazard and an unknown sub-verb.",
 	"abcd guard check": "Judge one shell command against the hazard registry: " +
 		"Writes nothing; refuses a hazard with exit 1 and a command it cannot parse with exit 2.",
 	"abcd guard approve": "Answer a headless agent's permission prompts over MCP: " +
 		"Writes nothing; refuses every prompt but a shell command the guard reads whole and clears.",
 	"abcd guard hook": "Judge the shell command in a host's pre-tool-use payload: " +
-		"Writes nothing; refuses a hazard or a badly built question with the host's deny.",
+		"Writes branch records and a question's mode; refuses a hazard or a badly built question.",
 
 	"abcd history": "Keep session transcripts in the user-level store and read them back: " +
 		"Writes nothing bare, and redacts each one it stores; refuses an unknown sub-verb.",
@@ -352,6 +352,12 @@ var sentences = map[string]string{
 
 	"abcd mode": "Print or set whose answer the agent loop is waiting on: " +
 		"Writes the state only when setting it; refuses an unknown state or a checkout with no local tier.",
+	"abcd mode autonomous": "Record that the person is away and sessions work on, until a time or open-ended: " +
+		"Writes the away record; refuses an end already past or past seven days.",
+	"abcd mode back": "End the away mode, printing what was queued and recorded one line each: " +
+		"Writes its ending whatever the record's or lock's state; refuses outside a git checkout.",
+	"abcd mode queue": "Queue one step for the person's return while they are away: " +
+		"Writes the away record; refuses when no away record holds.",
 
 	"abcd peers": "List what sibling worktrees and branches hold that this checkout lacks, and the reservations: " +
 		"Writes the fetched reservations; refuses outside a git checkout.",
diff --git a/internal/surface/cli/cli.go b/internal/surface/cli/cli.go
index 548bbbd5d7..59600139ae 100644
--- a/internal/surface/cli/cli.go
+++ b/internal/surface/cli/cli.go
@@ -152,6 +152,7 @@ func applyHookPlaneFailOpen(root *cobra.Command) {
 		{"hook"}, {"hook", "prompt-router"}, {"hook", "prompt-router-reset"},
 		{"hook", "session-start"}, {"hook", "session-end"},
 		{"hook", "subagent-stop"}, {"hook", "question-answered"},
+		{"hook", "stop"}, {"hook", "stop-failure"},
 	} {
 		if cmd := findByPath(root, path); cmd != nil {
 			cmd.SetFlagErrorFunc(failOpenFlagError)
@@ -1656,6 +1657,10 @@ type routerView struct {
 	// SessionTitle is the session's title when this prompt set it
 	// (hook_session_name.go), and absent on every other prompt.
 	SessionTitle string `json:"session_title,omitempty"`
+	// SystemMessage is the one line the person is shown while the away
+	// record holds, or once it lapsed unclosed with anything unread
+	// (spc-2610180914469489 step 2), and absent otherwise.
+	SystemMessage string `json:"system_message,omitempty"`
 }
 
 // routerRefused is the prompt router's fail-open exit when it cannot evaluate
@@ -1731,7 +1736,16 @@ alone, or empty, when the rules could not be loaded):
   {"hookSpecificOutput": {"hookEventName": "UserPromptSubmit",
    "additionalContext": ..., "sessionTitle": ...}}
 
-and the --json envelope carries the name as session_title.`,
+and the --json envelope carries the name as session_title.
+
+While the away record holds (abcd mode autonomous), every prompt's text ends
+with the "## AWAY" block, outside the dedup ledger, and the person is shown
+one line naming who set it, from which working copy, the steps queued and
+items handed back, and abcd mode back; once its window has lapsed unclosed
+with a queued step or a recorded stop, one line naming abcd mode back
+instead. Plain stdout is then one object carrying that line as systemMessage
+beside the additional context (and sessionTitle when owed), and the --json
+envelope carries it as system_message.`,
 		Args: cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, _ []string) error {
 			// The hook's one deadline (C12), set before anything else runs:
@@ -1774,7 +1788,13 @@ and the --json envelope carries the name as session_title.`,
 			// the drain's reason: a rules.json that will not load must not
 			// also leave the badge parked.
 			resetModeOnAnswer(cmd.ErrOrStderr(), cwd)
+			// The away record (spc-2610180914469489 step 2): its block rides
+			// every prompt, outside the loader's dedup ledger, and its line
+			// is shown to the person. Read before the rules, for the drain's
+			// reason, from the drain's root-commit lookup, and inside the
+			// hook's one deadline: the status read below takes what it leaves.
 			root := rulesRoot(cwd, cmd.ErrOrStderr())
+			away := readPromptAway(cmd.ErrOrStderr(), drained, root)
 			rs, err := rules.Load(root)
 			if err != nil {
 				// rules.Load errors already carry their own "rules:" prefix, so
@@ -1786,22 +1806,24 @@ and the --json envelope carries the name as session_title.`,
 				// (spc-2610150728396006 step 3).
 				status := routerStatus(cmd, root, deadline)
 				defer status.MarkShown()
+				// Nor does it switch off the away block and line.
+				text := joinBlocks(status.Text, away.Block)
 				// The title owed on this prompt is set even so: naming does
 				// not depend on the rules (hook_session_name.go). The status
 				// block, when there is one, is the context it is set with.
 				if title := resendSessionTitle(cmd, in); title != "" {
 					if *asJSON {
-						return routerEmit(cmd, routerView{Text: status.Text, Injected: []string{}, Recalled: []string{}, Error: err.Error(), SessionTitle: title})
+						return routerEmit(cmd, routerView{Text: text, Injected: []string{}, Recalled: []string{}, Error: err.Error(), SessionTitle: title, SystemMessage: away.Message})
 					}
-					emitTitled(cmd, status.Text, title)
+					emitPrompt(cmd, text, title, away.Message)
 					return nil
 				}
-				if status.Text != "" && !*asJSON {
-					fmt.Fprint(cmd.OutOrStdout(), status.Text)
+				if (text != "" || away.Message != "") && !*asJSON {
+					emitPrompt(cmd, text, "", away.Message)
 					return nil
 				}
-				if status.Text != "" {
-					return routerEmit(cmd, routerView{Text: status.Text, Injected: []string{}, Recalled: []string{}, Error: err.Error()})
+				if text != "" || away.Message != "" {
+					return routerEmit(cmd, routerView{Text: text, Injected: []string{}, Recalled: []string{}, Error: err.Error(), SystemMessage: away.Message})
 				}
 				return routerRefused(cmd, *asJSON, err.Error())
 			}
@@ -1851,6 +1873,7 @@ and the --json envelope carries the name as session_title.`,
 			status := routerStatus(cmd, root, deadline)
 			defer status.MarkShown()
 			text = joinBlocks(text, status.Text)
+			text = joinBlocks(text, away.Block)
 			// The name this session's start reserved, set once at its first
 			// prompt (hook_session_name.go).
 			title := resendSessionTitle(cmd, in)
@@ -1863,15 +1886,9 @@ and the --json envelope carries the name as session_title.`,
 				if recalled == nil {
 					recalled = []string{}
 				}
-				return routerEmit(cmd, routerView{Text: text, Injected: injected, Recalled: recalled, Active: &res.Active, SessionTitle: title})
-			}
-			if title != "" {
-				emitTitled(cmd, text, title)
-				return nil
-			}
-			if text != "" {
-				fmt.Fprint(cmd.OutOrStdout(), text)
+				return routerEmit(cmd, routerView{Text: text, Injected: injected, Recalled: recalled, Active: &res.Active, SessionTitle: title, SystemMessage: away.Message})
 			}
+			emitPrompt(cmd, text, title, away.Message)
 			return nil
 		},
 	})
@@ -2090,6 +2107,12 @@ and the --json envelope carries the name as session_title.`,
 			// name the first prompt sets, and writes nothing to stdout
 			// (hook_session_name.go).
 			startSessionName(cmd, in, cwd)
+			// The away block, on every source, compaction included, and the
+			// session's start copy noted (spc-2610180914469489 step 2). The
+			// block is the home store's own words, never a tracked file's.
+			if block := sessionStartAway(cmd.ErrOrStderr(), in, cwd); block != "" {
+				fmt.Fprint(cmd.OutOrStdout(), block)
+			}
 			var notices []string
 			// currentSHA is remembered so the cross-repository survey below can
 			// leave this repository out: the drain reports it entry by entry,
@@ -2293,6 +2316,10 @@ and the --json envelope carries the name as session_title.`,
 	// store resolution it needs.
 	hookCmd.AddCommand(newSubagentStopCommand())
 
+	// stop and stop-failure — Stop and StopFailure: the away mode's stop
+	// check (spc-2610180914469489 step 5). Their bodies live in hook_stop.go.
+	hookCmd.AddCommand(newHookStopCommand(), newHookStopFailureCommand())
+
 	return hookCmd
 }
 
diff --git a/internal/surface/cli/guard.go b/internal/surface/cli/guard.go
index af0760cdc7..34263bf55f 100644
--- a/internal/surface/cli/guard.go
+++ b/internal/surface/cli/guard.go
@@ -274,7 +274,11 @@ func newGuardHookCommand() *cobra.Command {
 			"the mode, and the question is marked open in the local tier; the answer\n" +
 			"resets the mode to managed, from `abcd hook question-answered` on the\n" +
 			"question tool's PostToolUse or else on the next human message. A questions\n" +
-			"field the hook cannot read lets the question run and warns loudly.",
+			"field the hook cannot read lets the question run and warns loudly. While\n" +
+			"the away mode holds (`abcd mode autonomous`), every question is refused\n" +
+			"first, whatever its chip, with one reason that routes it by the act it asks\n" +
+			"about: an act only the person may approve to `abcd mode queue`, every other\n" +
+			"question to `abcd decide`; no mode is set and nothing is marked open.",
 		Args: cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, _ []string) error {
 			return answerGuardHook(cmd, guardHookDecide)
@@ -382,6 +386,10 @@ func guardHookDecide(cmd *cobra.Command) error {
 			cwd = wd
 		}
 	}
+	// The away mode's created-branch recorder runs first and refuses
+	// nothing, so the registry's state never decides whether a branch the
+	// session cuts is seen as its own (spc-2610180914469489 step 3).
+	recordCreatedBranches(cmd.ErrOrStderr(), cwd, in.SessionID, in.ToolInput.Workdir, candidate)
 	sessionRoot := rulesRoot(cwd, cmd.ErrOrStderr())
 	// The fail-safe posture is decided in core (guard.LoadRepo,
 	// iss-2608291814576261); the hook only formats it. A dropped repo layer
@@ -535,6 +543,9 @@ func hookToolName(raw []byte) (name string, known bool) {
 // guardHookInput is the subset of the host's pre-tool-use payload the adapter
 // reads. Unknown fields are ignored: the host owns this schema and adds to it.
 type guardHookInput struct {
+	// SessionID names the session, whose start copy the created-branch
+	// recorder keys on (awayCopyRoot).
+	SessionID string `json:"session_id"`
 	Cwd       string `json:"cwd"`
 	ToolName  string `json:"tool_name"`
 	ToolInput struct {
diff --git a/internal/surface/cli/guard_branches.go b/internal/surface/cli/guard_branches.go
new file mode 100644
index 0000000000..40fabf3b1e
--- /dev/null
+++ b/internal/surface/cli/guard_branches.go
@@ -0,0 +1,69 @@
+package cli
+
+import (
+	"encoding/json"
+	"io"
+	"strings"
+
+	"github.com/intentdriven/abcd/internal/core/autonomy"
+	"github.com/intentdriven/abcd/internal/core/guard"
+)
+
+// awayCopyRoot is the working copy a hook acts for: the session's start copy,
+// as the session-start hook noted it (autonomy.ResolveCopy), else the worktree
+// root of the payload's cwd; and nothing at all outside a checkout abcd
+// manages (managedRoot). The stop check reads the copy's owed work from the
+// same root (spc-2610180914469489, "Which copy"), so a branch a session cuts
+// after changing into a worktree it made is recorded where the check looks.
+func awayCopyRoot(cwd, sessionID string) (string, bool) {
+	root, ok := managedRoot(cwd)
+	if !ok {
+		return "", false
+	}
+	if c, _, err := autonomy.ResolveCopy(root, sessionID, autonomy.Options{}); err == nil {
+		return c, true
+	}
+	return root, true
+}
+
+// recordCreatedBranches is the created-branch recorder of the away mode
+// (spc-2610180914469489 step 3): before the guard judges command, the
+// branches it creates, checks out into a new worktree or renames are recorded
+// under the session copy's key (awayCopyRoot) in the away store, whether or not the person
+// is away. It refuses nothing: a store it cannot write leaves one line on w
+// and the command goes on to the guard's own judgement.
+func recordCreatedBranches(w io.Writer, cwd, sessionID string, workdir json.RawMessage, command string) {
+	acts := guard.BranchActs(command)
+	if len(acts) == 0 {
+		return
+	}
+	copyRoot, ok := awayCopyRoot(cwd, sessionID)
+	if !ok {
+		return
+	}
+	runDir := cwd
+	if wd, err := hookWorkdir(workdir, cwd); err == nil && wd.Exists {
+		runDir = wd.Path
+	}
+	changes := make([]autonomy.BranchChange, 0, len(acts))
+	var names []string
+	for _, a := range acts {
+		c := autonomy.BranchChange{Name: a.Name, From: a.From}
+		switch a.Kind {
+		case guard.BranchCreate:
+			c.Kind = autonomy.BranchCreated
+		case guard.BranchCheckout:
+			c.Kind = autonomy.BranchCheckedOut
+		case guard.BranchRename:
+			c.Kind = autonomy.BranchMoved
+		default:
+			continue
+		}
+		changes = append(changes, c)
+		names = append(names, a.Name)
+	}
+	if err := autonomy.RecordCreated(copyRoot, runDir, changes, autonomy.Options{}); err != nil {
+		diagnosticLine(w, "abcd guard: the created branch %s was not recorded for the away mode (%s); the command is not refused for it",
+			strings.Join(names, ", "), scrubPaths(err))
+	}
+}
diff --git a/internal/surface/cli/guard_branches_test.go b/internal/surface/cli/guard_branches_test.go
new file mode 100644
index 0000000000..5a2f6b328f
--- /dev/null
+++ b/internal/surface/cli/guard_branches_test.go
@@ -0,0 +1,201 @@
+package cli
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/abcdhome"
+	"github.com/intentdriven/abcd/internal/core/autonomy"
+	"github.com/intentdriven/abcd/internal/core/claim"
+)
+
+// createdBranches is the created-branch list the recorder kept for root's
+// copy, by name.
+func createdBranches(t *testing.T, root string) []string {
+	t.Helper()
+	key := claim.OwnCopyKey(root)
+	if key == "" {
+		return nil
+	}
+	got, err := awayStore(t, root).CreatedBranches(key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var out []string
+	for _, b := range got {
+		out = append(out, b.Name)
+	}
+	return out
+}
+
+// hookAllows runs the guard hook on command from root and fails the test on a
+// deny: the recorder never refuses.
+func hookAllows(t *testing.T, root, command string) (stderr string) {
+	t.Helper()
+	stdout, stderr, code := runGuard(preToolUse(t, "Bash", command, root), "guard", "hook")
+	if strings.Contains(stdout, `"deny"`) || code == 2 {
+		t.Fatalf("%q was refused: stdout %q stderr %q code %d", command, stdout, stderr, code)
+	}
+	return stderr
+}
+
+// TestBranchRecorderOnCreate: `git worktree add -b feat/x ../x`, `git switch
+// -c feat/y` and `git checkout -B feat/z` record the branch under this copy's
+// key, whether or not the person is away, only when no branch of that name
+// exists, and `git checkout -b main` on an existing main records nothing.
+func TestBranchRecorderOnCreate(t *testing.T) {
+	root := awayCheckout(t)
+	hookAllows(t, root, "git worktree add -b feat/x ../x")
+	if got := createdBranches(t, root); !slices.Equal(got, []string{"feat/x"}) {
+		t.Fatalf("not away: recorded %v, want [feat/x]", got)
+	}
+	if _, err := autonomy.SetAway(root, "", false, autonomy.Options{}); err != nil {
+		t.Fatal(err)
+	}
+	hookAllows(t, root, "git switch -c feat/y")
+	hookAllows(t, root, "git checkout -B feat/z")
+	gitAt(t, root, "branch", "feat/old")
+	hookAllows(t, root, "git checkout -b main")
+	hookAllows(t, root, "git switch -c feat/old")
+	if got := createdBranches(t, root); !slices.Equal(got, []string{"feat/x", "feat/y", "feat/z"}) {
+		t.Fatalf("recorded %v, want [feat/x feat/y feat/z]", got)
+	}
+}
+
+// TestBranchRecorderOtherForms: `git branch feat/w`, a bare `git worktree add
+// ../v` recording v, and `git worktree add ../u feat/u` on an existing branch
+// are recorded; `git branch -m feat/w feat/w2` carries the record; feat/x is
+// not matched inside feat/x2; a tag checked out is no branch; the file stays
+// within its cap.
+func TestBranchRecorderOtherForms(t *testing.T) {
+	root := awayCheckout(t)
+	gitAt(t, root, "branch", "feat/u")
+	gitAt(t, root, "branch", "feat/x")
+	hookAllows(t, root, "git branch feat/w")
+	hookAllows(t, root, "git worktree add ../v")
+	hookAllows(t, root, "git worktree add ../u feat/u")
+	gitAt(t, root, "tag", "v1")
+	hookAllows(t, root, "git worktree add ../t v1")
+	hookAllows(t, root, "git branch -m feat/w feat/w2")
+	hookAllows(t, root, "git checkout -b feat/x2")
+	hookAllows(t, root, "git branch -m feat/x feat/q")
+	got := createdBranches(t, root)
+	want := []string{"feat/w2", "v", "feat/u", "feat/x2"}
+	if !slices.Equal(got, want) {
+		t.Fatalf("recorded %v, want %v", got, want)
+	}
+
+	key := claim.OwnCopyKey(root)
+	st := awayStore(t, root)
+	var fill []autonomy.BranchChange
+	for i := range autonomy.MaxCreatedBranches {
+		fill = append(fill, autonomy.BranchChange{Kind: autonomy.BranchCreated, Name: fmt.Sprintf("feat/fill%03d", i)})
+	}
+	if err := st.RecordBranches(key, fill, time.Now()); err != nil {
+		t.Fatal(err)
+	}
+	hookAllows(t, root, "git switch -c feat/last")
+	got = createdBranches(t, root)
+	if len(got) != autonomy.MaxCreatedBranches || got[len(got)-1] != "feat/last" {
+		t.Fatalf("the list must stay within its cap of %d, newest kept: %d, last %q", autonomy.MaxCreatedBranches, len(got), got[len(got)-1])
+	}
+}
+
+// TestBranchRecorderNeverRefuses: the command is allowed whatever the
+// recorder does, and a store it cannot write leaves a stderr line.
+func TestBranchRecorderNeverRefuses(t *testing.T) {
+	root := awayCheckout(t)
+	st := awayStore(t, root)
+	// A plain file where the store's folder goes: nothing can be written.
+	parent := filepath.Dir(st.Dir())
+	if err := os.MkdirAll(parent, abcdhome.DirMode); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(st.Dir(), []byte("x"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	stderr := hookAllows(t, root, "git switch -c feat/y")
+	if !strings.Contains(stderr, "created branch") || !strings.Contains(stderr, "feat/y") {
+		t.Fatalf("a store the recorder cannot write must leave a stderr line naming the branch; stderr %q", stderr)
+	}
+	// A command with no branch act is silent as before.
+	if stderr := hookAllows(t, root, "git status --porcelain"); stderr != "" {
+		t.Fatalf("no branch act, no line: %q", stderr)
+	}
+}
+
+// TestBranchRecorderUsesSessionStartCopy: the recorder keys a branch on the
+// session's start copy, the one the session-start hook noted, so a session
+// that changed into a worktree it made still records under the copy the stop
+// check reads; with no note for the session it keys on the payload cwd's
+// worktree.
+func TestBranchRecorderUsesSessionStartCopy(t *testing.T) {
+	root := awayCheckout(t)
+	wt := filepath.Join(t.TempDir(), "wt")
+	gitAt(t, root, "worktree", "add", "-q", "-b", "feat/wt", wt)
+	wt = realPath(t, wt)
+	if err := os.MkdirAll(filepath.Join(wt, ".abcd", ".work.local"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	payload := func(session, command string) string {
+		b, err := json.Marshal(map[string]any{
+			"session_id": session, "cwd": wt, "hook_event_name": "PreToolUse", "tool_name": "Bash",
+			"tool_input": map[string]any{"command": command, "description": "x"},
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+		return string(b)
+	}
+	run := func(session, command string) {
+		t.Helper()
+		stdout, stderr, code := runGuard(payload(session, command), "guard", "hook")
+		if strings.Contains(stdout, `"deny"`) || code == 2 {
+			t.Fatalf("%q was refused: stdout %q stderr %q code %d", command, stdout, stderr, code)
+		}
+	}
+
+	if _, err := awayStore(t, root).NoteSessionCopy("noted", root, time.Now()); err != nil {
+		t.Fatal(err)
+	}
+	run("noted", "git switch -c feat/from-noted")
+	if got := createdBranches(t, root); !slices.Contains(got, "feat/from-noted") {
+		t.Fatalf("a noted session's branch is recorded under its start copy: start copy holds %v", got)
+	}
+	if got := createdBranches(t, wt); slices.Contains(got, "feat/from-noted") {
+		t.Fatalf("a noted session's branch is not recorded under the worktree it ran in: worktree holds %v", got)
+	}
+
+	run("unnoted", "git switch -c feat/from-unnoted")
+	if got := createdBranches(t, wt); !slices.Contains(got, "feat/from-unnoted") {
+		t.Fatalf("with no note the branch is recorded under the payload cwd's worktree: worktree holds %v", got)
+	}
+	if got := createdBranches(t, root); slices.Contains(got, "feat/from-unnoted") {
+		t.Fatalf("with no note nothing is recorded under another copy: start copy holds %v", got)
+	}
+}
+
+// TestBranchRecorderSkipsBranchCheckedOutElsewhere: `git worktree add <path>
+// <branch>` naming a branch another worktree has checked out fails in git,
+// so the recorder, which runs before the command, records nothing for it;
+// the same command naming a branch no worktree has checked out is recorded.
+func TestBranchRecorderSkipsBranchCheckedOutElsewhere(t *testing.T) {
+	root := awayCheckout(t)
+	sib := filepath.Join(t.TempDir(), "b")
+	gitAt(t, root, "worktree", "add", "-q", "-b", "feat/sib", sib)
+	gitAt(t, root, "branch", "feat/free")
+	hookAllows(t, root, "git worktree add ../r feat/sib")
+	if got := createdBranches(t, root); slices.Contains(got, "feat/sib") {
+		t.Errorf("a branch another worktree has checked out was recorded: %v", got)
+	}
+	hookAllows(t, root, "git worktree add ../f feat/free")
+	if got := createdBranches(t, root); !slices.Contains(got, "feat/free") {
+		t.Errorf("a branch no worktree has checked out was not recorded: %v", got)
+	}
+}
diff --git a/internal/surface/cli/guard_question.go b/internal/surface/cli/guard_question.go
index 160009f119..daef2498b1 100644
--- a/internal/surface/cli/guard_question.go
+++ b/internal/surface/cli/guard_question.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 
 	"github.com/intentdriven/abcd/internal/core/ahoy"
+	"github.com/intentdriven/abcd/internal/core/autonomy"
 	"github.com/intentdriven/abcd/internal/core/mode"
 	"github.com/intentdriven/abcd/internal/core/question"
 	"github.com/intentdriven/abcd/internal/gitutil"
@@ -27,7 +28,9 @@ import (
 // tool's PostToolUse hook runs the reset when the answer comes back, and the
 // prompt hook runs the same reset on the next human message, for a host that
 // does not run PostToolUse. Another tool's question is none of this file's
-// business and runs unchecked.
+// business and runs unchecked, except while the person is away
+// (spc-2610180914469489): then every question is refused, routed by its act
+// to `abcd mode queue` or `abcd decide`.
 //
 // This file is the whole of the feature on the front-door side. The guard's
 // own hook calls questionGate once, before its shell-command path, and touches
@@ -56,9 +59,16 @@ func isQuestionTool(name string) bool {
 // question whose only finding is the rows limit is admitted with a note for
 // the agent (rowsNote).
 //
-// The order is the spec's. First the questions are decoded; a field the check
-// cannot read is not a decision, so the question runs on the loud, non-blocking
-// status. Then the gate decides whether the question is abcd's: a header in
+// The away record is read first (spc-2610180914469489, "The question
+// reroute"). While it holds, every question-tool call is refused with one
+// reason, abcd's question or another tool's, chipped or not, readable or not
+// (awayQuestionRefusal): the person is not there to answer, and the reason
+// routes the question by the act it asks about. Nothing past that point runs,
+// so no mode is set from a chip and no question is marked open while away.
+//
+// While the person is present the order is the spec's. First the questions
+// are decoded; a field the check cannot read is not a decision, so the
+// question runs on the loud, non-blocking status. Then the gate decides whether the question is abcd's: a header in
 // abcd's chip grammar, which only abcd's interview pages are taught to write,
 // or a mode naming somebody, which only abcd's mode verb and this gate set
 // (itd-201 decision 10). Anything else is another tool's question and runs,
@@ -77,6 +87,74 @@ func isQuestionTool(name string) bool {
 // read or write is not a decision: the question runs and the gate says so, the
 // guard's fail-open-loud contract.
 func questionGate(cmd *cobra.Command, cwd string, raw json.RawMessage) error {
+	away, unread := awayAtQuestion(cwd)
+	if away {
+		return denyCall(awayQuestionRefusal())
+	}
+	if unread == nil {
+		return presentQuestionGate(cmd, cwd, raw)
+	}
+	// The away record could not be read safely, so it reads as not away and
+	// the question is checked as if the person were present. Said on stderr,
+	// and kept loud: an admitted question exits 1, which the host shows,
+	// unless the gate already answered on stdout, whose note exit 1 would
+	// drop. A deny folds the line into its reason.
+	fmt.Fprintf(cmd.ErrOrStderr(), "abcd guard: the away record was not read (%s), so it reads as not away and the question is checked as if the person were present.\n",
+		termsafe.Sanitize(scrubPaths(unread)))
+	out := &wroteWriter{w: cmd.OutOrStdout()}
+	cmd.SetOut(out)
+	err := presentQuestionGate(cmd, cwd, raw)
+	cmd.SetOut(out.w)
+	if err == nil && !out.wrote {
+		return &exitError{Code: 1}
+	}
+	return err
+}
+
+// awayAtQuestion reads whether the person is away for the repository holding
+// cwd (spc-2610180914469489, "The question reroute"). It fails open: outside
+// a checkout, in a repository with no root commit, or with no home, nobody is
+// away and nothing is said; a record or lock the store refuses reads as not
+// away, and is returned for the one line the gate writes.
+func awayAtQuestion(cwd string) (away bool, unread error) {
+	root, err := mode.Root(cwd)
+	if err != nil {
+		return false, nil
+	}
+	_, holds, err := autonomy.AwayAt(root, autonomy.Options{})
+	if err != nil {
+		if errors.Is(err, autonomy.ErrUnsafe) {
+			return false, err
+		}
+		return false, nil
+	}
+	return holds, nil
+}
+
+// awayQuestionRefusal is the one reason every question gets while the person
+// is away, whatever its chip and whoever wrote it (dcn-2610180937177502): a
+// head line saying why, then the route by the act (autonomy.QuestionRoute).
+// It names none of the asking rules, so the agent reroutes the question
+// rather than redrafting it.
+func awayQuestionRefusal() string {
+	return "Blocked by the abcd guard (question tool): the person is away (abcd mode autonomous), so no question is put to them, whatever its chip and whoever wrote it.\n" +
+		autonomy.QuestionRoute()
+}
+
+// wroteWriter records whether anything was written through it.
+type wroteWriter struct {
+	w     io.Writer
+	wrote bool
+}
+
+func (o *wroteWriter) Write(p []byte) (int, error) {
+	o.wrote = o.wrote || len(p) > 0
+	return o.w.Write(p)
+}
+
+// presentQuestionGate is the gate while the person is present: everything
+// questionGate's comment describes after the away check.
+func presentQuestionGate(cmd *cobra.Command, cwd string, raw json.RawMessage) error {
 	stderr := cmd.ErrOrStderr()
 	fields, err := decodeQuestions(raw)
 	if err != nil {
diff --git a/internal/surface/cli/guard_question_away_test.go b/internal/surface/cli/guard_question_away_test.go
new file mode 100644
index 0000000000..28686bf815
--- /dev/null
+++ b/internal/surface/cli/guard_question_away_test.go
@@ -0,0 +1,240 @@
+package cli
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/core/autonomy"
+	"github.com/intentdriven/abcd/internal/core/mode"
+)
+
+// The question reroute (spc-2610180914469489, step 6): while the away record
+// holds, the guard hook refuses every call to the host's question tool with
+// one reason whatever the chip, and the reason routes the question by the act
+// it asks about.
+
+// setAwayHere sets the away mode from the checkout the process stands in,
+// through the verb, as a person or a session on their word would.
+func setAwayHere(t *testing.T) {
+	t.Helper()
+	if _, stderr, err := runSplit(t, "", "mode", "autonomous"); err != nil {
+		t.Fatalf("mode autonomous: %v\n%s", err, stderr)
+	}
+}
+
+// modeFile is the badge's store file in the checkout at root.
+func modeFile(root string) string {
+	return filepath.Join(root, filepath.FromSlash(mode.FileRelPath))
+}
+
+// TestAwayQuestionDeniedOneReason: while the person is away, a Product-chip,
+// a Tech-chip, a Setup-chip and an unchipped question, another tool's (one
+// that would break abcd's rules among them), a questions field the check
+// cannot read, and a question asked from a sibling worktree of the same
+// repository are each refused with the host's deny, and every refusal gives
+// the same reason, which carries the person-only act list.
+func TestAwayQuestionDeniedOneReason(t *testing.T) {
+	foreign := hostQuestion{
+		Header:   "Pick a theme",
+		Question: "Which theme?",
+		Options:  []hostOption{{Label: "Dark (Recommended)"}, {Label: "Light"}},
+	}
+	unchipped := wellBuilt()
+	unchipped.Header = "Label"
+	cases := []struct {
+		name    string
+		before  mode.State // the badge before the mode was set
+		sibling bool       // asked from a sibling worktree
+		payload func(t *testing.T, cwd string) string
+	}{
+		{name: "product chip", payload: func(t *testing.T, cwd string) string { return chipCall(t, cwd, "Product Q1") }},
+		{name: "tech chip", payload: func(t *testing.T, cwd string) string { return chipCall(t, cwd, "Tech Q3") }},
+		{name: "setup chip", payload: func(t *testing.T, cwd string) string { return chipCall(t, cwd, "Setup Q1/4") }},
+		{name: "unchipped, the badge naming the facilitator", before: mode.Facilitator,
+			payload: func(t *testing.T, cwd string) string { return askPayload(t, cwd, unchipped) }},
+		{name: "another tool's", payload: func(t *testing.T, cwd string) string { return askPayload(t, cwd, foreign) }},
+		{name: "unreadable questions field", payload: func(t *testing.T, cwd string) string {
+			return askToolPayload(t, cwd, map[string]any{"questions": 5})
+		}},
+		{name: "from a sibling worktree", sibling: true,
+			payload: func(t *testing.T, cwd string) string { return chipCall(t, cwd, "Product Q1") }},
+	}
+	var first string
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			root := awayCheckout(t)
+			if tc.before != "" {
+				setMode(t, root, tc.before)
+			}
+			setAwayHere(t)
+			cwd := root
+			if tc.sibling {
+				cwd = filepath.Join(t.TempDir(), "sibling")
+				gitAt(t, root, "worktree", "add", "-q", "-b", "feat/sibling", cwd)
+				cwd = realPath(t, cwd)
+				t.Chdir(cwd)
+			}
+			reason := hookDenyOf(t, tc.payload(t, cwd))
+			if first == "" {
+				first = reason
+			} else if reason != first {
+				t.Errorf("the reason differs from the first case's:\n got %q\nwant %q", reason, first)
+			}
+			if !strings.Contains(reason, "the person is away") {
+				t.Errorf("the reason does not say the person is away:\n%s", reason)
+			}
+			// The route carries every person-only act (autonomy's own test
+			// holds the route to the list), so the reason carrying it whole
+			// carries each act.
+			if !strings.Contains(reason, autonomy.QuestionRoute()) {
+				t.Errorf("the reason leaves out the question route and its person-only acts:\n%s", reason)
+			}
+			if strings.Contains(reason, "asking rules") {
+				t.Errorf("an away refusal names the asking rules, so the agent would redraft instead of rerouting:\n%s", reason)
+			}
+		})
+	}
+}
+
+// runGuardTriple is runGuard on the guard hook.
+func runGuardTriple(payload string) (string, string, int) {
+	return runGuard(payload, "guard", "hook")
+}
+
+// hookDenyOf runs the guard hook on payload, asserts it denied the call, and
+// returns the reason.
+func hookDenyOf(t *testing.T, payload string) string {
+	t.Helper()
+	stdout, stderr, code := runGuardTriple(payload)
+	return mustDeny(t, stdout, stderr, code)
+}
+
+// TestAwayQuestionSetsNoMode: a question refused while away sets no mode and
+// writes no marker. The badge stays as it was (absent, or the person an
+// earlier stop named), the question is not marked open, and the away record
+// is untouched, so the chip-set path is never reached while away.
+func TestAwayQuestionSetsNoMode(t *testing.T) {
+	for _, before := range []mode.State{"", mode.Facilitator} {
+		t.Run("badge "+string(before), func(t *testing.T) {
+			root := awayCheckout(t)
+			if before != "" {
+				setMode(t, root, before)
+			}
+			setAwayHere(t)
+			modeBefore, modeErrBefore := os.ReadFile(modeFile(root))
+			recBefore, err := os.ReadFile(awayStore(t, root).RecordPath())
+			if err != nil {
+				t.Fatal(err)
+			}
+			hookDenyOf(t, chipCall(t, root, "Product Q1"))
+
+			modeAfter, modeErrAfter := os.ReadFile(modeFile(root))
+			if string(modeAfter) != string(modeBefore) || (modeErrBefore == nil) != (modeErrAfter == nil) {
+				t.Errorf("the badge's store changed: before %q (%v), after %q (%v)", modeBefore, modeErrBefore, modeAfter, modeErrAfter)
+			}
+			if markedOpen(t, root) {
+				t.Error("a question refused while away was marked open")
+			}
+			recAfter, err := os.ReadFile(awayStore(t, root).RecordPath())
+			if err != nil {
+				t.Fatal(err)
+			}
+			if string(recAfter) != string(recBefore) {
+				t.Errorf("the away record changed on a refused question:\n before %s\n after %s", recBefore, recAfter)
+			}
+		})
+	}
+}
+
+// TestPresentQuestionGateUnchanged: while the person is present (no record,
+// a record ended with `abcd mode back`, or one whose time has passed) the
+// gate is what it was: a chipped question is admitted silently, sets the
+// badge from its chip and is marked open; another tool's question runs
+// unchecked; and a question that breaks abcd's rules is refused on them.
+func TestPresentQuestionGateUnchanged(t *testing.T) {
+	broken := wellBuilt()
+	broken.Options[0].Label = "Role and number (Recommended)"
+	foreign := hostQuestion{
+		Header:   "Pick a theme",
+		Question: "Which theme?",
+		Options:  []hostOption{{Label: "Dark (Recommended)"}, {Label: "Light"}},
+	}
+	for _, present := range []struct {
+		name string
+		make func(t *testing.T, root string)
+	}{
+		{"no record", func(*testing.T, string) {}},
+		{"ended with mode back", func(t *testing.T, root string) {
+			setAwayHere(t)
+			if _, stderr, err := runSplit(t, "", "mode", "back"); err != nil {
+				t.Fatalf("mode back: %v\n%s", err, stderr)
+			}
+		}},
+		{"lapsed", func(t *testing.T, root string) {
+			past := time.Now().Add(-8 * 24 * time.Hour)
+			if _, err := autonomy.SetAway(root, "", false, autonomy.Options{Now: func() time.Time { return past }}); err != nil {
+				t.Fatal(err)
+			}
+		}},
+	} {
+		t.Run(present.name, func(t *testing.T) {
+			root := awayCheckout(t)
+			present.make(t, root)
+			if _, holds, err := autonomy.AwayAt(root, autonomy.Options{}); err != nil || holds {
+				t.Fatalf("the fixture is not present: holds=%v err=%v", holds, err)
+			}
+
+			stdout, stderr, code := runGuardTriple(chipCall(t, root, "Product Q1"))
+			if code != 0 || stdout != "" || stderr != "" {
+				t.Fatalf("a chipped question must be admitted silently while present; code=%d stdout=%q stderr=%q", code, stdout, stderr)
+			}
+			if got, _ := mode.ReadAt(root); got != mode.ProductThinker {
+				t.Errorf("mode = %q, want the chip's product-thinker", got)
+			}
+			if !markedOpen(t, root) {
+				t.Error("the admitted question was not marked open")
+			}
+
+			// The badge names the product thinker now, so another tool's
+			// question would be held to abcd's rules; the answer's reset
+			// puts it back to managed first.
+			setMode(t, root, mode.Managed)
+			if stdout, stderr, code := runGuardTriple(askPayload(t, root, foreign)); code != 0 || stdout != "" || stderr != "" {
+				t.Fatalf("another tool's question must run unchecked while present; code=%d stdout=%q stderr=%q", code, stdout, stderr)
+			}
+
+			reason := hookDenyOf(t, askPayload(t, root, broken))
+			if !strings.Contains(reason, "break abcd's asking rules") || strings.Contains(reason, "the person is away") {
+				t.Errorf("a broken question must be refused on the asking rules alone while present:\n%s", reason)
+			}
+		})
+	}
+}
+
+// TestAwayRecordUnreadableFailsOpenLoud: an away record the store refuses (here
+// one another account could write) reads as not away. The question is checked
+// as if the person were present, the badge set from its chip, and the hook
+// says on exit 1, which the host shows, that the away record was not read.
+func TestAwayRecordUnreadableFailsOpenLoud(t *testing.T) {
+	root := awayCheckout(t)
+	setAwayHere(t)
+	if err := os.Chmod(awayStore(t, root).RecordPath(), 0o666); err != nil {
+		t.Fatal(err)
+	}
+	stdout, stderr, code := runGuardTriple(chipCall(t, root, "Product Q1"))
+	if isDeny(stdout) {
+		t.Fatalf("an unreadable away record must not refuse the question; stdout=%q", stdout)
+	}
+	if code != 1 {
+		t.Errorf("exit = %d, want 1 so the host shows the warning", code)
+	}
+	if !strings.Contains(stderr, "away record") || !strings.Contains(stderr, "writable by another account") {
+		t.Errorf("stderr does not name the unread away record and why:\n%s", stderr)
+	}
+	if got, _ := mode.ReadAt(root); got != mode.ProductThinker {
+		t.Errorf("mode = %q, want the chip's product-thinker", got)
+	}
+}
diff --git a/internal/surface/cli/hook_away.go b/internal/surface/cli/hook_away.go
new file mode 100644
index 0000000000..9295f7a5bd
--- /dev/null
+++ b/internal/surface/cli/hook_away.go
@@ -0,0 +1,200 @@
+package cli
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/core/autonomy"
+	"github.com/intentdriven/abcd/internal/fsutil"
+	"github.com/intentdriven/abcd/internal/gitutil"
+	"github.com/intentdriven/abcd/internal/termsafe"
+	"github.com/spf13/cobra"
+)
+
+// hook_away.go — the away record repeated to the agent and shown to the
+// person (spc-2610180914469489 step 2). The session-start hook, on every
+// source (`compact` included), and the prompt hook, on every prompt and
+// outside the rules loader's dedup ledger, add the away block to the agent's
+// context while the record holds; the prompt hook also shows the person one
+// line (a systemMessage) saying so, or, once the window has lapsed unclosed
+// with anything unread, one line naming `abcd mode back`.
+//
+// The block's words come from the away record, which lives in the away store
+// under the home folder (owner-only, checked as rules.json is), never from a
+// tracked file, and every interpolated value is cleaned to one line.
+
+// awayBlock is the agent-facing block for a record that holds.
+func awayBlock(rec *autonomy.Record) string {
+	var b strings.Builder
+	b.WriteString("## AWAY\n\n")
+	for _, l := range rec.Terms() {
+		b.WriteString(l + "\n")
+	}
+	b.WriteString("\nThe mode is never permission for anything. While it holds, a turn's end is checked: while work is owed the session keeps working, and it waits only with a scheduled wake that fires soon enough.\n\n")
+	b.WriteString("Never ask the person a question while they are away.\n")
+	b.WriteString(autonomy.QuestionRoute() + "\n")
+	b.WriteString("\nRun `abcd mode back` only on the person's word in this session.\n")
+	return b.String()
+}
+
+// awayView is what the away record adds to one prompt: the block for the
+// agent and the line for the person, either possibly empty.
+type awayView struct {
+	Block   string
+	Message string
+}
+
+// readPromptAway reads the away record for the repository whose root commit
+// the live drain already looked up for this prompt, so the router still makes
+// one root-commit lookup a prompt, and only when abcd manages the checkout at
+// root (the loader's root for this prompt). It fails open: a record that cannot be read
+// safely is named on stderr and adds nothing; with no root commit (outside a
+// checkout, or git not answering in time) it adds nothing silently.
+func readPromptAway(stderr io.Writer, drained rootLookup, root string) awayView {
+	if !autonomy.Managed(root) || !drained.asked || drained.err != nil || drained.sha == "" {
+		return awayView{}
+	}
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return awayView{}
+	}
+	st, err := autonomy.StoreAt(home, drained.sha)
+	if err != nil {
+		return awayView{}
+	}
+	now := time.Now()
+	rec, holds, err := st.Away(now)
+	if err != nil {
+		diagnosticLine(stderr, "abcd mode: %s; read as not away", fsutil.RedactHome(err.Error()))
+		return awayView{}
+	}
+	switch {
+	case holds:
+		return awayView{Block: awayBlock(rec), Message: rec.PersonLine()}
+	case rec.Lapsed(now):
+		return awayView{Message: rec.LapsedLine()}
+	}
+	return awayView{}
+}
+
+// readAwayFailOpen is the hooks' read of the away record: ok false when there
+// is nothing to read here (no checkout, no root commit, no home) or the
+// record failed the store's checks, which is named on stderr.
+func readAwayFailOpen(stderr io.Writer, cwd string) (*autonomy.Record, bool, bool) {
+	if cwd == "" {
+		return nil, false, false
+	}
+	_, st, err := autonomy.Resolve(cwd, autonomy.Options{})
+	if err != nil {
+		return nil, false, false
+	}
+	rec, holds, err := st.Away(time.Now())
+	if err != nil {
+		diagnosticLine(stderr, "abcd mode: %s; read as not away", fsutil.RedactHome(err.Error()))
+		return nil, false, false
+	}
+	return rec, holds, true
+}
+
+// managedRoot is the root of the checkout cwd stands in, and whether abcd
+// manages it (autonomy.Managed). Every away hook and the branch recorder ask
+// it first: outside a managed checkout they read nothing, write nothing and
+// say nothing, and run no git at all where the checkout's .git is a folder.
+func managedRoot(cwd string) (string, bool) {
+	if cwd == "" {
+		return "", false
+	}
+	// The marker first, with no git at all: the nearest folder holding a
+	// .git entry. A plain .git folder with no .abcd/ beside it is a
+	// checkout abcd does not manage, and the hooks leave it untouched; only
+	// a managed-looking one, or a linked worktree's .git file, is asked of
+	// git.
+	shaped := gitutil.RepoShapedRoot(cwd)
+	if shaped == "" {
+		return "", false
+	}
+	if fi, err := os.Lstat(filepath.Join(shaped, ".git")); err == nil && fi.IsDir() && !autonomy.Managed(shaped) {
+		return "", false
+	}
+	root, err := gitutil.CheckoutRoot(cwd, autonomy.StoreName)
+	if err != nil || !autonomy.Managed(root) {
+		return "", false
+	}
+	return root, true
+}
+
+// sessionStartAway notes the session's start copy and returns the away block
+// when the record holds. Both happen only in a checkout abcd manages (one with
+// `.abcd/` at its root), and the note only the first time for a session, so a
+// compaction or resume run from a worktree the session made keeps the start.
+func sessionStartAway(stderr io.Writer, in hookInput, cwd string) string {
+	root, ok := managedRoot(cwd)
+	if !ok {
+		return ""
+	}
+	if autonomy.ValidSessionID(in.SessionID) {
+		if _, st, err := autonomy.Resolve(root, autonomy.Options{}); err == nil {
+			if _, err := st.NoteSessionCopy(in.SessionID, root, time.Now()); err != nil {
+				diagnosticLine(stderr, "abcd mode: the session's start copy was not noted (%s)", fsutil.RedactHome(err.Error()))
+			}
+		}
+	}
+	rec, holds, ok := readAwayFailOpen(stderr, root)
+	if !ok || !holds {
+		return ""
+	}
+	return awayBlock(rec)
+}
+
+// promptOutput is the prompt hook's object when it shows the person a line:
+// systemMessage for the person, the additional context for the agent, and
+// the session's title when this prompt sets it.
+type promptOutput struct {
+	SystemMessage      string             `json:"systemMessage,omitempty"`
+	HookSpecificOutput promptOutputFields `json:"hookSpecificOutput"`
+}
+
+type promptOutputFields struct {
+	HookEventName     string `json:"hookEventName"`
+	AdditionalContext string `json:"additionalContext"`
+	SessionTitle      string `json:"sessionTitle,omitempty"`
+}
+
+// emitPrompt writes the prompt hook's plain output: the text alone when there
+// is no title and no line for the person, the titled object when only a title
+// is owed, and otherwise one object carrying the person's line beside the
+// context (and the title). A write that fails is named on stderr; the hook
+// still exits 0.
+func emitPrompt(cmd *cobra.Command, text, title, message string) {
+	switch {
+	case message == "" && title == "":
+		if text != "" {
+			io.WriteString(cmd.OutOrStdout(), text)
+		}
+		return
+	case message == "":
+		emitTitled(cmd, text, title)
+		return
+	}
+	var b bytes.Buffer
+	enc := json.NewEncoder(&b)
+	enc.SetEscapeHTML(false)
+	err := enc.Encode(promptOutput{
+		SystemMessage: termsafe.CleanProseLine(message, 1024),
+		HookSpecificOutput: promptOutputFields{
+			HookEventName: "UserPromptSubmit", AdditionalContext: text, SessionTitle: title,
+		},
+	})
+	if err == nil {
+		_, err = io.Copy(cmd.OutOrStdout(), &b)
+	}
+	if err != nil && !errors.Is(err, io.EOF) {
+		diagnosticLine(cmd.ErrOrStderr(), "abcd mode: the prompt hook's output was not written (%s)", err.Error())
+	}
+}
diff --git a/internal/surface/cli/hook_away_test.go b/internal/surface/cli/hook_away_test.go
new file mode 100644
index 0000000000..c65bc3f90f
--- /dev/null
+++ b/internal/surface/cli/hook_away_test.go
@@ -0,0 +1,282 @@
+package cli
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/core/autonomy"
+)
+
+// hook_away_test.go — step 2 of spc-2610180914469489: the away record repeated
+// to the agent at every session start and on every prompt, and the one line
+// the person sees on every prompt.
+
+func awayStartPayload(session, cwd, source string) string {
+	b, _ := json.Marshal(map[string]string{"session_id": session, "cwd": cwd, "source": source, "hook_event_name": "SessionStart"})
+	return string(b)
+}
+
+func awayPromptPayload(session, cwd, prompt string) string {
+	b, _ := json.Marshal(map[string]string{"session_id": session, "cwd": cwd, "prompt": prompt, "hook_event_name": "UserPromptSubmit"})
+	return string(b)
+}
+
+// promptHookOut is the prompt hook's stdout decoded: the plain text when it is
+// not an object, else the object's fields.
+type promptHookOut struct {
+	Plain   string
+	Message string
+	Context string
+}
+
+func decodePromptHook(t *testing.T, stdout string) promptHookOut {
+	t.Helper()
+	trimmed := strings.TrimSpace(stdout)
+	if !strings.HasPrefix(trimmed, "{") {
+		return promptHookOut{Plain: stdout, Context: stdout}
+	}
+	var v struct {
+		SystemMessage      string `json:"systemMessage"`
+		HookSpecificOutput struct {
+			HookEventName     string `json:"hookEventName"`
+			AdditionalContext string `json:"additionalContext"`
+		} `json:"hookSpecificOutput"`
+	}
+	if err := json.Unmarshal([]byte(trimmed), &v); err != nil {
+		t.Fatalf("the prompt hook's stdout is neither plain text nor one object: %v\n%s", err, stdout)
+	}
+	if v.HookSpecificOutput.HookEventName != "" && v.HookSpecificOutput.HookEventName != "UserPromptSubmit" {
+		t.Errorf("hookEventName = %q", v.HookSpecificOutput.HookEventName)
+	}
+	return promptHookOut{Message: v.SystemMessage, Context: v.HookSpecificOutput.AdditionalContext}
+}
+
+func setAway(t *testing.T, args ...string) {
+	t.Helper()
+	if _, stderr, err := runSplit(t, "", append([]string{"mode", "autonomous"}, args...)...); err != nil {
+		t.Fatalf("mode autonomous: %v\n%s", err, stderr)
+	}
+}
+
+// assertAwayBlock checks the away block's load-bearing sentences.
+func assertAwayBlock(t *testing.T, where, text string) {
+	t.Helper()
+	for _, want := range []string{
+		"## AWAY",
+		"grants no rights",
+		"abcd decide",
+		"abcd mode queue",
+		"--approve",
+		"embargo triage verdict",
+		"drain's hand-back",
+		"release sign-off",
+		"without a standing instruction",
+		"adding a dependency",
+		"force push",
+		"spends money",
+		"Run `abcd mode back` only on the person's word in this session",
+	} {
+		if !strings.Contains(text, want) {
+			t.Errorf("%s: the away block misses %q:\n%s", where, want, text)
+		}
+	}
+}
+
+// TestSessionStartAwayBlockEverySource: startup, resume and compact print the
+// away block while the record holds, and nothing of it when it does not.
+func TestSessionStartAwayBlockEverySource(t *testing.T) {
+	root := awayCheckout(t)
+	for _, source := range []string{"startup", "resume", "compact"} {
+		so, _, err := runSplit(t, awayStartPayload("s-"+source, root, source), "hook", "session-start")
+		if err != nil {
+			t.Fatal(err)
+		}
+		if strings.Contains(so, "## AWAY") {
+			t.Errorf("%s while present printed the away block:\n%s", source, so)
+		}
+	}
+	setAway(t, "--until", "09:00")
+	for _, source := range []string{"startup", "resume", "compact"} {
+		so, _, err := runSplit(t, awayStartPayload("s-"+source, root, source), "hook", "session-start")
+		if err != nil {
+			t.Fatal(err)
+		}
+		assertAwayBlock(t, "session-start "+source, so)
+		if !strings.Contains(so, "Alice") {
+			t.Errorf("%s: the block does not name who set it:\n%s", source, so)
+		}
+	}
+	// Ended: nothing again.
+	if _, _, err := runSplit(t, "", "mode", "back"); err != nil {
+		t.Fatal(err)
+	}
+	so, _, _ := runSplit(t, awayStartPayload("s-after", root, "startup"), "hook", "session-start")
+	if strings.Contains(so, "## AWAY") {
+		t.Errorf("after mode back the session start still prints the block:\n%s", so)
+	}
+}
+
+// TestPromptRouterAwayBlockEveryPrompt: the block rides every prompt of a
+// session, the second as well as the first, outside the loader's dedup ledger.
+func TestPromptRouterAwayBlockEveryPrompt(t *testing.T) {
+	root := awayCheckout(t)
+	so, _, _ := runSplit(t, awayPromptPayload("p1", root, "hello"), "hook", "prompt-router")
+	if strings.Contains(so, "## AWAY") {
+		t.Fatalf("present: the prompt carries the away block:\n%s", so)
+	}
+	setAway(t)
+	for i, prompt := range []string{"hello", "and again"} {
+		so, _, err := runSplit(t, awayPromptPayload("p1", root, prompt), "hook", "prompt-router")
+		if err != nil {
+			t.Fatal(err)
+		}
+		out := decodePromptHook(t, so)
+		assertAwayBlock(t, "prompt "+string(rune('1'+i)), out.Context)
+	}
+	// The --json envelope carries it in text too.
+	so, _, _ = runSplit(t, awayPromptPayload("p1", root, "third"), "hook", "prompt-router", "--json")
+	var v routerView
+	if err := json.Unmarshal([]byte(so), &v); err != nil {
+		t.Fatalf("--json: %v\n%s", err, so)
+	}
+	assertAwayBlock(t, "--json text", v.Text)
+	if !strings.Contains(v.SystemMessage, "abcd mode back") {
+		t.Errorf("--json system_message = %q", v.SystemMessage)
+	}
+}
+
+// TestPromptRouterAwaySystemMessage: one line the person sees on every prompt
+// while the record holds: who set it, from which copy, the counts of queued
+// steps and handed-back items, and the literal `abcd mode back`.
+func TestPromptRouterAwaySystemMessage(t *testing.T) {
+	root := awayCheckout(t)
+	setAway(t, "--until", "09:00")
+	for _, step := range []string{"push feat/x", "merge #12"} {
+		if _, stderr, err := runSplit(t, "", "mode", "queue", step); err != nil {
+			t.Fatalf("mode queue: %v\n%s", err, stderr)
+		}
+	}
+	if _, err := awayStore(t, root).RecordHandBack("feat/x", strings.Repeat("a", 40), time.Now()); err != nil {
+		t.Fatal(err)
+	}
+	for _, prompt := range []string{"one", "two"} {
+		so, _, err := runSplit(t, awayPromptPayload("m1", root, prompt), "hook", "prompt-router")
+		if err != nil {
+			t.Fatal(err)
+		}
+		msg := decodePromptHook(t, so).Message
+		for _, want := range []string{"Alice", "2 steps queued", "1 item handed back", "`abcd mode back`", "away until"} {
+			if !strings.Contains(msg, want) {
+				t.Errorf("prompt %q: the person's line misses %q: %q", prompt, want, msg)
+			}
+		}
+		if strings.Contains(msg, "\n") {
+			t.Errorf("the person's line is more than one line: %q", msg)
+		}
+		if !strings.Contains(msg, filepathBase(root)) {
+			t.Errorf("the person's line does not name the copy: %q", msg)
+		}
+	}
+}
+
+func filepathBase(p string) string { return filepath.Base(p) }
+
+// TestSessionStartNotesCopy: the session's start worktree is noted per session
+// id, and a later read from a worktree the session made resolves to the start
+// copy; a session with no note resolves to its own worktree.
+func TestSessionStartNotesCopy(t *testing.T) {
+	root := awayCheckout(t)
+	if _, _, err := runSplit(t, awayStartPayload("note-1", root, "startup"), "hook", "session-start"); err != nil {
+		t.Fatal(err)
+	}
+	made := filepath.Join(t.TempDir(), "made")
+	gitAt(t, root, "worktree", "add", "-q", "-b", "feat/made", made)
+	made = realPath(t, made)
+
+	got, _, err := autonomy.ResolveCopy(made, "note-1", autonomy.Options{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != root {
+		t.Errorf("a hook run from the made worktree resolves to %s, want the start copy %s", got, root)
+	}
+	// A compaction from the made worktree keeps the first note.
+	if _, _, err := runSplit(t, awayStartPayload("note-1", made, "compact"), "hook", "session-start"); err != nil {
+		t.Fatal(err)
+	}
+	if got, _, _ := autonomy.ResolveCopy(made, "note-1", autonomy.Options{}); got != root {
+		t.Errorf("after a compaction from the made worktree the session resolves to %s, want %s", got, root)
+	}
+	// No note: the payload's own worktree.
+	if got, _, _ := autonomy.ResolveCopy(made, "never-started", autonomy.Options{}); got != made {
+		t.Errorf("a session with no note resolves to %s, want its own worktree %s", got, made)
+	}
+}
+
+// TestPromptRouterLapsedWindowLine: a lapsed, unclosed record with a queued
+// step or a recorded stop shows the person one line naming `abcd mode back`
+// on every prompt until that verb closes it; one with neither shows nothing.
+func TestPromptRouterLapsedWindowLine(t *testing.T) {
+	root := awayCheckout(t)
+	st := awayStore(t, root)
+	lapse := func(queue, stop bool) {
+		t.Helper()
+		past := time.Now().Add(-3 * time.Hour)
+		o := autonomy.Options{Home: os.Getenv("HOME"), Now: func() time.Time { return past }, Who: func(string) string { return "Alice" }}
+		if _, err := autonomy.SetAway(root, past.Add(time.Hour).Format(time.RFC3339), false, o); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := st.Update(func(r *autonomy.Record) (*autonomy.Record, error) {
+			if queue {
+				_ = r.AddStep("push feat/x", root, past)
+			}
+			if stop {
+				r.AddStop(autonomy.Stop{Kind: autonomy.StopWorkOwed, Detail: "behind #12"}, past)
+			}
+			return r, nil
+		}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, c := range []struct {
+		name        string
+		queue, stop bool
+		want        bool
+	}{
+		{"queued step", true, false, true},
+		{"recorded stop", false, true, true},
+		{"neither", false, false, false},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			lapse(c.queue, c.stop)
+			for _, prompt := range []string{"one", "two"} {
+				so, _, _ := runSplit(t, awayPromptPayload("l1", root, prompt), "hook", "prompt-router")
+				out := decodePromptHook(t, so)
+				if strings.Contains(out.Context, "## AWAY") {
+					t.Errorf("a lapsed record still sends the away block:\n%s", out.Context)
+				}
+				has := strings.Contains(out.Message, "`abcd mode back`")
+				if has != c.want {
+					t.Errorf("prompt %q: lapsed line shown=%v, want %v: %q", prompt, has, c.want, out.Message)
+				}
+				if c.want && strings.Contains(out.Message, "\n") {
+					t.Errorf("the lapsed line is more than one line: %q", out.Message)
+				}
+			}
+			if !c.want {
+				return
+			}
+			if _, _, err := runSplit(t, "", "mode", "back"); err != nil {
+				t.Fatal(err)
+			}
+			so, _, _ := runSplit(t, awayPromptPayload("l1", root, "after"), "hook", "prompt-router")
+			if msg := decodePromptHook(t, so).Message; msg != "" {
+				t.Errorf("after mode back the lapsed line still shows: %q", msg)
+			}
+		})
+	}
+}
diff --git a/internal/surface/cli/hook_stop.go b/internal/surface/cli/hook_stop.go
new file mode 100644
index 0000000000..daf612ec68
--- /dev/null
+++ b/internal/surface/cli/hook_stop.go
@@ -0,0 +1,307 @@
+package cli
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"regexp"
+	"strconv"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/core/autonomy"
+	"github.com/intentdriven/abcd/internal/fsutil"
+	"github.com/intentdriven/abcd/internal/termsafe"
+	"github.com/spf13/cobra"
+)
+
+// hook_stop.go — `abcd hook stop` and `abcd hook stop-failure`, the front
+// doors onto the away mode's stop check (spc-2610180914469489 step 5).
+//
+// Every path is fail-open and loud, the guard's contract: a malformed
+// payload, an unreadable record or session state, an owed set that could not
+// be read, or the away store's lock not had within its two seconds allows the
+// stop and says so on stderr. A stop is never blocked on abcd's own fault.
+
+// stopOwedReader is the seam onto the owed reader (spc-2610180914469489 step
+// 4): autonomy.ReadOwed, asked with the session's working copy (its start
+// copy, from the session-start note), the away record (not holding, the
+// reader reads disk only and never calls the forge), the home the away store
+// lives under, and the clock. While away its forge listing runs under its own
+// ten-second deadline. A test replaces it with constructed sets.
+var stopOwedReader = autonomy.ReadOwed
+
+// stopReadBudget bounds the owed read, counted from the hook's start (the
+// checkout's root and root commit included), its forge listing's own
+// ten-second deadline inside it. Judging, the session's state and at most a
+// few store writes under their two-second lock follow, so the hook ends
+// within about 20 seconds, well inside the host's 30-second timeout. A read
+// the budget cuts short is incomplete, and the stop is allowed, naming what
+// was not read (spc-2610180914469489, "Diff review round 1", major 6).
+const stopReadBudget = 14 * time.Second
+
+// stopBlockCapEnv names the host's setting that raises its continuation cap.
+const stopBlockCapEnv = "CLAUDE_CODE_STOP_HOOK_BLOCK_CAP"
+
+// stopPayload is the Stop and StopFailure payload, the fields the stop check
+// reads.
+type stopPayload struct {
+	SessionID            string                    `json:"session_id"`
+	Cwd                  string                    `json:"cwd"`
+	StopHookActive       bool                      `json:"stop_hook_active"`
+	LastAssistantMessage string                    `json:"last_assistant_message"`
+	BackgroundTasks      []autonomy.BackgroundTask `json:"background_tasks"`
+	SessionCrons         []autonomy.SessionCron    `json:"session_crons"`
+	// Error is StopFailure's error type (rate_limit, overloaded, …).
+	Error string `json:"error"`
+}
+
+func readStopPayload(cmd *cobra.Command) (stopPayload, error) {
+	raw, err := io.ReadAll(io.LimitReader(cmd.InOrStdin(), maxHookStdinBytes+1))
+	if err != nil {
+		return stopPayload{}, err
+	}
+	if len(raw) > maxHookStdinBytes {
+		return stopPayload{}, fmt.Errorf("payload is over the %d-byte cap; it was discarded unparsed", maxHookStdinBytes)
+	}
+	var p stopPayload
+	if err := json.Unmarshal(raw, &p); err != nil {
+		return stopPayload{}, err
+	}
+	if p.Cwd == "" {
+		if wd, err := os.Getwd(); err == nil {
+			p.Cwd = wd
+		}
+	}
+	return p, nil
+}
+
+// stopAllow names on stderr why the stop is allowed, and allows it.
+func stopAllow(cmd *cobra.Command, format string, a ...any) error {
+	diagnosticLine(cmd.ErrOrStderr(), "abcd stop: "+format+"; the stop is allowed", a...)
+	return nil
+}
+
+func newHookStopCommand() *cobra.Command {
+	return &cobra.Command{
+		Use:   "stop",
+		Short: "Stop: keep a session working while the person is away and work is owed",
+		Long: `The Stop hook's front door onto the away mode's stop check.
+
+While the away record holds (abcd mode autonomous), a turn's end is blocked
+while work is owed, naming the next item, and is allowed only with a
+session cron whose latest fire time, the host's lateness included, falls
+before the deadline: within half an hour while work is owed (an hour when
+none is) and before the session's reservations need renewing. A wake
+releases an unchanged set of work the session can do itself at most twice
+in a row, and a last message ending on a question is blocked once. Plain
+stdout is then the host's non-error Stop feedback,
+{"hookSpecificOutput":{"hookEventName":"Stop","additionalContext":...}},
+which continues the session as a block does; the block passing the
+host's cap of consecutive continuations (eight, or
+CLAUDE_CODE_STOP_HOOK_BLOCK_CAP) is recorded in the away record as a stop
+possibly forced by the cap. While the person is present the check reads disk
+only and, with work owed, allows the stop with a systemMessage naming it.
+The owed work is read within 14 seconds of the hook's start, so the hook
+ends well inside the host's 30-second timeout; a reading cut short allows
+the stop with a systemMessage naming what was not read, recorded in the away
+record while the person is away.
+
+The session's state is kept per session id in its start copy's local tier,
+.abcd/.work.local/autonomy/sessions/<session-id>.json. A malformed payload,
+an unreadable record or a lock not had allows the stop, naming why on
+stderr; every outcome exits 0. Outside a checkout abcd manages (no .abcd/
+at its root, nor at its main worktree's) it reads nothing and prints
+nothing.`,
+		Args: cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) (ret error) {
+			// A panic allows the stop: exit 2 is the host's block on this
+			// event, and a stop is never blocked on abcd's own fault.
+			defer func() {
+				if r := recover(); r != nil {
+					ret = stopAllow(cmd, "the stop check failed (%s)", termsafe.CleanProseLine(fsutil.RedactHome(fmt.Sprint(r)), 256))
+				}
+			}()
+			ctx, cancel := context.WithTimeout(context.Background(), stopReadBudget)
+			defer cancel()
+			p, err := readStopPayload(cmd)
+			if err != nil {
+				return stopAllow(cmd, "unreadable Stop payload (%s)", termsafe.Sanitize(err.Error()))
+			}
+			root, ok := managedRoot(p.Cwd)
+			if !ok {
+				return nil // not a checkout abcd manages: nothing to check, and no git spent
+			}
+			copyRoot, st, err := autonomy.ResolveCopy(root, p.SessionID, autonomy.Options{})
+			if err != nil {
+				return nil // not a checkout abcd can key a store on: nothing to check
+			}
+			now := time.Now()
+			rec, away, err := st.Away(now)
+			if err != nil {
+				return stopAllow(cmd, "%s; read as not away", fsutil.RedactHome(err.Error()))
+			}
+			if away && !autonomy.ValidSessionID(p.SessionID) {
+				return stopAllow(cmd, "the session id %q is not [A-Za-z0-9_-]{1,128}", termsafe.CleanProseLine(p.SessionID, 64))
+			}
+			home, _ := os.UserHomeDir()
+			owed, err := stopOwedReader(ctx, autonomy.ReadOptions{Root: copyRoot, Record: rec, Home: home, Now: func() time.Time { return now }})
+			if err != nil {
+				return stopAllow(cmd, "owed work could not be read (%s)", fsutil.RedactHome(err.Error()))
+			}
+			in := autonomy.StopInput{
+				SessionID: p.SessionID, StopHookActive: p.StopHookActive, LastAssistantMessage: p.LastAssistantMessage,
+				SessionCrons: p.SessionCrons, BackgroundTasks: p.BackgroundTasks, Cap: stopBlockCap(cmd.ErrOrStderr()),
+			}
+			var prev autonomy.SessionState
+			if away {
+				if prev, err = autonomy.LoadSession(copyRoot, p.SessionID); err != nil {
+					return stopAllow(cmd, "the session's state could not be read (%s)", fsutil.RedactHome(err.Error()))
+				}
+			}
+			v := autonomy.Judge(rec, owed, in, prev, now)
+			if v.Save {
+				if err := autonomy.SaveSession(copyRoot, p.SessionID, v.State); err != nil {
+					return stopAllow(cmd, "the session's state could not be saved (%s)", fsutil.RedactHome(err.Error()))
+				}
+			}
+			for _, h := range v.HandBacks {
+				if _, err := st.RecordHandBack(h.Branch, h.Head, now); err != nil {
+					return stopAllow(cmd, "the hand-back of %s was not recorded (%s)", termsafe.CleanProseLine(h.Branch, 128), stopStoreWords(err))
+				}
+			}
+			if v.Stop != nil {
+				if _, err := st.RecordStop(*v.Stop, now); err != nil {
+					return stopAllow(cmd, "the stop was not recorded (%s)", stopStoreWords(err))
+				}
+			}
+			return emitStop(cmd, v)
+		},
+	}
+}
+
+// stopStoreWords names an away-store failure, the lock's included.
+func stopStoreWords(err error) string {
+	if errors.Is(err, autonomy.ErrLockBusy) {
+		return "the away store's lock was not had in time: " + fsutil.RedactHome(err.Error())
+	}
+	return fsutil.RedactHome(err.Error())
+}
+
+// stopBlockCap is the host's continuation cap as the environment sets it;
+// 0 (the default of eight) when it is unset or not a positive number.
+func stopBlockCap(stderr io.Writer) int {
+	raw := os.Getenv(stopBlockCapEnv)
+	if raw == "" {
+		return 0
+	}
+	n, err := strconv.Atoi(raw)
+	if err != nil || n <= 0 {
+		diagnosticLine(stderr, "abcd stop: %s=%q is not a positive number; counting to the host's default of %d",
+			stopBlockCapEnv, termsafe.CleanProseLine(raw, 32), autonomy.DefaultBlockCap)
+		return 0
+	}
+	return n
+}
+
+// stopBlockOutput is a block written as the host's non-error feedback for a
+// Stop hook: hookSpecificOutput.additionalContext keeps the session going
+// under the same loop protections as {"decision":"block"} (stop_hook_active
+// and the continuation cap), and the host labels it "Stop hook feedback"
+// rather than showing a hook error, its documented form for a hook working as
+// designed (code.claude.com/docs/en/hooks, "Stop decision control").
+type stopBlockOutput struct {
+	HookSpecificOutput stopBlockFields `json:"hookSpecificOutput"`
+}
+
+type stopBlockFields struct {
+	HookEventName     string `json:"hookEventName"`
+	AdditionalContext string `json:"additionalContext"`
+}
+
+type stopMessageOutput struct {
+	SystemMessage string `json:"systemMessage"`
+}
+
+// emitStop writes the host's answer: the block object, the person's line, or
+// nothing.
+func emitStop(cmd *cobra.Command, v autonomy.Verdict) error {
+	var obj any
+	switch {
+	case v.Block:
+		obj = stopBlockOutput{HookSpecificOutput: stopBlockFields{HookEventName: "Stop", AdditionalContext: v.Reason}}
+	case v.SystemMessage != "":
+		obj = stopMessageOutput{SystemMessage: termsafe.CleanProseLine(v.SystemMessage, 1024)}
+	default:
+		return nil
+	}
+	var b bytes.Buffer
+	enc := json.NewEncoder(&b)
+	enc.SetEscapeHTML(false)
+	if err := enc.Encode(obj); err != nil {
+		return stopAllow(cmd, "the answer could not be written (%s)", err.Error())
+	}
+	if _, err := io.Copy(cmd.OutOrStdout(), &b); err != nil {
+		diagnosticLine(cmd.ErrOrStderr(), "abcd stop: the answer could not be written (%s)", err.Error())
+	}
+	return nil
+}
+
+// stopErrorRe is the shape of the host's error types; anything else is
+// recorded as unknown.
+var stopErrorRe = regexp.MustCompile(`^[a-z][a-z0-9_]{0,63}$`)
+
+func newHookStopFailureCommand() *cobra.Command {
+	return &cobra.Command{
+		Use:   "stop-failure",
+		Short: "StopFailure: record a turn the host ended on an API error while the person is away",
+		Long: `The StopFailure hook's front door. While the away record holds, a turn the
+host ended on an API error is recorded in it as "stopped on an API error"
+with the error type, under the store's lock; abcd mode back prints it. The
+host ignores this hook's output and it cannot continue the session. While
+the person is present, or outside a checkout abcd manages, nothing is
+written. Every outcome exits 0.`,
+		Args: cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) (ret error) {
+			defer func() {
+				if r := recover(); r != nil {
+					diagnosticLine(cmd.ErrOrStderr(), "abcd stop: the API-error stop was not recorded (%s)", termsafe.CleanProseLine(fsutil.RedactHome(fmt.Sprint(r)), 256))
+					ret = nil
+				}
+			}()
+			p, err := readStopPayload(cmd)
+			if err != nil {
+				diagnosticLine(cmd.ErrOrStderr(), "abcd stop: unreadable StopFailure payload (%s); nothing recorded", termsafe.Sanitize(err.Error()))
+				return nil
+			}
+			root, ok := managedRoot(p.Cwd)
+			if !ok {
+				return nil
+			}
+			_, st, err := autonomy.ResolveCopy(root, p.SessionID, autonomy.Options{})
+			if err != nil {
+				return nil
+			}
+			now := time.Now()
+			_, away, err := st.Away(now)
+			if err != nil {
+				diagnosticLine(cmd.ErrOrStderr(), "abcd stop: %s; read as not away, nothing recorded", fsutil.RedactHome(err.Error()))
+				return nil
+			}
+			if !away {
+				return nil
+			}
+			kind := p.Error
+			if !stopErrorRe.MatchString(kind) {
+				kind = "unknown"
+			}
+			if _, err := st.RecordStop(autonomy.Stop{Kind: autonomy.StopAPIError, ErrorType: kind}, now); err != nil {
+				diagnosticLine(cmd.ErrOrStderr(), "abcd stop: the API-error stop was not recorded (%s)", stopStoreWords(err))
+			}
+			return nil
+		},
+	}
+}
diff --git a/internal/surface/cli/hook_stop_e2e_test.go b/internal/surface/cli/hook_stop_e2e_test.go
new file mode 100644
index 0000000000..b18045a60e
--- /dev/null
+++ b/internal/surface/cli/hook_stop_e2e_test.go
@@ -0,0 +1,101 @@
+package cli
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/intentdriven/abcd/internal/gittest"
+)
+
+// hook_stop_e2e_test.go — the away mode's stop check end to end, through the
+// real owed reader (spc-2610180914469489 steps 4 and 5 joined at the seam):
+// real git in a temporary checkout with a bare origin, and a stub forge client
+// first on PATH, so nothing reaches a real forge.
+
+// ownedUnpushedCheckout is a managed checkout with a bare origin whose default
+// branch is fetched, and an own branch, feat/x, checked out in this copy and
+// back (so its HEAD reflog holds it), pushed once and then given a commit of
+// this checkout's author that is not pushed. A stub gh answers the away
+// listing with no open pull request and logs every call to the returned file.
+func ownedUnpushedCheckout(t *testing.T) (root, ghLog string) {
+	t.Helper()
+	root = awayCheckout(t)
+	gitAt(t, root, "config", "--local", "user.email", "alice@example.invalid")
+	gitAt(t, root, "config", "--local", "commit.gpgsign", "false")
+	origin := filepath.Join(t.TempDir(), "origin.git")
+	gittest.InitBare(t, origin)
+	gitAt(t, root, "remote", "add", "origin", origin)
+	main := gitAt(t, root, "rev-parse", "--abbrev-ref", "HEAD")
+	gitAt(t, root, "push", "-q", "origin", main)
+	gitAt(t, root, "remote", "set-head", "origin", main)
+	gitAt(t, root, "checkout", "-q", "-b", "feat/x")
+	gitAt(t, root, "commit", "-q", "--allow-empty", "-m", "the first half")
+	gitAt(t, root, "push", "-q", "-u", "origin", "feat/x")
+	gitAt(t, root, "commit", "-q", "--allow-empty", "-m", "the second half, not pushed")
+	gitAt(t, root, "checkout", "-q", main)
+
+	bin := t.TempDir()
+	ghLog = filepath.Join(t.TempDir(), "gh-calls.log")
+	script := "#!/bin/sh\n" +
+		"printf '%s\\n' \"$*\" >> '" + ghLog + "'\n" +
+		"if [ \"$1 $2\" = 'pr list' ]; then echo '[]'; exit 0; fi\n" +
+		"echo \"gh stub: unexpected call: $*\" >&2\nexit 1\n"
+	if err := os.WriteFile(filepath.Join(bin, "gh"), []byte(script), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("PATH", bin+string(os.PathListSeparator)+os.Getenv("PATH"))
+	return root, ghLog
+}
+
+func ghCalls(t *testing.T, log string) string {
+	t.Helper()
+	b, err := os.ReadFile(log)
+	if err != nil && !os.IsNotExist(err) {
+		t.Fatal(err)
+	}
+	return string(b)
+}
+
+// TestHookStopEndToEndOwnUnpushedBranch: while the away record holds, an own
+// branch with commits not pushed blocks the stop, naming the branch and the
+// push sentence that defers to the person's standing instruction, and the
+// forge is asked for the open pull requests. With no away record the same
+// checkout's stop is allowed, the owed branch named to the person, and the
+// forge is never asked.
+func TestHookStopEndToEndOwnUnpushedBranch(t *testing.T) {
+	t.Run("away blocks", func(t *testing.T) {
+		root, ghLog := ownedUnpushedCheckout(t)
+		setAway(t)
+		out, so, se := runStop(t, stopHookPayload(t, "e2e-away", root, false, "Done for now."))
+		if out.Decision != "block" {
+			t.Fatalf("away with an own unpushed branch: want a block, got %s\nstderr: %s", so, se)
+		}
+		for _, want := range []string{
+			"feat/x",
+			"push if your standing instruction allows",
+			"queue it with `abcd mode queue",
+		} {
+			if !strings.Contains(out.Reason, want) {
+				t.Errorf("the block's reason lacks %q:\n%s", want, out.Reason)
+			}
+		}
+		if calls := ghCalls(t, ghLog); !strings.Contains(calls, "pr list") {
+			t.Errorf("away, the forge was not asked for the open pull requests; calls: %q", calls)
+		}
+	})
+	t.Run("present allows", func(t *testing.T) {
+		root, ghLog := ownedUnpushedCheckout(t)
+		out, so, se := runStop(t, stopHookPayload(t, "e2e-present", root, false, "Done for now."))
+		if out.Decision == "block" {
+			t.Fatalf("with no away record the stop is allowed, got %s\nstderr: %s", so, se)
+		}
+		if want := "abcd: stopped with work owed (1 item); next: branch feat/x has commits not pushed."; out.SystemMessage != want {
+			t.Errorf("present, the owed branch is named to the person once:\n got %s\nwant %q", so, want)
+		}
+		if calls := ghCalls(t, ghLog); calls != "" {
+			t.Errorf("present, the check reads disk only, but the forge was asked: %q", calls)
+		}
+	})
+}
diff --git a/internal/surface/cli/hook_stop_test.go b/internal/surface/cli/hook_stop_test.go
new file mode 100644
index 0000000000..9c6e25ee0f
--- /dev/null
+++ b/internal/surface/cli/hook_stop_test.go
@@ -0,0 +1,545 @@
+package cli
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/abcdhome"
+	"github.com/intentdriven/abcd/internal/core/autonomy"
+)
+
+// hook_stop_test.go — step 5 of spc-2610180914469489: `abcd hook stop` and
+// `abcd hook stop-failure`, the front doors onto the stop verdict.
+
+// fakeOwed replaces the owed reader for one test with one answering owed, and
+// counts the calls and what each was asked.
+func fakeOwed(t *testing.T, owed *autonomy.Owed) *[]autonomy.ReadOptions {
+	t.Helper()
+	var asked []autonomy.ReadOptions
+	prev := stopOwedReader
+	stopOwedReader = func(_ context.Context, q autonomy.ReadOptions) (autonomy.Owed, error) {
+		asked = append(asked, q)
+		return *owed, nil
+	}
+	t.Cleanup(func() { stopOwedReader = prev })
+	return &asked
+}
+
+func stopHookPayload(t *testing.T, session, cwd string, active bool, last string, crons ...string) string {
+	t.Helper()
+	var cs []map[string]any
+	for i, c := range crons {
+		cs = append(cs, map[string]any{"id": "cron-" + string(rune('a'+i)), "schedule": c, "recurring": true, "prompt": "look"})
+	}
+	b, err := json.Marshal(map[string]any{
+		"session_id": session, "cwd": cwd, "hook_event_name": "Stop",
+		"stop_hook_active": active, "last_assistant_message": last,
+		"background_tasks": []any{}, "session_crons": cs,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return string(b)
+}
+
+// stopOut is the Stop hook's answer as the host reads it. A block is the
+// host's non-error feedback, hookSpecificOutput.additionalContext, which
+// keeps the session going under the same loop protections as a decision
+// block without the "Stop hook error" notice; Decision and Reason are filled
+// from it, and Raw keeps what was printed.
+type stopOut struct {
+	Decision           string `json:"decision"`
+	Reason             string `json:"reason"`
+	SystemMessage      string `json:"systemMessage"`
+	HookSpecificOutput struct {
+		HookEventName     string `json:"hookEventName"`
+		AdditionalContext string `json:"additionalContext"`
+	} `json:"hookSpecificOutput"`
+	Raw map[string]any `json:"-"`
+}
+
+func runStop(t *testing.T, payload string) (stopOut, string, string) {
+	t.Helper()
+	so, se, err := runSplit(t, payload, "hook", "stop")
+	if err != nil {
+		t.Fatalf("hook stop exited non-zero: %v\nstderr: %s", err, se)
+	}
+	var out stopOut
+	if strings.TrimSpace(so) != "" {
+		if err := json.Unmarshal([]byte(so), &out); err != nil {
+			t.Fatalf("hook stop stdout is not one object: %v\n%s", err, so)
+		}
+		_ = json.Unmarshal([]byte(so), &out.Raw)
+		if c := out.HookSpecificOutput.AdditionalContext; c != "" && out.HookSpecificOutput.HookEventName == "Stop" {
+			out.Decision, out.Reason = "block", c
+		}
+	}
+	return out, so, se
+}
+
+var behindItem = autonomy.OwedItem{Kind: autonomy.OwedBehind, Capped: true, Branch: "feat/behind", PR: 12, Head: "aaaa"}
+
+// TestHookStopOutput: `{"decision":"block","reason":…}` only on a block, a
+// systemMessage while present with work owed; a malformed payload, an
+// unreadable record or a held lock allows with a stderr line.
+func TestHookStopOutput(t *testing.T) {
+	root := awayCheckout(t)
+	owed := autonomy.Owed{Items: []autonomy.OwedItem{behindItem}}
+	asked := fakeOwed(t, &owed)
+
+	// Present, work owed: allowed, flagged, the reader asked for disk only.
+	out, so, _ := runStop(t, stopHookPayload(t, "s1", root, false, "Done."))
+	if out.Decision != "" || !strings.Contains(out.SystemMessage, "feat/behind") {
+		t.Errorf("present with work owed: %s", so)
+	}
+	if len(*asked) != 1 || (*asked)[0].Record.Holds(time.Now()) {
+		t.Errorf("present: the reader was asked %+v, want once, not away", *asked)
+	}
+	// Present, nothing owed: silent.
+	owed = autonomy.Owed{}
+	if _, so, _ := runStop(t, stopHookPayload(t, "s1", root, false, "Done.")); so != "" {
+		t.Errorf("present with nothing owed printed %q", so)
+	}
+
+	// Away, work owed: blocked.
+	setAway(t)
+	owed = autonomy.Owed{Items: []autonomy.OwedItem{behindItem}}
+	out, so, _ = runStop(t, stopHookPayload(t, "s1", root, false, "Done.", "*/10 * * * *"))
+	if out.Decision != "block" || !strings.Contains(out.Reason, "feat/behind") || out.SystemMessage != "" {
+		t.Errorf("away with work owed, first stop: %s", so)
+	}
+	if q := (*asked)[len(*asked)-1]; q.Root != root || !q.Record.Holds(time.Now()) || q.Home == "" {
+		t.Errorf("away: the reader was asked %+v", q)
+	}
+	// Away, nothing owed, a qualifying wake: allowed, silent.
+	owed = autonomy.Owed{}
+	if _, so, _ := runStop(t, stopHookPayload(t, "s2", root, false, "Done.", "*/30 * * * *")); so != "" {
+		t.Errorf("away, nothing owed, a wake: printed %q", so)
+	}
+
+	// A malformed payload allows, with a stderr line.
+	if _, so, se := runStop(t, "{not json"); so != "" || !strings.Contains(se, "allow") {
+		t.Errorf("malformed payload: stdout %q stderr %q", so, se)
+	}
+	// A bad session id while away allows, with a stderr line.
+	if _, so, se := runStop(t, stopHookPayload(t, "../evil", root, false, "Done.")); so != "" || !strings.Contains(se, "session id") {
+		t.Errorf("bad session id: stdout %q stderr %q", so, se)
+	}
+
+	// A held lock, when the stop must be recorded, allows with a stderr line.
+	owed = autonomy.Owed{Items: []autonomy.OwedItem{behindItem}}
+	st := awayStore(t, root)
+	if err := autonomy.SaveSession(root, "s3", autonomy.SessionState{
+		Fingerprint: owed.Fingerprint(), WakeFingerprint: owed.CappedFingerprint(), Blocks: autonomy.DefaultBlockCap,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	var held stopOut
+	var heldOut, heldErr string
+	if err := st.WithLock(func() error {
+		held, heldOut, heldErr = runStop(t, stopHookPayload(t, "s3", root, true, "Done."))
+		return nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if held.Decision != "" || heldOut != "" || !strings.Contains(heldErr, "lock") {
+		t.Errorf("held lock: stdout %q stderr %q; want the stop allowed and the lock named", heldOut, heldErr)
+	}
+
+	// An unreadable record allows, with a stderr line.
+	if err := os.WriteFile(st.RecordPath(), []byte("{garbage"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if _, so, se := runStop(t, stopHookPayload(t, "s1", root, false, "Done.")); so != "" || !strings.Contains(se, "not away") {
+		t.Errorf("unreadable record: stdout %q stderr %q", so, se)
+	}
+}
+
+// TestHookStopCapFromEnvironment: CLAUDE_CODE_STOP_HOOK_BLOCK_CAP sets the
+// cap, and the block passing it records the stop, labelled possibly forced by
+// the cap, in the away record.
+func TestHookStopCapFromEnvironment(t *testing.T) {
+	root := awayCheckout(t)
+	setAway(t)
+	owed := autonomy.Owed{Items: []autonomy.OwedItem{behindItem}}
+	fakeOwed(t, &owed)
+	t.Setenv("CLAUDE_CODE_STOP_HOOK_BLOCK_CAP", "3")
+	for i := 1; i <= 4; i++ {
+		out, so, _ := runStop(t, stopHookPayload(t, "cap-1", root, i > 1, "Done."))
+		if out.Decision != "block" {
+			t.Fatalf("block %d: %s", i, so)
+		}
+		stops := readAway(t, root).Stops
+		if want := map[bool]int{true: 1, false: 0}[i == 4]; len(stops) != want {
+			t.Fatalf("after block %d the record holds %d stops, want %d", i, len(stops), want)
+		}
+	}
+	s := readAway(t, root).Stops[0]
+	if s.Kind != autonomy.StopWorkOwed || !s.PossiblyForcedByCap || !strings.Contains(s.Detail, "feat/behind") {
+		t.Errorf("recorded %+v", s)
+	}
+}
+
+// TestHookStopWakeCountAcrossRuns: the wake count and its fingerprint are
+// read back from the session's state file by each hook run, kept in the
+// session's start copy even when the hook runs from a worktree it made.
+func TestHookStopWakeCountAcrossRuns(t *testing.T) {
+	root := awayCheckout(t)
+	if _, _, err := runSplit(t, awayStartPayload("wake-1", root, "startup"), "hook", "session-start"); err != nil {
+		t.Fatal(err)
+	}
+	made := filepath.Join(t.TempDir(), "made")
+	gitAt(t, root, "worktree", "add", "-q", "-b", "feat/made", made)
+	made = realPath(t, made)
+	setAway(t)
+	owed := autonomy.Owed{Items: []autonomy.OwedItem{behindItem}}
+	asked := fakeOwed(t, &owed)
+	var blocks []bool
+	for i := 0; i < 5; i++ {
+		out, _, _ := runStop(t, stopHookPayload(t, "wake-1", made, false, "Done.", "*/10 * * * *"))
+		blocks = append(blocks, out.Decision == "block")
+	}
+	want := []bool{true, false, false, true, true}
+	for i := range want {
+		if blocks[i] != want[i] {
+			t.Fatalf("stops blocked %v, want %v (first block, two wakes, then blocked)", blocks, want)
+		}
+	}
+	if q := (*asked)[0]; q.Root != root {
+		t.Errorf("the reader was asked about %s, want the start copy %s", q.Root, root)
+	}
+	st, err := autonomy.LoadSession(root, "wake-1")
+	if err != nil || st.Wakes != 2 || st.WakeFingerprint != owed.CappedFingerprint() {
+		t.Errorf("the start copy's state file: %+v (%v)", st, err)
+	}
+	if _, err := os.Stat(filepath.Join(made, filepath.FromSlash(autonomy.SessionsDir))); err == nil {
+		t.Errorf("the made worktree holds session state; it belongs to the start copy")
+	}
+}
+
+// TestHookStopRecordsHandBack: a hand-back the verdict accepts is recorded
+// in the away record, once per branch and head, and counted on the person's
+// line.
+func TestHookStopRecordsHandBack(t *testing.T) {
+	root := awayCheckout(t)
+	setAway(t, "--hold-pushes")
+	item := autonomy.OwedItem{Kind: autonomy.OwedUnpushed, Capped: true, Branch: "feat/ready", Head: strings.Repeat("c", 40)}
+	owed := autonomy.Owed{HandedBack: []autonomy.OwedItem{item}}
+	fakeOwed(t, &owed)
+	for i := 0; i < 2; i++ {
+		if out, so, _ := runStop(t, stopHookPayload(t, "hb-1", root, false, "Done.", "*/30 * * * *")); out.Decision != "" {
+			t.Fatalf("a handed-back item kept the stop blocked: %s", so)
+		}
+	}
+	rec := readAway(t, root)
+	if len(rec.HandedBack) != 1 || rec.HandedBack[0].Branch != "feat/ready" {
+		t.Errorf("record holds hand-backs %+v, want feat/ready once", rec.HandedBack)
+	}
+	if !strings.Contains(rec.PersonLine(), "1 item handed back") {
+		t.Errorf("the person's line: %q", rec.PersonLine())
+	}
+}
+
+// TestHookStopFailureRecords: the error type is recorded while away, and
+// nothing is written while present.
+func TestHookStopFailureRecords(t *testing.T) {
+	root := awayCheckout(t)
+	payload := `{"session_id":"f1","cwd":"` + root + `","hook_event_name":"StopFailure","error":"rate_limit","error_details":"429 Too Many Requests","last_assistant_message":"API Error: Rate limit reached"}`
+	so, se, err := runSplit(t, payload, "hook", "stop-failure")
+	if err != nil || so != "" {
+		t.Fatalf("present: err %v stdout %q stderr %q", err, so, se)
+	}
+	if _, err := os.Stat(awayStore(t, root).Dir()); err == nil {
+		t.Errorf("present: the away store was created")
+	}
+	setAway(t)
+	for i := 0; i < 2; i++ {
+		if so, se, err := runSplit(t, payload, "hook", "stop-failure"); err != nil || so != "" {
+			t.Fatalf("away: err %v stdout %q stderr %q", err, so, se)
+		}
+	}
+	stops := readAway(t, root).Stops
+	if len(stops) != 1 || stops[0].Kind != autonomy.StopAPIError || stops[0].ErrorType != "rate_limit" || stops[0].Count != 2 {
+		t.Errorf("recorded %+v, want one api-error entry for rate_limit counted twice", stops)
+	}
+	// A malformed payload or an odd error type never fails the hook.
+	if _, _, err := runSplit(t, "{nope", "hook", "stop-failure"); err != nil {
+		t.Errorf("malformed payload: %v", err)
+	}
+	odd := strings.Replace(payload, "rate_limit", "rate limit\\u001b[31m", 1)
+	if _, _, err := runSplit(t, odd, "hook", "stop-failure"); err != nil {
+		t.Fatal(err)
+	}
+	last := readAway(t, root).Stops
+	if got := last[len(last)-1].ErrorType; got != "unknown" {
+		t.Errorf("an error type outside the host's shape was recorded as %q, want unknown", got)
+	}
+}
+
+// gitCallLog puts a git on PATH that logs each call's arguments to the
+// returned file and runs the real git.
+func gitCallLog(t *testing.T) string {
+	t.Helper()
+	real, err := exec.LookPath("git")
+	if err != nil {
+		t.Skip("git not on PATH")
+	}
+	bin := t.TempDir()
+	log := filepath.Join(t.TempDir(), "git-calls.log")
+	script := "#!/bin/sh\nprintf '%s\\n' \"$*\" >> '" + log + "'\nexec '" + real + "' \"$@\"\n"
+	if err := os.WriteFile(filepath.Join(bin, "git"), []byte(script), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("PATH", bin+string(os.PathListSeparator)+os.Getenv("PATH"))
+	return log
+}
+
+// unmanagedOwnUnpushed is a checkout abcd does not manage (no .abcd/ at its
+// root) on an own branch, pushed without -u to nowhere: a commit of the
+// checkout's author no remote holds.
+func unmanagedOwnUnpushed(t *testing.T) string {
+	t.Helper()
+	repo := realPath(t, t.TempDir())
+	gitInitAt(t, repo)
+	gitAt(t, repo, "config", "--local", "user.email", "alice@example.invalid")
+	gitAt(t, repo, "config", "--local", "user.name", "Alice")
+	gitAt(t, repo, "config", "--local", "commit.gpgsign", "false")
+	gitAt(t, repo, "commit", "-q", "--allow-empty", "-m", "seed")
+	gitAt(t, repo, "checkout", "-q", "-b", "feat/elsewhere")
+	gitAt(t, repo, "commit", "-q", "--allow-empty", "-m", "not pushed")
+	return repo
+}
+
+// TestHookStopUnmanagedRepoSilent: in a checkout abcd does not manage the
+// stop hook allows silently, never reads the owed work and runs no git past
+// naming the checkout's root; StopFailure records nothing there, and the
+// session-start and prompt hooks add no away block, even with an away record
+// holding for the repository (set from a managed copy of it).
+func TestHookStopUnmanagedRepoSilent(t *testing.T) {
+	t.Run("stop", func(t *testing.T) {
+		awayCheckout(t) // the sandboxed HOME
+		repo := unmanagedOwnUnpushed(t)
+		owed := autonomy.Owed{Items: []autonomy.OwedItem{{Kind: autonomy.OwedUnpushed, Capped: true, Branch: "feat/elsewhere", Head: "aaaa"}}}
+		asked := fakeOwed(t, &owed)
+		log := gitCallLog(t)
+		_, so, se := runStop(t, stopHookPayload(t, "u1", repo, false, "Done."))
+		if so != "" || se != "" {
+			t.Errorf("an unmanaged checkout: stdout %q stderr %q, want nothing", so, se)
+		}
+		if len(*asked) != 0 {
+			t.Errorf("an unmanaged checkout's owed work was read: %+v", *asked)
+		}
+		for _, line := range strings.Split(strings.TrimSpace(ghCalls(t, log)), "\n") {
+			// `git version` is the client's version probe, read once a
+			// process, not a read of the repository.
+			if line != "" && line != "version" && !strings.Contains(line, "rev-parse --show-toplevel") {
+				t.Errorf("an unmanaged checkout ran git past naming its root: %q", line)
+			}
+		}
+	})
+	t.Run("away record from a managed copy", func(t *testing.T) {
+		root := awayCheckout(t)
+		// A clone shares the repository's root commit, so its away store,
+		// but has no .abcd/ at its root (the fixture's .abcd/ is untracked).
+		sib := filepath.Join(t.TempDir(), "sib")
+		gitAt(t, root, "clone", "-q", root, sib)
+		sib = realPath(t, sib)
+		setAway(t)
+		owed := autonomy.Owed{Items: []autonomy.OwedItem{behindItem}}
+		asked := fakeOwed(t, &owed)
+		if _, so, se := runStop(t, stopHookPayload(t, "u2", sib, false, "Done.")); so != "" || len(*asked) != 0 {
+			t.Errorf("stop from an unmanaged copy: stdout %q stderr %q, reader asked %d times", so, se, len(*asked))
+		}
+		fail := `{"session_id":"u2","cwd":"` + sib + `","hook_event_name":"StopFailure","error":"rate_limit"}`
+		if _, _, err := runSplit(t, fail, "hook", "stop-failure"); err != nil {
+			t.Fatal(err)
+		}
+		if stops := readAway(t, root).Stops; len(stops) != 0 {
+			t.Errorf("StopFailure from an unmanaged copy recorded %+v", stops)
+		}
+		if so, _, _ := runSplit(t, awayStartPayload("u2", sib, "startup"), "hook", "session-start"); strings.Contains(so, "## AWAY") {
+			t.Errorf("session start in an unmanaged copy added the away block:\n%s", so)
+		}
+		if so, _, _ := runSplit(t, awayPromptPayload("u2", sib, "hello"), "hook", "prompt-router"); strings.Contains(so, "AWAY") || strings.Contains(so, "away") {
+			t.Errorf("a prompt in an unmanaged copy carried the away block or line:\n%s", so)
+		}
+		// The managed copy is unchanged.
+		if out, so, _ := runStop(t, stopHookPayload(t, "u3", root, false, "Done.")); out.Decision != "block" {
+			t.Errorf("the managed copy no longer blocks: %s", so)
+		}
+	})
+}
+
+// TestHookStopBlockIsFeedback: a block is written as the host's non-error
+// feedback, {"hookSpecificOutput":{"hookEventName":"Stop","additionalContext":…}},
+// never as {"decision":"block"}, which the host shows as a hook error.
+func TestHookStopBlockIsFeedback(t *testing.T) {
+	root := awayCheckout(t)
+	setAway(t)
+	owed := autonomy.Owed{Items: []autonomy.OwedItem{behindItem}}
+	fakeOwed(t, &owed)
+	out, so, _ := runStop(t, stopHookPayload(t, "fb-1", root, false, "Done."))
+	if _, ok := out.Raw["decision"]; ok {
+		t.Errorf("a block is written as a decision, which the host shows as an error: %s", so)
+	}
+	if out.HookSpecificOutput.HookEventName != "Stop" || !strings.Contains(out.HookSpecificOutput.AdditionalContext, "feat/behind") {
+		t.Errorf("a block is the Stop hook's additionalContext naming the item: %s", so)
+	}
+	if len(out.Raw) != 1 {
+		t.Errorf("a block carries only hookSpecificOutput: %s", so)
+	}
+}
+
+// homeFiles lists every path under dir, relative, for a before-and-after
+// compare.
+func homeFiles(t *testing.T, dir string) []string {
+	t.Helper()
+	var out []string
+	_ = filepath.WalkDir(dir, func(p string, _ os.DirEntry, err error) error {
+		if err == nil && p != dir {
+			rel, _ := filepath.Rel(dir, p)
+			out = append(out, rel)
+		}
+		return nil
+	})
+	return out
+}
+
+// TestAwayHooksLeaveUnmanagedRepoAlone: in a repository abcd does not manage
+// every hook path of the away mode returns at once: the stop check (with the
+// real owed reader), StopFailure and the branch recorder print nothing,
+// create nothing under abcd's home folder, exit 0 and run no git (the
+// guard's own reading of a command aside, the same with or without a branch
+// act); the session-start and prompt hooks add no away
+// block and create no away store, session note or state file. (The away
+// store has no record here; a record shared with a managed copy is
+// TestHookStopUnmanagedRepoSilent's.)
+func TestAwayHooksLeaveUnmanagedRepoAlone(t *testing.T) {
+	awayCheckout(t) // the sandboxed HOME
+	home := os.Getenv("HOME")
+	repo := unmanagedOwnUnpushed(t)
+	abcdHome := abcdhome.Path(home)
+	before := homeFiles(t, abcdHome)
+	log := gitCallLog(t)
+	onlyRoot := func(what string) {
+		t.Helper()
+		if calls := strings.TrimSpace(ghCalls(t, log)); calls != "" {
+			t.Errorf("%s ran git in an unmanaged checkout:\n%s", what, calls)
+		}
+		if err := os.WriteFile(log, nil, 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	so, se, err := runSplit(t, stopHookPayload(t, "un-1", repo, false, "Done."), "hook", "stop")
+	if err != nil || so != "" {
+		t.Errorf("stop: err %v stdout %q stderr %q", err, so, se)
+	}
+	onlyRoot("stop")
+	fail := `{"session_id":"un-1","cwd":"` + repo + `","hook_event_name":"StopFailure","error":"rate_limit"}`
+	if so, se, err := runSplit(t, fail, "hook", "stop-failure"); err != nil || so != "" {
+		t.Errorf("stop-failure: err %v stdout %q stderr %q", err, so, se)
+	}
+	onlyRoot("stop-failure")
+	baseline := func(command string) string {
+		t.Helper()
+		so, se, code := runGuard(preToolUse(t, "Bash", command, repo), "guard", "hook")
+		if code != 0 || strings.Contains(so, "deny") {
+			t.Fatalf("guard hook on %q: code %d stdout %q stderr %q", command, code, so, se)
+		}
+		return ghCalls(t, log)
+	}
+	// The guard's own reading of a command is not the recorder's: a command
+	// with no branch act sets the baseline the branch acts must not exceed.
+	// The guard checks the git version once per process; warm that up first
+	// so the baseline holds only what every command costs.
+	_ = baseline("git status --porcelain")
+	_ = os.WriteFile(log, nil, 0o600)
+	plain := baseline("git status --porcelain")
+	for _, c := range []string{"git switch -c feat/new", "git worktree add -b feat/wt ../wt", "git checkout -b feat/co"} {
+		_ = os.WriteFile(log, nil, 0o600)
+		if got := baseline(c); got != plain {
+			t.Errorf("the recorder ran git for %q in an unmanaged checkout:\n%s\nbaseline:\n%s", c, got, plain)
+		}
+	}
+	if after := homeFiles(t, abcdHome); !slices.Equal(before, after) {
+		t.Errorf("abcd's home folder changed: before %v after %v", before, after)
+	}
+
+	so, _, _ = runSplit(t, awayStartPayload("un-1", repo, "startup"), "hook", "session-start")
+	so2, _, _ := runSplit(t, awayPromptPayload("un-1", repo, "hello"), "hook", "prompt-router")
+	if strings.Contains(so+so2, "AWAY") || strings.Contains(so2, "away until") {
+		t.Errorf("an unmanaged checkout got the away block or line:\n%s\n%s", so, so2)
+	}
+	if _, err := os.Stat(filepath.Join(abcdHome, autonomy.StoreDir)); err == nil {
+		t.Errorf("an unmanaged checkout created the away store")
+	}
+	if _, err := os.Stat(filepath.Join(repo, ".abcd")); err == nil {
+		t.Errorf("an unmanaged checkout gained a .abcd/ folder")
+	}
+}
+
+// TestHookStopPanicAllows: a panic inside the stop check allows the stop,
+// exits 0 and names it on stderr; it never reaches the host as exit 2, which
+// a Stop hook reads as a block.
+func TestHookStopPanicAllows(t *testing.T) {
+	root := awayCheckout(t)
+	setAway(t)
+	prev := stopOwedReader
+	stopOwedReader = func(context.Context, autonomy.ReadOptions) (autonomy.Owed, error) { panic("boom") }
+	t.Cleanup(func() { stopOwedReader = prev })
+	var so, se string
+	var err error
+	func() {
+		defer func() {
+			if r := recover(); r != nil {
+				t.Fatalf("the panic escaped the hook: %v", r)
+			}
+		}()
+		so, se, err = runSplit(t, stopHookPayload(t, "p-1", root, false, "Done."), "hook", "stop")
+	}()
+	if err != nil || so != "" || !strings.Contains(se, "allowed") || !strings.Contains(se, "boom") {
+		t.Errorf("a panic: err %v stdout %q stderr %q", err, so, se)
+	}
+}
+
+// TestHookStopBudgetFailsOpen: the owed read runs under a deadline well
+// inside the host's 30-second hook timeout, leaving room to judge and record
+// within about 20 seconds in all; a reading the deadline cut short allows the
+// stop with a line naming what was not read, and records the stop while away.
+func TestHookStopBudgetFailsOpen(t *testing.T) {
+	root := awayCheckout(t)
+	setAway(t)
+	var left time.Duration
+	prev := stopOwedReader
+	stopOwedReader = func(ctx context.Context, _ autonomy.ReadOptions) (autonomy.Owed, error) {
+		if d, ok := ctx.Deadline(); ok {
+			left = time.Until(d)
+		}
+		return autonomy.Owed{Items: []autonomy.OwedItem{behindItem}, Incomplete: true,
+			Notes: []string{"the check ran out of its time budget before reading 4 of 40 own branches (from feat/m36 on)"}}, nil
+	}
+	t.Cleanup(func() { stopOwedReader = prev })
+	start := time.Now()
+	out, so, _ := runStop(t, stopHookPayload(t, "bud-1", root, false, "Done."))
+	if left <= 0 || left > 15*time.Second {
+		t.Errorf("the owed read had %s left on its deadline, want at most 15s", left)
+	}
+	if time.Since(start) > 20*time.Second {
+		t.Errorf("the hook took %s", time.Since(start))
+	}
+	if out.Decision != "" || !strings.Contains(out.SystemMessage, "4 of 40 own branches") {
+		t.Errorf("a reading cut short: %s, want the stop allowed and named", so)
+	}
+	stops := readAway(t, root).Stops
+	if len(stops) != 1 || stops[0].Kind != autonomy.StopCheckIncomplete {
+		t.Errorf("recorded %+v, want the stop allowed by the budget", stops)
+	}
+}
diff --git a/internal/surface/cli/hooks_homestop_test.go b/internal/surface/cli/hooks_homestop_test.go
index 75935eccb9..4d18b6ae53 100644
--- a/internal/surface/cli/hooks_homestop_test.go
+++ b/internal/surface/cli/hooks_homestop_test.go
@@ -35,6 +35,8 @@ var stopWrapperEvents = []struct {
 	{"PreCompact", 1, []string{"hook prompt-router-reset"}},
 	{"SessionEnd", 1, []string{"hook session-end"}},
 	{"SubagentStop", 1, []string{"hook subagent-stop"}},
+	{"Stop", 1, []string{"hook stop"}},
+	{"StopFailure", 1, []string{"hook stop-failure"}},
 }
 
 // oldHomeWithPathEntry stands up a home holding the old ~/.abcd, whose
diff --git a/internal/surface/cli/hooks_selfprovision_count_test.go b/internal/surface/cli/hooks_selfprovision_count_test.go
index 80aea6c7f7..a9fa8dd951 100644
--- a/internal/surface/cli/hooks_selfprovision_count_test.go
+++ b/internal/surface/cli/hooks_selfprovision_count_test.go
@@ -26,7 +26,7 @@ import (
 // invention rather than ignored as an unknown word.
 var hookEventVocabulary = []string{
 	"SessionStart", "SessionEnd", "UserPromptSubmit", "PreToolUse", "PostToolUse",
-	"PostToolUseFailure", "PreCompact", "Stop", "SubagentStart", "SubagentStop",
+	"PostToolUseFailure", "PreCompact", "Stop", "StopFailure", "SubagentStart", "SubagentStop",
 	"Notification", "PermissionRequest",
 }
 
diff --git a/internal/surface/cli/hooks_selfprovision_test.go b/internal/surface/cli/hooks_selfprovision_test.go
index 0740ede9d4..1c6729e383 100644
--- a/internal/surface/cli/hooks_selfprovision_test.go
+++ b/internal/surface/cli/hooks_selfprovision_test.go
@@ -54,6 +54,8 @@ var binaryHooks = []binaryHook{
 	{event: "PreCompact", verb: "prompt-router-reset"},
 	{event: "SessionEnd", verb: "session-end", neverBootstraps: true},
 	{event: "SubagentStop", verb: "subagent-stop", neverBootstraps: true},
+	{event: "Stop", verb: "stop", neverBootstraps: true},
+	{event: "StopFailure", verb: "stop-failure", neverBootstraps: true},
 }
 
 // hookCommand returns the single command string for an event, failing on any
diff --git a/internal/surface/cli/hooks_timeout_test.go b/internal/surface/cli/hooks_timeout_test.go
index ea649d94c3..bf2dec39d0 100644
--- a/internal/surface/cli/hooks_timeout_test.go
+++ b/internal/surface/cli/hooks_timeout_test.go
@@ -35,6 +35,8 @@ var wantHookTimeouts = map[string]int{
 	"PreCompact":       0,
 	"SessionEnd":       0,
 	"SubagentStop":     0,
+	"Stop":             30,
+	"StopFailure":      0,
 }
 
 // decodedHooksManifest reads the committed manifest through the same decoded
diff --git a/internal/surface/cli/mode.go b/internal/surface/cli/mode.go
index 228e560520..f22c788e26 100644
--- a/internal/surface/cli/mode.go
+++ b/internal/surface/cli/mode.go
@@ -7,6 +7,7 @@ import (
 	"os"
 
 	"github.com/intentdriven/abcd/internal/abcdhome"
+	"github.com/intentdriven/abcd/internal/core/autonomy"
 	"github.com/intentdriven/abcd/internal/core/mode"
 	"github.com/intentdriven/abcd/internal/core/statusline"
 	"github.com/intentdriven/abcd/internal/gitutil"
@@ -57,7 +58,14 @@ func newModeCommand(asJSON *bool) *cobra.Command {
 			"nobody and prints nothing; with a surface installed nothing is printed at\n" +
 			"all. With --json the notice is a field. Both forms make no network request.\n\n" +
 			"Exit 2 on a refusal — an unknown state, no local tier, or no checkout —\n" +
-			"and nothing is written on any of them.",
+			"and nothing is written on any of them.\n\n" +
+			"The away mode sits beside the badge, not as a fourth word: `abcd mode\n" +
+			"autonomous [--until <time>] [--hold-pushes]` records that the person is away,\n" +
+			"`abcd mode queue \"<step>\"` keeps a step for their return, and `abcd mode back`\n" +
+			"ends it and prints what was queued and recorded. While it holds, setting\n" +
+			"`product-thinker` or `facilitator` is refused (exit 2), naming `abcd decide`:\n" +
+			"a stop parked on a person who is away is a question nobody answers. The away\n" +
+			"mode grants no rights; the person's standing instruction decides what is pushed.",
 		Args:      cobra.MaximumNArgs(1),
 		ValidArgs: stateWords(),
 		RunE: func(cmd *cobra.Command, args []string) error {
@@ -78,6 +86,9 @@ func newModeCommand(asJSON *bool) *cobra.Command {
 			if err != nil {
 				return modeRefusal(err)
 			}
+			if err := refuseParkWhileAway(cmd.ErrOrStderr(), cwd, st); err != nil {
+				return modeRefusal(err)
+			}
 			if err := mode.Set(cwd, st); err != nil {
 				return modeRefusal(err)
 			}
@@ -92,9 +103,29 @@ func newModeCommand(asJSON *bool) *cobra.Command {
 			})
 		},
 	}
+	cmd.AddCommand(newModeAutonomousCommand(asJSON), newModeBackCommand(asJSON), newModeQueueCommand(asJSON))
 	return cmd
 }
 
+// refuseParkWhileAway refuses parking the badge on a person while the away
+// mode holds for this checkout's repository. Reading the away record fails
+// open: one that cannot be read safely reads as not away, and says so in one
+// line on errw; a repository with no root commit has no away record at all.
+func refuseParkWhileAway(errw io.Writer, cwd string, st mode.State) error {
+	if st == mode.Managed {
+		return nil
+	}
+	root, err := mode.Root(cwd)
+	if err != nil {
+		return nil // mode.Set reports the root refusal itself.
+	}
+	_, away, err := autonomy.AwayAt(root, autonomy.Options{})
+	if err != nil && errors.Is(err, autonomy.ErrUnsafe) {
+		fmt.Fprintf(errw, "abcd mode: %v; read as not away\n", err)
+	}
+	return mode.RefuseParkWhileAway(st, away)
+}
+
 // stateWords is the closed vocabulary as strings, for shell completion.
 func stateWords() []string {
 	var words []string
@@ -111,7 +142,7 @@ func stateWords() []string {
 // default exit 1. The store's own wording is kept: it names the three words,
 // or the tier, or the checkout, and it carries no local path.
 func modeRefusal(err error) error {
-	if errors.Is(err, mode.ErrUnknownState) || errors.Is(err, mode.ErrNoLocalTier) || errors.Is(err, gitutil.ErrNoCheckoutRoot) {
+	if errors.Is(err, mode.ErrUnknownState) || errors.Is(err, mode.ErrNoLocalTier) || errors.Is(err, mode.ErrAway) || errors.Is(err, gitutil.ErrNoCheckoutRoot) {
 		return &exitError{Code: 2, Msg: "abcd mode: " + err.Error() + " (nothing written)"}
 	}
 	return fmt.Errorf("abcd mode: %w", err)
diff --git a/internal/surface/cli/mode_away.go b/internal/surface/cli/mode_away.go
new file mode 100644
index 0000000000..dd68453307
--- /dev/null
+++ b/internal/surface/cli/mode_away.go
@@ -0,0 +1,211 @@
+package cli
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/abcdhome"
+	"github.com/intentdriven/abcd/internal/core/autonomy"
+	"github.com/intentdriven/abcd/internal/fsutil"
+	"github.com/intentdriven/abcd/internal/gitutil"
+	"github.com/intentdriven/abcd/internal/termsafe"
+	"github.com/spf13/cobra"
+)
+
+// awayOutput is the --json envelope of `abcd mode autonomous`.
+type awayOutput struct {
+	Away       bool      `json:"away"`
+	SetBy      string    `json:"set_by"`
+	SetFrom    string    `json:"set_from"`
+	Start      time.Time `json:"start"`
+	Until      time.Time `json:"until"`
+	OpenEnded  bool      `json:"open_ended"`
+	HoldPushes bool      `json:"hold_pushes"`
+	Queued     int       `json:"queued"`
+	HandedBack int       `json:"handed_back"`
+	Stops      int       `json:"stops"`
+	Terms      []string  `json:"terms"`
+}
+
+// backOutput is the --json envelope of `abcd mode back`.
+type backOutput struct {
+	State     string   `json:"state"`
+	Lines     []string `json:"lines"`
+	EndedBy   string   `json:"ended_by,omitempty"`
+	EndedFrom string   `json:"ended_from,omitempty"`
+	// Notes say what could not be read or done as usual on the way to
+	// ending the mode.
+	Notes []string `json:"notes,omitempty"`
+}
+
+// queueOutput is the --json envelope of `abcd mode queue`.
+type queueOutput struct {
+	Queued int `json:"queued"`
+}
+
+// newModeAutonomousCommand builds `abcd mode autonomous`, the front door onto
+// autonomy.SetAway (itd-2610180912189125, step 1).
+func newModeAutonomousCommand(asJSON *bool) *cobra.Command {
+	var until string
+	var holdPushes bool
+	cmd := &cobra.Command{
+		Use: "autonomous",
+		Long: "Record that the person is away, for every working copy of this repository on\n" +
+			"this machine: who set it (the holder name reservations resolve without a\n" +
+			"network read, else git's user.name), from which working copy, and when it ends.\n\n" +
+			"--until takes a clock time (its next occurrence, local time, as 09:00) or a\n" +
+			"timestamp (2026-10-19T09:00, or RFC 3339). Without it the mode is open-ended,\n" +
+			"and every record ends seven days after it was set at most: an --until past that,\n" +
+			"or one already past, is refused. --hold-pushes records the person's word that\n" +
+			"pushes wait for their return; it narrows what sessions do and grants nothing.\n\n" +
+			"The away mode grants no rights: the person's own standing instruction decides\n" +
+			"what is committed, pushed, and opened or merged as a pull request. It ends at its\n" +
+			"time or with `abcd mode back`; a prompt never ends it. Setting it again keeps\n" +
+			"whatever is queued or recorded and not yet read.\n\n" +
+			"The record lives in " + abcdhome.Display(autonomy.StoreDir, "<root-sha>", autonomy.RecordFile) + ", keyed on the repository's\n" +
+			"root commit, and is changed under its lock, which only `abcd mode back` goes\n" +
+			"around. A record merely past its 64 KiB is carried, its oldest lines let go.\n" +
+			"Exit 2 on a refusal (an unreadable or past --until, one past seven days, no local\n" +
+			"tier, no checkout, or a record or lock that is not safely this account's) with\n" +
+			"nothing written. No network request.",
+		Args: cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			cwd, err := os.Getwd()
+			if err != nil {
+				return err
+			}
+			rec, err := autonomy.SetAway(cwd, until, holdPushes, autonomy.Options{})
+			if err != nil {
+				return awayRefusal("autonomous", err)
+			}
+			out := awayOutput{
+				Away: true, SetBy: rec.SetBy, SetFrom: fsutil.DisplayPath(rec.SetFrom),
+				Start: rec.Start, Until: rec.Ends(), OpenEnded: rec.OpenEnded, HoldPushes: rec.HoldPushes,
+				Queued: len(rec.Queue), HandedBack: len(rec.HandedBack), Stops: len(rec.Stops), Terms: rec.Terms(),
+			}
+			return render(cmd.OutOrStdout(), *asJSON, out, func(w io.Writer) {
+				for _, l := range out.Terms {
+					fmt.Fprintln(w, l)
+				}
+				if n := out.Queued + out.HandedBack + out.Stops; n > 0 {
+					fmt.Fprintf(w, "Kept from before, not yet read: %d queued, %d handed back, %d stops recorded.\n",
+						out.Queued, out.HandedBack, out.Stops)
+				}
+			})
+		},
+	}
+	cmd.Flags().StringVar(&until, "until", "", "when the mode ends: a clock time (09:00) or a timestamp; open-ended (seven days at most) when omitted")
+	cmd.Flags().BoolVar(&holdPushes, "hold-pushes", false, "the person's word that pushes wait for their return (grants nothing)")
+	return cmd
+}
+
+// newModeBackCommand builds `abcd mode back`, the front door onto
+// autonomy.Back.
+func newModeBackCommand(asJSON *bool) *cobra.Command {
+	return &cobra.Command{
+		Use: "back",
+		Long: "End the away mode: print one plain line per queued step, per item handed back\n" +
+			"and per recorded stop (a stop at the host's cap is labelled \"possibly forced by\n" +
+			"the cap\"), record who ended it and from which working copy, and close the record.\n" +
+			"On a record whose time has already passed it prints the same and closes it. With\n" +
+			"no record, or one already closed, it says there is nothing to end.\n\n" +
+			"A session runs it only on the person's word in that session. It ends the mode\n" +
+			"whatever state the record is in: one past its 64 KiB is printed whole and kept\n" +
+			"with its oldest lines let go and counted; one that does not parse, or is not\n" +
+			"safely this account's, is replaced by a closed record, printing nothing from\n" +
+			"it; and a lock not had in time is gone around. Each is named on its own line.\n" +
+			"No network request.",
+		Args: cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			cwd, err := os.Getwd()
+			if err != nil {
+				return err
+			}
+			res, err := autonomy.Back(cwd, autonomy.Options{})
+			if err != nil {
+				return awayRefusal("back", err)
+			}
+			out := backOutput{State: res.State, Lines: res.Lines, Notes: res.Notes}
+			if out.Lines == nil {
+				out.Lines = []string{}
+			}
+			if res.State != "none" && res.Record != nil && res.Record.Closed != nil {
+				out.EndedBy = res.Record.Closed.By
+				out.EndedFrom = fsutil.DisplayPath(res.Record.Closed.From)
+			}
+			return render(cmd.OutOrStdout(), *asJSON, out, func(w io.Writer) {
+				for _, l := range out.Lines {
+					fmt.Fprintln(w, l)
+				}
+				for _, n := range out.Notes {
+					fmt.Fprintln(w, "abcd: "+termsafe.CleanProseLine(n, 512))
+				}
+				switch res.State {
+				case "none":
+					fmt.Fprintln(w, "abcd: not in the away mode; nothing to end")
+				case "lapsed":
+					fmt.Fprintf(w, "abcd: the away window ended at %s; closed by %s from %s\n",
+						res.Record.Ends().Local().Format("2006-01-02 15:04 MST"), whoWords(out.EndedBy), out.EndedFrom)
+				default:
+					fmt.Fprintf(w, "abcd: the away mode is over, ended by %s from %s\n", whoWords(out.EndedBy), out.EndedFrom)
+				}
+			})
+		},
+	}
+}
+
+// newModeQueueCommand builds `abcd mode queue "<step>"`, the front door onto
+// autonomy.QueueStep.
+func newModeQueueCommand(asJSON *bool) *cobra.Command {
+	return &cobra.Command{
+		Use: "queue <step>",
+		Long: "Queue one step for the person's return, while the away mode holds: an act only\n" +
+			"the person may approve, which a session queues instead of asking, then carries on\n" +
+			"with other work. `abcd mode back` prints each queued step on one line.\n\n" +
+			"Exit 2 when no away record holds (ask the person instead), on an empty step or one\n" +
+			"over 500 characters, when the queue is full (it is never cut), and when the record\n" +
+			"or its lock is not safely this account's, with nothing written. No network request.",
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			cwd, err := os.Getwd()
+			if err != nil {
+				return err
+			}
+			rec, err := autonomy.QueueStep(cwd, args[0], autonomy.Options{})
+			if err != nil {
+				return awayRefusal("queue", err)
+			}
+			out := queueOutput{Queued: len(rec.Queue)}
+			return render(cmd.OutOrStdout(), *asJSON, out, func(w io.Writer) {
+				fmt.Fprintf(w, "abcd: queued for the person's return (%d queued)\n", out.Queued)
+			})
+		},
+	}
+}
+
+func whoWords(name string) string {
+	if name == "" {
+		return "someone git does not name"
+	}
+	return name
+}
+
+// awayRefusal maps the away verbs' refusals to exit 2 with nothing written:
+// each is "this invocation cannot be honoured". Anything else is an I/O
+// failure at the default exit 1.
+func awayRefusal(verb string, err error) error {
+	for _, sentinel := range []error{
+		autonomy.ErrUntilUnreadable, autonomy.ErrUntilPast, autonomy.ErrUntilBeyondCap,
+		autonomy.ErrStepEmpty, autonomy.ErrStepTooLong, autonomy.ErrQueueFull, autonomy.ErrNotAway,
+		autonomy.ErrNoLocalTier, autonomy.ErrUnsafe, autonomy.ErrLockBusy, autonomy.ErrRecordFull,
+		autonomy.ErrNoRootCommit, autonomy.ErrNoHome, gitutil.ErrNoCheckoutRoot,
+	} {
+		if errors.Is(err, sentinel) {
+			return &exitError{Code: 2, Msg: "abcd mode " + verb + ": " + err.Error() + " (nothing written)"}
+		}
+	}
+	return fmt.Errorf("abcd mode %s: %w", verb, err)
+}
diff --git a/internal/surface/cli/mode_away_test.go b/internal/surface/cli/mode_away_test.go
new file mode 100644
index 0000000000..b6a0660f99
--- /dev/null
+++ b/internal/surface/cli/mode_away_test.go
@@ -0,0 +1,304 @@
+package cli
+
+import (
+	"encoding/json"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/abcdhome"
+	"github.com/intentdriven/abcd/internal/core/autonomy"
+	"github.com/intentdriven/abcd/internal/gittest"
+)
+
+// awayCheckout is managedCheckout with a first commit, so the away store has a
+// root commit to key on, and a local user.name, so the record names who set
+// it.
+func awayCheckout(t *testing.T) string {
+	t.Helper()
+	root := managedCheckout(t)
+	gitCommitAt(t, root, "seed")
+	gitAt(t, root, "config", "--local", "user.name", "Alice")
+	return root
+}
+
+func gitAt(t *testing.T, dir string, args ...string) string {
+	t.Helper()
+	cmd := exec.Command("git", append([]string{"-C", dir}, args...)...)
+	cmd.Env = gittest.Env(t)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("git %v: %v (%s)", args, err, out)
+	}
+	return strings.TrimSpace(string(out))
+}
+
+func awayStore(t *testing.T, root string) autonomy.Store {
+	t.Helper()
+	_, st, err := autonomy.Resolve(root, autonomy.Options{Home: os.Getenv("HOME")})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return st
+}
+
+func readAway(t *testing.T, root string) *autonomy.Record {
+	t.Helper()
+	rec, err := awayStore(t, root).Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return rec
+}
+
+// TestAwayRecordSharedAcrossWorktrees: `abcd mode autonomous --until 09:00`
+// writes one record in the away store that a sibling worktree reads, with who
+// set it and from which copy.
+func TestAwayRecordSharedAcrossWorktrees(t *testing.T) {
+	root := awayCheckout(t)
+	sibling := filepath.Join(t.TempDir(), "sibling")
+	gitAt(t, root, "worktree", "add", "-q", "-b", "feat/sibling", sibling)
+	sibling = realPath(t, sibling)
+
+	stdout, stderr, err := runSplit(t, "", "mode", "autonomous", "--until", "09:00")
+	if err != nil {
+		t.Fatalf("mode autonomous: %v\n%s", err, stderr)
+	}
+	for _, want := range []string{"Away until", "Alice", "abcd mode back", "grants no rights"} {
+		if !strings.Contains(stdout, want) {
+			t.Errorf("the set's output misses %q:\n%s", want, stdout)
+		}
+	}
+
+	t.Chdir(sibling)
+	rec, holds, err := autonomy.AwayAt(sibling, autonomy.Options{})
+	if err != nil || !holds {
+		t.Fatalf("the sibling worktree does not read the record: holds=%v err=%v", holds, err)
+	}
+	if rec.SetBy != "Alice" || rec.SetFrom != root {
+		t.Errorf("record names set_by=%q set_from=%q, want Alice from %s", rec.SetBy, rec.SetFrom, root)
+	}
+	if h, m := rec.Ends().Local().Hour(), rec.Ends().Local().Minute(); h != 9 || m != 0 {
+		t.Errorf("--until 09:00 ends at %s", rec.Ends().Local())
+	}
+	if entries, _ := os.ReadDir(abcdhome.Path(os.Getenv("HOME"), autonomy.StoreDir)); len(entries) != 1 {
+		t.Errorf("the away store holds %d repository folders, want one shared by both copies", len(entries))
+	}
+
+	// The JSON form carries the same record.
+	t.Chdir(root)
+	so, _, err := runSplit(t, "", "mode", "autonomous", "--until", "09:00", "--json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var got struct {
+		Away    bool   `json:"away"`
+		SetBy   string `json:"set_by"`
+		SetFrom string `json:"set_from"`
+		Until   string `json:"until"`
+	}
+	if err := json.Unmarshal([]byte(so), &got); err != nil {
+		t.Fatalf("--json: %v\n%s", err, so)
+	}
+	if !got.Away || got.SetBy != "Alice" || got.Until == "" || got.SetFrom == "" {
+		t.Errorf("--json = %+v", got)
+	}
+}
+
+// TestUntilRefusedPastOrNoTierOrNoCheckout: a past --until, one past seven
+// days, an unreadable one, a checkout without the local tier, and no checkout
+// are each refused at exit 2 with nothing written.
+func TestUntilRefusedPastOrNoTierOrNoCheckout(t *testing.T) {
+	root := awayCheckout(t)
+	home := os.Getenv("HOME")
+	past := time.Now().Add(-time.Hour).Format(time.RFC3339)
+	far := time.Now().Add(autonomy.MaxWindow + time.Hour).Format(time.RFC3339)
+	for _, args := range [][]string{
+		{"mode", "autonomous", "--until", past},
+		{"mode", "autonomous", "--until", far},
+		{"mode", "autonomous", "--until", "tomorrow"},
+	} {
+		out, err := runCLIErr(t, args...)
+		if err == nil {
+			t.Errorf("%v succeeded:\n%s", args, out)
+			continue
+		}
+		if code := exitCodeOf(err); code != 2 {
+			t.Errorf("%v: exit = %d, want 2 (%v)", args, code, err)
+		}
+		if !strings.Contains(err.Error(), "nothing written") {
+			t.Errorf("%v: the refusal does not say nothing was written: %v", args, err)
+		}
+	}
+	if err := os.RemoveAll(filepath.Join(root, ".abcd")); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := runCLIErr(t, "mode", "autonomous"); err == nil || exitCodeOf(err) != 2 || !strings.Contains(err.Error(), ".abcd/.work.local") {
+		t.Errorf("no tier: err = %v, want exit 2 naming the tier", err)
+	}
+	t.Chdir(t.TempDir())
+	if _, err := runCLIErr(t, "mode", "autonomous"); err == nil || exitCodeOf(err) != 2 {
+		t.Errorf("no checkout: err = %v, want exit 2", err)
+	}
+	if _, err := os.Stat(abcdhome.Path(home, autonomy.StoreDir)); err == nil {
+		t.Error("a refused set created the away store")
+	}
+}
+
+// TestModeBackPrintsQueueAndStops: `abcd mode back` prints one plain line per
+// queued step and per recorded stop, the cap label included, records who
+// ended the mode and from which copy, and does the same on a record whose
+// time has passed.
+func TestModeBackPrintsQueueAndStops(t *testing.T) {
+	root := awayCheckout(t)
+	if _, err := runCLIErr(t, "mode", "autonomous"); err != nil {
+		t.Fatal(err)
+	}
+	for _, step := range []string{"approve the embargo close", "push feat/x"} {
+		if out, err := runCLIErr(t, "mode", "queue", step); err != nil {
+			t.Fatalf("mode queue: %v\n%s", err, out)
+		}
+	}
+	st := awayStore(t, root)
+	stop := autonomy.Stop{Kind: autonomy.StopWorkOwed, Detail: "feat/x is behind main", PossiblyForcedByCap: true}
+	for range 2 {
+		if ok, err := st.RecordStop(stop, time.Now()); err != nil || !ok {
+			t.Fatalf("RecordStop: %v %v", ok, err)
+		}
+	}
+	stdout, stderr, err := runSplit(t, "", "mode", "back")
+	if err != nil {
+		t.Fatalf("mode back: %v\n%s", err, stderr)
+	}
+	lines := strings.Split(strings.TrimRight(stdout, "\n"), "\n")
+	if len(lines) != 4 {
+		t.Fatalf("mode back printed %d lines, want two queued, one stop and the ending:\n%s", len(lines), stdout)
+	}
+	for _, want := range []string{"queued: approve the embargo close", "queued: push feat/x", "possibly forced by the cap", "2 times", "Alice"} {
+		if !strings.Contains(stdout, want) {
+			t.Errorf("mode back misses %q:\n%s", want, stdout)
+		}
+	}
+	rec := readAway(t, root)
+	if rec.Holds(time.Now()) || rec.Closed == nil || rec.Closed.By != "Alice" || rec.Closed.From != root {
+		t.Errorf("after mode back: closed=%+v holds=%v", rec.Closed, rec.Holds(time.Now()))
+	}
+
+	// A second `mode back` has nothing to end.
+	if out := string(runCLI(t, "mode", "back")); !strings.Contains(out, "not in the away mode") {
+		t.Errorf("a second mode back printed %q", out)
+	}
+
+	// A record whose time has passed prints the same and is closed.
+	start := time.Now().Add(-3 * time.Hour).Truncate(time.Second)
+	if _, err := st.Update(func(*autonomy.Record) (*autonomy.Record, error) {
+		r := &autonomy.Record{SchemaVersion: autonomy.SchemaVersion, SetBy: "Alice", SetFrom: root,
+			Start: start, Until: start.Add(time.Hour)}
+		_ = r.AddStep("rotate the release key", root, start)
+		return r, nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	out := string(runCLI(t, "mode", "back"))
+	if !strings.Contains(out, "queued: rotate the release key") || !strings.Contains(out, "ended at") {
+		t.Errorf("mode back on a lapsed record printed:\n%s", out)
+	}
+	if rec := readAway(t, root); rec.Closed == nil {
+		t.Error("mode back left a lapsed record unclosed")
+	}
+}
+
+// TestHoldPushesRecordedAtTheVerb: `--hold-pushes` is kept in the record and
+// said in the set's output, beside the mode granting no rights.
+func TestHoldPushesRecordedAtTheVerb(t *testing.T) {
+	root := awayCheckout(t)
+	stdout, _, err := runSplit(t, "", "mode", "autonomous", "--hold-pushes")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !readAway(t, root).HoldPushes {
+		t.Error("--hold-pushes is not in the record")
+	}
+	if !strings.Contains(stdout, "pushes wait") || !strings.Contains(stdout, "grants no rights") {
+		t.Errorf("the set's output does not say pushes wait and the mode grants no rights:\n%s", stdout)
+	}
+	so, _, err := runSplit(t, "", "mode", "autonomous", "--json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(so, `"hold_pushes": false`) || readAway(t, root).HoldPushes {
+		t.Errorf("setting again without --hold-pushes kept it:\n%s", so)
+	}
+}
+
+// TestBadgeRefusedWhileAwayAtTheVerb: while away, `abcd mode product-thinker`
+// and `abcd mode facilitator` are refused naming `abcd decide`, nothing is
+// written, and `managed` is still set.
+func TestBadgeRefusedWhileAwayAtTheVerb(t *testing.T) {
+	root := awayCheckout(t)
+	if _, err := runCLIErr(t, "mode", "autonomous"); err != nil {
+		t.Fatal(err)
+	}
+	for _, st := range []string{"product-thinker", "facilitator"} {
+		_, err := runCLIErr(t, "mode", st)
+		if err == nil || exitCodeOf(err) != 2 || !strings.Contains(err.Error(), "abcd decide") {
+			t.Errorf("mode %s while away: err = %v, want exit 2 naming `abcd decide`", st, err)
+		}
+		if storedMode(t, root) != "" {
+			t.Errorf("a refused `mode %s` wrote the badge", st)
+		}
+	}
+	if _, err := runCLIErr(t, "mode", "managed"); err != nil {
+		t.Errorf("mode managed while away refused: %v", err)
+	}
+	runCLI(t, "mode", "back")
+	if _, err := runCLIErr(t, "mode", "facilitator"); err != nil {
+		t.Errorf("mode facilitator after mode back refused: %v", err)
+	}
+}
+
+// TestModeQueueRefusals: a step is refused when no record holds, when it is
+// empty, and when the record fails the store's checks, naming the file.
+func TestModeQueueRefusals(t *testing.T) {
+	root := awayCheckout(t)
+	if _, err := runCLIErr(t, "mode", "queue", "push feat/x"); err == nil || exitCodeOf(err) != 2 || !strings.Contains(err.Error(), "not away") {
+		t.Errorf("queue while present: err = %v, want exit 2 saying not away", err)
+	}
+	if _, err := runCLIErr(t, "mode", "autonomous"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := runCLIErr(t, "mode", "queue", "   "); err == nil || exitCodeOf(err) != 2 {
+		t.Errorf("empty step: err = %v, want exit 2", err)
+	}
+	if err := os.Chmod(awayStore(t, root).RecordPath(), 0o666); err != nil {
+		t.Fatal(err)
+	}
+	_, err := runCLIErr(t, "mode", "queue", "push feat/x")
+	if err == nil || exitCodeOf(err) != 2 || !strings.Contains(err.Error(), autonomy.RecordFile) {
+		t.Errorf("queue on a record others can write: err = %v, want exit 2 naming %s", err, autonomy.RecordFile)
+	}
+}
+
+// TestModeBackEndsAnUnreadableRecord: `abcd mode back` on a record that does
+// not parse exits 0, says the record could not be read and was replaced, and
+// the mode no longer holds; the --json envelope carries the notes.
+func TestModeBackEndsAnUnreadableRecord(t *testing.T) {
+	root := awayCheckout(t)
+	setAway(t)
+	if err := os.WriteFile(awayStore(t, root).RecordPath(), []byte("{not json"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	stdout, stderr, err := runSplit(t, "", "mode", "back", "--json")
+	if err != nil {
+		t.Fatalf("mode back on an unreadable record: %v\n%s", err, stderr)
+	}
+	if !strings.Contains(stdout, `"notes"`) || !strings.Contains(stdout, "could not be read") {
+		t.Errorf("the envelope lacks the notes:\n%s", stdout)
+	}
+	if rec := readAway(t, root); rec.Closed == nil || rec.Holds(time.Now()) {
+		t.Errorf("after mode back the record holds: %+v", rec)
+	}
+}