From 85588458058a6e87f1b3eed7271ad33a4b47b5a2 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 10:13:54 +0100
Subject: [PATCH 01/58] chore: decide the overnight-stall fix first and settle
 the slice's questions

The critical overnight stall is fixed first rather than deferred, on the
product thinker's standing rulings; its smallest slice is its own intent.
The slice's design questions and the checklist draft's obvious ones are
answered from the record and the host's documented hook behaviour.

Refs: iss-2610170619247185
Refs: itd-2610170638184486
Assisted-by: Claude:claude-opus-5-5
---
 ...10180913379049-the-overnight-stall-is-fixed-first-not.md | 6 ++++++
 ...610180913388445-the-stall-fix-is-its-own-intent-not-a.md | 6 ++++++
 ...0180913399042-the-away-mode-is-a-record-of-the-person.md | 6 ++++++
 .../dcn-2610180913399499-the-away-mode-is-held-once-per.md  | 6 ++++++
 ...180913406972-the-away-mode-is-repeated-to-the-session.md | 6 ++++++
 ...610180913413137-the-stop-check-refuses-only-while-the.md | 6 ++++++
 ...10180913416683-owed-work-is-four-kinds-read-from-disk.md | 6 ++++++
 ...10180913421109-a-session-with-nothing-owed-stops-only.md | 6 ++++++
 ...2610180913431493-while-the-person-is-away-no-question.md | 6 ++++++
 ...-2610180913431985-the-person-s-return-shows-two-lists.md | 6 ++++++
 ...10180913444971-a-session-s-checklist-is-one-json-file.md | 6 ++++++
 ...10180913445272-the-slice-keeps-the-core-host-agnostic.md | 6 ++++++
 ...dcn-2610180913455828-a-promise-tied-to-a-trigger-is-a.md | 6 ++++++
 ...-2610180913466436-the-pre-run-blocker-sweep-asks-four.md | 6 ++++++
 14 files changed, 84 insertions(+)
 create mode 100644 .abcd/work/decisions/dcn-2610180913379049-the-overnight-stall-is-fixed-first-not.md
 create mode 100644 .abcd/work/decisions/dcn-2610180913388445-the-stall-fix-is-its-own-intent-not-a.md
 create mode 100644 .abcd/work/decisions/dcn-2610180913399042-the-away-mode-is-a-record-of-the-person.md
 create mode 100644 .abcd/work/decisions/dcn-2610180913399499-the-away-mode-is-held-once-per.md
 create mode 100644 .abcd/work/decisions/dcn-2610180913406972-the-away-mode-is-repeated-to-the-session.md
 create mode 100644 .abcd/work/decisions/dcn-2610180913413137-the-stop-check-refuses-only-while-the.md
 create mode 100644 .abcd/work/decisions/dcn-2610180913416683-owed-work-is-four-kinds-read-from-disk.md
 create mode 100644 .abcd/work/decisions/dcn-2610180913421109-a-session-with-nothing-owed-stops-only.md
 create mode 100644 .abcd/work/decisions/dcn-2610180913431493-while-the-person-is-away-no-question.md
 create mode 100644 .abcd/work/decisions/dcn-2610180913431985-the-person-s-return-shows-two-lists.md
 create mode 100644 .abcd/work/decisions/dcn-2610180913444971-a-session-s-checklist-is-one-json-file.md
 create mode 100644 .abcd/work/decisions/dcn-2610180913445272-the-slice-keeps-the-core-host-agnostic.md
 create mode 100644 .abcd/work/decisions/dcn-2610180913455828-a-promise-tied-to-a-trigger-is-a.md
 create mode 100644 .abcd/work/decisions/dcn-2610180913466436-the-pre-run-blocker-sweep-asks-four.md

diff --git a/.abcd/work/decisions/dcn-2610180913379049-the-overnight-stall-is-fixed-first-not.md b/.abcd/work/decisions/dcn-2610180913379049-the-overnight-stall-is-fixed-first-not.md
new file mode 100644
index 0000000000..91fdddb376
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913379049-the-overnight-stall-is-fixed-first-not.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913379049
+slug: the-overnight-stall-is-fixed-first-not
+date: 2026-10-18
+---
+2026-10-18 — The overnight stall is fixed first, not deferred (facilitator-on-delegation, iss-2610170619247185 and itd-2610170638184486 planning prep): the critical record of the session that sat idle overnight is not given a one-cycle deferral; the security and bug-fix release waits for the smallest slice that removes its core cause, filed as itd-2610180912189125. This rests on the product thinker's standing rulings, restated: of 2026-10-11, that a major finding is fixed before a cut, never deferred, and building carries on; of 2026-10-12, that when a deferred question is all that stands between an intent and its plan, the facilitator decides it on delegation and plans it; of 2026-10-17, that in an autonomous run the agent decides and records rather than ending on a wait for the person. The stop check itself is the product thinker's settled design, in the checklist draft's decisions of 2026-10-17: a stop with work owed is refused only while they are recorded as away, and while they are present it is allowed and pointed out. It agrees with the coordination prep's decision that this fix ships as the bundle's first slice without waiting on the coordination intent (grounds: iss-2610170619247185 remedy; itd-2610170638184486 decisions; the coordination prep's ship-first decision of 2026-10-18)
diff --git a/.abcd/work/decisions/dcn-2610180913388445-the-stall-fix-is-its-own-intent-not-a.md b/.abcd/work/decisions/dcn-2610180913388445-the-stall-fix-is-its-own-intent-not-a.md
new file mode 100644
index 0000000000..375967382a
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913388445-the-stall-fix-is-its-own-intent-not-a.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913388445
+slug: the-stall-fix-is-its-own-intent-not-a
+date: 2026-10-18
+---
+2026-10-18 — The stall fix is its own intent, not a spec of the checklist draft (facilitator-on-delegation, itd-2610180912189125 planning): the slice (the away mode held by abcd, the stop check, and the question reroute) is filed as itd-2610180912189125, which builds on itd-2610170638184486, rather than planned as a first spec of that draft closed with a remainder; planning the draft would move it to planned before the product thinker has walked its criteria on Thursday, and its open trade-offs (the phone, the shared options) would then sit inside a planned record. A separate intent keeps the split with the coordination intent unchanged, since the slice touches nothing on the shared remote, and follows the precedent of itd-2610150602547271, filed as the first slice of itd-97. The idle time a coordinator sees stays out of the slice and comes with the coordination intent's central view (grounds: brief invariant 17; itd-2610150602547271; itd-2610170638184486 scope split; the coordination prep's ship-first decision)
diff --git a/.abcd/work/decisions/dcn-2610180913399042-the-away-mode-is-a-record-of-the-person.md b/.abcd/work/decisions/dcn-2610180913399042-the-away-mode-is-a-record-of-the-person.md
new file mode 100644
index 0000000000..25246bed7e
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913399042-the-away-mode-is-a-record-of-the-person.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913399042
+slug: the-away-mode-is-a-record-of-the-person
+date: 2026-10-18
+---
+2026-10-18 — The away mode is a record of the person's absence, set by a verb and ended only by its time or by their word (facilitator-on-delegation, itd-2610180912189125 planning): abcd mode autonomous [--until <time>] records who set it (the holder name reservations already resolve from caller-local facts), when, and when it ends, where --until takes a clock time (its next occurrence, local time) or a full timestamp and a time already past is refused; without --until it is open-ended until abcd mode back. It sits beside the waiting-on badge, whose three words stay a closed set, and is not a fourth word. A human prompt during the window does not end it, since a brief return overrode the instruction on 2026-10-16 and a prompt from a peer looks the same. An agent sets it on the person's word in its session, and one set covers every working copy, so no peer has to relay it. This restates the product thinker's 2026-10-17 ruling that they say they are away, until a set time or open-ended, and say when they are back (grounds: itd-2610170638184486 decisions; iss-2610170619247185; brief invariant 10; internal/core/mode)
diff --git a/.abcd/work/decisions/dcn-2610180913399499-the-away-mode-is-held-once-per.md b/.abcd/work/decisions/dcn-2610180913399499-the-away-mode-is-held-once-per.md
new file mode 100644
index 0000000000..d8345a321b
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913399499-the-away-mode-is-held-once-per.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913399499
+slug: the-away-mode-is-held-once-per
+date: 2026-10-18
+---
+2026-10-18 — The away mode is held once per repository on the machine, not per working copy (facilitator-on-delegation, itd-2610180912189125 planning): the record lives in abcd's machine store under the repository's root commit, beside the worktree store's key, so every working copy of the repository and every session in it reads the same record; the issue's remedy words it per checkout, but the stall began with an instruction relayed by a peer between sessions in separate working copies, and the person's absence is a fact about them, not about one copy. It is not machine-wide, so a repository the person never left running is unaffected. A session on another computer or in the cloud does not see it until the checklist draft's shared options land (grounds: iss-2610170619247185 what happened; AGENTS.md worktree store; principle the-users-directory-is-theirs)
diff --git a/.abcd/work/decisions/dcn-2610180913406972-the-away-mode-is-repeated-to-the-session.md b/.abcd/work/decisions/dcn-2610180913406972-the-away-mode-is-repeated-to-the-session.md
new file mode 100644
index 0000000000..f35c60d6f6
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913406972-the-away-mode-is-repeated-to-the-session.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913406972
+slug: the-away-mode-is-repeated-to-the-session
+date: 2026-10-18
+---
+2026-10-18 — The away mode is repeated to the session at every start, after every compaction and with every prompt (facilitator-on-delegation, itd-2610180912189125 planning): while it holds, the session-start hook says it on every source, compact included, and the prompt hook says it with every prompt, outside the rule loader's once-per-session ledger, as one short block: away until when and set by whom, the rule to decide and record rather than wait, and the next owed item. The host documents that a SessionStart hook fires with source compact after compaction and that its plain stdout or additionalContext, like a UserPromptSubmit hook's, is added to Claude's context. The instruction of 2026-10-16 was lost because it lived only in the context a compaction summarised (grounds: code.claude.com/docs/en/hooks SessionStart matcher compact and UserPromptSubmit additionalContext; principle durable-state-lives-where-the-platform-says-it-survives; iss-2610170619247185)
diff --git a/.abcd/work/decisions/dcn-2610180913413137-the-stop-check-refuses-only-while-the.md b/.abcd/work/decisions/dcn-2610180913413137-the-stop-check-refuses-only-while-the.md
new file mode 100644
index 0000000000..386caf4ac2
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913413137-the-stop-check-refuses-only-while-the.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913413137
+slug: the-stop-check-refuses-only-while-the
+date: 2026-10-18
+---
+2026-10-18 — The stop check refuses only while the person is away and is bounded so it never spins (facilitator-on-delegation, itd-2610180912189125 planning): a plugin Stop hook asks abcd, which blocks the stop with the host's decision block and a reason naming the next owed item and how many remain, only while the away mode holds and owed work exists. While the person is present the stop is allowed and, with work owed, pointed out in one line through the host's systemMessage. If the host says the session is already continuing because of a stop hook and the owed set is unchanged since this session's last block, the stop is allowed and recorded as stopped with work owed, shown on the person's return; the host's own cap of eight consecutive continuations, reset by each tool call, is the outer bound. The host documents stop_hook_active as the field to check so a hook never blocks on a condition that will not resolve. The session states are the bundle's: working, waiting, stopped. This restates the product thinker's 2026-10-17 stop-check ruling (grounds: code.claude.com/docs/en/hooks Stop input and Stop decision control; itd-2610170638184486 decisions)
diff --git a/.abcd/work/decisions/dcn-2610180913416683-owed-work-is-four-kinds-read-from-disk.md b/.abcd/work/decisions/dcn-2610180913416683-owed-work-is-four-kinds-read-from-disk.md
new file mode 100644
index 0000000000..9d68028058
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913416683-owed-work-is-four-kinds-read-from-disk.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913416683
+slug: owed-work-is-four-kinds-read-from-disk
+date: 2026-10-18
+---
+2026-10-18 — Owed work is four kinds, read from disk and one forge listing (facilitator-on-delegation, itd-2610180912189125 planning): a session owes work it can do alone when it has (1) a live reservation whose renewal is due or whose work no open pull request carries yet; (2) an open pull request of its own that is behind the default branch or failing its checks; (3) a branch of its own with commits not pushed; (4) a branch of its own stacked on a change that is still open, whose merge from the default branch, fixes, review and preflight are owed now, since a declared dependency holds only its landing. A branch is the session's own when its working copy's own HEAD history has had it checked out since the window began, so a sibling copy's branches never count. The reservations are read as last fetched, behind against the last-fetched default branch, and the pull requests' states from one listing of the person's open pull requests through the forge client per stop check, which becomes part of the away mode's documented meaning in brief invariant 7, as the drain's listing is; a failed listing falls back to the disk kinds and says so. The next item is the first of: a renewal due, a failing pull request, a behind one, a stacked branch, an unpushed branch, unhanded work (grounds: iss-2610170619247185 remedy and second instance; the coordination prep's decision that a declared dependency constrains only the landing; brief invariant 7; internal/core/claim)
diff --git a/.abcd/work/decisions/dcn-2610180913421109-a-session-with-nothing-owed-stops-only.md b/.abcd/work/decisions/dcn-2610180913421109-a-session-with-nothing-owed-stops-only.md
new file mode 100644
index 0000000000..f5ec127348
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913421109-a-session-with-nothing-owed-stops-only.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913421109
+slug: a-session-with-nothing-owed-stops-only
+date: 2026-10-18
+---
+2026-10-18 — A session with nothing owed stops only with its next look scheduled (facilitator-on-delegation, itd-2610180912189125 planning): while the away mode holds, a stop with no owed work is allowed when the host reports a scheduled wake for the session or a background task in flight, and is then waiting; otherwise it is blocked once, asking the session to schedule its next look sooner than half its reservations' lease (under an hour for the two-hour lease) through the host's own scheduling, and the bound in the stop-check decision applies. The host documents that its Stop input carries session_crons (wakes from CronCreate, ScheduleWakeup and /loop) and background_tasks so a hook can tell a finished session from one paused for work that will wake it. abcd starts no process of its own and schedules nothing itself. The check covers the overnight gap after the two-hour watcher ended; the checklist draft's own timed wakes and trigger promises stay there. It matches the coordination prep's decision that a waiting session wakes before half its lease, and the product thinker's ruling that a waiting session records when it looks again and is never kept spinning (grounds: code.claude.com/docs/en/hooks Stop input; itd-2610170638184486 decisions; iss-2610170619247185 idle spans)
diff --git a/.abcd/work/decisions/dcn-2610180913431493-while-the-person-is-away-no-question.md b/.abcd/work/decisions/dcn-2610180913431493-while-the-person-is-away-no-question.md
new file mode 100644
index 0000000000..9060b213d6
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913431493-while-the-person-is-away-no-question.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913431493
+slug: while-the-person-is-away-no-question
+date: 2026-10-18
+---
+2026-10-18 — While the person is away no question waits for them (facilitator-on-delegation, itd-2610180912189125 planning): while the away mode holds, the guard refuses every question on the host's question tool, abcd's or another tool's, because a question nobody is there to answer stalls the session. A product or technical question is refused with a reason telling the agent to decide it, record it with abcd decide marked as decided on delegation with its grounds and how to reverse it, and carry on; a step only the person's hands can do (a browser step, a secret, a new App) is refused with a reason telling the agent to queue it with abcd mode queue "<step>" and carry on with other work. abcd mode product-thinker or facilitator is refused the same way. Decisions in the window are not asked first, technical trade-offs included, since the product thinker ruled on 2026-10-17 that in an autonomous run the agent decides and records and only steps that need them on the website wait (grounds: iss-2610170619247185 remedy; itd-2610170638184486 framing; internal/surface/cli guard question check)
diff --git a/.abcd/work/decisions/dcn-2610180913431985-the-person-s-return-shows-two-lists.md b/.abcd/work/decisions/dcn-2610180913431985-the-person-s-return-shows-two-lists.md
new file mode 100644
index 0000000000..31db379e1f
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913431985-the-person-s-return-shows-two-lists.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913431985
+slug: the-person-s-return-shows-two-lists
+date: 2026-10-18
+---
+2026-10-18 — The person's return shows two lists derived from what already exists (facilitator-on-delegation, itd-2610180912189125 planning): when the away mode ends, by its time passing or abcd mode back, the next prompt shows once the steps queued for the person's hands and the decisions recorded in the window, each with its text, which the reroute asks to carry its grounds and how to reverse it, plus any stop recorded with work owed. The decisions are the decision records whose time-ordered ids fall inside the window, so no second store of decisions is kept; the queue is the only new list and lives in the away record. The draft's richer lists for the person's return stay in itd-2610170638184486 (grounds: principle one-canonical-primitive; adr-45 time-ordered ids; itd-2610170638184486 press release)
diff --git a/.abcd/work/decisions/dcn-2610180913444971-a-session-s-checklist-is-one-json-file.md b/.abcd/work/decisions/dcn-2610180913444971-a-session-s-checklist-is-one-json-file.md
new file mode 100644
index 0000000000..355f0529e2
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913444971-a-session-s-checklist-is-one-json-file.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913444971
+slug: a-session-s-checklist-is-one-json-file
+date: 2026-10-18
+---
+2026-10-18 — A session's checklist is one JSON file per working copy in its local tier (facilitator-on-delegation, itd-2610170638184486 planning prep): the checklist the draft describes is kept per working copy, since the checkout is the unit of isolation and the coordination prep keys one central-view line per working copy, in that copy's local tier, never in a tracked folder, and its re-injection reuses the slice's session-start and prompt-hook path; the away mode itself is not copied into it but read from the repository's one away record (grounds: AGENTS.md concurrent sessions and working-tree layout; the draft's format decision; the coordination prep's per-working-copy decision; itd-2610180912189125)
diff --git a/.abcd/work/decisions/dcn-2610180913445272-the-slice-keeps-the-core-host-agnostic.md b/.abcd/work/decisions/dcn-2610180913445272-the-slice-keeps-the-core-host-agnostic.md
new file mode 100644
index 0000000000..aedd1ad535
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913445272-the-slice-keeps-the-core-host-agnostic.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913445272
+slug: the-slice-keeps-the-core-host-agnostic
+date: 2026-10-18
+---
+2026-10-18 — The slice keeps the core host-agnostic and is reachable without a host (facilitator-on-delegation, itd-2610180912189125 planning): the away record, the owed-work reading and the stop verdict are a core package returning data, and the front doors format it: abcd hook stop maps the host's Stop payload and answers in its decision format, and a bare abcd mode prints the away record, the queue and the owed items, so the check runs with no plugin host present. The plugin's hook manifest gains a Stop entry with the same bootstrap and home checks as its other hooks, and the status line names the away mode and its end, so the person never wrongly believes agents are working or waiting. Nothing is written under the host's own settings directory (grounds: brief invariant 3; AGENTS.md transport-agnostic core and wired or it isn't done; the product thinker's ruling of 2026-10-05 that nothing in the host's settings calls abcd beyond the consented status line; itd-2610170638184486 decisions)
diff --git a/.abcd/work/decisions/dcn-2610180913455828-a-promise-tied-to-a-trigger-is-a.md b/.abcd/work/decisions/dcn-2610180913455828-a-promise-tied-to-a-trigger-is-a.md
new file mode 100644
index 0000000000..6f41d646d1
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913455828-a-promise-tied-to-a-trigger-is-a.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913455828
+slug: a-promise-tied-to-a-trigger-is-a
+date: 2026-10-18
+---
+2026-10-18 — A promise tied to a trigger is a checklist entry checked when the session looks, never a watcher (facilitator-on-delegation, itd-2610170638184486 planning prep): a promise such as 'when that pull request merges, add the wrapper' is written into the checklist with its trigger, read by the session at each start, wake and stop check, and its wake is the host's scheduled wake that the slice's stop check already reads; abcd keeps no process alive for it. The two-hour watcher of 2026-10-16 ended with the promise unkept, and the coordination prep settled that every deadline is derived when records are read, with no process that must stay alive (grounds: iss-2610170619247185; the coordination prep's on-demand pass decision; code.claude.com/docs/en/hooks Stop input session_crons)
diff --git a/.abcd/work/decisions/dcn-2610180913466436-the-pre-run-blocker-sweep-asks-four.md b/.abcd/work/decisions/dcn-2610180913466436-the-pre-run-blocker-sweep-asks-four.md
new file mode 100644
index 0000000000..bb6c2c51e0
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180913466436-the-pre-run-blocker-sweep-asks-four.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180913466436
+slug: the-pre-run-blocker-sweep-asks-four
+date: 2026-10-18
+---
+2026-10-18 — The pre-run blocker sweep asks four fixed kinds and reports the run likely autonomous only when none is open (facilitator-on-delegation, itd-2610170638184486 planning prep): before or as an autonomous run starts, the orchestrating session asks each session by message, as the product thinker chose, for (1) a design decision not yet made, (2) a step only a person's hands can do, (3) work it depends on from another session, and (4) a credential missing or expiring within the window; each session writes its answers into its checklist, the orchestrator puts them to the person together, and says the run is likely to stay autonomous only once every session reports none open. The kinds are the four the draft's press release names; the message route stays within the coordination prep's bound that a question put to a person may travel by message (grounds: itd-2610170638184486 press release and scope split; the coordination prep's stance-bound decision; iss-2610170619247185, every blocker known at 20:48)

From caf57df6c755169f1a79f99a9878fc7d9416716e Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 10:19:12 +0100
Subject: [PATCH 02/58] docs: plan the overnight-stall fix as the checklist
 draft's first slice

The away mode held by abcd and repeated at every start, compaction and
prompt, a Stop hook that refuses to end a turn with owed work while the
person is away, and the question reroute become their own planned intent
with a seven-step spec ending in a live session capture. The ready gate
passes.

Refs: iss-2610170619247185
Refs: itd-2610180912189125
Assisted-by: Claude:claude-opus-5-5
---
 ...125-a-session-told-to-work-on-while-its.md | 228 ++++++++++++++++++
 ...489-a-session-told-to-work-on-while-its.md | 226 +++++++++++++++++
 ...n-autonomous-session-sat-idle-overnight.md |   1 +
 3 files changed, 455 insertions(+)
 create mode 100644 .abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md
 create mode 100644 .abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md

diff --git a/.abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md b/.abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md
new file mode 100644
index 0000000000..7fd5aed93a
--- /dev/null
+++ b/.abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md
@@ -0,0 +1,228 @@
+---
+id: itd-2610180912189125
+slug: a-session-told-to-work-on-while-its
+spec_id: spc-2610180914469489
+kind: standalone
+suggested_kind: null
+reclassification_history: []
+builds_on: [itd-2610170638184486]
+severity: critical
+impact: additive
+origin: researcher-authored
+production_mode: hand-written
+related_issues: [iss-2610170619247185]
+---
+
+# A session left to work on never stops while it has work
+
+## Press Release
+
+> A session told to work on while its person is away keeps working until they are back. Alice, a solo founder who is also the product thinker, leaves for the evening and says the sessions should work on until 09:00. abcd records that once for the repository, with who set it and when it ends, and repeats it to every session at each start, after each compaction and with every prompt, so no summary and no relay between sessions can drop it. A session that tries to end its turn while it still has work it can do alone (a reservation whose work is not yet handed in, a pull request of its own that has fallen behind or is failing, a branch it has not pushed, a branch stacked on another change that is still open) is handed the next of those items instead. One with nothing left to do may stop only with its next look scheduled. A question it would have put to Alice is decided and recorded instead, and a step only Alice's hands can do is queued for their return. In the morning Alice sees those steps and the decisions taken while they were away, and while they are at the terminal nothing is refused: a stop with work left is only pointed out.
+
+## Why This Matters
+
+On the night of 2026-10-16 every session had been told to work on until the
+morning, and one sat idle for about ten of eleven and a half hours while it
+held work it could do alone (iss-2610170619247185). The instruction lived only
+in chat: relayed by a peer, overridden in the session's reading when the
+product thinker came back for an hour, then dropped by a compaction summary.
+The session ended its turn on a question nobody was there to answer, and a
+Claude Code session runs only when something sends it input, so nothing ran
+until a peer's message six hours later. The same night a coordinating session
+held three finished steps behind a merge order when only their landing order
+was fixed.
+
+This is the smallest slice of the checklist draft (itd-2610170638184486) that
+removes the stall's core cause, carved out so the security and bug-fix release
+waits on it alone (dcn-2610180913379049, dcn-2610180913388445). It needs
+nothing on the shared remote, so it does not wait on the coordination intent.
+
+## Mechanism
+
+We expect an autonomous run to stop stalling because the three ways the
+session of 2026-10-16 went quiet are each closed where the host gives abcd a
+hook: the instruction to work on becomes a record abcd repeats at every start,
+compaction and prompt rather than context a summary can drop; ending a turn
+with owed work is refused at the Stop hook, the one point every quiet spell
+passes through; and a question to an absent person is refused before it can
+leave the session waiting. Shown wrong if, in an away window of at least six
+hours with owed work seeded at its start, a session following the slice is
+idle (no tool call) for more than one hour while owed work remains, or ends
+its turn on a question to the person.
+
+## Scope Conditions
+
+- A repository abcd manages, with the local tier and abcd's plugin hooks <!-- cond: cond-2610180914466989 -->
+  installed in the host that runs its sessions.
+- A host that runs a Stop hook and honours its block decision, a session-start <!-- cond: cond-2610180914464633 -->
+  hook on compaction and a prompt hook, as Claude Code documents them; on a
+  host without them the mode is still recorded and shown, and nothing is
+  enforced.
+- Sessions on one computer: the away record is held per repository on that <!-- cond: cond-2610180914460950 -->
+  machine, so a session on another computer or in the cloud does not see it.
+- The stop check's pull-request reading needs the forge client signed in; when <!-- cond: cond-2610180914462056 -->
+  it cannot read the forge it judges from disk alone and says so.
+- A session that keeps working through the host: the check refuses a stop, it <!-- cond: cond-2610180914469321 -->
+  cannot start a session that is not running.
+
+## What's In Scope
+
+- **The away mode.** `abcd mode autonomous [--until <time>]` records who set
+  it, when, and when it ends; `abcd mode back` ends it. One record per
+  repository on the machine, shared by every working copy
+  (dcn-2610180913399042, dcn-2610180913399499).
+- **Repeated, never summarised away.** While it holds, the session-start hook
+  (every source, compaction included) and the prompt hook (every prompt) add
+  one short block to the session's context (dcn-2610180913406972).
+- **The stop check.** A plugin Stop hook asks `abcd hook stop`, which refuses
+  to end a turn with owed work while the person is away, names the next item,
+  and is bounded so it never spins; while the person is present it only points
+  the work out (dcn-2610180913413137, dcn-2610180913421109).
+- **Owed work**, in exactly these terms: a live reservation whose renewal is
+  due or whose work no open pull request carries yet; an open pull request of
+  the session's own that is behind the default branch or failing its checks; a
+  branch of its own with commits not pushed; and a branch of its own stacked on
+  a change that is still open, whose merge from the default branch, fixes,
+  review and preflight are owed now while only its landing waits
+  (dcn-2610180913416683).
+- **The question reroute.** While the person is away, the guard refuses every
+  question on the host's question tool: a decision is taken and recorded with
+  `abcd decide`, and a step only the person's hands can do is queued with
+  `abcd mode queue "<step>"` (dcn-2610180913431493).
+- **The person's return.** The queue and the decisions recorded in the window,
+  shown once on the next prompt after the mode ends (dcn-2610180913431985).
+- **Shown and reachable.** The status line names the away mode and its end; a
+  bare `abcd mode` prints the record, the queue and the owed items
+  (dcn-2610180913445272).
+
+## What's Out of Scope
+
+- The rest of itd-2610170638184486: the per-session checklist, trigger
+  promises, abcd's own timed wakes, the pre-run blocker sweep, the shared and
+  published options and the phone.
+- Idle time a coordinator sees across sessions, which comes with the
+  coordination intent's central view in `abcd status`.
+- Starting or waking a session that is not running.
+- Each autonomous session's own forge credential, owned by the coordination
+  intent.
+
+## Acceptance Criteria
+
+- **Given** Alice, the product thinker, runs `abcd mode autonomous --until
+  09:00` in one working copy at 20:00, **when** a session in a sibling working
+  copy of the same repository starts, **then** its context carries the away
+  block naming 09:00 and who set it, with no message from any peer.
+- **Given** the away mode holds, **when** a session's context is compacted,
+  **then** the session-start hook fired with source `compact` adds the away
+  block again, and so does the prompt hook on the next prompt.
+- **Given** the away mode holds and the session's own pull request is behind
+  the default branch, **when** the session tries to end its turn, **then** the
+  stop is blocked and the reason names that pull request as the next item and
+  says how many items remain.
+- **Given** the away mode holds and a branch of the session's own is stacked
+  on a pull request that is still open, **when** it tries to end its turn,
+  **then** the stop is blocked and the reason asks for the merge from the
+  default branch, the fixes, the review and the preflight now, and says only
+  the landing waits for the base.
+- **Given** the away mode holds and the session holds a live reservation whose
+  work no open pull request carries, or a branch with unpushed commits,
+  **when** it tries to end its turn, **then** the stop is blocked naming that
+  item.
+- **Given** the stop was blocked once and the host reports the session is
+  already continuing because of a stop hook, **when** it tries to stop again
+  with the owed set unchanged, **then** the stop is allowed and recorded as
+  stopped with work owed, and that record appears on Alice's return.
+- **Given** the away mode holds and nothing is owed, **when** the session tries
+  to stop with no scheduled wake and no background task, **then** the stop is
+  blocked once asking it to schedule its next look in under an hour; **and
+  when** it stops with a wake scheduled, **then** the stop is allowed and the
+  session is waiting.
+- **Given** no away mode holds (Alice is at the terminal), **when** a session
+  with owed work ends its turn, **then** the stop is allowed and one line
+  shown to Alice names the owed work.
+- **Given** the away mode holds, **when** the agent puts a question to Alice on
+  the host's question tool, **then** the guard refuses it, telling the agent to
+  decide and record it with `abcd decide` and carry on, or, for a step only
+  Alice's hands can do, to queue it with `abcd mode queue`.
+- **Given** a window in which two decisions were recorded and one step was
+  queued, **when** Alice runs `abcd mode back` or the window's time passes and
+  they send the next prompt, **then** they see the queued step and both
+  decisions with their text, once.
+- **Given** the away mode holds, **when** Alice looks at the status line,
+  **then** it names the away mode and its end; **and when** Nia, the technical
+  facilitator, runs a bare `abcd mode` with no plugin host, **then** it prints
+  the record, the queue and the owed items.
+- **Given** `--until` names a time already past, or the repository has no local
+  tier, **when** `abcd mode autonomous` runs, **then** it refuses, names the
+  reason, and writes nothing.
+- **Given** the forge cannot be read during a stop check, **when** the session
+  tries to stop while away, **then** the check judges from the disk kinds alone
+  and the reason says the pull requests were not read.
+- **Given** the slice is built, **when** a live Claude Code session with the
+  plugin from the branch runs an away window with seeded owed work, a
+  compaction and an attempted stop, **then** a captured transcript shows the
+  away block after compaction, the blocked stop naming the next item, and the
+  refused question.
+
+## SOTA
+
+Surveyed 2026-10-18 against the host's current hook reference
+(https://code.claude.com/docs/en/hooks) and the record:
+
+- **The host's Stop hook with a block decision:** documented and current.
+  Adopted as the only point every quiet spell passes through; the host bounds
+  it with `stop_hook_active` and a cap of eight consecutive continuations,
+  reset by each tool call.
+- **The host's session-scoped scheduled wakes** (CronCreate, ScheduleWakeup,
+  `/loop`), reported to a Stop hook as `session_crons`: young. Adopted only as
+  evidence that a waiting session will look again; abcd schedules nothing.
+- **Re-injection through the session-start hook's compact source and the
+  prompt hook:** documented. Adopted for the away block, as the checklist
+  draft's format decision already chose for the checklist.
+- **A supervisor process that restarts or prompts idle sessions:** a common
+  pattern, not adopted: it needs a process that stays alive, which the
+  coordination intent's on-demand pass rules out, and it cannot tell owed work
+  from a finished session without the same reading this slice adds.
+- **The host's agent-team idle hook (TeammateIdle):** young, bound to one agent
+  team in one session, so it cannot reach sessions in separate working copies.
+  Not adopted.
+
+Path taken: 2. The host's hooks are the native floor; the away record, the
+owed-work reading and the verdict are abcd's, behind a core seam that a
+second host's hooks can call.
+
+## Open Questions
+
+_None. Every question of the slice was settled on delegation; the decisions
+are listed below._
+
+## Decisions
+
+Each is the facilitator's, on delegation, and restates the product thinker's
+ruling or the ground it rests on; the full text is in the decision record.
+
+1. **Fixed first** (dcn-2610180913379049): the stall is fixed before the
+   security and bug-fix release, not deferred.
+2. **Its own intent** (dcn-2610180913388445): the slice builds on the
+   checklist draft rather than planning it.
+3. **The away record** (dcn-2610180913399042): set by a verb on the person's
+   word, ended by its time or their word, never by a prompt.
+4. **Per repository on the machine** (dcn-2610180913399499).
+5. **Repeated at start, compaction and every prompt**
+   (dcn-2610180913406972).
+6. **Owed work** (dcn-2610180913416683): four kinds, read from disk and one
+   forge listing; brief invariant 7 gains the clause.
+7. **The stop check and its bound** (dcn-2610180913413137).
+8. **Nothing owed means a scheduled look** (dcn-2610180913421109).
+9. **No question waits while away** (dcn-2610180913431493).
+10. **Two lists on return, derived** (dcn-2610180913431985).
+11. **Host-agnostic core, reachable without a host**
+    (dcn-2610180913445272).
+
+## Audit Notes
+
+_Empty. Populated by intent-auditor when intent moves to shipped/._
+
+## Grounds
+
+- pursued: we expect an autonomous session to stop going idle with owed work, because the instruction to work on becomes a record abcd repeats at start, compaction and prompt, and the Stop hook refuses a turn's end while owed work exists; shown wrong if, in a six-hour away window with seeded owed work, a session following the slice is idle over an hour while owed work remains, or ends its turn on a question to the person
diff --git a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
new file mode 100644
index 0000000000..1260e438da
--- /dev/null
+++ b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
@@ -0,0 +1,226 @@
+---
+id: spc-2610180914469489
+slug: a-session-told-to-work-on-while-its
+intent: itd-2610180912189125
+origin: researcher-authored
+production_mode: hand-written
+---
+# A session left to work on never stops while it has work
+
+## Summary
+
+Delivers itd-2610180912189125, the first slice of the checklist draft
+(itd-2610170638184486) and the fix for iss-2610170619247185. Three parts:
+
+- **The away mode.** `abcd mode autonomous [--until <time>]`, `abcd mode back`
+  and `abcd mode queue "<step>"` keep one away record per repository on the
+  machine. The session-start hook (every source, `compact` included) and the
+  prompt hook repeat it on every prompt while it holds.
+- **The stop check.** A plugin Stop hook runs `abcd hook stop`. While the
+  record holds, it blocks a turn's end while owed work exists and names the
+  next item. It is bounded by the host's `stop_hook_active` flag and by an
+  unchanged owed set. While the person is present, it only points the work
+  out.
+- **The question reroute.** While the record holds, the guard refuses every
+  question on the host's question tool. A decision goes to `abcd decide`, and
+  a step only the person's hands can do goes to the queue. On their return,
+  the queue and the window's decisions are shown once.
+
+Every behaviour is built test-first: each step's tests are written and watched
+failing before its code. The last step is a live Claude Code session capture,
+because the hook mechanics are the host's and a unit test cannot prove them
+(principle evaluate-at-the-user-surface).
+
+## Design
+
+### The host mechanics this rests on
+
+Read on 2026-10-18 at https://code.claude.com/docs/en/hooks (the old
+docs.claude.com hooks page redirects there):
+
+- **Stop.** The hook "runs when the main Claude Code agent has finished
+  responding" and not on a user interrupt. Its input carries
+  `stop_hook_active`, which is "true when Claude Code is already continuing as
+  a result of a stop hook". The page says to check it "to avoid blocking on a
+  condition that will never resolve". The input also carries
+  `last_assistant_message`, `background_tasks` and `session_crons`; the last
+  holds the session's scheduled wakes from CronCreate, ScheduleWakeup and
+  `/loop`. Output `{"decision": "block", "reason": …}` prevents the stop, and
+  the reason "tells Claude why it should continue". Claude Code caps this at
+  eight consecutive continuations, and the count resets each time Claude calls
+  a tool.
+- **SessionStart.** The matcher values include `compact` ("auto or manual
+  compaction"). Plain stdout, or `hookSpecificOutput.additionalContext`, is
+  added to Claude's context.
+- **UserPromptSubmit.** Plain stdout or `additionalContext` is added beside
+  the prompt, as a system reminder.
+- **Universal output.** `systemMessage` is a "warning message shown to the
+  user".
+
+abcd's hook manifest already registers SessionStart with no matcher, so
+compaction already runs `abcd hook session-start`. It has no Stop entry.
+
+### The away record
+
+- **Where it lives.** One JSON file per repository on the machine, in abcd's
+  machine store under the repository's root commit, beside the worktree store
+  (dcn-2610180913399499). It is written through fsutil's atomic writer.
+- **What it holds.** Who set it: the holder name reservations cache, without
+  a network read, falling back to git's `user.name`. It also holds the start
+  and the end (none when open-ended), the queue of steps for the person, and
+  the stops recorded with work owed.
+- **When it ends.** It holds while now is before its end. It ends with `abcd
+  mode back`, or when its time passes. A human prompt never ends it
+  (dcn-2610180913399042).
+- **The badge.** The three-word badge in `internal/core/mode` is untouched.
+  While the record holds, `abcd mode product-thinker` and `abcd mode
+  facilitator` are refused, naming `abcd decide`.
+
+### Owed work
+
+Owed work is four kinds (dcn-2610180913416683):
+
+1. a live reservation whose renewal is due or whose work no open pull
+   request carries yet;
+2. an open pull request of the session's own that is behind the default
+   branch or failing its checks;
+3. a branch of its own with commits not pushed;
+4. a branch of its own stacked on a change that is still open. Its merge from
+   the default branch, fixes, review and preflight are owed now, and only its
+   landing waits for the base.
+
+- **Which branches are the session's own.** A branch is the session's own when
+  the working copy's own HEAD reflog has had it checked out since the window
+  began. Sibling working copies share the branch namespace, so this keeps one
+  copy from being held for another's branch.
+- **What is read from disk.** Reservations are read as last fetched
+  (`claim.LastFetched`). "Behind" is measured against the last-fetched default
+  branch.
+- **What is read from the forge.** One `gh pr list` of the person's open pull
+  requests per stop check gives the head and base branch, the merge state and
+  the check rollup. Brief invariant 7 gains this as the away mode's documented
+  meaning, as the drain's listing is. If the listing fails, the check uses the
+  disk kinds only and says the pull requests were not read.
+- **Order.** The next item is the first of: a renewal due, a failing pull
+  request, a behind one, a stacked branch, an unpushed branch, unhanded work.
+
+### The stop verdict
+
+`autonomy.Judge(record, owed, payload) Verdict` is pure:
+
+| state | owed | `stop_hook_active` | verdict |
+|---|---|---|---|
+| away | some, changed or first time | any | block: next item and count (working) |
+| away | some, unchanged since this session's last block | true | allow; record "stopped with work owed" |
+| away | none, a wake or background task present | any | allow (waiting) |
+| away | none, no wake | false | block once: schedule the next look within half the lease |
+| away | none, no wake | true | allow; record it |
+| present | some | any | allow; `systemMessage` names the work (stopped, flagged) |
+| present | none | any | allow, silent |
+
+- **The fingerprint.** "Unchanged" compares a hash of the owed set with the
+  one kept for the session id in the local tier.
+- **The front door.** `abcd hook stop` maps the payload and writes the host's
+  JSON. A malformed payload or an unreadable record allows the stop and says
+  so on stderr, following the guard's fail-open-loud contract. A stop is never
+  blocked on abcd's own fault.
+
+### The question reroute
+
+`questionGate` (`internal/surface/cli/guard_question.go`) reads the away
+record first. While it holds, it denies every question-tool call, abcd's or
+another tool's. The deny reason depends on the chip:
+
+- a Product or Tech chip, or no chip, gets the reason to decide and record it
+  with `abcd decide`, with grounds and how to reverse it;
+- a Setup chip gets the reason to queue the step with `abcd mode queue`.
+
+No mode is set and no question is marked open (dcn-2610180913431493).
+
+### Shown
+
+- **On the person's return.** The prompt hook's first run after the record
+  ends prints the queue, the window's decisions and the recorded stops once,
+  then marks the record shown. The window's decisions are the records whose
+  ids fall between its start and end (dcn-2610180913431985).
+- **On the status line.** It reads the record and names the away mode and its
+  end.
+- **From the command line.** A bare `abcd mode` prints the badge, the record,
+  the queue and the owed items.
+
+## Footprint
+
+- packages: internal/core/autonomy, internal/core/mode, internal/core/statusline, internal/surface/cli, hooks, commands/mode.md, .abcd/development/brief/02-constraints/03-invariants.md, .abcd/development/brief/04-surfaces/08-abcd.md, .abcd/development/brief/04-surfaces/17-guard.md
+- tests: internal/core/autonomy, internal/core/mode, internal/core/statusline, internal/surface/cli
+
+## Steps
+
+1. The away record and its verbs
+   - packages: internal/core/autonomy, internal/surface/cli, commands/mode.md
+   - tests: internal/core/autonomy, internal/surface/cli
+   - Watched failing first: `abcd mode autonomous --until 09:00` writes one
+     record that a sibling worktree of the same repository reads; `--until`
+     takes a clock time (its next occurrence) or a full timestamp; a past time,
+     no local tier or no checkout is refused with nothing written; `abcd mode
+     back` ends it; a record past its end reads as ended; `abcd mode queue`
+     appends; `abcd mode product-thinker` is refused while the record holds;
+     the badge's three-word vocabulary test still passes unchanged.
+2. Repeated at start, compaction and every prompt
+   - packages: internal/surface/cli
+   - tests: internal/surface/cli
+   - Watched failing first: `abcd hook session-start` with source `startup`,
+     `resume` and `compact` prints the away block while the record holds and
+     nothing when it does not; `abcd hook prompt-router` adds it on every
+     prompt, including a second prompt in the same session, outside the
+     loader's dedup ledger; both stay inside the hook's existing deadline.
+3. Owed work
+   - packages: internal/core/autonomy
+   - tests: internal/core/autonomy
+   - Watched failing first, against real git repositories in temp folders
+     and a fake forge listing pinned to `internal/ghcontract`'s fields: each
+     of the four kinds is found; a sibling worktree's branch is not the
+     session's own; a stacked branch with an open base is owed and its item
+     says only the landing waits; a reservation whose pull request is open and
+     green is not owed until its renewal is due; a failed listing yields the
+     disk kinds and a "not read" note; the order of items is fixed.
+4. The stop verdict and the Stop hook
+   - packages: internal/core/autonomy, internal/surface/cli, hooks
+   - tests: internal/core/autonomy, internal/surface/cli
+   - Watched failing first: every row of the verdict table; the fingerprint
+     is kept per session id; `abcd hook stop` writes `{"decision":"block",
+     "reason":…}` only on a block and a `systemMessage` while present; a
+     malformed payload allows the stop with a stderr line; `hooks/hooks.json`
+     gains a Stop entry and `hooks/stop.sh` takes the same bootstrap and home
+     checks as `hooks/subagent-stop.sh` (the hook-shape tests in
+     `internal/surface/cli` cover it).
+5. The question reroute and the person's return
+   - packages: internal/surface/cli, internal/core/autonomy
+   - tests: internal/surface/cli, internal/core/autonomy
+   - Watched failing first: while away, a Product-chip, a Tech-chip and an
+     unchipped question are denied with the decide reason, and a Setup-chip
+     question with the queue reason; another tool's question is denied too;
+     no mode is set and no marker written; while present the gate behaves
+     exactly as today. The first prompt after the record ends prints the
+     queue, the window's decisions (by id range) and the recorded stops,
+     once.
+6. Shown, documented, and invariant 7's clause
+   - packages: internal/core/statusline, internal/surface/cli, commands/mode.md, .abcd/development/brief/02-constraints/03-invariants.md, .abcd/development/brief/04-surfaces/08-abcd.md, .abcd/development/brief/04-surfaces/17-guard.md
+   - tests: internal/core/statusline, internal/surface/cli
+   - Watched failing first: the status line names the away mode and its end;
+     a bare `abcd mode` prints the record, the queue and the owed items with
+     no host. Brief invariant 7 gains the stop check's one forge listing as
+     the away mode's documented meaning. The plugin page and the brief's
+     surface chapters say what each verb does. Then `go generate
+     ./internal/surface/cli` is run for the derived appendix.
+7. The live session capture
+   - packages: none (evidence only, kept in the local tier)
+   - tests: a live Claude Code session with the plugin built from the branch
+   - In a lab checkout, seed one behind pull request, one stacked branch and
+     one unpushed branch, set `abcd mode autonomous --until` an hour ahead,
+     and record the transcript. It must show the away block on start; a
+     manual `/compact` followed by the block again; an attempted stop blocked
+     naming the behind pull request; the stacked branch's item; a question
+     refused with the decide reason; `abcd mode back` showing the decisions
+     and the queue. Repeat with the mode off to show the stop allowed and
+     flagged. Capture before and after the change on the same checkout, as
+     the release lesson on host fixes requires.
diff --git a/.abcd/work/issues/open/iss-2610170619247185-an-autonomous-session-sat-idle-overnight.md b/.abcd/work/issues/open/iss-2610170619247185-an-autonomous-session-sat-idle-overnight.md
index 334a358804..15dc69d983 100644
--- a/.abcd/work/issues/open/iss-2610170619247185-an-autonomous-session-sat-idle-overnight.md
+++ b/.abcd/work/issues/open/iss-2610170619247185-an-autonomous-session-sat-idle-overnight.md
@@ -8,6 +8,7 @@ source: "user-observation"
 found_during: "autonomous overnight run 2026-10-16"
 origin: researcher-authored
 production_mode: hand-written
+related_intents: [itd-2610170638184486, itd-2610180912189125]
 found_at: "the agent loop between turns in an autonomous run"
 lapsed_at: "2026-10-16T19:48:14Z"
 remedy: "Make an autonomous run abcd state rather than chat: an 'abcd mode autonomous --until <time>' state per checkout that the prompt and session-start hooks inject (so compaction and peer relays cannot drop it); a Stop hook that, while that state holds, refuses to end a turn that has owed work (its reservations, its behind or failing pull requests, its unpushed branches) and names the next item, bounded by the host's stop_hook_active flag; the question check rerouting a product question in that state to 'abcd decide' with only website-only steps queued for the morning; and idle time per session in 'abcd peers' so a coordinator sees a stall."

From 27886fba3b1472f620eb27eed7f259515c466702 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 10:19:14 +0100
Subject: [PATCH 03/58] docs: draft the checklist intent's acceptance criteria
 for the planning walk

Fourteen Given-When-Then criteria derived from the press release and the
product thinker's decisions, marked as a draft to walk on Thursday, and the
scope split names the first slice that builds on the draft.

Refs: itd-2610170638184486
Assisted-by: Claude:claude-opus-5-5
---
 ...every-abcd-session-keeps-a-checklist-on.md | 72 ++++++++++++++++++-
 1 file changed, 71 insertions(+), 1 deletion(-)

diff --git a/.abcd/development/intents/drafts/itd-2610170638184486-every-abcd-session-keeps-a-checklist-on.md b/.abcd/development/intents/drafts/itd-2610170638184486-every-abcd-session-keeps-a-checklist-on.md
index d03d8ab38c..30f00df87c 100644
--- a/.abcd/development/intents/drafts/itd-2610170638184486-every-abcd-session-keeps-a-checklist-on.md
+++ b/.abcd/development/intents/drafts/itd-2610170638184486-every-abcd-session-keeps-a-checklist-on.md
@@ -81,7 +81,71 @@ unowned pull request.
 
 ## Acceptance Criteria
 
-> _Required (the itd-1 discipline): add at least one Given-When-Then bullet describing the verifiable bar for "shipped" before this draft can be planned._
+_Draft for the product thinker to walk in the planning interview: derived by
+the agent on 2026-10-18 from the press release and the decisions below, none
+of it yet confirmed. The away mode, the stop check and the question reroute
+are criteria of itd-2610180912189125, the slice that builds on this draft,
+and are not repeated here. The last three move with the phone and the shared
+options if the split proposed for Thursday is confirmed._
+
+- **Given** Alice, the product thinker, has said the sessions work on until
+  09:00, **when** a session writes its checklist, **then** the file in its
+  working copy's local tier holds the design decisions signed off, whether
+  the technical facilitator is set to auto, the kinds of choice still raised
+  with a person, each item waiting and on whom, its trigger promises, and the
+  work it owns, read from its reservations, its pull requests and its
+  branches.
+- **Given** a session with a checklist, **when** it starts or its context is
+  compacted, **then** the last complete checklist is added to its context by
+  the session-start hook, the compact source included.
+- **Given** a session killed while writing its checklist, or a reboot,
+  **when** the next session starts in that working copy, **then** it reads and
+  is given the last complete checklist, never a truncated or empty one, and an
+  unreadable file falls back to the last good copy and says so.
+- **Given** a checklist promise "when pull request 42 merges, add the
+  wrapper", **when** the session next looks (at a start, a wake or a stop
+  check) after 42 has merged, **then** the promise is named as its next item,
+  with no watcher process kept running.
+- **Given** a session whose items all wait on something outside, **when** it
+  records the wait, **then** its checklist names what each item waits for and
+  when it looks again, sooner than half its reservations' lease, and its state
+  reads waiting, never stopped.
+- **Given** Alice is about to leave, **when** the orchestrating session runs
+  the blocker sweep, **then** every session writes into its checklist any
+  undecided design decision, step only a person's hands can do, work it
+  depends on from another session, and credential missing or expiring, the
+  orchestrator puts them to Alice together, and it says the run is likely to
+  stay autonomous only once every session reports none open.
+- **Given** the sweep finds a credential that expires before the window ends,
+  **when** the session records it, **then** the checklist holds its kind, its
+  scope and its expiry, and never its value or anything that retrieves it.
+- **Given** Alice comes back, **when** they read what the sessions left them,
+  **then** they see two short lists across every session: the steps only
+  their own hands can do, and the decisions taken while they were away, each
+  with its grounds and how to reverse it.
+- **Given** Nia, the technical facilitator, is set to auto, **when** a session
+  meets a technical trade-off, **then** it decides and records it; **and
+  given** Nia is set to a person and is present, **when** the trade-off is one
+  of security, performance or compatibility, **then** it is raised with them,
+  and any other is decided and recorded.
+- **Given** a feature whose design trade-offs are listed in its checklist,
+  **when** a session asks whether the human design work for it is done,
+  **then** the answer is yes only when every genuine trade-off has a recorded
+  answer from the product thinker.
+- **Given** a session's state shown to a person, **when** what the session
+  wrote about itself disagrees with what the machine can see (its claim
+  renewal, its process, its last commit), **then** the state shown follows
+  the machine, with the session's own words beside it as a hint.
+- **Given** the private shared option is on, **when** a session writes its
+  checklist, **then** the checklist is shared in full by default, and a person
+  can narrow what is shared.
+- **Given** the public option is on, **when** it publishes a checklist,
+  **then** nothing carrying the id of an advisory not yet published leaves the
+  machine, by the same check announcements apply.
+- **Given** the phone app on the private shared option, **when** a session's
+  work would otherwise stop on a question, **then** the person whose role it
+  belongs to (product questions to Alice, technical trade-offs to Nia) is
+  notified, and can only choose among the options offered or add a note.
 
 ## Scope Split
 
@@ -103,6 +167,12 @@ session's interview on 2026-10-17:
   one line, what it waits on, when it was last seen), published only when it
   changes and only after the session has written its checklist; and each
   autonomous session's own credential.
+- **The first slice (itd-2610180912189125, which builds on this draft):** the
+  away mode held by abcd and repeated at start, compaction and prompt, the
+  stop check, and the question reroute, carved out on 2026-10-18 as the fix
+  for iss-2610170619247185 so the security and bug-fix release waits on it
+  alone (dcn-2610180913379049, dcn-2610180913388445). This draft keeps the
+  rest and reuses the slice's away record and hook path.
 
 ## Decisions
 

From 82b928305b7948659fa692531f2e747584921155 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 10:19:45 +0100
Subject: [PATCH 04/58] docs: grade the checklist draft's decomposition as a
 proposed split

Refs: itd-2610170638184486
Refs: itd-2610180912189125
Assisted-by: Claude:claude-opus-5-5
---
 .../2026-08-15-decomposition-calibration.md   | 42 +++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/.abcd/development/research/notes/2026-08-15-decomposition-calibration.md b/.abcd/development/research/notes/2026-08-15-decomposition-calibration.md
index ce45395600..4a3b5b4206 100644
--- a/.abcd/development/research/notes/2026-08-15-decomposition-calibration.md
+++ b/.abcd/development/research/notes/2026-08-15-decomposition-calibration.md
@@ -2494,3 +2494,45 @@ After filing, two adversarial reviews (design and record discipline, each an Opu
 - **The trust-rule row got no brief invariant, on purpose**: the ADR binds matrix runs only, so it is not a system-wide boundary; the ADR's consequences say so.
 
 The SOTA survey was filed as research/notes/2026-10-16-model-matrix-sota.md, and itd-166 was widened to the asked and served sides it was routed. The routing survived as a five-record split; its plumbing row was the part the initial routing got wrong.
+
+## 2026-10-18: every session keeps a checklist on disk (facilitator-on-delegation, routing not yet put to the product thinker)
+
+| part | type | home |
+|---|---|---|
+| the away mode with an owner and an end time, repeated at every start, compaction and prompt; the stop check that refuses to end a turn with owed work while the person is away; the question reroute and the queue of steps for the person's hands | capability | intent itd-2610180912189125 (planned, spc-2610180914469489), the first slice, which builds on the draft |
+| the per-session checklist on disk and its re-injection; waits per item; trigger promises; timed wakes; the states working, waiting and stopped | capability | itd-2610170638184486 (draft) |
+| the pre-run blocker sweep, asked by message | capability | the same draft, by the product thinker's choice |
+| the two lists for the person's return across sessions | capability | the same draft; the slice ships a per-repository form |
+| the technical facilitator set to auto or to a person, and whether a feature's design work is done | capability | the same draft, reading the existing `facilitator.mode` of itd-2610150602547271; no second toggle |
+| the private shared option, the public option and the phone | capability | proposed as its own intent in the bundle; split not filed |
+| the checklist records a credential's kind, scope and expiry, never its value or anything that retrieves it | trust rule | proposed ADR and brief invariant clause at planning; not filed |
+| a public upload passes the embargo check | cited | brief invariant 22; no new rule |
+| the stop check's one forge listing per check | rule clause | brief invariant 7, amended by the slice's step 6 |
+| a wait holds one item, never the session, and a declared dependency holds only the landing | stance | proposed principle; not filed |
+| a state shown to a person follows what the machine sees, and the agent's own words are a hint | stance | the coordination intent's decision 6 and the principle `enforcement-claims-are-facts`, cited; no new principle |
+| the checklist's JSON format and its crash-safe write | plumbing | the brief's internals, through `internal/fsutil`'s atomic writer |
+| idle time per session for a coordinator; each autonomous session's own credential | capability | the coordination intent (headless agents coordinate through the shared remote), not this draft |
+
+Verdict: SPLIT, proposed. The routing is the agent's and has not been put to
+the product thinker; it is graded as unconfirmed until the planning interview
+on 2026-10-23. Only the first slice was filed, on the orchestrating session's
+instruction, so the security and bug-fix release can wait on it alone
+(dcn-2610180913379049, dcn-2610180913388445). The other proposed records (the
+shared-options and phone intent, the credential ADR, the waiting principle)
+are described in the facilitator's note for Thursday and filed only once the
+routing is confirmed.
+
+Typed links: itd-2610180912189125 builds on the draft and is the remedy home
+of iss-2610170619247185 with it; the coordination intent is the bundle
+sibling, kept apart by the draft's scope split. Advisory reversal flags: none.
+Two refinements of the issue's remedy wording are recorded rather than
+flagged: the away record is held per repository on the machine rather than
+per checkout (dcn-2610180913399499), and a coordinator's view of idle time
+comes through the coordination intent's central view rather than `abcd
+peers`.
+
+The initial routing moved once before filing. The draft first held the stop
+check and the away mode inside the checklist itself; carving them into a
+separate intent followed from the release cut waiting on them, and from
+planning the draft before its criteria are walked being the worse of the two
+routes.

From d04bc92fc6c5c9562576a53bc6d36357eea1d2f1 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 10:43:34 +0100
Subject: [PATCH 05/58] docs: revise the overnight-stall plan after its first
 review

The plan review of 2026-10-18 (an Opus and Sonnet pair) returned fix the
plan first. Every blocker, major and moderate is applied as a plan edit:
"own" work without a window, read from the reflog, a run's lanes and
this copy's reservations; a clearing rule for stacked branches; a stop
allowed while away only with a wake whose next fire time precedes the
earliest renewal due; questions routed by the act, with the acts only
the person may approve queued; the away record changed under a lock and
capped at seven days; present mode reading disk only; a StopFailure
entry. The return report, the status line and the bare mode print move
back to the checklist draft, and the slice is re-estimated at five days.
Eight new decisions record the refinements; the spec carries a review
round note listing each finding's disposition.

Refs: iss-2610170619247185
Refs: itd-2610180912189125
Refs: itd-2610170638184486
Assisted-by: Claude:claude-opus-5-5
---
 ...every-abcd-session-keeps-a-checklist-on.md |  16 +
 ...125-a-session-told-to-work-on-while-its.md | 175 ++++---
 .../2026-08-15-decomposition-calibration.md   |   4 +-
 ...489-a-session-told-to-work-on-while-its.md | 473 +++++++++++++-----
 ...8-a-session-s-own-branches-are-named-by.md |   6 +
 ...-a-stacked-branch-is-owed-only-while-it.md |   6 +
 ...0-while-the-person-is-away-a-session-is.md |   6 +
 ...-wake-qualifies-only-when-its-next-fire.md |   6 +
 ...n-api-error-stop-is-recorded-and-a-turn.md |   6 +
 ...-while-the-person-is-away-a-question-is.md |   6 +
 ...the-away-record-is-changed-only-under-a.md |   6 +
 ...9-the-person-s-return-report-the-status.md |   6 +
 12 files changed, 512 insertions(+), 204 deletions(-)
 create mode 100644 .abcd/work/decisions/dcn-2610180936568358-a-session-s-own-branches-are-named-by.md
 create mode 100644 .abcd/work/decisions/dcn-2610180936571036-a-stacked-branch-is-owed-only-while-it.md
 create mode 100644 .abcd/work/decisions/dcn-2610180936577720-while-the-person-is-away-a-session-is.md
 create mode 100644 .abcd/work/decisions/dcn-2610180936579498-a-wake-qualifies-only-when-its-next-fire.md
 create mode 100644 .abcd/work/decisions/dcn-2610180937175629-an-api-error-stop-is-recorded-and-a-turn.md
 create mode 100644 .abcd/work/decisions/dcn-2610180937177502-while-the-person-is-away-a-question-is.md
 create mode 100644 .abcd/work/decisions/dcn-2610180937181736-the-away-record-is-changed-only-under-a.md
 create mode 100644 .abcd/work/decisions/dcn-2610180937181929-the-person-s-return-report-the-status.md

diff --git a/.abcd/development/intents/drafts/itd-2610170638184486-every-abcd-session-keeps-a-checklist-on.md b/.abcd/development/intents/drafts/itd-2610170638184486-every-abcd-session-keeps-a-checklist-on.md
index 30f00df87c..5fc36efb9c 100644
--- a/.abcd/development/intents/drafts/itd-2610170638184486-every-abcd-session-keeps-a-checklist-on.md
+++ b/.abcd/development/intents/drafts/itd-2610170638184486-every-abcd-session-keeps-a-checklist-on.md
@@ -173,6 +173,22 @@ session's interview on 2026-10-17:
   for iss-2610170619247185 so the security and bug-fix release waits on it
   alone (dcn-2610180913379049, dcn-2610180913388445). This draft keeps the
   rest and reuses the slice's away record and hook path.
+- **Moved back from the first slice by its review round 1 (2026-10-18,
+  dcn-2610180937181929), named remaining work of this draft:**
+  - the report shown once on the first prompt after the away mode ends: the
+    queued steps, the decisions recorded in the window and the stops the
+    host forced, with who ended the mode and from which working copy;
+  - the window's decisions gathered from every working copy, by `abcd
+    decide` appending each decision's id to the away record under its lock
+    while the window is open, since sibling worktrees hold their own
+    decision records;
+  - the status line naming the away mode and its end;
+  - a bare `abcd mode` printing the away record, the queue and the owed
+    items with no plugin host;
+  - the brief's surface text for these.
+
+  The slice keeps `abcd mode back` printing the queue and the recorded stops,
+  so nothing queued goes unread meanwhile.
 
 ## Decisions
 
diff --git a/.abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md b/.abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md
index 7fd5aed93a..df4ea78c62 100644
--- a/.abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md
+++ b/.abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md
@@ -17,7 +17,7 @@ related_issues: [iss-2610170619247185]
 
 ## Press Release
 
-> A session told to work on while its person is away keeps working until they are back. Alice, a solo founder who is also the product thinker, leaves for the evening and says the sessions should work on until 09:00. abcd records that once for the repository, with who set it and when it ends, and repeats it to every session at each start, after each compaction and with every prompt, so no summary and no relay between sessions can drop it. A session that tries to end its turn while it still has work it can do alone (a reservation whose work is not yet handed in, a pull request of its own that has fallen behind or is failing, a branch it has not pushed, a branch stacked on another change that is still open) is handed the next of those items instead. One with nothing left to do may stop only with its next look scheduled. A question it would have put to Alice is decided and recorded instead, and a step only Alice's hands can do is queued for their return. In the morning Alice sees those steps and the decisions taken while they were away, and while they are at the terminal nothing is refused: a stop with work left is only pointed out.
+> A session told to work on while its person is away keeps working until they are back. Alice, a solo founder who is also the product thinker, leaves for the evening and says the sessions should work on until 09:00. abcd records that once for the repository, with who set it and when it ends, and repeats it to every session at each start, after each compaction and with every prompt, so no summary and no relay between sessions can drop it. A session that tries to end its turn while it still has work it can do alone (a reservation whose work is not yet handed in, a pull request of its own that has fallen behind or is failing, a branch it has not pushed, a branch stacked on another change that is still open) is handed the next of those items instead. One with nothing left to do takes the next ready item, and may stop only with its next look scheduled before its reservations need renewing. A question it would have put to Alice is decided and recorded instead, and an act only Alice may approve (an advisory's approval, a publication, a new dependency, a secret, a browser step) is queued for their return. When Alice is back and says so, the mode ends and they see the queued steps and any stop the host forced; from then on nothing is refused, and a stop with work left is only pointed out.
 
 ## Why This Matters
 
@@ -60,40 +60,53 @@ its turn on a question to the person.
   enforced.
 - Sessions on one computer: the away record is held per repository on that <!-- cond: cond-2610180914460950 -->
   machine, so a session on another computer or in the cloud does not see it.
-- The stop check's pull-request reading needs the forge client signed in; when <!-- cond: cond-2610180914462056 -->
-  it cannot read the forge it judges from disk alone and says so.
+- The stop check's pull-request reading, made only while the person is away, <!-- cond: cond-2610180914462056 -->
+  needs the forge client signed in; when it cannot read the forge in time it
+  judges from a recent cached listing or from disk alone, and says so.
 - A session that keeps working through the host: the check refuses a stop, it <!-- cond: cond-2610180914469321 -->
-  cannot start a session that is not running.
+  cannot start a session that is not running. A turn the host ends on an API
+  error, such as a rate limit, fires no Stop hook and cannot be continued: it
+  is recorded, and only a wake the session had already scheduled resumes it.
 
 ## What's In Scope
 
 - **The away mode.** `abcd mode autonomous [--until <time>]` records who set
-  it, when, and when it ends; `abcd mode back` ends it. One record per
-  repository on the machine, shared by every working copy
-  (dcn-2610180913399042, dcn-2610180913399499).
+  it, when, and when it ends, at most seven days on; `abcd mode back` ends it,
+  prints the queue and the recorded stops, and records who ended it. One
+  record per repository on the machine, shared by every working copy, changed
+  only under a lock (dcn-2610180913399042, dcn-2610180913399499,
+  dcn-2610180937181736).
 - **Repeated, never summarised away.** While it holds, the session-start hook
   (every source, compaction included) and the prompt hook (every prompt) add
-  one short block to the session's context (dcn-2610180913406972).
-- **The stop check.** A plugin Stop hook asks `abcd hook stop`, which refuses
-  to end a turn with owed work while the person is away, names the next item,
-  and is bounded so it never spins; while the person is present it only points
-  the work out (dcn-2610180913413137, dcn-2610180913421109).
-- **Owed work**, in exactly these terms: a live reservation whose renewal is
-  due or whose work no open pull request carries yet; an open pull request of
-  the session's own that is behind the default branch or failing its checks; a
-  branch of its own with commits not pushed; and a branch of its own stacked on
-  a change that is still open, whose merge from the default branch, fixes,
-  review and preflight are owed now while only its landing waits
-  (dcn-2610180913416683).
+  one short block to the session's context (dcn-2610180913406972), and the
+  prompt hook shows the person one line naming the away mode
+  (dcn-2610180937181736).
+- **The stop check.** A plugin Stop hook asks `abcd hook stop`. While the
+  person is away a session is only working or waiting: a turn's end with owed
+  work is refused, naming the next item, and a stop is allowed only with a
+  wake that fires before its reservations need renewing; the host's cap of
+  eight continuations is the outer bound, and a stop it forces is recorded.
+  A StopFailure hook records a turn ended by an API error. While the person
+  is present the check reads disk only and points the work out
+  (dcn-2610180913413137, dcn-2610180913421109, dcn-2610180936577720,
+  dcn-2610180936579498, dcn-2610180937175629).
+- **Owed work**, in exactly these terms: a live reservation under this
+  working copy's key whose renewal is due or whose work no open pull request
+  carries yet; an open pull request of the session's own that is behind the
+  default branch or failing its checks; a branch of its own with commits not
+  pushed; and a branch of its own stacked on a change that is still open,
+  while it is behind, failing or has no preflight receipt, since only its
+  landing waits for the base. A branch is the session's own when this copy
+  ever checked it out, a run in this copy cut it as a lane, or a reservation
+  under this copy's key links it (dcn-2610180913416683,
+  dcn-2610180936568358, dcn-2610180936571036).
 - **The question reroute.** While the person is away, the guard refuses every
-  question on the host's question tool: a decision is taken and recorded with
-  `abcd decide`, and a step only the person's hands can do is queued with
-  `abcd mode queue "<step>"` (dcn-2610180913431493).
-- **The person's return.** The queue and the decisions recorded in the window,
-  shown once on the next prompt after the mode ends (dcn-2610180913431985).
-- **Shown and reachable.** The status line names the away mode and its end; a
-  bare `abcd mode` prints the record, the queue and the owed items
-  (dcn-2610180913445272).
+  question on the host's question tool. A question about an act only the
+  person may approve (a per-act approval such as an embargo close's digest,
+  a publication or visibility change, a new dependency, a secret, credential
+  or App, a website or browser step, a destructive act, a spend) is queued
+  with `abcd mode queue "<step>"`; every other question is decided and
+  recorded with `abcd decide` (dcn-2610180913431493, dcn-2610180937177502).
 
 ## What's Out of Scope
 
@@ -102,6 +115,11 @@ its turn on a question to the person.
   published options and the phone.
 - Idle time a coordinator sees across sessions, which comes with the
   coordination intent's central view in `abcd status`.
+- Moved back to itd-2610170638184486 by review round 1
+  (dcn-2610180937181929): the report shown once on the person's return (the
+  queue, the window's decisions gathered across working copies, the recorded
+  stops and who ended the mode), the status line naming the away mode, and
+  the bare `abcd mode` print of the record, the queue and the owed items.
 - Starting or waking a session that is not running.
 - Each autonomous session's own forge credential, owned by the coordination
   intent.
@@ -115,49 +133,64 @@ its turn on a question to the person.
 - **Given** the away mode holds, **when** a session's context is compacted,
   **then** the session-start hook fired with source `compact` adds the away
   block again, and so does the prompt hook on the next prompt.
-- **Given** the away mode holds and the session's own pull request is behind
-  the default branch, **when** the session tries to end its turn, **then** the
+- **Given** the away mode holds and the session's own pull request, opened
+  and checked out in its working copy before the mode was set, is behind the
+  default branch, **when** the session tries to end its turn, **then** the
   stop is blocked and the reason names that pull request as the next item and
   says how many items remain.
-- **Given** the away mode holds and a branch of the session's own is stacked
-  on a pull request that is still open, **when** it tries to end its turn,
-  **then** the stop is blocked and the reason asks for the merge from the
-  default branch, the fixes, the review and the preflight now, and says only
-  the landing waits for the base.
+- **Given** the away mode holds and a lane branch that a run in the
+  session's working copy cut in its own worktree is stacked on a pull request
+  that is still open and is behind the default branch, **when** the session
+  tries to end its turn, **then** the stop is blocked and the reason asks for
+  the merge from the default branch, the fixes, the review and the preflight
+  now, and says only the landing waits for the base; **and when** the branch
+  is up to date, green and has a preflight receipt, **then** it is waiting on
+  its base and is not owed.
 - **Given** the away mode holds and the session holds a live reservation whose
   work no open pull request carries, or a branch with unpushed commits,
   **when** it tries to end its turn, **then** the stop is blocked naming that
   item.
-- **Given** the stop was blocked once and the host reports the session is
-  already continuing because of a stop hook, **when** it tries to stop again
-  with the owed set unchanged, **then** the stop is allowed and recorded as
-  stopped with work owed, and that record appears on Alice's return.
+- **Given** the stop was blocked and the session replied "awaiting the
+  person" with no tool call and no wake, **when** it tries to stop again with
+  the owed set unchanged, **then** the stop is blocked again; **and when** the
+  host's cap of continuations ends the turn, **then** it is recorded as
+  stopped with work owed, shown when Alice runs `abcd mode back`.
 - **Given** the away mode holds and nothing is owed, **when** the session tries
-  to stop with no scheduled wake and no background task, **then** the stop is
-  blocked once asking it to schedule its next look in under an hour; **and
-  when** it stops with a wake scheduled, **then** the stop is allowed and the
-  session is waiting.
+  to stop with no qualifying wake, **then** the stop is blocked, telling it to
+  take the next ready item first and only then schedule its next look before
+  its earliest reservation renewal is due; a wake set for 09:00 the next
+  morning, or a background shell task, does not qualify; **and when** it stops
+  with a wake that fires in time, **then** the stop is allowed and the
+  session is waiting, with that time kept as its next look.
 - **Given** no away mode holds (Alice is at the terminal), **when** a session
-  with owed work ends its turn, **then** the stop is allowed and one line
-  shown to Alice names the owed work.
-- **Given** the away mode holds, **when** the agent puts a question to Alice on
-  the host's question tool, **then** the guard refuses it, telling the agent to
-  decide and record it with `abcd decide` and carry on, or, for a step only
-  Alice's hands can do, to queue it with `abcd mode queue`.
-- **Given** a window in which two decisions were recorded and one step was
-  queued, **when** Alice runs `abcd mode back` or the window's time passes and
-  they send the next prompt, **then** they see the queued step and both
-  decisions with their text, once.
-- **Given** the away mode holds, **when** Alice looks at the status line,
-  **then** it names the away mode and its end; **and when** Nia, the technical
-  facilitator, runs a bare `abcd mode` with no plugin host, **then** it prints
-  the record, the queue and the owed items.
-- **Given** `--until` names a time already past, or the repository has no local
-  tier, **when** `abcd mode autonomous` runs, **then** it refuses, names the
-  reason, and writes nothing.
-- **Given** the forge cannot be read during a stop check, **when** the session
-  tries to stop while away, **then** the check judges from the disk kinds alone
-  and the reason says the pull requests were not read.
+  with owed work ends its turn, **then** the stop is allowed, one line shown
+  to Alice names the owed work read from disk, and the forge is not called.
+- **Given** the away mode holds, **when** the agent puts a product question to
+  Alice on the host's question tool, under any chip, **then** the guard
+  refuses it, telling the agent to decide and record it with `abcd decide`
+  and carry on; **and when** it asks Alice to approve closing a security
+  advisory, **then** the same refusal tells it that an act only Alice may
+  approve is queued with `abcd mode queue`, and it never supplies the
+  approval itself.
+- **Given** the away mode holds, **when** Alice sends any prompt, **then** one
+  line shown to Alice names the away mode, its end, who set it and how to end
+  it.
+- **Given** a window in which one step was queued and the host forced one
+  stop, **when** Alice runs `abcd mode back`, **then** they see the queued
+  step and the stop, and the mode ends recording who ended it.
+- **Given** a stop check reading the forge while Alice runs `abcd mode back`
+  in another session, **when** the check finishes, **then** the mode stays
+  ended.
+- **Given** the away mode holds, **when** a turn ends on a rate limit, **then**
+  the stop and its error type are recorded and shown when Alice runs `abcd
+  mode back`.
+- **Given** `--until` names a time already past or more than seven days
+  ahead, or the repository has no local tier, **when** `abcd mode autonomous`
+  runs, **then** it refuses, names the reason, and writes nothing.
+- **Given** the forge cannot be read within ten seconds during a stop check,
+  **when** the session tries to stop while away, **then** the check judges
+  from a listing cached in the last half lease, naming its age, or from the
+  disk kinds alone, saying the pull requests were not read.
 - **Given** the slice is built, **when** a live Claude Code session with the
   plugin from the branch runs an away window with seeded owed work, a
   compaction and an attempted stop, **then** a captured transcript shows the
@@ -217,7 +250,23 @@ ruling or the ground it rests on; the full text is in the decision record.
 9. **No question waits while away** (dcn-2610180913431493).
 10. **Two lists on return, derived** (dcn-2610180913431985).
 11. **Host-agnostic core, reachable without a host**
-    (dcn-2610180913445272).
+    (dcn-2610180913445272); its status-line and bare-print halves moved by
+    decision 19.
+
+Review round 1 of 2026-10-18 refined them:
+
+12. **"Own" without a window, this copy's reservations only**
+    (dcn-2610180936568358).
+13. **Stacked branches cleared; the forge read only while away**
+    (dcn-2610180936571036).
+14. **Away means working or waiting** (dcn-2610180936577720).
+15. **A wake qualifies by its next fire time** (dcn-2610180936579498).
+16. **API-error stops recorded; prose questions blocked once**
+    (dcn-2610180937175629).
+17. **Questions routed by the act** (dcn-2610180937177502).
+18. **The record's lock, checks and seven-day cap** (dcn-2610180937181736).
+19. **The return report, status line and bare print move to the draft**
+    (dcn-2610180937181929).
 
 ## Audit Notes
 
diff --git a/.abcd/development/research/notes/2026-08-15-decomposition-calibration.md b/.abcd/development/research/notes/2026-08-15-decomposition-calibration.md
index 4a3b5b4206..e7914aa116 100644
--- a/.abcd/development/research/notes/2026-08-15-decomposition-calibration.md
+++ b/.abcd/development/research/notes/2026-08-15-decomposition-calibration.md
@@ -2502,12 +2502,12 @@ The SOTA survey was filed as research/notes/2026-10-16-model-matrix-sota.md, and
 | the away mode with an owner and an end time, repeated at every start, compaction and prompt; the stop check that refuses to end a turn with owed work while the person is away; the question reroute and the queue of steps for the person's hands | capability | intent itd-2610180912189125 (planned, spc-2610180914469489), the first slice, which builds on the draft |
 | the per-session checklist on disk and its re-injection; waits per item; trigger promises; timed wakes; the states working, waiting and stopped | capability | itd-2610170638184486 (draft) |
 | the pre-run blocker sweep, asked by message | capability | the same draft, by the product thinker's choice |
-| the two lists for the person's return across sessions | capability | the same draft; the slice ships a per-repository form |
+| the two lists for the person's return across sessions | capability | the same draft; the slice's per-repository form moved back here in its review round 1 (dcn-2610180937181929), leaving it only `abcd mode back` printing the queue |
 | the technical facilitator set to auto or to a person, and whether a feature's design work is done | capability | the same draft, reading the existing `facilitator.mode` of itd-2610150602547271; no second toggle |
 | the private shared option, the public option and the phone | capability | proposed as its own intent in the bundle; split not filed |
 | the checklist records a credential's kind, scope and expiry, never its value or anything that retrieves it | trust rule | proposed ADR and brief invariant clause at planning; not filed |
 | a public upload passes the embargo check | cited | brief invariant 22; no new rule |
-| the stop check's one forge listing per check | rule clause | brief invariant 7, amended by the slice's step 6 |
+| the stop check's one forge listing per check, made only while the person is away | rule clause | brief invariant 7, amended by the slice's step 3 (step 6 before its review round 1) |
 | a wait holds one item, never the session, and a declared dependency holds only the landing | stance | proposed principle; not filed |
 | a state shown to a person follows what the machine sees, and the agent's own words are a hint | stance | the coordination intent's decision 6 and the principle `enforcement-claims-are-facts`, cited; no new principle |
 | the checklist's JSON format and its crash-safe write | plumbing | the brief's internals, through `internal/fsutil`'s atomic writer |
diff --git a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
index 1260e438da..4ccdc4349e 100644
--- a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
+++ b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
@@ -14,22 +14,31 @@ Delivers itd-2610180912189125, the first slice of the checklist draft
 
 - **The away mode.** `abcd mode autonomous [--until <time>]`, `abcd mode back`
   and `abcd mode queue "<step>"` keep one away record per repository on the
-  machine. The session-start hook (every source, `compact` included) and the
-  prompt hook repeat it on every prompt while it holds.
+  machine, changed only under a lock. The session-start hook (every source,
+  `compact` included) and the prompt hook repeat it to the agent while it
+  holds, and the prompt hook shows the person one line saying so.
 - **The stop check.** A plugin Stop hook runs `abcd hook stop`. While the
-  record holds, it blocks a turn's end while owed work exists and names the
-  next item. It is bounded by the host's `stop_hook_active` flag and by an
-  unchanged owed set. While the person is present, it only points the work
-  out.
+  record holds, a session is only working or waiting: a turn's end is blocked
+  while owed work exists, naming the next item, and is allowed only with a
+  wake that fires before the session's reservations need renewing. The host's
+  cap of eight consecutive continuations is the outer bound. A StopFailure
+  hook records a turn the host ends on an API error. While the person is
+  present the check reads disk only and points the work out.
 - **The question reroute.** While the record holds, the guard refuses every
-  question on the host's question tool. A decision goes to `abcd decide`, and
-  a step only the person's hands can do goes to the queue. On their return,
-  the queue and the window's decisions are shown once.
+  question on the host's question tool. An act only the person may approve
+  goes to the queue; every other question is decided and recorded with `abcd
+  decide`. `abcd mode back` prints the queue and the recorded stops.
 
-Every behaviour is built test-first: each step's tests are written and watched
-failing before its code. The last step is a live Claude Code session capture,
-because the hook mechanics are the host's and a unit test cannot prove them
-(principle evaluate-at-the-user-surface).
+Every behaviour is built test-first: each step names its tests, written and
+watched failing before its code. The last step is a live Claude Code session
+capture, because the hook mechanics are the host's and a unit test cannot
+prove them (principle evaluate-at-the-user-surface).
+
+Moved out by review round 1 (dcn-2610180937181929), back to the checklist
+draft as named remaining work: the report shown once on the person's return
+(the queue, the window's decisions gathered across working copies, the
+recorded stops and who ended the mode), the status line, the bare `abcd mode`
+print, and the brief's surface text for them.
 
 ## Design
 
@@ -40,15 +49,19 @@ docs.claude.com hooks page redirects there):
 
 - **Stop.** The hook "runs when the main Claude Code agent has finished
   responding" and not on a user interrupt. Its input carries
-  `stop_hook_active`, which is "true when Claude Code is already continuing as
-  a result of a stop hook". The page says to check it "to avoid blocking on a
-  condition that will never resolve". The input also carries
-  `last_assistant_message`, `background_tasks` and `session_crons`; the last
-  holds the session's scheduled wakes from CronCreate, ScheduleWakeup and
-  `/loop`. Output `{"decision": "block", "reason": …}` prevents the stop, and
-  the reason "tells Claude why it should continue". Claude Code caps this at
-  eight consecutive continuations, and the count resets each time Claude calls
-  a tool.
+  `stop_hook_active`, "true when Claude Code is already continuing as a result
+  of a stop hook", and `last_assistant_message`, the text of Claude's final
+  response. It also carries `background_tasks` (each with `id`, `type` such as
+  `shell`, `subagent`, `monitor` or `workflow`, and `status`) and
+  `session_crons` (each with `id`, `schedule` as a cron expression such as
+  `0 9 * * 1-5`, `recurring` and `prompt`); both are present only when the
+  host's task registry is reachable. Output `{"decision": "block", "reason":
+  …}` prevents the stop. Claude Code caps this at eight consecutive
+  continuations, overriding the next block; the count resets each time Claude
+  calls a tool, and `CLAUDE_CODE_STOP_HOOK_BLOCK_CAP` raises it.
+- **StopFailure.** Fires instead of Stop "when the turn ends due to an API
+  error"; its matcher is the error type (`rate_limit`, `overloaded`,
+  `server_error` and others). It cannot block, and its output is ignored.
 - **SessionStart.** The matcher values include `compact` ("auto or manual
   compaction"). Plain stdout, or `hookSpecificOutput.additionalContext`, is
   added to Claude's context.
@@ -58,169 +71,351 @@ docs.claude.com hooks page redirects there):
   user".
 
 abcd's hook manifest already registers SessionStart with no matcher, so
-compaction already runs `abcd hook session-start`. It has no Stop entry.
+compaction already runs `abcd hook session-start`. It has no Stop or
+StopFailure entry, and its PreToolUse entry already matches the host's
+question tool.
 
 ### The away record
 
 - **Where it lives.** One JSON file per repository on the machine, in abcd's
   machine store under the repository's root commit, beside the worktree store
-  (dcn-2610180913399499). It is written through fsutil's atomic writer.
+  (dcn-2610180913399499), with a lock file beside it. It is written through
+  fsutil's atomic writer.
 - **What it holds.** Who set it: the holder name reservations cache, without
-  a network read, falling back to git's `user.name`. It also holds the start
-  and the end (none when open-ended), the queue of steps for the person, and
-  the stops recorded with work owed.
+  a network read, falling back to git's `user.name`. It also holds the start,
+  the end, the queue of steps for the person, the stops recorded (with work
+  owed, with no next look, or on an API error with its type), and, once ended
+  by word, who ended it and from which working copy.
+- **The lock** (dcn-2610180937181736). Every read-modify-write (`mode
+  autonomous`, `mode back`, `mode queue`, a recorded stop) holds
+  `fsutil.WithFileLock` on the lock file and re-reads the record inside it.
+  The stop check reads the record and lists the forge outside the lock, then
+  takes it, re-reads, and records its stop only if the record still holds, so
+  a check that began while away never writes away back after `abcd mode
+  back`. A lock not had within two seconds: the verbs refuse naming it, and
+  the hooks allow the stop and say so on stderr.
+- **Ownership and permissions.** The record and the lock file are used only
+  when each is a regular file this account owns that no one else can write,
+  within 64 KiB: the checks `rules.json` already gets. A record that fails
+  them, or does not parse, reads as not away (failing open, with a stderr
+  line), and a verb asked to change it refuses naming the file.
 - **When it ends.** It holds while now is before its end. It ends with `abcd
   mode back`, or when its time passes. A human prompt never ends it
   (dcn-2610180913399042).
+- **The stale-record cap.** An open-ended record ends seven days after it was
+  set, and `--until` may name no later time; a later one is refused with
+  nothing written. A run of several days, like the standing run of 2026-10-15
+  through 2026-10-17, fits; a forgotten record lapses.
+- **Seen by the person.** While the record holds, the prompt hook adds a
+  one-line `systemMessage` on every prompt: away until when, set by whom, and
+  that saying they are back ends it. The away block tells the agent to run
+  `abcd mode back` only on the person's word in its session.
+- **Ending it.** `abcd mode back` prints the queue and the recorded stops,
+  records who ended the mode and from which working copy, and ends the
+  record; on a record whose time has passed it prints the same and closes it.
 - **The badge.** The three-word badge in `internal/core/mode` is untouched.
   While the record holds, `abcd mode product-thinker` and `abcd mode
   facilitator` are refused, naming `abcd decide`.
 
 ### Owed work
 
-Owed work is four kinds (dcn-2610180913416683):
+Owed work is four kinds (dcn-2610180913416683, refined by
+dcn-2610180936568358 and dcn-2610180936571036):
 
-1. a live reservation whose renewal is due or whose work no open pull
-   request carries yet;
+1. a live reservation under this copy's key whose renewal is due, or whose
+   work no open pull request carries yet;
 2. an open pull request of the session's own that is behind the default
    branch or failing its checks;
 3. a branch of its own with commits not pushed;
-4. a branch of its own stacked on a change that is still open. Its merge from
-   the default branch, fixes, review and preflight are owed now, and only its
-   landing waits for the base.
-
-- **Which branches are the session's own.** A branch is the session's own when
-  the working copy's own HEAD reflog has had it checked out since the window
-  began. Sibling working copies share the branch namespace, so this keeps one
-  copy from being held for another's branch.
-- **What is read from disk.** Reservations are read as last fetched
-  (`claim.LastFetched`). "Behind" is measured against the last-fetched default
-  branch.
-- **What is read from the forge.** One `gh pr list` of the person's open pull
-  requests per stop check gives the head and base branch, the merge state and
-  the check rollup. Brief invariant 7 gains this as the away mode's documented
-  meaning, as the drain's listing is. If the listing fails, the check uses the
-  disk kinds only and says the pull requests were not read.
+4. a branch of its own stacked on a change that is still open, while it
+   needs work (the clearing rule below).
+
+- **What "own" means.** A branch other than the default branch is the
+  session's own when any of these holds, with no window bound:
+  - this working copy's HEAD reflog has checked it out at any time;
+  - it is the branch of a lane in a run state this copy's local tier holds
+    (`.abcd/.work.local/run/<run-id>/state.json`, whose lanes `build` and
+    `drain` cut with `git worktree add`, so they never reach this copy's
+    reflog);
+  - it is the head branch of an open pull request linked to a reservation
+    under this copy's key.
+
+  A sibling copy's branch is none of these, so it never holds this session.
+- **The reservation filter and link.** A reservation counts only when its
+  copy key is this copy's (the view's `Copy == CopyThis`). A pull request
+  carries a reservation's work when the record id appears in its head
+  branch's name or on a `Refs:`, `Resolves:` or `Delivers:` line of its body.
+  A renewal is due halfway between the reservation's latest claim or renewal
+  and its expiry.
+- **Finding a stacked branch.** An own branch is stacked when its open pull
+  request's base is not the default branch, or, with no pull request, when
+  the nearest other own branch whose tip is an ancestor of its tip is not
+  contained in the last-fetched default branch.
+- **The clearing rule for a stacked branch.** One whose base is still open is
+  owed only while it is behind its base's tip or behind the last-fetched
+  default branch, its checks are failing, or no preflight receipt names its
+  head in any worktree (`landing.Receipt`). Otherwise it is waiting on its
+  base, which is not owed: only its landing waits.
+- **Unpushed.** An own branch with commits not on its upstream, or, with no
+  upstream configured, not in any remote-tracking ref. A branch whose
+  upstream is gone (merged and deleted on the remote, a squash merge
+  included) never counts.
+- **What is read, and when (invariant 7).** While the person is present the
+  check reads disk only: renewals due (reservations as last fetched,
+  `claim.LastFetched`) and unpushed own branches. It never calls the forge,
+  so no turn's end touches the network. While away it adds at most one `gh pr
+  list` of the person's open pull requests (head and base branch, body, merge
+  state, check rollup) under a ten-second deadline, cached in the local tier:
+  a listing younger than ten minutes is reused, not repeated, so eight blocks
+  in a row cost one call; on a failure or timeout a cached listing younger
+  than half the default lease is used with its age named, else the disk
+  kinds alone with the pull requests named as not read. "Behind" is measured
+  against the last-fetched default branch. Brief invariant 7 gains this
+  listing as the away mode's documented meaning, as the drain's listing is.
 - **Order.** The next item is the first of: a renewal due, a failing pull
   request, a behind one, a stacked branch, an unpushed branch, unhanded work.
 
 ### The stop verdict
 
-`autonomy.Judge(record, owed, payload) Verdict` is pure:
+`autonomy.Judge(record, owed, payload, session, now) Verdict` is pure.
+
+**The allowed states while away** (dcn-2610180936577720): working (the stop
+is blocked) or waiting (the stop is allowed with a qualifying wake, whose
+next fire time is the next look). abcd never allows a stop with work owed
+and no qualifying wake; "stopped" happens only when the host's cap overrides
+a block, and is then recorded. Stopped is allowed, and flagged, only while
+the person is present.
+
+**The qualifying wake** (dcn-2610180936579498). A `session_crons` entry
+qualifies when the next time its schedule matches after now, read in the
+machine's local time, is no later than the deadline: the earliest renewal due
+among the live reservations under this copy's key, minus `lease.Skew`; or,
+with none held, now plus half of `lease.Default`. The next fire time comes
+from a five-field cron parser of abcd's own (minute, hour, day of month,
+month, day of week; lists, ranges, steps and `*`; when both day fields are
+restricted, either matches, as cron does), which steps minute by minute from
+now to the deadline, at most a day's minutes since `lease.Max` is a day. An
+expression it cannot parse never qualifies. A background task never counts
+on its own while away. No new dependency.
 
-| state | owed | `stop_hook_active` | verdict |
-|---|---|---|---|
-| away | some, changed or first time | any | block: next item and count (working) |
-| away | some, unchanged since this session's last block | true | allow; record "stopped with work owed" |
-| away | none, a wake or background task present | any | allow (waiting) |
-| away | none, no wake | false | block once: schedule the next look within half the lease |
-| away | none, no wake | true | allow; record it |
-| present | some | any | allow; `systemMessage` names the work (stopped, flagged) |
-| present | none | any | allow, silent |
+**The session's state.** One file per session id in the local tier
+(`.abcd/.work.local/autonomy/sessions/<session-id>.json`; an id outside
+`[A-Za-z0-9_-]{1,128}` is refused and the stop allowed with a stderr line)
+holds the state, the next look, the owed-set fingerprint, the last question
+message's hash, and the count of consecutive blocks.
 
-- **The fingerprint.** "Unchanged" compares a hash of the owed set with the
-  one kept for the session id in the local tier.
+While away, the rows are read in order and the first that matches decides:
+
+| # | condition | verdict |
+|---|---|---|
+| 1 | `last_assistant_message` ends on a line ending in `?`, not yet blocked for this message | block with the reroute's reason (working) |
+| 2 | owed, set changed or first block this session | block: next item and count (working) |
+| 3 | owed, set unchanged, qualifying wake | allow (waiting; next look kept) |
+| 4 | owed, set unchanged, no qualifying wake | block: next item, and if it cannot move, take another or schedule a look before the deadline (working) |
+| 5 | none owed, qualifying wake | allow (waiting; next look kept) |
+| 6 | none owed, no qualifying wake | block: take the next ready item first (reserve it), and only if none can be taken alone, schedule a look before the deadline (working) |
+
+- **`stop_hook_active`** decides no row, so both values are covered by every
+  row, the old missing row (owed, unchanged, `false`) included. It drives the
+  count: a block with it `false` sets the count to one, and with it `true`
+  adds one; a changed fingerprint also resets it. The block whose count
+  passes the cap (eight, or `CLAUDE_CODE_STOP_HOOK_BLOCK_CAP` when set)
+  records "stopped with work owed" (rows 2 and 4) or "stopped with no next
+  look" (row 6) in the away record, since the host will override it. The
+  host's count resets on a tool call abcd cannot see, so abcd's count errs
+  toward recording a stop that did not happen, never toward missing one.
+- **Present.** With owed work (the disk kinds only), allow with a
+  `systemMessage` naming the work (stopped, flagged); with none, allow
+  silently. No forge call.
 - **The front door.** `abcd hook stop` maps the payload and writes the host's
-  JSON. A malformed payload or an unreadable record allows the stop and says
-  so on stderr, following the guard's fail-open-loud contract. A stop is never
-  blocked on abcd's own fault.
+  JSON. A malformed payload, an unreadable record or a lock not had allows
+  the stop and says so on stderr, following the guard's fail-open-loud
+  contract. A stop is never blocked on abcd's own fault.
+- **StopFailure** (dcn-2610180937175629). `abcd hook stop-failure`, while
+  the record holds, records "stopped on an API error" with the error type,
+  under the lock. It cannot continue the session; the scope conditions name
+  the gap.
 
 ### The question reroute
 
 `questionGate` (`internal/surface/cli/guard_question.go`) reads the away
 record first. While it holds, it denies every question-tool call, abcd's or
-another tool's. The deny reason depends on the chip:
-
-- a Product or Tech chip, or no chip, gets the reason to decide and record it
-  with `abcd decide`, with grounds and how to reverse it;
-- a Setup chip gets the reason to queue the step with `abcd mode queue`.
-
-No mode is set and no question is marked open (dcn-2610180913431493).
+another tool's, with one reason whatever the chip (dcn-2610180937177502).
+The classification is by the act asked about, which the reason lists, so the
+agent routes it:
 
-### Shown
+- **Queued for the person** with `abcd mode queue "<step>"`, carrying on with
+  other work meanwhile, is a question about an act only the person may
+  approve:
+  - an approval the repository binds to the person per act: an embargo
+    close's `--approve <digest>`, which `commands/embargo.md` says is passed
+    only after the person, in this session, has read the text and said yes,
+    and never supplied on the agent's own; a release sign-off;
+  - publishing anything, or changing a repository's visibility;
+  - adding a dependency;
+  - a secret, a credential or an App;
+  - a step only a website or a browser can do;
+  - a destructive act: deleting what the session did not create, overwriting
+    uncommitted work, a force push, discarding a peer's work;
+  - anything that spends money.
+- **Decided and recorded** with `abcd decide`, with its grounds and how to
+  reverse it, is every other question.
 
-- **On the person's return.** The prompt hook's first run after the record
-  ends prints the queue, the window's decisions and the recorded stops once,
-  then marks the record shown. The window's decisions are the records whose
-  ids fall between its start and end (dcn-2610180913431985).
-- **On the status line.** It reads the record and names the away mode and its
-  end.
-- **From the command line.** A bare `abcd mode` prints the badge, the record,
-  the queue and the owed items.
+The away mode, set on the person's word, is their ask for the session to
+commit and push its own branches and open their pull requests, which is the
+owed work; merging follows the repository's own rule. The away block repeats
+the list. No mode is set and no question is marked open.
 
 ## Footprint
 
-- packages: internal/core/autonomy, internal/core/mode, internal/core/statusline, internal/surface/cli, hooks, commands/mode.md, .abcd/development/brief/02-constraints/03-invariants.md, .abcd/development/brief/04-surfaces/08-abcd.md, .abcd/development/brief/04-surfaces/17-guard.md
-- tests: internal/core/autonomy, internal/core/mode, internal/core/statusline, internal/surface/cli
+- packages: internal/core/autonomy, internal/core/mode, internal/surface/cli, hooks, commands/mode.md, .abcd/development/brief/02-constraints/03-invariants.md, .abcd/development/brief/04-surfaces/08-abcd.md, .abcd/development/brief/04-surfaces/17-guard.md
+- tests: internal/core/autonomy, internal/core/mode, internal/surface/cli
 
 ## Steps
 
-1. The away record and its verbs
-   - packages: internal/core/autonomy, internal/surface/cli, commands/mode.md
-   - tests: internal/core/autonomy, internal/surface/cli
-   - Watched failing first: `abcd mode autonomous --until 09:00` writes one
-     record that a sibling worktree of the same repository reads; `--until`
-     takes a clock time (its next occurrence) or a full timestamp; a past time,
-     no local tier or no checkout is refused with nothing written; `abcd mode
-     back` ends it; a record past its end reads as ended; `abcd mode queue`
-     appends; `abcd mode product-thinker` is refused while the record holds;
-     the badge's three-word vocabulary test still passes unchanged.
-2. Repeated at start, compaction and every prompt
+1. The away record, its lock and its verbs
+   - packages: internal/core/autonomy, internal/core/mode, internal/surface/cli, commands/mode.md, .abcd/development/brief/04-surfaces/08-abcd.md
+   - tests: internal/core/autonomy, internal/core/mode, internal/surface/cli
+   - Watched failing first: TestAwayRecordSharedAcrossWorktrees (`abcd mode
+     autonomous --until 09:00` writes one record a sibling worktree reads);
+     TestUntilClockTimeAndTimestamp; TestUntilRefusedPastOrNoTierOrNoCheckout
+     (nothing written); TestStaleRecordCapSevenDays (an open-ended record
+     reads as ended seven days on, and `--until` beyond that is refused);
+     TestModeBackPrintsQueueAndStopsAndRecordsEnder (also on a record whose
+     time has passed); TestRecordPastEndReadsEnded; TestQueueAppends;
+     TestConcurrentWritesUnderLock (two `mode queue` calls racing keep both
+     steps, and a stop recorded after `mode back` re-reads inside the lock and
+     does not turn the mode back on); TestRecordOwnershipFailsOpen (a record
+     or lock that is a symlink, not this account's, writable by others, or
+     over 64 KiB reads as not away, and a verb refuses naming it);
+     TestBadgeRefusedWhileAway; the badge's three-word vocabulary test passes
+     unchanged. The plugin page and the brief's `abcd mode` surface text
+     describe the three verbs, and `go generate ./internal/surface/cli`
+     refreshes the derived appendix.
+2. Repeated to the agent, shown to the person
    - packages: internal/surface/cli
    - tests: internal/surface/cli
-   - Watched failing first: `abcd hook session-start` with source `startup`,
-     `resume` and `compact` prints the away block while the record holds and
-     nothing when it does not; `abcd hook prompt-router` adds it on every
-     prompt, including a second prompt in the same session, outside the
-     loader's dedup ledger; both stay inside the hook's existing deadline.
-3. Owed work
-   - packages: internal/core/autonomy
+   - Watched failing first: TestSessionStartAwayBlockEverySource (`startup`,
+     `resume` and `compact` print the away block while the record holds,
+     nothing when it does not, and the block carries the person-only act list
+     and the rule to run `abcd mode back` only on the person's word);
+     TestPromptRouterAwayBlockEveryPrompt (a second prompt in the same session
+     too, outside the loader's dedup ledger); TestPromptRouterAwaySystemMessage
+     (one line the person sees on every prompt while it holds); both inside
+     the hook's existing deadline.
+3. Owed work, and invariant 7's clause
+   - packages: internal/core/autonomy, .abcd/development/brief/02-constraints/03-invariants.md
    - tests: internal/core/autonomy
    - Watched failing first, against real git repositories in temp folders
-     and a fake forge listing pinned to `internal/ghcontract`'s fields: each
-     of the four kinds is found; a sibling worktree's branch is not the
-     session's own; a stacked branch with an open base is owed and its item
-     says only the landing waits; a reservation whose pull request is open and
-     green is not owed until its renewal is due; a failed listing yields the
-     disk kinds and a "not read" note; the order of items is fixed.
-4. The stop verdict and the Stop hook
+     and a fake forge listing pinned to `internal/ghcontract`'s fields:
+     TestOwnBranchFromReflogWithoutWindow (checked out before the mode was
+     set, still own); TestOwnBranchFromRunLane (a lane cut with `git worktree
+     add`, absent from this copy's reflog, is own);
+     TestOwnBranchFromLinkedReservation; TestSiblingBranchNotOwn;
+     TestReservationCopyKeyFilter (a sibling copy's live reservation is not
+     owed); TestReservationPullRequestLink (record id in the head branch or a
+     `Refs:`/`Resolves:`/`Delivers:` body line; a green linked pull request is
+     not owed until renewal is due); TestStackedBranchFoundWithoutPullRequest;
+     TestStackedBranchClearingRule (owed while behind its base or the default
+     branch, failing, or without a receipt; waiting on its base otherwise);
+     TestUnpushedSkipsGoneUpstream (a squash-merged branch whose upstream is
+     gone is not owed); TestPresentReadsDiskOnly (zero forge calls while
+     present); TestForgeListingDeadlineAndCache (a hung listing ends at ten
+     seconds; a listing younger than ten minutes is reused; a stale cache
+     falls back with its age named, else the disk kinds and a "not read"
+     note); TestOwedOrderFixed. Brief invariant 7 gains the away mode's one
+     listing per check, its deadline and its cache.
+4. The stop verdict, the Stop and StopFailure hooks
    - packages: internal/core/autonomy, internal/surface/cli, hooks
    - tests: internal/core/autonomy, internal/surface/cli
-   - Watched failing first: every row of the verdict table; the fingerprint
-     is kept per session id; `abcd hook stop` writes `{"decision":"block",
-     "reason":…}` only on a block and a `systemMessage` while present; a
-     malformed payload allows the stop with a stderr line; `hooks/hooks.json`
-     gains a Stop entry and `hooks/stop.sh` takes the same bootstrap and home
-     checks as `hooks/subagent-stop.sh` (the hook-shape tests in
-     `internal/surface/cli` cover it).
-5. The question reroute and the person's return
-   - packages: internal/surface/cli, internal/core/autonomy
+   - Watched failing first: TestJudgeRows (each of the six away rows and both
+     present rows, each with `stop_hook_active` true and false);
+     TestJudgeEscapeBoundReproducesNoStall (owed, unchanged, `true`, no wake:
+     blocked, not allowed); TestJudgeCapRecordsStop (the block passing the
+     cap, and an override from the environment, records the stop);
+     TestCronNextFire (lists, ranges, steps, both day fields, an unparsable
+     expression never qualifies); TestQualifyingWakeDistantCron (`0 9 * * *`
+     seen at 21:00 does not qualify); TestQualifyingWakeRecurringCron (`*/30 *
+     * * *` does); TestQualifyingWakeAfterLeaseLapse (a wake past the earliest
+     renewal due minus the skew does not); TestBackgroundTaskNotAWake (a
+     `shell` task running `sleep 36000` or a `tail -f` does not count);
+     TestNextLookStored; TestProseQuestionBlockedOnce; TestNothingOwedReason
+     (names taking the next ready item first); TestSessionIDShape;
+     TestHookStopOutput (`{"decision":"block","reason":…}` only on a block, a
+     `systemMessage` while present; a malformed payload, an unreadable record
+     or a held lock allows with a stderr line); TestHookStopFailureRecords
+     (the error type recorded while away, nothing written while present);
+     `hooks/hooks.json` gains Stop and StopFailure entries, and `hooks/stop.sh`
+     and `hooks/stop-failure.sh` take the same bootstrap and home checks as
+     `hooks/subagent-stop.sh` (the hook-shape tests cover them); `go generate
+     ./internal/surface/cli` refreshes the derived appendix.
+5. The question reroute
+   - packages: internal/surface/cli, internal/core/autonomy, .abcd/development/brief/04-surfaces/17-guard.md
    - tests: internal/surface/cli, internal/core/autonomy
-   - Watched failing first: while away, a Product-chip, a Tech-chip and an
-     unchipped question are denied with the decide reason, and a Setup-chip
-     question with the queue reason; another tool's question is denied too;
-     no mode is set and no marker written; while present the gate behaves
-     exactly as today. The first prompt after the record ends prints the
-     queue, the window's decisions (by id range) and the recorded stops,
-     once.
-6. Shown, documented, and invariant 7's clause
-   - packages: internal/core/statusline, internal/surface/cli, commands/mode.md, .abcd/development/brief/02-constraints/03-invariants.md, .abcd/development/brief/04-surfaces/08-abcd.md, .abcd/development/brief/04-surfaces/17-guard.md
-   - tests: internal/core/statusline, internal/surface/cli
-   - Watched failing first: the status line names the away mode and its end;
-     a bare `abcd mode` prints the record, the queue and the owed items with
-     no host. Brief invariant 7 gains the stop check's one forge listing as
-     the away mode's documented meaning. The plugin page and the brief's
-     surface chapters say what each verb does. Then `go generate
-     ./internal/surface/cli` is run for the derived appendix.
-7. The live session capture
+   - Watched failing first: TestAwayQuestionDeniedOneReason (a Product-chip,
+     a Tech-chip, a Setup-chip and an unchipped question, and another tool's,
+     get the same reason); TestAwayReasonListsPersonOnlyActs (the reason
+     names every act in the list, the embargo `--approve` digest among them,
+     and the route to `abcd mode queue` for those and to `abcd decide` for
+     the rest); TestAwayQuestionSetsNoMode (no mode set, no marker written);
+     TestPresentQuestionGateUnchanged. The brief's guard chapter says what
+     the gate does while away.
+6. The live session capture
    - packages: none (evidence only, kept in the local tier)
    - tests: a live Claude Code session with the plugin built from the branch
-   - In a lab checkout, seed one behind pull request, one stacked branch and
-     one unpushed branch, set `abcd mode autonomous --until` an hour ahead,
-     and record the transcript. It must show the away block on start; a
-     manual `/compact` followed by the block again; an attempted stop blocked
-     naming the behind pull request; the stacked branch's item; a question
-     refused with the decide reason; `abcd mode back` showing the decisions
-     and the queue. Repeat with the mode off to show the stop allowed and
-     flagged. Capture before and after the change on the same checkout, as
-     the release lesson on host fixes requires.
+   - In a lab checkout, seed one behind pull request checked out before the
+     mode is set, one stacked branch made with `git worktree add` by a run,
+     and one unpushed branch; set `abcd mode autonomous --until` an hour
+     ahead, and record the transcript. It must show the away block on start
+     and the person's line; a manual `/compact` followed by the block again;
+     an attempted stop blocked naming the behind pull request; a reply with
+     no tool call blocked again rather than allowed; the stacked branch's
+     item; a cron set for the next morning refused as a wake and one inside
+     the deadline accepted; a question refused with the one reason; `abcd
+     mode back` printing the queue and the recorded stops. Repeat with the
+     mode off to show the stop allowed and flagged with no forge call.
+     Capture before and after the change on the same checkout, as the
+     release lesson on host fixes requires.
+
+## Size
+
+Re-estimated in review round 1 at five working days, the risk sitting in
+step 3's reflog, run-state and forge reading and step 4's cron parser:
+
+| step | days |
+|---|---|
+| 1. The away record, its lock and its verbs | 0.75 |
+| 2. Repeated to the agent, shown to the person | 0.5 |
+| 3. Owed work, and invariant 7's clause | 1.5 |
+| 4. The stop verdict, the Stop and StopFailure hooks | 1.25 |
+| 5. The question reroute | 0.5 |
+| 6. The live session capture | 0.5 |
+| total | 5.0 |
+
+The first plan wrote no size down; the four-day figure the review was asked
+to check appears nowhere in it, and it would have covered steps 1 to 5 of
+that plan without the review's fixes.
+
+## Review round 1
+
+On 2026-10-18 an Opus and Sonnet pair reviewed the plan as frozen at
+82b928305, with the verdict "fix the plan first". Each item and how it was
+handled:
+
+| # | finding | handled |
+|---|---|---|
+| 1 | the ownership rule misses both instances; stacked-branch clearing | fixed: "own" without a window, from the reflog, a run's lanes or a linked reservation; the clearing rule; stacked found without a pull request; gone upstreams skipped (dcn-2610180936568358, dcn-2610180936571036) |
+| 2 | the escape bound reproduces the stall | fixed: an unchanged owed set is allowed only with a qualifying wake, else blocked again, the host's cap the outer bound with the stop recorded; `stop_hook_active` decides no row, so the missing row is covered (dcn-2610180936577720) |
+| 3 | a wake's timing is never checked | fixed: next fire time from abcd's own cron parser, before the earliest renewal due minus the skew; background tasks never count; distant, recurring and stale-shell rows tested (dcn-2610180936579498) |
+| 4 | the reroute approves acts only the person may approve | fixed: classified by the act with the listed person-only acts, the embargo `--approve` digest included; the chip no longer routes (dcn-2610180937177502) |
+| 5 | stopping while away contradicts the coordination decision | fixed: while away only working or waiting with a qualifying wake; the next look stored in the session's state (dcn-2610180936577720) |
+| 6 | concurrent writes lose updates | fixed: `fsutil.WithFileLock` with a re-read inside it; ownership and permission checks; an unreadable record fails open (dcn-2610180937181736) |
+| 7 | a stale record traps the person | fixed in part: capped at seven days rather than 24 hours, since the record's standing run of 2026-10-15 to 2026-10-17 would not fit 24 hours and requiring `--until` contradicts the open-ended ruling; the person sees a line on every prompt rather than past a threshold; the agent runs `abcd mode back` only on the person's word (dcn-2610180937181736) |
+| 8 | the return list reads one working copy's decisions | moved: the return list leaves the slice with the split, and the fix (`abcd decide` appending each id to the away record under its lock) moves with it (dcn-2610180937181929) |
+| 9 | present mode undefined; per-turn forge call | fixed: present reads disk only with no forge call; away listing under a ten-second deadline with a cache (dcn-2610180936571036) |
+| 10 | reservations: no link, no copy filter | fixed: the record id in the head branch or a body trailer links them; only this copy's key counts (dcn-2610180936568358) |
+| 11 | StopFailure and prose questions | fixed: a StopFailure entry records the stop and its type, the gap named in the scope conditions; a prose question is blocked once (dcn-2610180937175629) |
+| 12 | waiting does not look for other work | fixed: the nothing-owed reason says to take the next ready item first (dcn-2610180936577720) |
+| 13 | a refused session can lift away mode for all | fixed in part: `abcd mode back` records who ended it and from which copy, and the away block allows it only on the person's word; showing it on return moved with the return report (dcn-2610180937181736, dcn-2610180937181929) |
+| size | no size written; five days more honest | fixed: re-estimated at five days, per step above |
+| split | move step 6 and the return half of step 5 | made: the return report, the status line, the bare print and their brief text moved to the checklist draft; kept here, because the slice's own behaviour needs them, are `abcd mode back` printing the queue, invariant 7's clause and the shipped verbs' docs (dcn-2610180937181929) |
diff --git a/.abcd/work/decisions/dcn-2610180936568358-a-session-s-own-branches-are-named-by.md b/.abcd/work/decisions/dcn-2610180936568358-a-session-s-own-branches-are-named-by.md
new file mode 100644
index 0000000000..53b5a6b70b
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180936568358-a-session-s-own-branches-are-named-by.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180936568358
+slug: a-session-s-own-branches-are-named-by
+date: 2026-10-18
+---
+2026-10-18 — A session's own branches are named by three facts with no window bound, and only this copy's reservations count (facilitator-on-delegation, itd-2610180912189125 review round 1; refines dcn-2610180913416683): a branch other than the default branch is the session's own when (a) this working copy's HEAD reflog has checked it out at any time, (b) it is the branch of a lane recorded in a run state this copy's local tier holds (the implement loop's lanes, which build and drain cut with git worktree add, so they never reach the coordinating copy's reflog), or (c) it is the head branch of an open pull request linked to a live reservation held under this copy's key. A reservation counts only when its copy key is this copy's, so a sibling copy's reservation never holds this session. A pull request carries a reservation's work when the record id appears in its head branch's name or on a Refs:, Resolves: or Delivers: line of its body. The window bound is dropped because both instances of iss-2610170619247185 escaped it: the pull requests that fell behind were opened and last checked out before any window began, and the stacked drain lanes lived in worktrees of their own (grounds: the plan review of 2026-10-18 by an Opus and Sonnet pair, findings 1 and 10; internal/core/claim copy key; internal/core/implement/loop lane worktrees; iss-2610170619247185)
diff --git a/.abcd/work/decisions/dcn-2610180936571036-a-stacked-branch-is-owed-only-while-it.md b/.abcd/work/decisions/dcn-2610180936571036-a-stacked-branch-is-owed-only-while-it.md
new file mode 100644
index 0000000000..265ab6a771
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180936571036-a-stacked-branch-is-owed-only-while-it.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180936571036
+slug: a-stacked-branch-is-owed-only-while-it
+date: 2026-10-18
+---
+2026-10-18 — A stacked branch is owed only while it needs work, and the forge is read only while the person is away, under a deadline (facilitator-on-delegation, itd-2610180912189125 review round 1; refines dcn-2610180913416683): an own branch is stacked when its open pull request's base is not the default branch, or, with no pull request, when the nearest other own branch whose tip is an ancestor of its tip is not contained in the last-fetched default branch. A stacked branch whose base is still open is owed only while it is behind its base's tip or the last-fetched default branch, its checks are failing, or no preflight receipt names its head in any worktree (the receipts the landing step already reads); otherwise it is waiting on its base, which is not owed. An unpushed branch has commits not on its upstream or, with none configured, not in any remote-tracking ref; a branch whose upstream is gone (merged and deleted on the remote, a squash merge included) is never counted. While the person is present the check reads disk only (a reservation's renewal due and unpushed own branches) and never calls the forge, so brief invariant 7 holds on every turn. While away it makes at most one pull-request listing under a ten-second deadline; a listing younger than ten minutes is reused rather than repeated, and on a failure or timeout one younger than half the default lease is used with its age named, else the disk kinds alone with the pull requests named as not read (grounds: the plan review of 2026-10-18, findings 1 and 9; brief invariant 7; internal/core/landing receipt lookup)
diff --git a/.abcd/work/decisions/dcn-2610180936577720-while-the-person-is-away-a-session-is.md b/.abcd/work/decisions/dcn-2610180936577720-while-the-person-is-away-a-session-is.md
new file mode 100644
index 0000000000..9add66cd61
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180936577720-while-the-person-is-away-a-session-is.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180936577720
+slug: while-the-person-is-away-a-session-is
+date: 2026-10-18
+---
+2026-10-18 — While the person is away a session is only working or waiting, and abcd never allows a stop with work owed (facilitator-on-delegation, itd-2610180912189125 review round 1; supersedes the bound in dcn-2610180913413137 and refines dcn-2610180913421109): while away a stop is allowed only when the session has a qualifying wake and either nothing is owed or the owed set is unchanged since this session's last block; it then reads waiting, and the wake's next fire time is kept as its next look in the session's own state file in the local tier, beside the owed-set fingerprint and a count of consecutive blocks. Every other stop while away is blocked, whatever stop_hook_active says, naming the next item, or with nothing owed asking the session to take the next ready item first and only then schedule its next look. The host's cap of eight consecutive continuations, or the cap its documented environment variable sets, is the outer bound, and the block abcd counts as reaching it records stopped with work owed in the away record. The old row that allowed an unchanged owed set once stop_hook_active was true reproduced the stall, since a reply of awaiting the person with no tool call ended the turn until morning. This matches the coordination prep's decision that while the person is away a session with work never stops and one with nothing it can do is waiting with its next look, and the draft's ruling that stopped is allowed only while the person is present (grounds: the plan review of 2026-10-18, findings 2, 5 and 12; code.claude.com/docs/en/hooks Stop input and continuation cap; itd-2610170638184486 decisions)
diff --git a/.abcd/work/decisions/dcn-2610180936579498-a-wake-qualifies-only-when-its-next-fire.md b/.abcd/work/decisions/dcn-2610180936579498-a-wake-qualifies-only-when-its-next-fire.md
new file mode 100644
index 0000000000..04c33f6e97
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180936579498-a-wake-qualifies-only-when-its-next-fire.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180936579498
+slug: a-wake-qualifies-only-when-its-next-fire
+date: 2026-10-18
+---
+2026-10-18 — A wake qualifies only when its next fire time falls before the session's earliest renewal due, and a background task never counts (facilitator-on-delegation, itd-2610180912189125 review round 1; refines dcn-2610180913421109): a session_crons entry qualifies when the next time its cron expression matches after now, read in the machine's local time, is no later than the earliest renewal due among the live reservations under this copy's key minus the lease skew allowance, a renewal being due halfway between a reservation's claim or last renewal and its expiry; with no live reservation it must fire within half the default lease. The next fire time comes from a small five-field cron parser of abcd's own (minute, hour, day of month, month, day of week, with lists, ranges, steps and the wildcard), since the host documents schedule as a cron expression and a new dependency would need sign-off; an expression it cannot parse never qualifies. A background task does not count on its own while the person is away, since a shell task such as a long sleep or a tail that never ends reports as in flight however distant its wake. So a cron at 09:00 seen at 21:00, or a wake that fires after a lease lapses, no longer passes (grounds: the plan review of 2026-10-18, finding 3; code.claude.com/docs/en/hooks session_crons and background_tasks fields; internal/core/lease; AGENTS.md new dependencies need sign-off)
diff --git a/.abcd/work/decisions/dcn-2610180937175629-an-api-error-stop-is-recorded-and-a-turn.md b/.abcd/work/decisions/dcn-2610180937175629-an-api-error-stop-is-recorded-and-a-turn.md
new file mode 100644
index 0000000000..0f4bb1b0d4
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180937175629-an-api-error-stop-is-recorded-and-a-turn.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180937175629
+slug: an-api-error-stop-is-recorded-and-a-turn
+date: 2026-10-18
+---
+2026-10-18 — An API-error stop is recorded, and a turn ending on a prose question while away is blocked once (facilitator-on-delegation, itd-2610180912189125 review round 1): the plugin's hook manifest gains a StopFailure entry, which the host fires instead of Stop when a turn ends on an API error such as a rate limit and whose output it ignores, so it cannot continue the session; while the person is away abcd records the stop and the host's error type in the away record, and the slice's scope conditions name that such a turn is recorded, not resumed, except by a wake the session had already scheduled. While away, a stop whose last_assistant_message ends on a line ending in a question mark is blocked once per message with the reroute's reason (decide and record it, or queue it when it is an act only the person may approve), before the verdict's other rows apply (grounds: the plan review of 2026-10-18, finding 11; code.claude.com/docs/en/hooks StopFailure and Stop input; iss-2610170619247185, whose session ended its turn on a question)
diff --git a/.abcd/work/decisions/dcn-2610180937177502-while-the-person-is-away-a-question-is.md b/.abcd/work/decisions/dcn-2610180937177502-while-the-person-is-away-a-question-is.md
new file mode 100644
index 0000000000..0f4d788bf7
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180937177502-while-the-person-is-away-a-question-is.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180937177502
+slug: while-the-person-is-away-a-question-is
+date: 2026-10-18
+---
+2026-10-18 — While the person is away a question is routed by the act it asks about, not by its chip (facilitator-on-delegation, itd-2610180912189125 review round 1; supersedes the chip routing in dcn-2610180913431493): the guard still refuses every question on the host's question tool while the away mode holds, now with one reason whatever the chip. It tells the agent to queue with abcd mode queue, and carry on with other work, a question about any act only the person may approve: an approval the repository binds to the person per act (an embargo close's --approve digest, which commands/embargo.md says is never supplied unless the person has read the text and said yes in that session; a release sign-off); publishing anything or changing a repository's visibility; adding a dependency; a secret, a credential or an App; a step only a website or a browser can do; a destructive act (deleting what the session did not create, overwriting uncommitted work, a force push, discarding a peer's work); and anything that spends money. Every other question is decided and recorded with abcd decide, with its grounds and how to reverse it. The away mode, set on the person's word, is their ask for the session to commit and push its own branches and open their pull requests, which is the owed work itself; merging follows the repository's own rule. The Setup chip marks the setup interview's questions (visibility, keys, oracles), not a step only the person can take, so routing by chip would have sent an embargo approval, or the creation of a new App asked under a Product chip, to be decided by the agent (grounds: the plan review of 2026-10-18, finding 4; commands/embargo.md approval one per act; brief invariant 22; AGENTS.md new dependencies and commits; internal/surface/cli guard question chips)
diff --git a/.abcd/work/decisions/dcn-2610180937181736-the-away-record-is-changed-only-under-a.md b/.abcd/work/decisions/dcn-2610180937181736-the-away-record-is-changed-only-under-a.md
new file mode 100644
index 0000000000..454f923837
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180937181736-the-away-record-is-changed-only-under-a.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180937181736
+slug: the-away-record-is-changed-only-under-a
+date: 2026-10-18
+---
+2026-10-18 — The away record is changed only under a lock, read only when it is safely the account's, and capped at seven days (facilitator-on-delegation, itd-2610180912189125 review round 1; refines dcn-2610180913399042): every read-modify-write of the record (setting, ending, queueing, a recorded stop) holds fsutil.WithFileLock on a lock file beside it and re-reads the record inside the lock, so a stop check that read away before a slow forge listing cannot write away back after the person ended it, and two queued steps cannot lose one; the forge listing runs outside the lock, and a lock not had within two seconds allows the stop and says so on stderr. The record and its lock are used only when each is a regular file this account owns that no one else can write, within 64 KiB, the checks rules.json already gets; a record failing them, or failing to parse, reads as not away, failing open, and a verb asked to change it refuses naming the file. An open-ended record ends seven days after it was set, and --until may name no later time, so a forgotten record lapses while a run of several days, such as the standing run of 2026-10-15 through 2026-10-17, still fits; a 24-hour cap would have ended that run midway, and requiring --until would contradict the product thinker's ruling that the mode may be open-ended. While the record holds, the prompt hook adds a one-line systemMessage the person sees on every prompt naming the away mode, its end, who set it and how to end it; the away block tells the agent to run abcd mode back only on the person's word in its session; and abcd mode back records who ended the mode and from which working copy (grounds: the plan review of 2026-10-18, findings 6, 7 and 13; internal/fsutil file lock; AGENTS.md rules.json ownership checks; iss-2610170619247185 standing run; the draft's ruling that the state is always shown plainly)
diff --git a/.abcd/work/decisions/dcn-2610180937181929-the-person-s-return-report-the-status.md b/.abcd/work/decisions/dcn-2610180937181929-the-person-s-return-report-the-status.md
new file mode 100644
index 0000000000..2a502d7705
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610180937181929-the-person-s-return-report-the-status.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610180937181929
+slug: the-person-s-return-report-the-status
+date: 2026-10-18
+---
+2026-10-18 — The person's return report, the status line and the bare abcd mode print move from the slice back to the checklist draft (facilitator-on-delegation, itd-2610180912189125 review round 1; supersedes dcn-2610180913431985 for the slice, and the status-line and bare-print halves of dcn-2610180913445272): both reviewers of 2026-10-18 recommended the split, so the security and bug-fix cut waits only on the away record, the stop check and the question reroute. The spec's step 6 and the return half of its step 5 leave the slice: the report shown once on the first prompt after the window ends (the queue, the window's decisions and the recorded stops); the window's decisions gathered from every working copy by abcd decide appending each id to the away record under its lock (review finding 8); showing on return who ended the mode (finding 13); the status line naming the away mode and its end; a bare abcd mode printing the record, the queue and the owed items; and the brief's surface text for them. They become named remaining work in the scope of itd-2610170638184486. The slice keeps what its own behaviour needs: abcd mode back prints the queue and the recorded stops as it ends the record, so a queued step is never unread; brief invariant 7 gains the away mode's forge listing; and the plugin page and the brief's surface chapters describe the verbs and hooks the slice ships, so nothing it ships is undocumented. The slice is re-estimated at five working days (grounds: the plan review of 2026-10-18, size and split; the coordination prep's decision that the cut waits on this slice alone; AGENTS.md wired or it isn't done; brief invariant 7)

From bc221abf95a308f080e1407f3ab26774a8910491 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 11:11:45 +0100
Subject: [PATCH 06/58] docs: revise the overnight-stall plan after its second
 review

Only the person sets the away mode now: guard entries refuse an agent's
every route to it that the guard reads, and the mode's push rights are
narrow, with the default branch, tags, cuts, other people's pull requests
and review-only branches excluded. The wake deadline gains a ceiling and
the host's lateness, behind comes from the forge's merge state, created
branches are recorded as own, stale and review-only branches are not, the
person-only acts are completed, and a lapsed window points at the verb
that ends it. Nine refining decisions and a proposed ADR for the network
read record it; the slice is re-estimated at eight days.

Refs: itd-2610180912189125
Refs: iss-2610170619247185
Assisted-by: Claude:claude-opus-5-5
---
 ...97-the-away-mode-s-stop-check-reads-the.md |  75 ++
 .abcd/development/decisions/adrs/README.md    |   1 +
 ...125-a-session-told-to-work-on-while-its.md | 144 ++--
 ...489-a-session-told-to-work-on-while-its.md | 649 +++++++++++++-----
 ...a-wake-qualifies-only-when-it-fires-the.md |   6 +
 ...-only-the-person-sets-the-away-mode-its.md |   6 +
 ...-branch-is-the-session-s-own-only-while.md |   6 +
 ...while-the-person-is-away-a-pull-request.md |   6 +
 ...-a-pull-request-carries-a-reservation-s.md |   6 +
 ...4765-a-window-that-lapsed-with-anything.md |   6 +
 ...he-acts-only-the-person-may-approve-are.md |   6 +
 ...abcd-s-count-of-blocks-resets-only-when.md |   6 +
 ...488355-a-stacked-branch-s-clearing-rule.md |   6 +
 13 files changed, 724 insertions(+), 199 deletions(-)
 create mode 100644 .abcd/development/decisions/adrs/2610181003541997-the-away-mode-s-stop-check-reads-the.md
 create mode 100644 .abcd/work/decisions/dcn-2610181003455731-a-wake-qualifies-only-when-it-fires-the.md
 create mode 100644 .abcd/work/decisions/dcn-2610181003456444-only-the-person-sets-the-away-mode-its.md
 create mode 100644 .abcd/work/decisions/dcn-2610181003463367-a-branch-is-the-session-s-own-only-while.md
 create mode 100644 .abcd/work/decisions/dcn-2610181003464379-while-the-person-is-away-a-pull-request.md
 create mode 100644 .abcd/work/decisions/dcn-2610181003467233-a-pull-request-carries-a-reservation-s.md
 create mode 100644 .abcd/work/decisions/dcn-2610181003474765-a-window-that-lapsed-with-anything.md
 create mode 100644 .abcd/work/decisions/dcn-2610181003477194-the-acts-only-the-person-may-approve-are.md
 create mode 100644 .abcd/work/decisions/dcn-2610181003484631-abcd-s-count-of-blocks-resets-only-when.md
 create mode 100644 .abcd/work/decisions/dcn-2610181003488355-a-stacked-branch-s-clearing-rule.md

diff --git a/.abcd/development/decisions/adrs/2610181003541997-the-away-mode-s-stop-check-reads-the.md b/.abcd/development/decisions/adrs/2610181003541997-the-away-mode-s-stop-check-reads-the.md
new file mode 100644
index 0000000000..ce2ced0713
--- /dev/null
+++ b/.abcd/development/decisions/adrs/2610181003541997-the-away-mode-s-stop-check-reads-the.md
@@ -0,0 +1,75 @@
+---
+id: adr-2610181003541997
+slug: the-away-mode-s-stop-check-reads-the
+status: proposed
+date: 2026-10-18
+supersedes: null
+superseded_by: null
+related_intents: [itd-2610180912189125]
+related_rfcs: []
+related_adrs: [adr-38]
+---
+
+# ADR-2610181003541997: The away mode's stop check reads the forge once, as its documented meaning
+
+## Context
+
+Brief invariant 7 says abcd asks the network nothing on its own: implicit
+checks read disk only, and a fetch happens only when the user invokes a verb
+or flag whose documented meaning is that fetch
+([adr-38](0038-implicit-checks-are-disk-only.md)). The stop check of
+itd-2610180912189125 runs from the host's Stop hook at every turn's end, which
+no one invokes by name.
+
+Two of the four kinds of owed work live only on the forge: whether a
+session's own pull request is behind its base or failing its checks, and
+whether one carries a reservation's work. Plan review round 2 showed that the
+disk cannot answer the first in the night: the last-fetched default branch is
+stale, so a pull request that fell behind after the last fetch never reads as
+behind (blocker 2, dcn-2610181003464379). The drain's own reads of the remote
+were written into invariant 7 the same way, as the documented meaning of its
+verb.
+
+## Decision
+
+We will treat setting the away mode (`abcd mode autonomous`, which only the
+person runs) as invoking the stop check's forge read while the mode holds:
+at most one pull-request listing of the person's open pull requests per
+check (head and base branch, author, body, merge state, review decision and
+check rollup), under a ten-second deadline, cached in the local tier and
+reused for ten minutes, so eight blocks in a row cost one call.
+
+We will keep the check disk-only whenever the away mode does not hold: no
+turn's end while the person is present touches the network.
+
+We will name a failed or late read, never hide it: the check falls back to a
+cached listing younger than half the default lease, with its age named, or to
+the disk kinds alone with the pull requests named as not read.
+
+We will add this listing to invariant 7 as the away mode's documented
+meaning, beside the drain's.
+
+## Alternatives Considered
+
+- **Disk only, always.** Keeps invariant 7 untouched. Rejected: "behind" is
+  then measured against a default branch nothing refreshes overnight, and a
+  reservation's carrying pull request cannot be seen, so the stall the slice
+  fixes (iss-2610170619247185) recurs on exactly the pull requests that fell
+  behind in the night.
+- **A fetch of the default branch at each check.** Answers "behind" from
+  disk after a fetch. Rejected: it is a network read all the same, it still
+  cannot see checks, reviews or links, and it would run while the person is
+  present unless also confined to the away mode.
+- **One listing per check while away, chosen.** One call, bounded in time,
+  cached, and only inside a window the person opened with their own command.
+
+## Consequences
+
+- Invariant 7 gains a third verb-scoped meaning; the zero-network test
+  harness must show the present-mode check makes no forge call
+  (TestPresentReadsDiskOnly).
+- The forge client must be signed in for the away check to read pull
+  requests; when it is not, the check says so and judges from disk, which the
+  intent's scope conditions already name.
+- A later intent that wants the forge read while the person is present needs
+  its own amendment; this record does not cover it.
diff --git a/.abcd/development/decisions/adrs/README.md b/.abcd/development/decisions/adrs/README.md
index d372cbac8a..084dce4990 100644
--- a/.abcd/development/decisions/adrs/README.md
+++ b/.abcd/development/decisions/adrs/README.md
@@ -215,4 +215,5 @@ The intent lint (a Go implementation) extends to verify these reciprocally.
 | [adr-2610150729333337](2610150729333337-a-status-branch-moves-without-a.md) | A status branch moves without a preflight receipt | proposed | 2026-10-15 |
 | [adr-2610161621415708](2610161621415708-abcd-s-command-guard-steers-agents-an-os.md) | Unattended runs abcd launches execute inside an OS sandbox | proposed | 2026-10-16 |
 | [adr-2610161733400551](2610161733400551-a-reviewer-in-a-model-matrix-run-never.md) | A reviewer or judge in a model-matrix run is told nothing about which model wrote the copy it judges | proposed | 2026-10-16 |
+| [adr-2610181003541997](2610181003541997-the-away-mode-s-stop-check-reads-the.md) | The away mode's stop check reads the forge once, as its documented meaning | proposed | 2026-10-18 |
 <!-- /index -->
diff --git a/.abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md b/.abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md
index df4ea78c62..61810d88e5 100644
--- a/.abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md
+++ b/.abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md
@@ -17,7 +17,7 @@ related_issues: [iss-2610170619247185]
 
 ## Press Release
 
-> A session told to work on while its person is away keeps working until they are back. Alice, a solo founder who is also the product thinker, leaves for the evening and says the sessions should work on until 09:00. abcd records that once for the repository, with who set it and when it ends, and repeats it to every session at each start, after each compaction and with every prompt, so no summary and no relay between sessions can drop it. A session that tries to end its turn while it still has work it can do alone (a reservation whose work is not yet handed in, a pull request of its own that has fallen behind or is failing, a branch it has not pushed, a branch stacked on another change that is still open) is handed the next of those items instead. One with nothing left to do takes the next ready item, and may stop only with its next look scheduled before its reservations need renewing. A question it would have put to Alice is decided and recorded instead, and an act only Alice may approve (an advisory's approval, a publication, a new dependency, a secret, a browser step) is queued for their return. When Alice is back and says so, the mode ends and they see the queued steps and any stop the host forced; from then on nothing is refused, and a stop with work left is only pointed out.
+> A session told to work on while its person is away keeps working until they are back. Alice, a solo founder who is also the product thinker, leaves for the evening and runs one command of her own saying the sessions should work on until 09:00; a session cannot run it for her, so a message relayed between sessions cannot set it. abcd records that once for the repository, with who set it and when it ends, and repeats it to every session at each start, after each compaction and with every prompt, so no summary and no relay between sessions can drop it. A session that tries to end its turn while it still has work it can do alone (a reservation whose work is not yet handed in, a pull request of its own that has fallen behind or is failing, a branch it has not pushed, a branch stacked on another change that is still open) is handed the next of those items instead. One with nothing left to do takes the next ready item, and may stop only with its next look scheduled before its reservations need renewing. A question it would have put to Alice is decided and recorded instead, and an act only Alice may approve (an advisory's approval, a publication, a new dependency, a secret, a browser step) is queued for their return. When Alice is back and says so, the mode ends and they see the queued steps and any stop the host forced; from then on nothing is refused, and a stop with work left is only pointed out.
 
 ## Why This Matters
 
@@ -72,41 +72,61 @@ its turn on a question to the person.
 
 - **The away mode.** `abcd mode autonomous [--until <time>]` records who set
   it, when, and when it ends, at most seven days on; `abcd mode back` ends it,
-  prints the queue and the recorded stops, and records who ended it. One
-  record per repository on the machine, shared by every working copy, changed
-  only under a lock (dcn-2610180913399042, dcn-2610180913399499,
-  dcn-2610180937181736).
+  prints the queue, the recorded stops and any refused attempt, and records
+  who ended it. One record per repository on the machine, shared by every
+  working copy, changed only under a lock (dcn-2610180913399042,
+  dcn-2610180913399499, dcn-2610180937181736).
+- **Only the person sets it.** Guard entries refuse an agent's every route to
+  setting the mode that the guard reads, its file tools included, so the
+  person sets it with their own `!` command or at a terminal, and a refused
+  attempt is shown to them. The guard is a mistake filter, not a boundary.
+  The mode lets a session push its own branches and open their pull
+  requests, never the default branch, a tag, a release cut, another person's
+  pull request or a branch only checked out to review
+  (dcn-2610181003456444).
 - **Repeated, never summarised away.** While it holds, the session-start hook
   (every source, compaction included) and the prompt hook (every prompt) add
   one short block to the session's context (dcn-2610180913406972), and the
-  prompt hook shows the person one line naming the away mode
-  (dcn-2610180937181736).
+  prompt hook shows the person one line naming the away mode and `abcd mode
+  back`, and after a window lapses with anything unread, one line pointing
+  at `abcd mode back` (dcn-2610180937181736, dcn-2610181003474765).
 - **The stop check.** A plugin Stop hook asks `abcd hook stop`. While the
   person is away a session is only working or waiting: a turn's end with owed
   work is refused, naming the next item, and a stop is allowed only with a
-  wake that fires before its reservations need renewing; the host's cap of
-  eight continuations is the outer bound, and a stop it forces is recorded.
+  wake that fires, the host's lateness included, within half an hour while
+  work is owed and before its reservations need renewing; the host's cap of
+  eight continuations is the outer bound, and a stop it may have forced is
+  recorded.
   A StopFailure hook records a turn ended by an API error. While the person
   is present the check reads disk only and points the work out
   (dcn-2610180913413137, dcn-2610180913421109, dcn-2610180936577720,
-  dcn-2610180936579498, dcn-2610180937175629).
+  dcn-2610180936579498, dcn-2610180937175629, dcn-2610181003455731,
+  dcn-2610181003484631).
 - **Owed work**, in exactly these terms: a live reservation under this
   working copy's key whose renewal is due or whose work no open pull request
-  carries yet; an open pull request of the session's own that is behind the
-  default branch or failing its checks; a branch of its own with commits not
-  pushed; and a branch of its own stacked on a change that is still open,
-  while it is behind, failing or has no preflight receipt, since only its
-  landing waits for the base. A branch is the session's own when this copy
-  ever checked it out, a run in this copy cut it as a lane, or a reservation
-  under this copy's key links it (dcn-2610180913416683,
-  dcn-2610180936568358, dcn-2610180936571036).
+  carries yet; an open pull request of the session's own that is behind its
+  base (by the forge's merge state while away) or failing its checks; a
+  branch of its own with commits not pushed; and a branch of its own stacked
+  on a change that is still open, while it is behind, failing, awaiting
+  review or unverified, since only its landing waits for the base. A branch
+  is the session's own when this copy checked it out or the session created
+  it, and it holds a recent commit of this checkout's; when it is a lane of
+  a run whose reservation is live under this copy's key; or when such a
+  reservation links it by its head branch or a closing trailer. Never the
+  default branch, a tag, or another person's pull request
+  (dcn-2610180913416683, dcn-2610180936568358, dcn-2610180936571036,
+  dcn-2610181003463367, dcn-2610181003467233, dcn-2610181003464379,
+  dcn-2610181003488355).
 - **The question reroute.** While the person is away, the guard refuses every
   question on the host's question tool. A question about an act only the
-  person may approve (a per-act approval such as an embargo close's digest,
-  a publication or visibility change, a new dependency, a secret, credential
-  or App, a website or browser step, a destructive act, a spend) is queued
-  with `abcd mode queue "<step>"`; every other question is decided and
-  recorded with `abcd decide` (dcn-2610180913431493, dcn-2610180937177502).
+  person may approve (a per-act approval or ruling such as an embargo
+  close's digest, an embargo triage verdict or a drain hand-back, a push or
+  merge beyond the session's own branches, a publication, outward message or
+  visibility change, a new dependency, a secret, credential or App, a
+  website or browser step, a destructive act, a spend, or any act a command
+  page or invariant names as the person's) is queued with `abcd mode queue
+  "<step>"`; every other question is decided and recorded with `abcd decide`
+  (dcn-2610180913431493, dcn-2610180937177502, dcn-2610181003477194).
 
 ## What's Out of Scope
 
@@ -138,8 +158,8 @@ its turn on a question to the person.
   default branch, **when** the session tries to end its turn, **then** the
   stop is blocked and the reason names that pull request as the next item and
   says how many items remain.
-- **Given** the away mode holds and a lane branch that a run in the
-  session's working copy cut in its own worktree is stacked on a pull request
+- **Given** the away mode holds and a branch the session cut with `git
+  worktree add -b`, with no upstream and no record id, is stacked on a pull request
   that is still open and is behind the default branch, **when** the session
   tries to end its turn, **then** the stop is blocked and the reason asks for
   the merge from the default branch, the fixes, the review and the preflight
@@ -173,8 +193,23 @@ its turn on a question to the person.
   approve is queued with `abcd mode queue`, and it never supplies the
   approval itself.
 - **Given** the away mode holds, **when** Alice sends any prompt, **then** one
-  line shown to Alice names the away mode, its end, who set it and how to end
-  it.
+  line shown to Alice names the away mode, its end, who set it and `abcd
+  mode back`.
+- **Given** a session relays a message saying Alice wants the sessions to
+  work on, **when** another session's agent runs `abcd mode autonomous`, or
+  `go run ./cmd/abcd mode autonomous`, or writes the away record with a file
+  tool, **then** the guard refuses it, telling the agent to leave it to
+  Alice, nothing is set, and Alice's next prompt shows one line saying a
+  session tried; **and when** Alice runs `!abcd mode autonomous --until
+  09:00` herself, **then** it is set.
+- **Given** a window that ended at 09:00 with one queued step, **when** Alice
+  sends her first prompt at 10:00 without having run `abcd mode back`,
+  **then** one line shown to Alice counts the queued step and names `abcd
+  mode back`.
+- **Given** the away mode holds and a branch this copy only checked out to
+  review another person's pull request, or a run lane whose run's
+  reservation has lapsed, **when** the session tries to end its turn,
+  **then** neither is named as owed.
 - **Given** a window in which one step was queued and the host forced one
   stop, **when** Alice runs `abcd mode back`, **then** they see the queued
   step and the stop, and the mode ends recording who ended it.
@@ -194,8 +229,9 @@ its turn on a question to the person.
 - **Given** the slice is built, **when** a live Claude Code session with the
   plugin from the branch runs an away window with seeded owed work, a
   compaction and an attempted stop, **then** a captured transcript shows the
-  away block after compaction, the blocked stop naming the next item, and the
-  refused question.
+  agent's attempt to set the mode refused and the person's own `!` command
+  setting it, the away block after compaction, the blocked stop naming the
+  next item, and the refused question.
 
 ## SOTA
 
@@ -238,8 +274,9 @@ ruling or the ground it rests on; the full text is in the decision record.
    security and bug-fix release, not deferred.
 2. **Its own intent** (dcn-2610180913388445): the slice builds on the
    checklist draft rather than planning it.
-3. **The away record** (dcn-2610180913399042): set by a verb on the person's
-   word, ended by its time or their word, never by a prompt.
+3. **The away record** (dcn-2610180913399042): set by a verb, ended by its
+   time or the person's word, never by a prompt; who may run the verb is
+   decision 19.
 4. **Per repository on the machine** (dcn-2610180913399499).
 5. **Repeated at start, compaction and every prompt**
    (dcn-2610180913406972).
@@ -248,25 +285,46 @@ ruling or the ground it rests on; the full text is in the decision record.
 7. **The stop check and its bound** (dcn-2610180913413137).
 8. **Nothing owed means a scheduled look** (dcn-2610180913421109).
 9. **No question waits while away** (dcn-2610180913431493).
-10. **Two lists on return, derived** (dcn-2610180913431985).
-11. **Host-agnostic core, reachable without a host**
+10. **Host-agnostic core, reachable without a host**
     (dcn-2610180913445272); its status-line and bare-print halves moved by
-    decision 19.
+    decision 18.
 
 Review round 1 of 2026-10-18 refined them:
 
-12. **"Own" without a window, this copy's reservations only**
+11. **"Own" without a window, this copy's reservations only**
     (dcn-2610180936568358).
-13. **Stacked branches cleared; the forge read only while away**
+12. **Stacked branches cleared; the forge read only while away**
     (dcn-2610180936571036).
-14. **Away means working or waiting** (dcn-2610180936577720).
-15. **A wake qualifies by its next fire time** (dcn-2610180936579498).
-16. **API-error stops recorded; prose questions blocked once**
+13. **Away means working or waiting** (dcn-2610180936577720).
+14. **A wake qualifies by its next fire time** (dcn-2610180936579498).
+15. **API-error stops recorded; prose questions blocked once**
     (dcn-2610180937175629).
-17. **Questions routed by the act** (dcn-2610180937177502).
-18. **The record's lock, checks and seven-day cap** (dcn-2610180937181736).
-19. **The return report, status line and bare print move to the draft**
-    (dcn-2610180937181929).
+16. **Questions routed by the act** (dcn-2610180937177502).
+17. **The record's lock, checks and seven-day cap** (dcn-2610180937181736).
+18. **The return report, status line and bare print move to the draft**
+    (dcn-2610180937181929), superseding the return lists of the planning
+    walk.
+
+Review round 2 of 2026-10-18 refined them again:
+
+19. **Only the person sets the away mode; narrow push rights; a mistake
+    filter** (dcn-2610181003456444), refining decision 3.
+20. **A wake qualifies within a ceiling, the host's lateness included**
+    (dcn-2610181003455731).
+21. **Behind is the forge's merge state while away** (dcn-2610181003464379).
+22. **Created branches recorded; stale and review-only branches not own**
+    (dcn-2610181003463367).
+23. **Linked only by head branch or a closing trailer**
+    (dcn-2610181003467233).
+24. **The person-only acts completed, with a catch-all**
+    (dcn-2610181003477194).
+25. **A lapsed window points at `abcd mode back`** (dcn-2610181003474765).
+26. **The block count resets only when the host is not continuing**
+    (dcn-2610181003484631).
+27. **The clearing rule names review and works without receipts**
+    (dcn-2610181003488355).
+
+The invariant 7 amendment is recorded as adr-2610181003541997 (proposed).
 
 ## Audit Notes
 
diff --git a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
index 4ccdc4349e..5120e1bad5 100644
--- a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
+++ b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
@@ -10,17 +10,23 @@ production_mode: hand-written
 ## Summary
 
 Delivers itd-2610180912189125, the first slice of the checklist draft
-(itd-2610170638184486) and the fix for iss-2610170619247185. Three parts:
+(itd-2610170638184486) and the fix for iss-2610170619247185. Four parts:
 
 - **The away mode.** `abcd mode autonomous [--until <time>]`, `abcd mode back`
   and `abcd mode queue "<step>"` keep one away record per repository on the
   machine, changed only under a lock. The session-start hook (every source,
   `compact` included) and the prompt hook repeat it to the agent while it
   holds, and the prompt hook shows the person one line saying so.
+- **Only the person sets it.** Guard entries refuse every route to setting
+  the mode that the guard reads, an agent's shell call and its file tools
+  included, so the person sets it with their own `!` command or at a
+  terminal. What the mode grants is narrow: the session pushes its own
+  branches and opens their pull requests, and nothing beyond them.
 - **The stop check.** A plugin Stop hook runs `abcd hook stop`. While the
   record holds, a session is only working or waiting: a turn's end is blocked
   while owed work exists, naming the next item, and is allowed only with a
-  wake that fires before the session's reservations need renewing. The host's
+  wake that fires, the host's lateness included, within half an hour while
+  work is owed and before the session's reservations need renewing. The host's
   cap of eight consecutive continuations is the outer bound. A StopFailure
   hook records a turn the host ends on an API error. While the person is
   present the check reads disk only and points the work out.
@@ -69,23 +75,49 @@ docs.claude.com hooks page redirects there):
   the prompt, as a system reminder.
 - **Universal output.** `systemMessage` is a "warning message shown to the
   user".
+- **Where a prompt comes from.** The prompt hook also fires on turns the
+  host starts on its own and on a message another session sends, and its
+  input has no field naming the prompt's origin, so a hook cannot tell the
+  person's word from a relayed one.
+
+Read on 2026-10-18 at https://code.claude.com/docs/en/interactive-mode and
+https://code.claude.com/docs/en/scheduled-tasks:
+
+- **Shell mode.** Input starting with `!` runs "shell commands directly
+  without going through Claude", and those commands run outside the sandbox
+  "because the sandbox applies to the commands Claude runs". So the
+  person's `!` command is not a Bash tool call and should not reach the
+  pre-tool hook; step 7 confirms it live.
+- **Scheduled tasks.** "All times are interpreted in your local timezone",
+  not UTC. A recurring task "starts each run late by up to half the gap to
+  the next run, and by at most 30 minutes", except `*/5 * * * *`, which runs
+  15 seconds sooner; a one-shot task set for `:00` or `:30` runs up to 90
+  seconds early, and one set for any other minute is not shifted. Day of
+  week takes `0` or `7` for Sunday, and when both day fields are restricted
+  either matches, "standard vixie-cron semantics". `CronList` rows show each
+  task's next run.
 
 abcd's hook manifest already registers SessionStart with no matcher, so
 compaction already runs `abcd hook session-start`. It has no Stop or
-StopFailure entry, and its PreToolUse entry already matches the host's
-question tool.
+StopFailure entry, and its PreToolUse entry matches the shell tool and the
+host's question tool, not the file tools.
 
 ### The away record
 
-- **Where it lives.** One JSON file per repository on the machine, in abcd's
-  machine store under the repository's root commit, beside the worktree store
-  (dcn-2610180913399499), with a lock file beside it. It is written through
-  fsutil's atomic writer.
+- **Where it lives.** One JSON file per repository on the machine, in the
+  away store, `~/.abcd.noindex/away/<root-sha>/`, keyed on the repository's
+  root commit as the worktree store is (dcn-2610180913399499), with a lock
+  file beside it. The same folder holds each working copy's list of branches
+  it created (dcn-2610181003463367). Everything in it is written through
+  fsutil's atomic writer, and only by abcd: the guard refuses an agent's
+  write to it (below).
 - **What it holds.** Who set it: the holder name reservations cache, without
-  a network read, falling back to git's `user.name`. It also holds the start,
-  the end, the queue of steps for the person, the stops recorded (with work
-  owed, with no next look, or on an API error with its type), and, once ended
-  by word, who ended it and from which working copy.
+  a network read, falling back to git's `user.name`, and the working copy it
+  was set from. It also holds the start, the end, the queue of steps for the
+  person, the stops recorded (with work owed, with no next look, or on an
+  API error with its type, each at the cap labelled "possibly forced by the
+  cap"), the guard's refused attempts to set the mode, and, once ended by
+  word, who ended it and from which working copy.
 - **The lock** (dcn-2610180937181736). Every read-modify-write (`mode
   autonomous`, `mode back`, `mode queue`, a recorded stop) holds
   `fsutil.WithFileLock` on the lock file and re-reads the record inside it.
@@ -107,9 +139,19 @@ question tool.
   nothing written. A run of several days, like the standing run of 2026-10-15
   through 2026-10-17, fits; a forgotten record lapses.
 - **Seen by the person.** While the record holds, the prompt hook adds a
-  one-line `systemMessage` on every prompt: away until when, set by whom, and
-  that saying they are back ends it. The away block tells the agent to run
-  `abcd mode back` only on the person's word in its session.
+  one-line `systemMessage` on every prompt: away until when, set by whom,
+  and the literal `abcd mode back` as the way to end it. The away block tells
+  the agent to run `abcd mode back` only on the person's word in its session
+  (dcn-2610181003474765).
+- **A lapsed window with anything unread.** While a record whose end has
+  passed is not yet closed and holds a queued step, a recorded stop or a
+  refused attempt, the prompt hook shows the person one line on every prompt
+  counting them and naming `abcd mode back`, until that verb closes the
+  record (dcn-2610181003474765).
+- **A refused attempt.** When the guard refuses an attempt to set the mode
+  (below), it records the time and the working copy in the store under the
+  lock, and the next prompt's line tells the person that a session tried and
+  that only they can set it; `abcd mode back` lists every attempt.
 - **Ending it.** `abcd mode back` prints the queue and the recorded stops,
   records who ended the mode and from which working copy, and ends the
   record; on a record whose time has passed it prints the same and closes it.
@@ -117,61 +159,187 @@ question tool.
   While the record holds, `abcd mode product-thinker` and `abcd mode
   facilitator` are refused, naming `abcd decide`.
 
+### Only the person sets it
+
+Setting the away mode hands sessions the right to push, so it must be the
+person's own act (dcn-2610181003456444, refining dcn-2610180913399042). The
+prompt hook cannot tell the person's message from one another session relays,
+so "on the person's word" cannot be checked, and a peer's relay on 2026-10-16
+would have let one agent give itself, and every copy, seven days of push
+rights. The guard closes the routes it can read, on the precedent of
+`abcd-source-ledger-flip`, which already leaves a person-only verb to the
+person:
+
+- **`abcd-away-mode-set`** (blocker, in the bundled registry): the program
+  `abcd`, subcommand `mode`, second subcommand `autonomous`, whatever its
+  flags. Matched by basename, it covers the binary on PATH and the plugin
+  root's; the guard already reads `sh -c` payloads and, under
+  adr-2610091150447054, a script file a shell runs, so a script that calls
+  it is refused too.
+- **The program's other spellings.** The matcher reads two more spellings of
+  the program as `abcd`, for every entry that names it: a built
+  `abcd-<goos>-<arch>` (what `make build` writes), and `go run <pkg>` whose
+  package path ends in `cmd/abcd`, optionally `@<version>`, with go's own
+  flags stepped over, the rest of the line being the program's arguments. So
+  `go run ./cmd/abcd mode autonomous` is refused by the same entry, and so
+  is a `go run` of the ledger flip, which commands/guard.md today names as
+  unseen.
+- **`abcd-away-store-write`** (blocker): a shell write whose resolved target
+  lies inside `~/.abcd.noindex/away/`, through a redirection or a writer the
+  guard lists (the list commands/guard.md names), or a delete of it. The
+  record, its lock and the branch lists are written only by abcd's own verbs
+  and hooks.
+- **The file tools** (`abcd-away-store-file-tool`, a refusal the hook
+  reports under that name, since registry entries read shell text only).
+  The plugin's PreToolUse matcher gains `Edit`, `Write`,
+  `MultiEdit` and `NotebookEdit`, and `abcd guard hook` refuses one whose
+  `file_path` (or `notebook_path`) resolves, `~` expanded and symlinks
+  followed, inside `~/.abcd.noindex/away/`; every other path is allowed with
+  no further reading. This adds one hook start to each file-tool call, as the
+  shell tool already pays.
+- **The refusal's words.** The why: setting the away mode hands every
+  session on this machine the right to push, so it is the person's own act.
+  The successor: tell the person that you believe they asked for it and let
+  them run `abcd mode autonomous` themselves, with `!` in this session or at
+  a terminal. `abcd mode back` and `abcd mode queue` stay allowed: ending the
+  mode is the safe direction, and the queue only adds to what the person
+  reads.
+
+**A mistake filter, not a boundary.** The guard reads a command's text, so
+it stops an agent that follows refusals from granting itself the mode on a
+relayed word; it does not stop one that routes around it (another
+interpreter, a program, a copy of the binary under another name, the
+unseen spellings commands/guard.md lists), as adr-42 says of the whole parse
+layer, and as the decision of 2026-10-17 on the default branch says of the
+headless approver. The OS fence (spc-2610161751056096,
+adr-2610161621415708) makes it a boundary for the agents abcd's runner
+launches once it ships, since it confines their writes to abcd's home to
+their own worktree, so a launched role can write neither the store nor,
+through the binary, the record. It does not fence the person's own
+interactive session, which is where the stall happened.
+
+**Why that is enough for now.** The grant governs only an agent that
+follows refusals: one that ignores them can push without any mode, so no
+shape of the mode adds a boundary inside the person's own session. The
+rights are narrow, every push is reversible and visible on the forge, and
+the record (who set it and from which copy) and the refused attempts leave a
+trail the person reads on the next prompt and on `abcd mode back`.
+
+**What the mode grants.** The session commits and pushes its own branches
+and opens their pull requests, which is the owed work; merging follows the
+repository's own rule. Never: the default branch, a tag, a release cut,
+another person's pull request, a branch this copy only checked out to
+review, or a force push. The away block repeats the grant and the
+exclusions.
+
+**The fallback, if the capture breaks the premise.** If step 7 shows that a
+message relayed from another session can run as a `!` command, or that an
+agent's tool call can reach the host's shell mode, the mode grants no push
+rights at all and the person's own standing instruction stays the authority
+to push; the guard entries stay, since a mode set by mistake still silences
+questions. If step 7 shows only that the person's `!` command does pass the
+pre-tool hook, nothing changes but the docs: the person sets it at a
+terminal.
+
 ### Owed work
 
 Owed work is four kinds (dcn-2610180913416683, refined by
-dcn-2610180936568358 and dcn-2610180936571036):
+dcn-2610180936568358, dcn-2610180936571036 and, in review round 2,
+dcn-2610181003463367, dcn-2610181003467233, dcn-2610181003464379 and
+dcn-2610181003488355):
 
 1. a live reservation under this copy's key whose renewal is due, or whose
    work no open pull request carries yet;
-2. an open pull request of the session's own that is behind the default
-   branch or failing its checks;
+2. an open pull request of the session's own that is behind its base or
+   failing its checks;
 3. a branch of its own with commits not pushed;
 4. a branch of its own stacked on a change that is still open, while it
    needs work (the clearing rule below).
 
-- **What "own" means.** A branch other than the default branch is the
-  session's own when any of these holds, with no window bound:
-  - this working copy's HEAD reflog has checked it out at any time;
+- **What "own" means.** A branch is the session's own when one of these
+  holds (dcn-2610181003463367):
+  - this working copy's HEAD reflog has checked it out;
+  - the session created it: when the guard's pre-tool hook sees this session
+    run `git worktree add -b|-B <b>`, `git switch -c|-C <b>` or `git checkout
+    -b|-B <b>`, and no branch named `<b>` exists yet, it records `<b>` under
+    this copy's key in the away store, under the store's lock, whether or not
+    the person is away. This is how the stacked drain branches of 2026-10-17
+    (`feat/drain-step11` and its siblings) are seen: cut with a plain `git
+    worktree add`, they had no upstream, no entry in this copy's reflog, no
+    run state and no record id in their names. A record made for a command
+    that then failed names a branch that does not exist, and is ignored;
   - it is the branch of a lane in a run state this copy's local tier holds
-    (`.abcd/.work.local/run/<run-id>/state.json`, whose lanes `build` and
-    `drain` cut with `git worktree add`, so they never reach this copy's
-    reflog);
+    (`.abcd/.work.local/run/<run-id>/state.json`), while that run's
+    reservation is live under this copy's key;
   - it is the head branch of an open pull request linked to a reservation
-    under this copy's key.
-
-  A sibling copy's branch is none of these, so it never holds this session.
-- **The reservation filter and link.** A reservation counts only when its
-  copy key is this copy's (the view's `Copy == CopyThis`). A pull request
-  carries a reservation's work when the record id appears in its head
-  branch's name or on a `Refs:`, `Resolves:` or `Delivers:` line of its body.
-  A renewal is due halfway between the reservation's latest claim or renewal
-  and its expiry.
+    under this copy's key (the link below).
+- **Live, not stale.** A branch owned through the reflog or a recorded
+  creation counts only while it holds a commit authored by this checkout's
+  `user.email` within the last 14 days, or a live reservation under this
+  copy's key links it. A finished or abandoned run's lanes never count. So
+  the five lanes of 2026-10-12 this checkout still holds, from runs that
+  stopped at implement and never landed, are not owed forever, and the
+  nothing-owed row stays reachable.
+- **Never own.** The default branch; a tag; a branch whose open pull request
+  another person authored (the listing's author is not the person); and a
+  branch this copy only checked out to review, which the authorship rule
+  above leaves out, since it holds none of this checkout's commits. A
+  sibling copy's branch is none of the routes above, so it never holds this
+  session.
+- **The reservation filter and link** (dcn-2610181003467233). A reservation
+  counts only when its copy key is this copy's (the view's `Copy ==
+  CopyThis`). A pull request carries a reservation's work when the record id
+  appears in its head branch's name or on a `Resolves:` or `Delivers:` line
+  of its body, matched on word boundaries, so iss-5 never matches iss-50. A
+  `Refs:` line, which the issue-resolution gate (RS004) requires of any pull
+  request that only names an issue, carries the work only when the head
+  branch is already own by another route, and never makes a branch own: a
+  sibling copy's pull request that mentions the record neither leaves this
+  session waiting nor becomes its branch. A renewal is due halfway between
+  the reservation's latest claim or renewal and its expiry.
+- **Behind** (dcn-2610181003464379). While away, a pull request is behind
+  when the listing's merge state (`mergeStateStatus`) is `BEHIND`, which the
+  forge measures against its base as it stands now, not against the
+  last-fetched default branch, which nothing refreshes overnight. Only a
+  branch with no pull request is compared on disk, with the last-fetched
+  default branch, and the reason names when that ref was last fetched.
 - **Finding a stacked branch.** An own branch is stacked when its open pull
   request's base is not the default branch, or, with no pull request, when
   the nearest other own branch whose tip is an ancestor of its tip is not
   contained in the last-fetched default branch.
-- **The clearing rule for a stacked branch.** One whose base is still open is
-  owed only while it is behind its base's tip or behind the last-fetched
-  default branch, its checks are failing, or no preflight receipt names its
-  head in any worktree (`landing.Receipt`). Otherwise it is waiting on its
-  base, which is not owed: only its landing waits.
+- **The clearing rule for a stacked branch** (dcn-2610180936571036, refined
+  by dcn-2610181003488355). One whose base is still open is owed only while
+  any of these holds: it is behind its base (its merge state, or with no
+  pull request its base's tip on disk); its checks are failing; a review of
+  its head is outstanding (the listing's review decision is
+  `CHANGES_REQUESTED`, or for a run's lane its run state records no passing
+  review of its head), since the coordination prep's decision that a
+  declared dependency constrains only the landing says its review runs now;
+  or it is not verified. Verified means a preflight receipt naming its head
+  in any worktree (`landing.Receipt`) where the repository mints receipts
+  (a receipt folder exists in one of its worktrees); in a repository without
+  them, its pull request's checks passing in the listing; with no pull
+  request there either, it is judged on the other conditions alone and the
+  reason says it was not verified. Otherwise it is waiting on its base,
+  which is not owed: only its landing waits.
 - **Unpushed.** An own branch with commits not on its upstream, or, with no
   upstream configured, not in any remote-tracking ref. A branch whose
   upstream is gone (merged and deleted on the remote, a squash merge
   included) never counts.
-- **What is read, and when (invariant 7).** While the person is present the
-  check reads disk only: renewals due (reservations as last fetched,
-  `claim.LastFetched`) and unpushed own branches. It never calls the forge,
-  so no turn's end touches the network. While away it adds at most one `gh pr
-  list` of the person's open pull requests (head and base branch, body, merge
-  state, check rollup) under a ten-second deadline, cached in the local tier:
-  a listing younger than ten minutes is reused, not repeated, so eight blocks
-  in a row cost one call; on a failure or timeout a cached listing younger
-  than half the default lease is used with its age named, else the disk
-  kinds alone with the pull requests named as not read. "Behind" is measured
-  against the last-fetched default branch. Brief invariant 7 gains this
-  listing as the away mode's documented meaning, as the drain's listing is.
+- **What is read, and when (invariant 7,
+  adr-2610181003541997).** While the person is present the check reads disk
+  only: renewals due (reservations as last fetched, `claim.LastFetched`) and
+  unpushed own branches. It never calls the forge, so no turn's end touches
+  the network. While away it adds at most one `gh pr list` of the person's
+  open pull requests (head and base branch, author, body, merge state,
+  review decision, check rollup; each field among those
+  `internal/ghcontract` pins) under a ten-second deadline, cached in the
+  local tier: a listing younger than ten minutes is reused, not repeated, so
+  eight blocks in a row cost one call; on a failure or timeout a cached
+  listing younger than half the default lease is used with its age named,
+  else the disk kinds alone with the pull requests named as not read. Brief
+  invariant 7 gains this listing as the away mode's documented meaning, as
+  the drain's listing is, by adr-2610181003541997.
 - **Order.** The next item is the first of: a renewal due, a failing pull
   request, a behind one, a stacked branch, an unpushed branch, unhanded work.
 
@@ -186,17 +354,35 @@ and no qualifying wake; "stopped" happens only when the host's cap overrides
 a block, and is then recorded. Stopped is allowed, and flagged, only while
 the person is present.
 
-**The qualifying wake** (dcn-2610180936579498). A `session_crons` entry
-qualifies when the next time its schedule matches after now, read in the
-machine's local time, is no later than the deadline: the earliest renewal due
-among the live reservations under this copy's key, minus `lease.Skew`; or,
-with none held, now plus half of `lease.Default`. The next fire time comes
-from a five-field cron parser of abcd's own (minute, hour, day of month,
-month, day of week; lists, ranges, steps and `*`; when both day fields are
-restricted, either matches, as cron does), which steps minute by minute from
-now to the deadline, at most a day's minutes since `lease.Max` is a day. An
-expression it cannot parse never qualifies. A background task never counts
-on its own while away. No new dependency.
+**The deadline** (dcn-2610181003455731, refining dcn-2610180936579498). The
+earlier of: the earliest renewal due among the live reservations under this
+copy's key, minus `lease.Skew`; and now plus a ceiling, 30 minutes while work
+is owed and one hour when none is. The ceiling closes the long-lease hole: a
+release reservation's 24-hour lease puts its renewal 12 hours on, and a
+`0 7 * * *` cron seen at 21:00 would otherwise qualify and leave the session
+idle for ten hours with work owed.
+
+**The qualifying wake.** A `session_crons` entry qualifies when its latest
+fire time is no later than the deadline. The latest fire time is the next
+time its schedule matches after now, read in the machine's local time as the
+host reads it, plus the most the host may run it late: for a recurring task,
+half the gap from that match to the following one, at most 30 minutes, and
+nothing for exactly `*/5 * * * *`; a one-shot task is taken as matched, since
+the host only runs one early. So an hourly cron whose next match is 3 minutes
+before the deadline does not qualify (it may run 30 minutes late), and with
+owed work the longest a session can wait is the 30-minute ceiling.
+
+The next fire time comes from a five-field cron parser of abcd's own (minute,
+hour, day of month, month, day of week; lists, ranges, steps, `a-b/n` and
+`*`; 7 is Sunday as 0 is). It follows vixie cron, as the host says it does:
+when both day fields are restricted either matches, and a day field written
+from `*` (`*/n` included) counts as unrestricted for that rule. It steps
+minute by minute in absolute time, converting each minute to local wall-clock
+time, from now to the deadline plus an hour (for the following match), so at
+most a few hundred steps; a wall-clock minute skipped by a daylight-saving
+change never matches, and one repeated by it matches at its first
+occurrence. An expression it cannot parse never qualifies. A background task
+never counts on its own while away. No new dependency.
 
 **The session's state.** One file per session id in the local tier
 (`.abcd/.work.local/autonomy/sessions/<session-id>.json`; an id outside
@@ -216,14 +402,18 @@ While away, the rows are read in order and the first that matches decides:
 | 6 | none owed, no qualifying wake | block: take the next ready item first (reserve it), and only if none can be taken alone, schedule a look before the deadline (working) |
 
 - **`stop_hook_active`** decides no row, so both values are covered by every
-  row, the old missing row (owed, unchanged, `false`) included. It drives the
-  count: a block with it `false` sets the count to one, and with it `true`
-  adds one; a changed fingerprint also resets it. The block whose count
-  passes the cap (eight, or `CLAUDE_CODE_STOP_HOOK_BLOCK_CAP` when set)
-  records "stopped with work owed" (rows 2 and 4) or "stopped with no next
-  look" (row 6) in the away record, since the host will override it. The
-  host's count resets on a tool call abcd cannot see, so abcd's count errs
-  toward recording a stop that did not happen, never toward missing one.
+  row. It alone drives the count (dcn-2610181003484631, refining
+  dcn-2610180936577720): a block with it `false` sets the count to one, and
+  with it `true` adds one. A change in the owed set no longer resets the
+  count, since the host's count does not: in the round-2 scenario a renewal
+  falling due at the sixth block would have reset abcd to one, and the host's
+  override at its ninth would have found abcd at three, unrecorded. The block
+  whose count passes the cap (eight, or `CLAUDE_CODE_STOP_HOOK_BLOCK_CAP`
+  when set) records "stopped with work owed" (rows 2 and 4) or "stopped with
+  no next look" (row 6) in the away record, labelled "possibly forced by the
+  cap", because the host's count also resets on a tool call abcd cannot see.
+  The count so errs toward recording a stop that did not happen, never
+  toward missing one, and step 7 checks where the host's count resets.
 - **Present.** With owed work (the disk kinds only), allow with a
   `systemMessage` naming the work (stopped, flagged); with none, allow
   silently. No forge call.
@@ -242,101 +432,202 @@ While away, the rows are read in order and the first that matches decides:
 record first. While it holds, it denies every question-tool call, abcd's or
 another tool's, with one reason whatever the chip (dcn-2610180937177502).
 The classification is by the act asked about, which the reason lists, so the
-agent routes it:
+agent routes it (dcn-2610181003477194):
 
 - **Queued for the person** with `abcd mode queue "<step>"`, carrying on with
   other work meanwhile, is a question about an act only the person may
   approve:
-  - an approval the repository binds to the person per act: an embargo
-    close's `--approve <digest>`, which `commands/embargo.md` says is passed
-    only after the person, in this session, has read the text and said yes,
-    and never supplied on the agent's own; a release sign-off;
-  - publishing anything, or changing a repository's visibility;
+  - an approval or ruling the repository binds to the person per act: an
+    embargo close's `--approve <digest>`, which `commands/embargo.md` says is
+    passed only after the person, in this session, has read the text and
+    said yes, and never supplied on the agent's own; the embargo triage
+    verdict ("the verdict is the person's decision", `commands/embargo.md`);
+    the drain's hand-back ("a hand-back is a person's decision",
+    `commands/drain.md`); the confirmed apply verb for remote configuration
+    (brief invariant 10); a release sign-off;
+  - a push or merge beyond the session's own branches: the default branch, a
+    tag, a release cut, another person's pull request, a branch only checked
+    out to review;
+  - publishing anything, changing a repository's visibility, or posting a
+    comment or message outward, other than the session's own pull request;
   - adding a dependency;
   - a secret, a credential or an App;
   - a step only a website or a browser can do;
   - a destructive act: deleting what the session did not create, overwriting
     uncommitted work, a force push, discarding a peer's work;
-  - anything that spends money.
+  - anything that spends money;
+  - any other act a command page or a brief invariant names as the person's.
 - **Decided and recorded** with `abcd decide`, with its grounds and how to
   reverse it, is every other question.
 
-The away mode, set on the person's word, is their ask for the session to
-commit and push its own branches and open their pull requests, which is the
-owed work; merging follows the repository's own rule. The away block repeats
-the list. No mode is set and no question is marked open.
+**A release sign-off** is a cut, or a step of one, that asks for the person
+by name, or that no standing instruction of theirs allows. A standing
+permission for automatic cuts stands; the away mode adds none.
+
+**Nothing detects the act mechanically.** The agent classifies its own
+question from the refusal's list, and the guard's existing entries enforce
+only what they name, a force push and a skipped hook among them; the rest of
+the list rests on the agent following it, as the person-only rules on the
+command pages already do.
+
+What the mode grants is stated under "Only the person sets it" above, and
+the away block repeats the grant, the exclusions and this list. No mode is
+set and no question is marked open.
 
 ## Footprint
 
-- packages: internal/core/autonomy, internal/core/mode, internal/surface/cli, hooks, commands/mode.md, .abcd/development/brief/02-constraints/03-invariants.md, .abcd/development/brief/04-surfaces/08-abcd.md, .abcd/development/brief/04-surfaces/17-guard.md
-- tests: internal/core/autonomy, internal/core/mode, internal/surface/cli
+- packages: internal/core/autonomy, internal/core/mode, internal/core/guard, internal/surface/cli, hooks, commands/mode.md, commands/guard.md, .abcd/development/brief/02-constraints/03-invariants.md, .abcd/development/brief/04-surfaces/08-abcd.md, .abcd/development/brief/04-surfaces/17-guard.md
+- tests: internal/core/autonomy, internal/core/mode, internal/core/guard, internal/surface/cli
 
 ## Steps
 
-1. The away record, its lock and its verbs
+1. The away record, its store, its lock and its verbs
    - packages: internal/core/autonomy, internal/core/mode, internal/surface/cli, commands/mode.md, .abcd/development/brief/04-surfaces/08-abcd.md
    - tests: internal/core/autonomy, internal/core/mode, internal/surface/cli
    - Watched failing first: TestAwayRecordSharedAcrossWorktrees (`abcd mode
-     autonomous --until 09:00` writes one record a sibling worktree reads);
-     TestUntilClockTimeAndTimestamp; TestUntilRefusedPastOrNoTierOrNoCheckout
-     (nothing written); TestStaleRecordCapSevenDays (an open-ended record
-     reads as ended seven days on, and `--until` beyond that is refused);
-     TestModeBackPrintsQueueAndStopsAndRecordsEnder (also on a record whose
-     time has passed); TestRecordPastEndReadsEnded; TestQueueAppends;
+     autonomous --until 09:00` writes one record in the away store that a
+     sibling worktree reads); TestUntilClockTimeAndTimestamp;
+     TestUntilRefusedPastOrNoTierOrNoCheckout (nothing written);
+     TestStaleRecordCapSevenDays (an open-ended record reads as ended seven
+     days on, and `--until` beyond that is refused);
+     TestModeBackPrintsQueueStopsAndAttempts (the queue, the recorded stops
+     with their "possibly forced by the cap" label and the refused attempts,
+     and the ender and copy recorded; also on a record whose time has
+     passed); TestRecordPastEndReadsEnded; TestQueueAppends;
      TestConcurrentWritesUnderLock (two `mode queue` calls racing keep both
-     steps, and a stop recorded after `mode back` re-reads inside the lock and
-     does not turn the mode back on); TestRecordOwnershipFailsOpen (a record
-     or lock that is a symlink, not this account's, writable by others, or
-     over 64 KiB reads as not away, and a verb refuses naming it);
-     TestBadgeRefusedWhileAway; the badge's three-word vocabulary test passes
-     unchanged. The plugin page and the brief's `abcd mode` surface text
-     describe the three verbs, and `go generate ./internal/surface/cli`
+     steps, and a stop recorded after `mode back` re-reads inside the lock
+     and does not turn the mode back on); TestRecordOwnershipFailsOpen (a
+     record or lock that is a symlink, not this account's, writable by
+     others, or over 64 KiB reads as not away, and a verb refuses naming
+     it); TestAttemptRecordedUnderLock (an attempt appended while away and
+     while not, kept by a racing `mode queue`); TestBadgeRefusedWhileAway;
+     the badge's three-word vocabulary test passes unchanged. The plugin page
+     and the brief's `abcd mode` surface text describe the three verbs, say
+     that only the person runs `abcd mode autonomous` and list what the mode
+     grants and never grants, and `go generate ./internal/surface/cli`
      refreshes the derived appendix.
-2. Repeated to the agent, shown to the person
+2. Only the person sets it: the guard entries and the branch recorder
+   - packages: internal/core/guard, internal/surface/cli, hooks, commands/guard.md, .abcd/development/brief/04-surfaces/17-guard.md
+   - tests: internal/core/guard, internal/surface/cli
+   - Watched failing first: TestAwayModeSetIsLeftToThePerson
+     (`abcd-away-mode-set` blocks `abcd mode autonomous`, with
+     `--until 09:00` and `--json`, `"$CLAUDE_PLUGIN_ROOT"/abcd mode
+     autonomous`, `sh -c 'abcd mode autonomous'` and `bin/abcd-darwin-arm64
+     mode autonomous`, and allows `abcd mode back`, `abcd mode queue "x"`,
+     `abcd mode`, `abcd mode facilitator` and `abcd capture "an agent ran
+     abcd mode autonomous"`); TestGoRunOfAbcdReadAsAbcd (`go run ./cmd/abcd
+     mode autonomous`, `go run -race ./cmd/abcd mode autonomous` and `go run
+     github.com/intentdriven/abcd/cmd/abcd@v1.2.3 mode autonomous` block,
+     and so does `go run ./cmd/abcd library ledger --flip 3`, while `go run
+     ./cmd/abcd mode back` and `go run ./cmd/other mode autonomous` allow);
+     TestAwayModeSetInAScriptFile (a script a shell runs that calls it is
+     refused, under the existing script reading); TestAwayStoreShellWrite
+     (`printf '{}' > ~/.abcd.noindex/away/x/away.json`, `tee`, `cp` and
+     `rm` into the store block; a write elsewhere under `~/.abcd.noindex/`
+     allows); TestGuardHookFileToolAwayStore (`abcd-away-store-file-tool`:
+     `Write`, `Edit`, `MultiEdit` and `NotebookEdit` on a path in the store, through `~` and through a
+     symlink, are denied, and on any other path allowed without reading the
+     store); TestGuardRefusalRecordsAttempt (a refusal by either away entry
+     appends an attempt under the lock, and fails open with a stderr line
+     when the store cannot be written); TestBranchRecorderOnCreate (`git
+     worktree add -b feat/x ../x`, `git switch -c feat/y` and `git checkout
+     -B feat/z` record the branch under this copy's key only when no branch
+     of that name exists, and `git checkout -b main` on an existing `main`
+     records nothing); the registry's fixture test covers the new entries'
+     known-bad and known-good lines; `hooks/hooks.json`'s PreToolUse matcher
+     gains the four file tools and the hook-shape tests cover it.
+     commands/guard.md names the entries, the `go run` and built-binary
+     spellings, and what stays unseen; the brief's guard chapter says the
+     same.
+3. Repeated to the agent, shown to the person
    - packages: internal/surface/cli
    - tests: internal/surface/cli
    - Watched failing first: TestSessionStartAwayBlockEverySource (`startup`,
      `resume` and `compact` print the away block while the record holds,
-     nothing when it does not, and the block carries the person-only act list
-     and the rule to run `abcd mode back` only on the person's word);
-     TestPromptRouterAwayBlockEveryPrompt (a second prompt in the same session
-     too, outside the loader's dedup ledger); TestPromptRouterAwaySystemMessage
-     (one line the person sees on every prompt while it holds); both inside
-     the hook's existing deadline.
-3. Owed work, and invariant 7's clause
+     nothing when it does not, and the block carries what the mode grants,
+     its exclusions, the person-only act list and the rule to run `abcd mode
+     back` only on the person's word); TestPromptRouterAwayBlockEveryPrompt
+     (a second prompt in the same session too, outside the loader's dedup
+     ledger); TestPromptRouterAwaySystemMessage (one line the person sees on
+     every prompt while it holds, carrying the literal `abcd mode back`);
+     TestPromptRouterLapsedWindowLine (a lapsed, unclosed record with a
+     queued step, a recorded stop or an attempt shows one line naming `abcd
+     mode back` on every prompt until `mode back` closes it, and one with
+     none shows nothing); TestPromptRouterAttemptLine (an attempt recorded
+     since the last line is shown once, while away and while not); all
+     inside the hook's existing deadline.
+4. Owed work, and invariant 7's clause
    - packages: internal/core/autonomy, .abcd/development/brief/02-constraints/03-invariants.md
    - tests: internal/core/autonomy
    - Watched failing first, against real git repositories in temp folders
      and a fake forge listing pinned to `internal/ghcontract`'s fields:
      TestOwnBranchFromReflogWithoutWindow (checked out before the mode was
-     set, still own); TestOwnBranchFromRunLane (a lane cut with `git worktree
-     add`, absent from this copy's reflog, is own);
-     TestOwnBranchFromLinkedReservation; TestSiblingBranchNotOwn;
+     set, with a recent commit of this checkout's, still own);
+     TestOwnBranchFromRecordedCreation (a branch cut with `git worktree add
+     -b`, absent from this copy's reflog, with no upstream and no record id,
+     is own once recorded); TestOwnBranchFromLiveRunLane (a lane of a run
+     whose reservation is live under this copy's key is own; a lane of a run
+     whose reservation lapsed, or of a finished run, is not);
+     TestOwnBranchFromLinkedReservation; TestStaleOwnBranchNotOwed (a
+     reflog or recorded branch whose newest commit of this checkout's is
+     older than 14 days, with no live reservation, is not owed);
+     TestReviewCheckoutNotOwn (a branch checked out to review, holding only
+     another author's commits, and the head of a pull request another person
+     authored, are never own); TestSiblingBranchNotOwn;
      TestReservationCopyKeyFilter (a sibling copy's live reservation is not
-     owed); TestReservationPullRequestLink (record id in the head branch or a
-     `Refs:`/`Resolves:`/`Delivers:` body line; a green linked pull request is
-     not owed until renewal is due); TestStackedBranchFoundWithoutPullRequest;
-     TestStackedBranchClearingRule (owed while behind its base or the default
-     branch, failing, or without a receipt; waiting on its base otherwise);
-     TestUnpushedSkipsGoneUpstream (a squash-merged branch whose upstream is
-     gone is not owed); TestPresentReadsDiskOnly (zero forge calls while
-     present); TestForgeListingDeadlineAndCache (a hung listing ends at ten
-     seconds; a listing younger than ten minutes is reused; a stale cache
-     falls back with its age named, else the disk kinds and a "not read"
-     note); TestOwedOrderFixed. Brief invariant 7 gains the away mode's one
-     listing per check, its deadline and its cache.
-4. The stop verdict, the Stop and StopFailure hooks
+     owed); TestReservationLinkByHeadOrClosingTrailer (the record id in the
+     head branch or a `Resolves:`/`Delivers:` line links; a green linked
+     pull request is not owed until renewal is due);
+     TestRecordIDWordBoundary (iss-5 does not match iss-50 in a branch name
+     or a trailer); TestRefsLineCarriesOnlyOwnBranch (a `Refs:` line on a
+     sibling copy's pull request neither carries the work nor makes its
+     branch own; on an own branch's pull request it carries it);
+     TestBehindFromMergeState (a pull request whose merge state is `BEHIND`
+     is owed while the local default branch is stale and shows it current;
+     one `CLEAN` is not); TestStackedBranchFoundWithoutPullRequest;
+     TestStackedBranchClearingRule (owed while behind its base, failing,
+     with a review outstanding, or unverified; waiting on its base
+     otherwise); TestClearingRuleReview (`CHANGES_REQUESTED` in the listing,
+     and a run lane with no passing review of its head, are owed);
+     TestClearingRuleWithoutReceipts (in a repository with no receipt
+     folder, passing checks verify; with no pull request the reason says it
+     was not verified); TestUnpushedSkipsGoneUpstream (a squash-merged
+     branch whose upstream is gone is not owed); TestPresentReadsDiskOnly
+     (zero forge calls while present); TestForgeListingDeadlineAndCache (a
+     hung listing ends at ten seconds; a listing younger than ten minutes is
+     reused; a stale cache falls back with its age named, else the disk
+     kinds and a "not read" note); TestOwedOrderFixed. Brief invariant 7
+     gains the away mode's one listing per check, its deadline and its
+     cache, citing adr-2610181003541997.
+5. The stop verdict, the Stop and StopFailure hooks
    - packages: internal/core/autonomy, internal/surface/cli, hooks
    - tests: internal/core/autonomy, internal/surface/cli
    - Watched failing first: TestJudgeRows (each of the six away rows and both
      present rows, each with `stop_hook_active` true and false);
      TestJudgeEscapeBoundReproducesNoStall (owed, unchanged, `true`, no wake:
      blocked, not allowed); TestJudgeCapRecordsStop (the block passing the
-     cap, and an override from the environment, records the stop);
+     cap, and an override from the environment, records the stop labelled
+     "possibly forced by the cap"); TestCountResetsOnlyOnInactive (a change
+     in the owed set at the sixth block does not reset the count, and the
+     ninth consecutive block still records the stop; a block with
+     `stop_hook_active` false sets it to one); TestDeadlineCeiling (with
+     work owed and no reservation, now plus 30 minutes; with nothing owed,
+     now plus one hour; with a renewal due sooner, that minus the skew);
      TestCronNextFire (lists, ranges, steps, both day fields, an unparsable
-     expression never qualifies); TestQualifyingWakeDistantCron (`0 9 * * *`
-     seen at 21:00 does not qualify); TestQualifyingWakeRecurringCron (`*/30 *
-     * * *` does); TestQualifyingWakeAfterLeaseLapse (a wake past the earliest
+     expression never qualifies); TestCronDayOfWeekSeven (7 matches Sunday
+     as 0 does); TestCronRangeStep (`10-50/20` matches minutes 10, 30 and
+     50); TestCronStarStepInDayField (`0 9 */2 * 1` matches only days that
+     are both odd-numbered and Monday, since a field written from `*` counts
+     as unrestricted, while `0 9 1 * 1` matches either);
+     TestCronDaylightSaving (in Europe/London, `30 1 * * *` has no match on
+     the spring-forward day and matches once, at its first occurrence, on
+     the fall-back day); TestQualifyingWakeDistantCron (a release
+     reservation with a 24-hour lease claimed at 20:00, and `0 7 * * *` seen
+     at 21:00: does not qualify); TestQualifyingWakeJitter (an hourly cron
+     whose next match is 3 minutes before the deadline does not qualify;
+     `*/5 * * * *` and `*/10 * * * *` do; a one-shot at the deadline does);
+     TestQualifyingWakeRecurringCron (`*/30 * * * *` with nothing owed
+     does); TestQualifyingWakeAfterLeaseLapse (a wake past the earliest
      renewal due minus the skew does not); TestBackgroundTaskNotAWake (a
      `shell` task running `sleep 36000` or a `tail -f` does not count);
      TestNextLookStored; TestProseQuestionBlockedOnce; TestNothingOwedReason
@@ -349,52 +640,73 @@ the list. No mode is set and no question is marked open.
      and `hooks/stop-failure.sh` take the same bootstrap and home checks as
      `hooks/subagent-stop.sh` (the hook-shape tests cover them); `go generate
      ./internal/surface/cli` refreshes the derived appendix.
-5. The question reroute
+6. The question reroute
    - packages: internal/surface/cli, internal/core/autonomy, .abcd/development/brief/04-surfaces/17-guard.md
    - tests: internal/surface/cli, internal/core/autonomy
    - Watched failing first: TestAwayQuestionDeniedOneReason (a Product-chip,
      a Tech-chip, a Setup-chip and an unchipped question, and another tool's,
      get the same reason); TestAwayReasonListsPersonOnlyActs (the reason
-     names every act in the list, the embargo `--approve` digest among them,
-     and the route to `abcd mode queue` for those and to `abcd decide` for
-     the rest); TestAwayQuestionSetsNoMode (no mode set, no marker written);
-     TestPresentQuestionGateUnchanged. The brief's guard chapter says what
-     the gate does while away.
-6. The live session capture
+     names every act in the list: the embargo `--approve` digest, the
+     embargo triage verdict, the drain's hand-back, the remote-configuration
+     apply verb, a release sign-off and its meaning, a push or merge beyond
+     the session's own branches, an outward comment or message, and the
+     catch-all; and the route to `abcd mode queue` for those and to `abcd
+     decide` for the rest); TestAwayQuestionSetsNoMode (no mode set, no
+     marker written); TestPresentQuestionGateUnchanged. The brief's guard
+     chapter says what the gate does while away, and that nothing detects
+     the act mechanically.
+7. The live session capture
    - packages: none (evidence only, kept in the local tier)
    - tests: a live Claude Code session with the plugin built from the branch
    - In a lab checkout, seed one behind pull request checked out before the
-     mode is set, one stacked branch made with `git worktree add` by a run,
-     and one unpushed branch; set `abcd mode autonomous --until` an hour
-     ahead, and record the transcript. It must show the away block on start
-     and the person's line; a manual `/compact` followed by the block again;
-     an attempted stop blocked naming the behind pull request; a reply with
-     no tool call blocked again rather than allowed; the stacked branch's
-     item; a cron set for the next morning refused as a wake and one inside
-     the deadline accepted; a question refused with the one reason; `abcd
-     mode back` printing the queue and the recorded stops. Repeat with the
-     mode off to show the stop allowed and flagged with no forge call.
-     Capture before and after the change on the same checkout, as the
-     release lesson on host fixes requires.
+     mode is set, one stacked branch made with `git worktree add -b` in the
+     session, and one unpushed branch, and record the transcript. It must
+     show: the agent's own `abcd mode autonomous` refused by the guard, and
+     `go run ./cmd/abcd mode autonomous` refused too, each attempt then
+     shown on the person's next prompt; the person's `!abcd mode autonomous
+     --until <an hour ahead>` running with no pre-tool hook call (a probe
+     hook the lab adds beside abcd's logs none for it), which settles whether the person can set it
+     from the session or must use a terminal; a message relayed from a
+     second session, starting with `!`, arriving as a prompt and not run as
+     a shell command, and whether that relay fires the prompt hook; the away
+     block on start and the person's line naming `abcd mode back`; a manual
+     `/compact` followed by the block again; an attempted stop blocked
+     naming the behind pull request; a reply with no tool call blocked
+     again rather than allowed; the stacked branch's item; a cron set for
+     the next morning refused as a wake and one inside the deadline
+     accepted, with abcd's computed fire time compared with the `next run`
+     the host's `CronList` row shows; nine blocks in a row with no tool
+     call, then the same with one tool call in between, to see where the
+     host's count resets; a question refused with the one reason; the
+     window left to lapse with a queued step, and the next prompt's line
+     naming `abcd mode back`; and `abcd mode back` printing the queue, the
+     recorded stops and the attempts. Repeat with the mode off to show the
+     stop allowed and flagged with no forge call. Capture before and after
+     the change on the same checkout, as the release lesson on host fixes
+     requires. If the relayed `!` runs as a shell command, or an agent's
+     tool call reaches shell mode, the plan falls back to a mode that grants
+     no push rights (dcn-2610181003456444) before it ships.
 
 ## Size
 
-Re-estimated in review round 1 at five working days, the risk sitting in
-step 3's reflog, run-state and forge reading and step 4's cron parser:
+Re-estimated in review round 2 at eight working days, up from five. The new
+step 2 (the guard entries, the `go run` spelling and the file-tool hook) is
+most of the growth; the rest is the ownership, link and review rules in step
+4, the deadline, jitter and cron cases in step 5, and the longer capture:
 
 | step | days |
 |---|---|
-| 1. The away record, its lock and its verbs | 0.75 |
-| 2. Repeated to the agent, shown to the person | 0.5 |
-| 3. Owed work, and invariant 7's clause | 1.5 |
-| 4. The stop verdict, the Stop and StopFailure hooks | 1.25 |
-| 5. The question reroute | 0.5 |
-| 6. The live session capture | 0.5 |
-| total | 5.0 |
-
-The first plan wrote no size down; the four-day figure the review was asked
-to check appears nowhere in it, and it would have covered steps 1 to 5 of
-that plan without the review's fixes.
+| 1. The away record, its store, its lock and its verbs | 1.0 |
+| 2. Only the person sets it: the guard entries and the branch recorder | 1.5 |
+| 3. Repeated to the agent, shown to the person | 0.75 |
+| 4. Owed work, and invariant 7's clause | 2.0 |
+| 5. The stop verdict, the Stop and StopFailure hooks | 1.5 |
+| 6. The question reroute | 0.5 |
+| 7. The live session capture | 0.75 |
+| total | 8.0 |
+
+Round 1 estimated five days for six steps; the first plan wrote no size
+down.
 
 ## Review round 1
 
@@ -419,3 +731,28 @@ handled:
 | 13 | a refused session can lift away mode for all | fixed in part: `abcd mode back` records who ended it and from which copy, and the away block allows it only on the person's word; showing it on return moved with the return report (dcn-2610180937181736, dcn-2610180937181929) |
 | size | no size written; five days more honest | fixed: re-estimated at five days, per step above |
 | split | move step 6 and the return half of step 5 | made: the return report, the status line, the bare print and their brief text moved to the checklist draft; kept here, because the slice's own behaviour needs them, are `abcd mode back` printing the queue, invariant 7's clause and the shipped verbs' docs (dcn-2610180937181929) |
+
+## Review round 2
+
+On 2026-10-18 an Opus and Sonnet pair re-reviewed the plan as frozen at
+d04bc92fc, with the verdict "fix the plan first". They found round 1's items
+2, 5, 6, 11, 12 and 13 fixed, item 7 sufficient, and items 8, 9 and 10
+narrowed by the findings below. Each item and how it was handled:
+
+| # | finding | handled |
+|---|---|---|
+| (a) | away mode as the person's ask to push is not safe: the prompt hook cannot tell a relayed message from the person's, so an agent could grant itself and every copy seven days of push rights | fixed: guard entries refuse every route to setting the mode the guard reads (the binary by any of its names, a `go run` of `cmd/abcd`, `sh -c`, a script file, a shell write into the away store, the file tools), so the person sets it with `!` or at a terminal; refused attempts are recorded and shown; the grant is narrow and its exclusions stated (never the default branch, a tag, a release cut, another person's pull request, a review-only branch, a force push); the guard is called a mistake filter, the OS fence the boundary for launched agents only; the capture checks the `!` path and a relayed `!`, with the no-push fallback named if they break the premise (dcn-2610181003456444) |
+| (b) | the cap count can miss a forced stop when the owed set changes | fixed: the count resets only on `stop_hook_active` false, a stop at the cap is labelled "possibly forced by the cap", and the capture checks where the host resets (dcn-2610181003484631) |
+| (c) | cron in local time is correct; add a capture check | fixed: the capture compares abcd's computed fire time with the host's listed next run (dcn-2610181003455731) |
+| 1 | the wake deadline still allows the stall, through long leases and the host's lateness | fixed: the deadline is the earlier of the renewal due minus the skew and now plus 30 minutes while owed (one hour when not); a recurring cron's fire time adds half its gap, at most 30 minutes; TestQualifyingWakeDistantCron is pinned to a 24-hour lease; daylight saving, day-of-week 7, `a-b/n` and `*/n` in a day field are tested (dcn-2610181003455731) |
+| 2 | "behind" is measured against a default branch nothing refreshes overnight | fixed: while away, behind is the listing's merge state; only a branch with no pull request is compared on disk, naming the fetch time (dcn-2610181003464379) |
+| 3 | instance 2 is still missed: the stacked drain branches have no upstream, reflog entry, run state or record id | fixed: the pre-tool hook records a branch the session creates (`git worktree add -b`, `git switch -c`, `git checkout -b`) under this copy's key in the away store, only when no branch of that name exists; the capture seeds one (dcn-2610181003463367) |
+| 4 | a `Refs:` line is a mention, not a carrier, and iss-5 matches iss-50 | fixed: linked by head branch, `Resolves:` or `Delivers:` on word boundaries; a `Refs:` line carries only for an already-own branch and never confers ownership (dcn-2610181003467233) |
+| 5 | stale ownership leaves abandoned lanes and pruned branches owed forever | fixed: a run lane counts only while its run's reservation is live under this copy's key, finished runs' lanes never; a reflog or recorded branch only with a commit of this checkout's in the last 14 days or a live linked reservation (dcn-2610181003463367) |
+| 6 | the person-only list is incomplete | fixed: the embargo triage verdict, the drain's hand-back, the remote-configuration apply verb, a push or merge beyond own branches, outward comments and messages, and a catch-all added; release sign-off defined beside the standing permission for automatic cuts; stated that nothing detects the act mechanically and the existing guards enforce only what they name (dcn-2610181003477194) |
+| 7 | the queue goes unread when the window lapses | fixed: a lapsed, unclosed record with anything unread shows a line naming `abcd mode back` on every prompt until closed, and the away line carries the literal verb (dcn-2610181003474765) |
+| minor | the clearing rule needs abcd's preflight receipt | fixed: where a repository mints no receipts, passing checks verify; with no pull request the reason says unverified (dcn-2610181003488355) |
+| minor | the clearing rule leaves out review | fixed: an outstanding review (`CHANGES_REQUESTED`, or a run lane with no passing review of its head) keeps a stacked branch owed (dcn-2610181003488355) |
+| minor | the intent still lists a superseded decision | fixed: dcn-2610180913431985 removed from the intent's list; its successor dcn-2610180937181929 stays |
+| minor | mint an ADR for the invariant 7 amendment | made: adr-2610181003541997, proposed |
+| size | not a finding; re-estimated for the fixes | eight working days, step by step above |
diff --git a/.abcd/work/decisions/dcn-2610181003455731-a-wake-qualifies-only-when-it-fires-the.md b/.abcd/work/decisions/dcn-2610181003455731-a-wake-qualifies-only-when-it-fires-the.md
new file mode 100644
index 0000000000..a934003fed
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610181003455731-a-wake-qualifies-only-when-it-fires-the.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610181003455731
+slug: a-wake-qualifies-only-when-it-fires-the
+date: 2026-10-18
+---
+2026-10-18 — A wake qualifies only when it fires, the host's lateness included, within a short ceiling (facilitator-on-delegation, itd-2610180912189125 review round 2, blocker 1 and choice (c); refines dcn-2610180936579498): the deadline is the earlier of the earliest renewal due among this copy's live reservations minus lease.Skew, and now plus a ceiling of 30 minutes while work is owed or one hour when none is, because a release reservation's 24-hour lease put its renewal 12 hours on and let a 07:00 cron seen at 21:00 qualify. The fire time compared with it is the next match, read in the machine's local time, plus the latest the host may run it: for a recurring task, half the gap to its following match, at most 30 minutes, and nothing for `*/5 * * * *`; a one-shot task is taken as matched, since the host only ever runs one early. The parser follows vixie cron, as the host says it does: a day field written from `*` (`*/n`) counts as unrestricted for the either-day rule, 7 is Sunday as 0 is, and `a-b/n` steps a range. The live capture compares the computed fire time with the next run the host lists (grounds: plan review round 2, blocker 1 and choice (c); the host's scheduled-tasks page on jitter, local time and day-of-week; the release reservation's default lease in the reserve verb)
diff --git a/.abcd/work/decisions/dcn-2610181003456444-only-the-person-sets-the-away-mode-its.md b/.abcd/work/decisions/dcn-2610181003456444-only-the-person-sets-the-away-mode-its.md
new file mode 100644
index 0000000000..c5e9b564da
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610181003456444-only-the-person-sets-the-away-mode-its.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610181003456444
+slug: only-the-person-sets-the-away-mode-its
+date: 2026-10-18
+---
+2026-10-18 — Only the person sets the away mode, its push rights are narrow, and the guard's refusal is a mistake filter (facilitator-on-delegation, itd-2610180912189125 review round 2, choice (a); refines dcn-2610180913399042, replacing its clause that an agent sets the mode on the person's word): the prompt hook cannot tell the person's message from one another session relays, and its input names no origin, so a relayed word could let an agent grant itself, and every copy, push rights. So the guard refuses every route to setting the mode that it reads: `abcd mode autonomous` by the binary on PATH, the plugin root's binary or a built `abcd-<goos>-<arch>`; a `go run` of a package ending in `cmd/abcd`; any of them inside `sh -c` or in a script file a shell runs (adr-2610091150447054); a shell write into the away store under `~/.abcd.noindex/away/`; and an Edit or Write tool call on a path inside it. The person sets the mode with their own `!` command, which the host runs directly without going through Claude and so without the pre-tool hook, or at a terminal. A refused attempt is recorded in the store and shown to the person on the next prompt. What the mode grants is the session committing and pushing its own branches and opening their pull requests; never the default branch, a tag, a release cut, another person's pull request, a branch this copy only checked out to review, or a force push; merging follows the repository's own rule. This is chosen over the fallback, and is enough for now, because the grant only governs an agent that follows refusals: one that ignores them can push without any mode, so no shape of the mode adds a boundary inside the person's own session; the guard stops a refusal-following agent from granting itself on a relayed word; the rights are narrow, and every push is reversible and visible on the forge; and the record (who set it and from which copy) and the recorded refusals leave a trail the person reads on return. The guard stays a mistake filter (adr-42, and the decision of 2026-10-17 on the default branch that keeps the headless approver one, naming the OS fence as the boundary). That fence (spc-2610161751056096) is the boundary only for agents abcd's runner launches, whose writes to abcd's home it confines to their own worktree; it does not fence the person's own interactive session, where the stall happened, so there the narrow grant and the trail are the mitigation. The fallback (the mode grants no push rights, and the person's own standing instruction stays the authority to push) applies instead if the live capture shows that a message relayed from another session can run as a `!` command, or that an agent's tool call can reach the host's shell mode (grounds: plan review round 2, choice (a), and the coordinator's two addenda; the host's interactive-mode page, which says shell mode runs commands directly without going through Claude and outside the sandbox that applies to Claude's commands; the abcd-source-ledger-flip guard entry; adr-2610161621415708)
diff --git a/.abcd/work/decisions/dcn-2610181003463367-a-branch-is-the-session-s-own-only-while.md b/.abcd/work/decisions/dcn-2610181003463367-a-branch-is-the-session-s-own-only-while.md
new file mode 100644
index 0000000000..610fb59002
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610181003463367-a-branch-is-the-session-s-own-only-while.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610181003463367
+slug: a-branch-is-the-session-s-own-only-while
+date: 2026-10-18
+---
+2026-10-18 — A branch is the session's own only while it is live and this copy's, and a branch the session creates is recorded as its own (facilitator-on-delegation, itd-2610180912189125 review round 2, blockers 3 and 5 and choice (a)'s exclusions; refines dcn-2610180936568358): when the guard's pre-tool hook sees this session run `git worktree add -b|-B <b>`, `git switch -c|-C <b>` or `git checkout -b|-B <b>`, it records `<b>` under this copy's key in the away store, under its lock, and only when no branch of that name exists yet, whether or not the person is away, because the stacked drain branches of 2026-10-17 were cut with a plain `git worktree add` before any window and carried no upstream, reflog entry, run state or record id. Stale ownership is bounded: a run's lane counts only while its run's reservation is live under this copy's key, and a finished or abandoned run's lanes never count; a branch owned through the reflog or a recorded creation counts only while it holds a commit authored by this checkout's `user.email` within the last 14 days, or a live reservation under this copy's key links it. Never own: the default branch, a tag, a branch whose open pull request another person authored, and a branch this copy only checked out to review, which the authorship rule leaves out (grounds: plan review round 2, blockers 3 and 5; lanes are cut from the default branch; the 60 run states and the five unlanded lanes of 2026-10-12 in this checkout)
diff --git a/.abcd/work/decisions/dcn-2610181003464379-while-the-person-is-away-a-pull-request.md b/.abcd/work/decisions/dcn-2610181003464379-while-the-person-is-away-a-pull-request.md
new file mode 100644
index 0000000000..f2d5fea567
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610181003464379-while-the-person-is-away-a-pull-request.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610181003464379
+slug: while-the-person-is-away-a-pull-request
+date: 2026-10-18
+---
+2026-10-18 — While the person is away, a pull request is behind when the forge says so (facilitator-on-delegation, itd-2610180912189125 review round 2, blocker 2; refines dcn-2610180936571036): the stop check reads "behind" from the merge state (`mergeStateStatus` BEHIND) in its one pull-request listing, not from the last-fetched default branch, which nothing refreshes overnight, so a pull request that fell behind after the last fetch still reads as owed. Only a branch with no pull request is compared on disk, and the reason names when that ref was last fetched (grounds: plan review round 2, blocker 2; the pinned pull-request fields in internal/ghcontract)
diff --git a/.abcd/work/decisions/dcn-2610181003467233-a-pull-request-carries-a-reservation-s.md b/.abcd/work/decisions/dcn-2610181003467233-a-pull-request-carries-a-reservation-s.md
new file mode 100644
index 0000000000..562b57a389
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610181003467233-a-pull-request-carries-a-reservation-s.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610181003467233
+slug: a-pull-request-carries-a-reservation-s
+date: 2026-10-18
+---
+2026-10-18 — A pull request carries a reservation's work only through its head branch or a closing trailer (facilitator-on-delegation, itd-2610180912189125 review round 2, blocker 4; refines dcn-2610180936568358): the link is the record id in the pull request's head branch name, or on a `Resolves:` or `Delivers:` line of its body, matched on word boundaries so that iss-5 never matches iss-50. A `Refs:` line, which the issue-resolution gate requires of any pull request that only names an issue, carries the work only when the head branch is already this copy's own by another route, and never makes a branch own, so a sibling copy's pull request that mentions the record neither leaves this session waiting nor becomes its branch (grounds: plan review round 2, blocker 4; the RS004 rule in scripts/check-issue-resolution.sh)
diff --git a/.abcd/work/decisions/dcn-2610181003474765-a-window-that-lapsed-with-anything.md b/.abcd/work/decisions/dcn-2610181003474765-a-window-that-lapsed-with-anything.md
new file mode 100644
index 0000000000..4be374bafe
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610181003474765-a-window-that-lapsed-with-anything.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610181003474765
+slug: a-window-that-lapsed-with-anything
+date: 2026-10-18
+---
+2026-10-18 — A window that lapsed with anything unread points the person at abcd mode back (facilitator-on-delegation, itd-2610180912189125 review round 2, blocker 7; refines dcn-2610180937181736): while a record whose end has passed is not yet closed and holds a queued step, a recorded stop or a refused attempt, the prompt hook shows the person one line on every prompt that counts them and names the literal `abcd mode back`, until that verb closes the record; the line shown while away carries the literal `abcd mode back` too, so the person never has to recall the verb (grounds: plan review round 2, blocker 7; dcn-2610180937181929, which kept the queue's print in the slice so that no queued step goes unread)
diff --git a/.abcd/work/decisions/dcn-2610181003477194-the-acts-only-the-person-may-approve-are.md b/.abcd/work/decisions/dcn-2610181003477194-the-acts-only-the-person-may-approve-are.md
new file mode 100644
index 0000000000..4a2b6841fc
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610181003477194-the-acts-only-the-person-may-approve-are.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610181003477194
+slug: the-acts-only-the-person-may-approve-are
+date: 2026-10-18
+---
+2026-10-18 — The acts only the person may approve are completed, end in a catch-all, and are classified by the agent (facilitator-on-delegation, itd-2610180912189125 review round 2, blocker 6; refines dcn-2610180937177502): the list the question reroute queues gains the embargo triage verdict (commands/embargo.md), the drain's hand-back (commands/drain.md), the confirmed apply verb for remote configuration (brief invariant 10), a push or merge beyond the session's own branches (the default branch, a tag, a release cut, another person's pull request, a branch only checked out to review), and a comment or message posted outward other than the session's own pull request, and it ends with any act a command page or a brief invariant names as the person's. A release sign-off is a cut, or a step of one, that asks for the person by name or that no standing instruction of theirs allows; a standing permission for automatic cuts stands, and the away mode adds none. Nothing detects the act mechanically: the agent classifies its own question from the refusal's list, and the guard's existing entries enforce only what they name, a force push and a skipped hook among them (grounds: plan review round 2, blocker 6; commands/embargo.md; commands/drain.md; brief invariant 10)
diff --git a/.abcd/work/decisions/dcn-2610181003484631-abcd-s-count-of-blocks-resets-only-when.md b/.abcd/work/decisions/dcn-2610181003484631-abcd-s-count-of-blocks-resets-only-when.md
new file mode 100644
index 0000000000..6ca7d2c046
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610181003484631-abcd-s-count-of-blocks-resets-only-when.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610181003484631
+slug: abcd-s-count-of-blocks-resets-only-when
+date: 2026-10-18
+---
+2026-10-18 — abcd's count of blocks resets only when the host is not already continuing (facilitator-on-delegation, itd-2610180912189125 review round 2, choice (b); refines dcn-2610180936577720): the count is set to one on a block with `stop_hook_active` false and adds one with it true; a change in the owed set no longer resets it, since the host's count does not, and a reset abcd made on one could leave a stop the host forced unrecorded. A stop recorded at the cap is labelled "possibly forced by the cap", because the host's count also resets on a tool call abcd cannot see, and the live capture checks where the host's count resets (grounds: plan review round 2, choice (b); the host's hooks page on the Stop cap)
diff --git a/.abcd/work/decisions/dcn-2610181003488355-a-stacked-branch-s-clearing-rule.md b/.abcd/work/decisions/dcn-2610181003488355-a-stacked-branch-s-clearing-rule.md
new file mode 100644
index 0000000000..6832c041be
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610181003488355-a-stacked-branch-s-clearing-rule.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610181003488355
+slug: a-stacked-branch-s-clearing-rule
+date: 2026-10-18
+---
+2026-10-18 — A stacked branch's clearing rule includes review and works without abcd's preflight (facilitator-on-delegation, itd-2610180912189125 review round 2, minor findings; refines dcn-2610180936571036): a stacked branch whose base is still open is also owed while a review of its head is outstanding, that is, while the away listing shows the forge's review decision as CHANGES_REQUESTED or, for a run's lane, its run state records no passing review of its head, since the coordination prep's decision that a declared dependency constrains only the landing says its review runs now. Verified means a preflight receipt naming its head where the repository mints receipts (a receipt folder exists in one of its worktrees); in a repository without them, its pull request's checks passing in the away listing; and with no pull request there either, the branch is judged on being behind and on review alone, and the reason says it was not verified (grounds: plan review round 2, minor findings; the receipt lookup in internal/core/landing)

From 600c109d6f20a3f3b86420e6053c53b2975f6d3f Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 11:23:00 +0100
Subject: [PATCH 07/58] docs: trim the overnight-stall plan to what closes the
 stall

The away mode now grants no push rights: the person's own standing
instruction decides what is committed, pushed and opened, as before, and
an owed item that needs a push is pushed only if that instruction allows,
otherwise queued and handed back for the window. The guard entries that
made setting the mode person-only, the guard's reading of go run and
built binaries as abcd, the forge listing's reuse cache and the fuller
mode back print move to the checklist draft as named remaining work. The
created-branch recorder, the ownership, link and stale rules, the wake
deadline, the merge-state reading and the person-only acts stay, so
round 2's blockers stay fixed. Re-estimated at 5.75 days over seven
steps, down from eight. Two decisions record it, the first superseding
round 2's choice (a); the invariant 7 ADR drops the cache while proposed.

Refs: itd-2610180912189125
Refs: itd-2610170638184486
Refs: iss-2610170619247185
Assisted-by: Claude:claude-opus-5-5
---
 ...97-the-away-mode-s-stop-check-reads-the.md |  17 +-
 ...every-abcd-session-keeps-a-checklist-on.md |  39 +-
 ...125-a-session-told-to-work-on-while-its.md |  89 +--
 ...489-a-session-told-to-work-on-while-its.md | 558 +++++++++---------
 ...the-away-mode-grants-no-push-rights-the.md |   6 +
 ...the-overnight-stall-slice-is-trimmed-to.md |   6 +
 6 files changed, 402 insertions(+), 313 deletions(-)
 create mode 100644 .abcd/work/decisions/dcn-2610181016510153-the-away-mode-grants-no-push-rights-the.md
 create mode 100644 .abcd/work/decisions/dcn-2610181017056307-the-overnight-stall-slice-is-trimmed-to.md

diff --git a/.abcd/development/decisions/adrs/2610181003541997-the-away-mode-s-stop-check-reads-the.md b/.abcd/development/decisions/adrs/2610181003541997-the-away-mode-s-stop-check-reads-the.md
index ce2ced0713..1186a4bd90 100644
--- a/.abcd/development/decisions/adrs/2610181003541997-the-away-mode-s-stop-check-reads-the.md
+++ b/.abcd/development/decisions/adrs/2610181003541997-the-away-mode-s-stop-check-reads-the.md
@@ -32,19 +32,20 @@ verb.
 
 ## Decision
 
-We will treat setting the away mode (`abcd mode autonomous`, which only the
-person runs) as invoking the stop check's forge read while the mode holds:
+We will treat setting the away mode (`abcd mode autonomous`, which the
+person runs or asks a session to run, and which grants no push rights,
+dcn-2610181016510153) as invoking the stop check's forge read while the mode holds:
 at most one pull-request listing of the person's open pull requests per
 check (head and base branch, author, body, merge state, review decision and
-check rollup), under a ten-second deadline, cached in the local tier and
-reused for ten minutes, so eight blocks in a row cost one call.
+check rollup), under a ten-second deadline. There is no cache, so a run of
+eight blocks costs up to eight listings, each bounded by the deadline; a
+reuse cache is remaining work of itd-2610170638184486 (dcn-2610181017056307).
 
 We will keep the check disk-only whenever the away mode does not hold: no
 turn's end while the person is present touches the network.
 
-We will name a failed or late read, never hide it: the check falls back to a
-cached listing younger than half the default lease, with its age named, or to
-the disk kinds alone with the pull requests named as not read.
+We will name a failed or late read, never hide it: the check falls back to
+the disk kinds alone, with the pull requests named as not read.
 
 We will add this listing to invariant 7 as the away mode's documented
 meaning, beside the drain's.
@@ -61,7 +62,7 @@ meaning, beside the drain's.
   cannot see checks, reviews or links, and it would run while the person is
   present unless also confined to the away mode.
 - **One listing per check while away, chosen.** One call, bounded in time,
-  cached, and only inside a window the person opened with their own command.
+  and only inside a window the person opened.
 
 ## Consequences
 
diff --git a/.abcd/development/intents/drafts/itd-2610170638184486-every-abcd-session-keeps-a-checklist-on.md b/.abcd/development/intents/drafts/itd-2610170638184486-every-abcd-session-keeps-a-checklist-on.md
index 5fc36efb9c..52b5691114 100644
--- a/.abcd/development/intents/drafts/itd-2610170638184486-every-abcd-session-keeps-a-checklist-on.md
+++ b/.abcd/development/intents/drafts/itd-2610170638184486-every-abcd-session-keeps-a-checklist-on.md
@@ -171,8 +171,10 @@ session's interview on 2026-10-17:
   away mode held by abcd and repeated at start, compaction and prompt, the
   stop check, and the question reroute, carved out on 2026-10-18 as the fix
   for iss-2610170619247185 so the security and bug-fix release waits on it
-  alone (dcn-2610180913379049, dcn-2610180913388445). This draft keeps the
-  rest and reuses the slice's away record and hook path.
+  alone (dcn-2610180913379049, dcn-2610180913388445). Its away mode grants
+  no rights; the person's standing instruction decides what is pushed
+  (dcn-2610181016510153). This draft keeps the rest and reuses the slice's
+  away record and hook path.
 - **Moved back from the first slice by its review round 1 (2026-10-18,
   dcn-2610180937181929), named remaining work of this draft:**
   - the report shown once on the first prompt after the away mode ends: the
@@ -188,7 +190,38 @@ session's interview on 2026-10-17:
   - the brief's surface text for these.
 
   The slice keeps `abcd mode back` printing the queue and the recorded stops,
-  so nothing queued goes unread meanwhile.
+  one plain line each, so nothing queued goes unread meanwhile.
+- **Moved back from the first slice by its trim after review round 2
+  (2026-10-18, dcn-2610181016510153 and dcn-2610181017056307, on the release
+  orchestrator's ruling), named remaining work of this draft:**
+  - making the away mode the person's act alone, should a later design give
+    it rights worth guarding: the guard entry refusing an agent's `abcd mode
+    autonomous` (the binary on PATH and the plugin root's), and its routes
+    through `sh -c` and a script file a shell runs; the shell-write refusal
+    on the away store under `~/.abcd.noindex/away/`; the file-tool refusal,
+    with the PreToolUse matcher gaining `Edit`, `Write`, `MultiEdit` and
+    `NotebookEdit`; the refused attempts recorded in the store, shown on the
+    person's next prompt and listed by `abcd mode back`; and the live checks
+    that the person's `!` command reaches no pre-tool hook and that a
+    message relayed from another session starting with `!` is not run as a
+    shell command. The slice's away mode grants no push rights, and the
+    person's standing instruction decides what is sent, so none of this
+    holds up the stall fix; and since the OS fence (spc-2610161751056096)
+    covers only runner-launched agents, it stays a mistake filter in the
+    person's own sessions;
+  - the guard reading `go run ./cmd/abcd` (go's flags stepped over, an
+    `@<version>` allowed) and a built `abcd-<goos>-<arch>` as `abcd`, for
+    every entry that names the program, `abcd-source-ledger-flip` included,
+    which commands/guard.md today names as unseen. It widens what every
+    entry matches, so it gets its own security review here rather than
+    riding on the cut;
+  - a reuse cache for the away stop check's forge listing (a listing younger
+    than ten minutes reused, and on a failed read a cached listing younger
+    than half the default lease used with its age named), so a run of blocks
+    costs one call; the slice makes one uncached listing per check under a
+    ten-second deadline;
+  - anything `abcd mode back` prints beyond one plain line per queued step
+    and recorded stop: grouping, formatting or a summary of the window.
 
 ## Decisions
 
diff --git a/.abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md b/.abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md
index 61810d88e5..34567c3d5d 100644
--- a/.abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md
+++ b/.abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md
@@ -17,7 +17,7 @@ related_issues: [iss-2610170619247185]
 
 ## Press Release
 
-> A session told to work on while its person is away keeps working until they are back. Alice, a solo founder who is also the product thinker, leaves for the evening and runs one command of her own saying the sessions should work on until 09:00; a session cannot run it for her, so a message relayed between sessions cannot set it. abcd records that once for the repository, with who set it and when it ends, and repeats it to every session at each start, after each compaction and with every prompt, so no summary and no relay between sessions can drop it. A session that tries to end its turn while it still has work it can do alone (a reservation whose work is not yet handed in, a pull request of its own that has fallen behind or is failing, a branch it has not pushed, a branch stacked on another change that is still open) is handed the next of those items instead. One with nothing left to do takes the next ready item, and may stop only with its next look scheduled before its reservations need renewing. A question it would have put to Alice is decided and recorded instead, and an act only Alice may approve (an advisory's approval, a publication, a new dependency, a secret, a browser step) is queued for their return. When Alice is back and says so, the mode ends and they see the queued steps and any stop the host forced; from then on nothing is refused, and a stop with work left is only pointed out.
+> A session told to work on while its person is away keeps working until they are back. Alice, a solo founder who is also the product thinker, leaves for the evening and says the sessions should work on until 09:00, running one command or asking a session to. abcd records that once for the repository, with who set it and when it ends, and repeats it to every session at each start, after each compaction and with every prompt, so no summary and no relay between sessions can drop it. A session that tries to end its turn while it still has work it can do alone (a reservation whose work is not yet handed in, a pull request of its own that has fallen behind or is failing, a branch it has not pushed, a branch stacked on another change that is still open) is handed the next of those items instead. One with nothing left to do takes the next ready item, and may stop only with its next look scheduled before its reservations need renewing. A question it would have put to Alice is decided and recorded instead, and an act only Alice may approve (an advisory's approval, a publication, a push her standing instructions do not allow, a new dependency, a secret, a browser step) is queued for their return. The mode itself grants nothing: what a session may push stays whatever Alice's own instructions say. When Alice is back and says so, the mode ends and they see the queued steps and any stop the host forced; from then on nothing is refused, and a stop with work left is only pointed out.
 
 ## Why This Matters
 
@@ -62,7 +62,7 @@ its turn on a question to the person.
   machine, so a session on another computer or in the cloud does not see it.
 - The stop check's pull-request reading, made only while the person is away, <!-- cond: cond-2610180914462056 -->
   needs the forge client signed in; when it cannot read the forge in time it
-  judges from a recent cached listing or from disk alone, and says so.
+  judges from disk alone, and says so.
 - A session that keeps working through the host: the check refuses a stop, it <!-- cond: cond-2610180914469321 -->
   cannot start a session that is not running. A turn the host ends on an API
   error, such as a rate limit, fires no Stop hook and cannot be continued: it
@@ -71,19 +71,17 @@ its turn on a question to the person.
 ## What's In Scope
 
 - **The away mode.** `abcd mode autonomous [--until <time>]` records who set
-  it, when, and when it ends, at most seven days on; `abcd mode back` ends it,
-  prints the queue, the recorded stops and any refused attempt, and records
-  who ended it. One record per repository on the machine, shared by every
+  it, from which working copy, when, and when it ends, at most seven days
+  on; `abcd mode back` ends it, prints one line per queued step and recorded
+  stop, and records who ended it. One record per repository on the machine, shared by every
   working copy, changed only under a lock (dcn-2610180913399042,
   dcn-2610180913399499, dcn-2610180937181736).
-- **Only the person sets it.** Guard entries refuse an agent's every route to
-  setting the mode that the guard reads, its file tools included, so the
-  person sets it with their own `!` command or at a terminal, and a refused
-  attempt is shown to them. The guard is a mistake filter, not a boundary.
-  The mode lets a session push its own branches and open their pull
-  requests, never the default branch, a tag, a release cut, another person's
-  pull request or a branch only checked out to review
-  (dcn-2610181003456444).
+- **It grants nothing.** The person's own standing instruction stays the
+  authority to commit, push, and open or merge a pull request, as before.
+  Where owed work needs a push, the stop check tells the session to push if
+  its standing instruction allows, and otherwise to queue the push, which
+  hands that item back to the person for the window. The person sets the
+  mode, or a session does on their word (dcn-2610181016510153).
 - **Repeated, never summarised away.** While it holds, the session-start hook
   (every source, compaction included) and the prompt hook (every prompt) add
   one short block to the session's context (dcn-2610180913406972), and the
@@ -120,13 +118,15 @@ its turn on a question to the person.
 - **The question reroute.** While the person is away, the guard refuses every
   question on the host's question tool. A question about an act only the
   person may approve (a per-act approval or ruling such as an embargo
-  close's digest, an embargo triage verdict or a drain hand-back, a push or
-  merge beyond the session's own branches, a publication, outward message or
+  close's digest, an embargo triage verdict or a drain hand-back, pushing,
+  opening or merging a pull request without a standing instruction that
+  allows it, a publication, outward message or
   visibility change, a new dependency, a secret, credential or App, a
   website or browser step, a destructive act, a spend, or any act a command
   page or invariant names as the person's) is queued with `abcd mode queue
   "<step>"`; every other question is decided and recorded with `abcd decide`
-  (dcn-2610180913431493, dcn-2610180937177502, dcn-2610181003477194).
+  (dcn-2610180913431493, dcn-2610180937177502, dcn-2610181003477194,
+  dcn-2610181016510153).
 
 ## What's Out of Scope
 
@@ -140,6 +140,16 @@ its turn on a question to the person.
   queue, the window's decisions gathered across working copies, the recorded
   stops and who ended the mode), the status line naming the away mode, and
   the bare `abcd mode` print of the record, the queue and the owed items.
+- Moved back to itd-2610170638184486 by the trim after review round 2
+  (dcn-2610181016510153, dcn-2610181017056307): making the away mode the
+  person's act alone (the guard entry refusing an agent's `abcd mode
+  autonomous` and its routes, the away store's shell-write and file-tool
+  refusals, the refused attempts recorded and shown, and the live checks of
+  the person's `!` command and a relayed `!`); the guard reading `go run
+  ./cmd/abcd` and built binaries as `abcd` for every entry; the away forge
+  listing's reuse cache; and any `abcd mode back` print beyond one plain
+  line per queued step and recorded stop.
+- Any push right granted by the away mode: it grants none.
 - Starting or waking a session that is not running.
 - Each autonomous session's own forge credential, owned by the coordination
   intent.
@@ -195,13 +205,18 @@ its turn on a question to the person.
 - **Given** the away mode holds, **when** Alice sends any prompt, **then** one
   line shown to Alice names the away mode, its end, who set it and `abcd
   mode back`.
-- **Given** a session relays a message saying Alice wants the sessions to
-  work on, **when** another session's agent runs `abcd mode autonomous`, or
-  `go run ./cmd/abcd mode autonomous`, or writes the away record with a file
-  tool, **then** the guard refuses it, telling the agent to leave it to
-  Alice, nothing is set, and Alice's next prompt shows one line saying a
-  session tried; **and when** Alice runs `!abcd mode autonomous --until
-  09:00` herself, **then** it is set.
+- **Given** the away mode holds and the session has an unpushed branch of
+  its own and no standing instruction from Alice allowing a push, **when**
+  it tries to end its turn, **then** the stop is blocked with a reason that
+  says to push only if a standing instruction allows and otherwise to queue
+  the push, never naming the away mode as permission; **and when** it
+  queues a step naming that branch, **then** the branch is no longer named
+  as owed in this window and the step is shown when Alice runs `abcd mode
+  back`.
+- **Given** a session sets the away mode on a message relayed from another
+  session, **when** Alice sends her next prompt, **then** the line shown to
+  her names who set it, from which working copy, and `abcd mode back`, and
+  no session has gained any right to push.
 - **Given** a window that ended at 09:00 with one queued step, **when** Alice
   sends her first prompt at 10:00 without having run `abcd mode back`,
   **then** one line shown to Alice counts the queued step and names `abcd
@@ -224,14 +239,13 @@ its turn on a question to the person.
   runs, **then** it refuses, names the reason, and writes nothing.
 - **Given** the forge cannot be read within ten seconds during a stop check,
   **when** the session tries to stop while away, **then** the check judges
-  from a listing cached in the last half lease, naming its age, or from the
-  disk kinds alone, saying the pull requests were not read.
+  from the disk kinds alone, saying the pull requests were not read.
 - **Given** the slice is built, **when** a live Claude Code session with the
   plugin from the branch runs an away window with seeded owed work, a
   compaction and an attempted stop, **then** a captured transcript shows the
-  agent's attempt to set the mode refused and the person's own `!` command
-  setting it, the away block after compaction, the blocked stop naming the
-  next item, and the refused question.
+  away block at start and after compaction, the blocked stop naming the next
+  item, an unpushed branch's push queued and no longer named, and the
+  refused question.
 
 ## SOTA
 
@@ -274,9 +288,9 @@ ruling or the ground it rests on; the full text is in the decision record.
    security and bug-fix release, not deferred.
 2. **Its own intent** (dcn-2610180913388445): the slice builds on the
    checklist draft rather than planning it.
-3. **The away record** (dcn-2610180913399042): set by a verb, ended by its
-   time or the person's word, never by a prompt; who may run the verb is
-   decision 19.
+3. **The away record** (dcn-2610180913399042): set by a verb, by the person
+   or a session on their word, ended by its time or the person's word, never
+   by a prompt; restored by decision 28 after decision 19 narrowed it.
 4. **Per repository on the machine** (dcn-2610180913399499).
 5. **Repeated at start, compaction and every prompt**
    (dcn-2610180913406972).
@@ -308,7 +322,8 @@ Review round 1 of 2026-10-18 refined them:
 Review round 2 of 2026-10-18 refined them again:
 
 19. **Only the person sets the away mode; narrow push rights; a mistake
-    filter** (dcn-2610181003456444), refining decision 3.
+    filter** (dcn-2610181003456444), refining decision 3; superseded by
+    decision 28.
 20. **A wake qualifies within a ceiling, the host's lateness included**
     (dcn-2610181003455731).
 21. **Behind is the forge's merge state while away** (dcn-2610181003464379).
@@ -324,7 +339,15 @@ Review round 2 of 2026-10-18 refined them again:
 27. **The clearing rule names review and works without receipts**
     (dcn-2610181003488355).
 
-The invariant 7 amendment is recorded as adr-2610181003541997 (proposed).
+The trim after review round 2, on the release orchestrator's ruling:
+
+28. **The away mode grants no push rights; the person-only guard moves to
+    the draft** (dcn-2610181016510153), superseding decision 19.
+29. **The slice trimmed to what closes the issue, with what moved listed**
+    (dcn-2610181017056307), refining decision 18.
+
+The invariant 7 amendment is recorded as adr-2610181003541997 (proposed),
+amended by the trim to one uncached listing per check.
 
 ## Audit Notes
 
diff --git a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
index 5120e1bad5..29cc2c9a88 100644
--- a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
+++ b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
@@ -10,18 +10,18 @@ production_mode: hand-written
 ## Summary
 
 Delivers itd-2610180912189125, the first slice of the checklist draft
-(itd-2610170638184486) and the fix for iss-2610170619247185. Four parts:
-
-- **The away mode.** `abcd mode autonomous [--until <time>]`, `abcd mode back`
-  and `abcd mode queue "<step>"` keep one away record per repository on the
-  machine, changed only under a lock. The session-start hook (every source,
-  `compact` included) and the prompt hook repeat it to the agent while it
-  holds, and the prompt hook shows the person one line saying so.
-- **Only the person sets it.** Guard entries refuse every route to setting
-  the mode that the guard reads, an agent's shell call and its file tools
-  included, so the person sets it with their own `!` command or at a
-  terminal. What the mode grants is narrow: the session pushes its own
-  branches and opens their pull requests, and nothing beyond them.
+(itd-2610170638184486) and the fix for iss-2610170619247185. Trimmed after
+review round 2 to what closes the issue (dcn-2610181017056307). Three parts:
+
+- **The away record.** `abcd mode autonomous [--until <time>]`, `abcd mode
+  back` and `abcd mode queue "<step>"` keep one away record per repository on
+  the machine, changed only under a lock and lapsing at its end, seven days
+  at most. The session-start hook (every source, `compact` included) and the
+  prompt hook repeat it to the agent while it holds, and the prompt hook
+  shows the person one line saying so, naming `abcd mode back`. The mode
+  grants no rights: the person's own standing instruction stays the
+  authority to commit, push and open or merge a pull request
+  (dcn-2610181016510153).
 - **The stop check.** A plugin Stop hook runs `abcd hook stop`. While the
   record holds, a session is only working or waiting: a turn's end is blocked
   while owed work exists, naming the next item, and is allowed only with a
@@ -33,18 +33,22 @@ Delivers itd-2610180912189125, the first slice of the checklist draft
 - **The question reroute.** While the record holds, the guard refuses every
   question on the host's question tool. An act only the person may approve
   goes to the queue; every other question is decided and recorded with `abcd
-  decide`. `abcd mode back` prints the queue and the recorded stops.
+  decide`. `abcd mode back` prints the queue and the recorded stops, one line
+  each.
 
 Every behaviour is built test-first: each step names its tests, written and
 watched failing before its code. The last step is a live Claude Code session
 capture, because the hook mechanics are the host's and a unit test cannot
 prove them (principle evaluate-at-the-user-surface).
 
-Moved out by review round 1 (dcn-2610180937181929), back to the checklist
-draft as named remaining work: the report shown once on the person's return
-(the queue, the window's decisions gathered across working copies, the
-recorded stops and who ended the mode), the status line, the bare `abcd mode`
-print, and the brief's surface text for them.
+Moved out by review round 1 (dcn-2610180937181929) and by the trim after
+round 2 (dcn-2610181016510153, dcn-2610181017056307), back to the checklist
+draft as named remaining work: the report shown once on the person's return,
+the status line, the bare `abcd mode` print, making the away mode the
+person's act alone (the guard entries, their other routes and the refused
+attempts), the guard's reading of `go run ./cmd/abcd` and built binaries as
+`abcd`, and the forge listing's reuse cache. "Trim after round 2" below
+lists each.
 
 ## Design
 
@@ -80,14 +84,8 @@ docs.claude.com hooks page redirects there):
   input has no field naming the prompt's origin, so a hook cannot tell the
   person's word from a relayed one.
 
-Read on 2026-10-18 at https://code.claude.com/docs/en/interactive-mode and
-https://code.claude.com/docs/en/scheduled-tasks:
+Read on 2026-10-18 at https://code.claude.com/docs/en/scheduled-tasks:
 
-- **Shell mode.** Input starting with `!` runs "shell commands directly
-  without going through Claude", and those commands run outside the sandbox
-  "because the sandbox applies to the commands Claude runs". So the
-  person's `!` command is not a Bash tool call and should not reach the
-  pre-tool hook; step 7 confirms it live.
 - **Scheduled tasks.** "All times are interpreted in your local timezone",
   not UTC. A recurring task "starts each run late by up to half the gap to
   the next run, and by at most 30 minutes", except `*/5 * * * *`, which runs
@@ -100,7 +98,7 @@ https://code.claude.com/docs/en/scheduled-tasks:
 abcd's hook manifest already registers SessionStart with no matcher, so
 compaction already runs `abcd hook session-start`. It has no Stop or
 StopFailure entry, and its PreToolUse entry matches the shell tool and the
-host's question tool, not the file tools.
+host's question tool.
 
 ### The away record
 
@@ -109,23 +107,21 @@ host's question tool, not the file tools.
   root commit as the worktree store is (dcn-2610180913399499), with a lock
   file beside it. The same folder holds each working copy's list of branches
   it created (dcn-2610181003463367). Everything in it is written through
-  fsutil's atomic writer, and only by abcd: the guard refuses an agent's
-  write to it (below).
+  fsutil's atomic writer.
 - **What it holds.** Who set it: the holder name reservations cache, without
   a network read, falling back to git's `user.name`, and the working copy it
   was set from. It also holds the start, the end, the queue of steps for the
   person, the stops recorded (with work owed, with no next look, or on an
   API error with its type, each at the cap labelled "possibly forced by the
-  cap"), the guard's refused attempts to set the mode, and, once ended by
-  word, who ended it and from which working copy.
+  cap"), and, once ended by word, who ended it and from which working copy.
 - **The lock** (dcn-2610180937181736). Every read-modify-write (`mode
-  autonomous`, `mode back`, `mode queue`, a recorded stop) holds
-  `fsutil.WithFileLock` on the lock file and re-reads the record inside it.
-  The stop check reads the record and lists the forge outside the lock, then
-  takes it, re-reads, and records its stop only if the record still holds, so
-  a check that began while away never writes away back after `abcd mode
-  back`. A lock not had within two seconds: the verbs refuse naming it, and
-  the hooks allow the stop and say so on stderr.
+  autonomous`, `mode back`, `mode queue`, a recorded stop, a recorded
+  branch) holds `fsutil.WithFileLock` on the lock file and re-reads the
+  record inside it. The stop check reads the record and lists the forge
+  outside the lock, then takes it, re-reads, and records its stop only if the
+  record still holds, so a check that began while away never writes away
+  back after `abcd mode back`. A lock not had within two seconds: the verbs
+  refuse naming it, and the hooks allow the stop and say so on stderr.
 - **Ownership and permissions.** The record and the lock file are used only
   when each is a regular file this account owns that no one else can write,
   within 64 KiB: the checks `rules.json` already gets. A record that fails
@@ -139,107 +135,56 @@ host's question tool, not the file tools.
   nothing written. A run of several days, like the standing run of 2026-10-15
   through 2026-10-17, fits; a forgotten record lapses.
 - **Seen by the person.** While the record holds, the prompt hook adds a
-  one-line `systemMessage` on every prompt: away until when, set by whom,
-  and the literal `abcd mode back` as the way to end it. The away block tells
-  the agent to run `abcd mode back` only on the person's word in its session
-  (dcn-2610181003474765).
+  one-line `systemMessage` on every prompt: away until when, set by whom and
+  from which working copy, and the literal `abcd mode back` as the way to
+  end it. The away block tells the agent to run `abcd mode back` only on the
+  person's word in its session (dcn-2610181003474765).
 - **A lapsed window with anything unread.** While a record whose end has
-  passed is not yet closed and holds a queued step, a recorded stop or a
-  refused attempt, the prompt hook shows the person one line on every prompt
-  counting them and naming `abcd mode back`, until that verb closes the
-  record (dcn-2610181003474765).
-- **A refused attempt.** When the guard refuses an attempt to set the mode
-  (below), it records the time and the working copy in the store under the
-  lock, and the next prompt's line tells the person that a session tried and
-  that only they can set it; `abcd mode back` lists every attempt.
-- **Ending it.** `abcd mode back` prints the queue and the recorded stops,
-  records who ended the mode and from which working copy, and ends the
-  record; on a record whose time has passed it prints the same and closes it.
+  passed is not yet closed and holds a queued step or a recorded stop, the
+  prompt hook shows the person one line on every prompt counting them and
+  naming `abcd mode back`, until that verb closes the record
+  (dcn-2610181003474765).
+- **Ending it.** `abcd mode back` prints one plain line per queued step and
+  per recorded stop (its label included), records who ended the mode and
+  from which working copy, and ends the record; on a record whose time has
+  passed it prints the same and closes it. Nothing more is printed: the
+  report on return moved to the checklist draft.
 - **The badge.** The three-word badge in `internal/core/mode` is untouched.
   While the record holds, `abcd mode product-thinker` and `abcd mode
-  facilitator` are refused, naming `abcd decide`.
-
-### Only the person sets it
-
-Setting the away mode hands sessions the right to push, so it must be the
-person's own act (dcn-2610181003456444, refining dcn-2610180913399042). The
-prompt hook cannot tell the person's message from one another session relays,
-so "on the person's word" cannot be checked, and a peer's relay on 2026-10-16
-would have let one agent give itself, and every copy, seven days of push
-rights. The guard closes the routes it can read, on the precedent of
-`abcd-source-ledger-flip`, which already leaves a person-only verb to the
-person:
-
-- **`abcd-away-mode-set`** (blocker, in the bundled registry): the program
-  `abcd`, subcommand `mode`, second subcommand `autonomous`, whatever its
-  flags. Matched by basename, it covers the binary on PATH and the plugin
-  root's; the guard already reads `sh -c` payloads and, under
-  adr-2610091150447054, a script file a shell runs, so a script that calls
-  it is refused too.
-- **The program's other spellings.** The matcher reads two more spellings of
-  the program as `abcd`, for every entry that names it: a built
-  `abcd-<goos>-<arch>` (what `make build` writes), and `go run <pkg>` whose
-  package path ends in `cmd/abcd`, optionally `@<version>`, with go's own
-  flags stepped over, the rest of the line being the program's arguments. So
-  `go run ./cmd/abcd mode autonomous` is refused by the same entry, and so
-  is a `go run` of the ledger flip, which commands/guard.md today names as
-  unseen.
-- **`abcd-away-store-write`** (blocker): a shell write whose resolved target
-  lies inside `~/.abcd.noindex/away/`, through a redirection or a writer the
-  guard lists (the list commands/guard.md names), or a delete of it. The
-  record, its lock and the branch lists are written only by abcd's own verbs
-  and hooks.
-- **The file tools** (`abcd-away-store-file-tool`, a refusal the hook
-  reports under that name, since registry entries read shell text only).
-  The plugin's PreToolUse matcher gains `Edit`, `Write`,
-  `MultiEdit` and `NotebookEdit`, and `abcd guard hook` refuses one whose
-  `file_path` (or `notebook_path`) resolves, `~` expanded and symlinks
-  followed, inside `~/.abcd.noindex/away/`; every other path is allowed with
-  no further reading. This adds one hook start to each file-tool call, as the
-  shell tool already pays.
-- **The refusal's words.** The why: setting the away mode hands every
-  session on this machine the right to push, so it is the person's own act.
-  The successor: tell the person that you believe they asked for it and let
-  them run `abcd mode autonomous` themselves, with `!` in this session or at
-  a terminal. `abcd mode back` and `abcd mode queue` stay allowed: ending the
-  mode is the safe direction, and the queue only adds to what the person
-  reads.
-
-**A mistake filter, not a boundary.** The guard reads a command's text, so
-it stops an agent that follows refusals from granting itself the mode on a
-relayed word; it does not stop one that routes around it (another
-interpreter, a program, a copy of the binary under another name, the
-unseen spellings commands/guard.md lists), as adr-42 says of the whole parse
-layer, and as the decision of 2026-10-17 on the default branch says of the
-headless approver. The OS fence (spc-2610161751056096,
-adr-2610161621415708) makes it a boundary for the agents abcd's runner
-launches once it ships, since it confines their writes to abcd's home to
-their own worktree, so a launched role can write neither the store nor,
-through the binary, the record. It does not fence the person's own
-interactive session, which is where the stall happened.
-
-**Why that is enough for now.** The grant governs only an agent that
-follows refusals: one that ignores them can push without any mode, so no
-shape of the mode adds a boundary inside the person's own session. The
-rights are narrow, every push is reversible and visible on the forge, and
-the record (who set it and from which copy) and the refused attempts leave a
-trail the person reads on the next prompt and on `abcd mode back`.
-
-**What the mode grants.** The session commits and pushes its own branches
-and opens their pull requests, which is the owed work; merging follows the
-repository's own rule. Never: the default branch, a tag, a release cut,
-another person's pull request, a branch this copy only checked out to
-review, or a force push. The away block repeats the grant and the
-exclusions.
-
-**The fallback, if the capture breaks the premise.** If step 7 shows that a
-message relayed from another session can run as a `!` command, or that an
-agent's tool call can reach the host's shell mode, the mode grants no push
-rights at all and the person's own standing instruction stays the authority
-to push; the guard entries stay, since a mode set by mistake still silences
-questions. If step 7 shows only that the person's `!` command does pass the
-pre-tool hook, nothing changes but the docs: the person sets it at a
-terminal.
+  facilitator` are refused, naming `abcd decide`, since a badge parked on the
+  person is a question waiting for them (dcn-2610180913431493).
+
+### Who sets it, and what it grants
+
+**It grants nothing** (dcn-2610181016510153, superseding
+dcn-2610181003456444). The person's own standing instruction stays the
+authority to commit, push, and open or merge a pull request, exactly as
+before the mode existed. The away mode only keeps a session working while
+owed work exists and turns its questions into recorded decisions or queued
+steps; it is never treated as permission. The away block says so, in those
+words.
+
+**Who sets it.** The person, with their own command (at a terminal, or with
+`!` in the session), or a session on the person's word in that session, as
+dcn-2610180913399042 first said. Nothing checks which: the prompt hook cannot
+tell the person's message from one another session relays. Because the mode
+grants no rights, a mode set on a relayed word only keeps sessions working
+and deciding instead of asking, and the person sees who set it, from which
+working copy, and `abcd mode back` on their next prompt.
+
+**Why the guard entries left the slice.** Round 2's choice (a) made setting
+the mode the person's act alone, because the mode then carried push rights.
+The OS sandbox of spc-2610161751056096 fences only the agents abcd's runner
+launches, never the person's own interactive sessions, which are the ones
+that stalled. There, the guard entries would only ever be a mistake filter
+(adr-42), so their two days would buy a trust claim the plan cannot make.
+With no push rights in the mode there is nothing for them to protect in this
+slice. Making the mode the person's act alone (the guard entry, its other
+routes, the store's shell-write and file-tool refusals, the refused
+attempts, and the capture's checks of the `!` path), and the guard reading
+`go run ./cmd/abcd` and built binaries as `abcd` for every entry, the ledger
+flip included, are named remaining work of itd-2610170638184486; the second
+is a security-relevant widening that gets its own review there.
 
 ### Owed work
 
@@ -263,11 +208,13 @@ dcn-2610181003488355):
     run `git worktree add -b|-B <b>`, `git switch -c|-C <b>` or `git checkout
     -b|-B <b>`, and no branch named `<b>` exists yet, it records `<b>` under
     this copy's key in the away store, under the store's lock, whether or not
-    the person is away. This is how the stacked drain branches of 2026-10-17
-    (`feat/drain-step11` and its siblings) are seen: cut with a plain `git
-    worktree add`, they had no upstream, no entry in this copy's reflog, no
-    run state and no record id in their names. A record made for a command
-    that then failed names a branch that does not exist, and is ignored;
+    the person is away. The hook only records; it refuses nothing, and a
+    failed write leaves the command allowed with a stderr line. This is how
+    the stacked drain branches of 2026-10-17 (`feat/drain-step11` and its
+    siblings) are seen: cut with a plain `git worktree add`, they had no
+    upstream, no entry in this copy's reflog, no run state and no record id
+    in their names. A record made for a command that then failed names a
+    branch that does not exist, and is ignored;
   - it is the branch of a lane in a run state this copy's local tier holds
     (`.abcd/.work.local/run/<run-id>/state.json`), while that run's
     reservation is live under this copy's key;
@@ -326,6 +273,16 @@ dcn-2610181003488355):
   upstream configured, not in any remote-tracking ref. A branch whose
   upstream is gone (merged and deleted on the remote, a squash merge
   included) never counts.
+- **Handed back by the queue** (dcn-2610181016510153). The mode grants no
+  push, so an item whose next act is a push (an unpushed branch, a
+  reservation whose work no pull request carries, a behind or failing pull
+  request once its local fix is committed) may be one the session has no
+  standing instruction to send. A queued step that names the item's branch
+  or record id, on the same word-boundary match as the link, hands that item
+  back to the person for the rest of the window, so the stop check stops
+  naming it. A branch is handed back only while it holds commits its upstream
+  lacks, so the local work (the merge from the base, the fix, the review, the
+  preflight) is done first and only the push waits.
 - **What is read, and when (invariant 7,
   adr-2610181003541997).** While the person is present the check reads disk
   only: renewals due (reservations as last fetched, `claim.LastFetched`) and
@@ -333,13 +290,13 @@ dcn-2610181003488355):
   the network. While away it adds at most one `gh pr list` of the person's
   open pull requests (head and base branch, author, body, merge state,
   review decision, check rollup; each field among those
-  `internal/ghcontract` pins) under a ten-second deadline, cached in the
-  local tier: a listing younger than ten minutes is reused, not repeated, so
-  eight blocks in a row cost one call; on a failure or timeout a cached
-  listing younger than half the default lease is used with its age named,
-  else the disk kinds alone with the pull requests named as not read. Brief
-  invariant 7 gains this listing as the away mode's documented meaning, as
-  the drain's listing is, by adr-2610181003541997.
+  `internal/ghcontract` pins) under a ten-second deadline. On a failure or
+  timeout it judges from the disk kinds alone, naming the pull requests as
+  not read. There is no cache: a run of eight blocks costs up to eight
+  listings, each bounded by the deadline (the reuse cache is remaining work
+  of the checklist draft). Brief invariant 7 gains this listing as the away
+  mode's documented meaning, as the drain's listing is, by
+  adr-2610181003541997.
 - **Order.** The next item is the first of: a renewal due, a failing pull
   request, a behind one, a stacked branch, an unpushed branch, unhanded work.
 
@@ -401,6 +358,11 @@ While away, the rows are read in order and the first that matches decides:
 | 5 | none owed, qualifying wake | allow (waiting; next look kept) |
 | 6 | none owed, no qualifying wake | block: take the next ready item first (reserve it), and only if none can be taken alone, schedule a look before the deadline (working) |
 
+- **An item that needs a push** (dcn-2610181016510153). The reason for it
+  says: do the local work, then push if your standing instruction allows;
+  otherwise queue the push with `abcd mode queue "<step>"` naming the branch
+  or record id, and take the next item. It never says the away mode allows
+  the push.
 - **`stop_hook_active`** decides no row, so both values are covered by every
   row. It alone drives the count (dcn-2610181003484631, refining
   dcn-2610180936577720): a block with it `false` sets the count to one, and
@@ -432,7 +394,7 @@ While away, the rows are read in order and the first that matches decides:
 record first. While it holds, it denies every question-tool call, abcd's or
 another tool's, with one reason whatever the chip (dcn-2610180937177502).
 The classification is by the act asked about, which the reason lists, so the
-agent routes it (dcn-2610181003477194):
+agent routes it (dcn-2610181003477194, extended by dcn-2610181016510153):
 
 - **Queued for the person** with `abcd mode queue "<step>"`, carrying on with
   other work meanwhile, is a question about an act only the person may
@@ -445,11 +407,12 @@ agent routes it (dcn-2610181003477194):
     the drain's hand-back ("a hand-back is a person's decision",
     `commands/drain.md`); the confirmed apply verb for remote configuration
     (brief invariant 10); a release sign-off;
-  - a push or merge beyond the session's own branches: the default branch, a
-    tag, a release cut, another person's pull request, a branch only checked
-    out to review;
+  - pushing, opening or merging a pull request without a standing
+    instruction of the person's that allows it; the away mode is never that
+    instruction;
   - publishing anything, changing a repository's visibility, or posting a
-    comment or message outward, other than the session's own pull request;
+    comment or message outward, other than a pull request a standing
+    instruction allows;
   - adding a dependency;
   - a secret, a credential or an App;
   - a step only a website or a browser can do;
@@ -470,9 +433,8 @@ only what they name, a force push and a skipped hook among them; the rest of
 the list rests on the agent following it, as the person-only rules on the
 command pages already do.
 
-What the mode grants is stated under "Only the person sets it" above, and
-the away block repeats the grant, the exclusions and this list. No mode is
-set and no question is marked open.
+The away block repeats this list and that the mode grants nothing. No mode
+is set and no question is marked open.
 
 ## Footprint
 
@@ -486,76 +448,53 @@ set and no question is marked open.
    - tests: internal/core/autonomy, internal/core/mode, internal/surface/cli
    - Watched failing first: TestAwayRecordSharedAcrossWorktrees (`abcd mode
      autonomous --until 09:00` writes one record in the away store that a
-     sibling worktree reads); TestUntilClockTimeAndTimestamp;
+     sibling worktree reads, with who set it and from which copy);
+     TestUntilClockTimeAndTimestamp;
      TestUntilRefusedPastOrNoTierOrNoCheckout (nothing written);
      TestStaleRecordCapSevenDays (an open-ended record reads as ended seven
      days on, and `--until` beyond that is refused);
-     TestModeBackPrintsQueueStopsAndAttempts (the queue, the recorded stops
-     with their "possibly forced by the cap" label and the refused attempts,
-     and the ender and copy recorded; also on a record whose time has
-     passed); TestRecordPastEndReadsEnded; TestQueueAppends;
+     TestModeBackPrintsQueueAndStops (one plain line per queued step and per
+     recorded stop, the "possibly forced by the cap" label included, and the
+     ender and copy recorded; also on a record whose time has passed);
+     TestRecordPastEndReadsEnded; TestQueueAppends;
      TestConcurrentWritesUnderLock (two `mode queue` calls racing keep both
      steps, and a stop recorded after `mode back` re-reads inside the lock
      and does not turn the mode back on); TestRecordOwnershipFailsOpen (a
      record or lock that is a symlink, not this account's, writable by
      others, or over 64 KiB reads as not away, and a verb refuses naming
-     it); TestAttemptRecordedUnderLock (an attempt appended while away and
-     while not, kept by a racing `mode queue`); TestBadgeRefusedWhileAway;
-     the badge's three-word vocabulary test passes unchanged. The plugin page
-     and the brief's `abcd mode` surface text describe the three verbs, say
-     that only the person runs `abcd mode autonomous` and list what the mode
-     grants and never grants, and `go generate ./internal/surface/cli`
-     refreshes the derived appendix.
-2. Only the person sets it: the guard entries and the branch recorder
-   - packages: internal/core/guard, internal/surface/cli, hooks, commands/guard.md, .abcd/development/brief/04-surfaces/17-guard.md
-   - tests: internal/core/guard, internal/surface/cli
-   - Watched failing first: TestAwayModeSetIsLeftToThePerson
-     (`abcd-away-mode-set` blocks `abcd mode autonomous`, with
-     `--until 09:00` and `--json`, `"$CLAUDE_PLUGIN_ROOT"/abcd mode
-     autonomous`, `sh -c 'abcd mode autonomous'` and `bin/abcd-darwin-arm64
-     mode autonomous`, and allows `abcd mode back`, `abcd mode queue "x"`,
-     `abcd mode`, `abcd mode facilitator` and `abcd capture "an agent ran
-     abcd mode autonomous"`); TestGoRunOfAbcdReadAsAbcd (`go run ./cmd/abcd
-     mode autonomous`, `go run -race ./cmd/abcd mode autonomous` and `go run
-     github.com/intentdriven/abcd/cmd/abcd@v1.2.3 mode autonomous` block,
-     and so does `go run ./cmd/abcd library ledger --flip 3`, while `go run
-     ./cmd/abcd mode back` and `go run ./cmd/other mode autonomous` allow);
-     TestAwayModeSetInAScriptFile (a script a shell runs that calls it is
-     refused, under the existing script reading); TestAwayStoreShellWrite
-     (`printf '{}' > ~/.abcd.noindex/away/x/away.json`, `tee`, `cp` and
-     `rm` into the store block; a write elsewhere under `~/.abcd.noindex/`
-     allows); TestGuardHookFileToolAwayStore (`abcd-away-store-file-tool`:
-     `Write`, `Edit`, `MultiEdit` and `NotebookEdit` on a path in the store, through `~` and through a
-     symlink, are denied, and on any other path allowed without reading the
-     store); TestGuardRefusalRecordsAttempt (a refusal by either away entry
-     appends an attempt under the lock, and fails open with a stderr line
-     when the store cannot be written); TestBranchRecorderOnCreate (`git
-     worktree add -b feat/x ../x`, `git switch -c feat/y` and `git checkout
-     -B feat/z` record the branch under this copy's key only when no branch
-     of that name exists, and `git checkout -b main` on an existing `main`
-     records nothing); the registry's fixture test covers the new entries'
-     known-bad and known-good lines; `hooks/hooks.json`'s PreToolUse matcher
-     gains the four file tools and the hook-shape tests cover it.
-     commands/guard.md names the entries, the `go run` and built-binary
-     spellings, and what stays unseen; the brief's guard chapter says the
-     same.
-3. Repeated to the agent, shown to the person
+     it); TestBadgeRefusedWhileAway; the badge's three-word vocabulary test
+     passes unchanged. The plugin page and the brief's `abcd mode` surface
+     text describe the three verbs and say the mode grants no rights, the
+     person's standing instruction deciding what is pushed, and `go generate
+     ./internal/surface/cli` refreshes the derived appendix.
+2. Repeated to the agent, shown to the person
    - packages: internal/surface/cli
    - tests: internal/surface/cli
    - Watched failing first: TestSessionStartAwayBlockEverySource (`startup`,
      `resume` and `compact` print the away block while the record holds,
-     nothing when it does not, and the block carries what the mode grants,
-     its exclusions, the person-only act list and the rule to run `abcd mode
-     back` only on the person's word); TestPromptRouterAwayBlockEveryPrompt
-     (a second prompt in the same session too, outside the loader's dedup
+     nothing when it does not, and the block says the mode grants nothing,
+     carries the person-only act list and the rule to run `abcd mode back`
+     only on the person's word); TestPromptRouterAwayBlockEveryPrompt (a
+     second prompt in the same session too, outside the loader's dedup
      ledger); TestPromptRouterAwaySystemMessage (one line the person sees on
-     every prompt while it holds, carrying the literal `abcd mode back`);
-     TestPromptRouterLapsedWindowLine (a lapsed, unclosed record with a
-     queued step, a recorded stop or an attempt shows one line naming `abcd
-     mode back` on every prompt until `mode back` closes it, and one with
-     none shows nothing); TestPromptRouterAttemptLine (an attempt recorded
-     since the last line is shown once, while away and while not); all
-     inside the hook's existing deadline.
+     every prompt while it holds, naming who set it, from which copy, and
+     the literal `abcd mode back`); TestPromptRouterLapsedWindowLine (a
+     lapsed, unclosed record with a queued step or a recorded stop shows one
+     line naming `abcd mode back` on every prompt until `mode back` closes
+     it, and one with neither shows nothing); all inside the hook's existing
+     deadline.
+3. The created-branch recorder
+   - packages: internal/core/guard, internal/core/autonomy, internal/surface/cli, commands/guard.md, .abcd/development/brief/04-surfaces/17-guard.md
+   - tests: internal/core/guard, internal/core/autonomy, internal/surface/cli
+   - Watched failing first: TestBranchRecorderOnCreate (`git worktree add -b
+     feat/x ../x`, `git switch -c feat/y` and `git checkout -B feat/z`
+     record the branch under this copy's key, whether or not the person is
+     away, only when no branch of that name exists, and `git checkout -b
+     main` on an existing `main` records nothing); TestBranchRecorderNeverRefuses
+     (the command is allowed whatever the recorder does, and a store it cannot
+     write leaves a stderr line); TestBranchRecorderUnderLock (two recordings
+     racing keep both). commands/guard.md and the brief's guard chapter say
+     the hook records a created branch and refuses nothing for it.
 4. Owed work, and invariant 7's clause
    - packages: internal/core/autonomy, .abcd/development/brief/02-constraints/03-invariants.md
    - tests: internal/core/autonomy
@@ -592,13 +531,15 @@ set and no question is marked open.
      TestClearingRuleWithoutReceipts (in a repository with no receipt
      folder, passing checks verify; with no pull request the reason says it
      was not verified); TestUnpushedSkipsGoneUpstream (a squash-merged
-     branch whose upstream is gone is not owed); TestPresentReadsDiskOnly
-     (zero forge calls while present); TestForgeListingDeadlineAndCache (a
-     hung listing ends at ten seconds; a listing younger than ten minutes is
-     reused; a stale cache falls back with its age named, else the disk
-     kinds and a "not read" note); TestOwedOrderFixed. Brief invariant 7
-     gains the away mode's one listing per check, its deadline and its
-     cache, citing adr-2610181003541997.
+     branch whose upstream is gone is not owed); TestQueuedPushHandsItemBack
+     (a queued step naming an unpushed branch hands it back while the branch
+     is ahead of its upstream; one naming a behind branch with nothing to
+     push does not; iss-5 queued does not hand back iss-50);
+     TestPresentReadsDiskOnly (zero forge calls while present);
+     TestForgeListingDeadline (a hung listing ends at ten seconds, and the
+     check judges from the disk kinds with a "not read" note);
+     TestOwedOrderFixed. Brief invariant 7 gains the away mode's one listing
+     per check and its deadline, citing adr-2610181003541997.
 5. The stop verdict, the Stop and StopFailure hooks
    - packages: internal/core/autonomy, internal/surface/cli, hooks
    - tests: internal/core/autonomy, internal/surface/cli
@@ -610,7 +551,10 @@ set and no question is marked open.
      "possibly forced by the cap"); TestCountResetsOnlyOnInactive (a change
      in the owed set at the sixth block does not reset the count, and the
      ninth consecutive block still records the stop; a block with
-     `stop_hook_active` false sets it to one); TestDeadlineCeiling (with
+     `stop_hook_active` false sets it to one); TestPushItemReasonDefersToStandingInstruction
+     (the reason for an unpushed branch says to push only if the standing
+     instruction allows, otherwise to queue it, and never names the away mode
+     as permission); TestDeadlineCeiling (with
      work owed and no reservation, now plus 30 minutes; with nothing owed,
      now plus one hour; with a renewal due sooner, that minus the skew);
      TestCronNextFire (lists, ranges, steps, both day fields, an unparsable
@@ -648,65 +592,74 @@ set and no question is marked open.
      get the same reason); TestAwayReasonListsPersonOnlyActs (the reason
      names every act in the list: the embargo `--approve` digest, the
      embargo triage verdict, the drain's hand-back, the remote-configuration
-     apply verb, a release sign-off and its meaning, a push or merge beyond
-     the session's own branches, an outward comment or message, and the
-     catch-all; and the route to `abcd mode queue` for those and to `abcd
-     decide` for the rest); TestAwayQuestionSetsNoMode (no mode set, no
-     marker written); TestPresentQuestionGateUnchanged. The brief's guard
-     chapter says what the gate does while away, and that nothing detects
-     the act mechanically.
+     apply verb, a release sign-off and its meaning, pushing, opening or
+     merging a pull request without a standing instruction, an outward
+     comment or message, and the catch-all; that the away mode is no
+     standing instruction; and the route to `abcd mode queue` for those and
+     to `abcd decide` for the rest); TestAwayQuestionSetsNoMode (no mode
+     set, no marker written); TestPresentQuestionGateUnchanged. The brief's
+     guard chapter says what the gate does while away, and that nothing
+     detects the act mechanically.
 7. The live session capture
    - packages: none (evidence only, kept in the local tier)
    - tests: a live Claude Code session with the plugin built from the branch
    - In a lab checkout, seed one behind pull request checked out before the
      mode is set, one stacked branch made with `git worktree add -b` in the
      session, and one unpushed branch, and record the transcript. It must
-     show: the agent's own `abcd mode autonomous` refused by the guard, and
-     `go run ./cmd/abcd mode autonomous` refused too, each attempt then
-     shown on the person's next prompt; the person's `!abcd mode autonomous
-     --until <an hour ahead>` running with no pre-tool hook call (a probe
-     hook the lab adds beside abcd's logs none for it), which settles whether the person can set it
-     from the session or must use a terminal; a message relayed from a
-     second session, starting with `!`, arriving as a prompt and not run as
-     a shell command, and whether that relay fires the prompt hook; the away
-     block on start and the person's line naming `abcd mode back`; a manual
-     `/compact` followed by the block again; an attempted stop blocked
-     naming the behind pull request; a reply with no tool call blocked
-     again rather than allowed; the stacked branch's item; a cron set for
-     the next morning refused as a wake and one inside the deadline
-     accepted, with abcd's computed fire time compared with the `next run`
-     the host's `CronList` row shows; nine blocks in a row with no tool
-     call, then the same with one tool call in between, to see where the
-     host's count resets; a question refused with the one reason; the
-     window left to lapse with a queued step, and the next prompt's line
-     naming `abcd mode back`; and `abcd mode back` printing the queue, the
-     recorded stops and the attempts. Repeat with the mode off to show the
-     stop allowed and flagged with no forge call. Capture before and after
-     the change on the same checkout, as the release lesson on host fixes
-     requires. If the relayed `!` runs as a shell command, or an agent's
-     tool call reaches shell mode, the plan falls back to a mode that grants
-     no push rights (dcn-2610181003456444) before it ships.
+     show: the mode set and the away block on start, with the person's line
+     naming who set it and `abcd mode back`; a manual `/compact` followed by
+     the block again; an attempted stop blocked naming the behind pull
+     request; a reply with no tool call blocked again rather than allowed;
+     the stacked branch's item; the unpushed branch's reason deferring to the
+     standing instruction, and, with none given, the push queued and the
+     item no longer named; a cron set for the next morning refused as a wake
+     and one inside the deadline accepted, with abcd's computed fire time
+     compared with the `next run` the host's `CronList` row shows; nine
+     blocks in a row with no tool call, then the same with one tool call in
+     between, to see where the host's count resets; a question refused with
+     the one reason; the window left to lapse with a queued step, and the
+     next prompt's line naming `abcd mode back`; and `abcd mode back`
+     printing the queue and the recorded stops. Repeat with the mode off to
+     show the stop allowed and flagged with no forge call. Capture before and
+     after the change on the same checkout, as the release lesson on host
+     fixes requires.
 
 ## Size
 
-Re-estimated in review round 2 at eight working days, up from five. The new
-step 2 (the guard entries, the `go run` spelling and the file-tool hook) is
-most of the growth; the rest is the ownership, link and review rules in step
-4, the deadline, jitter and cron cases in step 5, and the longer capture:
+Re-estimated after the trim at 5.75 working days, down from eight
+(dcn-2610181017056307):
 
-| step | days |
-|---|---|
-| 1. The away record, its store, its lock and its verbs | 1.0 |
-| 2. Only the person sets it: the guard entries and the branch recorder | 1.5 |
-| 3. Repeated to the agent, shown to the person | 0.75 |
-| 4. Owed work, and invariant 7's clause | 2.0 |
-| 5. The stop verdict, the Stop and StopFailure hooks | 1.5 |
-| 6. The question reroute | 0.5 |
-| 7. The live session capture | 0.75 |
-| total | 8.0 |
-
-Round 1 estimated five days for six steps; the first plan wrote no size
-down.
+| step | days | was |
+|---|---|---|
+| 1. The away record, its store, its lock and its verbs | 0.75 | 1.0 |
+| 2. Repeated to the agent, shown to the person | 0.5 | 0.75 |
+| 3. The created-branch recorder | 0.25 | (in the old step 2, 1.5) |
+| 4. Owed work, and invariant 7's clause | 1.75 | 2.0 |
+| 5. The stop verdict, the Stop and StopFailure hooks | 1.5 | 1.5 |
+| 6. The question reroute | 0.5 | 0.5 |
+| 7. The live session capture | 0.5 | 0.75 |
+| total | 5.75 | 8.0 |
+
+Step 1 loses the refused attempts and the fuller `mode back` print; step 2
+the attempt line; step 4 the listing's reuse cache and its stale-cache
+fallback, less the small queue hand-back it gains; step 7 the guard, `!`
+and relay checks. The old step 2's guard entries leave whole, and only its
+branch recorder stays, as step 3.
+
+**Why not four.** About four working days is not reachable by scoping
+alone. Steps 3 to 5 carry 3.5 days, and every rule in them answers a
+review finding the trim keeps: the created-branch, stale-ownership and
+`Refs:` rules (round-2 blockers 3 to 5), the merge state (blocker 2), and the
+deadline and cron cases (blocker 1). Cutting any of them reopens a blocker,
+and the stacked-branch rules are the issue's second instance. The floor is
+about 5.75 days of work. The elapsed time can be shorter: `Judge` is pure
+over the owed set, so steps 3 and 4 can run in one lane while steps 1, 2, 5
+and 6 run in another once step 1 fixes the record's shape, which puts the
+critical path at about four days with the capture after both. Whether to run
+two lanes is the release orchestrator's choice.
+
+Round 2 estimated eight days for seven steps, round 1 five days for six; the
+first plan wrote no size down.
 
 ## Review round 1
 
@@ -756,3 +709,70 @@ narrowed by the findings below. Each item and how it was handled:
 | minor | the intent still lists a superseded decision | fixed: dcn-2610180913431985 removed from the intent's list; its successor dcn-2610180937181929 stays |
 | minor | mint an ADR for the invariant 7 amendment | made: adr-2610181003541997, proposed |
 | size | not a finding; re-estimated for the fixes | eight working days, step by step above |
+
+## Trim after round 2
+
+On 2026-10-18 the release orchestrator ruled that the plan take the fallback
+and be trimmed to what closes iss-2610170619247185, aiming at about four
+working days, because the security and bug-fix cut waits on this slice. The
+reviewer added which items stay. Two decisions record it:
+dcn-2610181016510153 (the away mode grants no push rights; supersedes
+dcn-2610181003456444) and dcn-2610181017056307 (the trim and what moved).
+
+**What stays** is what serves the three things the issue needs: (i) a
+session with owed work cannot end its turn silently (the Stop hook, the
+ownership rules, the qualifying wake, the cap handling); (ii) questions
+reroute by the act (decided with `abcd decide`, or queued when only the
+person may approve); (iii) the away record (set, ended, lapsing,
+re-injected at start, compaction and prompt, with its lock).
+
+**What moved** to itd-2610170638184486, as named remaining work, and why:
+
+| moved | why |
+|---|---|
+| the guard entry refusing an agent's `abcd mode autonomous`, and its routes through `sh -c` and script files | the mode grants no rights now, so there is nothing for it to guard in this slice; and the OS fence (spc-2610161751056096) never covers the person's interactive sessions, so it could not become a boundary for the sessions that stalled |
+| the guard reading `go run ./cmd/abcd` and built `abcd-<goos>-<arch>` binaries as `abcd`, for every entry, the ledger flip included | a security-relevant widening of what every entry matches, which deserves its own review in the checklist work, not a ride on this cut |
+| the shell-write and file-tool refusals on the away store, and the PreToolUse matcher gaining the file tools | they only protected the person-only setting |
+| the refused attempts: recorded, shown on the next prompt, listed by `abcd mode back` | they only reported the person-only setting |
+| the capture's checks of the person's `!` command and of a relayed `!` | they tested the push-rights premise the fallback removes; the checklist work needs them when it makes the mode person-only |
+| the away forge listing's ten-minute reuse cache and its stale-cache fallback | tuning: each away check makes one listing under its ten-second deadline, and a failed read judges from disk, naming the pull requests as not read, so nothing is hidden; a run of eight blocks costs up to eight bounded listings |
+| `abcd mode back` printing more than one plain line per queued step and per recorded stop | the report on return is already the checklist draft's; the plain lines keep the queue read |
+
+**Added by the fallback** (dcn-2610181016510153): the reason for an item that
+needs a push tells the session to push if its standing instruction allows
+and otherwise to queue the push, never treating the away mode as
+permission; a queued step that names the item's branch or record id hands it
+back for the window, a branch only while it holds commits to push; and the
+person-only acts gain pushing, opening or merging a pull request without a
+standing instruction. Without the hand-back, a session with no standing
+instruction to push would be blocked on its unpushed branch until the host's
+cap.
+
+**Each round-2 item after the trim:**
+
+| # | round-2 finding | state after the trim |
+|---|---|---|
+| (a) | away mode as the person's ask to push is not safe | closed by the fallback the review named: the mode grants no push rights, so a relayed word cannot grant any; the guard entries that answered it the other way moved out with dcn-2610181003456444, which dcn-2610181016510153 supersedes. A mode set on a relayed word only keeps sessions working and deciding, and the person sees who set it on the next prompt |
+| (b) | the cap count can miss a forced stop | kept: the count resets only on `stop_hook_active` false, the stop at the cap is labelled "possibly forced by the cap", and the capture checks where the host resets (step 5, step 7) |
+| (c) | cron in local time; a capture check | kept: the capture compares abcd's fire time with the host's `CronList` next run (step 7) |
+| 1 | the wake deadline still allows the stall | kept whole: the ceiling, the host's lateness, the 24-hour-lease case and the daylight-saving, day-7, `a-b/n` and `*/n` cases (step 5) |
+| 2 | "behind" against a stale default branch | kept: the forge's merge state while away, disk only for a branch with no pull request (step 4); the listing loses only its reuse cache, and invariant 7's clause and adr-2610181003541997, amended while proposed, say one listing per check |
+| 3 | instance 2 missed: the stacked drain branches | kept, in any mode: the pre-tool hook records a created branch, now its own step 3, and it refuses nothing; the capture seeds one (step 7) |
+| 4 | `Refs:` as a carrier; iss-5 matching iss-50 | kept: linked by head branch or a closing trailer on word boundaries, a `Refs:` line carrying only for an already-own branch (step 4) |
+| 5 | stale ownership | kept: run lanes only while their reservation is live, reflog and recorded branches only with a commit of this checkout's in 14 days (step 4) |
+| 6 | the person-only list is incomplete | kept, and extended by the fallback: pushing, opening or merging a pull request without a standing instruction joins it, replacing "a push or merge beyond the session's own branches" (step 6) |
+| 7 | the queue goes unread when the window lapses | kept: the every-prompt line and the lapsed-window line, both naming `abcd mode back`; the lapsed line now counts queued steps and recorded stops, the refused attempts having moved (step 2) |
+| minor | the clearing rule needs abcd's receipt | kept: passing checks verify where no receipts are minted (step 4) |
+| minor | the clearing rule leaves out review | kept: an outstanding review keeps a stacked branch owed (step 4) |
+| minor | the intent lists a superseded decision | unchanged, still fixed; dcn-2610181003456444 is now superseded too and the intent says so |
+| minor | mint an ADR for invariant 7 | kept: adr-2610181003541997, proposed, amended to drop the cache from its decision |
+| size | re-estimate | 5.75 days, step by step under Size; about four is the elapsed time with two lanes, not the work |
+
+**Round-1 items the trim touches:** item 9 (the per-turn forge call) stays
+fixed, since present mode makes no call and the away call is bounded, though
+no longer cached; item 13 keeps the recorded ender, while showing it on
+return had already moved; items 6, 7 and 11 are kept whole.
+
+**No blocker is reopened.** Nothing the review made essential to (i) to
+(iii) was cut. The items kept against the trim's pressure, and why, are
+listed in dcn-2610181017056307: each is the fix of a finding above.
diff --git a/.abcd/work/decisions/dcn-2610181016510153-the-away-mode-grants-no-push-rights-the.md b/.abcd/work/decisions/dcn-2610181016510153-the-away-mode-grants-no-push-rights-the.md
new file mode 100644
index 0000000000..0767b57b82
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610181016510153-the-away-mode-grants-no-push-rights-the.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610181016510153
+slug: the-away-mode-grants-no-push-rights-the
+date: 2026-10-18
+---
+2026-10-18 — The away mode grants no push rights: the person's own standing instruction stays the authority to commit, push, and open or merge a pull request, exactly as before the mode existed (facilitator-on-delegation on the release orchestrator's ruling, itd-2610180912189125 after plan review round 2; supersedes dcn-2610181003456444, round 2's choice (a), and with it the guard entries that made setting the mode the person's act alone). The OS sandbox of spc-2610161751056096 fences only the agents abcd's runner launches, never the person's own interactive sessions, so for the sessions that actually stalled on 2026-10-16 the guard entries would never become a boundary, and their two days would buy a trust claim the plan cannot make. The fallback dcn-2610181003456444 already named is taken now, not on the live capture's evidence. Where the stop check finds owed work that needs a push (an unpushed branch, a reservation whose work no pull request carries, a behind or failing pull request once its local fix is committed), its reason tells the session to push if its standing instruction allows, and otherwise to queue the push with abcd mode queue for the person's return; a queued step that names the item's branch or record id, on word boundaries, hands that item back to the person for the rest of the window (a branch only while it holds commits its upstream lacks, so only the push waits), and the stop check stops naming it. The away mode is never treated as permission. The person-only acts gain pushing, opening or merging a pull request without a standing instruction that allows it. Who sets the mode returns to dcn-2610180913399042: the person, or a session on their word in that session; since the mode grants nothing, a mode set on a relayed word only keeps sessions working and deciding instead of asking, and the person sees who set it, from which working copy, and the literal abcd mode back on their next prompt. Making the mode the person's act alone moves to itd-2610170638184486 as named remaining work: the guard entry refusing an agent's abcd mode autonomous, its other routes (sh -c and script files), the shell-write and file-tool refusals on the away store, the refused attempts recorded and shown, the capture's checks of the person's ! command and of a relayed !, and the guard reading go run ./cmd/abcd and built abcd-<goos>-<arch> binaries as abcd for every entry, the ledger flip included, a security-relevant widening that gets its own review there (grounds: the release orchestrator's ruling of 2026-10-18 and the reviewer's addendum, both recommending the fallback; spc-2610161751056096 and adr-2610161621415708, which fence launched agents only; iss-2610170619247185, whose standing instruction already allowed pushes and auto-merge; the fallback clause of dcn-2610181003456444)
diff --git a/.abcd/work/decisions/dcn-2610181017056307-the-overnight-stall-slice-is-trimmed-to.md b/.abcd/work/decisions/dcn-2610181017056307-the-overnight-stall-slice-is-trimmed-to.md
new file mode 100644
index 0000000000..9108a5e0a1
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610181017056307-the-overnight-stall-slice-is-trimmed-to.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610181017056307
+slug: the-overnight-stall-slice-is-trimmed-to
+date: 2026-10-18
+---
+2026-10-18 — The overnight-stall slice is trimmed to what closes iss-2610170619247185 and nothing else (facilitator-on-delegation on the release orchestrator's ruling, itd-2610180912189125 after plan review round 2; refines dcn-2610180937181929): it keeps (i) a session with owed work cannot end its turn silently, through the Stop hook stop check with the ownership rules, the qualifying wake and the cap handling the reviews required; (ii) questions rerouted by the act, every other question decided with abcd decide and the person-only acts queued; and (iii) the away record set, ended, lapsing after at most seven days, re-injected at start, compaction and every prompt, under its lock. Moved to itd-2610170638184486 as named remaining work: the person-only guard step (dcn-2610181016510153), with the guard's reading of go run ./cmd/abcd and built binaries as abcd; the ten-minute reuse cache of the away forge listing and its stale-cache fallback, so each away check makes at most one listing under its ten-second deadline and a failed read judges from disk naming the pull requests as not read (adr-2610181003541997, still proposed, amended to match); abcd mode back printing more than one plain line per queued step and per recorded stop (any grouping, formatting or window summary); and the refused-attempt lines on the prompt. Kept despite the trim, because a review finding's fix rests on each: the created-branch list recorded in any mode (round-2 blocker 3, the drain's stacked branches, instance 2 of the issue); the Refs rule and word-boundary matching (blocker 4); the stale-ownership bounds (blocker 5); the wake deadline with the host's lateness and the cron cases (blocker 1); the forge's merge state for behind, with the one bounded listing and invariant 7's clause (blocker 2); the person-only acts list (blocker 6); the every-prompt line and the lapsed-window line naming abcd mode back (blocker 7); the block count and its possibly-forced label (round-2 (b)); the clearing rule's review and receipt terms (round-2 minors); the record's lock, ownership checks and seven-day cap (round-1 findings 6 and 7); the recorded ender (round-1 finding 13); the StopFailure record and the prose-question block (round-1 finding 11); and the badge verbs refused while away, which keeps a question from waiting on the person through the badge (dcn-2610180913431493). Re-estimated at 5.75 working days over seven steps, down from eight; about four is not reachable without reopening blockers 1 to 5, since the owed-work reading and the stop verdict with its cron parser carry 3.5 days between them and every rule in them answers a finding; the verdict is pure over the owed set, so two lanes could bring the elapsed time to about four days if the release orchestrator chooses (grounds: the release orchestrator's ruling of 2026-10-18 and the reviewer's addendum listing what stays; the spec's review rounds 1 and 2; AGENTS.md wired or it isn't done)

From 6b43f903b96268fe65718bf4d8e9d8b4712d4c55 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 11:39:19 +0100
Subject: [PATCH 08/58] docs: narrow the overnight-stall plan's hand-back and
 wake after its third review

A queued push now hands nothing back unless the person ran abcd mode
autonomous --hold-pushes, and then only a verified branch's unpushed
item; a qualifying wake releases an unchanged set of work the session can
do itself at most twice in a row. The cheap minors are written in, a
Review round 3 section lists each finding, and the size is re-estimated
at 7.5 days of work.

Refs: itd-2610180912189125
Assisted-by: Claude:claude-opus-5-5
---
 ...97-the-away-mode-s-stop-check-reads-the.md |   8 +-
 ...125-a-session-told-to-work-on-while-its.md |  55 ++-
 ...489-a-session-told-to-work-on-while-its.md | 332 +++++++++++++-----
 ...a-queued-push-hands-nothing-back-unless.md |   6 +
 ...a-qualifying-wake-releases-an-unchanged.md |   6 +
 5 files changed, 300 insertions(+), 107 deletions(-)
 create mode 100644 .abcd/work/decisions/dcn-2610181035355741-a-queued-push-hands-nothing-back-unless.md
 create mode 100644 .abcd/work/decisions/dcn-2610181035361997-a-qualifying-wake-releases-an-unchanged.md

diff --git a/.abcd/development/decisions/adrs/2610181003541997-the-away-mode-s-stop-check-reads-the.md b/.abcd/development/decisions/adrs/2610181003541997-the-away-mode-s-stop-check-reads-the.md
index 1186a4bd90..11a7fb87b4 100644
--- a/.abcd/development/decisions/adrs/2610181003541997-the-away-mode-s-stop-check-reads-the.md
+++ b/.abcd/development/decisions/adrs/2610181003541997-the-away-mode-s-stop-check-reads-the.md
@@ -44,8 +44,12 @@ reuse cache is remaining work of itd-2610170638184486 (dcn-2610181017056307).
 We will keep the check disk-only whenever the away mode does not hold: no
 turn's end while the person is present touches the network.
 
-We will name a failed or late read, never hide it: the check falls back to
-the disk kinds alone, with the pull requests named as not read.
+We will name a failed or late read, never hide it: the check fails open to
+the disk kinds alone, with the pull requests named as not read. A branch
+with a pull request is then compared on disk with the last-fetched default
+branch, naming the fetch time, and a reservation is never reported as
+uncarried, so a failed read cannot lead a session to open a duplicate pull
+request (plan review round 3).
 
 We will add this listing to invariant 7 as the away mode's documented
 meaning, beside the drain's.
diff --git a/.abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md b/.abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md
index 34567c3d5d..6c5085642a 100644
--- a/.abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md
+++ b/.abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md
@@ -70,7 +70,8 @@ its turn on a question to the person.
 
 ## What's In Scope
 
-- **The away mode.** `abcd mode autonomous [--until <time>]` records who set
+- **The away mode.** `abcd mode autonomous [--until <time>]
+  [--hold-pushes]` records who set
   it, from which working copy, when, and when it ends, at most seven days
   on; `abcd mode back` ends it, prints one line per queued step and recorded
   stop, and records who ended it. One record per repository on the machine, shared by every
@@ -79,9 +80,15 @@ its turn on a question to the person.
 - **It grants nothing.** The person's own standing instruction stays the
   authority to commit, push, and open or merge a pull request, as before.
   Where owed work needs a push, the stop check tells the session to push if
-  its standing instruction allows, and otherwise to queue the push, which
-  hands that item back to the person for the window. The person sets the
-  mode, or a session does on their word (dcn-2610181016510153).
+  its standing instruction allows; a queued push hands nothing back, so the
+  item stays owed and a stop the host's cap forces is recorded. Only when the
+  person has said pushes wait (`--hold-pushes`, which narrows and grants
+  nothing) does a queued push hand back a branch's unpushed item, and only
+  once its head contains the base's last-fetched tip and has a receipt; never
+  a behind, failing or under-review item, a reservation alone or a renewal.
+  The person's line counts the queued steps and the handed-back items. The
+  person sets the mode, or a session does on their word
+  (dcn-2610181016510153, dcn-2610181035355741).
 - **Repeated, never summarised away.** While it holds, the session-start hook
   (every source, compaction included) and the prompt hook (every prompt) add
   one short block to the session's context (dcn-2610180913406972), and the
@@ -92,14 +99,15 @@ its turn on a question to the person.
   person is away a session is only working or waiting: a turn's end with owed
   work is refused, naming the next item, and a stop is allowed only with a
   wake that fires, the host's lateness included, within half an hour while
-  work is owed and before its reservations need renewing; the host's cap of
-  eight continuations is the outer bound, and a stop it may have forced is
-  recorded.
+  work is owed and before its reservations need renewing, and a wake
+  releases an unchanged set of work the session can do itself at most twice
+  in a row; the host's cap of eight continuations is the outer bound, and a
+  stop it may have forced is recorded.
   A StopFailure hook records a turn ended by an API error. While the person
   is present the check reads disk only and points the work out
   (dcn-2610180913413137, dcn-2610180913421109, dcn-2610180936577720,
   dcn-2610180936579498, dcn-2610180937175629, dcn-2610181003455731,
-  dcn-2610181003484631).
+  dcn-2610181003484631, dcn-2610181035361997).
 - **Owed work**, in exactly these terms: a live reservation under this
   working copy's key whose renewal is due or whose work no open pull request
   carries yet; an open pull request of the session's own that is behind its
@@ -210,9 +218,19 @@ its turn on a question to the person.
   it tries to end its turn, **then** the stop is blocked with a reason that
   says to push only if a standing instruction allows and otherwise to queue
   the push, never naming the away mode as permission; **and when** it
-  queues a step naming that branch, **then** the branch is no longer named
-  as owed in this window and the step is shown when Alice runs `abcd mode
-  back`.
+  queues a step naming that branch, **then** the branch is still named as
+  owed, a stop the host's cap forces is recorded, and the step is shown when
+  Alice runs `abcd mode back`.
+- **Given** Alice set the away mode with `--hold-pushes` and the session's
+  unpushed branch has the default branch's last-fetched tip merged in and a
+  preflight receipt for its head, **when** it queues a step naming that
+  branch, **then** the branch's unpushed item is handed back and the line
+  shown to Alice counts it; **and given** instead a pull request of its own
+  that is behind, merged locally and queued, **then** it stays owed.
+- **Given** the away mode holds, a pull request of the session's own stays
+  behind, and the session has set a cron that fires every ten minutes,
+  **when** it tries to stop with the owed set unchanged a third time in a
+  row, **then** the stop is blocked naming that pull request.
 - **Given** a session sets the away mode on a message relayed from another
   session, **when** Alice sends her next prompt, **then** the line shown to
   her names who set it, from which working copy, and `abcd mode back`, and
@@ -244,8 +262,10 @@ its turn on a question to the person.
   plugin from the branch runs an away window with seeded owed work, a
   compaction and an attempted stop, **then** a captured transcript shows the
   away block at start and after compaction, the blocked stop naming the next
-  item, an unpushed branch's push queued and no longer named, and the
-  refused question.
+  item, an unpushed branch's queued push still named without
+  `--hold-pushes` and handed back with it once its head is verified, the
+  third unchanged stop with a ten-minute wake blocked, and the refused
+  question.
 
 ## SOTA
 
@@ -346,6 +366,15 @@ The trim after review round 2, on the release orchestrator's ruling:
 29. **The slice trimmed to what closes the issue, with what moved listed**
     (dcn-2610181017056307), refining decision 18.
 
+Review round 3 of 2026-10-18 narrowed two of them:
+
+30. **A queued push hands nothing back unless the person said pushes wait,
+    and then only a verified branch's unpushed item** (dcn-2610181035355741),
+    refining decision 28.
+31. **A wake releases an unchanged set of work the session can do itself at
+    most twice in a row** (dcn-2610181035361997), refining decisions 13 and
+    20.
+
 The invariant 7 amendment is recorded as adr-2610181003541997 (proposed),
 amended by the trim to one uncached listing per check.
 
diff --git a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
index 29cc2c9a88..e424660269 100644
--- a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
+++ b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
@@ -11,10 +11,13 @@ production_mode: hand-written
 
 Delivers itd-2610180912189125, the first slice of the checklist draft
 (itd-2610170638184486) and the fix for iss-2610170619247185. Trimmed after
-review round 2 to what closes the issue (dcn-2610181017056307). Three parts:
+review round 2 to what closes the issue (dcn-2610181017056307), and
+narrowed by review round 3 (dcn-2610181035355741, dcn-2610181035361997).
+Three parts:
 
-- **The away record.** `abcd mode autonomous [--until <time>]`, `abcd mode
-  back` and `abcd mode queue "<step>"` keep one away record per repository on
+- **The away record.** `abcd mode autonomous [--until <time>]
+  [--hold-pushes]`, `abcd mode back` and `abcd mode queue "<step>"` keep one
+  away record per repository on
   the machine, changed only under a lock and lapsing at its end, seven days
   at most. The session-start hook (every source, `compact` included) and the
   prompt hook repeat it to the agent while it holds, and the prompt hook
@@ -26,7 +29,9 @@ review round 2 to what closes the issue (dcn-2610181017056307). Three parts:
   record holds, a session is only working or waiting: a turn's end is blocked
   while owed work exists, naming the next item, and is allowed only with a
   wake that fires, the host's lateness included, within half an hour while
-  work is owed and before the session's reservations need renewing. The host's
+  work is owed and before the session's reservations need renewing, and a
+  wake releases an unchanged set of work the session can do itself at most
+  twice in a row. The host's
   cap of eight consecutive continuations is the outer bound. A StopFailure
   hook records a turn the host ends on an API error. While the person is
   present the check reads disk only and points the work out.
@@ -110,10 +115,14 @@ host's question tool.
   fsutil's atomic writer.
 - **What it holds.** Who set it: the holder name reservations cache, without
   a network read, falling back to git's `user.name`, and the working copy it
-  was set from. It also holds the start, the end, the queue of steps for the
-  person, the stops recorded (with work owed, with no next look, or on an
-  API error with its type, each at the cap labelled "possibly forced by the
-  cap"), and, once ended by word, who ended it and from which working copy.
+  was set from. It also holds the start, the end, whether the person said
+  pushes wait (`--hold-pushes`), the queue of steps for the person, the items
+  the stop check handed back (branch and head), the stops recorded (with work
+  owed, with no next look, or on an API error with its type, each at the cap
+  labelled "possibly forced by the cap"; a stop identical to the last one
+  recorded is kept as that entry with a count and the last time, so a wake
+  every ten minutes cannot push the record past its 64 KiB check), and, once
+  ended by word, who ended it and from which working copy.
 - **The lock** (dcn-2610180937181736). Every read-modify-write (`mode
   autonomous`, `mode back`, `mode queue`, a recorded stop, a recorded
   branch) holds `fsutil.WithFileLock` on the lock file and re-reads the
@@ -136,16 +145,17 @@ host's question tool.
   through 2026-10-17, fits; a forgotten record lapses.
 - **Seen by the person.** While the record holds, the prompt hook adds a
   one-line `systemMessage` on every prompt: away until when, set by whom and
-  from which working copy, and the literal `abcd mode back` as the way to
-  end it. The away block tells the agent to run `abcd mode back` only on the
+  from which working copy, "N steps queued, M items handed back", and the
+  literal `abcd mode back` as the way to end it (dcn-2610181035355741). The away block tells the agent to run `abcd mode back` only on the
   person's word in its session (dcn-2610181003474765).
 - **A lapsed window with anything unread.** While a record whose end has
   passed is not yet closed and holds a queued step or a recorded stop, the
   prompt hook shows the person one line on every prompt counting them and
   naming `abcd mode back`, until that verb closes the record
   (dcn-2610181003474765).
-- **Ending it.** `abcd mode back` prints one plain line per queued step and
-  per recorded stop (its label included), records who ended the mode and
+- **Ending it.** `abcd mode back` prints one plain line per queued step, per
+  handed-back item and per recorded stop (its label and count included),
+  records who ended the mode and
   from which working copy, and ends the record; on a record whose time has
   passed it prints the same and closes it. Nothing more is printed: the
   report on return moved to the checklist draft.
@@ -172,6 +182,13 @@ grants no rights, a mode set on a relayed word only keeps sessions working
 and deciding instead of asking, and the person sees who set it, from which
 working copy, and `abcd mode back` on their next prompt.
 
+**Pushes held** (dcn-2610181035355741). `--hold-pushes` is the person's word
+that pushes wait for their return. It only narrows what sessions do and grants
+nothing, so dcn-2610181016510153 stands: like the mode, nothing can check who
+ran it, and set on a relayed word it can at worst make sessions queue pushes
+they could have sent. It is the only thing that lets a queued push hand an
+item back (Owed work, below).
+
 **Why the guard entries left the slice.** Round 2's choice (a) made setting
 the mode the person's act alone, because the mode then carried push rights.
 The OS sandbox of spc-2610161751056096 fences only the agents abcd's runner
@@ -205,10 +222,15 @@ dcn-2610181003488355):
   holds (dcn-2610181003463367):
   - this working copy's HEAD reflog has checked it out;
   - the session created it: when the guard's pre-tool hook sees this session
-    run `git worktree add -b|-B <b>`, `git switch -c|-C <b>` or `git checkout
-    -b|-B <b>`, and no branch named `<b>` exists yet, it records `<b>` under
-    this copy's key in the away store, under the store's lock, whether or not
-    the person is away. The hook only records; it refuses nothing, and a
+    run `git worktree add -b|-B <b>`, `git switch -c|-C <b>`, `git checkout
+    -b|-B <b>` or `git branch <b>`, and no branch named `<b>` exists yet, it
+    records `<b>` under this copy's key in the away store, under the store's
+    lock, whether or not the person is away. A bare `git worktree add <path>`
+    records the branch git names after the folder, `git worktree add <path>
+    <existing>` records `<existing>`, and `git branch -m|-M <old> <new>`
+    carries a record from `<old>` to `<new>`; branch names match as whole
+    tokens, and the file is capped (the builder sets the bound, oldest
+    dropped). The hook only records; it refuses nothing, and a
     failed write leaves the command allowed with a stderr line. This is how
     the stacked drain branches of 2026-10-17 (`feat/drain-step11` and its
     siblings) are seen: cut with a plain `git worktree add`, they had no
@@ -233,6 +255,12 @@ dcn-2610181003488355):
   above leaves out, since it holds none of this checkout's commits. A
   sibling copy's branch is none of the routes above, so it never holds this
   session.
+- **Which copy.** A session's copy is the worktree it started in: the
+  session-start hook notes the worktree root of its payload's `cwd` per
+  session id in the away store, and the recorder and the stop check read the
+  copy key, local tier and session state from that root, so a session that
+  changes directory into a worktree it just made keeps its copy key; a
+  session with no note uses its payload `cwd`'s worktree.
 - **The reservation filter and link** (dcn-2610181003467233). A reservation
   counts only when its copy key is this copy's (the view's `Copy ==
   CopyThis`). A pull request carries a reservation's work when the record id
@@ -247,7 +275,10 @@ dcn-2610181003488355):
 - **Behind** (dcn-2610181003464379). While away, a pull request is behind
   when the listing's merge state (`mergeStateStatus`) is `BEHIND`, which the
   forge measures against its base as it stands now, not against the
-  last-fetched default branch, which nothing refreshes overnight. Only a
+  last-fetched default branch, which nothing refreshes overnight. `DIRTY` (a
+  conflicting pull request) is owed as behind too, and `UNKNOWN` reads as not
+  read. GitHub reports `BEHIND` only where the base requires branches to be up
+  to date, so the live capture's lab base requires it. Only a
   branch with no pull request is compared on disk, with the last-fetched
   default branch, and the reason names when that ref was last fetched.
 - **Finding a stacked branch.** An own branch is stacked when its open pull
@@ -273,16 +304,33 @@ dcn-2610181003488355):
   upstream configured, not in any remote-tracking ref. A branch whose
   upstream is gone (merged and deleted on the remote, a squash merge
   included) never counts.
-- **Handed back by the queue** (dcn-2610181016510153). The mode grants no
-  push, so an item whose next act is a push (an unpushed branch, a
-  reservation whose work no pull request carries, a behind or failing pull
-  request once its local fix is committed) may be one the session has no
-  standing instruction to send. A queued step that names the item's branch
-  or record id, on the same word-boundary match as the link, hands that item
-  back to the person for the rest of the window, so the stop check stops
-  naming it. A branch is handed back only while it holds commits its upstream
-  lacks, so the local work (the merge from the base, the fix, the review, the
-  preflight) is done first and only the push waits.
+- **Queued pushes, and the one hand-back** (dcn-2610181035355741, refining
+  dcn-2610181016510153). The mode grants no push, so an item whose next act
+  is a push (an unpushed branch, a reservation whose work no pull request
+  carries, a behind or failing pull request once its local fix is committed)
+  may be one the session has no standing instruction to send.
+  - **By default a queued push hands nothing back.** The item stays owed and
+    the stop stays blocked; a session with no standing instruction to push
+    ends at the host's cap, and the stop is recorded for the person.
+  - **Only with `--hold-pushes`** does a queued step hand anything back. A
+    step naming an own branch, on the same word-boundary match as the link,
+    removes only that branch's unpushed item, and only while the disk shows
+    the rest clear: its head contains its base's last-fetched tip (the
+    default branch, or a stacked branch's base branch as it stands on disk),
+    and a preflight receipt names the head (`landing.Receipt`) where the
+    repository mints receipts. Where it mints none, the clearing rule's
+    equivalent, passing checks in the listing, can only name a pushed
+    commit, so nothing is handed back there.
+  - **Never handed back:** a pull request that is behind (or `DIRTY`) or
+    failing, which the forge reads so until the push; a stacked branch the
+    clearing rule still owes; a review outstanding; a reservation named by
+    its record id alone; a renewal. So a behind pull request whose merge is
+    committed locally stays owed with pushes held and ends at the cap,
+    recorded: the instance of 2026-10-16 shows up in the morning instead of
+    passing as nothing owed.
+  - The conditions are re-read at every check. The stop check records each
+    item it hands back (branch and head) in the away record under its lock,
+    once per branch and head, for the person's line and `abcd mode back`.
 - **What is read, and when (invariant 7,
   adr-2610181003541997).** While the person is present the check reads disk
   only: renewals due (reservations as last fetched, `claim.LastFetched`) and
@@ -291,8 +339,11 @@ dcn-2610181003488355):
   open pull requests (head and base branch, author, body, merge state,
   review decision, check rollup; each field among those
   `internal/ghcontract` pins) under a ten-second deadline. On a failure or
-  timeout it judges from the disk kinds alone, naming the pull requests as
-  not read. There is no cache: a run of eight blocks costs up to eight
+  timeout it fails open to the disk kinds, naming the pull requests as not
+  read: a branch with a pull request is compared on disk with the
+  last-fetched default branch, naming the fetch time, and a reservation is
+  never reported as uncarried, so no duplicate pull request is opened. There
+  is no cache: a run of eight blocks costs up to eight
   listings, each bounded by the deadline (the reuse cache is remaining work
   of the checklist draft). Brief invariant 7 gains this listing as the away
   mode's documented meaning, as the drain's listing is, by
@@ -345,7 +396,21 @@ never counts on its own while away. No new dependency.
 (`.abcd/.work.local/autonomy/sessions/<session-id>.json`; an id outside
 `[A-Za-z0-9_-]{1,128}` is refused and the stop allowed with a stderr line)
 holds the state, the next look, the owed-set fingerprint, the last question
-message's hash, and the count of consecutive blocks.
+message's hash, the count of consecutive blocks, and the wake count with its
+own fingerprint of the capped items (below).
+
+**The wake count** (dcn-2610181035361997, refining dcn-2610180936577720 and
+dcn-2610181003455731). The capped items are the owed kinds the session can
+act on itself: a pull request that is behind or failing, an unpushed branch,
+a stacked branch the clearing rule still owes, and a reservation whose work
+no pull request carries (which the review's list did not name, but opening
+that pull request is the same kind of act as a push). A renewal that is only
+due, and an item waiting only on the forge (a stacked branch whose one unmet
+condition is its checks still running), are not capped. An allow by row 3
+while any capped item is owed adds one to the wake count; a change in the
+capped items' fingerprint sets it to zero. The count compares the capped
+items alone, so a renewal falling due or done neither resets it nor adds to
+it.
 
 While away, the rows are read in order and the first that matches decides:
 
@@ -353,16 +418,27 @@ While away, the rows are read in order and the first that matches decides:
 |---|---|---|
 | 1 | `last_assistant_message` ends on a line ending in `?`, not yet blocked for this message | block with the reroute's reason (working) |
 | 2 | owed, set changed or first block this session | block: next item and count (working) |
-| 3 | owed, set unchanged, qualifying wake | allow (waiting; next look kept) |
-| 4 | owed, set unchanged, no qualifying wake | block: next item, and if it cannot move, take another or schedule a look before the deadline (working) |
-| 5 | none owed, qualifying wake | allow (waiting; next look kept) |
-| 6 | none owed, no qualifying wake | block: take the next ready item first (reserve it), and only if none can be taken alone, schedule a look before the deadline (working) |
-
-- **An item that needs a push** (dcn-2610181016510153). The reason for it
-  says: do the local work, then push if your standing instruction allows;
-  otherwise queue the push with `abcd mode queue "<step>"` naming the branch
-  or record id, and take the next item. It never says the away mode allows
-  the push.
+| 3 | owed, set unchanged, qualifying wake, and no capped item owed or the wake count below two | allow (waiting; next look kept; the wake count adds one if a capped item is owed) |
+| 4 | owed, set unchanged, qualifying wake, a capped item owed and the wake count at two | block: next item; the set has not moved over two wakes, so a wake no longer releases this stop (working) |
+| 5 | owed, set unchanged, no qualifying wake | block: next item, and if it cannot move, take another or schedule a look before the deadline (working) |
+| 6 | none owed, qualifying wake | allow (waiting; next look kept) |
+| 7 | none owed, no qualifying wake | block: take the next ready item first (reserve it), and only if none can be taken alone, schedule a look before the deadline (working) |
+
+So a `*/10 * * * *` cron set once and an unchanged behind pull request give
+two waiting spells of up to ten minutes each, then blocks until the item
+moves or the host's cap records the stop; each later wake starts a turn that
+is blocked the same way, and the identical stops collapse into one recorded
+entry with a count.
+
+- **An item that needs a push** (dcn-2610181016510153, refined by
+  dcn-2610181035355741). Without `--hold-pushes` the reason says: do the
+  local work, then push if your standing instruction allows; queue only if
+  the person has said pushes wait, and a push you may not send stays owed,
+  so queue it with `abcd mode queue "<step>"` for the person and take
+  another item meanwhile. With `--hold-pushes` it says: the person has said
+  pushes wait; finish the local work (the merge from the base, the
+  preflight), then queue the push naming the branch. It never says the away
+  mode allows the push.
 - **`stop_hook_active`** decides no row, so both values are covered by every
   row. It alone drives the count (dcn-2610181003484631, refining
   dcn-2610180936577720): a block with it `false` sets the count to one, and
@@ -371,8 +447,8 @@ While away, the rows are read in order and the first that matches decides:
   falling due at the sixth block would have reset abcd to one, and the host's
   override at its ninth would have found abcd at three, unrecorded. The block
   whose count passes the cap (eight, or `CLAUDE_CODE_STOP_HOOK_BLOCK_CAP`
-  when set) records "stopped with work owed" (rows 2 and 4) or "stopped with
-  no next look" (row 6) in the away record, labelled "possibly forced by the
+  when set) records "stopped with work owed" (rows 2, 4 and 5) or "stopped
+  with no next look" (row 7) in the away record, labelled "possibly forced by the
   cap", because the host's count also resets on a tool call abcd cannot see.
   The count so errs toward recording a stop that did not happen, never
   toward missing one, and step 7 checks where the host's count resets.
@@ -382,7 +458,9 @@ While away, the rows are read in order and the first that matches decides:
 - **The front door.** `abcd hook stop` maps the payload and writes the host's
   JSON. A malformed payload, an unreadable record or a lock not had allows
   the stop and says so on stderr, following the guard's fail-open-loud
-  contract. A stop is never blocked on abcd's own fault.
+  contract. A stop is never blocked on abcd's own fault. The Stop entry in
+  `hooks/hooks.json` carries a timeout of 30 seconds, room for the
+  ten-second listing and the git reads.
 - **StopFailure** (dcn-2610180937175629). `abcd hook stop-failure`, while
   the record holds, records "stopped on an API error" with the error type,
   under the lock. It cannot continue the session; the scope conditions name
@@ -457,6 +535,10 @@ is set and no question is marked open.
      recorded stop, the "possibly forced by the cap" label included, and the
      ender and copy recorded; also on a record whose time has passed);
      TestRecordPastEndReadsEnded; TestQueueAppends;
+     TestHoldPushesRecorded (`--hold-pushes` is kept in the record, shown in
+     the away block, and grants nothing); TestRepeatedStopCollapses (a stop
+     identical to the last recorded one adds to its count and last time
+     instead of a new entry);
      TestConcurrentWritesUnderLock (two `mode queue` calls racing keep both
      steps, and a stop recorded after `mode back` re-reads inside the lock
      and does not turn the mode back on); TestRecordOwnershipFailsOpen (a
@@ -464,9 +546,13 @@ is set and no question is marked open.
      others, or over 64 KiB reads as not away, and a verb refuses naming
      it); TestBadgeRefusedWhileAway; the badge's three-word vocabulary test
      passes unchanged. The plugin page and the brief's `abcd mode` surface
-     text describe the three verbs and say the mode grants no rights, the
-     person's standing instruction deciding what is pushed, and `go generate
-     ./internal/surface/cli` refreshes the derived appendix.
+     text describe the three verbs and `--hold-pushes` and say the mode
+     grants no rights, the person's standing instruction deciding what is
+     pushed, and `go generate ./internal/surface/cli` refreshes the derived
+     appendix. This step also fixes the shapes of `Record` and of `Owed`
+     (the owed items, each with its kind, whether it is capped, and its
+     branch or record id) in `internal/core/autonomy`, so steps 3 and 4 and
+     steps 5 and 6 can run in two lanes against them.
 2. Repeated to the agent, shown to the person
    - packages: internal/surface/cli
    - tests: internal/surface/cli
@@ -477,8 +563,11 @@ is set and no question is marked open.
      only on the person's word); TestPromptRouterAwayBlockEveryPrompt (a
      second prompt in the same session too, outside the loader's dedup
      ledger); TestPromptRouterAwaySystemMessage (one line the person sees on
-     every prompt while it holds, naming who set it, from which copy, and
-     the literal `abcd mode back`); TestPromptRouterLapsedWindowLine (a
+     every prompt while it holds, naming who set it, from which copy, the
+     count of queued steps and of handed-back items, and the literal `abcd
+     mode back`); TestSessionStartNotesCopy (the session's start worktree is
+     noted per session id, and a later hook run from a worktree the session
+     made reads the start copy's key); TestPromptRouterLapsedWindowLine (a
      lapsed, unclosed record with a queued step or a recorded stop shows one
      line naming `abcd mode back` on every prompt until `mode back` closes
      it, and one with neither shows nothing); all inside the hook's existing
@@ -490,7 +579,11 @@ is set and no question is marked open.
      feat/x ../x`, `git switch -c feat/y` and `git checkout -B feat/z`
      record the branch under this copy's key, whether or not the person is
      away, only when no branch of that name exists, and `git checkout -b
-     main` on an existing `main` records nothing); TestBranchRecorderNeverRefuses
+     main` on an existing `main` records nothing); TestBranchRecorderOtherForms
+     (`git branch feat/w`, a bare `git worktree add ../v` recording `v`, and
+     `git worktree add ../u feat/u` on an existing branch are recorded; `git
+     branch -m feat/w feat/w2` carries the record; `feat/x` is not matched
+     inside `feat/x2`; the file stays within its cap); TestBranchRecorderNeverRefuses
      (the command is allowed whatever the recorder does, and a store it cannot
      write leaves a stderr line); TestBranchRecorderUnderLock (two recordings
      racing keep both). commands/guard.md and the brief's guard chapter say
@@ -523,7 +616,8 @@ is set and no question is marked open.
      branch own; on an own branch's pull request it carries it);
      TestBehindFromMergeState (a pull request whose merge state is `BEHIND`
      is owed while the local default branch is stale and shows it current;
-     one `CLEAN` is not); TestStackedBranchFoundWithoutPullRequest;
+     one `DIRTY` is owed as behind; one `CLEAN` is not; `UNKNOWN` reads as
+     not read); TestStackedBranchFoundWithoutPullRequest;
      TestStackedBranchClearingRule (owed while behind its base, failing,
      with a review outstanding, or unverified; waiting on its base
      otherwise); TestClearingRuleReview (`CHANGES_REQUESTED` in the listing,
@@ -532,19 +626,37 @@ is set and no question is marked open.
      folder, passing checks verify; with no pull request the reason says it
      was not verified); TestUnpushedSkipsGoneUpstream (a squash-merged
      branch whose upstream is gone is not owed); TestQueuedPushHandsItemBack
-     (a queued step naming an unpushed branch hands it back while the branch
-     is ahead of its upstream; one naming a behind branch with nothing to
-     push does not; iss-5 queued does not hand back iss-50);
+     (without `--hold-pushes` a queued step hands nothing back, the
+     unpushed branch staying owed; with it, a step naming an unpushed branch
+     whose head contains the base's last-fetched tip and has a receipt hands
+     back that branch's unpushed item, and the hand-back is recorded once
+     per branch and head; with it, none is handed back when the head lacks
+     the base tip, has no receipt, or the repository mints no receipts; nor
+     a pull request behind, `DIRTY` or failing whose fix is committed
+     locally; nor a stacked branch the clearing rule owes; nor one with
+     `CHANGES_REQUESTED`; nor a reservation queued by record id alone; nor a
+     renewal due; iss-5 queued does not hand back iss-50);
      TestPresentReadsDiskOnly (zero forge calls while present);
      TestForgeListingDeadline (a hung listing ends at ten seconds, and the
-     check judges from the disk kinds with a "not read" note);
+     check fails open to the disk kinds with a "not read" note: a branch with
+     a pull request is compared on disk naming the fetch time, and a
+     reservation is never reported as uncarried);
      TestOwedOrderFixed. Brief invariant 7 gains the away mode's one listing
      per check and its deadline, citing adr-2610181003541997.
 5. The stop verdict, the Stop and StopFailure hooks
    - packages: internal/core/autonomy, internal/surface/cli, hooks
    - tests: internal/core/autonomy, internal/surface/cli
-   - Watched failing first: TestJudgeRows (each of the six away rows and both
-     present rows, each with `stop_hook_active` true and false);
+   - Watched failing first: TestJudgeRows (each of the seven away rows and
+     both present rows, each with `stop_hook_active` true and false);
+     TestWakeReleasesUnchangedSetTwice (with `*/10 * * * *` and an
+     unchanged behind pull request, the first two stops with the wake are
+     allowed and the third is blocked, and so is each later one; the same
+     for failing, unpushed, stacked-not-clear and uncarried items; a set of
+     only a renewal due, or of a stacked branch waiting only on running
+     checks, keeps releasing; a renewal falling due between the wakes
+     neither resets nor adds to the count; a change in the capped items
+     resets it; the count and its fingerprint are read back from the
+     session's state file by a new hook process);
      TestJudgeEscapeBoundReproducesNoStall (owed, unchanged, `true`, no wake:
      blocked, not allowed); TestJudgeCapRecordsStop (the block passing the
      cap, and an override from the environment, records the stop labelled
@@ -552,9 +664,10 @@ is set and no question is marked open.
      in the owed set at the sixth block does not reset the count, and the
      ninth consecutive block still records the stop; a block with
      `stop_hook_active` false sets it to one); TestPushItemReasonDefersToStandingInstruction
-     (the reason for an unpushed branch says to push only if the standing
-     instruction allows, otherwise to queue it, and never names the away mode
-     as permission); TestDeadlineCeiling (with
+     (without `--hold-pushes` the reason for an unpushed branch says to push
+     if the standing instruction allows, to queue only if the person has said
+     pushes wait, and that a queued push stays owed; with it, to finish the
+     local work and then queue; neither names the away mode as permission); TestDeadlineCeiling (with
      work owed and no reservation, now plus 30 minutes; with nothing owed,
      now plus one hour; with a renewal due sooner, that minus the skew);
      TestCronNextFire (lists, ranges, steps, both day fields, an unparsable
@@ -580,7 +693,8 @@ is set and no question is marked open.
      `systemMessage` while present; a malformed payload, an unreadable record
      or a held lock allows with a stderr line); TestHookStopFailureRecords
      (the error type recorded while away, nothing written while present);
-     `hooks/hooks.json` gains Stop and StopFailure entries, and `hooks/stop.sh`
+     `hooks/hooks.json` gains Stop and StopFailure entries, the Stop entry
+     with a 30-second timeout, and `hooks/stop.sh`
      and `hooks/stop-failure.sh` take the same bootstrap and home checks as
      `hooks/subagent-stop.sh` (the hook-shape tests cover them); `go generate
      ./internal/surface/cli` refreshes the derived appendix.
@@ -611,10 +725,14 @@ is set and no question is marked open.
      the block again; an attempted stop blocked naming the behind pull
      request; a reply with no tool call blocked again rather than allowed;
      the stacked branch's item; the unpushed branch's reason deferring to the
-     standing instruction, and, with none given, the push queued and the
-     item no longer named; a cron set for the next morning refused as a wake
+     standing instruction, and, with none given and no `--hold-pushes`, the
+     push queued and the item still named; with `--hold-pushes` and a
+     receipt for its head, the item handed back and the person's line
+     counting it; a cron set for the next morning refused as a wake
      and one inside the deadline accepted, with abcd's computed fire time
-     compared with the `next run` the host's `CronList` row shows; nine
+     compared with the `next run` the host's `CronList` row shows; a
+     `*/10 * * * *` cron with the owed set unchanged releasing twice and the
+     third stop blocked; nine
      blocks in a row with no tool call, then the same with one tool call in
      between, to see where the host's count resets; a question refused with
      the one reason; the window left to lapse with a queued step, and the
@@ -626,37 +744,43 @@ is set and no question is marked open.
 
 ## Size
 
-Re-estimated after the trim at 5.75 working days, down from eight
-(dcn-2610181017056307):
+Re-estimated after review round 3 at 7.5 working days of work, up from the
+5.75 written after the trim (dcn-2610181017056307):
 
-| step | days | was |
+| step | days | after the trim |
 |---|---|---|
-| 1. The away record, its store, its lock and its verbs | 0.75 | 1.0 |
-| 2. Repeated to the agent, shown to the person | 0.5 | 0.75 |
-| 3. The created-branch recorder | 0.25 | (in the old step 2, 1.5) |
-| 4. Owed work, and invariant 7's clause | 1.75 | 2.0 |
-| 5. The stop verdict, the Stop and StopFailure hooks | 1.5 | 1.5 |
+| 1. The away record, its store, its lock and its verbs | 1.0 | 0.75 |
+| 2. Repeated to the agent, shown to the person | 0.75 | 0.5 |
+| 3. The created-branch recorder | 0.5 | 0.25 |
+| 4. Owed work, and invariant 7's clause | 2.25 | 1.75 |
+| 5. The stop verdict, the Stop and StopFailure hooks | 1.75 | 1.5 |
 | 6. The question reroute | 0.5 | 0.5 |
-| 7. The live session capture | 0.5 | 0.75 |
-| total | 5.75 | 8.0 |
-
-Step 1 loses the refused attempts and the fuller `mode back` print; step 2
-the attempt line; step 4 the listing's reuse cache and its stale-cache
-fallback, less the small queue hand-back it gains; step 7 the guard, `!`
-and relay checks. The old step 2's guard entries leave whole, and only its
-branch recorder stays, as step 3.
-
-**Why not four.** About four working days is not reachable by scoping
-alone. Steps 3 to 5 carry 3.5 days, and every rule in them answers a
-review finding the trim keeps: the created-branch, stale-ownership and
-`Refs:` rules (round-2 blockers 3 to 5), the merge state (blocker 2), and the
-deadline and cron cases (blocker 1). Cutting any of them reopens a blocker,
-and the stacked-branch rules are the issue's second instance. The floor is
-about 5.75 days of work. The elapsed time can be shorter: `Judge` is pure
-over the owed set, so steps 3 and 4 can run in one lane while steps 1, 2, 5
-and 6 run in another once step 1 fixes the record's shape, which puts the
-critical path at about four days with the capture after both. Whether to run
-two lanes is the release orchestrator's choice.
+| 7. The live session capture | 0.75 | 0.5 |
+| total | 7.5 | 5.75 |
+
+Round 3 adds: in step 1 `--hold-pushes`, the collapsed repeated stops and
+fixing the `Record` and `Owed` shapes; in step 2 the counts on the person's
+line and the session's start-copy note; in step 3 the other branch-creating
+forms, the rename and the cap; in step 4 the hand-back's base-tip and
+receipt conditions with their real-git cases, `DIRTY` and `UNKNOWN`, and the
+fail-open terms; in step 5 the wake count and its row; in step 7 the
+hand-back and wake-count checks. The rest of the rise is the Sonnet
+reviewer's point that 5.75 days was thin for about 60 tests on real-git
+fixtures: that reviewer planned about seven days before these additions, the
+Opus reviewer found the elapsed figure credible, and 7.5 is the honest
+figure with both.
+
+**Why not four.** About four working days of work is not reachable by
+scoping alone. Steps 3 to 5 carry 4.5 days, and every rule in them answers a
+review finding: the created-branch, stale-ownership and `Refs:` rules
+(round-2 blockers 3 to 5), the merge state (blocker 2), the deadline and
+cron cases (blocker 1), and the hand-back and wake count (round-3 F1 and
+F2). Cutting any of them reopens a finding, and the stacked-branch rules are
+the issue's second instance. The elapsed time can be shorter: `Judge` is
+pure over the owed set, so once step 1 fixes `Record` and `Owed`, steps 3
+and 4 (2.75 days) run in one lane while steps 2, 5 and 6 (3.0 days) run in
+another, which puts the critical path at about 4.75 days with the capture
+after both. Whether to run two lanes is the release orchestrator's choice.
 
 Round 2 estimated eight days for seven steps, round 1 five days for six; the
 first plan wrote no size down.
@@ -746,7 +870,9 @@ back for the window, a branch only while it holds commits to push; and the
 person-only acts gain pushing, opening or merging a pull request without a
 standing instruction. Without the hand-back, a session with no standing
 instruction to push would be blocked on its unpushed branch until the host's
-cap.
+cap. Review round 3 found that hand-back an exemption the session could
+grant itself, and narrowed it to `--hold-pushes` and a verified branch's
+unpushed item alone (below).
 
 **Each round-2 item after the trim:**
 
@@ -776,3 +902,25 @@ return had already moved; items 6, 7 and 11 are kept whole.
 **No blocker is reopened.** Nothing the review made essential to (i) to
 (iii) was cut. The items kept against the trim's pressure, and why, are
 listed in dcn-2610181017056307: each is the fix of a finding above.
+
+## Review round 3
+
+On 2026-10-18 an Opus and Sonnet pair reviewed the plan as frozen at
+600c109d6, with the verdict "ready to build once F1 and F2 are in". They
+found the round-2 mapping, the ADR and invariant 7's clause, the recorder
+and the two-lane estimate sound. Each item and how it was handled:
+
+| # | finding | handled |
+|---|---|---|
+| F1 | the queued-push hand-back lets the session exempt itself, replaying the first instance: a behind pull request merged locally and queued was handed back and stayed behind all night; it also covered stacked branches, reservations and renewals, and the person's line did not count it | fixed: by default a queued push hands nothing back, the item stays owed and the cap records the stop; only `abcd mode autonomous --hold-pushes`, which narrows and grants nothing (dcn-2610181016510153 stands), allows a hand-back, and then only of a branch's unpushed item while its head contains the base's last-fetched tip and has a receipt (or the clearing rule's equivalent, which an unpushed head never meets); never a behind, failing or under-review item, a reservation alone or a renewal; the person's line says "N steps queued, M items handed back"; TestQueuedPushHandsItemBack covers each case, the no-flag case included (dcn-2610181035355741) |
+| F2 | a cheap wake keeps a stall alive: a `*/10` cron set once releases an unchanged owed set at every wake | fixed: an unchanged set of capped items (behind, failing, unpushed, stacked-not-clear, and an uncarried reservation, added as the same kind of act) is released by a qualifying wake at most twice in a row, then blocked, the cap recording the stop; a renewal only due or an item waiting on running checks keeps releasing; the count and its fingerprint live in the session's state file in the local tier; TestWakeReleasesUnchangedSetTwice; repeated identical stops collapse into one entry so the record stays within 64 KiB (dcn-2610181035361997) |
+| minor | the behind kind: `DIRTY` and `UNKNOWN` | handed to the builder, and written into Owed work and TestBehindFromMergeState: `DIRTY` owed as behind, `UNKNOWN` not read |
+| minor | the recorder's forms: `git branch <b>`, a bare `git worktree add <path>`, `git worktree add <path> <existing>`, a record carried across `git branch -m` or `-M`, whole-token names, a capped file | handed to the builder, and written into "own" and TestBranchRecorderOtherForms; the cap's bound is the builder's |
+| minor | the copy key from a worktree's working directory | handed to the builder, and written into Owed work ("Which copy") and TestSessionStartNotesCopy; the note's shape is the builder's |
+| minor | fail-open when the listing fails, stated in the spec and the ADR | handed to the builder, and written into "What is read", TestForgeListingDeadline and adr-2610181003541997: a branch with a pull request compared on disk naming the fetch time, a reservation never reported as uncarried |
+| minor | a Stop hook timeout of about 30 seconds | handed to the builder, and written into the front door and step 5 |
+| minor | `Record` and `Owed` fixed in step 1 so the lanes can run in parallel | handed to the builder, and written into step 1 and Size |
+| size | Sonnet: 5.75 days thin, about seven; Opus: 3.75 days elapsed credible | re-estimated at 7.5 days of work with round 3's additions, about 4.75 elapsed in two lanes (Size) |
+
+No fourth review round: the two deltas are checked on the next commit by
+hand.
diff --git a/.abcd/work/decisions/dcn-2610181035355741-a-queued-push-hands-nothing-back-unless.md b/.abcd/work/decisions/dcn-2610181035355741-a-queued-push-hands-nothing-back-unless.md
new file mode 100644
index 0000000000..1f3f3ce784
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610181035355741-a-queued-push-hands-nothing-back-unless.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610181035355741
+slug: a-queued-push-hands-nothing-back-unless
+date: 2026-10-18
+---
+2026-10-18 — A queued push hands nothing back unless the person said pushes wait, and then only the unpushed item of a verified branch (facilitator-on-delegation, itd-2610180912189125 plan review round 3, finding F1; refines dcn-2610181016510153, whose grant of no push rights stands): by default a step queued with abcd mode queue hands nothing back, so the item stays owed and the stop stays blocked; the reason for an item that needs a push says to push if the standing instruction allows and to queue only if the person has said pushes wait, and a session with no instruction to push ends at the host's cap with the stop recorded for the person. A hand-back happens only when the away record carries the person's word that pushes wait, set with abcd mode autonomous --hold-pushes. The flag narrows what sessions do and grants nothing, so set on a relayed word it can at worst make sessions queue pushes they could have sent. Even then a queued step naming an own branch, on word boundaries, removes only that branch's unpushed item, and only while the disk shows the rest clear: its head contains its base's last-fetched tip, and a preflight receipt names the head where the repository mints receipts; where none are minted the clearing rule's equivalent, passing checks in the listing, can name only a pushed commit, so nothing is handed back there. It never removes a pull request that is behind or failing, a stacked branch the clearing rule still owes, a review outstanding, a reservation named by its record id alone, or a renewal, so a behind pull request whose merge is committed locally stays owed with pushes held and ends at the cap, recorded. The stop check records each hand-back in the away record under its lock, abcd mode back prints them, and the every-prompt line counts the queued steps and the handed-back items. TestQueuedPushHandsItemBack covers each case, the no-flag case handing nothing back (grounds: plan review round 3, finding F1, raised by both reviewers: the hand-back as written let a session exempt itself, replaying the first instance of iss-2610170619247185, where a behind pull request stayed behind all night; and it crossed the coordination intent's decisions that a stacked branch is cleared only by its merge and receipt and that a reservation's renewal must not lapse)
diff --git a/.abcd/work/decisions/dcn-2610181035361997-a-qualifying-wake-releases-an-unchanged.md b/.abcd/work/decisions/dcn-2610181035361997-a-qualifying-wake-releases-an-unchanged.md
new file mode 100644
index 0000000000..07d766dcf0
--- /dev/null
+++ b/.abcd/work/decisions/dcn-2610181035361997-a-qualifying-wake-releases-an-unchanged.md
@@ -0,0 +1,6 @@
+---
+id: dcn-2610181035361997
+slug: a-qualifying-wake-releases-an-unchanged
+date: 2026-10-18
+---
+2026-10-18 — A qualifying wake releases an unchanged set of work the session can do itself at most twice in a row (facilitator-on-delegation, itd-2610180912189125 plan review round 3, finding F2; refines dcn-2610180936577720 and dcn-2610181003455731): while away, a stop whose owed set is unchanged is allowed with a qualifying wake at most twice while any capped item stays unchanged, and the third such stop is blocked naming the next item; the block counts toward the host's cap, whose forced stop is recorded. The capped items are the kinds the session can act on itself: a pull request that is behind or failing, an unpushed branch, a stacked branch the clearing rule still owes, and a reservation whose work no pull request carries, which the review's list did not name but which is the same kind of act as a push. A renewal that is only due, and an item waiting only on the forge, such as checks still running, keep releasing on a qualifying wake. The count compares the capped items alone, so a renewal falling due or done neither resets it nor adds to it, and a change in the capped items resets it; the count and a fingerprint of the capped items are kept in the session's state file in the local tier (.abcd/.work.local/autonomy/sessions/<session-id>.json), and TestWakeReleasesUnchangedSetTwice shows the third consecutive unchanged stop with a wake blocked. Repeated identical recorded stops are kept as one entry with a count and the last time, so a cron that wakes the session every ten minutes cannot grow the away record past its 64 KiB check, which would read as not away (grounds: plan review round 3, finding F2: with a */10 cron set once, each wake found the set unchanged and was allowed, and a behind pull request stayed behind for eleven hours, meeting the intent's falsifier)

From f24f1d467e7b7cce41294454706390d24a3000e7 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 11:56:29 +0100
Subject: [PATCH 09/58] feat: add the away record, its store and lock, and the
 owed-work shape

internal/core/autonomy keeps one away record per repository on the
machine, in the away store keyed on the root commit, changed only under
fsutil's file lock with a re-read inside it. A record or lock that is
not a regular file this account owns that no one else can write, within
64 KiB, reads as not away and refuses a writer, naming the file. A
record lapses at its end, seven days at most; repeated identical stops
collapse into one entry. Record and Owed are fixed here so the
owed-work and stop-verdict lanes can build against them.

Refs: itd-2610180912189125
Assisted-by: Claude:claude-opus-5-5
---
 internal/core/autonomy/doc.go         |  80 ++++++
 internal/core/autonomy/owed.go        | 128 +++++++++
 internal/core/autonomy/record.go      | 360 ++++++++++++++++++++++++++
 internal/core/autonomy/record_test.go | 340 ++++++++++++++++++++++++
 internal/core/autonomy/store.go       | 303 ++++++++++++++++++++++
 internal/core/autonomy/store_test.go  | 239 +++++++++++++++++
 internal/core/autonomy/verbs.go       | 198 ++++++++++++++
 7 files changed, 1648 insertions(+)
 create mode 100644 internal/core/autonomy/doc.go
 create mode 100644 internal/core/autonomy/owed.go
 create mode 100644 internal/core/autonomy/record.go
 create mode 100644 internal/core/autonomy/record_test.go
 create mode 100644 internal/core/autonomy/store.go
 create mode 100644 internal/core/autonomy/store_test.go
 create mode 100644 internal/core/autonomy/verbs.go

diff --git a/internal/core/autonomy/doc.go b/internal/core/autonomy/doc.go
new file mode 100644
index 0000000000..4bb4a234bc
--- /dev/null
+++ b/internal/core/autonomy/doc.go
@@ -0,0 +1,80 @@
+// Package autonomy is the away mode: the person's word that they are away and
+// sessions should work on, held once per repository on the machine, and the
+// shapes the stop check reads (itd-2610180912189125, spc-2610180914469489).
+//
+// It is a library: it returns values and errors, and never prints. The front
+// doors (`abcd mode autonomous|back|queue`, and later the hooks) format what it
+// returns.
+//
+// # The away store
+//
+// One folder per repository, keyed on the repository's root commit as the
+// worktree store is, below abcd's home: `away/<root-sha>/` (Store.Dir,
+// Store.Rel). Every working copy of the repository reads the same folder. It
+// holds:
+//
+//   - record.json (RecordFile, Store.RecordPath): the Record;
+//   - lock (LockFile, Store.LockPath): the one lock every read-modify-write in
+//     the folder holds, the record's and any sibling file's alike;
+//   - sibling files other parts of the slice add (a working copy's created
+//     branches, a session's start copy), read and written through
+//     Store.ReadFile and Store.WriteFile inside Store.WithLock.
+//
+// Every file in it is used only when it is a regular file this account owns
+// that no one else can write, within MaxFileBytes (64 KiB), and only through
+// folders no one else can change: the checks a user-layer rules.json gets.
+// A file failing them is ErrUnsafe, naming the file. Writes go through
+// fsutil's atomic writer.
+//
+// # The lock
+//
+// Store.WithLock holds fsutil.WithFileLock on the lock file for at most
+// LockTimeout (two seconds); past it the call returns ErrLockBusy. Store.Update
+// re-reads the record inside the lock, hands it to the caller's function, and
+// writes what that returns, so two writers never lose an update and a check
+// that read the record before a slow forge listing never writes away back
+// after `abcd mode back` (Store.RecordStop records only while the re-read
+// record still holds).
+//
+// # Failing open
+//
+// Store.Away is the hooks' read: an unreadable or unsafe record (or lock)
+// reads as not away, with the reason returned for a stderr line. A verb asked
+// to change such a record refuses, naming the file.
+//
+// # Record
+//
+// Record is the away record. Its fields, as written to record.json:
+//
+//	schema_version  1
+//	set_by          who set it (Who.Name): the holder name reservations
+//	                resolve without a network read, else git's user.name
+//	set_from        the working copy it was set from (Who.Copy, its root)
+//	start, until    when it was set and when it ends
+//	open_ended      set without --until (until is then start plus MaxWindow)
+//	hold_pushes     the person said pushes wait (--hold-pushes); it narrows
+//	                and grants nothing
+//	queue           []QueuedStep: steps for the person (`abcd mode queue`)
+//	handed_back     []HandBack: items the stop check handed back, by branch
+//	                and head, once each
+//	stops           []Stop: the stops recorded, a stop identical to the last
+//	                kept as that entry with a count and the last time
+//	closed          *Closing: once ended by word, who ended it and from
+//	                which copy
+//
+// A record holds (Record.Holds) while it is not closed and now is before
+// Record.Ends, which is never more than MaxWindow (seven days) after its
+// start, whatever is stored. Past its end and not yet closed it is lapsed
+// (Record.Lapsed). A human prompt never ends it.
+//
+// # Owed
+//
+// Owed is the stop check's input: the owed items, each an OwedItem with its
+// OwedKind, whether it is capped (an item the session can act on itself, which
+// a wake releases at most twice in a row), and its branch or record id (plus
+// its pull request and head where it has them). The kinds, in the order the
+// next item is chosen (OwedKinds): a renewal due, a failing pull request, a
+// behind one, a stacked branch, an unpushed branch, and a reservation whose
+// work no pull request carries. Owed.Fingerprint and Owed.CappedFingerprint
+// compare two owed sets item by item, ignoring order and reasons.
+package autonomy
diff --git a/internal/core/autonomy/owed.go b/internal/core/autonomy/owed.go
new file mode 100644
index 0000000000..19b8f83db9
--- /dev/null
+++ b/internal/core/autonomy/owed.go
@@ -0,0 +1,128 @@
+package autonomy
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"sort"
+	"strconv"
+	"strings"
+)
+
+// OwedKind is one of the four kinds of owed work, the reservation kind split
+// in two (a renewal due, and work no pull request carries) and the pull
+// request kind split in two (failing, behind).
+type OwedKind string
+
+const (
+	// OwedRenewal is a live reservation under this copy's key whose renewal
+	// is due. It is never capped.
+	OwedRenewal OwedKind = "renewal"
+	// OwedFailing is an open pull request of the session's own failing its
+	// checks.
+	OwedFailing OwedKind = "failing"
+	// OwedBehind is an open pull request of the session's own behind its base
+	// (or conflicting).
+	OwedBehind OwedKind = "behind"
+	// OwedStacked is an own branch stacked on a change still open, while the
+	// clearing rule owes it.
+	OwedStacked OwedKind = "stacked"
+	// OwedUnpushed is an own branch with commits not pushed.
+	OwedUnpushed OwedKind = "unpushed"
+	// OwedUncarried is a live reservation under this copy's key whose work no
+	// open pull request carries yet.
+	OwedUncarried OwedKind = "uncarried"
+)
+
+// OwedKinds returns the kinds in the order the next item is chosen.
+func OwedKinds() []OwedKind {
+	return []OwedKind{OwedRenewal, OwedFailing, OwedBehind, OwedStacked, OwedUnpushed, OwedUncarried}
+}
+
+func kindRank(k OwedKind) int {
+	for i, o := range OwedKinds() {
+		if o == k {
+			return i
+		}
+	}
+	return len(OwedKinds())
+}
+
+// OwedItem is one owed item.
+type OwedItem struct {
+	Kind OwedKind `json:"kind"`
+	// Capped marks an item the session can act on itself, which a qualifying
+	// wake releases at most twice in a row (dcn-2610181035361997).
+	Capped bool `json:"capped"`
+	// Branch is the branch the item is about, when it is about one.
+	Branch string `json:"branch,omitempty"`
+	// Record is the reservation's record id, when the item is about one.
+	Record string `json:"record,omitempty"`
+	// PR is the pull request's number, when the item has one.
+	PR int `json:"pr,omitempty"`
+	// Head is the branch's head commit, when known.
+	Head string `json:"head,omitempty"`
+	// Reason says, in plain words, why the item is owed and what to do. It is
+	// not part of the item's identity.
+	Reason string `json:"reason,omitempty"`
+}
+
+func (i OwedItem) key() string {
+	return strings.Join([]string{string(i.Kind), i.Branch, i.Record, strconv.Itoa(i.PR), i.Head}, "\x00")
+}
+
+// Owed is the owed set a stop check judges.
+type Owed struct {
+	Items []OwedItem `json:"items"`
+	// Notes say what was not read and how the set was judged instead, such
+	// as pull requests not read when the forge listing failed.
+	Notes []string `json:"notes,omitempty"`
+}
+
+// Empty reports whether nothing is owed.
+func (o Owed) Empty() bool { return len(o.Items) == 0 }
+
+// HasCapped reports whether any owed item is capped.
+func (o Owed) HasCapped() bool {
+	for _, i := range o.Items {
+		if i.Capped {
+			return true
+		}
+	}
+	return false
+}
+
+// Next is the item the session is handed: the first by OwedKinds' order, the
+// items of one kind in the order they were given.
+func (o Owed) Next() (OwedItem, bool) {
+	if len(o.Items) == 0 {
+		return OwedItem{}, false
+	}
+	best := 0
+	for i := 1; i < len(o.Items); i++ {
+		if kindRank(o.Items[i].Kind) < kindRank(o.Items[best].Kind) {
+			best = i
+		}
+	}
+	return o.Items[best], true
+}
+
+// Fingerprint identifies the owed set by its items' kind, branch, record,
+// pull request and head, whatever their order and reasons.
+func (o Owed) Fingerprint() string { return fingerprint(o.Items, false) }
+
+// CappedFingerprint is Fingerprint over the capped items alone, so a renewal
+// falling due or done does not change it.
+func (o Owed) CappedFingerprint() string { return fingerprint(o.Items, true) }
+
+func fingerprint(items []OwedItem, cappedOnly bool) string {
+	keys := make([]string, 0, len(items))
+	for _, i := range items {
+		if cappedOnly && !i.Capped {
+			continue
+		}
+		keys = append(keys, i.key())
+	}
+	sort.Strings(keys)
+	sum := sha256.Sum256([]byte(strings.Join(keys, "\n")))
+	return hex.EncodeToString(sum[:16])
+}
diff --git a/internal/core/autonomy/record.go b/internal/core/autonomy/record.go
new file mode 100644
index 0000000000..caad79823c
--- /dev/null
+++ b/internal/core/autonomy/record.go
@@ -0,0 +1,360 @@
+package autonomy
+
+import (
+	"errors"
+	"fmt"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"github.com/intentdriven/abcd/internal/fsutil"
+	"github.com/intentdriven/abcd/internal/termsafe"
+)
+
+// SchemaVersion is the record's shape version, written as schema_version.
+const SchemaVersion = 1
+
+// MaxWindow is the stale-record cap: a record ends at most seven days after
+// it was set, so a forgotten one lapses while a run of several days fits
+// (dcn-2610180937181736).
+const MaxWindow = 7 * 24 * time.Hour
+
+// MaxStepLen bounds a queued step, in characters, so one step cannot fill the
+// record's 64 KiB.
+const MaxStepLen = 500
+
+// echoCap bounds how much of an untrusted value a message quotes back.
+const echoCap = 64
+
+var (
+	// ErrUntilUnreadable is an --until that is neither a clock time nor a
+	// timestamp.
+	ErrUntilUnreadable = errors.New("autonomy: --until is not a time")
+	// ErrUntilPast is an --until already past.
+	ErrUntilPast = errors.New("autonomy: --until is already past")
+	// ErrUntilBeyondCap is an --until later than seven days on.
+	ErrUntilBeyondCap = errors.New("autonomy: --until is past the seven-day cap")
+	// ErrStepEmpty is a queued step with no words.
+	ErrStepEmpty = errors.New("autonomy: the step is empty")
+	// ErrStepTooLong is a queued step past MaxStepLen.
+	ErrStepTooLong = errors.New("autonomy: the step is too long")
+)
+
+// Who names a person acting on the record and the working copy they act from
+// (its root, as git names it).
+type Who struct {
+	Name string
+	Copy string
+}
+
+// Record is the away record. The package comment lists its fields.
+type Record struct {
+	SchemaVersion int          `json:"schema_version"`
+	SetBy         string       `json:"set_by"`
+	SetFrom       string       `json:"set_from"`
+	Start         time.Time    `json:"start"`
+	Until         time.Time    `json:"until"`
+	OpenEnded     bool         `json:"open_ended"`
+	HoldPushes    bool         `json:"hold_pushes"`
+	Queue         []QueuedStep `json:"queue"`
+	HandedBack    []HandBack   `json:"handed_back"`
+	Stops         []Stop       `json:"stops"`
+	Closed        *Closing     `json:"closed,omitempty"`
+}
+
+// QueuedStep is one step queued for the person's return.
+type QueuedStep struct {
+	Step string    `json:"step"`
+	At   time.Time `json:"at"`
+	From string    `json:"from"`
+}
+
+// HandBack is one owed item the stop check handed back to the person, by its
+// branch and the head it had then.
+type HandBack struct {
+	Branch string    `json:"branch"`
+	Head   string    `json:"head"`
+	At     time.Time `json:"at"`
+}
+
+// StopKind is why a recorded stop happened.
+type StopKind string
+
+const (
+	// StopWorkOwed is a stop with work owed.
+	StopWorkOwed StopKind = "work-owed"
+	// StopNoNextLook is a stop with nothing owed and no next look scheduled.
+	StopNoNextLook StopKind = "no-next-look"
+	// StopAPIError is a turn the host ended on an API error.
+	StopAPIError StopKind = "api-error"
+)
+
+// Stop is one recorded stop. Count, First and Last are kept by AddStop: a stop
+// identical to the last one recorded adds to that entry instead of a new one.
+type Stop struct {
+	Kind StopKind `json:"kind"`
+	// ErrorType is the host's error type for StopAPIError (rate_limit, …).
+	ErrorType string `json:"error_type,omitempty"`
+	// Detail is the next item at the stop, in plain words.
+	Detail string `json:"detail,omitempty"`
+	// PossiblyForcedByCap marks a stop at the host's continuation cap.
+	PossiblyForcedByCap bool      `json:"possibly_forced_by_cap,omitempty"`
+	Count               int       `json:"count"`
+	First               time.Time `json:"first"`
+	Last                time.Time `json:"last"`
+}
+
+// Closing is who ended the record by word, from which copy, and when.
+type Closing struct {
+	By   string    `json:"by"`
+	From string    `json:"from"`
+	At   time.Time `json:"at"`
+}
+
+// Begin is the record `abcd mode autonomous` writes at now: until zero is
+// open-ended (seven days at most), and otherwise must be after now and no
+// later than seven days on. prev is the record already stored, or nil: an
+// unclosed one's queue, hand-backs and stops are still unread, so they are
+// carried into the new record rather than dropped.
+func Begin(prev *Record, who Who, now, until time.Time, holdPushes bool) (*Record, error) {
+	now = now.Truncate(time.Second)
+	r := &Record{
+		SchemaVersion: SchemaVersion,
+		SetBy:         who.Name,
+		SetFrom:       who.Copy,
+		Start:         now,
+		HoldPushes:    holdPushes,
+	}
+	switch {
+	case until.IsZero():
+		r.OpenEnded = true
+		r.Until = now.Add(MaxWindow)
+	case !until.After(now):
+		return nil, fmt.Errorf("%w: %s", ErrUntilPast, showTime(until))
+	case until.After(now.Add(MaxWindow)):
+		return nil, fmt.Errorf("%w: %s is later than seven days from now (%s)", ErrUntilBeyondCap, showTime(until), showTime(now.Add(MaxWindow)))
+	default:
+		r.Until = until
+	}
+	if prev != nil && prev.Closed == nil {
+		r.Queue = append(r.Queue, prev.Queue...)
+		r.HandedBack = append(r.HandedBack, prev.HandedBack...)
+		r.Stops = append(r.Stops, prev.Stops...)
+	}
+	return r, nil
+}
+
+// Ends is when the record ends: its stored end, but never later than seven
+// days after its start, whatever is stored.
+func (r *Record) Ends() time.Time {
+	limit := r.Start.Add(MaxWindow)
+	if r.Until.IsZero() || r.Until.After(limit) {
+		return limit
+	}
+	return r.Until
+}
+
+// Holds reports whether the person is away at now: a record, not closed, and
+// now before its end. No record is not away.
+func (r *Record) Holds(now time.Time) bool {
+	return r != nil && r.Closed == nil && now.Before(r.Ends())
+}
+
+// Lapsed reports whether the record's end has passed while it is still
+// unclosed: what is in it has not been read by `abcd mode back`.
+func (r *Record) Lapsed(now time.Time) bool {
+	return r != nil && r.Closed == nil && !now.Before(r.Ends())
+}
+
+// Close ends the record by word: who ended it, from which copy, and when.
+func (r *Record) Close(who Who, now time.Time) {
+	r.Closed = &Closing{By: who.Name, From: who.Copy, At: now.Truncate(time.Second)}
+}
+
+// AddStep queues a step for the person. Its whitespace is folded to single
+// spaces, so it is one line; an empty step, or one past MaxStepLen
+// characters, is refused and nothing is kept.
+func (r *Record) AddStep(step, from string, now time.Time) error {
+	step = strings.Join(strings.Fields(step), " ")
+	if step == "" {
+		return ErrStepEmpty
+	}
+	if n := utf8.RuneCountInString(step); n > MaxStepLen {
+		return fmt.Errorf("%w: %d characters, at most %d", ErrStepTooLong, n, MaxStepLen)
+	}
+	r.Queue = append(r.Queue, QueuedStep{Step: step, At: now.Truncate(time.Second), From: from})
+	return nil
+}
+
+// AddStop records a stop at now. A stop identical to the last one recorded
+// (same kind, error type, detail and cap label) adds to that entry's count and
+// last time instead, so a wake every ten minutes cannot grow the record past
+// its 64 KiB check.
+func (r *Record) AddStop(s Stop, now time.Time) {
+	now = now.Truncate(time.Second)
+	if n := len(r.Stops); n > 0 && sameStop(r.Stops[n-1], s) {
+		r.Stops[n-1].Count++
+		r.Stops[n-1].Last = now
+		return
+	}
+	s.Count, s.First, s.Last = 1, now, now
+	r.Stops = append(r.Stops, s)
+}
+
+func sameStop(a, b Stop) bool {
+	return a.Kind == b.Kind && a.ErrorType == b.ErrorType && a.Detail == b.Detail && a.PossiblyForcedByCap == b.PossiblyForcedByCap
+}
+
+// AddHandBack records an item handed back, once per branch and head; it
+// reports whether this call added it.
+func (r *Record) AddHandBack(branch, head string, now time.Time) bool {
+	for _, h := range r.HandedBack {
+		if h.Branch == branch && h.Head == head {
+			return false
+		}
+	}
+	r.HandedBack = append(r.HandedBack, HandBack{Branch: branch, Head: head, At: now.Truncate(time.Second)})
+	return true
+}
+
+// Terms are the record's plain statement, one line each: until when, set by
+// whom and from which copy; that pushes wait, when the person said so; that
+// the mode grants no rights, the person's standing instruction deciding; and
+// how it ends.
+func (r *Record) Terms() []string {
+	until := "until " + showTime(r.Ends())
+	if r.OpenEnded {
+		until += " (open-ended, seven days at most)"
+	}
+	lines := []string{fmt.Sprintf("Away %s, set by %s from %s.", until, showWho(r.SetBy), showCopy(r.SetFrom))}
+	if r.HoldPushes {
+		lines = append(lines, "The person said pushes wait for their return (--hold-pushes): finish the local work, then queue the push with `abcd mode queue \"<step>\"`.")
+	}
+	lines = append(lines,
+		"The away mode grants no rights: the person's own standing instruction decides what is committed, pushed, and opened or merged as a pull request.",
+		"It ends at its time or with `abcd mode back`, run only on the person's word.")
+	return lines
+}
+
+// Lines are what `abcd mode back` prints: one plain line per queued step, per
+// handed-back item and per recorded stop, the cap label and count included.
+func (r *Record) Lines() []string {
+	var lines []string
+	for _, q := range r.Queue {
+		lines = append(lines, "queued: "+termsafe.CleanProseLine(q.Step, MaxStepLen*4))
+	}
+	for _, h := range r.HandedBack {
+		lines = append(lines, fmt.Sprintf("handed back: %s at %s", clean(h.Branch), shortHead(h.Head)))
+	}
+	for _, s := range r.Stops {
+		lines = append(lines, stopLine(s))
+	}
+	return lines
+}
+
+func stopLine(s Stop) string {
+	var b strings.Builder
+	switch s.Kind {
+	case StopWorkOwed:
+		b.WriteString("stopped with work owed")
+	case StopNoNextLook:
+		b.WriteString("stopped with no next look")
+	case StopAPIError:
+		b.WriteString("stopped on an API error")
+		if s.ErrorType != "" {
+			b.WriteString(" (" + clean(s.ErrorType) + ")")
+		}
+	default:
+		b.WriteString("stopped (" + clean(string(s.Kind)) + ")")
+	}
+	if s.PossiblyForcedByCap {
+		b.WriteString(", possibly forced by the cap")
+	}
+	if s.Detail != "" {
+		b.WriteString(": " + termsafe.CleanProseLine(s.Detail, 256))
+	}
+	if s.Count > 1 {
+		fmt.Fprintf(&b, " (%d times, first %s, last %s)", s.Count, showTime(s.First), showTime(s.Last))
+	} else {
+		b.WriteString(" (" + showTime(s.Last) + ")")
+	}
+	return b.String()
+}
+
+func clean(s string) string { return termsafe.CleanProseLine(s, echoCap*2) }
+
+func shortHead(h string) string {
+	if len(h) > 12 {
+		h = h[:12]
+	}
+	return clean(h)
+}
+
+// showTime renders a time for the person, in the machine's local time.
+func showTime(t time.Time) string { return t.Local().Format("2006-01-02 15:04 MST") }
+
+func showWho(name string) string {
+	if strings.TrimSpace(name) == "" {
+		return "someone git does not name"
+	}
+	return clean(name)
+}
+
+func showCopy(p string) string {
+	if p == "" {
+		return "an unnamed working copy"
+	}
+	return clean(fsutil.DisplayPath(p))
+}
+
+// clockRe is a clock time, H:MM or HH:MM.
+var clockRe = regexp.MustCompile(`^(\d{1,2}):(\d{2})$`)
+
+// localLayouts are the timestamp forms read in now's location; RFC 3339,
+// which names its own offset, is tried first.
+var localLayouts = []string{"2006-01-02T15:04:05", "2006-01-02T15:04", "2006-01-02 15:04:05", "2006-01-02 15:04"}
+
+// ParseUntil reads --until against now, in now's location (the machine's
+// local time at the front door): a clock time is its next occurrence after
+// now; a timestamp is RFC 3339 or a date and time read in local time. One
+// that is neither is ErrUntilUnreadable, and one not after now ErrUntilPast.
+func ParseUntil(s string, now time.Time) (time.Time, error) {
+	raw := s
+	s = strings.TrimSpace(s)
+	loc := now.Location()
+	if m := clockRe.FindStringSubmatch(s); m != nil {
+		h, _ := strconv.Atoi(m[1])
+		mi, _ := strconv.Atoi(m[2])
+		if h > 23 || mi > 59 {
+			return time.Time{}, unreadable(raw)
+		}
+		y, mo, d := now.Date()
+		t := time.Date(y, mo, d, h, mi, 0, 0, loc)
+		if !t.After(now) {
+			t = time.Date(y, mo, d+1, h, mi, 0, 0, loc)
+		}
+		return t, nil
+	}
+	t, err := time.Parse(time.RFC3339, s)
+	if err != nil {
+		for _, layout := range localLayouts {
+			if t, err = time.ParseInLocation(layout, s, loc); err == nil {
+				break
+			}
+		}
+	}
+	if err != nil {
+		return time.Time{}, unreadable(raw)
+	}
+	if !t.After(now) {
+		return time.Time{}, fmt.Errorf("%w: %s", ErrUntilPast, showTime(t))
+	}
+	return t, nil
+}
+
+func unreadable(raw string) error {
+	return fmt.Errorf("%w: %q is neither a clock time (09:00) nor a timestamp (2026-10-19T09:00, or RFC 3339)",
+		ErrUntilUnreadable, termsafe.CleanProseLine(raw, echoCap))
+}
diff --git a/internal/core/autonomy/record_test.go b/internal/core/autonomy/record_test.go
new file mode 100644
index 0000000000..fd77bfe4b2
--- /dev/null
+++ b/internal/core/autonomy/record_test.go
@@ -0,0 +1,340 @@
+package autonomy
+
+import (
+	"encoding/json"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+)
+
+// london is the zone the clock-time cases are read in: a named zone with a
+// daylight-saving change, so a case that silently used UTC would show.
+func london(t *testing.T) *time.Location {
+	t.Helper()
+	loc, err := time.LoadLocation("Europe/London")
+	if err != nil {
+		t.Skipf("no zoneinfo for Europe/London: %v", err)
+	}
+	return loc
+}
+
+func at(t *testing.T, s string) time.Time {
+	t.Helper()
+	v, err := time.ParseInLocation("2006-01-02 15:04", s, london(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	return v
+}
+
+var alice = Who{Name: "alice", Copy: "/work/abcd"}
+
+// TestUntilClockTimeAndTimestamp: --until takes a clock time, read as its next
+// occurrence in local time, or a full timestamp; a time already past, and one
+// that is neither, are refused.
+func TestUntilClockTimeAndTimestamp(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	for _, c := range []struct {
+		in   string
+		want time.Time
+	}{
+		{"09:00", at(t, "2026-10-19 09:00")},
+		{"9:05", at(t, "2026-10-19 09:05")},
+		{"23:30", at(t, "2026-10-18 23:30")},
+		{"2026-10-20T09:00:00+01:00", at(t, "2026-10-20 09:00")},
+		{"2026-10-20T08:00:00Z", at(t, "2026-10-20 09:00")},
+		{"2026-10-20T09:00", at(t, "2026-10-20 09:00")},
+		{"2026-10-20 09:00", at(t, "2026-10-20 09:00")},
+	} {
+		got, err := ParseUntil(c.in, now)
+		if err != nil {
+			t.Errorf("ParseUntil(%q): %v", c.in, err)
+			continue
+		}
+		if !got.Equal(c.want) {
+			t.Errorf("ParseUntil(%q) = %s, want %s", c.in, got, c.want)
+		}
+	}
+	for _, in := range []string{"", "tomorrow", "25:00", "09:60", "2026-13-01T09:00"} {
+		if _, err := ParseUntil(in, now); !errors.Is(err, ErrUntilUnreadable) {
+			t.Errorf("ParseUntil(%q) err = %v, want ErrUntilUnreadable", in, err)
+		}
+	}
+	for _, in := range []string{"2026-10-18T20:00", "2026-10-18 21:00"} {
+		if _, err := ParseUntil(in, now); !errors.Is(err, ErrUntilPast) {
+			t.Errorf("ParseUntil(%q) err = %v, want ErrUntilPast", in, err)
+		}
+	}
+}
+
+// TestStaleRecordCapSevenDays: an open-ended record reads as ended seven days
+// after it was set, an --until past that is refused, and a stored end past
+// the cap (a hand edit) is read as the cap.
+func TestStaleRecordCapSevenDays(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	r, err := Begin(nil, alice, now, time.Time{}, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !r.OpenEnded {
+		t.Error("a record set without --until is not marked open-ended")
+	}
+	if want := now.Add(MaxWindow); !r.Ends().Equal(want) {
+		t.Errorf("open-ended record ends %s, want %s", r.Ends(), want)
+	}
+	if !r.Holds(now.Add(MaxWindow - time.Second)) {
+		t.Error("record does not hold one second before its seven days end")
+	}
+	if r.Holds(now.Add(MaxWindow)) {
+		t.Error("record still holds seven days on")
+	}
+	if _, err := Begin(nil, alice, now, now.Add(MaxWindow+time.Minute), false); !errors.Is(err, ErrUntilBeyondCap) {
+		t.Errorf("--until past seven days: err = %v, want ErrUntilBeyondCap", err)
+	}
+	if _, err := Begin(nil, alice, now, now.Add(MaxWindow), false); err != nil {
+		t.Errorf("--until at exactly seven days refused: %v", err)
+	}
+	edited := *r
+	edited.OpenEnded = false
+	edited.Until = now.Add(30 * 24 * time.Hour)
+	if !edited.Ends().Equal(now.Add(MaxWindow)) {
+		t.Errorf("a stored end thirty days on reads as %s, want the cap", edited.Ends())
+	}
+}
+
+// TestRecordPastEndReadsEnded: a record holds while now is before its end, and
+// past it reads as ended, lapsed until it is closed.
+func TestRecordPastEndReadsEnded(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	r, err := Begin(nil, alice, now, now.Add(time.Hour), false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !r.Holds(now.Add(59 * time.Minute)) {
+		t.Error("record does not hold before its end")
+	}
+	if r.Holds(now.Add(time.Hour)) {
+		t.Error("record holds at its end")
+	}
+	if !r.Lapsed(now.Add(2 * time.Hour)) {
+		t.Error("an unclosed record past its end does not read as lapsed")
+	}
+	r.Close(alice, now.Add(3*time.Hour))
+	if r.Lapsed(now.Add(4*time.Hour)) || r.Holds(now.Add(30*time.Minute)) {
+		t.Error("a closed record still reads as lapsed or holding")
+	}
+	var nilRec *Record
+	if nilRec.Holds(now) || nilRec.Lapsed(now) {
+		t.Error("no record reads as away")
+	}
+}
+
+// TestQueueAppends: each queued step is kept in order with where and when it
+// was queued; an empty step or one past the length bound is refused.
+func TestQueueAppends(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	r, err := Begin(nil, alice, now, time.Time{}, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := r.AddStep("approve the embargo close", "/work/a", now.Add(time.Minute)); err != nil {
+		t.Fatal(err)
+	}
+	if err := r.AddStep("  push feat/x  ", "/work/b", now.Add(2*time.Minute)); err != nil {
+		t.Fatal(err)
+	}
+	if len(r.Queue) != 2 || r.Queue[0].Step != "approve the embargo close" || r.Queue[1].Step != "push feat/x" {
+		t.Fatalf("queue = %+v", r.Queue)
+	}
+	if r.Queue[1].From != "/work/b" || !r.Queue[1].At.Equal(now.Add(2*time.Minute)) {
+		t.Errorf("queued step lost its copy or time: %+v", r.Queue[1])
+	}
+	if err := r.AddStep("   ", "/work/a", now); !errors.Is(err, ErrStepEmpty) {
+		t.Errorf("empty step: err = %v", err)
+	}
+	if err := r.AddStep(strings.Repeat("x", MaxStepLen+1), "/work/a", now); !errors.Is(err, ErrStepTooLong) {
+		t.Errorf("over-long step: err = %v", err)
+	}
+	if len(r.Queue) != 2 {
+		t.Errorf("a refused step was kept: %d steps", len(r.Queue))
+	}
+
+	// Setting the mode again keeps what is still unread.
+	again, err := Begin(r, alice, now.Add(time.Hour), time.Time{}, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(again.Queue) != 2 {
+		t.Errorf("setting the mode again dropped the unread queue: %+v", again.Queue)
+	}
+	r.Close(alice, now.Add(2*time.Hour))
+	fresh, err := Begin(r, alice, now.Add(3*time.Hour), time.Time{}, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(fresh.Queue) != 0 {
+		t.Errorf("a closed record's queue, already printed, was carried into a new window: %+v", fresh.Queue)
+	}
+}
+
+// TestRepeatedStopCollapses: a stop identical to the last recorded one adds to
+// its count and last time instead of a new entry; a different stop, or the
+// first one again after a different one, is its own entry.
+func TestRepeatedStopCollapses(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	r, err := Begin(nil, alice, now, time.Time{}, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	a := Stop{Kind: StopWorkOwed, Detail: "feat/x is behind main", PossiblyForcedByCap: true}
+	b := Stop{Kind: StopAPIError, ErrorType: "rate_limit"}
+	r.AddStop(a, now.Add(10*time.Minute))
+	r.AddStop(a, now.Add(20*time.Minute))
+	if len(r.Stops) != 1 {
+		t.Fatalf("an identical stop made a new entry: %+v", r.Stops)
+	}
+	if s := r.Stops[0]; s.Count != 2 || !s.First.Equal(now.Add(10*time.Minute)) || !s.Last.Equal(now.Add(20*time.Minute)) {
+		t.Errorf("collapsed stop = %+v, want count 2 with first and last times", s)
+	}
+	r.AddStop(b, now.Add(30*time.Minute))
+	r.AddStop(a, now.Add(40*time.Minute))
+	if len(r.Stops) != 3 {
+		t.Errorf("stops = %+v, want three entries", r.Stops)
+	}
+	if r.Stops[1].Count != 1 {
+		t.Errorf("a first stop's count = %d, want 1", r.Stops[1].Count)
+	}
+}
+
+// TestHoldPushesRecorded: --hold-pushes is kept in the record and in its JSON,
+// shown in the record's terms, and changes nothing else: the terms say the
+// mode grants no rights whether or not pushes are held.
+func TestHoldPushesRecorded(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	held, err := Begin(nil, alice, now, at(t, "2026-10-19 09:00"), true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	plain, err := Begin(nil, alice, now, at(t, "2026-10-19 09:00"), false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !held.HoldPushes || plain.HoldPushes {
+		t.Fatalf("hold_pushes: held=%v plain=%v", held.HoldPushes, plain.HoldPushes)
+	}
+	raw, err := json.Marshal(held)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var back Record
+	if err := json.Unmarshal(raw, &back); err != nil {
+		t.Fatal(err)
+	}
+	if !back.HoldPushes || !strings.Contains(string(raw), `"hold_pushes":true`) {
+		t.Errorf("hold_pushes lost in the round trip: %s", raw)
+	}
+	heldTerms := strings.Join(held.Terms(), "\n")
+	plainTerms := strings.Join(plain.Terms(), "\n")
+	if !strings.Contains(heldTerms, "pushes wait") {
+		t.Errorf("held terms do not say pushes wait:\n%s", heldTerms)
+	}
+	if strings.Contains(plainTerms, "pushes wait") {
+		t.Errorf("terms without --hold-pushes say pushes wait:\n%s", plainTerms)
+	}
+	for _, terms := range []string{heldTerms, plainTerms} {
+		if !strings.Contains(terms, "grants no rights") || !strings.Contains(terms, "standing instruction") {
+			t.Errorf("terms do not say the mode grants no rights and the standing instruction decides:\n%s", terms)
+		}
+		if !strings.Contains(terms, "abcd mode back") {
+			t.Errorf("terms do not name `abcd mode back`:\n%s", terms)
+		}
+	}
+	if held.SetBy != plain.SetBy || !held.Ends().Equal(plain.Ends()) {
+		t.Error("--hold-pushes changed something other than itself")
+	}
+}
+
+// TestBackLinesOnePerItem: the lines `abcd mode back` prints are one per
+// queued step, per handed-back item and per recorded stop, the cap label and
+// the count included.
+func TestBackLinesOnePerItem(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	r, err := Begin(nil, alice, now, time.Time{}, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_ = r.AddStep("approve the embargo close", "/work/a", now)
+	_ = r.AddStep("push feat/y", "/work/a", now)
+	if !r.AddHandBack("feat/y", "0123456789abcdef", now) || r.AddHandBack("feat/y", "0123456789abcdef", now) {
+		t.Error("a hand-back is not recorded exactly once per branch and head")
+	}
+	r.AddStop(Stop{Kind: StopWorkOwed, Detail: "feat/x is behind main", PossiblyForcedByCap: true}, now)
+	r.AddStop(Stop{Kind: StopWorkOwed, Detail: "feat/x is behind main", PossiblyForcedByCap: true}, now.Add(time.Hour))
+	r.AddStop(Stop{Kind: StopAPIError, ErrorType: "rate_limit"}, now)
+	lines := r.Lines()
+	if len(lines) != 5 {
+		t.Fatalf("lines = %q, want five", lines)
+	}
+	all := strings.Join(lines, "\n")
+	for _, want := range []string{"approve the embargo close", "push feat/y", "feat/y", "possibly forced by the cap", "2 times", "rate_limit"} {
+		if !strings.Contains(all, want) {
+			t.Errorf("lines miss %q:\n%s", want, all)
+		}
+	}
+	for _, l := range lines {
+		if strings.Contains(l, "\n") {
+			t.Errorf("a line spans lines: %q", l)
+		}
+	}
+}
+
+// TestOwedShape: the owed set's next item follows the fixed order whatever
+// order the items arrive in, its fingerprint ignores order and reasons, and
+// the capped fingerprint reads the capped items alone.
+func TestOwedShape(t *testing.T) {
+	kinds := OwedKinds()
+	want := []OwedKind{OwedRenewal, OwedFailing, OwedBehind, OwedStacked, OwedUnpushed, OwedUncarried}
+	if len(kinds) != len(want) {
+		t.Fatalf("kinds = %v", kinds)
+	}
+	for i := range want {
+		if kinds[i] != want[i] {
+			t.Fatalf("kinds = %v, want %v", kinds, want)
+		}
+	}
+	a := Owed{Items: []OwedItem{
+		{Kind: OwedUnpushed, Capped: true, Branch: "feat/z", Head: "c3"},
+		{Kind: OwedBehind, Capped: true, Branch: "feat/x", PR: 7, Head: "a1"},
+		{Kind: OwedRenewal, Record: "iss-5"},
+	}}
+	b := Owed{Items: []OwedItem{a.Items[2], a.Items[0], a.Items[1]}}
+	b.Items[0].Reason = "renewal due at 03:00"
+	if next, ok := a.Next(); !ok || next.Kind != OwedRenewal {
+		t.Errorf("next = %+v, want the renewal", next)
+	}
+	if a.Fingerprint() != b.Fingerprint() {
+		t.Error("the fingerprint depends on order or on a reason")
+	}
+	if !a.HasCapped() {
+		t.Error("HasCapped is false with capped items owed")
+	}
+	c := Owed{Items: a.Items[:2]}
+	if a.CappedFingerprint() != c.CappedFingerprint() {
+		t.Error("a renewal coming or going changed the capped fingerprint")
+	}
+	if a.Fingerprint() == c.Fingerprint() {
+		t.Error("the full fingerprint ignored the renewal")
+	}
+	moved := Owed{Items: []OwedItem{a.Items[0], {Kind: OwedBehind, Capped: true, Branch: "feat/x", PR: 7, Head: "a2"}}}
+	if moved.CappedFingerprint() == c.CappedFingerprint() {
+		t.Error("a new head on a capped item left the capped fingerprint unchanged")
+	}
+	var empty Owed
+	if !empty.Empty() || empty.HasCapped() {
+		t.Error("an empty owed set reads as holding work")
+	}
+	if _, ok := empty.Next(); ok {
+		t.Error("an empty owed set has a next item")
+	}
+}
diff --git a/internal/core/autonomy/store.go b/internal/core/autonomy/store.go
new file mode 100644
index 0000000000..8942c4859a
--- /dev/null
+++ b/internal/core/autonomy/store.go
@@ -0,0 +1,303 @@
+package autonomy
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"regexp"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/abcdhome"
+	"github.com/intentdriven/abcd/internal/fsutil"
+	"github.com/intentdriven/abcd/internal/gitutil"
+)
+
+const (
+	// StoreDir is the away store's folder below abcd's home; each repository
+	// has StoreDir/<root-sha>/.
+	StoreDir = "away"
+	// RecordFile is the away record's file name in a repository's folder.
+	RecordFile = "record.json"
+	// LockFile is the lock file's name in a repository's folder.
+	LockFile = "lock"
+	// MaxFileBytes is the most any file in the store may hold.
+	MaxFileBytes = 64 << 10
+	// LockTimeout is how long a writer waits for the lock.
+	LockTimeout = 2 * time.Second
+)
+
+var (
+	// ErrUnsafe is a store file that is not a regular file this account owns
+	// that no one else can write, within MaxFileBytes, or that does not parse.
+	ErrUnsafe = errors.New("autonomy: away store file refused")
+	// ErrLockBusy is the store's lock not had within LockTimeout.
+	ErrLockBusy = errors.New("autonomy: away store lock busy")
+	// ErrNoRootCommit is a repository with no root commit to key the store on.
+	ErrNoRootCommit = errors.New("autonomy: the repository has no root commit to key the away store on")
+	// ErrNoHome is a home directory that is unset or not absolute.
+	ErrNoHome = errors.New("autonomy: no home directory for the away store")
+	// ErrRecordFull is a record that would pass MaxFileBytes if written.
+	ErrRecordFull = errors.New("autonomy: the away record would pass 64 KiB")
+)
+
+// Store is one repository's folder in the away store.
+type Store struct {
+	home    string
+	rootSHA string
+}
+
+// OpenStore is the away store of the repository whose working copy is at
+// repoRoot, below home: keyed on the repository's root commit, so every
+// working copy of it opens the same store. Nothing is created.
+func OpenStore(home, repoRoot string) (Store, error) {
+	sha := gitutil.RootCommit(repoRoot)
+	if !gitutil.IsFullSHA(sha) {
+		return Store{}, ErrNoRootCommit
+	}
+	return StoreAt(home, sha)
+}
+
+// StoreAt is the away store keyed on rootSHA, a full object name, below home.
+func StoreAt(home, rootSHA string) (Store, error) {
+	if home == "" || !filepath.IsAbs(home) {
+		return Store{}, ErrNoHome
+	}
+	if !gitutil.IsFullSHA(rootSHA) {
+		return Store{}, ErrNoRootCommit
+	}
+	return Store{home: home, rootSHA: rootSHA}, nil
+}
+
+// RootSHA is the root commit the store is keyed on.
+func (s Store) RootSHA() string { return s.rootSHA }
+
+// Rel is the store's folder as a slash path relative to the home directory.
+func (s Store) Rel() string { return abcdhome.Rel(StoreDir, s.rootSHA) }
+
+// Dir is the store's folder.
+func (s Store) Dir() string { return abcdhome.Path(s.home, StoreDir, s.rootSHA) }
+
+// RecordPath is the away record's path.
+func (s Store) RecordPath() string { return filepath.Join(s.Dir(), RecordFile) }
+
+// LockPath is the lock file's path.
+func (s Store) LockPath() string { return filepath.Join(s.Dir(), LockFile) }
+
+// Display is a file of the store in the tilde form a message names it by.
+func (s Store) Display(name string) string { return abcdhome.Display(StoreDir, s.rootSHA, name) }
+
+// siblingRe is a sibling file's name: one path segment, no leading dot.
+var siblingRe = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$`)
+
+// ReadFile reads the store file name under the store's checks: a regular
+// file this account owns that no one else can write, within MaxFileBytes,
+// reached through folders no one else can change. An absent file is an error
+// for which errors.Is(err, fs.ErrNotExist) holds; a refused one is ErrUnsafe,
+// naming it. A caller reading to modify holds WithLock around it.
+func (s Store) ReadFile(name string) ([]byte, error) {
+	if !siblingRe.MatchString(name) {
+		return nil, fmt.Errorf("%w: %q is not a store file name", ErrUnsafe, name)
+	}
+	raw, refusal, err := fsutil.ReadHomeDeclaration(s.home, s.Rel()+"/"+name, MaxFileBytes)
+	switch refusal {
+	case fsutil.DeclarationOK:
+		return raw, nil
+	case fsutil.DeclarationAbsent:
+		if errors.Is(err, fs.ErrNotExist) {
+			return nil, err
+		}
+	}
+	return nil, fmt.Errorf("%w: %s %s", ErrUnsafe, s.Display(name), refusalWords(refusal, err))
+}
+
+// WriteFile replaces the store file name through fsutil's atomic writer,
+// creating the store's folders (owner-only) on the way, and refuses data past
+// MaxFileBytes. The caller holds WithLock.
+func (s Store) WriteFile(name string, data []byte) error {
+	if !siblingRe.MatchString(name) || name == LockFile {
+		return fmt.Errorf("%w: %q is not a store file name", ErrUnsafe, name)
+	}
+	if len(data) > MaxFileBytes {
+		return fmt.Errorf("%w: %s would hold %d bytes, at most %d", ErrRecordFull, s.Display(name), len(data), MaxFileBytes)
+	}
+	dir, err := fsutil.EnsureHomeScope(s.home, s.Rel(), abcdhome.DirMode)
+	if err != nil {
+		return fmt.Errorf("opening %s: %w", abcdhome.Display(StoreDir, s.rootSHA), err)
+	}
+	defer dir.Close()
+	if err := fsutil.WriteFileAtomicInRoot(dir, name, data, abcdhome.FileMode); err != nil {
+		return fmt.Errorf("writing %s: %w", s.Display(name), err)
+	}
+	return nil
+}
+
+func refusalWords(r fsutil.DeclarationRefusal, err error) string {
+	switch r {
+	case fsutil.DeclarationNotRegular:
+		return "is not a regular file (a symlink or something else stands there)"
+	case fsutil.DeclarationWritableByOthers:
+		return "is writable by another account"
+	case fsutil.DeclarationForeignOwner:
+		return "is not this account's"
+	case fsutil.DeclarationBehindSymlink:
+		return "is reached through a symlink"
+	case fsutil.DeclarationDirectoryExposed:
+		return "sits in a folder another account can change"
+	}
+	if errors.Is(err, fsutil.ErrTooBig) {
+		return fmt.Sprintf("is over %d KiB", MaxFileBytes>>10)
+	}
+	return "could not be read safely"
+}
+
+// vetLock checks the lock file, when there is one, on the store's terms: a
+// regular file this account owns that no one else can write, within
+// MaxFileBytes.
+func (s Store) vetLock() error {
+	p := s.LockPath()
+	fi, err := os.Lstat(p)
+	if errors.Is(err, fs.ErrNotExist) {
+		return nil
+	}
+	if err != nil {
+		return fmt.Errorf("%w: %s could not be checked", ErrUnsafe, s.Display(LockFile))
+	}
+	if !fi.Mode().IsRegular() {
+		return fmt.Errorf("%w: %s %s", ErrUnsafe, s.Display(LockFile), refusalWords(fsutil.DeclarationNotRegular, nil))
+	}
+	if err := fsutil.CallersAlone(p, fi); err != nil {
+		r := fsutil.DeclarationForeignOwner
+		if errors.Is(err, fsutil.ErrDeclarationWritable) {
+			r = fsutil.DeclarationWritableByOthers
+		}
+		return fmt.Errorf("%w: %s %s", ErrUnsafe, s.Display(LockFile), refusalWords(r, nil))
+	}
+	if fi.Size() > MaxFileBytes {
+		return fmt.Errorf("%w: %s %s", ErrUnsafe, s.Display(LockFile), refusalWords(fsutil.DeclarationUnreadable, fsutil.ErrTooBig))
+	}
+	return nil
+}
+
+// WithLock holds the store's lock across fn: the store's folders are made
+// (owner-only) if absent, the lock file is checked as every store file is,
+// and the lock not had within LockTimeout is ErrLockBusy. fn's error is
+// returned as it is.
+func (s Store) WithLock(fn func() error) error {
+	dir, err := fsutil.EnsureHomeScope(s.home, s.Rel(), abcdhome.DirMode)
+	if err != nil {
+		return fmt.Errorf("opening %s: %w", abcdhome.Display(StoreDir, s.rootSHA), err)
+	}
+	dir.Close()
+	if err := s.vetLock(); err != nil {
+		return err
+	}
+	err = fsutil.WithFileLock(s.LockPath(), LockTimeout, fn)
+	switch {
+	case errors.Is(err, fsutil.ErrLockContention):
+		return fmt.Errorf("%w: %s was not had within %s", ErrLockBusy, s.Display(LockFile), LockTimeout)
+	case errors.Is(err, fsutil.ErrLockPathUnsafe):
+		return fmt.Errorf("%w: %s %s", ErrUnsafe, s.Display(LockFile), refusalWords(fsutil.DeclarationNotRegular, nil))
+	}
+	return err
+}
+
+// Read returns the stored record, or nil when there is none. A record or
+// lock refused by the store's checks, or a record that does not parse, is
+// ErrUnsafe naming the file.
+func (s Store) Read() (*Record, error) {
+	raw, err := s.ReadFile(RecordFile)
+	if errors.Is(err, fs.ErrNotExist) && !errors.Is(err, ErrUnsafe) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	if err := s.vetLock(); err != nil {
+		return nil, err
+	}
+	var r Record
+	if err := json.Unmarshal(raw, &r); err != nil {
+		return nil, fmt.Errorf("%w: %s does not parse", ErrUnsafe, s.Display(RecordFile))
+	}
+	if r.SchemaVersion != SchemaVersion {
+		return nil, fmt.Errorf("%w: %s has schema_version %d, this abcd reads %d", ErrUnsafe, s.Display(RecordFile), r.SchemaVersion, SchemaVersion)
+	}
+	return &r, nil
+}
+
+// Away is the hooks' read, which fails open: the stored record and whether it
+// holds at now. A record that cannot be read safely reads as not away (nil,
+// false) with the reason returned, for one line on stderr.
+func (s Store) Away(now time.Time) (*Record, bool, error) {
+	r, err := s.Read()
+	if err != nil {
+		return nil, false, err
+	}
+	return r, r.Holds(now), nil
+}
+
+// Update is the store's read-modify-write: under the lock it re-reads the
+// record (nil when there is none) and hands it to fn, and writes what fn
+// returns. fn returning nil writes nothing; its error is returned and nothing
+// is written. Update returns the record written, or the one read when nothing
+// was.
+func (s Store) Update(fn func(cur *Record) (*Record, error)) (*Record, error) {
+	var out *Record
+	err := s.WithLock(func() error {
+		cur, err := s.Read()
+		if err != nil {
+			return err
+		}
+		next, err := fn(cur)
+		if err != nil {
+			return err
+		}
+		if next == nil {
+			out = cur
+			return nil
+		}
+		raw, err := json.MarshalIndent(next, "", "  ")
+		if err != nil {
+			return err
+		}
+		if err := s.WriteFile(RecordFile, append(raw, '\n')); err != nil {
+			return err
+		}
+		out = next
+		return nil
+	})
+	return out, err
+}
+
+// RecordStop records a stop at now, only if the record re-read inside the
+// lock still holds; it reports whether it wrote.
+func (s Store) RecordStop(st Stop, now time.Time) (bool, error) {
+	wrote := false
+	_, err := s.Update(func(cur *Record) (*Record, error) {
+		if !cur.Holds(now) {
+			return nil, nil
+		}
+		cur.AddStop(st, now)
+		wrote = true
+		return cur, nil
+	})
+	return wrote && err == nil, err
+}
+
+// RecordHandBack records an item handed back (its branch and head) at now,
+// once per branch and head, only if the record re-read inside the lock still
+// holds; it reports whether it wrote.
+func (s Store) RecordHandBack(branch, head string, now time.Time) (bool, error) {
+	wrote := false
+	_, err := s.Update(func(cur *Record) (*Record, error) {
+		if !cur.Holds(now) || !cur.AddHandBack(branch, head, now) {
+			return nil, nil
+		}
+		wrote = true
+		return cur, nil
+	})
+	return wrote && err == nil, err
+}
diff --git a/internal/core/autonomy/store_test.go b/internal/core/autonomy/store_test.go
new file mode 100644
index 0000000000..382494caf6
--- /dev/null
+++ b/internal/core/autonomy/store_test.go
@@ -0,0 +1,239 @@
+package autonomy
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/abcdhome"
+	"github.com/intentdriven/abcd/internal/fsutil"
+	"github.com/intentdriven/abcd/internal/gittest"
+)
+
+// managedCopy is a checkout with one commit and the local tier, under a HOME
+// the test owns, so the away store is the test's own.
+func managedCopy(t *testing.T) (root, home string) {
+	t.Helper()
+	home = t.TempDir()
+	t.Setenv("HOME", home)
+	repo := gittest.NewRepo(t)
+	repo.Commit("seed")
+	root, err := filepath.EvalSymlinks(repo.Root())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(filepath.Join(root, ".abcd", ".work.local"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	return root, home
+}
+
+func fixedOptions(home string, now time.Time) Options {
+	return Options{
+		Home: home,
+		Now:  func() time.Time { return now },
+		Who:  func(string) string { return "alice" },
+	}
+}
+
+// TestConcurrentWritesUnderLock: queued steps racing keep every step, and a
+// stop recorded after `mode back` re-reads inside the lock and does not turn
+// the mode back on.
+func TestConcurrentWritesUnderLock(t *testing.T) {
+	root, home := managedCopy(t)
+	now := time.Now().Truncate(time.Second)
+	o := fixedOptions(home, now)
+	if _, err := SetAway(root, "", false, o); err != nil {
+		t.Fatal(err)
+	}
+	const n = 8
+	var wg sync.WaitGroup
+	errs := make(chan error, n)
+	for i := range n {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			_, err := QueueStep(root, "step "+string(rune('a'+i)), o)
+			errs <- err
+		}()
+	}
+	wg.Wait()
+	close(errs)
+	for err := range errs {
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	st, err := OpenStore(home, root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	rec, err := st.Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(rec.Queue) != n {
+		t.Fatalf("queue holds %d steps after %d racing writes", len(rec.Queue), n)
+	}
+
+	// A stop check that read away before `mode back` must not write it back.
+	if _, holds, _ := st.Away(now); !holds {
+		t.Fatal("the record does not hold before `mode back`")
+	}
+	if _, err := Back(root, o); err != nil {
+		t.Fatal(err)
+	}
+	wrote, err := st.RecordStop(Stop{Kind: StopWorkOwed, Detail: "feat/x"}, now.Add(time.Minute))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if wrote {
+		t.Error("a stop was recorded on a record `mode back` had ended")
+	}
+	after, err := st.Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if after.Holds(now.Add(time.Minute)) || len(after.Stops) != 0 {
+		t.Errorf("the late stop turned the mode back on or was kept: %+v", after)
+	}
+	if after.Closed == nil || after.Closed.By != "alice" || after.Closed.From != root {
+		t.Errorf("`mode back` did not record who ended it and from which copy: %+v", after.Closed)
+	}
+}
+
+// TestRecordOwnershipFailsOpen: a record or lock that is a symlink, not this
+// account's, writable by others, or over 64 KiB reads as not away, with the
+// reason naming the file, and a verb asked to change it refuses naming it.
+func TestRecordOwnershipFailsOpen(t *testing.T) {
+	for _, c := range []struct {
+		name  string
+		file  string // RecordFile or LockFile
+		spoil func(t *testing.T, path string)
+	}{
+		{"record symlink", RecordFile, func(t *testing.T, p string) {
+			real := p + ".real"
+			mustRename(t, p, real)
+			if err := os.Symlink(real, p); err != nil {
+				t.Fatal(err)
+			}
+		}},
+		{"record writable by others", RecordFile, func(t *testing.T, p string) { mustChmod(t, p, 0o666) }},
+		{"record over 64 KiB", RecordFile, func(t *testing.T, p string) {
+			raw, err := os.ReadFile(p)
+			if err != nil {
+				t.Fatal(err)
+			}
+			pad := strings.Repeat(" ", MaxFileBytes)
+			if err := os.WriteFile(p, append(raw, pad...), 0o600); err != nil {
+				t.Fatal(err)
+			}
+		}},
+		{"record not this account's", RecordFile, func(t *testing.T, p string) {
+			restore := fsutil.SwapOwnerUIDForTest(func(q string) (uint32, error) {
+				if q == p {
+					return uint32(os.Getuid()) + 1, nil
+				}
+				return fsutil.OwnerUID(q)
+			})
+			t.Cleanup(restore)
+		}},
+		{"record does not parse", RecordFile, func(t *testing.T, p string) {
+			if err := os.WriteFile(p, []byte("{not json"), 0o600); err != nil {
+				t.Fatal(err)
+			}
+		}},
+		{"lock symlink", LockFile, func(t *testing.T, p string) {
+			other := filepath.Join(t.TempDir(), "elsewhere")
+			if err := os.WriteFile(other, nil, 0o600); err != nil {
+				t.Fatal(err)
+			}
+			if err := os.Remove(p); err != nil {
+				t.Fatal(err)
+			}
+			if err := os.Symlink(other, p); err != nil {
+				t.Fatal(err)
+			}
+		}},
+		{"lock writable by others", LockFile, func(t *testing.T, p string) { mustChmod(t, p, 0o666) }},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			root, home := managedCopy(t)
+			now := time.Now().Truncate(time.Second)
+			o := fixedOptions(home, now)
+			if _, err := SetAway(root, "", false, o); err != nil {
+				t.Fatal(err)
+			}
+			st, err := OpenStore(home, root)
+			if err != nil {
+				t.Fatal(err)
+			}
+			path := st.RecordPath()
+			if c.file == LockFile {
+				path = st.LockPath()
+			}
+			c.spoil(t, path)
+
+			rec, holds, err := st.Away(now)
+			if holds || rec != nil {
+				t.Errorf("a spoilt %s reads as away", c.file)
+			}
+			if err == nil || !strings.Contains(err.Error(), c.file) {
+				t.Errorf("Away err = %v, want one naming %s", err, c.file)
+			}
+			if _, err := QueueStep(root, "push feat/x", o); err == nil || !errors.Is(err, ErrUnsafe) || !strings.Contains(err.Error(), c.file) {
+				t.Errorf("queue on a spoilt %s: err = %v, want ErrUnsafe naming it", c.file, err)
+			}
+			if _, err := Back(root, o); err == nil || !strings.Contains(err.Error(), c.file) {
+				t.Errorf("back on a spoilt %s: err = %v, want a refusal naming it", c.file, err)
+			}
+		})
+	}
+}
+
+// TestSetAwayRefusesWithNothingWritten: a past or over-cap --until, a checkout
+// without the local tier, and no checkout at all are refused before the store
+// is touched.
+func TestSetAwayRefusesWithNothingWritten(t *testing.T) {
+	root, home := managedCopy(t)
+	now := time.Now().Truncate(time.Second)
+	o := fixedOptions(home, now)
+	past := now.Add(-time.Hour).Format("2006-01-02T15:04:05Z07:00")
+	far := now.Add(MaxWindow + time.Hour).Format("2006-01-02T15:04:05Z07:00")
+	if _, err := SetAway(root, past, false, o); !errors.Is(err, ErrUntilPast) {
+		t.Errorf("past --until: err = %v", err)
+	}
+	if _, err := SetAway(root, far, false, o); !errors.Is(err, ErrUntilBeyondCap) {
+		t.Errorf("--until past seven days: err = %v", err)
+	}
+	if err := os.RemoveAll(filepath.Join(root, ".abcd")); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := SetAway(root, "", false, o); !errors.Is(err, ErrNoLocalTier) {
+		t.Errorf("no tier: err = %v", err)
+	}
+	if _, err := SetAway(t.TempDir(), "", false, o); err == nil {
+		t.Error("outside a checkout the set was not refused")
+	}
+	if entries, _ := os.ReadDir(abcdhome.Path(home)); len(entries) != 0 {
+		t.Errorf("a refused set left %d entries in the home store", len(entries))
+	}
+}
+
+func mustChmod(t *testing.T, p string, m os.FileMode) {
+	t.Helper()
+	if err := os.Chmod(p, m); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func mustRename(t *testing.T, a, b string) {
+	t.Helper()
+	if err := os.Rename(a, b); err != nil {
+		t.Fatal(err)
+	}
+}
diff --git a/internal/core/autonomy/verbs.go b/internal/core/autonomy/verbs.go
new file mode 100644
index 0000000000..283d657484
--- /dev/null
+++ b/internal/core/autonomy/verbs.go
@@ -0,0 +1,198 @@
+package autonomy
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/core/claim"
+	"github.com/intentdriven/abcd/internal/core/identity"
+	"github.com/intentdriven/abcd/internal/core/mode"
+	"github.com/intentdriven/abcd/internal/gitutil"
+)
+
+// StoreName is the noun the checkout-root refusals are phrased with.
+const StoreName = "the away store"
+
+var (
+	// ErrNoLocalTier is the set's refusal in a checkout abcd does not manage:
+	// the mode store's own refusal, so a front door maps both alike.
+	ErrNoLocalTier = mode.ErrNoLocalTier
+	// ErrNotAway is a queued step with no away record holding.
+	ErrNotAway = errors.New("autonomy: the person is not away")
+)
+
+// Options carry what the verbs read from the machine; the zero value reads
+// the process's own home, clock and identity.
+type Options struct {
+	// Home is the home directory the away store lives under; "" means the
+	// process's own.
+	Home string
+	// Now is the clock; nil means time.Now.
+	Now func() time.Time
+	// Who names the person acting in the checkout at root; nil means
+	// ResolveWho.
+	Who func(root string) string
+}
+
+func (o Options) now() time.Time {
+	if o.Now != nil {
+		return o.Now()
+	}
+	return time.Now()
+}
+
+func (o Options) home() (string, error) {
+	if o.Home != "" {
+		return o.Home, nil
+	}
+	h, err := os.UserHomeDir()
+	if err != nil || h == "" {
+		return "", ErrNoHome
+	}
+	return h, nil
+}
+
+func (o Options) who(root, home string) string {
+	if o.Who != nil {
+		return o.Who(root)
+	}
+	return ResolveWho(root, home)
+}
+
+// ResolveWho names the person acting in the checkout at root: the holder
+// name reservations resolve without a network read, else git's user.name,
+// else "".
+func ResolveWho(root, home string) string {
+	if h := claim.ReaderHolder(root, claim.Options{Home: home}); h != "" {
+		return h
+	}
+	if id, err := identity.EffectiveIdentity(root); err == nil {
+		return id.Name
+	}
+	return ""
+}
+
+// Resolve is the checkout root a caller standing in cwd acts from, the away
+// store its repository keys, and the home it lives under.
+func Resolve(cwd string, o Options) (root string, st Store, err error) {
+	root, err = gitutil.CheckoutRoot(cwd, StoreName)
+	if err != nil {
+		return "", Store{}, err
+	}
+	home, err := o.home()
+	if err != nil {
+		return "", Store{}, err
+	}
+	st, err = OpenStore(home, root)
+	return root, st, err
+}
+
+// SetAway is `abcd mode autonomous [--until <time>] [--hold-pushes]` from
+// cwd: until "" is open-ended. A past or unreadable --until, one past seven
+// days, no checkout, and a checkout without the local tier are refused with
+// nothing written; so is a store whose record or lock fails the checks.
+func SetAway(cwd, until string, holdPushes bool, o Options) (*Record, error) {
+	now := o.now()
+	var end time.Time
+	if until != "" {
+		t, err := ParseUntil(until, now)
+		if err != nil {
+			return nil, err
+		}
+		end = t
+	}
+	root, err := gitutil.CheckoutRoot(cwd, StoreName)
+	if err != nil {
+		return nil, err
+	}
+	if fi, err := os.Lstat(filepath.Join(root, filepath.FromSlash(mode.TierRelPath))); err != nil || !fi.IsDir() {
+		return nil, fmt.Errorf("%w: %s/ is not a directory in this checkout, so abcd does not manage it and the away mode is not set from it",
+			ErrNoLocalTier, mode.TierRelPath)
+	}
+	_, st, err := Resolve(root, o)
+	if err != nil {
+		return nil, err
+	}
+	who := Who{Name: o.who(root, st.home), Copy: root}
+	// Judge the window before anything is created on disk.
+	if _, err := Begin(nil, who, now, end, holdPushes); err != nil {
+		return nil, err
+	}
+	return st.Update(func(cur *Record) (*Record, error) {
+		return Begin(cur, who, now, end, holdPushes)
+	})
+}
+
+// BackResult is what `abcd mode back` found and did.
+type BackResult struct {
+	// State is what the record was before: "away" (it held and is now
+	// ended), "lapsed" (its time had passed and it is now closed), or "none"
+	// (no record, or one already closed: nothing to end).
+	State string
+	// Record is the record after the verb, nil when there was none.
+	Record *Record
+	// Lines are the record's lines, printed one each.
+	Lines []string
+}
+
+// Back is `abcd mode back` from cwd: under the lock it reads the record's
+// lines, records who ended it and from which copy, and closes it, on a
+// record whose time has passed as on one that holds.
+func Back(cwd string, o Options) (BackResult, error) {
+	root, st, err := Resolve(cwd, o)
+	if err != nil {
+		return BackResult{}, err
+	}
+	now := o.now()
+	res := BackResult{State: "none"}
+	rec, err := st.Update(func(cur *Record) (*Record, error) {
+		if cur == nil || cur.Closed != nil {
+			return nil, nil
+		}
+		res.State = "lapsed"
+		if cur.Holds(now) {
+			res.State = "away"
+		}
+		res.Lines = cur.Lines()
+		cur.Close(Who{Name: o.who(root, st.home), Copy: root}, now)
+		return cur, nil
+	})
+	res.Record = rec
+	return res, err
+}
+
+// QueueStep is `abcd mode queue "<step>"` from cwd: the step is kept for the
+// person's return while the record holds, and refused otherwise.
+func QueueStep(cwd, step string, o Options) (*Record, error) {
+	root, st, err := Resolve(cwd, o)
+	if err != nil {
+		return nil, err
+	}
+	now := o.now()
+	return st.Update(func(cur *Record) (*Record, error) {
+		if !cur.Holds(now) {
+			return nil, fmt.Errorf("%w: no away record holds, so there is no return to queue the step for; ask the person instead", ErrNotAway)
+		}
+		if err := cur.AddStep(step, root, now); err != nil {
+			return nil, err
+		}
+		return cur, nil
+	})
+}
+
+// AwayAt reads whether the person is away for the checkout at root, failing
+// open: an unreadable record reads as not away, with the reason returned.
+func AwayAt(root string, o Options) (*Record, bool, error) {
+	home, err := o.home()
+	if err != nil {
+		return nil, false, err
+	}
+	st, err := OpenStore(home, root)
+	if err != nil {
+		return nil, false, err
+	}
+	return st.Away(o.now())
+}

From 9074106fcbeba82498e451e93f26a8c31995d650 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 11:57:01 +0100
Subject: [PATCH 10/58] feat: refuse parking the badge on a person while they
 are away

RefuseParkWhileAway refuses product-thinker and facilitator while the
away mode holds, naming abcd decide and abcd mode queue; managed is
never refused and the three-word vocabulary is unchanged.

Refs: itd-2610180912189125
Assisted-by: Claude:claude-opus-5-5
---
 internal/core/mode/away.go      | 25 +++++++++++++++++++++++++
 internal/core/mode/away_test.go | 30 ++++++++++++++++++++++++++++++
 2 files changed, 55 insertions(+)
 create mode 100644 internal/core/mode/away.go
 create mode 100644 internal/core/mode/away_test.go

diff --git a/internal/core/mode/away.go b/internal/core/mode/away.go
new file mode 100644
index 0000000000..b2c3cc95d4
--- /dev/null
+++ b/internal/core/mode/away.go
@@ -0,0 +1,25 @@
+package mode
+
+import (
+	"errors"
+	"fmt"
+)
+
+// ErrAway is the badge's refusal while the person is away: a loop parked on
+// the facilitator or the product thinker is a question waiting for someone
+// who is not there (dcn-2610180913431493).
+var ErrAway = errors.New("mode: the person is away")
+
+// RefuseParkWhileAway refuses parking the badge on a person while the away
+// mode holds (away true), naming where the question goes instead. Managed is
+// never refused, and nothing is refused while the person is present. The
+// three-word vocabulary is untouched: the away mode is not a fourth word, and
+// whether it holds is the caller's to read (internal/core/autonomy), so this
+// package keeps no knowledge of the away store.
+func RefuseParkWhileAway(s State, away bool) error {
+	if !away || s == Managed {
+		return nil
+	}
+	return fmt.Errorf("%w, so no stop parks on the %s: decide it and record it with `abcd decide`, "+
+		"or queue an act only the person may approve with `abcd mode queue \"<step>\"`, and carry on", ErrAway, s.Addressee())
+}
diff --git a/internal/core/mode/away_test.go b/internal/core/mode/away_test.go
new file mode 100644
index 0000000000..10474c1ad4
--- /dev/null
+++ b/internal/core/mode/away_test.go
@@ -0,0 +1,30 @@
+package mode
+
+import (
+	"errors"
+	"strings"
+	"testing"
+)
+
+// TestBadgeRefusedWhileAway: while the person is away, parking the badge on
+// either person is refused, naming `abcd decide`, since a badge parked on the
+// person is a question waiting for them; `managed` is never refused, and
+// nothing is refused while the person is present (dcn-2610180913431493).
+func TestBadgeRefusedWhileAway(t *testing.T) {
+	for _, s := range []State{ProductThinker, Facilitator} {
+		err := RefuseParkWhileAway(s, true)
+		if !errors.Is(err, ErrAway) {
+			t.Errorf("%s while away: err = %v, want ErrAway", s, err)
+			continue
+		}
+		if !strings.Contains(err.Error(), "abcd decide") || !strings.Contains(err.Error(), "abcd mode queue") {
+			t.Errorf("%s while away: the refusal does not name `abcd decide` and `abcd mode queue`: %v", s, err)
+		}
+		if err := RefuseParkWhileAway(s, false); err != nil {
+			t.Errorf("%s while present refused: %v", s, err)
+		}
+	}
+	if err := RefuseParkWhileAway(Managed, true); err != nil {
+		t.Errorf("managed while away refused: %v", err)
+	}
+}

From 2e859ad4b6d21016f07548f013d325e467e57bf4 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 12:25:28 +0100
Subject: [PATCH 11/58] feat: wire abcd mode autonomous, back and queue on both
 surfaces

The away verbs reach autonomy from the CLI and the plugin page:
autonomous [--until <time>] [--hold-pushes] sets the record, queue keeps
a step for the person's return, and back prints one line per queued
step, hand-back and stop, records who ended it, and closes it. While
the record holds, mode product-thinker and facilitator are refused
naming abcd decide. Every refusal exits 2 with nothing written. The
verb gains its own brief chapter, as surface_coverage requires once it
has sub-verbs, and the derived reference and appendix are regenerated.

Refs: itd-2610180912189125
Assisted-by: Claude:claude-opus-5-5
---
 .../development/brief/04-surfaces/08-abcd.md  |  15 +-
 .../development/brief/04-surfaces/26-mode.md  | 110 +++++++
 .abcd/development/brief/04-surfaces/README.md |   2 +-
 .abcd/development/release/surface.json        |  33 ++
 commands/mode.md                              |  56 +++-
 docs/reference/cli/commands.md                |  77 +++++
 internal/core/surface/examples.go             |   2 +
 internal/core/surface/sentences.go            |   6 +
 internal/surface/cli/mode.go                  |  35 ++-
 internal/surface/cli/mode_away.go             | 199 ++++++++++++
 internal/surface/cli/mode_away_test.go        | 283 ++++++++++++++++++
 11 files changed, 804 insertions(+), 14 deletions(-)
 create mode 100644 .abcd/development/brief/04-surfaces/26-mode.md
 create mode 100644 internal/surface/cli/mode_away.go
 create mode 100644 internal/surface/cli/mode_away_test.go

diff --git a/.abcd/development/brief/04-surfaces/08-abcd.md b/.abcd/development/brief/04-surfaces/08-abcd.md
index e3d24a553b..b1ee3efb4d 100644
--- a/.abcd/development/brief/04-surfaces/08-abcd.md
+++ b/.abcd/development/brief/04-surfaces/08-abcd.md
@@ -22,14 +22,15 @@ answer.
 
 | Verb | Bucket | Status |
 |---|---|---|
-| `mode` | — | shipped |
 | `peers` | — | shipped |
 
 This is the bare command's chapter, so the rule compares its table with the
 command tree in neither direction: the surfaces index is what covers the
-top-level verbs. The rows are the two top-level verbs this chapter documents
-beneath the board, and neither registers a sub-verb of its own. The record-id
-form is a positional on the root, not a sub-verb.
+top-level verbs. The row is the top-level verb this chapter documents beneath
+the board, and it registers no sub-verb of its own. `abcd mode`, which stores
+the badge's state and keeps the away mode, has its own chapter,
+[`26-mode.md`](26-mode.md). The record-id form is a positional on the root,
+not a sub-verb.
 
 ## What ships today
 
@@ -621,12 +622,6 @@ _Generated from the command tree; a drift test fails `go test` when this appendi
 | `--version` | bool |
 | `--view` | string |
 
-### `abcd mode`
-
-Sub-verbs: none.
-
-Flags: none.
-
 ### `abcd peers`
 
 Sub-verbs: none.
diff --git a/.abcd/development/brief/04-surfaces/26-mode.md b/.abcd/development/brief/04-surfaces/26-mode.md
new file mode 100644
index 0000000000..e6b2095c44
--- /dev/null
+++ b/.abcd/development/brief/04-surfaces/26-mode.md
@@ -0,0 +1,110 @@
+# `/abcd:mode` — Whose Answer the Loop Waits On, and the Away Mode
+
+`/abcd:mode` holds two facts the agent loop is judged by. The first is the
+waiting-on state behind the status line's badge: `managed`, `facilitator` or
+`product-thinker`, stored per checkout at `.abcd/.work.local/mode`, printed by
+bare `abcd mode` and set by `abcd mode <state>` (itd-200, spc-70). The badge,
+who sets it and when it resets are described with the board that shows it, in
+[`08-abcd.md`](08-abcd.md) ("The presence line" and "The badge is true at
+every stop"). The second is the away mode, below: the person's word that they
+are away and sessions should work on (itd-2610180912189125,
+spc-2610180914469489).
+
+## Sub-verbs
+
+> _Machine-checked (`surface_coverage`, spc-27): each row records the verb's
+> adr-40 bucket (`lint` / `review` / `audit` / `gate`, or `—` for a
+> non-assessment verb) and its existence (`shipped` / `staged`). The existence
+> fact is verified against the committed command-tree snapshot in both
+> directions. The bucket cell is checked for membership of the closed adr-40
+> vocabulary only: the snapshot carries no bucket field, so a bucket that is
+> wrong but legal passes, and that cell stays a review-grain claim._
+
+| Verb | Bucket | Status |
+|---|---|---|
+| `autonomous` | — | shipped |
+| `back` | — | shipped |
+| `queue` | — | shipped |
+
+## The away mode
+
+Beside the badge, and never a fourth word, the away mode records the person's
+word that they are away and sessions should work on. Setting it records, once
+for every working copy of the repository on the machine, who set it (the
+holder name reservations resolve without a network read, else git's
+`user.name`), from which working copy, when, and when it ends. The record
+lives in `~/.abcd.noindex/away/<root-sha>/`, keyed on the root commit as the worktree
+store is.
+
+**When it ends.** The end is a clock time (its next occurrence, local time)
+or a timestamp, or nothing, which leaves the record open-ended. Every record
+ends seven days after it was set at most, so an end past that, or one already
+past, is refused with nothing written. The person may also say that pushes
+wait for their return; that word is kept in the record, narrows what sessions
+do, and grants nothing. A prompt never ends the mode; its time does, or the
+person's word that they are back.
+
+**The queue and the return.** While the record holds, a session keeps a step
+for the person's return instead of asking them: an act only the person may
+approve. On their return the record is ended by word, which prints one plain
+line per queued step, per item handed back and per recorded stop (a stop at
+the host's cap labelled "possibly forced by the cap"), records who ended it and
+from which working copy, and closes the record, on a record whose time has
+passed as on one that holds.
+
+**It grants no rights.** The person's own standing instruction stays what
+decides whether a session commits, pushes, or opens or merges a pull request.
+
+**The lock and the checks.** Every change to the record holds a lock file
+beside it and re-reads the record inside the lock, so two writers never lose
+an update and a check that read the record before the person came back never
+writes it back. The record and the lock are used only when each is a regular
+file this account owns that no one else can write, within 64 KiB: one that
+fails those checks, or does not parse, reads as not away, and a verb asked to
+change it refuses, naming the file.
+
+**The badge while away.** While the record holds, parking the badge on the
+product thinker or the technical facilitator is refused, naming
+`abcd decide`, since a stop parked on a person who is away is a question
+nobody answers.
+
+Every refusal of the away verbs exits 2 with nothing written: an unreadable
+or past end, one past seven days, a checkout without the local tier, no
+checkout, a queued step with no record holding or with no words, a lock not
+had within two seconds, and a record or lock that fails the checks. None makes
+a network request.
+
+<!-- surface-appendix:begin — generated from the command tree by `go generate ./internal/surface/cli`; never edit by hand -->
+
+## Appendix: the shipped surface
+
+_Generated from the command tree; a drift test fails `go test` when this appendix and the tree disagree. It lists flags and sub-verbs only. What each flag means is in the [CLI reference](../../../../docs/reference/cli/commands.md), and exit codes, output fields and behaviour are the prose's to state._
+
+### `abcd mode`
+
+Sub-verbs: `abcd mode autonomous`, `abcd mode back`, `abcd mode queue`.
+
+Flags: none.
+
+### `abcd mode autonomous`
+
+Sub-verbs: none.
+
+| Flag | Type |
+|---|---|
+| `--hold-pushes` | bool |
+| `--until` | string |
+
+### `abcd mode back`
+
+Sub-verbs: none.
+
+Flags: none.
+
+### `abcd mode queue`
+
+Sub-verbs: none.
+
+Flags: none.
+
+<!-- surface-appendix:end -->
diff --git a/.abcd/development/brief/04-surfaces/README.md b/.abcd/development/brief/04-surfaces/README.md
index 7ae7677dbc..1c00d4274a 100644
--- a/.abcd/development/brief/04-surfaces/README.md
+++ b/.abcd/development/brief/04-surfaces/README.md
@@ -34,7 +34,7 @@ are wiring rather than user-facing surface are listed separately under
 | 23 | `/abcd:reading` | shipped | Assemble what a cold reading may see, prove it, and validate what comes back | [`23-reading.md`](23-reading.md) |
 | 24 | `/abcd:decide` | shipped | Record a decision as one file that merges cleanly, list every decision newest first, or mint an ADR with its id, date and skeleton | [`24-decide.md`](24-decide.md) |
 | 25 | `/abcd:worktree` | staged | Keep session and agent worktrees in a machine-scoped store rather than beside the checkout (design target — [itd-2609091014076309](../../intents/planned/itd-2609091014076309-session-and-agent-worktrees-live-in-a.md)) | [`../05-internals/03-configuration.md` § The worktree store](../05-internals/03-configuration.md#the-worktree-store) |
-| 26 | `/abcd:mode` | shipped | Say whose answer the agent loop is waiting on, so the status line and the board show it | [`08-abcd.md`](08-abcd.md) |
+| 26 | `/abcd:mode` | shipped | Say whose answer the agent loop is waiting on, so the status line and the board show it, or that you are away and sessions should work on | [`26-mode.md`](26-mode.md) |
 | 27 | `/abcd:implement` | shipped | Share one autonomous run between two sessions: claim a record before its lane, keep the second session inside its bounds, and compare the ways of dividing the work from the run log | [`27-implement.md`](27-implement.md) |
 | 28 | `/abcd:peers` | shipped | See what the sibling worktrees and local branches hold before capturing, fixing or filing anything | [`08-abcd.md`](08-abcd.md) |
 | 29 | `/abcd:report` | shipped | Tell abcd about a defect or propose an enhancement from a repository it manages, into an inbox in your own account | [`29-report.md`](29-report.md) |
diff --git a/.abcd/development/release/surface.json b/.abcd/development/release/surface.json
index d3c575abde..81d8d7d9b8 100644
--- a/.abcd/development/release/surface.json
+++ b/.abcd/development/release/surface.json
@@ -3395,6 +3395,39 @@
       "sentence": "Print or set whose answer the agent loop is waiting on: Writes the state only when setting it; refuses an unknown state or a checkout with no local tier.",
       "flags": []
     },
+    {
+      "path": "abcd mode autonomous",
+      "hidden": false,
+      "sentence": "Record that the person is away and sessions work on, until a time or open-ended: Writes the away record; refuses an end already past or past seven days.",
+      "flags": [
+        {
+          "name": "hold-pushes",
+          "shorthand": "",
+          "type": "bool",
+          "required": false,
+          "hidden": false
+        },
+        {
+          "name": "until",
+          "shorthand": "",
+          "type": "string",
+          "required": false,
+          "hidden": false
+        }
+      ]
+    },
+    {
+      "path": "abcd mode back",
+      "hidden": false,
+      "sentence": "End the away mode, printing what was queued and recorded one line each: Writes the away record's ending; refuses a record not safely this account's.",
+      "flags": []
+    },
+    {
+      "path": "abcd mode queue",
+      "hidden": false,
+      "sentence": "Queue one step for the person's return while they are away: Writes the away record; refuses when no away record holds.",
+      "flags": []
+    },
     {
       "path": "abcd peers",
       "hidden": false,
diff --git a/commands/mode.md b/commands/mode.md
index 0e56363301..c5c77abe08 100644
--- a/commands/mode.md
+++ b/commands/mode.md
@@ -1,7 +1,7 @@
 ---
 name: mode
 description: "Print or set whose answer the agent loop is waiting on: Writes the state only when setting it; refuses an unknown state or a checkout with no local tier."
-argument-hint: "[managed|facilitator|product-thinker]"
+argument-hint: "[managed|facilitator|product-thinker|autonomous|back|queue]"
 block: agents
 user-invocable: false
 ---
@@ -65,6 +65,60 @@ named, and nothing is written. The state lives per checkout at
 one the set form refuses (exit 2) and creates nothing — say so, and point at
 `/abcd:ahoy install` if the user wanted this repository managed.
 
+## The away mode — `autonomous`, `queue`, `back`
+
+The person's word that they are away and sessions should work on until they
+are back. It sits beside the badge and is not a fourth word. One record holds
+it for every working copy of the repository on this machine, in
+`~/.abcd.noindex/away/<root-sha>/record.json`, changed only under its lock.
+
+**The away mode grants no rights.** The person's own standing instruction
+stays what decides whether a session commits, pushes, or opens or merges a
+pull request, exactly as before. Never read the away mode as permission.
+
+Set it when the person says they are away — they run it themselves, or you
+run it on their word in this session:
+
+```bash
+"${CLAUDE_PLUGIN_ROOT}/abcd" mode autonomous --until 09:00 --json
+```
+
+`--until` takes a clock time (its next occurrence, local time) or a timestamp
+(`2026-10-19T09:00`, or RFC 3339). Without it the mode is open-ended; every
+record ends seven days after it was set at most, and an `--until` past that,
+or one already past, is refused (exit 2) with nothing written. Add
+`--hold-pushes` only when the person says pushes wait for their return: it
+narrows what sessions do and grants nothing. Tell the user the `terms` the
+verb prints. A prompt never ends the mode.
+
+While it holds, an act only the person may approve is queued for their
+return instead of asked, and you carry on with other work:
+
+```bash
+"${CLAUDE_PLUGIN_ROOT}/abcd" mode queue "<step>" --json
+```
+
+A queue with no away record holding is refused (exit 2): ask the person
+instead, the product thinker or the technical facilitator, whichever the
+question is for. While the mode holds, `mode product-thinker` and `mode facilitator`
+are refused too, naming `abcd decide`: decide the question and record it, or
+queue the act.
+
+End it only when the person who was away, the product thinker or the
+technical facilitator, says in this session that they are back:
+
+```bash
+"${CLAUDE_PLUGIN_ROOT}/abcd" mode back
+```
+
+It prints one plain line per queued step, per item handed back and per
+recorded stop (a stop at the host's cap is labelled "possibly forced by the
+cap"), records who ended it and from which working copy, and closes the
+record; on a record whose time has passed it prints the same and closes it.
+Relay every line to the user. A record or lock that is not a regular file this
+account owns that no one else can write, within 64 KiB, is refused by each verb
+(exit 2), naming the file.
+
 ## Where the host has no status surface
 
 The set form prints one line naming whose answer is owed — for example `abcd:
diff --git a/docs/reference/cli/commands.md b/docs/reference/cli/commands.md
index 7431f7e688..3e8a18eda8 100644
--- a/docs/reference/cli/commands.md
+++ b/docs/reference/cli/commands.md
@@ -4047,6 +4047,83 @@ all. With --json the notice is a field. Both forms make no network request.
 Exit 2 on a refusal — an unknown state, no local tier, or no checkout —
 and nothing is written on any of them.
 
+The away mode sits beside the badge, not as a fourth word: `abcd mode
+autonomous [--until <time>] [--hold-pushes]` records that the person is away,
+`abcd mode queue "<step>"` keeps a step for their return, and `abcd mode back`
+ends it and prints what was queued and recorded. While it holds, setting
+`product-thinker` or `facilitator` is refused (exit 2), naming `abcd decide`:
+a stop parked on a person who is away is a question nobody answers. The away
+mode grants no rights; the person's standing instruction decides what is pushed.
+
+#### `abcd mode autonomous`
+
+Record that the person is away and sessions work on, until a time or open-ended: Writes the away record; refuses an end already past or past seven days.
+
+**Usage:** `abcd mode autonomous [flags]`
+
+Record that the person is away, for every working copy of this repository on
+this machine: who set it (the holder name reservations resolve without a
+network read, else git's user.name), from which working copy, and when it ends.
+
+--until takes a clock time (its next occurrence, local time, as 09:00) or a
+timestamp (2026-10-19T09:00, or RFC 3339). Without it the mode is open-ended,
+and every record ends seven days after it was set at most: an --until past that,
+or one already past, is refused. --hold-pushes records the person's word that
+pushes wait for their return; it narrows what sessions do and grants nothing.
+
+The away mode grants no rights: the person's own standing instruction decides
+what is committed, pushed, and opened or merged as a pull request. It ends at its
+time or with `abcd mode back`; a prompt never ends it. Setting it again keeps
+whatever is queued or recorded and not yet read.
+
+The record lives in ~/.abcd.noindex/away/<root-sha>/record.json, keyed on the repository's
+root commit, and is changed only under its lock. Exit 2 on a refusal (an unreadable
+or past --until, one past seven days, no local tier, no checkout, or a record or
+lock that is not safely this account's) with nothing written. No network request.
+
+**Flags:**
+
+```
+      --hold-pushes    the person's word that pushes wait for their return (grants nothing)
+      --until string   when the mode ends: a clock time (09:00) or a timestamp; open-ended (seven days at most) when omitted
+```
+
+#### `abcd mode back`
+
+End the away mode, printing what was queued and recorded one line each: Writes the away record's ending; refuses a record not safely this account's.
+
+**Usage:** `abcd mode back`
+
+End the away mode: print one plain line per queued step, per item handed back
+and per recorded stop (a stop at the host's cap is labelled "possibly forced by
+the cap"), record who ended it and from which working copy, and close the record.
+On a record whose time has already passed it prints the same and closes it. With
+no record, or one already closed, it says there is nothing to end.
+
+A session runs it only on the person's word in that session. Exit 2 when the
+record or its lock is not safely this account's, naming the file, with nothing
+written. No network request.
+
+#### `abcd mode queue`
+
+Queue one step for the person's return while they are away: Writes the away record; refuses when no away record holds.
+
+**Usage:** `abcd mode queue <step>`
+
+Queue one step for the person's return, while the away mode holds: an act only
+the person may approve, which a session queues instead of asking, then carries on
+with other work. `abcd mode back` prints each queued step on one line.
+
+Exit 2 when no away record holds (ask the person instead), on an empty step or one
+over 500 characters, and when the record or its lock is not safely this account's,
+with nothing written. No network request.
+
+**Example:**
+
+```
+abcd mode queue "approve the embargo close for the example advisory"
+```
+
 ### `abcd peers`
 
 List what sibling worktrees and branches hold that this checkout lacks, and the reservations: Writes the fetched reservations; refuses outside a git checkout.
diff --git a/internal/core/surface/examples.go b/internal/core/surface/examples.go
index e741f19378..0d404cb506 100644
--- a/internal/core/surface/examples.go
+++ b/internal/core/surface/examples.go
@@ -110,6 +110,8 @@ var examples = map[string]string{
 	"abcd library declassify": "abcd library declassify example-paper-2026",
 	"abcd library ingest":     "abcd library ingest https://example.com/paper.pdf",
 
+	"abcd mode queue": `abcd mode queue "approve the embargo close for the example advisory"`,
+
 	"abcd memory add":    `abcd memory add --title "The tests need the race flag" --recall test --recall race --by Example:model-1 < note.txt`,
 	"abcd memory remove": "abcd memory remove mem-2609010000000001",
 
diff --git a/internal/core/surface/sentences.go b/internal/core/surface/sentences.go
index a241fe6c3c..ee340de0e6 100644
--- a/internal/core/surface/sentences.go
+++ b/internal/core/surface/sentences.go
@@ -352,6 +352,12 @@ var sentences = map[string]string{
 
 	"abcd mode": "Print or set whose answer the agent loop is waiting on: " +
 		"Writes the state only when setting it; refuses an unknown state or a checkout with no local tier.",
+	"abcd mode autonomous": "Record that the person is away and sessions work on, until a time or open-ended: " +
+		"Writes the away record; refuses an end already past or past seven days.",
+	"abcd mode back": "End the away mode, printing what was queued and recorded one line each: " +
+		"Writes the away record's ending; refuses a record not safely this account's.",
+	"abcd mode queue": "Queue one step for the person's return while they are away: " +
+		"Writes the away record; refuses when no away record holds.",
 
 	"abcd peers": "List what sibling worktrees and branches hold that this checkout lacks, and the reservations: " +
 		"Writes the fetched reservations; refuses outside a git checkout.",
diff --git a/internal/surface/cli/mode.go b/internal/surface/cli/mode.go
index 228e560520..f22c788e26 100644
--- a/internal/surface/cli/mode.go
+++ b/internal/surface/cli/mode.go
@@ -7,6 +7,7 @@ import (
 	"os"
 
 	"github.com/intentdriven/abcd/internal/abcdhome"
+	"github.com/intentdriven/abcd/internal/core/autonomy"
 	"github.com/intentdriven/abcd/internal/core/mode"
 	"github.com/intentdriven/abcd/internal/core/statusline"
 	"github.com/intentdriven/abcd/internal/gitutil"
@@ -57,7 +58,14 @@ func newModeCommand(asJSON *bool) *cobra.Command {
 			"nobody and prints nothing; with a surface installed nothing is printed at\n" +
 			"all. With --json the notice is a field. Both forms make no network request.\n\n" +
 			"Exit 2 on a refusal — an unknown state, no local tier, or no checkout —\n" +
-			"and nothing is written on any of them.",
+			"and nothing is written on any of them.\n\n" +
+			"The away mode sits beside the badge, not as a fourth word: `abcd mode\n" +
+			"autonomous [--until <time>] [--hold-pushes]` records that the person is away,\n" +
+			"`abcd mode queue \"<step>\"` keeps a step for their return, and `abcd mode back`\n" +
+			"ends it and prints what was queued and recorded. While it holds, setting\n" +
+			"`product-thinker` or `facilitator` is refused (exit 2), naming `abcd decide`:\n" +
+			"a stop parked on a person who is away is a question nobody answers. The away\n" +
+			"mode grants no rights; the person's standing instruction decides what is pushed.",
 		Args:      cobra.MaximumNArgs(1),
 		ValidArgs: stateWords(),
 		RunE: func(cmd *cobra.Command, args []string) error {
@@ -78,6 +86,9 @@ func newModeCommand(asJSON *bool) *cobra.Command {
 			if err != nil {
 				return modeRefusal(err)
 			}
+			if err := refuseParkWhileAway(cmd.ErrOrStderr(), cwd, st); err != nil {
+				return modeRefusal(err)
+			}
 			if err := mode.Set(cwd, st); err != nil {
 				return modeRefusal(err)
 			}
@@ -92,9 +103,29 @@ func newModeCommand(asJSON *bool) *cobra.Command {
 			})
 		},
 	}
+	cmd.AddCommand(newModeAutonomousCommand(asJSON), newModeBackCommand(asJSON), newModeQueueCommand(asJSON))
 	return cmd
 }
 
+// refuseParkWhileAway refuses parking the badge on a person while the away
+// mode holds for this checkout's repository. Reading the away record fails
+// open: one that cannot be read safely reads as not away, and says so in one
+// line on errw; a repository with no root commit has no away record at all.
+func refuseParkWhileAway(errw io.Writer, cwd string, st mode.State) error {
+	if st == mode.Managed {
+		return nil
+	}
+	root, err := mode.Root(cwd)
+	if err != nil {
+		return nil // mode.Set reports the root refusal itself.
+	}
+	_, away, err := autonomy.AwayAt(root, autonomy.Options{})
+	if err != nil && errors.Is(err, autonomy.ErrUnsafe) {
+		fmt.Fprintf(errw, "abcd mode: %v; read as not away\n", err)
+	}
+	return mode.RefuseParkWhileAway(st, away)
+}
+
 // stateWords is the closed vocabulary as strings, for shell completion.
 func stateWords() []string {
 	var words []string
@@ -111,7 +142,7 @@ func stateWords() []string {
 // default exit 1. The store's own wording is kept: it names the three words,
 // or the tier, or the checkout, and it carries no local path.
 func modeRefusal(err error) error {
-	if errors.Is(err, mode.ErrUnknownState) || errors.Is(err, mode.ErrNoLocalTier) || errors.Is(err, gitutil.ErrNoCheckoutRoot) {
+	if errors.Is(err, mode.ErrUnknownState) || errors.Is(err, mode.ErrNoLocalTier) || errors.Is(err, mode.ErrAway) || errors.Is(err, gitutil.ErrNoCheckoutRoot) {
 		return &exitError{Code: 2, Msg: "abcd mode: " + err.Error() + " (nothing written)"}
 	}
 	return fmt.Errorf("abcd mode: %w", err)
diff --git a/internal/surface/cli/mode_away.go b/internal/surface/cli/mode_away.go
new file mode 100644
index 0000000000..aad79a0dfd
--- /dev/null
+++ b/internal/surface/cli/mode_away.go
@@ -0,0 +1,199 @@
+package cli
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/abcdhome"
+	"github.com/intentdriven/abcd/internal/core/autonomy"
+	"github.com/intentdriven/abcd/internal/fsutil"
+	"github.com/intentdriven/abcd/internal/gitutil"
+	"github.com/spf13/cobra"
+)
+
+// awayOutput is the --json envelope of `abcd mode autonomous`.
+type awayOutput struct {
+	Away       bool      `json:"away"`
+	SetBy      string    `json:"set_by"`
+	SetFrom    string    `json:"set_from"`
+	Start      time.Time `json:"start"`
+	Until      time.Time `json:"until"`
+	OpenEnded  bool      `json:"open_ended"`
+	HoldPushes bool      `json:"hold_pushes"`
+	Queued     int       `json:"queued"`
+	HandedBack int       `json:"handed_back"`
+	Stops      int       `json:"stops"`
+	Terms      []string  `json:"terms"`
+}
+
+// backOutput is the --json envelope of `abcd mode back`.
+type backOutput struct {
+	State     string   `json:"state"`
+	Lines     []string `json:"lines"`
+	EndedBy   string   `json:"ended_by,omitempty"`
+	EndedFrom string   `json:"ended_from,omitempty"`
+}
+
+// queueOutput is the --json envelope of `abcd mode queue`.
+type queueOutput struct {
+	Queued int `json:"queued"`
+}
+
+// newModeAutonomousCommand builds `abcd mode autonomous`, the front door onto
+// autonomy.SetAway (itd-2610180912189125, step 1).
+func newModeAutonomousCommand(asJSON *bool) *cobra.Command {
+	var until string
+	var holdPushes bool
+	cmd := &cobra.Command{
+		Use: "autonomous",
+		Long: "Record that the person is away, for every working copy of this repository on\n" +
+			"this machine: who set it (the holder name reservations resolve without a\n" +
+			"network read, else git's user.name), from which working copy, and when it ends.\n\n" +
+			"--until takes a clock time (its next occurrence, local time, as 09:00) or a\n" +
+			"timestamp (2026-10-19T09:00, or RFC 3339). Without it the mode is open-ended,\n" +
+			"and every record ends seven days after it was set at most: an --until past that,\n" +
+			"or one already past, is refused. --hold-pushes records the person's word that\n" +
+			"pushes wait for their return; it narrows what sessions do and grants nothing.\n\n" +
+			"The away mode grants no rights: the person's own standing instruction decides\n" +
+			"what is committed, pushed, and opened or merged as a pull request. It ends at its\n" +
+			"time or with `abcd mode back`; a prompt never ends it. Setting it again keeps\n" +
+			"whatever is queued or recorded and not yet read.\n\n" +
+			"The record lives in " + abcdhome.Display(autonomy.StoreDir, "<root-sha>", autonomy.RecordFile) + ", keyed on the repository's\n" +
+			"root commit, and is changed only under its lock. Exit 2 on a refusal (an unreadable\n" +
+			"or past --until, one past seven days, no local tier, no checkout, or a record or\n" +
+			"lock that is not safely this account's) with nothing written. No network request.",
+		Args: cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			cwd, err := os.Getwd()
+			if err != nil {
+				return err
+			}
+			rec, err := autonomy.SetAway(cwd, until, holdPushes, autonomy.Options{})
+			if err != nil {
+				return awayRefusal("autonomous", err)
+			}
+			out := awayOutput{
+				Away: true, SetBy: rec.SetBy, SetFrom: fsutil.DisplayPath(rec.SetFrom),
+				Start: rec.Start, Until: rec.Ends(), OpenEnded: rec.OpenEnded, HoldPushes: rec.HoldPushes,
+				Queued: len(rec.Queue), HandedBack: len(rec.HandedBack), Stops: len(rec.Stops), Terms: rec.Terms(),
+			}
+			return render(cmd.OutOrStdout(), *asJSON, out, func(w io.Writer) {
+				for _, l := range out.Terms {
+					fmt.Fprintln(w, l)
+				}
+				if n := out.Queued + out.HandedBack + out.Stops; n > 0 {
+					fmt.Fprintf(w, "Kept from before, not yet read: %d queued, %d handed back, %d stops recorded.\n",
+						out.Queued, out.HandedBack, out.Stops)
+				}
+			})
+		},
+	}
+	cmd.Flags().StringVar(&until, "until", "", "when the mode ends: a clock time (09:00) or a timestamp; open-ended (seven days at most) when omitted")
+	cmd.Flags().BoolVar(&holdPushes, "hold-pushes", false, "the person's word that pushes wait for their return (grants nothing)")
+	return cmd
+}
+
+// newModeBackCommand builds `abcd mode back`, the front door onto
+// autonomy.Back.
+func newModeBackCommand(asJSON *bool) *cobra.Command {
+	return &cobra.Command{
+		Use: "back",
+		Long: "End the away mode: print one plain line per queued step, per item handed back\n" +
+			"and per recorded stop (a stop at the host's cap is labelled \"possibly forced by\n" +
+			"the cap\"), record who ended it and from which working copy, and close the record.\n" +
+			"On a record whose time has already passed it prints the same and closes it. With\n" +
+			"no record, or one already closed, it says there is nothing to end.\n\n" +
+			"A session runs it only on the person's word in that session. Exit 2 when the\n" +
+			"record or its lock is not safely this account's, naming the file, with nothing\n" +
+			"written. No network request.",
+		Args: cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			cwd, err := os.Getwd()
+			if err != nil {
+				return err
+			}
+			res, err := autonomy.Back(cwd, autonomy.Options{})
+			if err != nil {
+				return awayRefusal("back", err)
+			}
+			out := backOutput{State: res.State, Lines: res.Lines}
+			if out.Lines == nil {
+				out.Lines = []string{}
+			}
+			if res.State != "none" && res.Record != nil && res.Record.Closed != nil {
+				out.EndedBy = res.Record.Closed.By
+				out.EndedFrom = fsutil.DisplayPath(res.Record.Closed.From)
+			}
+			return render(cmd.OutOrStdout(), *asJSON, out, func(w io.Writer) {
+				for _, l := range out.Lines {
+					fmt.Fprintln(w, l)
+				}
+				switch res.State {
+				case "none":
+					fmt.Fprintln(w, "abcd: not in the away mode; nothing to end")
+				case "lapsed":
+					fmt.Fprintf(w, "abcd: the away window ended at %s; closed by %s from %s\n",
+						res.Record.Ends().Local().Format("2006-01-02 15:04 MST"), whoWords(out.EndedBy), out.EndedFrom)
+				default:
+					fmt.Fprintf(w, "abcd: the away mode is over, ended by %s from %s\n", whoWords(out.EndedBy), out.EndedFrom)
+				}
+			})
+		},
+	}
+}
+
+// newModeQueueCommand builds `abcd mode queue "<step>"`, the front door onto
+// autonomy.QueueStep.
+func newModeQueueCommand(asJSON *bool) *cobra.Command {
+	return &cobra.Command{
+		Use: "queue <step>",
+		Long: "Queue one step for the person's return, while the away mode holds: an act only\n" +
+			"the person may approve, which a session queues instead of asking, then carries on\n" +
+			"with other work. `abcd mode back` prints each queued step on one line.\n\n" +
+			"Exit 2 when no away record holds (ask the person instead), on an empty step or one\n" +
+			"over 500 characters, and when the record or its lock is not safely this account's,\n" +
+			"with nothing written. No network request.",
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			cwd, err := os.Getwd()
+			if err != nil {
+				return err
+			}
+			rec, err := autonomy.QueueStep(cwd, args[0], autonomy.Options{})
+			if err != nil {
+				return awayRefusal("queue", err)
+			}
+			out := queueOutput{Queued: len(rec.Queue)}
+			return render(cmd.OutOrStdout(), *asJSON, out, func(w io.Writer) {
+				fmt.Fprintf(w, "abcd: queued for the person's return (%d queued)\n", out.Queued)
+			})
+		},
+	}
+}
+
+func whoWords(name string) string {
+	if name == "" {
+		return "someone git does not name"
+	}
+	return name
+}
+
+// awayRefusal maps the away verbs' refusals to exit 2 with nothing written:
+// each is "this invocation cannot be honoured". Anything else is an I/O
+// failure at the default exit 1.
+func awayRefusal(verb string, err error) error {
+	for _, sentinel := range []error{
+		autonomy.ErrUntilUnreadable, autonomy.ErrUntilPast, autonomy.ErrUntilBeyondCap,
+		autonomy.ErrStepEmpty, autonomy.ErrStepTooLong, autonomy.ErrNotAway,
+		autonomy.ErrNoLocalTier, autonomy.ErrUnsafe, autonomy.ErrLockBusy, autonomy.ErrRecordFull,
+		autonomy.ErrNoRootCommit, autonomy.ErrNoHome, gitutil.ErrNoCheckoutRoot,
+	} {
+		if errors.Is(err, sentinel) {
+			return &exitError{Code: 2, Msg: "abcd mode " + verb + ": " + err.Error() + " (nothing written)"}
+		}
+	}
+	return fmt.Errorf("abcd mode %s: %w", verb, err)
+}
diff --git a/internal/surface/cli/mode_away_test.go b/internal/surface/cli/mode_away_test.go
new file mode 100644
index 0000000000..917da03fe7
--- /dev/null
+++ b/internal/surface/cli/mode_away_test.go
@@ -0,0 +1,283 @@
+package cli
+
+import (
+	"encoding/json"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/abcdhome"
+	"github.com/intentdriven/abcd/internal/core/autonomy"
+	"github.com/intentdriven/abcd/internal/gittest"
+)
+
+// awayCheckout is managedCheckout with a first commit, so the away store has a
+// root commit to key on, and a local user.name, so the record names who set
+// it.
+func awayCheckout(t *testing.T) string {
+	t.Helper()
+	root := managedCheckout(t)
+	gitCommitAt(t, root, "seed")
+	gitAt(t, root, "config", "--local", "user.name", "Alice")
+	return root
+}
+
+func gitAt(t *testing.T, dir string, args ...string) string {
+	t.Helper()
+	cmd := exec.Command("git", append([]string{"-C", dir}, args...)...)
+	cmd.Env = gittest.Env(t)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("git %v: %v (%s)", args, err, out)
+	}
+	return strings.TrimSpace(string(out))
+}
+
+func awayStore(t *testing.T, root string) autonomy.Store {
+	t.Helper()
+	st, err := autonomy.OpenStore(os.Getenv("HOME"), root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return st
+}
+
+func readAway(t *testing.T, root string) *autonomy.Record {
+	t.Helper()
+	rec, err := awayStore(t, root).Read()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return rec
+}
+
+// TestAwayRecordSharedAcrossWorktrees: `abcd mode autonomous --until 09:00`
+// writes one record in the away store that a sibling worktree reads, with who
+// set it and from which copy.
+func TestAwayRecordSharedAcrossWorktrees(t *testing.T) {
+	root := awayCheckout(t)
+	sibling := filepath.Join(t.TempDir(), "sibling")
+	gitAt(t, root, "worktree", "add", "-q", "-b", "feat/sibling", sibling)
+	sibling = realPath(t, sibling)
+
+	stdout, stderr, err := runSplit(t, "", "mode", "autonomous", "--until", "09:00")
+	if err != nil {
+		t.Fatalf("mode autonomous: %v\n%s", err, stderr)
+	}
+	for _, want := range []string{"Away until", "Alice", "abcd mode back", "grants no rights"} {
+		if !strings.Contains(stdout, want) {
+			t.Errorf("the set's output misses %q:\n%s", want, stdout)
+		}
+	}
+
+	t.Chdir(sibling)
+	rec, holds, err := autonomy.AwayAt(sibling, autonomy.Options{})
+	if err != nil || !holds {
+		t.Fatalf("the sibling worktree does not read the record: holds=%v err=%v", holds, err)
+	}
+	if rec.SetBy != "Alice" || rec.SetFrom != root {
+		t.Errorf("record names set_by=%q set_from=%q, want Alice from %s", rec.SetBy, rec.SetFrom, root)
+	}
+	if h, m := rec.Ends().Local().Hour(), rec.Ends().Local().Minute(); h != 9 || m != 0 {
+		t.Errorf("--until 09:00 ends at %s", rec.Ends().Local())
+	}
+	if entries, _ := os.ReadDir(abcdhome.Path(os.Getenv("HOME"), autonomy.StoreDir)); len(entries) != 1 {
+		t.Errorf("the away store holds %d repository folders, want one shared by both copies", len(entries))
+	}
+
+	// The JSON form carries the same record.
+	t.Chdir(root)
+	so, _, err := runSplit(t, "", "mode", "autonomous", "--until", "09:00", "--json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var got struct {
+		Away    bool   `json:"away"`
+		SetBy   string `json:"set_by"`
+		SetFrom string `json:"set_from"`
+		Until   string `json:"until"`
+	}
+	if err := json.Unmarshal([]byte(so), &got); err != nil {
+		t.Fatalf("--json: %v\n%s", err, so)
+	}
+	if !got.Away || got.SetBy != "Alice" || got.Until == "" || got.SetFrom == "" {
+		t.Errorf("--json = %+v", got)
+	}
+}
+
+// TestUntilRefusedPastOrNoTierOrNoCheckout: a past --until, one past seven
+// days, an unreadable one, a checkout without the local tier, and no checkout
+// are each refused at exit 2 with nothing written.
+func TestUntilRefusedPastOrNoTierOrNoCheckout(t *testing.T) {
+	root := awayCheckout(t)
+	home := os.Getenv("HOME")
+	past := time.Now().Add(-time.Hour).Format(time.RFC3339)
+	far := time.Now().Add(autonomy.MaxWindow + time.Hour).Format(time.RFC3339)
+	for _, args := range [][]string{
+		{"mode", "autonomous", "--until", past},
+		{"mode", "autonomous", "--until", far},
+		{"mode", "autonomous", "--until", "tomorrow"},
+	} {
+		out, err := runCLIErr(t, args...)
+		if err == nil {
+			t.Errorf("%v succeeded:\n%s", args, out)
+			continue
+		}
+		if code := exitCodeOf(err); code != 2 {
+			t.Errorf("%v: exit = %d, want 2 (%v)", args, code, err)
+		}
+		if !strings.Contains(err.Error(), "nothing written") {
+			t.Errorf("%v: the refusal does not say nothing was written: %v", args, err)
+		}
+	}
+	if err := os.RemoveAll(filepath.Join(root, ".abcd")); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := runCLIErr(t, "mode", "autonomous"); err == nil || exitCodeOf(err) != 2 || !strings.Contains(err.Error(), ".abcd/.work.local") {
+		t.Errorf("no tier: err = %v, want exit 2 naming the tier", err)
+	}
+	t.Chdir(t.TempDir())
+	if _, err := runCLIErr(t, "mode", "autonomous"); err == nil || exitCodeOf(err) != 2 {
+		t.Errorf("no checkout: err = %v, want exit 2", err)
+	}
+	if _, err := os.Stat(abcdhome.Path(home, autonomy.StoreDir)); err == nil {
+		t.Error("a refused set created the away store")
+	}
+}
+
+// TestModeBackPrintsQueueAndStops: `abcd mode back` prints one plain line per
+// queued step and per recorded stop, the cap label included, records who
+// ended the mode and from which copy, and does the same on a record whose
+// time has passed.
+func TestModeBackPrintsQueueAndStops(t *testing.T) {
+	root := awayCheckout(t)
+	if _, err := runCLIErr(t, "mode", "autonomous"); err != nil {
+		t.Fatal(err)
+	}
+	for _, step := range []string{"approve the embargo close", "push feat/x"} {
+		if out, err := runCLIErr(t, "mode", "queue", step); err != nil {
+			t.Fatalf("mode queue: %v\n%s", err, out)
+		}
+	}
+	st := awayStore(t, root)
+	stop := autonomy.Stop{Kind: autonomy.StopWorkOwed, Detail: "feat/x is behind main", PossiblyForcedByCap: true}
+	for range 2 {
+		if ok, err := st.RecordStop(stop, time.Now()); err != nil || !ok {
+			t.Fatalf("RecordStop: %v %v", ok, err)
+		}
+	}
+	stdout, stderr, err := runSplit(t, "", "mode", "back")
+	if err != nil {
+		t.Fatalf("mode back: %v\n%s", err, stderr)
+	}
+	lines := strings.Split(strings.TrimRight(stdout, "\n"), "\n")
+	if len(lines) != 4 {
+		t.Fatalf("mode back printed %d lines, want two queued, one stop and the ending:\n%s", len(lines), stdout)
+	}
+	for _, want := range []string{"queued: approve the embargo close", "queued: push feat/x", "possibly forced by the cap", "2 times", "Alice"} {
+		if !strings.Contains(stdout, want) {
+			t.Errorf("mode back misses %q:\n%s", want, stdout)
+		}
+	}
+	rec := readAway(t, root)
+	if rec.Holds(time.Now()) || rec.Closed == nil || rec.Closed.By != "Alice" || rec.Closed.From != root {
+		t.Errorf("after mode back: closed=%+v holds=%v", rec.Closed, rec.Holds(time.Now()))
+	}
+
+	// A second `mode back` has nothing to end.
+	if out := string(runCLI(t, "mode", "back")); !strings.Contains(out, "not in the away mode") {
+		t.Errorf("a second mode back printed %q", out)
+	}
+
+	// A record whose time has passed prints the same and is closed.
+	start := time.Now().Add(-3 * time.Hour).Truncate(time.Second)
+	if _, err := st.Update(func(*autonomy.Record) (*autonomy.Record, error) {
+		r := &autonomy.Record{SchemaVersion: autonomy.SchemaVersion, SetBy: "Alice", SetFrom: root,
+			Start: start, Until: start.Add(time.Hour)}
+		_ = r.AddStep("rotate the release key", root, start)
+		return r, nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	out := string(runCLI(t, "mode", "back"))
+	if !strings.Contains(out, "queued: rotate the release key") || !strings.Contains(out, "ended at") {
+		t.Errorf("mode back on a lapsed record printed:\n%s", out)
+	}
+	if rec := readAway(t, root); rec.Closed == nil {
+		t.Error("mode back left a lapsed record unclosed")
+	}
+}
+
+// TestHoldPushesRecordedAtTheVerb: `--hold-pushes` is kept in the record and
+// said in the set's output, beside the mode granting no rights.
+func TestHoldPushesRecordedAtTheVerb(t *testing.T) {
+	root := awayCheckout(t)
+	stdout, _, err := runSplit(t, "", "mode", "autonomous", "--hold-pushes")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !readAway(t, root).HoldPushes {
+		t.Error("--hold-pushes is not in the record")
+	}
+	if !strings.Contains(stdout, "pushes wait") || !strings.Contains(stdout, "grants no rights") {
+		t.Errorf("the set's output does not say pushes wait and the mode grants no rights:\n%s", stdout)
+	}
+	so, _, err := runSplit(t, "", "mode", "autonomous", "--json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(so, `"hold_pushes": false`) || readAway(t, root).HoldPushes {
+		t.Errorf("setting again without --hold-pushes kept it:\n%s", so)
+	}
+}
+
+// TestBadgeRefusedWhileAwayAtTheVerb: while away, `abcd mode product-thinker`
+// and `abcd mode facilitator` are refused naming `abcd decide`, nothing is
+// written, and `managed` is still set.
+func TestBadgeRefusedWhileAwayAtTheVerb(t *testing.T) {
+	root := awayCheckout(t)
+	if _, err := runCLIErr(t, "mode", "autonomous"); err != nil {
+		t.Fatal(err)
+	}
+	for _, st := range []string{"product-thinker", "facilitator"} {
+		_, err := runCLIErr(t, "mode", st)
+		if err == nil || exitCodeOf(err) != 2 || !strings.Contains(err.Error(), "abcd decide") {
+			t.Errorf("mode %s while away: err = %v, want exit 2 naming `abcd decide`", st, err)
+		}
+		if storedMode(t, root) != "" {
+			t.Errorf("a refused `mode %s` wrote the badge", st)
+		}
+	}
+	if _, err := runCLIErr(t, "mode", "managed"); err != nil {
+		t.Errorf("mode managed while away refused: %v", err)
+	}
+	runCLI(t, "mode", "back")
+	if _, err := runCLIErr(t, "mode", "facilitator"); err != nil {
+		t.Errorf("mode facilitator after mode back refused: %v", err)
+	}
+}
+
+// TestModeQueueRefusals: a step is refused when no record holds, when it is
+// empty, and when the record fails the store's checks, naming the file.
+func TestModeQueueRefusals(t *testing.T) {
+	root := awayCheckout(t)
+	if _, err := runCLIErr(t, "mode", "queue", "push feat/x"); err == nil || exitCodeOf(err) != 2 || !strings.Contains(err.Error(), "not away") {
+		t.Errorf("queue while present: err = %v, want exit 2 saying not away", err)
+	}
+	if _, err := runCLIErr(t, "mode", "autonomous"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := runCLIErr(t, "mode", "queue", "   "); err == nil || exitCodeOf(err) != 2 {
+		t.Errorf("empty step: err = %v, want exit 2", err)
+	}
+	if err := os.Chmod(awayStore(t, root).RecordPath(), 0o666); err != nil {
+		t.Fatal(err)
+	}
+	_, err := runCLIErr(t, "mode", "queue", "push feat/x")
+	if err == nil || exitCodeOf(err) != 2 || !strings.Contains(err.Error(), autonomy.RecordFile) {
+		t.Errorf("queue on a record others can write: err = %v, want exit 2 naming %s", err, autonomy.RecordFile)
+	}
+}

From fce4d8b7297ecfeb5850c54bc90bf77b9e0e38f3 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 12:25:50 +0100
Subject: [PATCH 12/58] docs: mark the away record's step landed and record the
 lane's choices

Step 1 of the overnight-stall plan is landed; its Settled here section
records the readings the build lane chose where the plan was silent,
for review.

Refs: itd-2610180912189125
Assisted-by: Claude:claude-opus-5-5
---
 ...489-a-session-told-to-work-on-while-its.md | 62 +++++++++++++++++++
 1 file changed, 62 insertions(+)

diff --git a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
index e424660269..6f1e7b43be 100644
--- a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
+++ b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
@@ -514,6 +514,67 @@ command pages already do.
 The away block repeats this list and that the mode grants nothing. No mode
 is set and no question is marked open.
 
+## Settled here
+
+Choices made while building step 1 on 2026-10-18 where this record is
+silent, each the narrowest reading that meets the step. Each is the build
+lane's choice, recorded for review; none changes a test the step names.
+
+- 2026-10-18 (lane's choice, for review): **Setting the mode again keeps
+  what is unread.** `abcd mode autonomous` on a record that holds, or that
+  lapsed and is not yet closed, writes a new record (who set it, from which
+  copy, a new start and end, `--hold-pushes` as given this time) and carries
+  over its queued steps, handed-back items and recorded stops, since nothing
+  has printed them yet. The seven-day cap counts from the new start: setting
+  the mode is a deliberate act, and the cap is there for a forgotten record.
+  A closed record's items, already printed by `abcd mode back`, are not
+  carried.
+- 2026-10-18 (lane's choice, for review): **`abcd mode queue` needs a record
+  that holds.** With none, or one lapsed, it is refused (exit 2) and the
+  reason says to ask the person instead, since there is no return to queue
+  for. A step's whitespace is folded so it prints as one line, and a step
+  over 500 characters is refused, so one step cannot fill the 64 KiB record.
+- 2026-10-18 (lane's choice, for review): **Who set it.** The holder name
+  reservations resolve with no network read (`claim.ReaderHolder`), else
+  the name git would author a commit with (`identity.EffectiveIdentity`,
+  which reads `user.name` after git's own overrides), else nothing, shown as
+  "someone git does not name". The working copy is its root as git names it,
+  shown in the tilde form.
+- 2026-10-18 (lane's choice, for review): **Every refusal is exit 2 with
+  nothing written**, a lock not had within two seconds included: each is
+  "this invocation cannot be honoured", as the badge's refusals are.
+- 2026-10-18 (lane's choice, for review): **The lock is checked on every
+  read, not only on writes.** A lock file that is a symlink, another
+  account's, writable by others or over 64 KiB reads as not away for the
+  hooks as well as refusing the verbs, as TestRecordOwnershipFailsOpen
+  names. Reading never creates the store; the first write creates its
+  folders owner-only.
+- 2026-10-18 (lane's choice, for review): **"Shown in the away block" is
+  `Record.Terms`.** Step 1 has no away block yet (step 2 prints it), so the
+  record's plain statement (until when, set by whom from which copy, that
+  pushes wait when `--hold-pushes` is set, that the mode grants no rights,
+  and how it ends) is `Record.Terms`, which `abcd mode autonomous` prints and
+  step 2's block can repeat.
+- 2026-10-18 (lane's choice, for review): **Sibling files go through the
+  store.** The created-branch list (step 3) and the session's start-copy
+  note (step 2) live in the same folder; `Store.ReadFile` and
+  `Store.WriteFile`, called inside `Store.WithLock`, give them the record's
+  ownership, size and atomic-write terms. Their names and shapes are those
+  steps' to choose.
+- 2026-10-18 (lane's choice, for review): **The badge's refusal reads the
+  record at the verb.** `mode.RefuseParkWhileAway` is pure and the CLI reads
+  the away record for it, so `internal/core/mode` keeps no knowledge of the
+  away store; the guard's chip-set path is left to step 6, whose gate denies
+  every question while away before that path is reached.
+- 2026-10-18 (lane's choice, for review): **`abcd mode` gets its own brief
+  chapter**, `04-surfaces/26-mode.md`, beyond the step's named packages.
+  Once the verb registers sub-verbs, record-lint's `surface_coverage` rule
+  requires a chapter named for it with a sub-verbs table, so the away mode's
+  surface text lives there, the register's row 26 points at it, and
+  `08-abcd.md` keeps the badge and points at the new chapter. The three
+  sub-verbs' sentences and the queue's worked example go in
+  `internal/core/surface`, as every visible verb's do.
+
 ## Footprint
 
 - packages: internal/core/autonomy, internal/core/mode, internal/core/guard, internal/surface/cli, hooks, commands/mode.md, commands/guard.md, .abcd/development/brief/02-constraints/03-invariants.md, .abcd/development/brief/04-surfaces/08-abcd.md, .abcd/development/brief/04-surfaces/17-guard.md
@@ -553,6 +614,7 @@ is set and no question is marked open.
      (the owed items, each with its kind, whether it is capped, and its
      branch or record id) in `internal/core/autonomy`, so steps 3 and 4 and
      steps 5 and 6 can run in two lanes against them.
+   - landed: 2e859ad4b
 2. Repeated to the agent, shown to the person
    - packages: internal/surface/cli
    - tests: internal/surface/cli

From 472488938101fb6fe6c161b8ef0330d67949b7f4 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 12:45:28 +0100
Subject: [PATCH 13/58] feat: repeat the away record to the agent and show the
 person its line

While the away record holds, the session-start hook prints the away
block on every source, compaction included, and the prompt hook adds it
to every prompt outside the rules loader's dedup ledger. The block says
the mode grants no rights, lists the acts only the person may approve,
routes every other question to abcd decide, and allows abcd mode back
only on the person's word. The person sees one line on every prompt
naming who set it, from which copy, the steps queued and items handed
back, and abcd mode back; a lapsed, unclosed record holding a queued
step or a recorded stop shows one line naming that verb instead. The
session-start hook notes each session's start copy in the away store,
first note kept, so a hook run from a worktree the session made
resolves to the start copy. The prompt hook reads the record through
the drain's root-commit lookup, so it still makes one a prompt.

Refs: itd-2610180912189125
Assisted-by: Claude:claude-opus-5-5
---
 internal/core/autonomy/lines.go        |  49 +++++
 internal/core/autonomy/sessions.go     | 141 +++++++++++++
 internal/surface/cli/cli.go            |  52 +++--
 internal/surface/cli/hook_away.go      | 191 +++++++++++++++++
 internal/surface/cli/hook_away_test.go | 281 +++++++++++++++++++++++++
 5 files changed, 699 insertions(+), 15 deletions(-)
 create mode 100644 internal/core/autonomy/lines.go
 create mode 100644 internal/core/autonomy/sessions.go
 create mode 100644 internal/surface/cli/hook_away.go
 create mode 100644 internal/surface/cli/hook_away_test.go

diff --git a/internal/core/autonomy/lines.go b/internal/core/autonomy/lines.go
new file mode 100644
index 0000000000..b81d10446b
--- /dev/null
+++ b/internal/core/autonomy/lines.go
@@ -0,0 +1,49 @@
+package autonomy
+
+import (
+	"fmt"
+	"strings"
+)
+
+// PersonLine is the one line the prompt hook shows the person on every prompt
+// while the record holds: until when, set by whom and from which working
+// copy, the counts of queued steps and handed-back items, and the literal
+// `abcd mode back` as the way to end it (dcn-2610181035355741).
+func (r *Record) PersonLine() string {
+	until := showTime(r.Ends())
+	if r.OpenEnded {
+		until += " (open-ended)"
+	}
+	hold := ""
+	if r.HoldPushes {
+		hold = "; pushes wait for you"
+	}
+	return fmt.Sprintf("abcd: away until %s, set by %s from %s%s; %s queued, %s handed back. `abcd mode back` ends it.",
+		until, showWho(r.SetBy), showCopy(r.SetFrom), hold,
+		count(len(r.Queue), "step", "steps"), count(len(r.HandedBack), "item", "items"))
+}
+
+// LapsedLine is the one line the prompt hook shows the person on every prompt
+// while the record has lapsed unclosed holding a queued step or a recorded
+// stop, and "" otherwise (dcn-2610181003474765).
+func (r *Record) LapsedLine() string {
+	if len(r.Queue) == 0 && len(r.Stops) == 0 {
+		return ""
+	}
+	var parts []string
+	if n := len(r.Queue); n > 0 {
+		parts = append(parts, count(n, "step", "steps")+" queued")
+	}
+	if n := len(r.Stops); n > 0 {
+		parts = append(parts, count(n, "stop", "stops")+" recorded")
+	}
+	return fmt.Sprintf("abcd: the away window ended at %s with %s, not yet read. `abcd mode back` prints them and closes it.",
+		showTime(r.Ends()), strings.Join(parts, " and "))
+}
+
+func count(n int, one, many string) string {
+	if n == 1 {
+		return "1 " + one
+	}
+	return fmt.Sprintf("%d %s", n, many)
+}
diff --git a/internal/core/autonomy/sessions.go b/internal/core/autonomy/sessions.go
new file mode 100644
index 0000000000..94ae307d5e
--- /dev/null
+++ b/internal/core/autonomy/sessions.go
@@ -0,0 +1,141 @@
+package autonomy
+
+import (
+	"encoding/json"
+	"errors"
+	"io/fs"
+	"os"
+	"regexp"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/gitutil"
+)
+
+// SessionsFile is the away store's note of each session's start copy: the
+// worktree a session started in, keyed by session id, so a hook run after the
+// session changed directory into a worktree it made still reads the start
+// copy's key, local tier and session state ("Which copy").
+const SessionsFile = "sessions.json"
+
+// MaxSessionNotes bounds the notes kept; the oldest go first.
+const MaxSessionNotes = 256
+
+// SessionNoteTTL is how long a note is kept: a session older than this is
+// long over.
+const SessionNoteTTL = 30 * 24 * time.Hour
+
+// sessionIDRe is the shape of a session id abcd keys anything on.
+var sessionIDRe = regexp.MustCompile(`^[A-Za-z0-9_-]{1,128}$`)
+
+// ErrSessionID is a session id outside [A-Za-z0-9_-]{1,128}.
+var ErrSessionID = errors.New("autonomy: the session id is not [A-Za-z0-9_-]{1,128}")
+
+// ValidSessionID reports whether id is one abcd keys a file on.
+func ValidSessionID(id string) bool { return sessionIDRe.MatchString(id) }
+
+// SessionNote is one session's start copy.
+type SessionNote struct {
+	ID   string    `json:"id"`
+	Copy string    `json:"copy"`
+	At   time.Time `json:"at"`
+}
+
+type sessionNotes struct {
+	SchemaVersion int           `json:"schema_version"`
+	Sessions      []SessionNote `json:"sessions"`
+}
+
+func (s Store) readNotes() (sessionNotes, error) {
+	raw, err := s.ReadFile(SessionsFile)
+	if errors.Is(err, fs.ErrNotExist) && !errors.Is(err, ErrUnsafe) {
+		return sessionNotes{SchemaVersion: SchemaVersion}, nil
+	}
+	if err != nil {
+		return sessionNotes{}, err
+	}
+	var n sessionNotes
+	if err := json.Unmarshal(raw, &n); err != nil || n.SchemaVersion != SchemaVersion {
+		return sessionNotes{}, errors.Join(ErrUnsafe, errors.New(s.Display(SessionsFile)+" does not parse"))
+	}
+	return n, nil
+}
+
+// NoteSessionCopy notes copy as the session's start copy, under the store's
+// lock, unless the session already has a note: the first note is the start,
+// so a compaction or resume run from a worktree the session made keeps it.
+// It reports whether it wrote. Notes past SessionNoteTTL, and the oldest past
+// MaxSessionNotes, are dropped.
+func (s Store) NoteSessionCopy(sessionID, copy string, now time.Time) (bool, error) {
+	if !ValidSessionID(sessionID) {
+		return false, ErrSessionID
+	}
+	wrote := false
+	err := s.WithLock(func() error {
+		n, err := s.readNotes()
+		if err != nil {
+			return err
+		}
+		kept := n.Sessions[:0]
+		for _, e := range n.Sessions {
+			if e.ID == sessionID {
+				return nil
+			}
+			if now.Sub(e.At) < SessionNoteTTL {
+				kept = append(kept, e)
+			}
+		}
+		kept = append(kept, SessionNote{ID: sessionID, Copy: copy, At: now.Truncate(time.Second)})
+		if len(kept) > MaxSessionNotes {
+			kept = kept[len(kept)-MaxSessionNotes:]
+		}
+		n.SchemaVersion, n.Sessions = SchemaVersion, kept
+		raw, err := json.MarshalIndent(n, "", "  ")
+		if err != nil {
+			return err
+		}
+		if err := s.WriteFile(SessionsFile, append(raw, '\n')); err != nil {
+			return err
+		}
+		wrote = true
+		return nil
+	})
+	return wrote, err
+}
+
+// SessionCopy is the session's noted start copy, when it has one that is
+// still a directory.
+func (s Store) SessionCopy(sessionID string) (string, bool) {
+	if !ValidSessionID(sessionID) {
+		return "", false
+	}
+	n, err := s.readNotes()
+	if err != nil {
+		return "", false
+	}
+	for _, e := range n.Sessions {
+		if e.ID == sessionID {
+			if fi, err := os.Stat(e.Copy); err == nil && fi.IsDir() {
+				return e.Copy, true
+			}
+			return "", false
+		}
+	}
+	return "", false
+}
+
+// ResolveCopy is the working copy a session acts from: the start copy its
+// session-start noted, else the worktree of cwd; and the away store its
+// repository keys. The store is keyed on the root commit, so every worktree
+// of the repository opens the same one and finds the note.
+func ResolveCopy(cwd, sessionID string, o Options) (string, Store, error) {
+	root, st, err := Resolve(cwd, o)
+	if err != nil {
+		return root, st, err
+	}
+	if c, ok := st.SessionCopy(sessionID); ok {
+		if top, err := gitutil.Toplevel(c); err == nil && gitutil.RootCommit(top) == st.RootSHA() {
+			return top, st, nil
+		}
+	}
+	return root, st, nil
+}
diff --git a/internal/surface/cli/cli.go b/internal/surface/cli/cli.go
index fbf20454c4..4f7d789969 100644
--- a/internal/surface/cli/cli.go
+++ b/internal/surface/cli/cli.go
@@ -1656,6 +1656,10 @@ type routerView struct {
 	// SessionTitle is the session's title when this prompt set it
 	// (hook_session_name.go), and absent on every other prompt.
 	SessionTitle string `json:"session_title,omitempty"`
+	// SystemMessage is the one line the person is shown while the away
+	// record holds, or once it lapsed unclosed with anything unread
+	// (spc-2610180914469489 step 2), and absent otherwise.
+	SystemMessage string `json:"system_message,omitempty"`
 }
 
 // routerRefused is the prompt router's fail-open exit when it cannot evaluate
@@ -1731,7 +1735,16 @@ alone, or empty, when the rules could not be loaded):
   {"hookSpecificOutput": {"hookEventName": "UserPromptSubmit",
    "additionalContext": ..., "sessionTitle": ...}}
 
-and the --json envelope carries the name as session_title.`,
+and the --json envelope carries the name as session_title.
+
+While the away record holds (abcd mode autonomous), every prompt's text ends
+with the "## AWAY" block, outside the dedup ledger, and the person is shown
+one line naming who set it, from which working copy, the steps queued and
+items handed back, and abcd mode back; once its window has lapsed unclosed
+with a queued step or a recorded stop, one line naming abcd mode back
+instead. Plain stdout is then one object carrying that line as systemMessage
+beside the additional context (and sessionTitle when owed), and the --json
+envelope carries it as system_message.`,
 		Args: cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, _ []string) error {
 			// The hook's one deadline (C12), set before anything else runs:
@@ -1774,6 +1787,12 @@ and the --json envelope carries the name as session_title.`,
 			// the drain's reason: a rules.json that will not load must not
 			// also leave the badge parked.
 			resetModeOnAnswer(cmd.ErrOrStderr(), cwd)
+			// The away record (spc-2610180914469489 step 2): its block rides
+			// every prompt, outside the loader's dedup ledger, and its line
+			// is shown to the person. Read before the rules, for the drain's
+			// reason, from the drain's root-commit lookup, and inside the
+			// hook's one deadline: the status read below takes what it leaves.
+			away := readPromptAway(cmd.ErrOrStderr(), drained)
 			root := rulesRoot(cwd, cmd.ErrOrStderr())
 			rs, err := rules.Load(root)
 			if err != nil {
@@ -1786,22 +1805,24 @@ and the --json envelope carries the name as session_title.`,
 				// (spc-2610150728396006 step 3).
 				status := routerStatus(cmd, root, deadline)
 				defer status.MarkShown()
+				// Nor does it switch off the away block and line.
+				text := joinBlocks(status.Text, away.Block)
 				// The title owed on this prompt is set even so: naming does
 				// not depend on the rules (hook_session_name.go). The status
 				// block, when there is one, is the context it is set with.
 				if title := resendSessionTitle(cmd, in); title != "" {
 					if *asJSON {
-						return routerEmit(cmd, routerView{Text: status.Text, Injected: []string{}, Recalled: []string{}, Error: err.Error(), SessionTitle: title})
+						return routerEmit(cmd, routerView{Text: text, Injected: []string{}, Recalled: []string{}, Error: err.Error(), SessionTitle: title, SystemMessage: away.Message})
 					}
-					emitTitled(cmd, status.Text, title)
+					emitPrompt(cmd, text, title, away.Message)
 					return nil
 				}
-				if status.Text != "" && !*asJSON {
-					fmt.Fprint(cmd.OutOrStdout(), status.Text)
+				if (text != "" || away.Message != "") && !*asJSON {
+					emitPrompt(cmd, text, "", away.Message)
 					return nil
 				}
-				if status.Text != "" {
-					return routerEmit(cmd, routerView{Text: status.Text, Injected: []string{}, Recalled: []string{}, Error: err.Error()})
+				if text != "" || away.Message != "" {
+					return routerEmit(cmd, routerView{Text: text, Injected: []string{}, Recalled: []string{}, Error: err.Error(), SystemMessage: away.Message})
 				}
 				return routerRefused(cmd, *asJSON, err.Error())
 			}
@@ -1851,6 +1872,7 @@ and the --json envelope carries the name as session_title.`,
 			status := routerStatus(cmd, root, deadline)
 			defer status.MarkShown()
 			text = joinBlocks(text, status.Text)
+			text = joinBlocks(text, away.Block)
 			// The name this session's start reserved, set once at its first
 			// prompt (hook_session_name.go).
 			title := resendSessionTitle(cmd, in)
@@ -1863,15 +1885,9 @@ and the --json envelope carries the name as session_title.`,
 				if recalled == nil {
 					recalled = []string{}
 				}
-				return routerEmit(cmd, routerView{Text: text, Injected: injected, Recalled: recalled, Active: &res.Active, SessionTitle: title})
-			}
-			if title != "" {
-				emitTitled(cmd, text, title)
-				return nil
-			}
-			if text != "" {
-				fmt.Fprint(cmd.OutOrStdout(), text)
+				return routerEmit(cmd, routerView{Text: text, Injected: injected, Recalled: recalled, Active: &res.Active, SessionTitle: title, SystemMessage: away.Message})
 			}
+			emitPrompt(cmd, text, title, away.Message)
 			return nil
 		},
 	})
@@ -2071,6 +2087,12 @@ and the --json envelope carries the name as session_title.`,
 			// name the first prompt sets, and writes nothing to stdout
 			// (hook_session_name.go).
 			startSessionName(cmd, in, cwd)
+			// The away block, on every source, compaction included, and the
+			// session's start copy noted (spc-2610180914469489 step 2). The
+			// block is the home store's own words, never a tracked file's.
+			if block := sessionStartAway(cmd.ErrOrStderr(), in, cwd); block != "" {
+				fmt.Fprint(cmd.OutOrStdout(), block)
+			}
 			var notices []string
 			// currentSHA is remembered so the cross-repository survey below can
 			// leave this repository out: the drain reports it entry by entry,
diff --git a/internal/surface/cli/hook_away.go b/internal/surface/cli/hook_away.go
new file mode 100644
index 0000000000..d0b8bb47f5
--- /dev/null
+++ b/internal/surface/cli/hook_away.go
@@ -0,0 +1,191 @@
+package cli
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/core/autonomy"
+	"github.com/intentdriven/abcd/internal/fsutil"
+	"github.com/intentdriven/abcd/internal/gitutil"
+	"github.com/intentdriven/abcd/internal/termsafe"
+	"github.com/spf13/cobra"
+)
+
+// hook_away.go — the away record repeated to the agent and shown to the
+// person (spc-2610180914469489 step 2). The session-start hook, on every
+// source (`compact` included), and the prompt hook, on every prompt and
+// outside the rules loader's dedup ledger, add the away block to the agent's
+// context while the record holds; the prompt hook also shows the person one
+// line (a systemMessage) saying so, or, once the window has lapsed unclosed
+// with anything unread, one line naming `abcd mode back`.
+//
+// The block's words come from the away record, which lives in the away store
+// under the home folder (owner-only, checked as rules.json is), never from a
+// tracked file, and every interpolated value is cleaned to one line.
+
+// awayPersonOnlyActs is the list of acts only the person may approve, which
+// the away block repeats (spc-2610180914469489, "The question reroute").
+var awayPersonOnlyActs = []string{
+	"an approval or ruling the repository binds to the person per act: an embargo close's `--approve <digest>` (passed only after the person, in this session, has read the text and said yes), the embargo triage verdict, the drain's hand-back, the confirmed apply verb for remote configuration, and a release sign-off (a cut, or a step of one, that asks for the person by name or that no standing instruction of theirs allows; a standing permission for automatic cuts stands, and the away mode adds none)",
+	"pushing, opening or merging a pull request without a standing instruction of the person's that allows it; the away mode is never that instruction",
+	"publishing anything, changing a repository's visibility, or posting a comment or message outward, other than a pull request a standing instruction allows",
+	"adding a dependency",
+	"a secret, a credential or an App",
+	"a step only a website or a browser can do",
+	"a destructive act: deleting what the session did not create, overwriting uncommitted work, a force push, discarding a peer's work",
+	"anything that spends money",
+	"any other act a command page or a brief invariant names as the person's",
+}
+
+// awayBlock is the agent-facing block for a record that holds.
+func awayBlock(rec *autonomy.Record) string {
+	var b strings.Builder
+	b.WriteString("## AWAY\n\n")
+	for _, l := range rec.Terms() {
+		b.WriteString(l + "\n")
+	}
+	b.WriteString("\nThe mode is never permission for anything. While it holds, a turn's end is checked: while work is owed the session keeps working, and it waits only with a scheduled wake that fires soon enough.\n\n")
+	b.WriteString("Never ask the person a question while they are away. Decide it and record it with `abcd decide` (its grounds and how to reverse it); or, when only the person may approve the act, queue it with `abcd mode queue \"<step>\"` and carry on with other work meanwhile. Acts only the person may approve:\n\n")
+	for _, a := range awayPersonOnlyActs {
+		b.WriteString("- " + a + "\n")
+	}
+	b.WriteString("\nRun `abcd mode back` only on the person's word in this session.\n")
+	return b.String()
+}
+
+// awayView is what the away record adds to one prompt: the block for the
+// agent and the line for the person, either possibly empty.
+type awayView struct {
+	Block   string
+	Message string
+}
+
+// readPromptAway reads the away record for the repository whose root commit
+// the live drain already looked up for this prompt, so the router still makes
+// one root-commit lookup a prompt. It fails open: a record that cannot be read
+// safely is named on stderr and adds nothing; with no root commit (outside a
+// checkout, or git not answering in time) it adds nothing silently.
+func readPromptAway(stderr io.Writer, drained rootLookup) awayView {
+	if !drained.asked || drained.err != nil || drained.sha == "" {
+		return awayView{}
+	}
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return awayView{}
+	}
+	st, err := autonomy.StoreAt(home, drained.sha)
+	if err != nil {
+		return awayView{}
+	}
+	now := time.Now()
+	rec, holds, err := st.Away(now)
+	if err != nil {
+		diagnosticLine(stderr, "abcd mode: %s; read as not away", fsutil.RedactHome(err.Error()))
+		return awayView{}
+	}
+	switch {
+	case holds:
+		return awayView{Block: awayBlock(rec), Message: rec.PersonLine()}
+	case rec.Lapsed(now):
+		return awayView{Message: rec.LapsedLine()}
+	}
+	return awayView{}
+}
+
+// readAwayFailOpen is the hooks' read of the away record: ok false when there
+// is nothing to read here (no checkout, no root commit, no home) or the
+// record failed the store's checks, which is named on stderr.
+func readAwayFailOpen(stderr io.Writer, cwd string) (*autonomy.Record, bool, bool) {
+	if cwd == "" {
+		return nil, false, false
+	}
+	_, st, err := autonomy.Resolve(cwd, autonomy.Options{})
+	if err != nil {
+		return nil, false, false
+	}
+	rec, holds, err := st.Away(time.Now())
+	if err != nil {
+		diagnosticLine(stderr, "abcd mode: %s; read as not away", fsutil.RedactHome(err.Error()))
+		return nil, false, false
+	}
+	return rec, holds, true
+}
+
+// sessionStartAway notes the session's start copy and returns the away block
+// when the record holds. The note is written only in a checkout abcd manages
+// (one with `.abcd/` at its root), and only the first time for a session, so
+// a compaction or resume run from a worktree the session made keeps the start.
+func sessionStartAway(stderr io.Writer, in hookInput, cwd string) string {
+	if cwd == "" {
+		return ""
+	}
+	root, err := gitutil.CheckoutRoot(cwd, autonomy.StoreName)
+	if err != nil {
+		return ""
+	}
+	if fi, err := os.Lstat(filepath.Join(root, ".abcd")); err == nil && fi.IsDir() && autonomy.ValidSessionID(in.SessionID) {
+		if _, st, err := autonomy.Resolve(root, autonomy.Options{}); err == nil {
+			if _, err := st.NoteSessionCopy(in.SessionID, root, time.Now()); err != nil {
+				diagnosticLine(stderr, "abcd mode: the session's start copy was not noted (%s)", fsutil.RedactHome(err.Error()))
+			}
+		}
+	}
+	rec, holds, ok := readAwayFailOpen(stderr, root)
+	if !ok || !holds {
+		return ""
+	}
+	return awayBlock(rec)
+}
+
+// promptOutput is the prompt hook's object when it shows the person a line:
+// systemMessage for the person, the additional context for the agent, and
+// the session's title when this prompt sets it.
+type promptOutput struct {
+	SystemMessage      string             `json:"systemMessage,omitempty"`
+	HookSpecificOutput promptOutputFields `json:"hookSpecificOutput"`
+}
+
+type promptOutputFields struct {
+	HookEventName     string `json:"hookEventName"`
+	AdditionalContext string `json:"additionalContext"`
+	SessionTitle      string `json:"sessionTitle,omitempty"`
+}
+
+// emitPrompt writes the prompt hook's plain output: the text alone when there
+// is no title and no line for the person, the titled object when only a title
+// is owed, and otherwise one object carrying the person's line beside the
+// context (and the title). A write that fails is named on stderr; the hook
+// still exits 0.
+func emitPrompt(cmd *cobra.Command, text, title, message string) {
+	switch {
+	case message == "" && title == "":
+		if text != "" {
+			io.WriteString(cmd.OutOrStdout(), text)
+		}
+		return
+	case message == "":
+		emitTitled(cmd, text, title)
+		return
+	}
+	var b bytes.Buffer
+	enc := json.NewEncoder(&b)
+	enc.SetEscapeHTML(false)
+	err := enc.Encode(promptOutput{
+		SystemMessage: termsafe.CleanProseLine(message, 1024),
+		HookSpecificOutput: promptOutputFields{
+			HookEventName: "UserPromptSubmit", AdditionalContext: text, SessionTitle: title,
+		},
+	})
+	if err == nil {
+		_, err = io.Copy(cmd.OutOrStdout(), &b)
+	}
+	if err != nil && !errors.Is(err, io.EOF) {
+		diagnosticLine(cmd.ErrOrStderr(), "abcd mode: the prompt hook's output was not written (%s)", err.Error())
+	}
+}
diff --git a/internal/surface/cli/hook_away_test.go b/internal/surface/cli/hook_away_test.go
new file mode 100644
index 0000000000..ffb4a2fb67
--- /dev/null
+++ b/internal/surface/cli/hook_away_test.go
@@ -0,0 +1,281 @@
+package cli
+
+import (
+	"encoding/json"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/core/autonomy"
+)
+
+// hook_away_test.go — step 2 of spc-2610180914469489: the away record repeated
+// to the agent at every session start and on every prompt, and the one line
+// the person sees on every prompt.
+
+func awayStartPayload(session, cwd, source string) string {
+	b, _ := json.Marshal(map[string]string{"session_id": session, "cwd": cwd, "source": source, "hook_event_name": "SessionStart"})
+	return string(b)
+}
+
+func awayPromptPayload(session, cwd, prompt string) string {
+	b, _ := json.Marshal(map[string]string{"session_id": session, "cwd": cwd, "prompt": prompt, "hook_event_name": "UserPromptSubmit"})
+	return string(b)
+}
+
+// promptHookOut is the prompt hook's stdout decoded: the plain text when it is
+// not an object, else the object's fields.
+type promptHookOut struct {
+	Plain   string
+	Message string
+	Context string
+}
+
+func decodePromptHook(t *testing.T, stdout string) promptHookOut {
+	t.Helper()
+	trimmed := strings.TrimSpace(stdout)
+	if !strings.HasPrefix(trimmed, "{") {
+		return promptHookOut{Plain: stdout, Context: stdout}
+	}
+	var v struct {
+		SystemMessage      string `json:"systemMessage"`
+		HookSpecificOutput struct {
+			HookEventName     string `json:"hookEventName"`
+			AdditionalContext string `json:"additionalContext"`
+		} `json:"hookSpecificOutput"`
+	}
+	if err := json.Unmarshal([]byte(trimmed), &v); err != nil {
+		t.Fatalf("the prompt hook's stdout is neither plain text nor one object: %v\n%s", err, stdout)
+	}
+	if v.HookSpecificOutput.HookEventName != "" && v.HookSpecificOutput.HookEventName != "UserPromptSubmit" {
+		t.Errorf("hookEventName = %q", v.HookSpecificOutput.HookEventName)
+	}
+	return promptHookOut{Message: v.SystemMessage, Context: v.HookSpecificOutput.AdditionalContext}
+}
+
+func setAway(t *testing.T, args ...string) {
+	t.Helper()
+	if _, stderr, err := runSplit(t, "", append([]string{"mode", "autonomous"}, args...)...); err != nil {
+		t.Fatalf("mode autonomous: %v\n%s", err, stderr)
+	}
+}
+
+// assertAwayBlock checks the away block's load-bearing sentences.
+func assertAwayBlock(t *testing.T, where, text string) {
+	t.Helper()
+	for _, want := range []string{
+		"## AWAY",
+		"grants no rights",
+		"abcd decide",
+		"abcd mode queue",
+		"--approve",
+		"embargo triage verdict",
+		"drain's hand-back",
+		"release sign-off",
+		"without a standing instruction",
+		"adding a dependency",
+		"force push",
+		"spends money",
+		"Run `abcd mode back` only on the person's word in this session",
+	} {
+		if !strings.Contains(text, want) {
+			t.Errorf("%s: the away block misses %q:\n%s", where, want, text)
+		}
+	}
+}
+
+// TestSessionStartAwayBlockEverySource: startup, resume and compact print the
+// away block while the record holds, and nothing of it when it does not.
+func TestSessionStartAwayBlockEverySource(t *testing.T) {
+	root := awayCheckout(t)
+	for _, source := range []string{"startup", "resume", "compact"} {
+		so, _, err := runSplit(t, awayStartPayload("s-"+source, root, source), "hook", "session-start")
+		if err != nil {
+			t.Fatal(err)
+		}
+		if strings.Contains(so, "## AWAY") {
+			t.Errorf("%s while present printed the away block:\n%s", source, so)
+		}
+	}
+	setAway(t, "--until", "09:00")
+	for _, source := range []string{"startup", "resume", "compact"} {
+		so, _, err := runSplit(t, awayStartPayload("s-"+source, root, source), "hook", "session-start")
+		if err != nil {
+			t.Fatal(err)
+		}
+		assertAwayBlock(t, "session-start "+source, so)
+		if !strings.Contains(so, "Alice") {
+			t.Errorf("%s: the block does not name who set it:\n%s", source, so)
+		}
+	}
+	// Ended: nothing again.
+	if _, _, err := runSplit(t, "", "mode", "back"); err != nil {
+		t.Fatal(err)
+	}
+	so, _, _ := runSplit(t, awayStartPayload("s-after", root, "startup"), "hook", "session-start")
+	if strings.Contains(so, "## AWAY") {
+		t.Errorf("after mode back the session start still prints the block:\n%s", so)
+	}
+}
+
+// TestPromptRouterAwayBlockEveryPrompt: the block rides every prompt of a
+// session, the second as well as the first, outside the loader's dedup ledger.
+func TestPromptRouterAwayBlockEveryPrompt(t *testing.T) {
+	root := awayCheckout(t)
+	so, _, _ := runSplit(t, awayPromptPayload("p1", root, "hello"), "hook", "prompt-router")
+	if strings.Contains(so, "## AWAY") {
+		t.Fatalf("present: the prompt carries the away block:\n%s", so)
+	}
+	setAway(t)
+	for i, prompt := range []string{"hello", "and again"} {
+		so, _, err := runSplit(t, awayPromptPayload("p1", root, prompt), "hook", "prompt-router")
+		if err != nil {
+			t.Fatal(err)
+		}
+		out := decodePromptHook(t, so)
+		assertAwayBlock(t, "prompt "+string(rune('1'+i)), out.Context)
+	}
+	// The --json envelope carries it in text too.
+	so, _, _ = runSplit(t, awayPromptPayload("p1", root, "third"), "hook", "prompt-router", "--json")
+	var v routerView
+	if err := json.Unmarshal([]byte(so), &v); err != nil {
+		t.Fatalf("--json: %v\n%s", err, so)
+	}
+	assertAwayBlock(t, "--json text", v.Text)
+	if !strings.Contains(v.SystemMessage, "abcd mode back") {
+		t.Errorf("--json system_message = %q", v.SystemMessage)
+	}
+}
+
+// TestPromptRouterAwaySystemMessage: one line the person sees on every prompt
+// while the record holds: who set it, from which copy, the counts of queued
+// steps and handed-back items, and the literal `abcd mode back`.
+func TestPromptRouterAwaySystemMessage(t *testing.T) {
+	root := awayCheckout(t)
+	setAway(t, "--until", "09:00")
+	for _, step := range []string{"push feat/x", "merge #12"} {
+		if _, stderr, err := runSplit(t, "", "mode", "queue", step); err != nil {
+			t.Fatalf("mode queue: %v\n%s", err, stderr)
+		}
+	}
+	if _, err := awayStore(t, root).RecordHandBack("feat/x", strings.Repeat("a", 40), time.Now()); err != nil {
+		t.Fatal(err)
+	}
+	for _, prompt := range []string{"one", "two"} {
+		so, _, err := runSplit(t, awayPromptPayload("m1", root, prompt), "hook", "prompt-router")
+		if err != nil {
+			t.Fatal(err)
+		}
+		msg := decodePromptHook(t, so).Message
+		for _, want := range []string{"Alice", "2 steps queued", "1 item handed back", "`abcd mode back`", "away until"} {
+			if !strings.Contains(msg, want) {
+				t.Errorf("prompt %q: the person's line misses %q: %q", prompt, want, msg)
+			}
+		}
+		if strings.Contains(msg, "\n") {
+			t.Errorf("the person's line is more than one line: %q", msg)
+		}
+		if !strings.Contains(msg, filepathBase(root)) {
+			t.Errorf("the person's line does not name the copy: %q", msg)
+		}
+	}
+}
+
+func filepathBase(p string) string { return filepath.Base(p) }
+
+// TestSessionStartNotesCopy: the session's start worktree is noted per session
+// id, and a later read from a worktree the session made resolves to the start
+// copy; a session with no note resolves to its own worktree.
+func TestSessionStartNotesCopy(t *testing.T) {
+	root := awayCheckout(t)
+	if _, _, err := runSplit(t, awayStartPayload("note-1", root, "startup"), "hook", "session-start"); err != nil {
+		t.Fatal(err)
+	}
+	made := filepath.Join(t.TempDir(), "made")
+	gitAt(t, root, "worktree", "add", "-q", "-b", "feat/made", made)
+	made = realPath(t, made)
+
+	got, _, err := autonomy.ResolveCopy(made, "note-1", autonomy.Options{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != root {
+		t.Errorf("a hook run from the made worktree resolves to %s, want the start copy %s", got, root)
+	}
+	// A compaction from the made worktree keeps the first note.
+	if _, _, err := runSplit(t, awayStartPayload("note-1", made, "compact"), "hook", "session-start"); err != nil {
+		t.Fatal(err)
+	}
+	if got, _, _ := autonomy.ResolveCopy(made, "note-1", autonomy.Options{}); got != root {
+		t.Errorf("after a compaction from the made worktree the session resolves to %s, want %s", got, root)
+	}
+	// No note: the payload's own worktree.
+	if got, _, _ := autonomy.ResolveCopy(made, "never-started", autonomy.Options{}); got != made {
+		t.Errorf("a session with no note resolves to %s, want its own worktree %s", got, made)
+	}
+}
+
+// TestPromptRouterLapsedWindowLine: a lapsed, unclosed record with a queued
+// step or a recorded stop shows the person one line naming `abcd mode back`
+// on every prompt until that verb closes it; one with neither shows nothing.
+func TestPromptRouterLapsedWindowLine(t *testing.T) {
+	root := awayCheckout(t)
+	st := awayStore(t, root)
+	lapse := func(queue, stop bool) {
+		t.Helper()
+		past := time.Now().Add(-3 * time.Hour)
+		if _, err := st.Update(func(*autonomy.Record) (*autonomy.Record, error) {
+			r, err := autonomy.Begin(nil, autonomy.Who{Name: "Alice", Copy: root}, past, past.Add(time.Hour), false)
+			if err != nil {
+				return nil, err
+			}
+			if queue {
+				_ = r.AddStep("push feat/x", root, past)
+			}
+			if stop {
+				r.AddStop(autonomy.Stop{Kind: autonomy.StopWorkOwed, Detail: "behind #12"}, past)
+			}
+			return r, nil
+		}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, c := range []struct {
+		name        string
+		queue, stop bool
+		want        bool
+	}{
+		{"queued step", true, false, true},
+		{"recorded stop", false, true, true},
+		{"neither", false, false, false},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			lapse(c.queue, c.stop)
+			for _, prompt := range []string{"one", "two"} {
+				so, _, _ := runSplit(t, awayPromptPayload("l1", root, prompt), "hook", "prompt-router")
+				out := decodePromptHook(t, so)
+				if strings.Contains(out.Context, "## AWAY") {
+					t.Errorf("a lapsed record still sends the away block:\n%s", out.Context)
+				}
+				has := strings.Contains(out.Message, "`abcd mode back`")
+				if has != c.want {
+					t.Errorf("prompt %q: lapsed line shown=%v, want %v: %q", prompt, has, c.want, out.Message)
+				}
+				if c.want && strings.Contains(out.Message, "\n") {
+					t.Errorf("the lapsed line is more than one line: %q", out.Message)
+				}
+			}
+			if !c.want {
+				return
+			}
+			if _, _, err := runSplit(t, "", "mode", "back"); err != nil {
+				t.Fatal(err)
+			}
+			so, _, _ := runSplit(t, awayPromptPayload("l1", root, "after"), "hook", "prompt-router")
+			if msg := decodePromptHook(t, so).Message; msg != "" {
+				t.Errorf("after mode back the lapsed line still shows: %q", msg)
+			}
+		})
+	}
+}

From 710b9626ba07debc4e9c7e3f73eedaf81221b9f2 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 12:53:04 +0100
Subject: [PATCH 14/58] feat: record the branches a session creates, for the
 away mode's own-branch reading

The guard's pre-tool hook reads each shell command for the branches it
creates (git worktree add -b|-B, git switch -c|-C, git checkout -b|-B,
git branch <b>, a bare git worktree add, git worktree add on an existing
branch) and carries a record across git branch -m|-M, before the guard
judges it. A created name is kept only when no branch of that name exists;
names match whole. The list is per working copy, keyed on the copy key, in
the away store, written under the store's lock, capped at the hundred most
recent. It records whether or not the person is away and refuses nothing:
a store it cannot write leaves one stderr line.

Refs: itd-2610180912189125
Assisted-by: Claude:claude-opus-5-5
---
 .../development/brief/04-surfaces/17-guard.md |  30 +-
 .abcd/development/release/surface.json        |   4 +-
 commands/guard.md                             |  21 +-
 docs/reference/cli/commands.md                |   4 +-
 internal/core/autonomy/branches.go            | 216 ++++++++++++++
 internal/core/autonomy/branches_test.go       | 100 +++++++
 internal/core/guard/branchacts.go             | 270 ++++++++++++++++++
 internal/core/guard/branchacts_test.go        |  55 ++++
 internal/core/guard/unknownsites_test.go      |   9 +
 internal/core/surface/sentences.go            |   4 +-
 internal/surface/cli/guard.go                 |   4 +
 internal/surface/cli/guard_branches.go        |  64 +++++
 internal/surface/cli/guard_branches_test.go   | 130 +++++++++
 13 files changed, 900 insertions(+), 11 deletions(-)
 create mode 100644 internal/core/autonomy/branches.go
 create mode 100644 internal/core/autonomy/branches_test.go
 create mode 100644 internal/core/guard/branchacts.go
 create mode 100644 internal/core/guard/branchacts_test.go
 create mode 100644 internal/surface/cli/guard_branches.go
 create mode 100644 internal/surface/cli/guard_branches_test.go

diff --git a/.abcd/development/brief/04-surfaces/17-guard.md b/.abcd/development/brief/04-surfaces/17-guard.md
index 420fef1656..4fce549196 100644
--- a/.abcd/development/brief/04-surfaces/17-guard.md
+++ b/.abcd/development/brief/04-surfaces/17-guard.md
@@ -3,8 +3,9 @@
 A destructive shell command typed by accident costs a person hours: a force
 push that erases a colleague's commits, an `rm -rf` with an unlucky glob, a
 `git clean` over uncommitted work. `/abcd:guard` catches those before they run
-and says what to run instead. It writes nothing, and it costs nothing to have
-on: an unrecognised command passes through untouched.
+and says what to run instead. It writes nothing but the record of a branch an
+agent creates (below), and it costs nothing to have on: an unrecognised command
+passes through untouched.
 
 Two things use it. A person or a script asks it about one command line. A
 compatible agent harness asks it about every command the agent is about to run,
@@ -206,6 +207,31 @@ them, is not a decision: the question runs and the hook says so on exit 1, the
 same fail-open-loud contract below. The manifest's pre-tool-use matcher names the
 shell tool and the question tool, and nothing else.
 
+## The created-branch recorder
+
+The pre-tool-use hook also records each branch a shell command creates, for
+the away mode's reading of the session's own branches (itd-2610180912189125,
+spc-2610180914469489 step 3). The stacked drain branches of 2026-10-17 were cut
+with a plain `git worktree add` and left no upstream, no entry in the
+coordinating copy's reflog, no run state and no record id, so nothing else could
+tell they were the session's. Before the guard judges the command, the hook
+reads it for `git worktree add -b|-B <b>`, `git switch -c|-C <b>`, `git checkout
+-b|-B <b>` and `git branch <b>` (each recorded only when no branch of that name
+exists yet), a bare `git worktree add <path>` (the branch git names after the
+folder) and `git worktree add <path> <branch>`, and `git branch -m|-M <old>
+<new>`, which carries a record from the old name to the new. Branch names match
+as whole names, so `feat/x` never stands for `feat/x2`. A word a substitution
+or a variable prints is read as no branch.
+
+The record is kept whether or not the person is away, under the working copy's
+key (the reservations' copy key) in the away store, `~/.abcd.noindex/away/<root-sha>/`,
+written under the store's lock through its atomic writer, in a list capped at
+the hundred most recent, the oldest dropped. The recorder records and **refuses
+nothing**: a store it cannot write leaves one stderr line and the command goes
+on to the guard's own judgement, and a checkout without the local tier records
+nothing. A record made for a command that then fails names a branch that does
+not exist, and the away mode's reading ignores it.
+
 ## Fail-open-loud
 
 A broken guard never bricks a session and never silently stops protecting one.
diff --git a/.abcd/development/release/surface.json b/.abcd/development/release/surface.json
index 81d8d7d9b8..95da70943e 100644
--- a/.abcd/development/release/surface.json
+++ b/.abcd/development/release/surface.json
@@ -1509,7 +1509,7 @@
       "hidden": false,
       "group": "agents",
       "block": "agents",
-      "sentence": "Judge a shell command against the hazard registry before it runs: Writes nothing; refuses a hazard through check, hook or approve, and an unknown sub-verb.",
+      "sentence": "Judge a shell command against the hazard registry before it runs: Writes branch records; refuses a hazard via check, hook or approve, and an unknown sub-verb.",
       "flags": []
     },
     {
@@ -1559,7 +1559,7 @@
       "path": "abcd guard hook",
       "hidden": false,
       "block": "agents",
-      "sentence": "Judge the shell command in a host's pre-tool-use payload: Writes nothing; refuses a hazard or a badly built question with the host's deny.",
+      "sentence": "Judge the shell command in a host's pre-tool-use payload: Writes a created branch's record; refuses a hazard or a badly built question with the host's deny.",
       "flags": []
     },
     {
diff --git a/commands/guard.md b/commands/guard.md
index 97e9b03634..ea865c2cf0 100644
--- a/commands/guard.md
+++ b/commands/guard.md
@@ -1,6 +1,6 @@
 ---
 name: guard
-description: "Judge a shell command against the hazard registry before it runs: Writes nothing; refuses a hazard through check, hook or approve, and an unknown sub-verb."
+description: "Judge a shell command against the hazard registry before it runs: Writes branch records; refuses a hazard via check, hook or approve, and an unknown sub-verb."
 argument-hint: "[check [--command <command>] | hook | approve --dir <dir>]"
 block: agents
 user-invocable: false
@@ -9,8 +9,9 @@ user-invocable: false
 # `/abcd:guard` shell-hazard check
 
 Decide whether a shell command is safe to run, using abcd's hazard registry —
-the bundled hazard entries merged with this repo's `.abcd/guard.json`. This
-command performs **zero writes**.
+the bundled hazard entries merged with this repo's `.abcd/guard.json`. The
+check performs **zero writes**; the hook writes one thing, the record of a
+branch the session creates (below), and refuses nothing for it.
 
 ## `check` — decide one command
 
@@ -78,6 +79,20 @@ hands it to the agent. A notice the hook printed before it blocked, such as a
 repository guard file that did not load, leads the reason, because the host
 discards the hook's stderr when it exits 0.
 
+Before it judges a shell command, the hook records the branches the command
+creates, for the away mode's reading of which branches are the session's own
+(`/abcd:mode`): `git worktree add -b|-B <b>`, `git switch -c|-C <b>`, `git
+checkout -b|-B <b>` and `git branch <b>`, each only when no branch of that name
+exists yet; a bare `git worktree add <path>`, recorded as the branch git names
+after the folder, and `git worktree add <path> <branch>`; and `git branch
+-m|-M <old> <new>`, which carries a record from the old name to the new. It
+records them whether or not the person is away, under the working copy's key in
+the away store (`~/.abcd.noindex/away/<root-sha>/`), matched by whole name, in a
+list of the hundred most recent. The recorder **refuses nothing**: a store it
+cannot write leaves one stderr line and the command goes on to the check as
+before, and a record made for a command that then fails names a branch that
+does not exist, which the reading ignores.
+
 On the host's question tool the hook checks abcd's own questions instead of
 consulting the registry. A question is abcd's when a header is in abcd's chip
 grammar (a role word, then `Q` and the question's number, such as `Product Q2`)
diff --git a/docs/reference/cli/commands.md b/docs/reference/cli/commands.md
index 3e8a18eda8..c500d65cbd 100644
--- a/docs/reference/cli/commands.md
+++ b/docs/reference/cli/commands.md
@@ -1569,7 +1569,7 @@ abcd embark probe ../lifeboat
 
 ### `abcd guard`
 
-Judge a shell command against the hazard registry before it runs: Writes nothing; refuses a hazard through check, hook or approve, and an unknown sub-verb.
+Judge a shell command against the hazard registry before it runs: Writes branch records; refuses a hazard via check, hook or approve, and an unknown sub-verb.
 
 **Usage:** `abcd guard`
 
@@ -1810,7 +1810,7 @@ heredoc (`abcd guard check <<'EOF'` ... `EOF`) passes it through untouched.
 
 #### `abcd guard hook`
 
-Judge the shell command in a host's pre-tool-use payload: Writes nothing; refuses a hazard or a badly built question with the host's deny.
+Judge the shell command in a host's pre-tool-use payload: Writes a created branch's record; refuses a hazard or a badly built question with the host's deny.
 
 **Usage:** `abcd guard hook`
 
diff --git a/internal/core/autonomy/branches.go b/internal/core/autonomy/branches.go
new file mode 100644
index 0000000000..dd036d4b32
--- /dev/null
+++ b/internal/core/autonomy/branches.go
@@ -0,0 +1,216 @@
+package autonomy
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/core/claim"
+	"github.com/intentdriven/abcd/internal/core/mode"
+	"github.com/intentdriven/abcd/internal/gitutil"
+)
+
+// MaxCreatedBranches bounds a working copy's created-branch list; past it the
+// oldest record is dropped. A hundred names at git's 255-byte limit stay well
+// within the store's 64 KiB per file (spc-2610180914469489 leaves the bound to
+// the builder).
+const MaxCreatedBranches = 100
+
+// createdSchemaVersion is the created-branch list's shape version.
+const createdSchemaVersion = 1
+
+// CreatedFile is the store file holding the branches the working copy whose
+// key is copyKey created.
+func CreatedFile(copyKey string) string { return "branches-" + copyKey + ".json" }
+
+// CreatedBranch is one branch a session in the working copy created, and when
+// it was recorded.
+type CreatedBranch struct {
+	Name string    `json:"name"`
+	At   time.Time `json:"at"`
+}
+
+type createdList struct {
+	SchemaVersion int             `json:"schema_version"`
+	Branches      []CreatedBranch `json:"branches"`
+}
+
+// BranchChangeKind is what a recorded command did to a branch.
+type BranchChangeKind string
+
+const (
+	// BranchCreated is a branch the command creates; RecordCreated keeps it
+	// only when no branch of that name exists yet.
+	BranchCreated BranchChangeKind = "created"
+	// BranchCheckedOut is a branch `git worktree add` checks out in a new
+	// worktree; RecordCreated keeps it when it exists as a branch, or when the
+	// name resolves to nothing at all, so git creates it.
+	BranchCheckedOut BranchChangeKind = "checked-out"
+	// BranchMoved is a rename: a record of From (the current branch of the
+	// command's worktree when "") is carried to Name.
+	BranchMoved BranchChangeKind = "moved"
+)
+
+// BranchChange is one change the created-branch recorder applies.
+type BranchChange struct {
+	Kind BranchChangeKind
+	Name string
+	From string
+}
+
+// CreatedBranches is the created-branch list of the working copy whose key is
+// copyKey, oldest first; empty when none is kept. A list the store's checks
+// refuse, or that does not parse, is ErrUnsafe.
+func (s Store) CreatedBranches(copyKey string) ([]CreatedBranch, error) {
+	raw, err := s.ReadFile(CreatedFile(copyKey))
+	if errors.Is(err, fs.ErrNotExist) && !errors.Is(err, ErrUnsafe) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	var l createdList
+	if err := json.Unmarshal(raw, &l); err != nil || l.SchemaVersion != createdSchemaVersion {
+		return nil, fmt.Errorf("%w: %s does not parse as a created-branch list", ErrUnsafe, s.Display(CreatedFile(copyKey)))
+	}
+	return l.Branches, nil
+}
+
+// RecordBranches applies changes, already judged, to the created-branch list
+// of the working copy whose key is copyKey, under the store's lock and with
+// the list re-read inside it: a created or checked-out name is added once, a
+// rename carries the record whose name is From, whole name to whole name, and
+// the list keeps the newest MaxCreatedBranches.
+func (s Store) RecordBranches(copyKey string, changes []BranchChange, now time.Time) error {
+	if len(changes) == 0 {
+		return nil
+	}
+	now = now.Truncate(time.Second)
+	return s.WithLock(func() error {
+		cur, err := s.CreatedBranches(copyKey)
+		if err != nil {
+			return err
+		}
+		next := applyBranchChanges(cur, changes, now)
+		raw, err := json.MarshalIndent(createdList{SchemaVersion: createdSchemaVersion, Branches: next}, "", "  ")
+		if err != nil {
+			return err
+		}
+		return s.WriteFile(CreatedFile(copyKey), append(raw, '\n'))
+	})
+}
+
+func applyBranchChanges(list []CreatedBranch, changes []BranchChange, now time.Time) []CreatedBranch {
+	index := func(name string) int {
+		for i, b := range list {
+			if b.Name == name {
+				return i
+			}
+		}
+		return -1
+	}
+	for _, c := range changes {
+		switch c.Kind {
+		case BranchCreated, BranchCheckedOut:
+			if c.Name != "" && index(c.Name) < 0 {
+				list = append(list, CreatedBranch{Name: c.Name, At: now})
+			}
+		case BranchMoved:
+			i := index(c.From)
+			if i < 0 || c.Name == "" {
+				continue
+			}
+			if j := index(c.Name); j >= 0 && j != i {
+				list = append(list[:j], list[j+1:]...)
+				i = index(c.From)
+			}
+			list[i].Name = c.Name
+		}
+	}
+	if n := len(list); n > MaxCreatedBranches {
+		list = append([]CreatedBranch(nil), list[n-MaxCreatedBranches:]...)
+	}
+	return list
+}
+
+// RecordCreated is the created-branch recorder the guard's pre-tool hook
+// runs, before the command does, whether or not the person is away: it judges
+// each change against the repository as it stands (a created branch only when
+// no branch of that name exists yet; a checked-out one when it is a branch or
+// names nothing git can resolve) and records what passes under the copy's key
+// (claim.CopyKey, minted as a reservation verb mints it) in the away store.
+// copyRoot is the session's working copy; runDir is where the command runs,
+// whose current branch a rename with no old name renames. A checkout without
+// the local tier, or with no root commit, records nothing and is no error:
+// abcd does not manage it. The error is a store the recorder could not write;
+// it never refuses the command.
+func RecordCreated(copyRoot, runDir string, changes []BranchChange, o Options) error {
+	if len(changes) == 0 {
+		return nil
+	}
+	if fi, err := os.Lstat(filepath.Join(copyRoot, filepath.FromSlash(mode.TierRelPath))); err != nil || !fi.IsDir() {
+		return nil
+	}
+	home, err := o.home()
+	if err != nil {
+		return err
+	}
+	st, err := OpenStore(home, copyRoot)
+	if errors.Is(err, ErrNoRootCommit) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	var keep []BranchChange
+	for _, c := range changes {
+		switch c.Kind {
+		case BranchCreated:
+			if !branchExists(copyRoot, c.Name) {
+				keep = append(keep, c)
+			}
+		case BranchCheckedOut:
+			if branchExists(copyRoot, c.Name) || !resolves(copyRoot, c.Name) {
+				keep = append(keep, c)
+			}
+		case BranchMoved:
+			if c.From == "" {
+				cur, err := gitutil.Run(runDir, "symbolic-ref", "--quiet", "--short", "HEAD")
+				if err != nil || cur == "" {
+					continue
+				}
+				c.From = cur
+			}
+			keep = append(keep, c)
+		}
+	}
+	if len(keep) == 0 {
+		return nil
+	}
+	key, err := claim.CopyKey(copyRoot)
+	if err != nil {
+		return err
+	}
+	return st.RecordBranches(key, keep, o.now())
+}
+
+// branchExists reports whether refs/heads/name names a commit in the
+// repository at root.
+func branchExists(root, name string) bool {
+	if name == "" {
+		return false
+	}
+	_, err := gitutil.Run(root, "rev-parse", "--verify", "--quiet", "refs/heads/"+name+"^{commit}")
+	return err == nil
+}
+
+// resolves reports whether name resolves to a commit by any of git's rules
+// (a tag, a remote-tracking ref, an object name).
+func resolves(root, name string) bool {
+	_, err := gitutil.Run(root, "rev-parse", "--verify", "--quiet", "--end-of-options", name+"^{commit}")
+	return err == nil
+}
diff --git a/internal/core/autonomy/branches_test.go b/internal/core/autonomy/branches_test.go
new file mode 100644
index 0000000000..5f4f28e3c0
--- /dev/null
+++ b/internal/core/autonomy/branches_test.go
@@ -0,0 +1,100 @@
+package autonomy
+
+import (
+	"fmt"
+	"sync"
+	"testing"
+	"time"
+)
+
+const testCopyKey = "0123456789abcdef0123456789abcdef"
+
+func testStore(t *testing.T) Store {
+	t.Helper()
+	root, home := managedCopy(t)
+	st, err := OpenStore(home, root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return st
+}
+
+func names(bs []CreatedBranch) []string {
+	out := make([]string, len(bs))
+	for i, b := range bs {
+		out[i] = b.Name
+	}
+	return out
+}
+
+// TestBranchRecorderUnderLock: recordings racing each other keep every
+// branch, since each re-reads the list inside the store's lock.
+func TestBranchRecorderUnderLock(t *testing.T) {
+	st := testStore(t)
+	now := time.Now()
+	const n = 8
+	var wg sync.WaitGroup
+	errs := make(chan error, n)
+	for i := range n {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			errs <- st.RecordBranches(testCopyKey, []BranchChange{{Kind: BranchCreated, Name: fmt.Sprintf("feat/r%d", i)}}, now)
+		}()
+	}
+	wg.Wait()
+	close(errs)
+	for err := range errs {
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	got, err := st.CreatedBranches(testCopyKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != n {
+		t.Fatalf("racing recordings kept %d branches, want %d: %v", len(got), n, names(got))
+	}
+}
+
+// TestCreatedBranchesCapped: the list keeps at most MaxCreatedBranches, the
+// oldest dropped; a name already kept is not kept twice; a rename carries a
+// record by whole name only; and another copy's key keeps its own list.
+func TestCreatedBranchesCapped(t *testing.T) {
+	st := testStore(t)
+	now := time.Now()
+	for i := range MaxCreatedBranches + 5 {
+		if err := st.RecordBranches(testCopyKey, []BranchChange{{Kind: BranchCreated, Name: fmt.Sprintf("feat/c%03d", i)}}, now.Add(time.Duration(i)*time.Second)); err != nil {
+			t.Fatal(err)
+		}
+	}
+	got, err := st.CreatedBranches(testCopyKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != MaxCreatedBranches || got[0].Name != "feat/c005" {
+		t.Fatalf("the list holds %d, first %q; want %d, first feat/c005", len(got), got[0].Name, MaxCreatedBranches)
+	}
+	if err := st.RecordBranches(testCopyKey, []BranchChange{{Kind: BranchCreated, Name: "feat/c010"}}, now); err != nil {
+		t.Fatal(err)
+	}
+	if got, _ = st.CreatedBranches(testCopyKey); len(got) != MaxCreatedBranches {
+		t.Fatalf("a name already kept was kept again: %d", len(got))
+	}
+	if err := st.RecordBranches(testCopyKey, []BranchChange{{Kind: BranchMoved, From: "feat/c01", Name: "feat/x"}, {Kind: BranchMoved, From: "feat/c011", Name: "feat/c011b"}}, now); err != nil {
+		t.Fatal(err)
+	}
+	got, _ = st.CreatedBranches(testCopyKey)
+	have := map[string]bool{}
+	for _, n := range names(got) {
+		have[n] = true
+	}
+	if have["feat/x"] || !have["feat/c011b"] || have["feat/c011"] {
+		t.Fatalf("a rename must carry a record by its whole name only: %v", names(got))
+	}
+	other, err := st.CreatedBranches("fedcba9876543210fedcba9876543210")
+	if err != nil || len(other) != 0 {
+		t.Fatalf("another copy's list must be its own: %v %v", other, err)
+	}
+}
diff --git a/internal/core/guard/branchacts.go b/internal/core/guard/branchacts.go
new file mode 100644
index 0000000000..afccb569f8
--- /dev/null
+++ b/internal/core/guard/branchacts.go
@@ -0,0 +1,270 @@
+package guard
+
+import (
+	"path"
+	"strings"
+)
+
+// BranchActKind is what a git command does to the branch a BranchAct names.
+type BranchActKind string
+
+const (
+	// BranchCreate is a branch the command creates: `git worktree add
+	// -b|-B <b>`, `git switch -c|-C <b>`, `git checkout -b|-B <b>`, `git
+	// branch <b>` and `git branch -c|-C [<old>] <b>`. The recorder keeps it
+	// only when no branch of that name exists yet.
+	BranchCreate BranchActKind = "create"
+	// BranchCheckout is a branch `git worktree add` checks out in a new
+	// worktree, creating it when it does not exist: a bare `git worktree add
+	// <path>` names the branch after the folder, and `git worktree add <path>
+	// <commit-ish>` names the commit-ish.
+	BranchCheckout BranchActKind = "checkout"
+	// BranchRename is `git branch -m|-M [<old>] <new>`: a record of <old>
+	// (the current branch when From is "") is carried to <new>.
+	BranchRename BranchActKind = "rename"
+)
+
+// BranchAct is one branch a shell command creates, checks out into a new
+// worktree or renames, as the created-branch recorder of the away mode reads
+// it (spc-2610180914469489 step 3). It is a reading of the command line only:
+// whether the branch exists is the recorder's question.
+type BranchAct struct {
+	Kind BranchActKind
+	// Name is the branch the act leaves: the one created, checked out, or
+	// renamed to.
+	Name string
+	// From is a rename's old name, "" for the current branch.
+	From string
+}
+
+// BranchActs reads command for the branches it creates, checks out into a new
+// worktree or renames, in the order written. It refuses nothing and decides
+// nothing: a line the tokenizer cannot split, and a word a substitution or a
+// variable prints, are read as no act at all.
+func BranchActs(command string) []BranchAct {
+	segs, err := tokenize(command)
+	if err != nil {
+		return nil
+	}
+	var out []BranchAct
+	for _, s := range segs {
+		out = append(out, branchActsIn(s.tokens)...)
+	}
+	return out
+}
+
+// gitValueOptions are git's global options that take their value as the next
+// word.
+var gitValueOptions = map[string]bool{
+	"-C": true, "-c": true, "--git-dir": true, "--work-tree": true,
+	"--namespace": true, "--config-env": true, "--super-prefix": true,
+}
+
+func branchActsIn(toks []string) []BranchAct {
+	// A word nothing fixes (a substitution's output, a variable's value)
+	// makes the whole command no act: the recorder only records, and a
+	// branch it cannot name is one it does not record.
+	for _, w := range toks {
+		if isUnknown(w) {
+			return nil
+		}
+	}
+	for len(toks) > 0 && isAssignmentWord(toks[0]) {
+		toks = toks[1:]
+	}
+	if len(toks) == 0 || path.Base(toks[0]) != "git" {
+		return nil
+	}
+	i := 1
+	for i < len(toks) && strings.HasPrefix(toks[i], "-") {
+		if gitValueOptions[toks[i]] {
+			i++
+		}
+		i++
+	}
+	if i >= len(toks) {
+		return nil
+	}
+	sub, args := toks[i], toks[i+1:]
+	switch sub {
+	case "worktree":
+		if len(args) > 0 && args[0] == "add" {
+			return worktreeAddActs(args[1:])
+		}
+	case "switch":
+		return createFlagActs(args, []string{"-c", "-C", "--create", "--force-create"})
+	case "checkout":
+		return createFlagActs(args, []string{"-b", "-B"})
+	case "branch":
+		return branchCommandActs(args)
+	}
+	return nil
+}
+
+// isAssignmentWord is a NAME=value word in command position.
+func isAssignmentWord(w string) bool {
+	eq := strings.IndexByte(w, '=')
+	if eq <= 0 {
+		return false
+	}
+	for j, r := range w[:eq] {
+		if !(r == '_' || r >= 'A' && r <= 'Z' || r >= 'a' && r <= 'z' || j > 0 && r >= '0' && r <= '9') {
+			return false
+		}
+	}
+	return true
+}
+
+// flagValue reads a value-taking option at args[i] spelled one of names:
+// separate (`-b x`), glued to a short name (`-bx`) or after `=` for a long one
+// (`--create=x`). It returns the value and the index of the last word used.
+func flagValue(args []string, i int, names []string) (string, int, bool) {
+	a := args[i]
+	for _, n := range names {
+		switch {
+		case a == n:
+			if i+1 < len(args) {
+				return args[i+1], i + 1, true
+			}
+			return "", i, false
+		case strings.HasPrefix(n, "--") && strings.HasPrefix(a, n+"="):
+			return a[len(n)+1:], i, true
+		case !strings.HasPrefix(n, "--") && len(a) > len(n) && strings.HasPrefix(a, n):
+			return a[len(n):], i, true
+		}
+	}
+	return "", i, false
+}
+
+// createFlagActs is `git switch` or `git checkout`: a branch only when one of
+// the create options names it.
+func createFlagActs(args []string, names []string) []BranchAct {
+	for i := 0; i < len(args); i++ {
+		if args[i] == "--" {
+			return nil
+		}
+		if v, _, ok := flagValue(args, i, names); ok {
+			if plausibleBranch(v) {
+				return []BranchAct{{Kind: BranchCreate, Name: v}}
+			}
+			return nil
+		}
+	}
+	return nil
+}
+
+// worktreeAddValueOptions are `git worktree add`'s options that take the next
+// word, beside -b and -B.
+var worktreeAddValueOptions = map[string]bool{"--reason": true}
+
+func worktreeAddActs(args []string) []BranchAct {
+	var operands []string
+	created := ""
+	for i := 0; i < len(args); i++ {
+		a := args[i]
+		if a == "--" {
+			operands = append(operands, args[i+1:]...)
+			break
+		}
+		if v, j, ok := flagValue(args, i, []string{"-b", "-B"}); ok {
+			created, i = v, j
+			continue
+		}
+		switch {
+		case a == "-d" || a == "--detach" || a == "--orphan":
+			return nil
+		case worktreeAddValueOptions[a]:
+			i++
+		case strings.HasPrefix(a, "-"):
+		default:
+			operands = append(operands, a)
+		}
+	}
+	if created != "" {
+		if plausibleBranch(created) {
+			return []BranchAct{{Kind: BranchCreate, Name: created}}
+		}
+		return nil
+	}
+	var name string
+	switch len(operands) {
+	case 1:
+		name = path.Base(strings.TrimRight(operands[0], "/"))
+	case 2:
+		name = operands[1]
+	default:
+		return nil
+	}
+	if !plausibleBranch(name) {
+		return nil
+	}
+	return []BranchAct{{Kind: BranchCheckout, Name: name}}
+}
+
+// branchPassOptions are `git branch` options a creation may carry; any other
+// option makes the command something else (a listing, a delete, an upstream).
+var branchPassOptions = map[string]bool{
+	"-f": true, "--force": true, "-t": true, "--track": true, "--no-track": true,
+	"-q": true, "--quiet": true, "--create-reflog": true,
+	"--recurse-submodules": true, "--no-recurse-submodules": true,
+}
+
+func branchCommandActs(args []string) []BranchAct {
+	var operands []string
+	move, copyOp := false, false
+	for i, a := range args {
+		if a == "--" {
+			operands = append(operands, args[i+1:]...)
+			break
+		}
+		switch {
+		case a == "-m" || a == "-M" || a == "--move":
+			move = true
+		case a == "-c" || a == "-C" || a == "--copy":
+			copyOp = true
+		case branchPassOptions[a] || strings.HasPrefix(a, "--track="):
+		case strings.HasPrefix(a, "-"):
+			return nil
+		default:
+			operands = append(operands, a)
+		}
+	}
+	for _, o := range operands {
+		if !plausibleBranch(o) {
+			return nil
+		}
+	}
+	switch {
+	case move && copyOp:
+		return nil
+	case move && len(operands) == 1:
+		return []BranchAct{{Kind: BranchRename, Name: operands[0]}}
+	case move && len(operands) == 2:
+		return []BranchAct{{Kind: BranchRename, From: operands[0], Name: operands[1]}}
+	case copyOp && len(operands) == 1:
+		return []BranchAct{{Kind: BranchCreate, Name: operands[0]}}
+	case copyOp && len(operands) == 2:
+		return []BranchAct{{Kind: BranchCreate, Name: operands[1]}}
+	case move || copyOp:
+		return nil
+	case len(operands) == 1 || len(operands) == 2:
+		return []BranchAct{{Kind: BranchCreate, Name: operands[0]}}
+	}
+	return nil
+}
+
+// plausibleBranch is a word that can name a branch: not empty, not an option,
+// at most 255 bytes, with no whitespace, control character, `..`, or any of
+// the characters git refuses in a ref name.
+func plausibleBranch(b string) bool {
+	if b == "" || len(b) > 255 || strings.HasPrefix(b, "-") || strings.Contains(b, "..") ||
+		strings.HasSuffix(b, "/") || strings.HasSuffix(b, ".lock") || b == "@" {
+		return false
+	}
+	for _, r := range b {
+		if r <= ' ' || r == 0x7f || strings.ContainsRune("~^:?*[\\", r) {
+			return false
+		}
+	}
+	return true
+}
diff --git a/internal/core/guard/branchacts_test.go b/internal/core/guard/branchacts_test.go
new file mode 100644
index 0000000000..38b2ac1598
--- /dev/null
+++ b/internal/core/guard/branchacts_test.go
@@ -0,0 +1,55 @@
+package guard
+
+import (
+	"reflect"
+	"testing"
+)
+
+// TestBranchActsForms: the branch-creating forms of git the created-branch
+// recorder reads (spc-2610180914469489 step 3), each read as the branch it
+// names, and the forms that create nothing read as nothing.
+func TestBranchActsForms(t *testing.T) {
+	cases := []struct {
+		cmd  string
+		want []BranchAct
+	}{
+		{"git worktree add -b feat/x ../x", []BranchAct{{Kind: BranchCreate, Name: "feat/x"}}},
+		{"git worktree add -B feat/x ../x main", []BranchAct{{Kind: BranchCreate, Name: "feat/x"}}},
+		{"git worktree add ../x -b feat/x", []BranchAct{{Kind: BranchCreate, Name: "feat/x"}}},
+		{"git switch -c feat/y", []BranchAct{{Kind: BranchCreate, Name: "feat/y"}}},
+		{"git switch --create=feat/y origin/main", []BranchAct{{Kind: BranchCreate, Name: "feat/y"}}},
+		{"git switch -C feat/y", []BranchAct{{Kind: BranchCreate, Name: "feat/y"}}},
+		{"git checkout -B feat/z", []BranchAct{{Kind: BranchCreate, Name: "feat/z"}}},
+		{"git checkout -b feat/z main", []BranchAct{{Kind: BranchCreate, Name: "feat/z"}}},
+		{"git checkout -bfeat/z", []BranchAct{{Kind: BranchCreate, Name: "feat/z"}}},
+		{"git branch feat/w", []BranchAct{{Kind: BranchCreate, Name: "feat/w"}}},
+		{"git branch --no-track feat/w origin/main", []BranchAct{{Kind: BranchCreate, Name: "feat/w"}}},
+		{"git worktree add ../v", []BranchAct{{Kind: BranchCheckout, Name: "v"}}},
+		{"git worktree add ../u feat/u", []BranchAct{{Kind: BranchCheckout, Name: "feat/u"}}},
+		{"git branch -m feat/w feat/w2", []BranchAct{{Kind: BranchRename, From: "feat/w", Name: "feat/w2"}}},
+		{"git branch -M feat/w2", []BranchAct{{Kind: BranchRename, From: "", Name: "feat/w2"}}},
+		{"git -C ../other -c core.x=y checkout -b feat/q", []BranchAct{{Kind: BranchCreate, Name: "feat/q"}}},
+		{"GIT_TRACE=0 git switch -c feat/e", []BranchAct{{Kind: BranchCreate, Name: "feat/e"}}},
+		{"cd ../x && git switch -c feat/a && git branch feat/b", []BranchAct{{Kind: BranchCreate, Name: "feat/a"}, {Kind: BranchCreate, Name: "feat/b"}}},
+		// Nothing created.
+		{"git branch", nil},
+		{"git branch -d feat/w", nil},
+		{"git branch --list feat/*", nil},
+		{"git branch -u origin/main feat/w", nil},
+		{"git checkout feat/w", nil},
+		{"git switch feat/w", nil},
+		{"git worktree add --detach ../d", nil},
+		{"git worktree list", nil},
+		{"echo git checkout -b feat/no", nil},
+		{"git checkout -b \"$(name)\"", nil},
+	}
+	for _, c := range cases {
+		got := BranchActs(c.cmd)
+		if len(got) == 0 && len(c.want) == 0 {
+			continue
+		}
+		if !reflect.DeepEqual(got, c.want) {
+			t.Errorf("BranchActs(%q) = %+v, want %+v", c.cmd, got, c.want)
+		}
+	}
+}
diff --git a/internal/core/guard/unknownsites_test.go b/internal/core/guard/unknownsites_test.go
index 8cb12abd86..147a201aaa 100644
--- a/internal/core/guard/unknownsites_test.go
+++ b/internal/core/guard/unknownsites_test.go
@@ -36,6 +36,15 @@ var wordReaders = map[string]string{
 	"firstOperands":      "the rule itself",
 	"firstOperandLimit":  "the rule itself",
 
+	// branchacts.go: the away mode's created-branch recorder, which records
+	// and refuses nothing.
+	"branchActsIn":      "isUnknown on every word: a command with a word nothing fixes is read as no branch act",
+	"branchCommandActs": "exempt: reads only words branchActsIn found known",
+	"createFlagActs":    "exempt: reads only words branchActsIn found known",
+	"flagValue":         "exempt: reads only words branchActsIn found known",
+	"plausibleBranch":   "exempt: reads only words branchActsIn found known",
+	"worktreeAddActs":   "exempt: reads only words branchActsIn found known",
+
 	// match.go
 	"matchSegmentEnv":      "sitesNamed: every place the entry's command can sit; anyProgram marks a name nothing fixes",
 	"exportsAny":           "commandSites and nameCouldBe",
diff --git a/internal/core/surface/sentences.go b/internal/core/surface/sentences.go
index ee340de0e6..0c60d03ec9 100644
--- a/internal/core/surface/sentences.go
+++ b/internal/core/surface/sentences.go
@@ -139,13 +139,13 @@ var sentences = map[string]string{
 		"Writes nothing; refuses a lifeboat whose manifest does not verify.",
 
 	"abcd guard": "Judge a shell command against the hazard registry before it runs: " +
-		"Writes nothing; refuses a hazard through check, hook or approve, and an unknown sub-verb.",
+		"Writes branch records; refuses a hazard via check, hook or approve, and an unknown sub-verb.",
 	"abcd guard check": "Judge one shell command against the hazard registry: " +
 		"Writes nothing; refuses a hazard with exit 1 and a command it cannot parse with exit 2.",
 	"abcd guard approve": "Answer a headless agent's permission prompts over MCP: " +
 		"Writes nothing; refuses every prompt but a shell command the guard reads whole and clears.",
 	"abcd guard hook": "Judge the shell command in a host's pre-tool-use payload: " +
-		"Writes nothing; refuses a hazard or a badly built question with the host's deny.",
+		"Writes a created branch's record; refuses a hazard or a badly built question with the host's deny.",
 
 	"abcd history": "Keep session transcripts in the user-level store and read them back: " +
 		"Writes nothing bare, and redacts each one it stores; refuses an unknown sub-verb.",
diff --git a/internal/surface/cli/guard.go b/internal/surface/cli/guard.go
index af0760cdc7..cf8b7c8f75 100644
--- a/internal/surface/cli/guard.go
+++ b/internal/surface/cli/guard.go
@@ -382,6 +382,10 @@ func guardHookDecide(cmd *cobra.Command) error {
 			cwd = wd
 		}
 	}
+	// The away mode's created-branch recorder runs first and refuses
+	// nothing, so the registry's state never decides whether a branch the
+	// session cuts is seen as its own (spc-2610180914469489 step 3).
+	recordCreatedBranches(cmd.ErrOrStderr(), cwd, in.ToolInput.Workdir, candidate)
 	sessionRoot := rulesRoot(cwd, cmd.ErrOrStderr())
 	// The fail-safe posture is decided in core (guard.LoadRepo,
 	// iss-2608291814576261); the hook only formats it. A dropped repo layer
diff --git a/internal/surface/cli/guard_branches.go b/internal/surface/cli/guard_branches.go
new file mode 100644
index 0000000000..b3b23254b6
--- /dev/null
+++ b/internal/surface/cli/guard_branches.go
@@ -0,0 +1,64 @@
+package cli
+
+import (
+	"encoding/json"
+	"io"
+	"strings"
+
+	"github.com/intentdriven/abcd/internal/core/autonomy"
+	"github.com/intentdriven/abcd/internal/core/guard"
+	"github.com/intentdriven/abcd/internal/gitutil"
+)
+
+// awayCopyRoot is the working copy a hook acts for: the worktree root of the
+// session's directory. The stop check reads the copy's owed work from the same
+// root (spc-2610180914469489, "Which copy").
+func awayCopyRoot(cwd string) (string, bool) {
+	root, err := gitutil.CheckoutRoot(cwd, autonomy.StoreName)
+	if err != nil {
+		return "", false
+	}
+	return root, true
+}
+
+// recordCreatedBranches is the created-branch recorder of the away mode
+// (spc-2610180914469489 step 3): before the guard judges command, the
+// branches it creates, checks out into a new worktree or renames are recorded
+// under the session copy's key in the away store, whether or not the person
+// is away. It refuses nothing: a store it cannot write leaves one line on w
+// and the command goes on to the guard's own judgement.
+func recordCreatedBranches(w io.Writer, cwd string, workdir json.RawMessage, command string) {
+	acts := guard.BranchActs(command)
+	if len(acts) == 0 {
+		return
+	}
+	copyRoot, ok := awayCopyRoot(cwd)
+	if !ok {
+		return
+	}
+	runDir := cwd
+	if wd, err := hookWorkdir(workdir, cwd); err == nil && wd.Exists {
+		runDir = wd.Path
+	}
+	changes := make([]autonomy.BranchChange, 0, len(acts))
+	var names []string
+	for _, a := range acts {
+		c := autonomy.BranchChange{Name: a.Name, From: a.From}
+		switch a.Kind {
+		case guard.BranchCreate:
+			c.Kind = autonomy.BranchCreated
+		case guard.BranchCheckout:
+			c.Kind = autonomy.BranchCheckedOut
+		case guard.BranchRename:
+			c.Kind = autonomy.BranchMoved
+		default:
+			continue
+		}
+		changes = append(changes, c)
+		names = append(names, a.Name)
+	}
+	if err := autonomy.RecordCreated(copyRoot, runDir, changes, autonomy.Options{}); err != nil {
+		diagnosticLine(w, "abcd guard: the created branch %s was not recorded for the away mode (%s); the command is not refused for it",
+			strings.Join(names, ", "), scrubPaths(err))
+	}
+}
diff --git a/internal/surface/cli/guard_branches_test.go b/internal/surface/cli/guard_branches_test.go
new file mode 100644
index 0000000000..51d0ad0ff0
--- /dev/null
+++ b/internal/surface/cli/guard_branches_test.go
@@ -0,0 +1,130 @@
+package cli
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/abcdhome"
+	"github.com/intentdriven/abcd/internal/core/autonomy"
+	"github.com/intentdriven/abcd/internal/core/claim"
+)
+
+// createdBranches is the created-branch list the recorder kept for root's
+// copy, by name.
+func createdBranches(t *testing.T, root string) []string {
+	t.Helper()
+	key := claim.OwnCopyKey(root)
+	if key == "" {
+		return nil
+	}
+	got, err := awayStore(t, root).CreatedBranches(key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var out []string
+	for _, b := range got {
+		out = append(out, b.Name)
+	}
+	return out
+}
+
+// hookAllows runs the guard hook on command from root and fails the test on a
+// deny: the recorder never refuses.
+func hookAllows(t *testing.T, root, command string) (stderr string) {
+	t.Helper()
+	stdout, stderr, code := runGuard(preToolUse(t, "Bash", command, root), "guard", "hook")
+	if strings.Contains(stdout, `"deny"`) || code == 2 {
+		t.Fatalf("%q was refused: stdout %q stderr %q code %d", command, stdout, stderr, code)
+	}
+	return stderr
+}
+
+// TestBranchRecorderOnCreate: `git worktree add -b feat/x ../x`, `git switch
+// -c feat/y` and `git checkout -B feat/z` record the branch under this copy's
+// key, whether or not the person is away, only when no branch of that name
+// exists, and `git checkout -b main` on an existing main records nothing.
+func TestBranchRecorderOnCreate(t *testing.T) {
+	root := awayCheckout(t)
+	hookAllows(t, root, "git worktree add -b feat/x ../x")
+	if got := createdBranches(t, root); !slices.Equal(got, []string{"feat/x"}) {
+		t.Fatalf("not away: recorded %v, want [feat/x]", got)
+	}
+	if _, err := autonomy.SetAway(root, "", false, autonomy.Options{}); err != nil {
+		t.Fatal(err)
+	}
+	hookAllows(t, root, "git switch -c feat/y")
+	hookAllows(t, root, "git checkout -B feat/z")
+	gitAt(t, root, "branch", "feat/old")
+	hookAllows(t, root, "git checkout -b main")
+	hookAllows(t, root, "git switch -c feat/old")
+	if got := createdBranches(t, root); !slices.Equal(got, []string{"feat/x", "feat/y", "feat/z"}) {
+		t.Fatalf("recorded %v, want [feat/x feat/y feat/z]", got)
+	}
+}
+
+// TestBranchRecorderOtherForms: `git branch feat/w`, a bare `git worktree add
+// ../v` recording v, and `git worktree add ../u feat/u` on an existing branch
+// are recorded; `git branch -m feat/w feat/w2` carries the record; feat/x is
+// not matched inside feat/x2; a tag checked out is no branch; the file stays
+// within its cap.
+func TestBranchRecorderOtherForms(t *testing.T) {
+	root := awayCheckout(t)
+	gitAt(t, root, "branch", "feat/u")
+	gitAt(t, root, "branch", "feat/x")
+	hookAllows(t, root, "git branch feat/w")
+	hookAllows(t, root, "git worktree add ../v")
+	hookAllows(t, root, "git worktree add ../u feat/u")
+	gitAt(t, root, "tag", "v1")
+	hookAllows(t, root, "git worktree add ../t v1")
+	hookAllows(t, root, "git branch -m feat/w feat/w2")
+	hookAllows(t, root, "git checkout -b feat/x2")
+	hookAllows(t, root, "git branch -m feat/x feat/q")
+	got := createdBranches(t, root)
+	want := []string{"feat/w2", "v", "feat/u", "feat/x2"}
+	if !slices.Equal(got, want) {
+		t.Fatalf("recorded %v, want %v", got, want)
+	}
+
+	key := claim.OwnCopyKey(root)
+	st := awayStore(t, root)
+	var fill []autonomy.BranchChange
+	for i := range autonomy.MaxCreatedBranches {
+		fill = append(fill, autonomy.BranchChange{Kind: autonomy.BranchCreated, Name: fmt.Sprintf("feat/fill%03d", i)})
+	}
+	if err := st.RecordBranches(key, fill, time.Now()); err != nil {
+		t.Fatal(err)
+	}
+	hookAllows(t, root, "git switch -c feat/last")
+	got = createdBranches(t, root)
+	if len(got) != autonomy.MaxCreatedBranches || got[len(got)-1] != "feat/last" {
+		t.Fatalf("the list must stay within its cap of %d, newest kept: %d, last %q", autonomy.MaxCreatedBranches, len(got), got[len(got)-1])
+	}
+}
+
+// TestBranchRecorderNeverRefuses: the command is allowed whatever the
+// recorder does, and a store it cannot write leaves a stderr line.
+func TestBranchRecorderNeverRefuses(t *testing.T) {
+	root := awayCheckout(t)
+	st := awayStore(t, root)
+	// A plain file where the store's folder goes: nothing can be written.
+	parent := filepath.Dir(st.Dir())
+	if err := os.MkdirAll(parent, abcdhome.DirMode); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(st.Dir(), []byte("x"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	stderr := hookAllows(t, root, "git switch -c feat/y")
+	if !strings.Contains(stderr, "created branch") || !strings.Contains(stderr, "feat/y") {
+		t.Fatalf("a store the recorder cannot write must leave a stderr line naming the branch; stderr %q", stderr)
+	}
+	// A command with no branch act is silent as before.
+	if stderr := hookAllows(t, root, "git status --porcelain"); stderr != "" {
+		t.Fatalf("no branch act, no line: %q", stderr)
+	}
+}

From 77607fae881eb0d49a2fc1f1661d8961c26a41ac Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 12:53:42 +0100
Subject: [PATCH 15/58] feat: judge a session's stop while the person is away

Judge is the stop verdict, pure over the away record, the owed set, the
host's payload and the session's state: a prose question is blocked
once; owed work blocks, naming the next item, unless a qualifying wake
holds the session waiting, and a wake releases an unchanged set of
capped items at most twice in a row; with nothing owed the session
takes the next ready item or schedules a look. A wake qualifies when
its latest fire time, read by abcd's own five-field cron parser with
the host's lateness added, falls before the deadline: the earliest
renewal due less the skew, and at most half an hour on while work is
owed. stop_hook_active alone drives the count of consecutive blocks,
and the block passing the host's cap is recorded as a stop possibly
forced by it. A hand-back is accepted only under --hold-pushes and only
for an unpushed branch's item. The session's state is kept per session
id in the copy's local tier. Owed gains NextRenewal and HandedBack.

Refs: itd-2610180912189125
Assisted-by: Claude:claude-opus-5-5
---
 internal/core/autonomy/cron.go          | 162 ++++++++
 internal/core/autonomy/cron_test.go     | 162 ++++++++
 internal/core/autonomy/doc.go           |  19 +
 internal/core/autonomy/judge.go         | 301 ++++++++++++++
 internal/core/autonomy/judge_test.go    | 531 ++++++++++++++++++++++++
 internal/core/autonomy/owed.go          |  11 +
 internal/core/autonomy/session_state.go | 107 +++++
 internal/core/autonomy/wake.go          | 103 +++++
 8 files changed, 1396 insertions(+)
 create mode 100644 internal/core/autonomy/cron.go
 create mode 100644 internal/core/autonomy/cron_test.go
 create mode 100644 internal/core/autonomy/judge.go
 create mode 100644 internal/core/autonomy/judge_test.go
 create mode 100644 internal/core/autonomy/session_state.go
 create mode 100644 internal/core/autonomy/wake.go

diff --git a/internal/core/autonomy/cron.go b/internal/core/autonomy/cron.go
new file mode 100644
index 0000000000..7bdbc3fdf0
--- /dev/null
+++ b/internal/core/autonomy/cron.go
@@ -0,0 +1,162 @@
+package autonomy
+
+import (
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// ErrCron is a cron expression abcd's parser does not read. Such an
+// expression never qualifies as a wake.
+var ErrCron = errors.New("autonomy: not a five-field cron expression abcd reads")
+
+// Cron is a parsed five-field cron expression: minute, hour, day of month,
+// month and day of week, each a set of the values it matches. It follows
+// vixie cron, as the host says its scheduled tasks do: when both day fields
+// are restricted either matches, and a day field written from `*` (`*/n`
+// included) counts as unrestricted for that rule.
+type Cron struct {
+	minute, hour, dom, month, dow uint64
+	domStar, dowStar              bool
+	// everyFive is exactly `*/5 * * * *`, which the host runs on time.
+	everyFive bool
+}
+
+type cronField struct {
+	lo, hi int
+}
+
+var cronFields = [5]cronField{{0, 59}, {0, 23}, {1, 31}, {1, 12}, {0, 7}}
+
+// ParseCron reads a five-field expression: each field a comma list of `*`,
+// `*/n`, `a`, `a-b` or `a-b/n`, in numbers (no names, no `@` forms); day of
+// week takes 0 or 7 for Sunday. Anything else is ErrCron.
+func ParseCron(expr string) (Cron, error) {
+	f := strings.Fields(expr)
+	if len(f) != 5 {
+		return Cron{}, fmt.Errorf("%w: %d fields, want 5", ErrCron, len(f))
+	}
+	var sets [5]uint64
+	for i, s := range f {
+		set, err := parseCronField(s, cronFields[i])
+		if err != nil {
+			return Cron{}, fmt.Errorf("%w: field %d: %v", ErrCron, i+1, err)
+		}
+		sets[i] = set
+	}
+	if sets[4]&(1<<7) != 0 {
+		sets[4] = (sets[4] | 1) &^ (1 << 7)
+	}
+	return Cron{
+		minute: sets[0], hour: sets[1], dom: sets[2], month: sets[3], dow: sets[4],
+		domStar:   strings.HasPrefix(f[2], "*"),
+		dowStar:   strings.HasPrefix(f[4], "*"),
+		everyFive: strings.Join(f, " ") == "*/5 * * * *",
+	}, nil
+}
+
+func parseCronField(s string, r cronField) (uint64, error) {
+	var set uint64
+	for _, item := range strings.Split(s, ",") {
+		if item == "" {
+			return 0, errors.New("an empty list item")
+		}
+		rng, stepText, hasStep := strings.Cut(item, "/")
+		step := 1
+		if hasStep {
+			n, err := cronNumber(stepText)
+			if err != nil || n < 1 {
+				return 0, fmt.Errorf("step %q", stepText)
+			}
+			step = n
+		}
+		lo, hi := r.lo, r.hi
+		switch {
+		case rng == "*":
+		case strings.Contains(rng, "-"):
+			a, b, _ := strings.Cut(rng, "-")
+			x, err1 := cronNumber(a)
+			y, err2 := cronNumber(b)
+			if err1 != nil || err2 != nil || x > y {
+				return 0, fmt.Errorf("range %q", rng)
+			}
+			lo, hi = x, y
+		default:
+			if hasStep {
+				return 0, fmt.Errorf("a step on a single value %q", item)
+			}
+			x, err := cronNumber(rng)
+			if err != nil {
+				return 0, fmt.Errorf("value %q", rng)
+			}
+			lo, hi = x, x
+		}
+		if lo < r.lo || hi > r.hi {
+			return 0, fmt.Errorf("%q is outside %d-%d", item, r.lo, r.hi)
+		}
+		for v := lo; v <= hi; v += step {
+			set |= 1 << uint(v)
+		}
+	}
+	return set, nil
+}
+
+func cronNumber(s string) (int, error) {
+	if s == "" || len(s) > 2 {
+		return 0, errors.New("not a number")
+	}
+	for _, c := range s {
+		if c < '0' || c > '9' {
+			return 0, errors.New("not a number")
+		}
+	}
+	return strconv.Atoi(s)
+}
+
+// matches reports whether the wall-clock minute w (in its own location)
+// matches the expression.
+func (c Cron) matches(w time.Time) bool {
+	if c.minute&(1<<uint(w.Minute())) == 0 || c.hour&(1<<uint(w.Hour())) == 0 || c.month&(1<<uint(w.Month())) == 0 {
+		return false
+	}
+	domOK := c.dom&(1<<uint(w.Day())) != 0
+	dowOK := c.dow&(1<<uint(w.Weekday())) != 0
+	if c.domStar || c.dowStar {
+		return domOK && dowOK
+	}
+	return domOK || dowOK
+}
+
+// Next is the first time strictly after from, and no later than until, at
+// which the expression matches, read in loc's wall-clock time (nil means the
+// machine's local time, as the host reads its tasks). It steps minute by
+// minute in absolute time, so a wall-clock minute a daylight-saving change
+// skips never matches, and one it repeats matches only at its first
+// occurrence.
+func (c Cron) Next(from, until time.Time, loc *time.Location) (time.Time, bool) {
+	if loc == nil {
+		loc = time.Local
+	}
+	for t := from.Truncate(time.Minute).Add(time.Minute); !t.After(until); t = t.Add(time.Minute) {
+		w := t.In(loc)
+		if c.matches(w) && !repeatedWallMinute(t, loc) {
+			return t, true
+		}
+	}
+	return time.Time{}, false
+}
+
+// repeatedWallMinute reports whether t's wall-clock minute in loc already
+// happened earlier, as the hour after a fall-back change repeats the one
+// before it.
+func repeatedWallMinute(t time.Time, loc *time.Location) bool {
+	_, now := t.In(loc).Zone()
+	_, before := t.Add(-24 * time.Hour).In(loc).Zone()
+	d := time.Duration(before-now) * time.Second
+	if d <= 0 {
+		return false
+	}
+	return t.Add(-d).In(loc).Format("2006-01-02 15:04") == t.In(loc).Format("2006-01-02 15:04")
+}
diff --git a/internal/core/autonomy/cron_test.go b/internal/core/autonomy/cron_test.go
new file mode 100644
index 0000000000..873c65e589
--- /dev/null
+++ b/internal/core/autonomy/cron_test.go
@@ -0,0 +1,162 @@
+package autonomy
+
+import (
+	"testing"
+	"time"
+)
+
+// cronNext is the next match of expr strictly after from, searched to until,
+// read in loc.
+func cronNext(t *testing.T, expr string, from, until time.Time, loc *time.Location) (time.Time, bool) {
+	t.Helper()
+	c, err := ParseCron(expr)
+	if err != nil {
+		t.Fatalf("ParseCron(%q): %v", expr, err)
+	}
+	return c.Next(from, until, loc)
+}
+
+// matchesIn lists the minutes of the day (as "HH:MM") on which expr matches,
+// stepping from the start of day to its end in loc.
+func matchDays(t *testing.T, expr string, from time.Time, days int, loc *time.Location) []string {
+	t.Helper()
+	c, err := ParseCron(expr)
+	if err != nil {
+		t.Fatalf("ParseCron(%q): %v", expr, err)
+	}
+	var got []string
+	end := from.AddDate(0, 0, days)
+	for cur := from; ; {
+		n, ok := c.Next(cur, end, loc)
+		if !ok {
+			break
+		}
+		got = append(got, n.In(loc).Format("2006-01-02 Mon 15:04"))
+		cur = n
+	}
+	return got
+}
+
+// TestCronNextFire: lists, ranges, steps and both day fields give the next
+// fire time; an expression it cannot parse never qualifies.
+func TestCronNextFire(t *testing.T) {
+	loc := london(t)
+	now := at(t, "2026-10-18 21:07") // a Sunday
+	for _, c := range []struct {
+		expr string
+		want string
+	}{
+		{"*/10 * * * *", "2026-10-18 21:10"},
+		{"0 9 * * 1-5", "2026-10-19 09:00"},
+		{"15,45 * * * *", "2026-10-18 21:15"},
+		{"0 22-23 * * *", "2026-10-18 22:00"},
+		{"0 0 1 * *", "2026-11-01 00:00"},
+		{"30 6 * 11 *", "2026-11-01 06:30"},
+		{"0 7 19 * 3", "2026-10-19 07:00"}, // the 19th (a Monday) or a Wednesday: the 19th first
+		{"0 7 25 * 3", "2026-10-21 07:00"}, // the 25th or a Wednesday: Wednesday the 21st first
+		{"8 21 * * *", "2026-10-18 21:08"},
+		{"7 21 * * *", "2026-10-19 21:07"}, // strictly after now
+	} {
+		got, ok := cronNext(t, c.expr, now, now.AddDate(0, 1, 0), loc)
+		if !ok {
+			t.Errorf("%q: no match", c.expr)
+			continue
+		}
+		if s := got.In(loc).Format("2006-01-02 15:04"); s != c.want {
+			t.Errorf("%q: next %s, want %s", c.expr, s, c.want)
+		}
+	}
+	for _, bad := range []string{"", "* * * *", "* * * * * *", "60 * * * *", "* 24 * * *", "* * 0 * *", "* * * 13 *",
+		"* * * * 8", "a * * * *", "*/0 * * * *", "5-1 * * * *", "1,,2 * * * *", "0 9 * * MON", "@daily", "-1 * * * *"} {
+		if _, err := ParseCron(bad); err == nil {
+			t.Errorf("ParseCron(%q) parsed; want refused", bad)
+		}
+		if _, _, ok := LatestFire(SessionCron{Schedule: bad, Recurring: true}, now, now.Add(time.Hour), loc); ok {
+			t.Errorf("an unparsable %q gave a fire time", bad)
+		}
+	}
+}
+
+// TestCronDayOfWeekSeven: 7 matches Sunday as 0 does.
+func TestCronDayOfWeekSeven(t *testing.T) {
+	loc := london(t)
+	from := at(t, "2026-10-12 00:00") // a Monday
+	for _, expr := range []string{"0 9 * * 7", "0 9 * * 0", "0 9 * * 6-7"} {
+		got := matchDays(t, expr, from, 7, loc)
+		found := false
+		for _, g := range got {
+			if g == "2026-10-18 Sun 09:00" {
+				found = true
+			}
+		}
+		if !found {
+			t.Errorf("%q does not match Sunday: %v", expr, got)
+		}
+	}
+	if got := matchDays(t, "0 9 * * 7", from, 7, loc); len(got) != 1 {
+		t.Errorf("0 9 * * 7 matched %v, want Sunday alone", got)
+	}
+}
+
+// TestCronRangeStep: 10-50/20 matches minutes 10, 30 and 50.
+func TestCronRangeStep(t *testing.T) {
+	loc := london(t)
+	from := at(t, "2026-10-18 20:59")
+	got := matchDays(t, "10-50/20 21 18 10 *", from, 1, loc)
+	want := []string{"2026-10-18 Sun 21:10", "2026-10-18 Sun 21:30", "2026-10-18 Sun 21:50"}
+	if len(got) != len(want) {
+		t.Fatalf("10-50/20 matched %v, want %v", got, want)
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Errorf("10-50/20 matched %v, want %v", got, want)
+		}
+	}
+}
+
+// TestCronStarStepInDayField: `0 9 */2 * 1` matches only days both
+// odd-numbered and Monday, since a field written from `*` counts as
+// unrestricted; `0 9 1 * 1` matches either.
+func TestCronStarStepInDayField(t *testing.T) {
+	loc := london(t)
+	from := at(t, "2026-10-31 23:00")
+	got := matchDays(t, "0 9 */2 * 1", from, 30, loc)
+	for _, g := range got {
+		d, _ := time.ParseInLocation("2006-01-02 Mon 15:04", g, loc)
+		if d.Weekday() != time.Monday || d.Day()%2 != 1 {
+			t.Errorf("0 9 */2 * 1 matched %s, which is not an odd-numbered Monday", g)
+		}
+	}
+	// November 2026: Mondays 2, 9, 16, 23, 30; the odd ones are the 9th and 23rd.
+	if len(got) != 2 || got[0] != "2026-11-09 Mon 09:00" || got[1] != "2026-11-23 Mon 09:00" {
+		t.Errorf("0 9 */2 * 1 matched %v, want the 9th and the 23rd", got)
+	}
+	either := matchDays(t, "0 9 1 * 1", from, 30, loc)
+	// The 1st (a Sunday) and every Monday: 1, 2, 9, 16, 23, 30.
+	if len(either) != 6 || either[0] != "2026-11-01 Sun 09:00" {
+		t.Errorf("0 9 1 * 1 matched %v, want the 1st and every Monday", either)
+	}
+}
+
+// TestCronDaylightSaving: in Europe/London, `30 1 * * *` has no match on the
+// spring-forward day and matches once, at its first occurrence, on the
+// fall-back day.
+func TestCronDaylightSaving(t *testing.T) {
+	loc := london(t)
+	spring := time.Date(2026, 3, 29, 0, 0, 0, 0, loc)
+	if got, ok := cronNext(t, "30 1 * * *", spring, spring.Add(23*time.Hour), loc); ok {
+		t.Errorf("spring-forward day: 30 1 * * * matched at %s, a minute that never happens", got)
+	}
+	fall := time.Date(2026, 10, 25, 0, 0, 0, 0, loc)
+	end := fall.Add(24 * time.Hour)
+	first, ok := cronNext(t, "30 1 * * *", fall, end, loc)
+	if !ok {
+		t.Fatal("fall-back day: no match")
+	}
+	if _, off := first.In(loc).Zone(); off != 3600 {
+		t.Errorf("fall-back day: matched %s, want the first occurrence (BST)", first.In(loc).Format(time.RFC3339))
+	}
+	if again, ok := cronNext(t, "30 1 * * *", first, end, loc); ok {
+		t.Errorf("fall-back day: matched again at %s; the repeated minute matches once", again.In(loc).Format(time.RFC3339))
+	}
+}
diff --git a/internal/core/autonomy/doc.go b/internal/core/autonomy/doc.go
index 4bb4a234bc..1fd19d0625 100644
--- a/internal/core/autonomy/doc.go
+++ b/internal/core/autonomy/doc.go
@@ -77,4 +77,23 @@
 // behind one, a stacked branch, an unpushed branch, and a reservation whose
 // work no pull request carries. Owed.Fingerprint and Owed.CappedFingerprint
 // compare two owed sets item by item, ignoring order and reasons.
+// Owed.NextRenewal is the earliest renewal due among the live reservations
+// under this copy's key (zero when none), and Owed.HandedBack the items a
+// queued step handed back, which the verdict accepts only under
+// --hold-pushes and only for an unpushed branch's item with its head.
+//
+// # The stop verdict
+//
+// Judge(record, owed, input, session, now) is the stop check's verdict, pure:
+// present, it allows (with a SystemMessage naming owed work); away, the seven
+// rows of the plan decide, from the owed set, the host's payload (StopInput:
+// stop_hook_active, the last message, session_crons, background_tasks, the
+// host's cap) and the session's SessionState. A wake qualifies
+// (QualifyingWake) when a session cron's latest fire time (LatestFire: its
+// next match, by abcd's own five-field cron parser, ParseCron, plus the
+// host's lateness) is no later than Deadline. The session's state lives in
+// the copy's local tier (SessionsDir, LoadSession, SaveSession), keyed by a
+// session id ValidSessionID accepts. The session-start hook notes each
+// session's start copy in the store (Store.NoteSessionCopy); ResolveCopy
+// reads it back.
 package autonomy
diff --git a/internal/core/autonomy/judge.go b/internal/core/autonomy/judge.go
new file mode 100644
index 0000000000..9c04693ace
--- /dev/null
+++ b/internal/core/autonomy/judge.go
@@ -0,0 +1,301 @@
+package autonomy
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/termsafe"
+)
+
+// DefaultBlockCap is the host's cap on consecutive stop-hook continuations:
+// after eight in a row it overrides the next block and ends the turn
+// (CLAUDE_CODE_STOP_HOOK_BLOCK_CAP raises it).
+const DefaultBlockCap = 8
+
+// MaxWakesUnchanged is how many wakes in a row may release an unchanged set
+// of capped items (dcn-2610181035361997).
+const MaxWakesUnchanged = 2
+
+// The session states while away (dcn-2610180936577720): working (the stop is
+// blocked), waiting (allowed with a qualifying wake), and stopped (the host's
+// cap overrode a block, recorded).
+const (
+	StateWorking = "working"
+	StateWaiting = "waiting"
+	StateStopped = "stopped"
+)
+
+// StopInput is what the Stop hook's payload carries, as the front door maps
+// it, and the two values it reads from the machine for the verdict.
+type StopInput struct {
+	SessionID            string
+	StopHookActive       bool
+	LastAssistantMessage string
+	SessionCrons         []SessionCron
+	BackgroundTasks      []BackgroundTask
+	// Cap is the host's continuation cap; 0 means DefaultBlockCap. The front
+	// door reads CLAUDE_CODE_STOP_HOOK_BLOCK_CAP.
+	Cap int
+	// Location is the zone the host reads its tasks' schedules in; nil means
+	// the machine's local time.
+	Location *time.Location
+}
+
+// Verdict is the stop check's answer.
+type Verdict struct {
+	// Block holds the stop, with Reason handed to the agent.
+	Block  bool
+	Reason string
+	// SystemMessage is the line shown to the person on an allow while
+	// present with work owed (stopped, flagged).
+	SystemMessage string
+	// Row is the away row that decided (1 to 7), or 0 while present.
+	Row int
+	// State is the session's state to save, when Save is set (while away).
+	State SessionState
+	Save  bool
+	// Stop is a stop to record in the away record: the block passing the
+	// host's cap, possibly forced by it.
+	Stop *Stop
+	// HandBacks are the hand-backs the verdict accepted, to record in the
+	// away record under its lock, once per branch and head.
+	HandBacks []OwedItem
+}
+
+// Judge is the stop verdict, pure over the away record, the owed set, the
+// host's payload, the session's state and now. rec not holding at now is the
+// person present: with owed work the stop is allowed with a line naming it,
+// and with none silently. While away the rows of the plan are read in order
+// and the first that matches decides:
+//
+//  1. the last message ends on a line ending in `?`, not yet blocked for
+//     this message: block with the reroute's reason;
+//  2. owed, the set changed (or the first check): block, naming the next
+//     item and the count;
+//  3. owed, unchanged, a qualifying wake, and no capped item owed or the wake
+//     count below two: allow (waiting; the wake count adds one if a capped
+//     item is owed);
+//  4. owed, unchanged, a qualifying wake, a capped item owed and the wake
+//     count at two: block;
+//  5. owed, unchanged, no qualifying wake: block;
+//  6. none owed, a qualifying wake: allow (waiting);
+//  7. none owed, no qualifying wake: block, taking the next ready item first.
+//
+// stop_hook_active decides no row; it alone drives the count of consecutive
+// blocks (false sets it to one, true adds one), and the block whose count
+// passes the cap is recorded as a stop possibly forced by the cap.
+func Judge(rec *Record, owed Owed, in StopInput, st SessionState, now time.Time) Verdict {
+	away := rec.Holds(now)
+	owed, handBacks := settleHandBacks(rec, owed, away)
+	if !away {
+		if owed.Empty() {
+			return Verdict{}
+		}
+		return Verdict{SystemMessage: presentLine(owed)}
+	}
+
+	next := st
+	next.SchemaVersion = SchemaVersion
+	if cfp := owed.CappedFingerprint(); cfp != next.WakeFingerprint {
+		next.Wakes, next.WakeFingerprint = 0, cfp
+	}
+	fp := owed.Fingerprint()
+	changed := fp != st.Fingerprint
+	next.Fingerprint = fp
+	deadline := Deadline(owed, now)
+	_, look, wake := QualifyingWake(in.SessionCrons, now, deadline, in.Location)
+
+	v := Verdict{Save: true, HandBacks: handBacks}
+	qhash := ""
+	if endsOnQuestion(in.LastAssistantMessage) {
+		qhash = hashText(in.LastAssistantMessage)
+	}
+	switch {
+	case qhash != "" && qhash != st.QuestionHash:
+		v.Row, v.Reason = 1, questionReason()
+		next.QuestionHash = qhash
+		// The owed set is not taken as seen: the next check names it.
+		next.Fingerprint = st.Fingerprint
+	case !owed.Empty() && changed:
+		v.Row, v.Reason = 2, owedReason(rec, owed, "")
+	case !owed.Empty() && wake && (!owed.HasCapped() || next.Wakes < MaxWakesUnchanged):
+		v.Row = 3
+		if owed.HasCapped() {
+			next.Wakes++
+		}
+	case !owed.Empty() && wake:
+		v.Row, v.Reason = 4, owedReason(rec, owed,
+			"The set has not moved over two wakes, so a wake no longer releases this stop: move the item, or take another.")
+	case !owed.Empty():
+		v.Row, v.Reason = 5, owedReason(rec, owed,
+			fmt.Sprintf("If it cannot move, take another or schedule a look before %s (a cron that fires by then, the host's lateness included).", clock(deadline, in.Location)))
+	case wake:
+		v.Row = 6
+	default:
+		v.Row = 7
+		v.Reason = fmt.Sprintf("abcd: the person is away and nothing is owed: take the next ready item first (reserve it with `abcd reserve <id>`); only if none can be taken alone, schedule a look before %s (a cron that fires by then, the host's lateness included).",
+			clock(deadline, in.Location))
+	}
+
+	if v.Reason == "" {
+		v.Block = false
+		next.State, next.NextLook, next.Blocks = StateWaiting, look, 0
+		v.State = next
+		return v
+	}
+	v.Block = true
+	next.State, next.NextLook = StateWorking, time.Time{}
+	if in.StopHookActive {
+		next.Blocks++
+	} else {
+		next.Blocks = 1
+	}
+	limit := in.Cap
+	if limit <= 0 {
+		limit = DefaultBlockCap
+	}
+	if next.Blocks > limit {
+		switch v.Row {
+		case 2, 4, 5:
+			item, _ := owed.Next()
+			v.Stop = &Stop{Kind: StopWorkOwed, Detail: describeItem(item), PossiblyForcedByCap: true}
+			next.State = StateStopped
+		case 7:
+			v.Stop = &Stop{Kind: StopNoNextLook, PossiblyForcedByCap: true}
+			next.State = StateStopped
+		}
+	}
+	v.State = next
+	return v
+}
+
+// settleHandBacks applies the hand-back rule at the verdict (F1,
+// dcn-2610181035355741): only while away and only under --hold-pushes is an
+// item handed back, and then only an unpushed branch's item with its head;
+// every other item the reader handed back is put back among the owed items.
+func settleHandBacks(rec *Record, owed Owed, away bool) (Owed, []OwedItem) {
+	if len(owed.HandedBack) == 0 {
+		return owed, nil
+	}
+	items := append([]OwedItem(nil), owed.Items...)
+	var accepted []OwedItem
+	for _, h := range owed.HandedBack {
+		if away && rec.HoldPushes && h.Kind == OwedUnpushed && h.Branch != "" && h.Head != "" {
+			accepted = append(accepted, h)
+			continue
+		}
+		items = append(items, h)
+	}
+	owed.Items, owed.HandedBack = items, nil
+	return owed, accepted
+}
+
+// endsOnQuestion reports whether the message's last line, trailing space and
+// emphasis marks aside, ends in a question mark.
+func endsOnQuestion(msg string) bool {
+	return strings.HasSuffix(strings.TrimRight(msg, " \t\r\n*_"), "?")
+}
+
+func hashText(s string) string {
+	sum := sha256.Sum256([]byte(s))
+	return hex.EncodeToString(sum[:16])
+}
+
+func questionReason() string {
+	return "abcd: your last message ends on a question, and the person is away, so no one will answer it. Do not ask: decide it and record it with `abcd decide` (its grounds and how to reverse it); or, if only the person may approve the act, queue it with `abcd mode queue \"<step>\"` and carry on with other work."
+}
+
+func owedReason(rec *Record, owed Owed, tail string) string {
+	item, _ := owed.Next()
+	var b strings.Builder
+	fmt.Fprintf(&b, "abcd: the person is away and work is owed (%s). Next: %s.", count(len(owed.Items), "item", "items"), describeItem(item))
+	if needsPush(item.Kind) {
+		b.WriteString(" " + pushWords(rec, item))
+	}
+	if tail != "" {
+		b.WriteString(" " + tail)
+	}
+	for _, n := range owed.Notes {
+		b.WriteString(" " + termsafe.CleanProseLine(n, 256))
+	}
+	return b.String()
+}
+
+// needsPush reports whether an item's next act, once the local work is done,
+// is a push (or opening a pull request, the same kind of act).
+func needsPush(k OwedKind) bool {
+	switch k {
+	case OwedUnpushed, OwedUncarried, OwedBehind, OwedFailing:
+		return true
+	}
+	return false
+}
+
+// pushWords is the reason's sentence for an item that needs a push
+// (dcn-2610181016510153, refined by dcn-2610181035355741). It defers to the
+// person's standing instruction and never names the away mode as leave.
+func pushWords(rec *Record, item OwedItem) string {
+	if rec != nil && rec.HoldPushes {
+		target := "the branch"
+		if item.Branch != "" {
+			target = clean(item.Branch)
+		}
+		return fmt.Sprintf("With --hold-pushes the person has said pushes wait: finish the local work (the merge from the base, the preflight), then queue the push naming the branch, as `abcd mode queue \"push %s\"`.", target)
+	}
+	return "Do the local work, then push if your standing instruction allows; queue only if the person has said pushes wait. A push you may not send stays owed: queue it with `abcd mode queue \"<step>\"` for the person and take another item meanwhile."
+}
+
+// describeItem names an owed item in plain words.
+func describeItem(i OwedItem) string {
+	pr := ""
+	if i.PR > 0 {
+		pr = fmt.Sprintf("pull request #%d", i.PR)
+		if i.Branch != "" {
+			pr += " (" + clean(i.Branch) + ")"
+		}
+	}
+	var s string
+	switch i.Kind {
+	case OwedRenewal:
+		s = "the reservation on " + clean(i.Record) + " is due for renewal"
+	case OwedFailing:
+		s = orBranch(pr, i.Branch) + " is failing its checks"
+	case OwedBehind:
+		s = orBranch(pr, i.Branch) + " is behind its base"
+	case OwedStacked:
+		s = "branch " + clean(i.Branch) + " is stacked on a change still open and needs work"
+	case OwedUnpushed:
+		s = "branch " + clean(i.Branch) + " has commits not pushed"
+	case OwedUncarried:
+		s = "the reservation on " + clean(i.Record) + " has no open pull request carrying its work"
+	default:
+		s = clean(string(i.Kind)) + " " + clean(i.Branch+i.Record)
+	}
+	if i.Reason != "" {
+		s += " (" + termsafe.CleanProseLine(i.Reason, 256) + ")"
+	}
+	return s
+}
+
+func orBranch(pr, branch string) string {
+	if pr != "" {
+		return pr
+	}
+	return "branch " + clean(branch)
+}
+
+// presentLine is the person's line on a stop while present with work owed.
+func presentLine(owed Owed) string {
+	item, _ := owed.Next()
+	return fmt.Sprintf("abcd: stopped with work owed (%s); next: %s.", count(len(owed.Items), "item", "items"), describeItem(item))
+}
+
+func clock(t time.Time, loc *time.Location) string {
+	if loc == nil {
+		loc = time.Local
+	}
+	return t.In(loc).Format("15:04 MST")
+}
diff --git a/internal/core/autonomy/judge_test.go b/internal/core/autonomy/judge_test.go
new file mode 100644
index 0000000000..bfba02beb2
--- /dev/null
+++ b/internal/core/autonomy/judge_test.go
@@ -0,0 +1,531 @@
+package autonomy
+
+import (
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+// judge_test.go — step 5 of spc-2610180914469489: the stop verdict, pure over
+// the owed set, the session's state and the host's payload.
+
+func awayRec(now time.Time, holdPushes bool) *Record {
+	r, err := Begin(nil, alice, now.Add(-time.Hour), time.Time{}, holdPushes)
+	if err != nil {
+		panic(err)
+	}
+	return r
+}
+
+var (
+	behindPR    = OwedItem{Kind: OwedBehind, Capped: true, Branch: "feat/behind", PR: 12, Head: "aaaa"}
+	failingPR   = OwedItem{Kind: OwedFailing, Capped: true, Branch: "feat/failing", PR: 13, Head: "bbbb"}
+	unpushedBr  = OwedItem{Kind: OwedUnpushed, Capped: true, Branch: "feat/unpushed", Head: "cccc"}
+	stackedBr   = OwedItem{Kind: OwedStacked, Capped: true, Branch: "feat/stacked", Head: "dddd"}
+	uncarried   = OwedItem{Kind: OwedUncarried, Capped: true, Record: "iss-5"}
+	renewalDue  = OwedItem{Kind: OwedRenewal, Record: "iss-7"}
+	stackedWait = OwedItem{Kind: OwedStacked, Branch: "feat/waiting", Head: "eeee"} // waiting only on running checks
+)
+
+func owedOf(items ...OwedItem) Owed { return Owed{Items: items} }
+
+func crons(exprs ...string) []SessionCron {
+	var out []SessionCron
+	for i, e := range exprs {
+		out = append(out, SessionCron{ID: "c" + string(rune('0'+i)), Schedule: e, Recurring: true, Prompt: "look"})
+	}
+	return out
+}
+
+// judgeAt runs Judge read in London, on a minute boundary.
+func judgeAt(t *testing.T, rec *Record, owed Owed, in StopInput, st SessionState, now time.Time) Verdict {
+	t.Helper()
+	if in.Location == nil {
+		in.Location = london(t)
+	}
+	return Judge(rec, owed, in, st, now)
+}
+
+// TestJudgeRows: each of the seven away rows and both present rows, each with
+// stop_hook_active true and false.
+func TestJudgeRows(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	rec := awayRec(now, false)
+	owed := owedOf(behindPR)
+	seen := SessionState{Fingerprint: owed.Fingerprint(), WakeFingerprint: owed.CappedFingerprint()}
+	none := Owed{}
+	seenNone := SessionState{Fingerprint: none.Fingerprint(), WakeFingerprint: none.CappedFingerprint()}
+	wake := crons("*/10 * * * *")
+
+	for _, active := range []bool{false, true} {
+		for _, c := range []struct {
+			name  string
+			rec   *Record
+			owed  Owed
+			in    StopInput
+			st    SessionState
+			row   int
+			block bool
+			state string
+			want  []string
+		}{
+			{"1 prose question", rec, owed, StopInput{LastAssistantMessage: "Done.\nShall I merge it?\n"}, seen, 1, true, StateWorking, []string{"abcd decide", "abcd mode queue"}},
+			{"2 owed, first block", rec, owed, StopInput{SessionCrons: wake}, SessionState{}, 2, true, StateWorking, []string{"feat/behind", "#12", "1 item"}},
+			{"2 owed, set changed", rec, owedOf(behindPR, unpushedBr), StopInput{SessionCrons: wake}, seen, 2, true, StateWorking, []string{"feat/behind", "2 items"}},
+			{"3 owed, unchanged, wake", rec, owed, StopInput{SessionCrons: wake}, seen, 3, false, StateWaiting, nil},
+			{"4 owed, unchanged, wake, two wakes", rec, owed, StopInput{SessionCrons: wake}, withWakes(seen, 2), 4, true, StateWorking, []string{"feat/behind", "two wakes"}},
+			{"5 owed, unchanged, no wake", rec, owed, StopInput{}, seen, 5, true, StateWorking, []string{"feat/behind", "take another", "schedule a look before"}},
+			{"6 none, wake", rec, none, StopInput{SessionCrons: crons("*/30 * * * *")}, seenNone, 6, false, StateWaiting, nil},
+			{"7 none, no wake", rec, none, StopInput{}, seenNone, 7, true, StateWorking, []string{"next ready item", "reserve", "schedule a look before"}},
+			{"present, owed", nil, owed, StopInput{}, SessionState{}, 0, false, "", nil},
+			{"present, none", nil, none, StopInput{}, SessionState{}, 0, false, "", nil},
+		} {
+			c.in.StopHookActive = active
+			v := judgeAt(t, c.rec, c.owed, c.in, c.st, now)
+			name := c.name
+			if active {
+				name += " (stop_hook_active)"
+			}
+			if v.Row != c.row || v.Block != c.block {
+				t.Errorf("%s: row %d block %v, want row %d block %v (reason %q)", name, v.Row, v.Block, c.row, c.block, v.Reason)
+				continue
+			}
+			if c.rec != nil && v.State.State != c.state {
+				t.Errorf("%s: state %q, want %q", name, v.State.State, c.state)
+			}
+			for _, w := range c.want {
+				if !strings.Contains(v.Reason, w) {
+					t.Errorf("%s: the reason misses %q: %q", name, w, v.Reason)
+				}
+			}
+			if !c.block && v.Reason != "" {
+				t.Errorf("%s: an allow carries a reason: %q", name, v.Reason)
+			}
+		}
+	}
+	// Present: with owed work, allowed with a line naming it; with none, silent.
+	v := judgeAt(t, nil, owed, StopInput{}, SessionState{}, now)
+	if v.Block || !strings.Contains(v.SystemMessage, "feat/behind") || v.Save {
+		t.Errorf("present with work owed: %+v; want allowed, a line naming the work, nothing saved", v)
+	}
+	if v := judgeAt(t, nil, Owed{}, StopInput{}, SessionState{}, now); v.Block || v.SystemMessage != "" || v.Save {
+		t.Errorf("present with nothing owed: %+v; want a silent allow", v)
+	}
+	// A lapsed record is present.
+	lapsed := awayRec(now.Add(-8*24*time.Hour), false)
+	if v := judgeAt(t, lapsed, owed, StopInput{}, seen, now); v.Block || v.Row != 0 {
+		t.Errorf("a lapsed record judged as away: %+v", v)
+	}
+}
+
+func withWakes(s SessionState, n int) SessionState { s.Wakes = n; return s }
+
+// sequence runs Judge over a run of stops, carrying the state through a save
+// and a load of the session's state file, as a new hook process would.
+type sequence struct {
+	t    *testing.T
+	rec  *Record
+	root string
+	id   string
+	now  time.Time
+}
+
+func newSequence(t *testing.T, rec *Record, now time.Time) *sequence {
+	return &sequence{t: t, rec: rec, root: t.TempDir(), id: "sess-1", now: now}
+}
+
+func (s *sequence) stop(owed Owed, in StopInput) Verdict {
+	s.t.Helper()
+	st, err := LoadSession(s.root, s.id)
+	if err != nil {
+		s.t.Fatal(err)
+	}
+	v := judgeAt(s.t, s.rec, owed, in, st, s.now)
+	if v.Save {
+		if err := SaveSession(s.root, s.id, v.State); err != nil {
+			s.t.Fatal(err)
+		}
+	}
+	s.now = s.now.Add(10 * time.Minute)
+	return v
+}
+
+// TestWakeReleasesUnchangedSetTwice: with `*/10 * * * *` and an unchanged
+// capped item, the first two stops with the wake are allowed and the third
+// and each later one blocked; a set of only a renewal due, or of a stacked
+// branch waiting only on running checks, keeps releasing; a renewal falling
+// due between the wakes neither resets nor adds to the count; a change in the
+// capped items resets it; the count is read back from the state file.
+func TestWakeReleasesUnchangedSetTwice(t *testing.T) {
+	now := at(t, "2026-10-18 21:01")
+	wake := StopInput{SessionCrons: crons("*/10 * * * *")}
+	for _, item := range []OwedItem{behindPR, failingPR, unpushedBr, stackedBr, uncarried} {
+		s := newSequence(t, awayRec(now, false), now)
+		owed := owedOf(item)
+		if v := s.stop(owed, wake); v.Row != 2 {
+			t.Fatalf("%s: the first stop is row %d, want the first block", item.Kind, v.Row)
+		}
+		for i, want := range []bool{false, false, true, true, true} {
+			v := s.stop(owed, wake)
+			if v.Block != want {
+				t.Errorf("%s: wake %d: block %v, want %v (row %d)", item.Kind, i+1, v.Block, want, v.Row)
+			}
+		}
+	}
+	for _, item := range []OwedItem{renewalDue, stackedWait} {
+		s := newSequence(t, awayRec(now, false), now)
+		owed := owedOf(item)
+		s.stop(owed, wake)
+		for i := 0; i < 5; i++ {
+			if v := s.stop(owed, wake); v.Block {
+				t.Errorf("%s (not capped): wake %d blocked (row %d); want it to keep releasing", item.Kind, i+1, v.Row)
+			}
+		}
+	}
+	// A renewal falling due between the wakes: the full set changes (one
+	// block), the capped count neither resets nor adds.
+	s := newSequence(t, awayRec(now, false), now)
+	s.stop(owedOf(behindPR), wake)
+	if v := s.stop(owedOf(behindPR), wake); v.Block {
+		t.Fatal("first wake blocked")
+	}
+	if v := s.stop(owedOf(behindPR, renewalDue), wake); v.Row != 2 {
+		t.Fatalf("a renewal falling due is row %d, want the set-changed block", v.Row)
+	}
+	if v := s.stop(owedOf(behindPR, renewalDue), wake); v.Block {
+		t.Errorf("second wake after a renewal fell due blocked: the renewal reset or added to the count")
+	}
+	if v := s.stop(owedOf(behindPR, renewalDue), wake); !v.Block || v.Row != 4 {
+		t.Errorf("third wake: row %d block %v, want row 4", v.Row, v.Block)
+	}
+	// A change in the capped items resets it.
+	if v := s.stop(owedOf(failingPR, renewalDue), wake); v.Row != 2 {
+		t.Fatalf("a changed capped set is row %d, want 2", v.Row)
+	}
+	for i := 0; i < 2; i++ {
+		if v := s.stop(owedOf(failingPR, renewalDue), wake); v.Block {
+			t.Errorf("after the capped set changed, wake %d blocked: the count did not reset", i+1)
+		}
+	}
+	st, _ := LoadSession(s.root, s.id)
+	if st.Wakes != 2 || st.WakeFingerprint != owedOf(failingPR).CappedFingerprint() {
+		t.Errorf("state file holds wakes=%d fp=%q", st.Wakes, st.WakeFingerprint)
+	}
+}
+
+// TestJudgeEscapeBoundReproducesNoStall: owed, unchanged, stop_hook_active,
+// no wake: blocked, not allowed.
+func TestJudgeEscapeBoundReproducesNoStall(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	owed := owedOf(behindPR)
+	st := SessionState{Fingerprint: owed.Fingerprint(), WakeFingerprint: owed.CappedFingerprint(), Blocks: 3}
+	v := judgeAt(t, awayRec(now, false), owed, StopInput{StopHookActive: true}, st, now)
+	if !v.Block {
+		t.Fatalf("owed, unchanged, stop_hook_active, no wake: allowed (%+v)", v)
+	}
+}
+
+// TestJudgeCapRecordsStop: the block passing the cap, and one passing a cap
+// the environment raised, records the stop labelled possibly forced by the
+// cap; rows 2, 4 and 5 as work owed, row 7 as no next look.
+func TestJudgeCapRecordsStop(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	rec := awayRec(now, false)
+	owed := owedOf(behindPR)
+	seen := SessionState{Fingerprint: owed.Fingerprint(), WakeFingerprint: owed.CappedFingerprint()}
+	for _, c := range []struct {
+		cap, blocks int
+		record      bool
+	}{{0, 7, false}, {0, 8, true}, {0, 12, true}, {12, 8, false}, {12, 12, true}} {
+		st := seen
+		st.Blocks = c.blocks
+		v := judgeAt(t, rec, owed, StopInput{StopHookActive: true, Cap: c.cap}, st, now)
+		if !v.Block {
+			t.Fatalf("cap %d after %d blocks: allowed", c.cap, c.blocks)
+		}
+		if got := v.Stop != nil; got != c.record {
+			t.Errorf("cap %d after %d blocks: stop recorded %v, want %v", c.cap, c.blocks, got, c.record)
+			continue
+		}
+		if c.record && (v.Stop.Kind != StopWorkOwed || !v.Stop.PossiblyForcedByCap || !strings.Contains(v.Stop.Detail, "feat/behind")) {
+			t.Errorf("cap %d: recorded %+v", c.cap, v.Stop)
+		}
+		if c.record && v.State.State != StateStopped {
+			t.Errorf("cap %d: state %q after the cap, want stopped", c.cap, v.State.State)
+		}
+	}
+	none := Owed{}
+	st := SessionState{Fingerprint: none.Fingerprint(), WakeFingerprint: none.CappedFingerprint(), Blocks: 8}
+	v := judgeAt(t, rec, none, StopInput{StopHookActive: true}, st, now)
+	if v.Row != 7 || v.Stop == nil || v.Stop.Kind != StopNoNextLook || !v.Stop.PossiblyForcedByCap {
+		t.Errorf("row 7 past the cap: row %d stop %+v; want stopped with no next look", v.Row, v.Stop)
+	}
+}
+
+// TestCountResetsOnlyOnInactive: a change in the owed set at the sixth block
+// does not reset the count, and the ninth consecutive block still records the
+// stop; a block with stop_hook_active false sets it to one.
+func TestCountResetsOnlyOnInactive(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	s := newSequence(t, awayRec(now, false), now)
+	var v Verdict
+	for i := 1; i <= 9; i++ {
+		owed := owedOf(behindPR)
+		if i >= 6 {
+			owed = owedOf(behindPR, renewalDue)
+		}
+		v = s.stop(owed, StopInput{StopHookActive: i > 1})
+		if !v.Block || v.State.Blocks != i {
+			t.Fatalf("block %d: block %v count %d", i, v.Block, v.State.Blocks)
+		}
+		if (v.Stop != nil) != (i == 9) {
+			t.Fatalf("block %d: stop recorded %v, want only at the ninth", i, v.Stop != nil)
+		}
+	}
+	v = s.stop(owedOf(behindPR, renewalDue), StopInput{StopHookActive: false})
+	if v.State.Blocks != 1 {
+		t.Errorf("a block with stop_hook_active false leaves the count at %d, want 1", v.State.Blocks)
+	}
+}
+
+// TestPushItemReasonDefersToStandingInstruction: without --hold-pushes the
+// reason for an unpushed branch says to push if the standing instruction
+// allows, to queue only if the person has said pushes wait, and that a queued
+// push stays owed; with it, to finish the local work and then queue; neither
+// names the away mode as permission.
+func TestPushItemReasonDefersToStandingInstruction(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	owed := owedOf(unpushedBr)
+	v := judgeAt(t, awayRec(now, false), owed, StopInput{}, SessionState{}, now)
+	for _, want := range []string{"feat/unpushed", "push if your standing instruction allows", "queue only if the person has said pushes wait", "stays owed", "abcd mode queue"} {
+		if !strings.Contains(v.Reason, want) {
+			t.Errorf("without --hold-pushes the reason misses %q: %q", want, v.Reason)
+		}
+	}
+	h := judgeAt(t, awayRec(now, true), owed, StopInput{}, SessionState{}, now)
+	for _, want := range []string{"feat/unpushed", "the person has said pushes wait", "finish the local work", "then queue the push"} {
+		if !strings.Contains(h.Reason, want) {
+			t.Errorf("with --hold-pushes the reason misses %q: %q", want, h.Reason)
+		}
+	}
+	for _, r := range []string{v.Reason, h.Reason} {
+		low := strings.ToLower(r)
+		for _, bad := range []string{"away mode allows", "away mode permits", "allowed by the away mode", "you may push"} {
+			if strings.Contains(low, bad) {
+				t.Errorf("the reason names the away mode as permission (%q): %q", bad, r)
+			}
+		}
+	}
+}
+
+// TestJudgeHandBackOnlyUnderHoldPushes: the verdict accepts a hand-back only
+// of an unpushed branch's item, with its head, under --hold-pushes; any other
+// item handed back stays owed (F1, dcn-2610181035355741).
+func TestJudgeHandBackOnlyUnderHoldPushes(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	wake := StopInput{SessionCrons: crons("*/10 * * * *")}
+	handed := Owed{HandedBack: []OwedItem{unpushedBr}}
+	v := judgeAt(t, awayRec(now, true), handed, wake, SessionState{}, now)
+	if len(v.HandBacks) != 1 || v.HandBacks[0].Branch != "feat/unpushed" || v.Row != 6 {
+		t.Errorf("with --hold-pushes an unpushed item handed back: hand-backs %v row %d, want accepted and nothing owed", v.HandBacks, v.Row)
+	}
+	v = judgeAt(t, awayRec(now, false), handed, wake, SessionState{}, now)
+	if len(v.HandBacks) != 0 || !v.Block || !strings.Contains(v.Reason, "feat/unpushed") {
+		t.Errorf("without --hold-pushes: hand-backs %v block %v; want none accepted and the item still owed", v.HandBacks, v.Block)
+	}
+	for _, item := range []OwedItem{behindPR, failingPR, stackedBr, uncarried, renewalDue, {Kind: OwedUnpushed, Capped: true, Branch: "feat/nohead"}} {
+		v := judgeAt(t, awayRec(now, true), Owed{HandedBack: []OwedItem{item}}, wake, SessionState{}, now)
+		if len(v.HandBacks) != 0 || !v.Block {
+			t.Errorf("%s %s handed back under --hold-pushes: accepted %v block %v; want it kept owed", item.Kind, item.Branch, v.HandBacks, v.Block)
+		}
+	}
+}
+
+// TestDeadlineCeiling: with work owed and no reservation, now plus 30
+// minutes; with nothing owed, now plus one hour; with a renewal due sooner,
+// that minus the skew.
+func TestDeadlineCeiling(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	if got := Deadline(owedOf(behindPR), now); !got.Equal(now.Add(30 * time.Minute)) {
+		t.Errorf("owed, no reservation: %s", got)
+	}
+	if got := Deadline(Owed{}, now); !got.Equal(now.Add(time.Hour)) {
+		t.Errorf("nothing owed: %s", got)
+	}
+	soon := Owed{NextRenewal: now.Add(20 * time.Minute)}
+	if got := Deadline(soon, now); !got.Equal(now.Add(15 * time.Minute)) {
+		t.Errorf("renewal in 20 minutes: deadline %s, want 15 minutes on", got)
+	}
+	late := Owed{Items: []OwedItem{behindPR}, NextRenewal: now.Add(12 * time.Hour)}
+	if got := Deadline(late, now); !got.Equal(now.Add(30 * time.Minute)) {
+		t.Errorf("renewal in 12 hours: deadline %s, want the ceiling", got)
+	}
+}
+
+// TestQualifyingWakeDistantCron: a release reservation with a 24-hour lease
+// claimed at 20:00, and `0 7 * * *` seen at 21:00: does not qualify.
+func TestQualifyingWakeDistantCron(t *testing.T) {
+	loc := london(t)
+	claimed := at(t, "2026-10-18 20:00")
+	now := at(t, "2026-10-18 21:00")
+	owed := Owed{Items: []OwedItem{uncarried}, NextRenewal: claimed.Add(12 * time.Hour)}
+	if _, _, ok := QualifyingWake(crons("0 7 * * *"), now, Deadline(owed, now), loc); ok {
+		t.Error("0 7 * * * seen at 21:00 qualified with work owed")
+	}
+	if _, _, ok := QualifyingWake(crons("0 7 * * *"), now, Deadline(Owed{NextRenewal: owed.NextRenewal}, now), loc); ok {
+		t.Error("0 7 * * * seen at 21:00 qualified with nothing owed")
+	}
+}
+
+// TestQualifyingWakeJitter: an hourly cron whose next match is 3 minutes
+// before the deadline does not qualify; `*/5 * * * *` and `*/10 * * * *` do;
+// a one-shot at the deadline does.
+func TestQualifyingWakeJitter(t *testing.T) {
+	loc := london(t)
+	now := at(t, "2026-10-18 21:00")
+	deadline := Deadline(owedOf(behindPR), now) // 21:30
+	if _, _, ok := QualifyingWake(crons("27 * * * *"), now, deadline, loc); ok {
+		t.Error("an hourly cron at 21:27 qualified for a 21:30 deadline; it may run 30 minutes late")
+	}
+	for _, e := range []string{"*/5 * * * *", "*/10 * * * *"} {
+		if _, _, ok := QualifyingWake(crons(e), now, deadline, loc); !ok {
+			t.Errorf("%q did not qualify", e)
+		}
+	}
+	oneShot := []SessionCron{{ID: "once", Schedule: "30 21 18 10 *", Recurring: false}}
+	if _, look, ok := QualifyingWake(oneShot, now, deadline, loc); !ok || !look.Equal(deadline) {
+		t.Errorf("a one-shot at the deadline: ok %v look %s", ok, look)
+	}
+	// */5 runs on time, any other every-five-minutes form gets half its gap.
+	_, lateFive, _ := LatestFire(SessionCron{Schedule: "*/5 * * * *", Recurring: true}, now, deadline, loc)
+	if !lateFive.Equal(now.Add(5 * time.Minute)) {
+		t.Errorf("*/5 latest fire %s, want its match", lateFive)
+	}
+	_, lateTen, _ := LatestFire(SessionCron{Schedule: "*/10 * * * *", Recurring: true}, now, deadline, loc)
+	if !lateTen.Equal(now.Add(15 * time.Minute)) {
+		t.Errorf("*/10 latest fire %s, want its match plus five minutes", lateTen)
+	}
+}
+
+// TestQualifyingWakeRecurringCron: `*/30 * * * *` with nothing owed does.
+func TestQualifyingWakeRecurringCron(t *testing.T) {
+	loc := london(t)
+	now := at(t, "2026-10-18 21:05")
+	if _, look, ok := QualifyingWake(crons("*/30 * * * *"), now, Deadline(Owed{}, now), loc); !ok || !look.Equal(at(t, "2026-10-18 21:30")) {
+		t.Errorf("*/30 with nothing owed: ok %v look %s", ok, look)
+	}
+}
+
+// TestQualifyingWakeAfterLeaseLapse: a wake past the earliest renewal due
+// minus the skew does not.
+func TestQualifyingWakeAfterLeaseLapse(t *testing.T) {
+	loc := london(t)
+	now := at(t, "2026-10-18 21:00")
+	owed := Owed{Items: []OwedItem{renewalDue}, NextRenewal: now.Add(12 * time.Minute)} // deadline 21:07
+	if _, _, ok := QualifyingWake([]SessionCron{{Schedule: "10 21 * * *"}}, now, Deadline(owed, now), loc); ok {
+		t.Error("a one-shot at 21:10 qualified past a renewal due at 21:12 less the skew")
+	}
+	if _, _, ok := QualifyingWake([]SessionCron{{Schedule: "6 21 * * *"}}, now, Deadline(owed, now), loc); !ok {
+		t.Error("a one-shot at 21:06 did not qualify before 21:07")
+	}
+}
+
+// TestBackgroundTaskNotAWake: a shell task running `sleep 36000` or a
+// `tail -f` does not count.
+func TestBackgroundTaskNotAWake(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	owed := owedOf(behindPR)
+	st := SessionState{Fingerprint: owed.Fingerprint(), WakeFingerprint: owed.CappedFingerprint()}
+	in := StopInput{BackgroundTasks: []BackgroundTask{
+		{ID: "t1", Type: "shell", Status: "running", Command: "sleep 36000"},
+		{ID: "t2", Type: "shell", Status: "running", Command: "tail -f /var/log/syslog"},
+	}}
+	if v := judgeAt(t, awayRec(now, false), owed, in, st, now); !v.Block || v.Row != 5 {
+		t.Errorf("background tasks counted as a wake: row %d block %v", v.Row, v.Block)
+	}
+	none := Owed{}
+	st = SessionState{Fingerprint: none.Fingerprint(), WakeFingerprint: none.CappedFingerprint()}
+	if v := judgeAt(t, awayRec(now, false), none, in, st, now); !v.Block || v.Row != 7 {
+		t.Errorf("background tasks counted as a wake with nothing owed: row %d", v.Row)
+	}
+}
+
+// TestNextLookStored: a waiting verdict keeps the wake's next fire time as
+// the next look.
+func TestNextLookStored(t *testing.T) {
+	now := at(t, "2026-10-18 21:01")
+	s := newSequence(t, awayRec(now, false), now)
+	none := Owed{}
+	v := s.stop(none, StopInput{SessionCrons: crons("*/10 * * * *")})
+	if v.Block || v.State.State != StateWaiting || !v.State.NextLook.Equal(at(t, "2026-10-18 21:10")) {
+		t.Fatalf("waiting verdict: %+v", v.State)
+	}
+	st, _ := LoadSession(s.root, s.id)
+	if !st.NextLook.Equal(at(t, "2026-10-18 21:10")) || st.State != StateWaiting {
+		t.Errorf("state file: next look %s state %q", st.NextLook, st.State)
+	}
+}
+
+// TestProseQuestionBlockedOnce: a last message ending on a question is
+// blocked once; the same message again goes on to the other rows.
+func TestProseQuestionBlockedOnce(t *testing.T) {
+	now := at(t, "2026-10-18 21:01")
+	s := newSequence(t, awayRec(now, false), now)
+	in := StopInput{LastAssistantMessage: "Should I rebase onto main?  \n\n", SessionCrons: crons("*/10 * * * *")}
+	if v := s.stop(Owed{}, in); v.Row != 1 || !v.Block {
+		t.Fatalf("first: row %d", v.Row)
+	}
+	in.StopHookActive = true
+	if v := s.stop(Owed{}, in); v.Row == 1 {
+		t.Errorf("the same question was blocked twice")
+	}
+	in.LastAssistantMessage = "I merged it. Is CI green? I'll check.\n"
+	if v := s.stop(Owed{}, in); v.Row == 1 {
+		t.Errorf("a message not ending on a question line was blocked as one")
+	}
+	in.LastAssistantMessage = "Next question:\nwhich base should it use?"
+	if v := s.stop(Owed{}, in); v.Row != 1 {
+		t.Errorf("a new question was not blocked: row %d", v.Row)
+	}
+}
+
+// TestNothingOwedReason names taking the next ready item first.
+func TestNothingOwedReason(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	v := judgeAt(t, awayRec(now, false), Owed{}, StopInput{}, SessionState{}, now)
+	if v.Row != 7 || !strings.Contains(v.Reason, "take the next ready item first") || !strings.Contains(v.Reason, "abcd reserve") {
+		t.Errorf("row %d reason %q", v.Row, v.Reason)
+	}
+	if strings.Index(v.Reason, "next ready item") > strings.Index(v.Reason, "schedule a look") {
+		t.Errorf("the reason offers the look before the next item: %q", v.Reason)
+	}
+}
+
+// TestSessionIDShape: a session id outside [A-Za-z0-9_-]{1,128} is refused.
+func TestSessionIDShape(t *testing.T) {
+	root := t.TempDir()
+	for _, ok := range []string{"a", "abc-DEF_123", strings.Repeat("x", 128), "0b9c1d2e-aaaa-bbbb-cccc-0123456789ab"} {
+		if !ValidSessionID(ok) {
+			t.Errorf("%q refused", ok)
+		}
+		if err := SaveSession(root, ok, SessionState{State: StateWorking}); err != nil {
+			t.Errorf("SaveSession(%q): %v", ok, err)
+		}
+	}
+	for _, bad := range []string{"", "../x", "a/b", "a.b", strings.Repeat("x", 129), "a b", "x\n"} {
+		if ValidSessionID(bad) {
+			t.Errorf("%q accepted", bad)
+		}
+		if err := SaveSession(root, bad, SessionState{}); err == nil {
+			t.Errorf("SaveSession(%q) wrote", bad)
+		}
+		if _, err := LoadSession(root, bad); err == nil {
+			t.Errorf("LoadSession(%q) read", bad)
+		}
+	}
+	p, _ := SessionStatePath(root, "abc")
+	if want := filepath.Join(root, ".abcd", ".work.local", "autonomy", "sessions", "abc.json"); p != want {
+		t.Errorf("state path %s, want %s", p, want)
+	}
+}
diff --git a/internal/core/autonomy/owed.go b/internal/core/autonomy/owed.go
index 19b8f83db9..5d4d7f1868 100644
--- a/internal/core/autonomy/owed.go
+++ b/internal/core/autonomy/owed.go
@@ -6,6 +6,7 @@ import (
 	"sort"
 	"strconv"
 	"strings"
+	"time"
 )
 
 // OwedKind is one of the four kinds of owed work, the reservation kind split
@@ -76,6 +77,16 @@ type Owed struct {
 	// Notes say what was not read and how the set was judged instead, such
 	// as pull requests not read when the forge listing failed.
 	Notes []string `json:"notes,omitempty"`
+	// NextRenewal is the earliest renewal due among the live reservations
+	// under this copy's key, due or not yet; zero when there is none. The
+	// stop verdict's deadline is it less lease.Skew, when that is sooner than
+	// the ceiling (dcn-2610181003455731).
+	NextRenewal time.Time `json:"next_renewal,omitempty"`
+	// HandedBack are the items a queued step handed back this check, taken
+	// out of Items by the reader (dcn-2610181035355741). The verdict accepts
+	// only an unpushed branch's item, with its head, under --hold-pushes,
+	// and puts any other back among the owed items.
+	HandedBack []OwedItem `json:"handed_back,omitempty"`
 }
 
 // Empty reports whether nothing is owed.
diff --git a/internal/core/autonomy/session_state.go b/internal/core/autonomy/session_state.go
new file mode 100644
index 0000000000..0c48623a13
--- /dev/null
+++ b/internal/core/autonomy/session_state.go
@@ -0,0 +1,107 @@
+package autonomy
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"os"
+	"path"
+	"path/filepath"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/core/mode"
+	"github.com/intentdriven/abcd/internal/fsutil"
+)
+
+// SessionsDir is the session-state folder below a working copy's root: one
+// file per session id, in the copy's local tier.
+const SessionsDir = mode.TierRelPath + "/autonomy/sessions"
+
+// SessionState is one session's stop-check state, kept between hook runs in
+// SessionsDir/<session-id>.json.
+type SessionState struct {
+	SchemaVersion int `json:"schema_version"`
+	// State is working, waiting or stopped, as the last verdict left it.
+	State string `json:"state,omitempty"`
+	// NextLook is the qualifying wake's next fire time while waiting.
+	NextLook time.Time `json:"next_look,omitempty"`
+	// Fingerprint is the owed set's at the last check (Owed.Fingerprint).
+	Fingerprint string `json:"fingerprint,omitempty"`
+	// QuestionHash is the last prose question blocked, hashed.
+	QuestionHash string `json:"question_hash,omitempty"`
+	// Blocks is the count of consecutive blocks, which stop_hook_active alone
+	// drives (dcn-2610181003484631).
+	Blocks int `json:"blocks"`
+	// Wakes is how many times in a row a wake released an unchanged set of
+	// capped items, and WakeFingerprint those items' fingerprint
+	// (dcn-2610181035361997).
+	Wakes           int    `json:"wakes"`
+	WakeFingerprint string `json:"wake_fingerprint,omitempty"`
+}
+
+// SessionStatePath is the session's state file below the working copy at
+// copyRoot; an id outside [A-Za-z0-9_-]{1,128} is ErrSessionID.
+func SessionStatePath(copyRoot, sessionID string) (string, error) {
+	if !ValidSessionID(sessionID) {
+		return "", ErrSessionID
+	}
+	return filepath.Join(copyRoot, filepath.FromSlash(SessionsDir), sessionID+".json"), nil
+}
+
+// LoadSession reads the session's state below copyRoot, through an os.Root at
+// copyRoot so nothing outside the copy is read; an absent file is the zero
+// state. A file over MaxFileBytes, or one that does not parse, is an error.
+func LoadSession(copyRoot, sessionID string) (SessionState, error) {
+	if !ValidSessionID(sessionID) {
+		return SessionState{}, ErrSessionID
+	}
+	root, err := os.OpenRoot(copyRoot)
+	if err != nil {
+		return SessionState{}, err
+	}
+	defer root.Close()
+	f, err := root.Open(path.Join(SessionsDir, sessionID+".json"))
+	if errors.Is(err, fs.ErrNotExist) {
+		return SessionState{SchemaVersion: SchemaVersion}, nil
+	}
+	if err != nil {
+		return SessionState{}, err
+	}
+	defer f.Close()
+	raw, err := io.ReadAll(io.LimitReader(f, MaxFileBytes+1))
+	if err != nil {
+		return SessionState{}, err
+	}
+	if len(raw) > MaxFileBytes {
+		return SessionState{}, fmt.Errorf("the session state %s is over %d KiB", sessionID, MaxFileBytes>>10)
+	}
+	var st SessionState
+	if err := json.Unmarshal(raw, &st); err != nil || st.SchemaVersion != SchemaVersion {
+		return SessionState{}, fmt.Errorf("the session state %s does not parse", sessionID)
+	}
+	return st, nil
+}
+
+// SaveSession writes the session's state below copyRoot through fsutil's
+// atomic writer, making the folders owner-only on the way.
+func SaveSession(copyRoot, sessionID string, st SessionState) error {
+	if !ValidSessionID(sessionID) {
+		return ErrSessionID
+	}
+	root, err := os.OpenRoot(copyRoot)
+	if err != nil {
+		return err
+	}
+	defer root.Close()
+	if err := root.MkdirAll(SessionsDir, 0o700); err != nil {
+		return err
+	}
+	st.SchemaVersion = SchemaVersion
+	raw, err := json.MarshalIndent(st, "", "  ")
+	if err != nil {
+		return err
+	}
+	return fsutil.WriteFileAtomicInRoot(root, path.Join(SessionsDir, sessionID+".json"), append(raw, '\n'), 0o600)
+}
diff --git a/internal/core/autonomy/wake.go b/internal/core/autonomy/wake.go
new file mode 100644
index 0000000000..28fe6020a6
--- /dev/null
+++ b/internal/core/autonomy/wake.go
@@ -0,0 +1,103 @@
+package autonomy
+
+import (
+	"time"
+
+	"github.com/intentdriven/abcd/internal/core/lease"
+)
+
+const (
+	// OwedCeiling is the furthest a qualifying wake may fire while work is
+	// owed: a session with owed work waits half an hour at most.
+	OwedCeiling = 30 * time.Minute
+	// IdleCeiling is the furthest a qualifying wake may fire while nothing
+	// is owed.
+	IdleCeiling = time.Hour
+	// MaxLateness is the most the host runs a recurring task late: half the
+	// gap to its following run, at most this.
+	MaxLateness = 30 * time.Minute
+)
+
+// SessionCron is one of the host's scheduled tasks for the session, as the
+// Stop payload's session_crons carries it.
+type SessionCron struct {
+	ID        string `json:"id"`
+	Schedule  string `json:"schedule"`
+	Recurring bool   `json:"recurring"`
+	Prompt    string `json:"prompt"`
+}
+
+// BackgroundTask is one in-flight task the Stop payload's background_tasks
+// carries. A background task is never a wake on its own while away: a
+// `sleep 36000` or a `tail -f` would otherwise hold a session idle.
+type BackgroundTask struct {
+	ID          string `json:"id"`
+	Type        string `json:"type"`
+	Status      string `json:"status"`
+	Description string `json:"description,omitempty"`
+	Command     string `json:"command,omitempty"`
+}
+
+// Deadline is the latest a wake may fire for the stop to wait on it: the
+// earlier of the earliest renewal due among the live reservations under this
+// copy's key less lease.Skew, and now plus a ceiling, OwedCeiling while work
+// is owed and IdleCeiling when none is (dcn-2610181003455731).
+func Deadline(owed Owed, now time.Time) time.Time {
+	ceiling := IdleCeiling
+	if !owed.Empty() {
+		ceiling = OwedCeiling
+	}
+	d := now.Add(ceiling)
+	if !owed.NextRenewal.IsZero() {
+		if r := owed.NextRenewal.Add(-lease.Skew); r.Before(d) {
+			d = r
+		}
+	}
+	return d
+}
+
+// LatestFire is a task's next match after now, no later than deadline, and
+// the latest the host may run it: for a recurring task the match plus half
+// the gap to the following match, at most MaxLateness, and nothing for
+// exactly `*/5 * * * *`; a one-shot task is taken as matched, since the host
+// only ever runs one early. ok is false for an expression abcd cannot parse
+// or one with no match by the deadline.
+func LatestFire(c SessionCron, now, deadline time.Time, loc *time.Location) (match, latest time.Time, ok bool) {
+	cr, err := ParseCron(c.Schedule)
+	if err != nil {
+		return time.Time{}, time.Time{}, false
+	}
+	match, ok = cr.Next(now, deadline, loc)
+	if !ok {
+		return time.Time{}, time.Time{}, false
+	}
+	if !c.Recurring || cr.everyFive {
+		return match, match, true
+	}
+	late := MaxLateness
+	if following, found := cr.Next(match, deadline.Add(time.Hour), loc); found {
+		if half := following.Sub(match) / 2; half < late {
+			late = half
+		}
+	}
+	return match, match.Add(late), true
+}
+
+// QualifyingWake is the task whose latest fire time is no later than
+// deadline, the earliest-matching of them, and its next match, the session's
+// next look. ok is false when none qualifies.
+func QualifyingWake(crons []SessionCron, now, deadline time.Time, loc *time.Location) (SessionCron, time.Time, bool) {
+	var best SessionCron
+	var look time.Time
+	found := false
+	for _, c := range crons {
+		match, latest, ok := LatestFire(c, now, deadline, loc)
+		if !ok || latest.After(deadline) {
+			continue
+		}
+		if !found || match.Before(look) {
+			best, look, found = c, match, true
+		}
+	}
+	return best, look, found
+}

From 2d27610df5e043ff0daa7a53527ba5e68c27b8bc Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 12:55:33 +0100
Subject: [PATCH 16/58] feat: refuse every question while the person is away,
 routed by the act

While the away record holds, the guard's question gate refuses every
call to the host's question tool before any other check, abcd's or
another tool's, chipped or not, with one reason: an act only the person
may approve is queued with abcd mode queue, and every other question is
decided and recorded with abcd decide. No mode is set from a chip and
nothing is marked open. The list and the route live in
autonomy.PersonOnlyActs and autonomy.QuestionRoute, so the away block
and the stop check can repeat the same text. An away record the store
refuses reads as not away, and the hook says so with exit 1.

Refs: itd-2610180912189125
Assisted-by: Claude:claude-opus-5-5
---
 docs/reference/cli/commands.md                |   6 +-
 internal/core/autonomy/question.go            |  58 +++++
 internal/core/autonomy/question_test.go       |  67 +++++
 internal/surface/cli/guard.go                 |   6 +-
 internal/surface/cli/guard_question.go        |  86 ++++++-
 .../surface/cli/guard_question_away_test.go   | 239 ++++++++++++++++++
 6 files changed, 456 insertions(+), 6 deletions(-)
 create mode 100644 internal/core/autonomy/question.go
 create mode 100644 internal/core/autonomy/question_test.go
 create mode 100644 internal/surface/cli/guard_question_away_test.go

diff --git a/docs/reference/cli/commands.md b/docs/reference/cli/commands.md
index 3e8a18eda8..a4e06cc5ea 100644
--- a/docs/reference/cli/commands.md
+++ b/docs/reference/cli/commands.md
@@ -1873,7 +1873,11 @@ product-thinker, Tech and Setup to facilitator), so it is never refused on
 the mode, and the question is marked open in the local tier; the answer
 resets the mode to managed, from `abcd hook question-answered` on the
 question tool's PostToolUse or else on the next human message. A questions
-field the hook cannot read lets the question run and warns loudly.
+field the hook cannot read lets the question run and warns loudly. While
+the away mode holds (`abcd mode autonomous`), every question is refused
+first, whatever its chip, with one reason that routes it by the act it asks
+about: an act only the person may approve to `abcd mode queue`, every other
+question to `abcd decide`; no mode is set and nothing is marked open.
 
 ### `abcd help`
 
diff --git a/internal/core/autonomy/question.go b/internal/core/autonomy/question.go
new file mode 100644
index 0000000000..28e68970d6
--- /dev/null
+++ b/internal/core/autonomy/question.go
@@ -0,0 +1,58 @@
+package autonomy
+
+import "strings"
+
+// The question reroute (spc-2610180914469489, "The question reroute";
+// dcn-2610180937177502, dcn-2610181003477194, dcn-2610181016510153).
+//
+// While the away record holds, no question waits for the person: the guard
+// refuses every call to the host's question tool, whatever its chip, and its
+// reason routes the question by the act it asks about. An act only the person
+// may approve is queued for their return with `abcd mode queue`; every other
+// question is decided and recorded with `abcd decide`. Nothing detects the act
+// mechanically: the agent classifies its own question from the list, and the
+// guard's registry entries enforce only what they name. The text lives here,
+// beside the record, so every front door that repeats the list (the guard's
+// refusal, the away block, the stop check's refusal of a question asked in
+// prose) says the same thing.
+
+// personOnlyActs are the acts only the person may approve, in the spec's
+// order, each one line, the catch-all last.
+var personOnlyActs = []string{
+	"an embargo close's `--approve <digest>`, passed only after the person has read the text and said yes in their own session: never supply it on your own",
+	"the embargo triage verdict, which is the person's decision",
+	"the drain's hand-back, which is a person's decision",
+	"the confirmed apply verb for remote configuration",
+	"a release sign-off: a cut, or a step of one, that asks for the person by name, or that no standing instruction of theirs allows (a standing permission for automatic cuts stands, and the away mode adds none)",
+	"pushing, opening or merging a pull request without a standing instruction of the person's that allows it: the away mode is never that instruction",
+	"publishing anything, changing a repository's visibility, or posting a comment or message outward, other than a pull request a standing instruction allows",
+	"adding a dependency",
+	"a secret, a credential or an App",
+	"a step only a website or a browser can do",
+	"a destructive act: deleting what the session did not create, overwriting uncommitted work, a force push, discarding a peer's work",
+	"anything that spends money",
+	"any other act a command page or a brief invariant names as the person's",
+}
+
+// PersonOnlyActs are the acts only the person may approve, which a session
+// queues with `abcd mode queue` while the person is away instead of asking:
+// one line each, the catch-all last. The slice is a copy.
+func PersonOnlyActs() []string {
+	return append([]string(nil), personOnlyActs...)
+}
+
+// QuestionRoute is how a question is routed while the person is away, one
+// line each: the queue route and the person-only acts, then the decide route
+// for every other question, then that nothing detects the act and the away
+// mode grants nothing. A front door puts its own head line above it.
+func QuestionRoute() string {
+	var b strings.Builder
+	b.WriteString("Route the question by the act it asks about, not by its chip.\n")
+	b.WriteString("Queue it with `abcd mode queue \"<step>\"` for the person's return, and carry on with other work, when it asks about an act only the person may approve:\n")
+	for _, a := range personOnlyActs {
+		b.WriteString("- " + a + ";\n")
+	}
+	b.WriteString("Decide every other question yourself, product and technical alike, and record it with `abcd decide \"<text>\"`, with its grounds and how to reverse it; then carry on.\n")
+	b.WriteString("Nothing detects the act for you: classify your own question from this list. The away mode grants no rights, so it never allows an act on the list.")
+	return b.String()
+}
diff --git a/internal/core/autonomy/question_test.go b/internal/core/autonomy/question_test.go
new file mode 100644
index 0000000000..f1bed2e0bb
--- /dev/null
+++ b/internal/core/autonomy/question_test.go
@@ -0,0 +1,67 @@
+package autonomy
+
+import (
+	"strings"
+	"testing"
+)
+
+// TestAwayReasonListsPersonOnlyActs (spc-2610180914469489, step 6): the
+// reroute's reason names every act only the person may approve, each a
+// phrase the spec's list carries, says that the away mode is no standing
+// instruction, sends those acts to `abcd mode queue` and every other question
+// to `abcd decide`, and says nothing detects the act mechanically.
+func TestAwayReasonListsPersonOnlyActs(t *testing.T) {
+	route := QuestionRoute()
+	for _, want := range []struct{ what, phrase string }{
+		{"the embargo --approve digest", "--approve <digest>"},
+		{"the digest is never supplied on the agent's own", "never supply it on your own"},
+		{"the embargo triage verdict", "embargo triage verdict"},
+		{"the drain's hand-back", "drain's hand-back"},
+		{"the remote-configuration apply verb", "apply verb for remote configuration"},
+		{"a release sign-off", "a release sign-off"},
+		{"what a release sign-off means", "asks for the person by name, or that no standing instruction of theirs allows"},
+		{"a standing permission for automatic cuts stands", "standing permission for automatic cuts stands"},
+		{"pushing, opening or merging a pull request", "pushing, opening or merging a pull request without a standing instruction"},
+		{"the away mode is no standing instruction", "the away mode is never that instruction"},
+		{"publishing and visibility", "publishing anything, changing a repository's visibility"},
+		{"an outward comment or message", "posting a comment or message outward"},
+		{"a new dependency", "adding a dependency"},
+		{"secrets and Apps", "a secret, a credential or an App"},
+		{"a website step", "only a website or a browser can do"},
+		{"a destructive act", "a destructive act"},
+		{"a force push", "a force push"},
+		{"a peer's work", "discarding a peer's work"},
+		{"spending", "spends money"},
+		{"the catch-all", "any other act a command page or a brief invariant names as the person's"},
+		{"the queue route", "abcd mode queue \"<step>\""},
+		{"carrying on meanwhile", "carry on with other work"},
+		{"the decide route", "abcd decide"},
+		{"grounds and how to reverse it", "its grounds and how to reverse it"},
+		{"nothing detects the act", "Nothing detects the act"},
+		{"the mode grants nothing", "grants no rights"},
+	} {
+		if !strings.Contains(route, want.phrase) {
+			t.Errorf("the reason does not name %s (%q):\n%s", want.what, want.phrase, route)
+		}
+	}
+	acts := PersonOnlyActs()
+	if len(acts) == 0 {
+		t.Fatal("PersonOnlyActs is empty")
+	}
+	for _, a := range acts {
+		if !strings.Contains(route, a) {
+			t.Errorf("the reason leaves out the act %q", a)
+		}
+		if strings.Contains(a, "\n") {
+			t.Errorf("an act runs over one line: %q", a)
+		}
+	}
+	if last := acts[len(acts)-1]; !strings.Contains(last, "any other act") {
+		t.Errorf("the list does not end on the catch-all: %q", last)
+	}
+	// The queue route comes before the decide route, so the agent reads
+	// which acts are the person's before it reads that it decides the rest.
+	if q, d := strings.Index(route, "abcd mode queue"), strings.Index(route, "abcd decide"); q < 0 || d < 0 || q > d {
+		t.Errorf("the queue route (at %d) does not come before the decide route (at %d)", q, d)
+	}
+}
diff --git a/internal/surface/cli/guard.go b/internal/surface/cli/guard.go
index af0760cdc7..9172bc8abd 100644
--- a/internal/surface/cli/guard.go
+++ b/internal/surface/cli/guard.go
@@ -274,7 +274,11 @@ func newGuardHookCommand() *cobra.Command {
 			"the mode, and the question is marked open in the local tier; the answer\n" +
 			"resets the mode to managed, from `abcd hook question-answered` on the\n" +
 			"question tool's PostToolUse or else on the next human message. A questions\n" +
-			"field the hook cannot read lets the question run and warns loudly.",
+			"field the hook cannot read lets the question run and warns loudly. While\n" +
+			"the away mode holds (`abcd mode autonomous`), every question is refused\n" +
+			"first, whatever its chip, with one reason that routes it by the act it asks\n" +
+			"about: an act only the person may approve to `abcd mode queue`, every other\n" +
+			"question to `abcd decide`; no mode is set and nothing is marked open.",
 		Args: cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, _ []string) error {
 			return answerGuardHook(cmd, guardHookDecide)
diff --git a/internal/surface/cli/guard_question.go b/internal/surface/cli/guard_question.go
index 160009f119..daef2498b1 100644
--- a/internal/surface/cli/guard_question.go
+++ b/internal/surface/cli/guard_question.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 
 	"github.com/intentdriven/abcd/internal/core/ahoy"
+	"github.com/intentdriven/abcd/internal/core/autonomy"
 	"github.com/intentdriven/abcd/internal/core/mode"
 	"github.com/intentdriven/abcd/internal/core/question"
 	"github.com/intentdriven/abcd/internal/gitutil"
@@ -27,7 +28,9 @@ import (
 // tool's PostToolUse hook runs the reset when the answer comes back, and the
 // prompt hook runs the same reset on the next human message, for a host that
 // does not run PostToolUse. Another tool's question is none of this file's
-// business and runs unchecked.
+// business and runs unchecked, except while the person is away
+// (spc-2610180914469489): then every question is refused, routed by its act
+// to `abcd mode queue` or `abcd decide`.
 //
 // This file is the whole of the feature on the front-door side. The guard's
 // own hook calls questionGate once, before its shell-command path, and touches
@@ -56,9 +59,16 @@ func isQuestionTool(name string) bool {
 // question whose only finding is the rows limit is admitted with a note for
 // the agent (rowsNote).
 //
-// The order is the spec's. First the questions are decoded; a field the check
-// cannot read is not a decision, so the question runs on the loud, non-blocking
-// status. Then the gate decides whether the question is abcd's: a header in
+// The away record is read first (spc-2610180914469489, "The question
+// reroute"). While it holds, every question-tool call is refused with one
+// reason, abcd's question or another tool's, chipped or not, readable or not
+// (awayQuestionRefusal): the person is not there to answer, and the reason
+// routes the question by the act it asks about. Nothing past that point runs,
+// so no mode is set from a chip and no question is marked open while away.
+//
+// While the person is present the order is the spec's. First the questions
+// are decoded; a field the check cannot read is not a decision, so the
+// question runs on the loud, non-blocking status. Then the gate decides whether the question is abcd's: a header in
 // abcd's chip grammar, which only abcd's interview pages are taught to write,
 // or a mode naming somebody, which only abcd's mode verb and this gate set
 // (itd-201 decision 10). Anything else is another tool's question and runs,
@@ -77,6 +87,74 @@ func isQuestionTool(name string) bool {
 // read or write is not a decision: the question runs and the gate says so, the
 // guard's fail-open-loud contract.
 func questionGate(cmd *cobra.Command, cwd string, raw json.RawMessage) error {
+	away, unread := awayAtQuestion(cwd)
+	if away {
+		return denyCall(awayQuestionRefusal())
+	}
+	if unread == nil {
+		return presentQuestionGate(cmd, cwd, raw)
+	}
+	// The away record could not be read safely, so it reads as not away and
+	// the question is checked as if the person were present. Said on stderr,
+	// and kept loud: an admitted question exits 1, which the host shows,
+	// unless the gate already answered on stdout, whose note exit 1 would
+	// drop. A deny folds the line into its reason.
+	fmt.Fprintf(cmd.ErrOrStderr(), "abcd guard: the away record was not read (%s), so it reads as not away and the question is checked as if the person were present.\n",
+		termsafe.Sanitize(scrubPaths(unread)))
+	out := &wroteWriter{w: cmd.OutOrStdout()}
+	cmd.SetOut(out)
+	err := presentQuestionGate(cmd, cwd, raw)
+	cmd.SetOut(out.w)
+	if err == nil && !out.wrote {
+		return &exitError{Code: 1}
+	}
+	return err
+}
+
+// awayAtQuestion reads whether the person is away for the repository holding
+// cwd (spc-2610180914469489, "The question reroute"). It fails open: outside
+// a checkout, in a repository with no root commit, or with no home, nobody is
+// away and nothing is said; a record or lock the store refuses reads as not
+// away, and is returned for the one line the gate writes.
+func awayAtQuestion(cwd string) (away bool, unread error) {
+	root, err := mode.Root(cwd)
+	if err != nil {
+		return false, nil
+	}
+	_, holds, err := autonomy.AwayAt(root, autonomy.Options{})
+	if err != nil {
+		if errors.Is(err, autonomy.ErrUnsafe) {
+			return false, err
+		}
+		return false, nil
+	}
+	return holds, nil
+}
+
+// awayQuestionRefusal is the one reason every question gets while the person
+// is away, whatever its chip and whoever wrote it (dcn-2610180937177502): a
+// head line saying why, then the route by the act (autonomy.QuestionRoute).
+// It names none of the asking rules, so the agent reroutes the question
+// rather than redrafting it.
+func awayQuestionRefusal() string {
+	return "Blocked by the abcd guard (question tool): the person is away (abcd mode autonomous), so no question is put to them, whatever its chip and whoever wrote it.\n" +
+		autonomy.QuestionRoute()
+}
+
+// wroteWriter records whether anything was written through it.
+type wroteWriter struct {
+	w     io.Writer
+	wrote bool
+}
+
+func (o *wroteWriter) Write(p []byte) (int, error) {
+	o.wrote = o.wrote || len(p) > 0
+	return o.w.Write(p)
+}
+
+// presentQuestionGate is the gate while the person is present: everything
+// questionGate's comment describes after the away check.
+func presentQuestionGate(cmd *cobra.Command, cwd string, raw json.RawMessage) error {
 	stderr := cmd.ErrOrStderr()
 	fields, err := decodeQuestions(raw)
 	if err != nil {
diff --git a/internal/surface/cli/guard_question_away_test.go b/internal/surface/cli/guard_question_away_test.go
new file mode 100644
index 0000000000..27285c853b
--- /dev/null
+++ b/internal/surface/cli/guard_question_away_test.go
@@ -0,0 +1,239 @@
+package cli
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/core/autonomy"
+	"github.com/intentdriven/abcd/internal/core/mode"
+)
+
+// The question reroute (spc-2610180914469489, step 6): while the away record
+// holds, the guard hook refuses every call to the host's question tool with
+// one reason whatever the chip, and the reason routes the question by the act
+// it asks about.
+
+// setAwayHere sets the away mode from the checkout the process stands in,
+// through the verb, as a person or a session on their word would.
+func setAwayHere(t *testing.T) {
+	t.Helper()
+	if _, stderr, err := runSplit(t, "", "mode", "autonomous"); err != nil {
+		t.Fatalf("mode autonomous: %v\n%s", err, stderr)
+	}
+}
+
+// modeFile is the badge's store file in the checkout at root.
+func modeFile(root string) string {
+	return filepath.Join(root, filepath.FromSlash(mode.FileRelPath))
+}
+
+// TestAwayQuestionDeniedOneReason: while the person is away, a Product-chip,
+// a Tech-chip, a Setup-chip and an unchipped question, another tool's (one
+// that would break abcd's rules among them), a questions field the check
+// cannot read, and a question asked from a sibling worktree of the same
+// repository are each refused with the host's deny, and every refusal gives
+// the same reason, which carries the person-only act list.
+func TestAwayQuestionDeniedOneReason(t *testing.T) {
+	foreign := hostQuestion{
+		Header:   "Pick a theme",
+		Question: "Which theme?",
+		Options:  []hostOption{{Label: "Dark (Recommended)"}, {Label: "Light"}},
+	}
+	unchipped := wellBuilt()
+	unchipped.Header = "Label"
+	cases := []struct {
+		name    string
+		before  mode.State // the badge before the mode was set
+		sibling bool       // asked from a sibling worktree
+		payload func(t *testing.T, cwd string) string
+	}{
+		{name: "product chip", payload: func(t *testing.T, cwd string) string { return chipCall(t, cwd, "Product Q1") }},
+		{name: "tech chip", payload: func(t *testing.T, cwd string) string { return chipCall(t, cwd, "Tech Q3") }},
+		{name: "setup chip", payload: func(t *testing.T, cwd string) string { return chipCall(t, cwd, "Setup Q1/4") }},
+		{name: "unchipped, the badge naming the facilitator", before: mode.Facilitator,
+			payload: func(t *testing.T, cwd string) string { return askPayload(t, cwd, unchipped) }},
+		{name: "another tool's", payload: func(t *testing.T, cwd string) string { return askPayload(t, cwd, foreign) }},
+		{name: "unreadable questions field", payload: func(t *testing.T, cwd string) string {
+			return askToolPayload(t, cwd, map[string]any{"questions": 5})
+		}},
+		{name: "from a sibling worktree", sibling: true,
+			payload: func(t *testing.T, cwd string) string { return chipCall(t, cwd, "Product Q1") }},
+	}
+	var first string
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			root := awayCheckout(t)
+			if tc.before != "" {
+				setMode(t, root, tc.before)
+			}
+			setAwayHere(t)
+			cwd := root
+			if tc.sibling {
+				cwd = filepath.Join(t.TempDir(), "sibling")
+				gitAt(t, root, "worktree", "add", "-q", "-b", "feat/sibling", cwd)
+				cwd = realPath(t, cwd)
+				t.Chdir(cwd)
+			}
+			reason := hookDenyOf(t, tc.payload(t, cwd))
+			if first == "" {
+				first = reason
+			} else if reason != first {
+				t.Errorf("the reason differs from the first case's:\n got %q\nwant %q", reason, first)
+			}
+			if !strings.Contains(reason, "the person is away") {
+				t.Errorf("the reason does not say the person is away:\n%s", reason)
+			}
+			for _, act := range autonomy.PersonOnlyActs() {
+				if !strings.Contains(reason, act) {
+					t.Errorf("the reason leaves out the person-only act %q", act)
+				}
+			}
+			if strings.Contains(reason, "asking rules") {
+				t.Errorf("an away refusal names the asking rules, so the agent would redraft instead of rerouting:\n%s", reason)
+			}
+		})
+	}
+}
+
+// runGuardTriple is runGuard on the guard hook.
+func runGuardTriple(payload string) (string, string, int) {
+	return runGuard(payload, "guard", "hook")
+}
+
+// hookDenyOf runs the guard hook on payload, asserts it denied the call, and
+// returns the reason.
+func hookDenyOf(t *testing.T, payload string) string {
+	t.Helper()
+	stdout, stderr, code := runGuardTriple(payload)
+	return mustDeny(t, stdout, stderr, code)
+}
+
+// TestAwayQuestionSetsNoMode: a question refused while away sets no mode and
+// writes no marker. The badge stays as it was (absent, or the person an
+// earlier stop named), the question is not marked open, and the away record
+// is untouched, so the chip-set path is never reached while away.
+func TestAwayQuestionSetsNoMode(t *testing.T) {
+	for _, before := range []mode.State{"", mode.Facilitator} {
+		t.Run("badge "+string(before), func(t *testing.T) {
+			root := awayCheckout(t)
+			if before != "" {
+				setMode(t, root, before)
+			}
+			setAwayHere(t)
+			modeBefore, modeErrBefore := os.ReadFile(modeFile(root))
+			recBefore, err := os.ReadFile(awayStore(t, root).RecordPath())
+			if err != nil {
+				t.Fatal(err)
+			}
+			hookDenyOf(t, chipCall(t, root, "Product Q1"))
+
+			modeAfter, modeErrAfter := os.ReadFile(modeFile(root))
+			if string(modeAfter) != string(modeBefore) || (modeErrBefore == nil) != (modeErrAfter == nil) {
+				t.Errorf("the badge's store changed: before %q (%v), after %q (%v)", modeBefore, modeErrBefore, modeAfter, modeErrAfter)
+			}
+			if markedOpen(t, root) {
+				t.Error("a question refused while away was marked open")
+			}
+			recAfter, err := os.ReadFile(awayStore(t, root).RecordPath())
+			if err != nil {
+				t.Fatal(err)
+			}
+			if string(recAfter) != string(recBefore) {
+				t.Errorf("the away record changed on a refused question:\n before %s\n after %s", recBefore, recAfter)
+			}
+		})
+	}
+}
+
+// TestPresentQuestionGateUnchanged: while the person is present (no record,
+// a record ended with `abcd mode back`, or one whose time has passed) the
+// gate is what it was: a chipped question is admitted silently, sets the
+// badge from its chip and is marked open; another tool's question runs
+// unchecked; and a question that breaks abcd's rules is refused on them.
+func TestPresentQuestionGateUnchanged(t *testing.T) {
+	broken := wellBuilt()
+	broken.Options[0].Label = "Role and number (Recommended)"
+	foreign := hostQuestion{
+		Header:   "Pick a theme",
+		Question: "Which theme?",
+		Options:  []hostOption{{Label: "Dark (Recommended)"}, {Label: "Light"}},
+	}
+	for _, present := range []struct {
+		name string
+		make func(t *testing.T, root string)
+	}{
+		{"no record", func(*testing.T, string) {}},
+		{"ended with mode back", func(t *testing.T, root string) {
+			setAwayHere(t)
+			if _, stderr, err := runSplit(t, "", "mode", "back"); err != nil {
+				t.Fatalf("mode back: %v\n%s", err, stderr)
+			}
+		}},
+		{"lapsed", func(t *testing.T, root string) {
+			past := time.Now().Add(-8 * 24 * time.Hour)
+			if _, err := autonomy.SetAway(root, "", false, autonomy.Options{Now: func() time.Time { return past }}); err != nil {
+				t.Fatal(err)
+			}
+		}},
+	} {
+		t.Run(present.name, func(t *testing.T) {
+			root := awayCheckout(t)
+			present.make(t, root)
+			if _, holds, err := autonomy.AwayAt(root, autonomy.Options{}); err != nil || holds {
+				t.Fatalf("the fixture is not present: holds=%v err=%v", holds, err)
+			}
+
+			stdout, stderr, code := runGuardTriple(chipCall(t, root, "Product Q1"))
+			if code != 0 || stdout != "" || stderr != "" {
+				t.Fatalf("a chipped question must be admitted silently while present; code=%d stdout=%q stderr=%q", code, stdout, stderr)
+			}
+			if got, _ := mode.ReadAt(root); got != mode.ProductThinker {
+				t.Errorf("mode = %q, want the chip's product-thinker", got)
+			}
+			if !markedOpen(t, root) {
+				t.Error("the admitted question was not marked open")
+			}
+
+			// The badge names the product thinker now, so another tool's
+			// question would be held to abcd's rules; the answer's reset
+			// puts it back to managed first.
+			setMode(t, root, mode.Managed)
+			if stdout, stderr, code := runGuardTriple(askPayload(t, root, foreign)); code != 0 || stdout != "" || stderr != "" {
+				t.Fatalf("another tool's question must run unchecked while present; code=%d stdout=%q stderr=%q", code, stdout, stderr)
+			}
+
+			reason := hookDenyOf(t, askPayload(t, root, broken))
+			if !strings.Contains(reason, "break abcd's asking rules") || strings.Contains(reason, "the person is away") {
+				t.Errorf("a broken question must be refused on the asking rules alone while present:\n%s", reason)
+			}
+		})
+	}
+}
+
+// TestAwayRecordUnreadableFailsOpenLoud: an away record the store refuses (here
+// one another account could write) reads as not away. The question is checked
+// as if the person were present, the badge set from its chip, and the hook
+// says on exit 1, which the host shows, that the away record was not read.
+func TestAwayRecordUnreadableFailsOpenLoud(t *testing.T) {
+	root := awayCheckout(t)
+	setAwayHere(t)
+	if err := os.Chmod(awayStore(t, root).RecordPath(), 0o666); err != nil {
+		t.Fatal(err)
+	}
+	stdout, stderr, code := runGuardTriple(chipCall(t, root, "Product Q1"))
+	if isDeny(stdout) {
+		t.Fatalf("an unreadable away record must not refuse the question; stdout=%q", stdout)
+	}
+	if code != 1 {
+		t.Errorf("exit = %d, want 1 so the host shows the warning", code)
+	}
+	if !strings.Contains(stderr, "away record") || !strings.Contains(stderr, "writable by another account") {
+		t.Errorf("stderr does not name the unread away record and why:\n%s", stderr)
+	}
+	if got, _ := mode.ReadAt(root); got != mode.ProductThinker {
+		t.Errorf("mode = %q, want the chip's product-thinker", got)
+	}
+}

From 9aa9d55a1ff72b0419a83a0cb7b3d2d547cf7c05 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 12:55:35 +0100
Subject: [PATCH 17/58] docs: say what the question gate does while the person
 is away

The guard chapter, the guard page and the mode page say the gate
refuses every question while away with one reason routing it by the
act, sets no mode, and that nothing detects the act mechanically.

Refs: itd-2610180912189125
Assisted-by: Claude:claude-opus-5-5
---
 .../development/brief/04-surfaces/17-guard.md | 33 +++++++++++++++++++
 commands/guard.md                             | 15 +++++++++
 commands/mode.md                              |  4 ++-
 3 files changed, 51 insertions(+), 1 deletion(-)

diff --git a/.abcd/development/brief/04-surfaces/17-guard.md b/.abcd/development/brief/04-surfaces/17-guard.md
index 420fef1656..3b760297a7 100644
--- a/.abcd/development/brief/04-surfaces/17-guard.md
+++ b/.abcd/development/brief/04-surfaces/17-guard.md
@@ -206,6 +206,39 @@ them, is not a decision: the question runs and the hook says so on exit 1, the
 same fail-open-loud contract below. The manifest's pre-tool-use matcher names the
 shell tool and the question tool, and nothing else.
 
+**While the person is away** (spc-2610180914469489, "The question reroute";
+dcn-2610180937177502, dcn-2610181003477194), the gate reads the away record
+(`internal/core/autonomy`, the person's word that they are away, set through
+`abcd mode`) before anything above. While it holds, every call to the question
+tool is refused with the host's deny and one reason, whatever the chip: abcd's
+question or another
+tool's, chipped or not, and a questions field the check cannot read alike,
+from any working copy of the repository. Nothing past the away check runs, so
+no mode is set from a chip and no question is marked open; the badge's
+chip-set path is never reached while away. The reason names none of the asking
+rules, so the agent reroutes the question rather than redrafting it. It routes
+the question by the act it asks about (`autonomy.QuestionRoute`, the list in
+`autonomy.PersonOnlyActs`): an act only the person may approve is queued with
+the queue `abcd mode` keeps for their return, and the session carries on with
+other work. The acts are an embargo close's approval digest, the embargo
+triage verdict, the drain's hand-back, the confirmed apply verb for remote
+configuration, a release sign-off (a cut, or a step of one, that asks for the
+person by name or that no standing instruction of theirs allows; a standing
+permission for automatic cuts stands, and the away mode adds none), pushing,
+opening or merging a pull request without a standing instruction of the
+person's (the away mode is never that instruction), publishing, a visibility
+change or an outward comment or message, a new dependency, a secret, a
+credential or an App, a step only a website or a browser can do, a
+destructive act, anything that spends money, and any other act a command page
+or a brief invariant names as the person's. Every other question, product or
+technical, is decided and recorded with `abcd decide`, with its grounds and
+how to reverse it. **Nothing detects the act mechanically:** the agent
+classifies its own question from the reason's list, and the guard's registry
+entries enforce only what they name, a force push and a skipped hook among
+them. An away record or lock the store refuses reads as not away: the question
+is checked as if the person were present, and the hook says so on stderr,
+with exit 1 where it would otherwise admit the question silently.
+
 ## Fail-open-loud
 
 A broken guard never bricks a session and never silently stops protecting one.
diff --git a/commands/guard.md b/commands/guard.md
index 97e9b03634..c3800d4ce9 100644
--- a/commands/guard.md
+++ b/commands/guard.md
@@ -125,6 +125,21 @@ warns loudly. So is a payload the hook cannot decode at all: where it names the
 question tool the warning says the question runs, and where no tool name can be
 read the warning names no tool.
 
+While the away mode holds (`/abcd:mode autonomous`), the hook refuses every
+question on the host's question tool before any of the checks above, abcd's or
+another tool's, whatever its chip, with one reason, and sets no mode and marks
+nothing open. The reason routes the question by the act it asks about: an act
+only the person may approve (an embargo `--approve` digest or triage verdict,
+the drain's hand-back, the remote-configuration apply verb, a release sign-off,
+pushing, opening or merging a pull request without a standing instruction,
+publishing or posting outward, a new dependency, a secret, a credential or an
+App, a website step, a destructive act, spending, or any other act a command
+page or a brief invariant names as the person's) is queued with
+`/abcd:mode queue "<step>"`, and every other question is decided and recorded
+with `/abcd:decide`. Nothing detects the act: the agent classifies its own
+question from the reason's list. An away record that cannot be read safely
+reads as not away, and the hook says so with the warning status.
+
 Anything the adapter cannot turn into a decision — an unreadable payload, a tool
 call that is neither a shell command nor a question, a registry that does not
 load — allows the command and warns loudly. A guard that cannot answer never
diff --git a/commands/mode.md b/commands/mode.md
index c5c77abe08..ac2d900069 100644
--- a/commands/mode.md
+++ b/commands/mode.md
@@ -37,7 +37,9 @@ and it marks the question open. The answer resets the state to `managed`: the
 plugin's hook on the question tool's result resets it when the answer comes
 back, and on a host that does not run that hook the prompt hook resets it on
 the next human message. Either says so once on stderr, so you do not set it
-back yourself.
+back yourself. While the away mode below holds, the guard refuses every
+question instead, whatever its chip, and sets nothing: its reason says which
+acts to queue and that every other question is decided with `abcd decide`.
 
 **The agent, at a stop that is not a question.** When you stop to obtain a
 verdict any other way, such as a hand-off or a step the person runs, record

From 808fdb04d91cb665cf9b91993f805096aed6a4b7 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 12:56:18 +0100
Subject: [PATCH 18/58] docs: mark the question reroute's step landed and
 record the lane's choices

Refs: itd-2610180912189125
Assisted-by: Claude:claude-opus-5-5
---
 ...489-a-session-told-to-work-on-while-its.md | 36 +++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
index 6f1e7b43be..5fcde7f786 100644
--- a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
+++ b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
@@ -574,6 +574,41 @@ lane's choice, recorded for review; none changes a test the step names.
   `08-abcd.md` keeps the badge and points at the new chapter. The three
   sub-verbs' sentences and the queue's worked example go in
   `internal/core/surface`, as every visible verb's do.
+- 2026-10-18 (step 6 lane's choice, for review): **The away check comes
+  before decoding.** "Every question-tool call" is read literally: a
+  questions field the check cannot read is refused with the same reason
+  while away, rather than running on the loud fail-open status, since a
+  question nobody is there to answer stalls the session whatever its shape.
+  A payload whose outer JSON does not decode still fails open, because the
+  hook then has no working directory to find the record by.
+- 2026-10-18 (step 6 lane's choice, for review): **The reason names none of
+  the asking rules.** Its head line says the person is away and that no
+  question is put to them whatever its chip and whoever wrote it, then
+  `autonomy.QuestionRoute`: the queue route with the person-only acts, the
+  decide route, and that nothing detects the act. A reason that also listed
+  the question's field findings would invite a redraft instead of a
+  reroute.
+- 2026-10-18 (step 6 lane's choice, for review): **The text lives in
+  `internal/core/autonomy`.** `PersonOnlyActs` and `QuestionRoute` are
+  additive exports beside the record, so step 2's away block and step 5's
+  row 1 ("block with the reroute's reason") can repeat the same list rather
+  than a copy that drifts.
+- 2026-10-18 (step 6 lane's choice, for review): **An unreadable away record
+  is loud at the question gate.** A record or lock the store refuses reads as
+  not away, the question is checked as if the person were present, and one
+  line names the record: folded into the reason when the gate denies, and
+  with exit 1 (the guard's fail-open-loud status) when it would otherwise
+  admit silently. Where the gate already answered on stdout with the rows
+  note, it keeps exit 0, since exit 1 would drop the note. Outside a
+  checkout, with no root commit or no home, nobody is away and nothing is
+  said.
+- 2026-10-18 (step 6 lane's choice, for review): **The badge's chip-set path
+  needs no code of its own.** The away check returns the deny before the
+  chip is read, so no mode is set and no question marked open while away;
+  TestAwayQuestionSetsNoMode holds it. Beyond the step's named packages,
+  `commands/guard.md`, `commands/mode.md` and the guard hook's help text
+  gain a sentence each, since each describes the gate and would otherwise
+  misstate it while away.
 
 ## Footprint
 
@@ -776,6 +811,7 @@ lane's choice, recorded for review; none changes a test the step names.
      set, no marker written); TestPresentQuestionGateUnchanged. The brief's
      guard chapter says what the gate does while away, and that nothing
      detects the act mechanically.
+   - landed: 2d27610df
 7. The live session capture
    - packages: none (evidence only, kept in the local tier)
    - tests: a live Claude Code session with the plugin built from the branch

From c336b0c583cc289f373ad7ca8f2b631892baf7b3 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 13:01:13 +0100
Subject: [PATCH 19/58] refactor: take the person-only list from the question
 reroute's text

The away block and the stop check's prose-question block now carry
autonomy.QuestionRoute, the question reroute's one statement of the
acts only the person may approve, instead of a list of their own. A
placeholder file stands in for the reroute's question.go until its
branch merges, with exactly its text, and is deleted then.

Refs: itd-2610180912189125
Assisted-by: Claude:claude-opus-5-5
---
 internal/core/autonomy/judge.go               |  2 +-
 .../core/autonomy/question_placeholder.go     | 63 +++++++++++++++++++
 internal/surface/cli/hook_away.go             | 20 +-----
 3 files changed, 66 insertions(+), 19 deletions(-)
 create mode 100644 internal/core/autonomy/question_placeholder.go

diff --git a/internal/core/autonomy/judge.go b/internal/core/autonomy/judge.go
index 9c04693ace..4fd52c5776 100644
--- a/internal/core/autonomy/judge.go
+++ b/internal/core/autonomy/judge.go
@@ -205,7 +205,7 @@ func hashText(s string) string {
 }
 
 func questionReason() string {
-	return "abcd: your last message ends on a question, and the person is away, so no one will answer it. Do not ask: decide it and record it with `abcd decide` (its grounds and how to reverse it); or, if only the person may approve the act, queue it with `abcd mode queue \"<step>\"` and carry on with other work."
+	return "abcd: your last message ends on a question, and the person is away, so no one will answer it. Do not ask it.\n" + QuestionRoute()
 }
 
 func owedReason(rec *Record, owed Owed, tail string) string {
diff --git a/internal/core/autonomy/question_placeholder.go b/internal/core/autonomy/question_placeholder.go
new file mode 100644
index 0000000000..ed86f3850e
--- /dev/null
+++ b/internal/core/autonomy/question_placeholder.go
@@ -0,0 +1,63 @@
+package autonomy
+
+// PLACEHOLDER for the merge: the build lane of step 6 (branch
+// feat/away-reroute) defines PersonOnlyActs and QuestionRoute in question.go,
+// with exactly this text. This file stands in for it so steps 2 and 5 call the
+// real names; delete it when that branch merges, and nothing else changes.
+
+import "strings"
+
+// The question reroute (spc-2610180914469489, "The question reroute";
+// dcn-2610180937177502, dcn-2610181003477194, dcn-2610181016510153).
+//
+// While the away record holds, no question waits for the person: the guard
+// refuses every call to the host's question tool, whatever its chip, and its
+// reason routes the question by the act it asks about. An act only the person
+// may approve is queued for their return with `abcd mode queue`; every other
+// question is decided and recorded with `abcd decide`. Nothing detects the act
+// mechanically: the agent classifies its own question from the list, and the
+// guard's registry entries enforce only what they name. The text lives here,
+// beside the record, so every front door that repeats the list (the guard's
+// refusal, the away block, the stop check's refusal of a question asked in
+// prose) says the same thing.
+
+// personOnlyActs are the acts only the person may approve, in the spec's
+// order, each one line, the catch-all last.
+var personOnlyActs = []string{
+	"an embargo close's `--approve <digest>`, passed only after the person has read the text and said yes in their own session: never supply it on your own",
+	"the embargo triage verdict, which is the person's decision",
+	"the drain's hand-back, which is a person's decision",
+	"the confirmed apply verb for remote configuration",
+	"a release sign-off: a cut, or a step of one, that asks for the person by name, or that no standing instruction of theirs allows (a standing permission for automatic cuts stands, and the away mode adds none)",
+	"pushing, opening or merging a pull request without a standing instruction of the person's that allows it: the away mode is never that instruction",
+	"publishing anything, changing a repository's visibility, or posting a comment or message outward, other than a pull request a standing instruction allows",
+	"adding a dependency",
+	"a secret, a credential or an App",
+	"a step only a website or a browser can do",
+	"a destructive act: deleting what the session did not create, overwriting uncommitted work, a force push, discarding a peer's work",
+	"anything that spends money",
+	"any other act a command page or a brief invariant names as the person's",
+}
+
+// PersonOnlyActs are the acts only the person may approve, which a session
+// queues with `abcd mode queue` while the person is away instead of asking:
+// one line each, the catch-all last. The slice is a copy.
+func PersonOnlyActs() []string {
+	return append([]string(nil), personOnlyActs...)
+}
+
+// QuestionRoute is how a question is routed while the person is away, one
+// line each: the queue route and the person-only acts, then the decide route
+// for every other question, then that nothing detects the act and the away
+// mode grants nothing. A front door puts its own head line above it.
+func QuestionRoute() string {
+	var b strings.Builder
+	b.WriteString("Route the question by the act it asks about, not by its chip.\n")
+	b.WriteString("Queue it with `abcd mode queue \"<step>\"` for the person's return, and carry on with other work, when it asks about an act only the person may approve:\n")
+	for _, a := range personOnlyActs {
+		b.WriteString("- " + a + ";\n")
+	}
+	b.WriteString("Decide every other question yourself, product and technical alike, and record it with `abcd decide \"<text>\"`, with its grounds and how to reverse it; then carry on.\n")
+	b.WriteString("Nothing detects the act for you: classify your own question from this list. The away mode grants no rights, so it never allows an act on the list.")
+	return b.String()
+}
diff --git a/internal/surface/cli/hook_away.go b/internal/surface/cli/hook_away.go
index d0b8bb47f5..8316cfa096 100644
--- a/internal/surface/cli/hook_away.go
+++ b/internal/surface/cli/hook_away.go
@@ -29,20 +29,6 @@ import (
 // under the home folder (owner-only, checked as rules.json is), never from a
 // tracked file, and every interpolated value is cleaned to one line.
 
-// awayPersonOnlyActs is the list of acts only the person may approve, which
-// the away block repeats (spc-2610180914469489, "The question reroute").
-var awayPersonOnlyActs = []string{
-	"an approval or ruling the repository binds to the person per act: an embargo close's `--approve <digest>` (passed only after the person, in this session, has read the text and said yes), the embargo triage verdict, the drain's hand-back, the confirmed apply verb for remote configuration, and a release sign-off (a cut, or a step of one, that asks for the person by name or that no standing instruction of theirs allows; a standing permission for automatic cuts stands, and the away mode adds none)",
-	"pushing, opening or merging a pull request without a standing instruction of the person's that allows it; the away mode is never that instruction",
-	"publishing anything, changing a repository's visibility, or posting a comment or message outward, other than a pull request a standing instruction allows",
-	"adding a dependency",
-	"a secret, a credential or an App",
-	"a step only a website or a browser can do",
-	"a destructive act: deleting what the session did not create, overwriting uncommitted work, a force push, discarding a peer's work",
-	"anything that spends money",
-	"any other act a command page or a brief invariant names as the person's",
-}
-
 // awayBlock is the agent-facing block for a record that holds.
 func awayBlock(rec *autonomy.Record) string {
 	var b strings.Builder
@@ -51,10 +37,8 @@ func awayBlock(rec *autonomy.Record) string {
 		b.WriteString(l + "\n")
 	}
 	b.WriteString("\nThe mode is never permission for anything. While it holds, a turn's end is checked: while work is owed the session keeps working, and it waits only with a scheduled wake that fires soon enough.\n\n")
-	b.WriteString("Never ask the person a question while they are away. Decide it and record it with `abcd decide` (its grounds and how to reverse it); or, when only the person may approve the act, queue it with `abcd mode queue \"<step>\"` and carry on with other work meanwhile. Acts only the person may approve:\n\n")
-	for _, a := range awayPersonOnlyActs {
-		b.WriteString("- " + a + "\n")
-	}
+	b.WriteString("Never ask the person a question while they are away.\n")
+	b.WriteString(autonomy.QuestionRoute() + "\n")
 	b.WriteString("\nRun `abcd mode back` only on the person's word in this session.\n")
 	return b.String()
 }

From 1ad31a522447d5eb8c540e8fcf79c915b6b786dd Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 13:08:56 +0100
Subject: [PATCH 20/58] feat: read a working copy's owed work for the away
 mode's stop check

autonomy.ReadOwed(ctx, ReadOptions) is the stop check's one seam onto owed
work. While the person is present it reads disk only: renewals due and
unpushed own branches. While away it adds one listing of the open pull
requests under a ten-second deadline, for failing, behind (the forge's
merge state, DIRTY as behind), stacked and uncarried work, and fails open
to the disk kinds, naming the pull requests as not read.

A branch is own through this copy's reflog or its created-branch list
while it holds a recent commit of this checkout's or a live reservation
links it, as a lane of a live run, or as the head of the person's pull
request a reservation under this copy's key links by head branch or a
closing trailer. A stacked branch is judged by the clearing rule, review
and receipts included. With --hold-pushes a queued step hands back a
verified branch's unpushed item, recorded once per branch and head.

landing.GHContext binds the forge client to a caller's deadline; brief
invariant 7 gains the away mode's one listing per check.

Refs: itd-2610180912189125
Assisted-by: Claude:claude-opus-5-5
---
 .../brief/02-constraints/03-invariants.md     |  16 +
 internal/core/autonomy/doc.go                 |  58 ++
 internal/core/autonomy/forge.go               | 159 +++
 internal/core/autonomy/owedread.go            | 886 +++++++++++++++++
 internal/core/autonomy/owedread_test.go       | 931 ++++++++++++++++++
 internal/core/landing/primitives.go           |  12 +-
 6 files changed, 2061 insertions(+), 1 deletion(-)
 create mode 100644 internal/core/autonomy/forge.go
 create mode 100644 internal/core/autonomy/owedread.go
 create mode 100644 internal/core/autonomy/owedread_test.go

diff --git a/.abcd/development/brief/02-constraints/03-invariants.md b/.abcd/development/brief/02-constraints/03-invariants.md
index 60c19439e5..8aa7ca8806 100644
--- a/.abcd/development/brief/02-constraints/03-invariants.md
+++ b/.abcd/development/brief/02-constraints/03-invariants.md
@@ -117,6 +117,22 @@ The following are non-negotiable invariants — any architectural choice that vi
    status branch holding a standing announcement it has not asked about. The
    prompt hook shows the announcements, the doubts and the release holds from
    the last completed fetch, from disk alone, and asks the network nothing.
+   The away mode (itd-2610180912189125) is the person's word that sessions
+   work on while they are away: setting it (`abcd mode autonomous`) invokes,
+   for as long as it holds, the stop check's one read of the forge at each
+   turn's end, at most one listing of the open pull requests through the
+   forge client (`gh pr list`: head and base branch, author, body, merge
+   state, review decision and check rollup) under a ten-second deadline, with
+   no cache, so a run of eight blocked stops costs up to eight bounded
+   listings. A listing that fails or is late is named as not read, never
+   hidden, and the check judges from disk alone: a branch with a pull request
+   is compared with the last-fetched default branch, naming when it was
+   fetched, and a reservation is never reported as carried by no pull
+   request. Whenever the away mode does not hold, the stop check reads disk
+   only, and no turn's end touches the network, held by
+   `TestPresentReadsDiskOnly`
+   ([adr-2610181003541997](../../decisions/adrs/2610181003541997-the-away-mode-s-stop-check-reads-the.md),
+   which refines adr-38 for this verb's meaning alone).
    Inbound, abcd listens on a network only through the dashboard, only while
    someone has started it on purpose, and only for the people let in: it
    listens on this computer's own Tailscale addresses alone, never every
diff --git a/internal/core/autonomy/doc.go b/internal/core/autonomy/doc.go
index 4bb4a234bc..d480a9ff8d 100644
--- a/internal/core/autonomy/doc.go
+++ b/internal/core/autonomy/doc.go
@@ -77,4 +77,62 @@
 // behind one, a stacked branch, an unpushed branch, and a reservation whose
 // work no pull request carries. Owed.Fingerprint and Owed.CappedFingerprint
 // compare two owed sets item by item, ignoring order and reasons.
+//
+// # The created-branch list
+//
+// The guard's pre-tool hook records the branches a session creates
+// (spc-2610180914469489 step 3) through RecordCreated(copyRoot, runDir,
+// changes, Options), whether or not the person is away: a BranchCreated name
+// only when no branch of that name exists yet, a BranchCheckedOut one (`git
+// worktree add <path> [<branch>]`) when it is a branch or names nothing git
+// resolves, and a BranchMoved rename carrying a record by whole name. The list
+// is CreatedFile(copyKey) in the away store, keyed on the working copy's
+// reservation copy key (claim.CopyKey), written under the store's lock
+// (Store.RecordBranches) and capped at MaxCreatedBranches, the oldest
+// dropped; Store.CreatedBranches reads it. A checkout without the local tier
+// records nothing.
+//
+// # Reading the owed work
+//
+// ReadOwed is the stop check's one seam onto owed work:
+//
+//	func ReadOwed(ctx context.Context, o ReadOptions) (Owed, error)
+//
+// o.Root is the session's working copy and o.Record the away record as the
+// check read it. While o.Record does not hold at o.Now the person is present
+// and ReadOwed reads disk only: renewals due and unpushed own branches, with
+// no forge call. While it holds, ReadOwed adds one `gh pr list` of the open
+// pull requests (o.Forge, landing.GHContext by default) under ForgeDeadline
+// (ten seconds, o.ForgeDeadline in a test), for failing, behind (the forge's
+// merge state: BEHIND, and DIRTY as behind; UNKNOWN is a note), stacked and
+// uncarried work. A listing that fails or is late is a note, and the check
+// judges from disk alone: a pushed branch is compared with the last-fetched
+// default branch, naming the fetch, and no reservation is reported uncarried
+// (adr-2610181003541997).
+//
+// A branch is the session's own when this copy's HEAD reflog has checked it
+// out or the copy's created-branch list holds it, either only while it holds
+// a commit of this checkout's author email made within StaleWindow (14 days)
+// or a live reservation under this copy's key links it; when it is a lane of
+// an unfinished run in this copy's local tier whose reservation is live under
+// this copy's key; or when it heads an open pull request of the person's that
+// a live reservation under this copy's key links. Never the default branch,
+// nor a branch whose open pull request another person authored. A pull
+// request carries a reservation's work when the record id is in its head
+// branch's name or on a Resolves: or Delivers: line of its body, on word
+// boundaries; a Refs: line carries it only for a head already own.
+//
+// A stacked branch (its pull request's base is not the default branch, or,
+// with none, its nearest own ancestor branch is not in the default branch) is
+// owed by the clearing rule alone: while it is behind its base, failing, has a
+// review outstanding (CHANGES_REQUESTED, or a run lane with no passing review
+// of its head) or is not verified (a preflight receipt naming its head where
+// the repository mints receipts, else passing checks); an item whose only
+// unmet condition is checks still running is not capped. With --hold-pushes,
+// an unpushed own branch a queued step names as a whole name, whose head
+// contains its base's last-fetched tip and has a receipt, is handed back:
+// left out of the set and recorded once per branch and head
+// (Store.RecordHandBack). The items come sorted by OwedKinds' order. The
+// error is a root that is not a working copy; anything else ReadOwed could
+// not read is a note in Owed.Notes.
 package autonomy
diff --git a/internal/core/autonomy/forge.go b/internal/core/autonomy/forge.go
new file mode 100644
index 0000000000..7913adc8af
--- /dev/null
+++ b/internal/core/autonomy/forge.go
@@ -0,0 +1,159 @@
+package autonomy
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/core/landing"
+	"github.com/intentdriven/abcd/internal/fsutil"
+	"github.com/intentdriven/abcd/internal/gitutil"
+	"github.com/intentdriven/abcd/internal/termsafe"
+)
+
+// ForgeDeadline bounds the away check's one pull-request listing
+// (adr-2610181003541997): past it the check judges from disk alone.
+const ForgeDeadline = 10 * time.Second
+
+// prListLimit is how many open pull requests the listing asks for.
+const prListLimit = 200
+
+// prListFields are the fields the listing reads, each among those
+// internal/ghcontract pins for `gh pr list --json`.
+var prListFields = []string{
+	"number", "headRefName", "headRefOid", "baseRefName", "author", "body",
+	"mergeStateStatus", "reviewDecision", "statusCheckRollup", "isCrossRepository",
+}
+
+// Forge runs the forge client (`gh`) with args from dir, bound to ctx, and
+// returns its stdout: landing.GHContext, or a test's fake.
+type Forge func(ctx context.Context, dir string, args ...string) (string, error)
+
+// pullRequest is one open pull request as the listing reads it.
+type pullRequest struct {
+	Number            int    `json:"number"`
+	HeadRefName       string `json:"headRefName"`
+	HeadRefOid        string `json:"headRefOid"`
+	BaseRefName       string `json:"baseRefName"`
+	Body              string `json:"body"`
+	MergeStateStatus  string `json:"mergeStateStatus"`
+	ReviewDecision    string `json:"reviewDecision"`
+	IsCrossRepository bool   `json:"isCrossRepository"`
+	Author            struct {
+		Login string `json:"login"`
+	} `json:"author"`
+	StatusCheckRollup []checkEntry `json:"statusCheckRollup"`
+}
+
+// checkEntry is one entry of a check rollup: a check run (status and
+// conclusion) or a commit status (state).
+type checkEntry struct {
+	Status     string `json:"status"`
+	Conclusion string `json:"conclusion"`
+	State      string `json:"state"`
+}
+
+// checksState is what a pull request's checks say as a whole.
+type checksState int
+
+const (
+	checksNone checksState = iota
+	checksPassing
+	checksPending
+	checksFailing
+)
+
+// checks reads the rollup: failing when any entry failed, else pending when
+// any has not finished, else passing when there is any entry at all.
+func (p pullRequest) checks() checksState {
+	if len(p.StatusCheckRollup) == 0 {
+		return checksNone
+	}
+	pending := false
+	for _, c := range p.StatusCheckRollup {
+		switch strings.ToUpper(c.Conclusion) {
+		case "FAILURE", "CANCELLED", "TIMED_OUT", "ACTION_REQUIRED", "STARTUP_FAILURE":
+			return checksFailing
+		}
+		switch strings.ToUpper(c.State) {
+		case "FAILURE", "ERROR":
+			return checksFailing
+		case "PENDING", "EXPECTED":
+			pending = true
+		}
+		if c.Status != "" && !strings.EqualFold(c.Status, "COMPLETED") {
+			pending = true
+		}
+	}
+	if pending {
+		return checksPending
+	}
+	return checksPassing
+}
+
+// listing is the one forge read of a check: the open pull requests, or why
+// they were not read.
+type listing struct {
+	read   bool
+	unread string
+	prs    []pullRequest
+	// mine is whether every listed pull request is the person's (a listing
+	// by `--author @me`, made when the person's forge name is not known).
+	mine bool
+}
+
+// listOpen makes the listing under deadline: every open pull request when the
+// person's forge name is known, so another person's can be told apart, else
+// only theirs (`--author @me`).
+func listOpen(ctx context.Context, forge Forge, dir, person string, deadline time.Duration) listing {
+	ctx, cancel := context.WithTimeout(ctx, deadline)
+	defer cancel()
+	args := []string{"pr", "list", "--state", "open", "--limit", strconv.Itoa(prListLimit), "--json", strings.Join(prListFields, ",")}
+	mine := person == ""
+	if mine {
+		args = append(args, "--author", "@me")
+	}
+	out, err := forge(ctx, dir, args...)
+	switch {
+	case err != nil && (ctx.Err() != nil || errors.Is(err, context.DeadlineExceeded)):
+		return listing{unread: fmt.Sprintf("the forge did not answer within %s", deadline)}
+	case errors.Is(err, landing.ErrNoForgeClient):
+		return listing{unread: "the forge client `gh` is not installed"}
+	case err != nil:
+		return listing{unread: termsafe.CleanProseLine(gitutil.ScrubURLCredentials(fsutil.RedactHome(err.Error())), 200)}
+	}
+	var prs []pullRequest
+	if err := json.Unmarshal([]byte(out), &prs); err != nil {
+		return listing{unread: "the forge's listing of the pull requests does not parse"}
+	}
+	return listing{read: true, prs: prs, mine: mine}
+}
+
+// byHead is the open pull request whose head is branch in this repository
+// (a fork's pull request whose branch shares the name is not it), preferring
+// the person's own.
+func (l listing) byHead(branch, person string) (pullRequest, bool) {
+	var found pullRequest
+	ok := false
+	for _, p := range l.prs {
+		if p.IsCrossRepository || p.HeadRefName != branch {
+			continue
+		}
+		if l.authoredBy(p, person) {
+			return p, true
+		}
+		if !ok {
+			found, ok = p, true
+		}
+	}
+	return found, ok
+}
+
+// authoredBy reports whether p is the person's.
+func (l listing) authoredBy(p pullRequest, person string) bool {
+	return l.mine || strings.EqualFold(p.Author.Login, person)
+}
diff --git a/internal/core/autonomy/owedread.go b/internal/core/autonomy/owedread.go
new file mode 100644
index 0000000000..2c84b78668
--- /dev/null
+++ b/internal/core/autonomy/owedread.go
@@ -0,0 +1,886 @@
+package autonomy
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/core/claim"
+	"github.com/intentdriven/abcd/internal/core/identity"
+	"github.com/intentdriven/abcd/internal/core/landing"
+	"github.com/intentdriven/abcd/internal/fsutil"
+	"github.com/intentdriven/abcd/internal/gitutil"
+)
+
+// StaleWindow bounds ownership through the reflog or a recorded creation: such
+// a branch is the session's own only while it holds a commit of this
+// checkout's made within it, or a live reservation links it
+// (dcn-2610181003463367).
+const StaleWindow = 14 * 24 * time.Hour
+
+// ReadOptions carry what ReadOwed reads; every seam's zero value reads the
+// machine.
+type ReadOptions struct {
+	// Root is the session's working copy: the root of the worktree the
+	// session started in.
+	Root string
+	// Record is the away record as the stop check read it, nil when there is
+	// none. The forge is read only while it holds at Now; its queue and
+	// HoldPushes decide what a queued push hands back.
+	Record *Record
+	// Home is the home directory the away store lives under; "" means the
+	// process's own.
+	Home string
+	// Now is the clock; nil means time.Now.
+	Now func() time.Time
+	// Forge runs the forge client; nil means landing.GHContext.
+	Forge Forge
+	// ForgeDeadline bounds the listing; zero means ForgeDeadline.
+	ForgeDeadline time.Duration
+	// Reservations reads the reservations as last fetched, with no network;
+	// nil means claim.View.
+	Reservations func(root string, now time.Time) (claim.Snapshot, error)
+	// Person is the person's forge name, which tells their pull requests
+	// from another person's; "" means the holder name reservations resolve
+	// without a network read (claim.ReaderHolder), and when that is unknown
+	// too the listing asks for the person's own pull requests alone.
+	Person string
+	// Email is this checkout's author email, which tells its commits from
+	// another author's; "" means the email git would author a commit with.
+	Email string
+}
+
+func (o ReadOptions) now() time.Time {
+	if o.Now != nil {
+		return o.Now()
+	}
+	return time.Now()
+}
+
+// ReadOwed is the owed work of the working copy at o.Root
+// (spc-2610180914469489, "Owed work"): the stop check's one reading.
+//
+// While the person is present (o.Record does not hold) it reads disk only:
+// renewals due and unpushed own branches, and never calls the forge. While
+// away it adds one listing of the open pull requests under ForgeDeadline,
+// for failing, behind, stacked and uncarried work; a listing that fails or
+// is late is named in Owed.Notes and the check judges from disk alone
+// (adr-2610181003541997). With --hold-pushes, an unpushed own branch a queued
+// step names, whose head contains its base's last-fetched tip and has a
+// preflight receipt, is handed back: left out of the set and recorded once
+// per branch and head in the away record.
+//
+// The error is a root that is not a working copy; every other failure to read
+// something is a note, and the set is judged without it.
+func ReadOwed(ctx context.Context, o ReadOptions) (Owed, error) {
+	if o.Root == "" {
+		return Owed{}, errors.New("autonomy: no working copy to read the owed work of")
+	}
+	root, err := gitutil.CheckoutRoot(o.Root, StoreName)
+	if err != nil {
+		return Owed{}, err
+	}
+	home := o.Home
+	if home == "" {
+		if home, err = os.UserHomeDir(); err != nil {
+			home = ""
+		}
+	}
+	r := &owedReader{
+		root:  root,
+		home:  home,
+		now:   o.now(),
+		email: o.Email,
+		rec:   o.Record,
+	}
+	r.away = o.Record.Holds(r.now)
+	if r.email == "" {
+		if id, err := identity.EffectiveIdentity(root); err == nil {
+			r.email = id.Email
+		}
+	}
+	r.readRefs()
+	r.readReservations(o)
+	if r.away {
+		r.person = o.Person
+		if r.person == "" {
+			r.person = claim.ReaderHolder(root, claim.Options{Home: home})
+		}
+		forge := o.Forge
+		if forge == nil {
+			forge = landing.GHContext
+		}
+		deadline := o.ForgeDeadline
+		if deadline <= 0 {
+			deadline = ForgeDeadline
+		}
+		r.list = listOpen(ctx, forge, root, r.person, deadline)
+		if !r.list.read {
+			r.note("the pull requests were not read (%s), so the check judged from disk alone", r.list.unread)
+		}
+	}
+	r.receiptsMinted = receiptsMinted(root)
+	r.readLanes()
+	r.findOwn()
+	r.branchItems()
+	r.reservationItems()
+	r.handBack()
+	sort.SliceStable(r.items, func(i, j int) bool {
+		a, b := r.items[i], r.items[j]
+		if ka, kb := kindRank(a.Kind), kindRank(b.Kind); ka != kb {
+			return ka < kb
+		}
+		if a.Branch != b.Branch {
+			return a.Branch < b.Branch
+		}
+		return a.Record < b.Record
+	})
+	return Owed{Items: r.items, Notes: r.notes}, nil
+}
+
+// owedReader is one ReadOwed's state.
+type owedReader struct {
+	root, home string
+	now        time.Time
+	away       bool
+	email      string
+	person     string
+	rec        *Record
+
+	def     string // the default branch's full ref as last fetched
+	defName string // its branch name
+	defTip  string
+
+	branches map[string]*localBranch
+	mine     []claim.Reservation
+	list     listing
+	lanes    map[string]laneState
+
+	receiptsMinted bool
+	own            map[string]bool
+	stackBase      map[string]string // a branch's base's tip on disk, for the hand-back
+
+	items []OwedItem
+	notes []string
+}
+
+type localBranch struct {
+	name, head   string
+	upstream     string
+	upstreamGone bool
+}
+
+type laneState struct {
+	key     string
+	reviews []laneReview
+}
+
+type laneReview struct {
+	head string
+	pass bool
+}
+
+func (r *owedReader) note(format string, a ...any) {
+	r.notes = append(r.notes, fmt.Sprintf(format, a...))
+}
+
+func (r *owedReader) git(args ...string) (string, error) {
+	return gitutil.RunLimited(r.root, 1<<20, args...)
+}
+
+func (r *owedReader) ancestor(a, b string) bool {
+	if a == "" || b == "" {
+		return false
+	}
+	ok, err := gitutil.IsAncestor(r.root, a, b)
+	return err == nil && ok
+}
+
+// readRefs reads the default branch as last fetched and every local branch
+// with its head and upstream.
+func (r *owedReader) readRefs() {
+	r.def = gitutil.DefaultRef(r.root)
+	switch {
+	case strings.HasPrefix(r.def, "refs/remotes/"):
+		parts := strings.SplitN(strings.TrimPrefix(r.def, "refs/remotes/"), "/", 2)
+		if len(parts) == 2 {
+			r.defName = parts[1]
+		}
+	case strings.HasPrefix(r.def, "refs/heads/"):
+		r.defName = strings.TrimPrefix(r.def, "refs/heads/")
+	}
+	if r.def != "" {
+		r.defTip, _ = r.git("rev-parse", "--verify", "--quiet", r.def+"^{commit}")
+		r.defTip = strings.TrimSpace(r.defTip)
+	}
+	r.branches = map[string]*localBranch{}
+	out, err := r.git("for-each-ref", "--format=%(refname:short)%00%(objectname)%00%(upstream)%00%(upstream:track)", "refs/heads")
+	if err != nil {
+		r.note("the local branches could not be listed")
+		return
+	}
+	for _, line := range strings.Split(out, "\n") {
+		f := strings.Split(line, "\x00")
+		if len(f) != 4 || f[0] == "" {
+			continue
+		}
+		r.branches[f[0]] = &localBranch{name: f[0], head: f[1], upstream: f[2], upstreamGone: strings.Contains(f[3], "gone")}
+	}
+}
+
+// readReservations keeps the live reservations under this copy's key.
+func (r *owedReader) readReservations(o ReadOptions) {
+	view := o.Reservations
+	if view == nil {
+		view = claim.View
+	}
+	snap, err := view(r.root, r.now)
+	if err != nil {
+		r.note("the reservations as last fetched could not be read")
+		return
+	}
+	for _, res := range snap.Reservations {
+		if res.Copy == claim.CopyThis && res.State == claim.StateLive {
+			r.mine = append(r.mine, res)
+		}
+	}
+}
+
+func (r *owedReader) liveMine(id string) bool {
+	for _, res := range r.mine {
+		if res.Record == id {
+			return true
+		}
+	}
+	return false
+}
+
+// receiptsMinted reports whether the repository mints preflight receipts: a
+// receipt folder exists in one of its worktrees.
+func receiptsMinted(root string) bool {
+	wts, err := gitutil.ListWorktrees(root, gitutil.MaxWorktreeListing)
+	if err != nil {
+		return false
+	}
+	for _, wt := range wts {
+		if wt.Bare {
+			continue
+		}
+		if fi, err := os.Lstat(filepath.Join(wt.Path, filepath.FromSlash(landing.ReceiptsRelDir))); err == nil && fi.IsDir() {
+			return true
+		}
+	}
+	return false
+}
+
+func (r *owedReader) hasReceipt(head string) bool {
+	if head == "" {
+		return false
+	}
+	p, err := landing.Receipt(r.root, head)
+	return err == nil && p != ""
+}
+
+// runIDRe is a run's directory name (loop.ValidRunID's shape).
+var runIDRe = regexp.MustCompile(`^run-[0-9]{16}$`)
+
+// runFile is what the owed reading needs of a run's state file, read
+// leniently: the loop owns the file, and this reads only its lanes.
+type runFile struct {
+	Key     string            `json:"key"`
+	Pending []json.RawMessage `json:"pending"`
+	Lanes   []struct {
+		Branch     string `json:"branch"`
+		Stage      string `json:"stage"`
+		Validation []struct {
+			HeadSHA    string `json:"head_sha"`
+			Validators []struct {
+				Pass bool `json:"pass"`
+			} `json:"validators"`
+		} `json:"validation"`
+	} `json:"lanes"`
+}
+
+const runRelDir = ".abcd/.work.local/run"
+
+// readLanes keeps the open lanes of every unfinished run in this copy's local
+// tier whose reservation is live under this copy's key.
+func (r *owedReader) readLanes() {
+	r.lanes = map[string]laneState{}
+	rt, err := os.OpenRoot(r.root)
+	if err != nil {
+		return
+	}
+	defer rt.Close()
+	entries, err := fs.ReadDir(rt.FS(), runRelDir)
+	if err != nil {
+		return
+	}
+	for _, e := range entries {
+		if !e.IsDir() || !runIDRe.MatchString(e.Name()) {
+			continue
+		}
+		raw, err := fsutil.ReadGuardedInRoot(rt, runRelDir+"/"+e.Name()+"/state.json", 8<<20)
+		if err != nil {
+			continue
+		}
+		var run runFile
+		if json.Unmarshal(raw, &run) != nil || !r.liveMine(run.Key) {
+			continue
+		}
+		finished := len(run.Pending) == 0
+		for _, l := range run.Lanes {
+			if l.Stage != "done" && l.Stage != "discarded" {
+				finished = false
+			}
+		}
+		if finished {
+			continue
+		}
+		for _, l := range run.Lanes {
+			if l.Branch == "" || l.Stage == "done" || l.Stage == "discarded" || l.Stage == "handed-back" {
+				continue
+			}
+			ls := laneState{key: run.Key}
+			for _, v := range l.Validation {
+				pass := len(v.Validators) > 0
+				for _, val := range v.Validators {
+					pass = pass && val.Pass
+				}
+				ls.reviews = append(ls.reviews, laneReview{head: v.HeadSHA, pass: pass})
+			}
+			r.lanes[l.Branch] = ls
+		}
+	}
+}
+
+// reflogBranches are the branches this working copy's HEAD reflog has
+// checked out, and the one checked out now.
+func (r *owedReader) reflogBranches() []string {
+	var out []string
+	if cur, err := r.git("symbolic-ref", "--quiet", "--short", "HEAD"); err == nil && strings.TrimSpace(cur) != "" {
+		out = append(out, strings.TrimSpace(cur))
+	}
+	log, err := r.git("reflog", "show", "-n", "5000", "--format=%gs", "HEAD", "--")
+	if err != nil {
+		return out
+	}
+	for _, line := range strings.Split(log, "\n") {
+		rest, ok := strings.CutPrefix(strings.TrimSpace(line), "checkout: moving from ")
+		if !ok {
+			continue
+		}
+		from, to, ok := strings.Cut(rest, " to ")
+		if !ok {
+			continue
+		}
+		out = append(out, from, to)
+	}
+	return out
+}
+
+// recordedBranches are the branches this copy's sessions created, as the
+// guard's pre-tool hook recorded them.
+func (r *owedReader) recordedBranches() []string {
+	key := claim.OwnCopyKey(r.root)
+	if key == "" || r.home == "" {
+		return nil
+	}
+	st, err := OpenStore(r.home, r.root)
+	if err != nil {
+		return nil
+	}
+	list, err := st.CreatedBranches(key)
+	if err != nil {
+		r.note("this copy's created-branch list could not be read (%s)", err)
+		return nil
+	}
+	var out []string
+	for _, b := range list {
+		out = append(out, b.Name)
+	}
+	return out
+}
+
+// authoredRecently reports whether branch holds, beyond the default branch, a
+// commit of this checkout's author email made or rewritten within
+// StaleWindow.
+func (r *owedReader) authoredRecently(b *localBranch) bool {
+	if r.email == "" {
+		return false
+	}
+	args := []string{"log", "-n", "200", "--format=%ae%x09%at%x09%ct", b.head}
+	if r.defTip != "" {
+		args = append(args, "--not", r.defTip)
+	}
+	out, err := r.git(append(args, "--")...)
+	if err != nil {
+		return false
+	}
+	cutoff := r.now.Add(-StaleWindow).Unix()
+	for _, line := range strings.Split(out, "\n") {
+		f := strings.Split(line, "\t")
+		if len(f) != 3 || !strings.EqualFold(f[0], r.email) {
+			continue
+		}
+		at, _ := strconv.ParseInt(f[1], 10, 64)
+		ct, _ := strconv.ParseInt(f[2], 10, 64)
+		if max(at, ct) >= cutoff {
+			return true
+		}
+	}
+	return false
+}
+
+// linksByName reports whether a branch's name carries the id of a live
+// reservation under this copy's key.
+func (r *owedReader) linksByName(branch string) bool {
+	for _, res := range r.mine {
+		if mentionsID(branch, res.Record) {
+			return true
+		}
+	}
+	return false
+}
+
+// prLinks reports whether p carries the work of the reservation id: the id in
+// its head branch's name or on a Resolves: or Delivers: line of its body, or
+// on a Refs: line when its head is already own.
+func (r *owedReader) prLinks(p pullRequest, id string, headOwn bool) bool {
+	if mentionsID(p.HeadRefName, id) || trailerMentions(p.Body, closingKeys, id) {
+		return true
+	}
+	return headOwn && trailerMentions(p.Body, refsKeys, id)
+}
+
+// findOwn names the session's own branches (dcn-2610180936568358,
+// dcn-2610181003463367): the reflog's and the recorded ones while live, the
+// live runs' lanes, and the heads of the person's open pull requests linked
+// to a live reservation under this copy's key; never the default branch, nor
+// a branch whose open pull request another person authored.
+func (r *owedReader) findOwn() {
+	r.own = map[string]bool{}
+	var linkedHeads []string
+	if r.list.read {
+		for _, p := range r.list.prs {
+			if p.IsCrossRepository || !r.list.authoredBy(p, r.person) {
+				continue
+			}
+			for _, res := range r.mine {
+				if r.prLinks(p, res.Record, false) {
+					linkedHeads = append(linkedHeads, p.HeadRefName)
+					break
+				}
+			}
+		}
+	}
+	linked := map[string]bool{}
+	for _, h := range linkedHeads {
+		linked[h] = true
+	}
+	for _, name := range append(r.reflogBranches(), r.recordedBranches()...) {
+		b, ok := r.branches[name]
+		if !ok || r.own[name] {
+			continue
+		}
+		if linked[name] || r.linksByName(name) || r.authoredRecently(b) {
+			r.own[name] = true
+		}
+	}
+	for name := range r.lanes {
+		if _, ok := r.branches[name]; ok {
+			r.own[name] = true
+		}
+	}
+	for _, h := range linkedHeads {
+		r.own[h] = true
+	}
+	delete(r.own, r.defName)
+	if r.list.read && !r.list.mine && r.person != "" {
+		for name := range r.own {
+			if p, ok := r.list.byHead(name, r.person); ok && !r.list.authoredBy(p, r.person) {
+				delete(r.own, name)
+			}
+		}
+	}
+}
+
+func (r *owedReader) ownNames() []string {
+	names := make([]string, 0, len(r.own))
+	for n := range r.own {
+		names = append(names, n)
+	}
+	sort.Strings(names)
+	return names
+}
+
+// fetchedAt names when the default branch was last fetched.
+func (r *owedReader) fetchedAt() string {
+	if r.def != "" {
+		if out, err := r.git("reflog", "show", "-n", "1", "--format=%ct", r.def, "--"); err == nil {
+			if s, err := strconv.ParseInt(strings.TrimSpace(out), 10, 64); err == nil && s > 0 {
+				return showTime(time.Unix(s, 0))
+			}
+		}
+	}
+	if t := claim.LastFetched(r.root); !t.IsZero() {
+		return showTime(t)
+	}
+	return "an unknown time"
+}
+
+// diskStackBase is the nearest other own branch whose tip is an ancestor of
+// b's and is not in the last-fetched default branch, or nil. A base that has
+// moved on since b was cut is no longer an ancestor of b's tip, so it is found
+// too by the commit they share, when that commit is not in the default branch
+// and was the other branch's own tip (its reflog set it there other than by
+// creating the branch, which tells the base from a branch cut from it).
+func (r *owedReader) diskStackBase(b *localBranch) *localBranch {
+	var best *localBranch
+	for _, name := range r.ownNames() {
+		c, ok := r.branches[name]
+		if !ok || c.name == b.name || c.head == b.head || !r.ancestor(c.head, b.head) || r.ancestor(c.head, r.defTip) {
+			continue
+		}
+		if best == nil || r.ancestor(best.head, c.head) {
+			best = c
+		}
+	}
+	if best != nil {
+		return best
+	}
+	var bestFork string
+	for _, name := range r.ownNames() {
+		c, ok := r.branches[name]
+		if !ok || c.name == b.name || r.ancestor(b.head, c.head) {
+			continue
+		}
+		out, err := r.git("merge-base", c.head, b.head)
+		fork := strings.TrimSpace(out)
+		if err != nil || fork == "" || fork == b.head || r.ancestor(fork, r.defTip) || !r.wasOwnTip(c.name, fork) {
+			continue
+		}
+		if best == nil || r.ancestor(bestFork, fork) {
+			best, bestFork = c, fork
+		}
+	}
+	return best
+}
+
+// wasOwnTip reports whether branch's reflog shows sha as its tip, set there
+// other than by the branch's creation.
+func (r *owedReader) wasOwnTip(branch, sha string) bool {
+	out, err := r.git("reflog", "show", "-n", "1000", "--format=%H%x09%gs", "refs/heads/"+branch, "--")
+	if err != nil {
+		return false
+	}
+	for _, line := range strings.Split(out, "\n") {
+		h, msg, _ := strings.Cut(line, "\t")
+		if h == sha && !strings.HasPrefix(msg, "branch: Created from") {
+			return true
+		}
+	}
+	return false
+}
+
+// baseTipOnDisk is a base branch's tip as it stands on disk: the local branch,
+// else its remote-tracking ref.
+func (r *owedReader) baseTipOnDisk(base string) string {
+	if b, ok := r.branches[base]; ok {
+		return b.head
+	}
+	out, err := r.git("rev-parse", "--verify", "--quiet", "refs/remotes/origin/"+base+"^{commit}")
+	if err != nil {
+		return ""
+	}
+	return strings.TrimSpace(out)
+}
+
+func (r *owedReader) lanePassed(branch, head string) (isLane, passed bool) {
+	ls, ok := r.lanes[branch]
+	if !ok {
+		return false, false
+	}
+	for _, v := range ls.reviews {
+		if v.head == head && v.pass {
+			return true, true
+		}
+	}
+	return true, false
+}
+
+func (r *owedReader) add(i OwedItem) { r.items = append(r.items, i) }
+
+// branchItems judges each own branch: failing and behind pull requests,
+// stacked branches by the clearing rule, and unpushed commits.
+func (r *owedReader) branchItems() {
+	r.stackBase = map[string]string{}
+	for _, name := range r.ownNames() {
+		b := r.branches[name]
+		head := ""
+		if b != nil {
+			head = b.head
+		}
+		var p pullRequest
+		hasPR := false
+		if r.away && r.list.read {
+			p, hasPR = r.list.byHead(name, r.person)
+			if hasPR && head == "" {
+				head = p.HeadRefOid
+			}
+		}
+		if r.away {
+			r.forgeItems(name, b, head, p, hasPR)
+		}
+		if b != nil && r.unpushed(b) {
+			r.add(OwedItem{Kind: OwedUnpushed, Capped: true, Branch: name, Head: head,
+				Reason: fmt.Sprintf("%s has commits not pushed", name)})
+		}
+	}
+}
+
+// forgeItems is the away half of a branch's judgement.
+func (r *owedReader) forgeItems(name string, b *localBranch, head string, p pullRequest, hasPR bool) {
+	// Stacked: its pull request's base is not the default branch, or, with no
+	// pull request read, its nearest own ancestor branch is not in the
+	// default branch.
+	base, baseTip := "", ""
+	switch {
+	case hasPR && p.BaseRefName != "" && p.BaseRefName != r.defName:
+		base, baseTip = p.BaseRefName, r.baseTipOnDisk(p.BaseRefName)
+	case !hasPR && b != nil:
+		if sb := r.diskStackBase(b); sb != nil {
+			base, baseTip = sb.name, sb.head
+		}
+	}
+	if base != "" {
+		r.stackBase[name] = baseTip
+		r.stacked(name, head, base, baseTip, p, hasPR)
+		return
+	}
+	if hasPR {
+		if p.checks() == checksFailing {
+			r.add(OwedItem{Kind: OwedFailing, Capped: true, Branch: name, PR: p.Number, Head: head,
+				Reason: fmt.Sprintf("pull request #%d (%s) is failing its checks: fix them", p.Number, name)})
+		}
+		switch strings.ToUpper(p.MergeStateStatus) {
+		case "BEHIND":
+			r.add(OwedItem{Kind: OwedBehind, Capped: true, Branch: name, PR: p.Number, Head: head,
+				Reason: fmt.Sprintf("pull request #%d (%s) is behind its base: merge it in", p.Number, name)})
+		case "DIRTY":
+			r.add(OwedItem{Kind: OwedBehind, Capped: true, Branch: name, PR: p.Number, Head: head,
+				Reason: fmt.Sprintf("pull request #%d (%s) conflicts with its base: merge it in and resolve the conflicts", p.Number, name)})
+		case "UNKNOWN", "":
+			r.note("the merge state of pull request #%d (%s) was not read (the forge has not computed it)", p.Number, name)
+		}
+		return
+	}
+	// The listing failed: a pushed branch is compared on disk with the
+	// last-fetched default branch, naming when it was fetched.
+	if !r.list.read && b != nil && b.upstream != "" && !b.upstreamGone && r.defTip != "" && !r.ancestor(r.defTip, b.head) {
+		r.add(OwedItem{Kind: OwedBehind, Capped: true, Branch: name, Head: head,
+			Reason: fmt.Sprintf("%s is behind %s as last fetched (fetched %s), compared on disk because the pull requests were not read: merge it in",
+				name, gitutil.ShortRef(r.def), r.fetchedAt())})
+	}
+}
+
+// stacked applies the clearing rule (dcn-2610180936571036,
+// dcn-2610181003488355): a branch stacked on a change still open is owed while
+// it is behind its base, failing, with a review outstanding, or not verified;
+// otherwise only its landing waits for its base.
+func (r *owedReader) stacked(name, head, base, baseTip string, p pullRequest, hasPR bool) {
+	var needs []string
+	capped := false
+	need := func(what string, forgeOnly bool) {
+		needs = append(needs, what)
+		capped = capped || !forgeOnly
+	}
+	notVerified := ""
+	checks := checksNone
+	if hasPR {
+		checks = p.checks()
+		switch strings.ToUpper(p.MergeStateStatus) {
+		case "BEHIND", "DIRTY":
+			need("the merge from its base", false)
+		case "UNKNOWN", "":
+			r.note("the merge state of pull request #%d (%s) was not read (the forge has not computed it)", p.Number, name)
+		}
+		if checks == checksFailing {
+			need("the fixes for its failing checks", false)
+		}
+		if strings.EqualFold(p.ReviewDecision, "CHANGES_REQUESTED") {
+			need("the review (changes are requested)", false)
+		}
+	} else if baseTip != "" && !r.ancestor(baseTip, head) {
+		need(fmt.Sprintf("the merge from its base (%s as it stands on disk)", base), false)
+	}
+	if isLane, passed := r.lanePassed(name, head); isLane && !passed {
+		need("the review of its head", false)
+	}
+	switch {
+	case r.receiptsMinted:
+		if !r.hasReceipt(head) {
+			need("the preflight (no receipt names its head)", false)
+		}
+	case hasPR && checks == checksPending:
+		need("its checks, still running", true)
+	case hasPR && checks == checksNone:
+		need("verification (no checks reported, and no receipts are minted here)", false)
+	case !hasPR:
+		notVerified = "it was not verified: no receipts are minted here and it has no pull request read"
+	}
+	if len(needs) == 0 {
+		if notVerified != "" {
+			r.note("%s is waiting on its base %s; %s", name, base, notVerified)
+		}
+		return
+	}
+	reason := fmt.Sprintf("%s is stacked on %s, still open, and needs now: %s; only its landing waits for its base",
+		name, base, strings.Join(needs, ", "))
+	if notVerified != "" {
+		reason += "; " + notVerified
+	}
+	r.add(OwedItem{Kind: OwedStacked, Capped: capped, Branch: name, PR: p.Number, Head: head, Reason: reason})
+}
+
+// unpushed reports whether b holds commits not on its upstream, or, with no
+// upstream configured, not in any remote-tracking ref. A branch whose upstream
+// is gone never counts.
+func (r *owedReader) unpushed(b *localBranch) bool {
+	if b.upstream != "" {
+		if b.upstreamGone {
+			return false
+		}
+		out, err := r.git("rev-list", "--count", b.upstream+".."+b.head, "--")
+		n, _ := strconv.Atoi(strings.TrimSpace(out))
+		return err == nil && n > 0
+	}
+	out, err := r.git("rev-list", "-n", "1", b.head, "--not", "--remotes", "--")
+	return err == nil && strings.TrimSpace(out) != ""
+}
+
+// reservationItems judges this copy's live reservations: a renewal due
+// halfway between the latest claim or renewal and the expiry, and, while away
+// with the listing read, work no open pull request carries (a release
+// subject, which no pull request carries, aside).
+func (r *owedReader) reservationItems() {
+	for _, res := range r.mine {
+		if half := res.ClaimedAt.Add(res.EffectiveExpiry.Sub(res.ClaimedAt) / 2); !r.now.Before(half) {
+			r.add(OwedItem{Kind: OwedRenewal, Record: res.Record,
+				Reason: fmt.Sprintf("the reservation of %s is due for renewal (it lapses %s): renew it with `abcd reserve %s`",
+					res.Record, showTime(res.EffectiveExpiry), res.Record)})
+		}
+		if !r.away || !r.list.read || strings.HasPrefix(res.Record, "rel-") {
+			continue
+		}
+		carried := false
+		for _, p := range r.list.prs {
+			if r.prLinks(p, res.Record, r.own[p.HeadRefName]) {
+				carried = true
+				break
+			}
+		}
+		if !carried {
+			r.add(OwedItem{Kind: OwedUncarried, Capped: true, Record: res.Record,
+				Reason: fmt.Sprintf("no open pull request carries the work of %s yet: finish it and open one", res.Record)})
+		}
+	}
+}
+
+// handBack is the one hand-back (dcn-2610181035355741): only with
+// --hold-pushes, a queued step naming an own branch hands back that branch's
+// unpushed item, while its head contains its base's last-fetched tip and a
+// preflight receipt names it where the repository mints receipts. Each is
+// recorded once per branch and head.
+func (r *owedReader) handBack() {
+	if !r.away || !r.rec.HoldPushes || len(r.rec.Queue) == 0 || !r.receiptsMinted {
+		return
+	}
+	var st *Store
+	if r.home != "" {
+		if s, err := OpenStore(r.home, r.root); err == nil {
+			st = &s
+		}
+	}
+	kept := r.items[:0]
+	for _, it := range r.items {
+		if it.Kind != OwedUnpushed || !r.queued(it.Branch) {
+			kept = append(kept, it)
+			continue
+		}
+		baseTip := r.defTip
+		if t, ok := r.stackBase[it.Branch]; ok {
+			baseTip = t
+		}
+		if baseTip == "" || !r.ancestor(baseTip, it.Head) || !r.hasReceipt(it.Head) {
+			kept = append(kept, it)
+			continue
+		}
+		if st != nil {
+			if _, err := st.RecordHandBack(it.Branch, it.Head, r.now); err != nil {
+				r.note("the hand-back of %s was not recorded (%s)", it.Branch, err)
+			}
+		}
+	}
+	r.items = kept
+}
+
+// queued reports whether a queued step names branch as a whole name.
+func (r *owedReader) queued(branch string) bool {
+	for _, q := range r.rec.Queue {
+		if namesBranch(q.Step, branch) {
+			return true
+		}
+	}
+	return false
+}
+
+// mentionsID reports whether text names the record id on word boundaries:
+// iss-5 is never found in iss-50, and is found in feat/iss-5-x.
+func mentionsID(text, id string) bool {
+	if id == "" {
+		return false
+	}
+	return regexp.MustCompile(`(?:^|[^A-Za-z0-9])` + regexp.QuoteMeta(id) + `(?:$|[^A-Za-z0-9])`).MatchString(text)
+}
+
+// namesBranch reports whether text names branch as a whole name: the
+// characters around it cannot continue a branch name, so feat/p is never
+// found in feat/p-2 or feat/p2.
+func namesBranch(text, branch string) bool {
+	if branch == "" {
+		return false
+	}
+	return regexp.MustCompile(`(?:^|[^A-Za-z0-9._/-])` + regexp.QuoteMeta(branch) + `(?:$|[^A-Za-z0-9._/-]|[.](?:$|\s))`).MatchString(text)
+}
+
+var (
+	closingKeys = []string{"resolves", "delivers"}
+	refsKeys    = []string{"refs"}
+)
+
+// trailerMentions reports whether body has a line keyed by one of keys
+// (`Resolves: …`, any case) naming id on word boundaries.
+func trailerMentions(body string, keys []string, id string) bool {
+	for _, line := range strings.Split(body, "\n") {
+		k, v, ok := strings.Cut(strings.TrimSpace(line), ":")
+		if !ok {
+			continue
+		}
+		for _, want := range keys {
+			if strings.EqualFold(strings.TrimSpace(k), want) && mentionsID(v, id) {
+				return true
+			}
+		}
+	}
+	return false
+}
diff --git a/internal/core/autonomy/owedread_test.go b/internal/core/autonomy/owedread_test.go
new file mode 100644
index 0000000000..47c83e6957
--- /dev/null
+++ b/internal/core/autonomy/owedread_test.go
@@ -0,0 +1,931 @@
+package autonomy
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/core/claim"
+	"github.com/intentdriven/abcd/internal/ghcontract"
+	"github.com/intentdriven/abcd/internal/gittest"
+)
+
+const fixtureEmail = "fixture@example.invalid"
+
+// fakePR is one open pull request the fake forge lists, in the shape `gh pr
+// list --json` prints it.
+type fakePR struct {
+	Number            int              `json:"number"`
+	HeadRefName       string           `json:"headRefName"`
+	HeadRefOid        string           `json:"headRefOid"`
+	BaseRefName       string           `json:"baseRefName"`
+	Author            map[string]any   `json:"author"`
+	Body              string           `json:"body"`
+	MergeStateStatus  string           `json:"mergeStateStatus"`
+	ReviewDecision    string           `json:"reviewDecision"`
+	StatusCheckRollup []map[string]any `json:"statusCheckRollup"`
+	IsCrossRepository bool             `json:"isCrossRepository"`
+}
+
+var (
+	rollupGreen   = []map[string]any{{"__typename": "CheckRun", "name": "ci", "status": "COMPLETED", "conclusion": "SUCCESS"}}
+	rollupFailing = []map[string]any{{"__typename": "CheckRun", "name": "ci", "status": "COMPLETED", "conclusion": "FAILURE"}}
+	rollupRunning = []map[string]any{{"__typename": "CheckRun", "name": "ci", "status": "IN_PROGRESS", "conclusion": ""}}
+)
+
+func pr(n int, head, base, author string) fakePR {
+	return fakePR{Number: n, HeadRefName: head, BaseRefName: base, Author: map[string]any{"login": author},
+		MergeStateStatus: "CLEAN", StatusCheckRollup: rollupGreen}
+}
+
+// fakeForge answers the one listing a stop check makes, refusing a field the
+// real forge client refuses (internal/ghcontract).
+type fakeForge struct {
+	t     *testing.T
+	mu    sync.Mutex
+	prs   []fakePR
+	calls int
+	hang  bool
+	err   error
+	ctxs  []context.Context
+}
+
+func (f *fakeForge) run(ctx context.Context, dir string, args ...string) (string, error) {
+	f.mu.Lock()
+	f.calls++
+	f.ctxs = append(f.ctxs, ctx)
+	f.mu.Unlock()
+	if err := ghcontract.Check(args); err != nil {
+		f.t.Errorf("the listing asks the forge for a field it refuses: %v", err)
+		return "", err
+	}
+	if len(args) < 2 || args[0] != "pr" || args[1] != "list" {
+		f.t.Errorf("the stop check's one forge call is a pull-request listing; got %v", args)
+	}
+	if f.hang {
+		<-ctx.Done()
+		return "", ctx.Err()
+	}
+	if f.err != nil {
+		return "", f.err
+	}
+	raw, err := json.Marshal(f.prs)
+	return string(raw), err
+}
+
+// fx is a managed checkout with an origin, the default branch pushed and
+// fetched, a fake forge and the reservations as last fetched.
+type fx struct {
+	t      *testing.T
+	repo   *gittest.Repo
+	root   string
+	home   string
+	origin string
+	now    time.Time
+	forge  *fakeForge
+	res    []claim.Reservation
+	email  string
+}
+
+func newFx(t *testing.T) *fx {
+	t.Helper()
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	repo := gittest.NewRepo(t)
+	repo.Commit("seed")
+	root, err := filepath.EvalSymlinks(repo.Root())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(filepath.Join(root, ".abcd", ".work.local"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	f := &fx{t: t, repo: repo, root: root, home: home, now: time.Now().Truncate(time.Second), email: fixtureEmail}
+	f.forge = &fakeForge{t: t}
+	f.origin = filepath.Join(t.TempDir(), "origin.git")
+	gittest.InitBare(t, f.origin)
+	f.git("remote", "add", "origin", f.origin)
+	f.git("push", "-q", "origin", "main")
+	f.git("remote", "set-head", "origin", "main")
+	return f
+}
+
+func (f *fx) git(args ...string) string { f.t.Helper(); return f.repo.Git(args...) }
+
+// commitOn records an empty commit on branch without checking it out, by
+// author (the fixture's own when ""), and returns it.
+func (f *fx) commitOn(branch, msg, author string) string {
+	f.t.Helper()
+	tree := f.git("rev-parse", branch+"^{tree}")
+	args := []string{}
+	if author != "" {
+		args = append(args, "-c", "user.email="+author, "-c", "user.name="+strings.Split(author, "@")[0])
+	}
+	args = append(args, "commit-tree", tree, "-p", branch, "-m", msg)
+	c := f.git(args...)
+	f.git("update-ref", "refs/heads/"+branch, c)
+	return c
+}
+
+// own checks branch out in this copy and back, so its HEAD reflog holds it.
+func (f *fx) own(branch string) {
+	f.t.Helper()
+	f.git("checkout", "-q", branch)
+	f.git("checkout", "-q", "main")
+}
+
+func (f *fx) push(branch string) { f.t.Helper(); f.git("push", "-q", "-u", "origin", branch) }
+
+func (f *fx) head(branch string) string {
+	f.t.Helper()
+	return f.git("rev-parse", "refs/heads/"+branch)
+}
+
+func (f *fx) mintReceipts() string {
+	f.t.Helper()
+	dir := filepath.Join(f.root, ".abcd", ".work.local", "preflight-receipts")
+	if err := os.MkdirAll(dir, 0o700); err != nil {
+		f.t.Fatal(err)
+	}
+	return dir
+}
+
+func (f *fx) receipt(sha string) {
+	f.t.Helper()
+	if err := os.WriteFile(filepath.Join(f.mintReceipts(), sha), []byte("ok\n"), 0o600); err != nil {
+		f.t.Fatal(err)
+	}
+}
+
+func (f *fx) reserve(id, copy string, claimed, expiry time.Time) {
+	f.res = append(f.res, claim.Reservation{Record: id, Copy: copy, State: claim.StateLive, ClaimedAt: claimed, EffectiveExpiry: expiry})
+}
+
+// reserveFresh is a live reservation under this copy's key, claimed an hour
+// ago with a four-hour lease, so its renewal is not due.
+func (f *fx) reserveFresh(id string) {
+	f.reserve(id, claim.CopyThis, f.now.Add(-time.Hour), f.now.Add(3*time.Hour))
+}
+
+func (f *fx) opts() ReadOptions {
+	return ReadOptions{
+		Root:   f.root,
+		Home:   f.home,
+		Now:    func() time.Time { return f.now },
+		Forge:  f.forge.run,
+		Person: "alice",
+		Email:  f.email,
+		Reservations: func(string, time.Time) (claim.Snapshot, error) {
+			return claim.Snapshot{Reservations: f.res}, nil
+		},
+	}
+}
+
+func (f *fx) awayRecord(hold bool, steps ...string) *Record {
+	f.t.Helper()
+	o := Options{Home: f.home, Now: func() time.Time { return f.now }, Who: func(string) string { return "alice" }}
+	rec, err := SetAway(f.root, "", hold, o)
+	if err != nil {
+		f.t.Fatal(err)
+	}
+	for _, s := range steps {
+		if rec, err = QueueStep(f.root, s, o); err != nil {
+			f.t.Fatal(err)
+		}
+	}
+	return rec
+}
+
+// read is ReadOwed while away (with a fresh away record) or present.
+func (f *fx) read(away bool) Owed {
+	f.t.Helper()
+	o := f.opts()
+	if away {
+		o.Record = f.awayRecord(false)
+	}
+	return f.readWith(o)
+}
+
+func (f *fx) readWith(o ReadOptions) Owed {
+	f.t.Helper()
+	owed, err := ReadOwed(context.Background(), o)
+	if err != nil {
+		f.t.Fatal(err)
+	}
+	return owed
+}
+
+func has(o Owed, kind OwedKind, key string) bool {
+	_, ok := find(o, kind, key)
+	return ok
+}
+
+func find(o Owed, kind OwedKind, key string) (OwedItem, bool) {
+	for _, i := range o.Items {
+		if i.Kind == kind && (i.Branch == key || i.Record == key) {
+			return i, true
+		}
+	}
+	return OwedItem{}, false
+}
+
+func describe(o Owed) string {
+	var b strings.Builder
+	for _, i := range o.Items {
+		b.WriteString(string(i.Kind) + ":" + i.Branch + i.Record + " ")
+	}
+	b.WriteString("notes=" + strings.Join(o.Notes, " | "))
+	return b.String()
+}
+
+// TestOwnBranchFromReflogWithoutWindow: a branch checked out before the mode
+// was set, with a recent commit of this checkout's, is still own.
+func TestOwnBranchFromReflogWithoutWindow(t *testing.T) {
+	f := newFx(t)
+	f.git("branch", "feat/a")
+	f.commitOn("feat/a", "work", "")
+	f.push("feat/a")
+	f.own("feat/a")
+	f.now = f.now.Add(6 * time.Hour) // the mode is set long after the checkout
+	p := pr(1, "feat/a", "main", "alice")
+	p.MergeStateStatus = "BEHIND"
+	f.forge.prs = []fakePR{p}
+	owed := f.read(true)
+	if it, ok := find(owed, OwedBehind, "feat/a"); !ok || it.PR != 1 || !it.Capped {
+		t.Fatalf("the branch checked out before the window must be own and owed as behind: %s", describe(owed))
+	}
+}
+
+// TestOwnBranchFromRecordedCreation: a branch cut with `git worktree add -b`,
+// absent from this copy's reflog, with no upstream and no record id, is own
+// once recorded.
+func TestOwnBranchFromRecordedCreation(t *testing.T) {
+	f := newFx(t)
+	wt := filepath.Join(t.TempDir(), "s")
+	f.git("worktree", "add", "-q", "-b", "feat/s", wt)
+	f.git("-C", wt, "commit", "-q", "--allow-empty", "-m", "stacked work")
+	if owed := f.read(false); has(owed, OwedUnpushed, "feat/s") {
+		t.Fatalf("an unrecorded branch in another worktree is not own: %s", describe(owed))
+	}
+	st, err := OpenStore(f.home, f.root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	key, err := claim.CopyKey(f.root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := st.RecordBranches(key, []BranchChange{{Kind: BranchCreated, Name: "feat/s"}}, f.now); err != nil {
+		t.Fatal(err)
+	}
+	if owed := f.read(false); !has(owed, OwedUnpushed, "feat/s") {
+		t.Fatalf("a recorded creation is own, and its unpushed commit owed: %s", describe(owed))
+	}
+}
+
+// writeRun lays a run state in this copy's local tier: key, its lanes'
+// branches and stages, and whether a spec step is still pending.
+func (f *fx) writeRun(id, key string, pending bool, lanes ...map[string]any) {
+	f.t.Helper()
+	dir := filepath.Join(f.root, ".abcd", ".work.local", "run", id)
+	if err := os.MkdirAll(dir, 0o700); err != nil {
+		f.t.Fatal(err)
+	}
+	st := map[string]any{"schema_version": 9, "run_id": id, "key": key, "lanes": lanes, "pending": []any{}}
+	if pending {
+		st["pending"] = []any{map[string]any{"spec_step": 2}}
+	}
+	raw, _ := json.Marshal(st)
+	if err := os.WriteFile(filepath.Join(dir, "state.json"), raw, 0o600); err != nil {
+		f.t.Fatal(err)
+	}
+}
+
+// TestOwnBranchFromLiveRunLane: a lane of a run whose reservation is live
+// under this copy's key is own; a lane of a run whose reservation lapsed, or
+// of a finished run, is not.
+func TestOwnBranchFromLiveRunLane(t *testing.T) {
+	f := newFx(t)
+	f.git("branch", "feat/lane")
+	f.commitOn("feat/lane", "lane work", "bob@example.invalid")
+	f.writeRun("run-0000000000000001", "itd-1", false, map[string]any{"id": "lane-1", "branch": "feat/lane", "stage": "validate"})
+	f.reserveFresh("itd-1")
+	if owed := f.read(false); !has(owed, OwedUnpushed, "feat/lane") {
+		t.Fatalf("a live run's lane is own: %s", describe(owed))
+	}
+	f.res[0].State = claim.StateExpired
+	if owed := f.read(false); has(owed, OwedUnpushed, "feat/lane") {
+		t.Fatalf("a lane whose run's reservation lapsed is not own: %s", describe(owed))
+	}
+	f.res[0].State = claim.StateLive
+	f.writeRun("run-0000000000000001", "itd-1", false, map[string]any{"id": "lane-1", "branch": "feat/lane", "stage": "done"})
+	if owed := f.read(false); has(owed, OwedUnpushed, "feat/lane") {
+		t.Fatalf("a finished run's lane is not own: %s", describe(owed))
+	}
+}
+
+// TestOwnBranchFromLinkedReservation: the head branch of an open pull request
+// a closing trailer links to a reservation under this copy's key is own.
+func TestOwnBranchFromLinkedReservation(t *testing.T) {
+	f := newFx(t)
+	f.reserveFresh("iss-7")
+	p := pr(3, "fix/other", "main", "alice")
+	p.Body = "Fixes the thing.\n\nResolves: iss-7\nAssisted-by: x"
+	p.StatusCheckRollup = rollupFailing
+	f.forge.prs = []fakePR{p}
+	owed := f.read(true)
+	if it, ok := find(owed, OwedFailing, "fix/other"); !ok || it.PR != 3 {
+		t.Fatalf("the linked pull request's head is own, and failing is owed: %s", describe(owed))
+	}
+	if has(owed, OwedUncarried, "iss-7") {
+		t.Fatalf("the linked pull request carries the reservation's work: %s", describe(owed))
+	}
+}
+
+// TestStaleOwnBranchNotOwed: a reflog or recorded branch whose newest commit
+// of this checkout's is older than 14 days, with no live reservation, is not
+// owed; a live reservation linking it keeps it owed.
+func TestStaleOwnBranchNotOwed(t *testing.T) {
+	f := newFx(t)
+	f.git("branch", "feat/old")
+	f.commitOn("feat/old", "old work", "")
+	f.own("feat/old")
+	f.git("branch", "feat/iss-9-old")
+	f.commitOn("feat/iss-9-old", "old linked work", "")
+	f.own("feat/iss-9-old")
+	f.now = f.now.Add(20 * 24 * time.Hour)
+	f.reserveFresh("iss-9")
+	owed := f.read(false)
+	if has(owed, OwedUnpushed, "feat/old") {
+		t.Fatalf("a branch with no commit of this checkout's in 14 days is not owed: %s", describe(owed))
+	}
+	if !has(owed, OwedUnpushed, "feat/iss-9-old") {
+		t.Fatalf("a live reservation linking a stale branch keeps it owed: %s", describe(owed))
+	}
+}
+
+// TestReviewCheckoutNotOwn: a branch checked out to review, holding only
+// another author's commits, and the head of a pull request another person
+// authored, are never own.
+func TestReviewCheckoutNotOwn(t *testing.T) {
+	f := newFx(t)
+	f.git("branch", "feat/review")
+	f.commitOn("feat/review", "their work", "bob@example.invalid")
+	f.own("feat/review")
+	f.git("branch", "feat/theirs")
+	f.commitOn("feat/theirs", "their work", "bob@example.invalid")
+	f.commitOn("feat/theirs", "my suggestion", "")
+	f.own("feat/theirs")
+	p := pr(5, "feat/theirs", "main", "bob")
+	p.MergeStateStatus = "BEHIND"
+	f.forge.prs = []fakePR{p}
+	owed := f.read(true)
+	for _, b := range []string{"feat/review", "feat/theirs"} {
+		for _, i := range owed.Items {
+			if i.Branch == b {
+				t.Fatalf("%s is never own: %s", b, describe(owed))
+			}
+		}
+	}
+}
+
+// TestSiblingBranchNotOwn: a branch a sibling working copy cut and works on
+// is none of this copy's routes, so it never holds this session.
+func TestSiblingBranchNotOwn(t *testing.T) {
+	f := newFx(t)
+	wt := filepath.Join(t.TempDir(), "sib")
+	f.git("worktree", "add", "-q", "-b", "feat/sib", wt)
+	f.git("-C", wt, "commit", "-q", "--allow-empty", "-m", "sibling work")
+	st, _ := OpenStore(f.home, f.root)
+	if err := st.RecordBranches("fedcba9876543210fedcba9876543210", []BranchChange{{Kind: BranchCreated, Name: "feat/sib"}}, f.now); err != nil {
+		t.Fatal(err)
+	}
+	f.forge.prs = []fakePR{pr(8, "feat/sib", "main", "alice")}
+	f.forge.prs[0].StatusCheckRollup = rollupFailing
+	owed := f.read(true)
+	for _, i := range owed.Items {
+		if i.Branch == "feat/sib" {
+			t.Fatalf("a sibling copy's branch is not own: %s", describe(owed))
+		}
+	}
+}
+
+// TestReservationCopyKeyFilter: a sibling copy's live reservation is not
+// owed; this copy's is, as uncarried work and, half through, as a renewal.
+func TestReservationCopyKeyFilter(t *testing.T) {
+	f := newFx(t)
+	f.reserve("iss-1", "", f.now.Add(-3*time.Hour), f.now.Add(time.Hour))
+	if owed := f.read(true); !owed.Empty() {
+		t.Fatalf("a sibling copy's reservation is not owed: %s", describe(owed))
+	}
+	f.res[0].Copy = claim.CopyThis
+	owed := f.read(true)
+	if !has(owed, OwedUncarried, "iss-1") || !has(owed, OwedRenewal, "iss-1") {
+		t.Fatalf("this copy's reservation, half through and carried by nothing: %s", describe(owed))
+	}
+	if it, _ := find(owed, OwedRenewal, "iss-1"); it.Capped {
+		t.Fatalf("a renewal is never capped")
+	}
+	if it, _ := find(owed, OwedUncarried, "iss-1"); !it.Capped {
+		t.Fatalf("uncarried work is capped")
+	}
+}
+
+// TestReservationLinkByHeadOrClosingTrailer: the record id in the head branch
+// or on a Resolves: or Delivers: line links; a green linked pull request is
+// not owed until renewal is due.
+func TestReservationLinkByHeadOrClosingTrailer(t *testing.T) {
+	f := newFx(t)
+	f.reserveFresh("iss-11")
+	f.reserveFresh("iss-12")
+	f.reserveFresh("itd-13")
+	a := pr(1, "fix/iss-11-thing", "main", "alice")
+	b := pr(2, "fix/y", "main", "alice")
+	b.Body = "Delivers: itd-13"
+	c := pr(3, "fix/z", "main", "alice")
+	c.Body = "Mentions iss-12 in passing."
+	f.forge.prs = []fakePR{a, b, c}
+	owed := f.read(true)
+	if has(owed, OwedUncarried, "iss-11") || has(owed, OwedUncarried, "itd-13") || !has(owed, OwedUncarried, "iss-12") {
+		t.Fatalf("head branch and closing trailer link; a mention does not: %s", describe(owed))
+	}
+	if len(owed.Items) != 1 {
+		t.Fatalf("green linked pull requests are not owed: %s", describe(owed))
+	}
+	f.now = f.now.Add(2 * time.Hour)
+	owed = f.read(true)
+	if !has(owed, OwedRenewal, "iss-11") || !has(owed, OwedRenewal, "itd-13") {
+		t.Fatalf("once half through, each renewal is due: %s", describe(owed))
+	}
+}
+
+// TestRecordIDWordBoundary: iss-5 does not match iss-50 in a branch name or a
+// trailer.
+func TestRecordIDWordBoundary(t *testing.T) {
+	f := newFx(t)
+	f.reserveFresh("iss-5")
+	p := pr(4, "fix/iss-50", "main", "alice")
+	p.Body = "Resolves: iss-50"
+	p.StatusCheckRollup = rollupFailing
+	f.forge.prs = []fakePR{p}
+	owed := f.read(true)
+	if !has(owed, OwedUncarried, "iss-5") || has(owed, OwedFailing, "fix/iss-50") {
+		t.Fatalf("iss-5 is not iss-50: %s", describe(owed))
+	}
+	if !mentionsID("feat/iss-5", "iss-5") || mentionsID("feat/iss-50", "iss-5") || !mentionsID("Resolves: iss-5, iss-6", "iss-5") {
+		t.Fatalf("the word-boundary match is wrong")
+	}
+}
+
+// TestRefsLineCarriesOnlyOwnBranch: a Refs: line on a sibling copy's pull
+// request neither carries the work nor makes its branch own; on an own
+// branch's pull request it carries it.
+func TestRefsLineCarriesOnlyOwnBranch(t *testing.T) {
+	f := newFx(t)
+	f.reserveFresh("iss-20")
+	sib := pr(1, "feat/sib", "main", "alice")
+	sib.Body = "Refs: iss-20"
+	sib.StatusCheckRollup = rollupFailing
+	f.forge.prs = []fakePR{sib}
+	owed := f.read(true)
+	if !has(owed, OwedUncarried, "iss-20") || has(owed, OwedFailing, "feat/sib") {
+		t.Fatalf("a Refs: line on a branch not own carries nothing and owns nothing: %s", describe(owed))
+	}
+	f.git("branch", "feat/mine")
+	f.commitOn("feat/mine", "work", "")
+	f.push("feat/mine")
+	f.own("feat/mine")
+	mine := pr(2, "feat/mine", "main", "alice")
+	mine.Body = "Refs: iss-20"
+	f.forge.prs = []fakePR{sib, mine}
+	if owed := f.read(true); has(owed, OwedUncarried, "iss-20") {
+		t.Fatalf("a Refs: line on an own branch's pull request carries the work: %s", describe(owed))
+	}
+}
+
+// TestBehindFromMergeState: a pull request whose merge state is BEHIND is
+// owed while the local default branch is stale and shows it current; DIRTY is
+// owed as behind; CLEAN is not; UNKNOWN reads as not read.
+func TestBehindFromMergeState(t *testing.T) {
+	for _, c := range []struct {
+		state string
+		owed  bool
+	}{{"BEHIND", true}, {"DIRTY", true}, {"CLEAN", false}, {"UNKNOWN", false}} {
+		t.Run(c.state, func(t *testing.T) {
+			f := newFx(t)
+			f.git("branch", "feat/a")
+			f.commitOn("feat/a", "work", "")
+			f.push("feat/a")
+			f.own("feat/a")
+			p := pr(1, "feat/a", "main", "alice")
+			p.MergeStateStatus = c.state
+			f.forge.prs = []fakePR{p}
+			owed := f.read(true)
+			if has(owed, OwedBehind, "feat/a") != c.owed {
+				t.Fatalf("merge state %s: owed as behind = %v, want %v: %s", c.state, !c.owed, c.owed, describe(owed))
+			}
+			if c.state == "UNKNOWN" && !strings.Contains(strings.Join(owed.Notes, " "), "not read") {
+				t.Fatalf("UNKNOWN must be said as not read: %s", describe(owed))
+			}
+		})
+	}
+}
+
+// stack makes feat/base (own, pushed, one commit off main) and feat/top on it
+// (own, pushed, one commit more).
+func (f *fx) stack() {
+	f.t.Helper()
+	f.git("branch", "feat/base")
+	f.commitOn("feat/base", "base work", "")
+	f.push("feat/base")
+	f.own("feat/base")
+	f.git("branch", "feat/top", "feat/base")
+	f.commitOn("feat/top", "top work", "")
+	f.push("feat/top")
+	f.own("feat/top")
+}
+
+// TestStackedBranchFoundWithoutPullRequest: with no pull request, a branch
+// whose nearest own ancestor branch is not in the default branch is stacked,
+// and owed while behind that base.
+func TestStackedBranchFoundWithoutPullRequest(t *testing.T) {
+	f := newFx(t)
+	f.stack()
+	f.commitOn("feat/base", "base moves on", "")
+	owed := f.read(true)
+	it, ok := find(owed, OwedStacked, "feat/top")
+	if !ok || !strings.Contains(it.Reason, "feat/base") {
+		t.Fatalf("feat/top is stacked on feat/base and behind it: %s", describe(owed))
+	}
+	if has(owed, OwedStacked, "feat/base") {
+		t.Fatalf("feat/base stands on the default branch, not stacked: %s", describe(owed))
+	}
+}
+
+// TestStackedBranchClearingRule: a stacked branch is owed while behind its
+// base, failing, with a review outstanding, or unverified; waiting on its base
+// otherwise.
+func TestStackedBranchClearingRule(t *testing.T) {
+	cases := []struct {
+		name    string
+		mutate  func(*fakePR)
+		receipt bool
+		owed    bool
+	}{
+		{"behind", func(p *fakePR) { p.MergeStateStatus = "BEHIND" }, true, true},
+		{"failing", func(p *fakePR) { p.StatusCheckRollup = rollupFailing }, true, true},
+		{"review", func(p *fakePR) { p.ReviewDecision = "CHANGES_REQUESTED" }, true, true},
+		{"unverified", func(p *fakePR) {}, false, true},
+		{"waiting", func(p *fakePR) {}, true, false},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			f := newFx(t)
+			f.stack()
+			f.mintReceipts()
+			if c.receipt {
+				f.receipt(f.head("feat/top"))
+			}
+			base := pr(1, "feat/base", "main", "alice")
+			top := pr(2, "feat/top", "feat/base", "alice")
+			c.mutate(&top)
+			f.forge.prs = []fakePR{base, top}
+			owed := f.read(true)
+			if has(owed, OwedStacked, "feat/top") != c.owed {
+				t.Fatalf("%s: stacked owed = %v, want %v: %s", c.name, !c.owed, c.owed, describe(owed))
+			}
+			if has(owed, OwedBehind, "feat/top") || has(owed, OwedFailing, "feat/top") {
+				t.Fatalf("a stacked branch is judged by the clearing rule alone: %s", describe(owed))
+			}
+		})
+	}
+}
+
+// TestClearingRuleReview: CHANGES_REQUESTED in the listing, and a run lane
+// with no passing review of its head, are owed.
+func TestClearingRuleReview(t *testing.T) {
+	f := newFx(t)
+	f.stack()
+	f.receipt(f.head("feat/top"))
+	f.forge.prs = []fakePR{pr(1, "feat/base", "main", "alice"), pr(2, "feat/top", "feat/base", "alice")}
+	f.reserveFresh("itd-2")
+	lane := func(head string, pass bool) map[string]any {
+		return map[string]any{"id": "lane-1", "branch": "feat/top", "stage": "validate", "validation": []any{
+			map[string]any{"round": 1, "head_sha": head, "validators": []any{map[string]any{"role": "r", "pass": pass}}},
+		}}
+	}
+	f.writeRun("run-0000000000000002", "itd-2", true, lane("0000000000000000000000000000000000000000", true))
+	if owed := f.read(true); !has(owed, OwedStacked, "feat/top") {
+		t.Fatalf("a lane with no passing review of its head is owed: %s", describe(owed))
+	}
+	f.writeRun("run-0000000000000002", "itd-2", true, lane(f.head("feat/top"), false))
+	if owed := f.read(true); !has(owed, OwedStacked, "feat/top") {
+		t.Fatalf("a lane whose review of its head did not pass is owed: %s", describe(owed))
+	}
+	f.writeRun("run-0000000000000002", "itd-2", true, lane(f.head("feat/top"), true))
+	if owed := f.read(true); has(owed, OwedStacked, "feat/top") {
+		t.Fatalf("a lane with a passing review of its head waits on its base: %s", describe(owed))
+	}
+	f.forge.prs[1].ReviewDecision = "CHANGES_REQUESTED"
+	if owed := f.read(true); !has(owed, OwedStacked, "feat/top") {
+		t.Fatalf("CHANGES_REQUESTED is owed: %s", describe(owed))
+	}
+}
+
+// TestClearingRuleWithoutReceipts: in a repository with no receipt folder,
+// passing checks verify; checks still running owe it uncapped; with no pull
+// request the reason says it was not verified.
+func TestClearingRuleWithoutReceipts(t *testing.T) {
+	f := newFx(t)
+	f.stack()
+	f.forge.prs = []fakePR{pr(1, "feat/base", "main", "alice"), pr(2, "feat/top", "feat/base", "alice")}
+	if owed := f.read(true); has(owed, OwedStacked, "feat/top") {
+		t.Fatalf("passing checks verify where no receipts are minted: %s", describe(owed))
+	}
+	f.forge.prs[1].StatusCheckRollup = rollupRunning
+	owed := f.read(true)
+	it, ok := find(owed, OwedStacked, "feat/top")
+	if !ok || it.Capped {
+		t.Fatalf("checks still running owe it, not capped: %s", describe(owed))
+	}
+	f.forge.prs = nil
+	owed = f.read(true)
+	if has(owed, OwedStacked, "feat/top") || !strings.Contains(strings.Join(owed.Notes, " "), "not verified") {
+		t.Fatalf("with no pull request it is judged on the rest, and said not verified: %s", describe(owed))
+	}
+	f.commitOn("feat/base", "base moves on", "")
+	owed = f.read(true)
+	if it, ok := find(owed, OwedStacked, "feat/top"); !ok || !strings.Contains(it.Reason, "not verified") {
+		t.Fatalf("owed for being behind, the reason says it was not verified: %s", describe(owed))
+	}
+}
+
+// TestUnpushedSkipsGoneUpstream: a squash-merged branch whose upstream is gone
+// is not owed.
+func TestUnpushedSkipsGoneUpstream(t *testing.T) {
+	f := newFx(t)
+	f.git("branch", "feat/g")
+	f.commitOn("feat/g", "work", "")
+	f.push("feat/g")
+	f.own("feat/g")
+	f.commitOn("feat/g", "more", "")
+	if owed := f.read(false); !has(owed, OwedUnpushed, "feat/g") {
+		t.Fatalf("a commit not on the upstream is owed: %s", describe(owed))
+	}
+	f.git("push", "-q", "origin", "--delete", "feat/g")
+	f.git("fetch", "-q", "--prune", "origin")
+	if owed := f.read(false); has(owed, OwedUnpushed, "feat/g") {
+		t.Fatalf("a branch whose upstream is gone is not owed: %s", describe(owed))
+	}
+}
+
+// TestQueuedPushHandsItemBack: without --hold-pushes a queued step hands
+// nothing back; with it, a step naming an unpushed branch whose head contains
+// the base's last-fetched tip and has a receipt hands that branch's unpushed
+// item back, recorded once per branch and head; nothing else is handed back.
+func TestQueuedPushHandsItemBack(t *testing.T) {
+	setup := func(t *testing.T) *fx {
+		f := newFx(t)
+		f.git("branch", "feat/p")
+		f.commitOn("feat/p", "work", "")
+		f.own("feat/p")
+		f.receipt(f.head("feat/p"))
+		return f
+	}
+	readWith := func(f *fx, hold bool, steps ...string) Owed {
+		o := f.opts()
+		o.Record = f.awayRecord(hold, steps...)
+		return f.readWith(o)
+	}
+	handedBack := func(t *testing.T, f *fx) []HandBack {
+		st, _ := OpenStore(f.home, f.root)
+		rec, err := st.Read()
+		if err != nil {
+			t.Fatal(err)
+		}
+		return rec.HandedBack
+	}
+
+	t.Run("no hold-pushes", func(t *testing.T) {
+		f := setup(t)
+		if owed := readWith(f, false, "push feat/p"); !has(owed, OwedUnpushed, "feat/p") {
+			t.Fatalf("without --hold-pushes a queued push hands nothing back: %s", describe(owed))
+		}
+		if hb := handedBack(t, f); len(hb) != 0 {
+			t.Fatalf("nothing is recorded as handed back: %v", hb)
+		}
+	})
+	t.Run("hold-pushes verified", func(t *testing.T) {
+		f := setup(t)
+		if owed := readWith(f, true, "push feat/p"); has(owed, OwedUnpushed, "feat/p") {
+			t.Fatalf("a verified branch's queued push is handed back: %s", describe(owed))
+		}
+		o := f.opts()
+		st, _ := OpenStore(f.home, f.root)
+		o.Record, _ = st.Read()
+		f.readWith(o)
+		hb := handedBack(t, f)
+		if len(hb) != 1 || hb[0].Branch != "feat/p" || hb[0].Head != f.head("feat/p") {
+			t.Fatalf("the hand-back is recorded once per branch and head: %+v", hb)
+		}
+	})
+	t.Run("hold-pushes base moved", func(t *testing.T) {
+		f := setup(t)
+		f.commitOn("main", "main moves on", "")
+		f.git("push", "-q", "origin", "main")
+		if owed := readWith(f, true, "push feat/p"); !has(owed, OwedUnpushed, "feat/p") {
+			t.Fatalf("a head lacking the base's tip is not handed back: %s", describe(owed))
+		}
+	})
+	t.Run("hold-pushes no receipt", func(t *testing.T) {
+		f := setup(t)
+		f.commitOn("feat/p", "more", "")
+		if owed := readWith(f, true, "push feat/p"); !has(owed, OwedUnpushed, "feat/p") {
+			t.Fatalf("a head with no receipt is not handed back: %s", describe(owed))
+		}
+	})
+	t.Run("hold-pushes mints no receipts", func(t *testing.T) {
+		f := setup(t)
+		if err := os.RemoveAll(f.mintReceipts()); err != nil {
+			t.Fatal(err)
+		}
+		if owed := readWith(f, true, "push feat/p"); !has(owed, OwedUnpushed, "feat/p") {
+			t.Fatalf("a repository that mints no receipts hands nothing back: %s", describe(owed))
+		}
+	})
+	t.Run("hold-pushes behind and failing pull requests", func(t *testing.T) {
+		f := setup(t)
+		for _, b := range []string{"feat/b", "feat/f"} {
+			f.git("branch", b)
+			f.commitOn(b, "work", "")
+			f.push(b)
+			f.own(b)
+			f.commitOn(b, "local fix", "")
+			f.receipt(f.head(b))
+		}
+		behind := pr(1, "feat/b", "main", "alice")
+		behind.MergeStateStatus = "DIRTY"
+		failing := pr(2, "feat/f", "main", "alice")
+		failing.StatusCheckRollup = rollupFailing
+		f.forge.prs = []fakePR{behind, failing}
+		owed := readWith(f, true, "push feat/b", "push feat/f")
+		if !has(owed, OwedBehind, "feat/b") || !has(owed, OwedFailing, "feat/f") {
+			t.Fatalf("a behind or failing pull request stays owed though its fix is queued: %s", describe(owed))
+		}
+	})
+	t.Run("hold-pushes stacked and review", func(t *testing.T) {
+		f := setup(t)
+		f.stack()
+		f.commitOn("feat/top", "unpushed", "")
+		f.receipt(f.head("feat/top"))
+		top := pr(2, "feat/top", "feat/base", "alice")
+		top.ReviewDecision = "CHANGES_REQUESTED"
+		f.forge.prs = []fakePR{pr(1, "feat/base", "main", "alice"), top}
+		owed := readWith(f, true, "push feat/top")
+		if !has(owed, OwedStacked, "feat/top") {
+			t.Fatalf("a stacked branch the clearing rule owes, a review outstanding, stays owed: %s", describe(owed))
+		}
+	})
+	t.Run("hold-pushes reservation and renewal", func(t *testing.T) {
+		f := setup(t)
+		f.reserve("iss-30", claim.CopyThis, f.now.Add(-3*time.Hour), f.now.Add(time.Hour))
+		owed := readWith(f, true, "open the pull request for iss-30", "renew iss-30")
+		if !has(owed, OwedUncarried, "iss-30") || !has(owed, OwedRenewal, "iss-30") {
+			t.Fatalf("a reservation queued by its id, and a renewal, are never handed back: %s", describe(owed))
+		}
+	})
+	t.Run("hold-pushes word boundary", func(t *testing.T) {
+		f := setup(t)
+		f.git("branch", "feat/iss-50")
+		f.commitOn("feat/iss-50", "work", "")
+		f.own("feat/iss-50")
+		f.receipt(f.head("feat/iss-50"))
+		if owed := readWith(f, true, "push feat/iss-5"); !has(owed, OwedUnpushed, "feat/iss-50") {
+			t.Fatalf("iss-5 queued does not hand back iss-50: %s", describe(owed))
+		}
+	})
+}
+
+// TestPresentReadsDiskOnly: while the person is present the check makes no
+// forge call, and reads renewals due and unpushed own branches only.
+func TestPresentReadsDiskOnly(t *testing.T) {
+	f := newFx(t)
+	f.git("branch", "feat/a")
+	f.commitOn("feat/a", "work", "")
+	f.own("feat/a")
+	f.reserve("iss-3", claim.CopyThis, f.now.Add(-3*time.Hour), f.now.Add(time.Hour))
+	f.forge.prs = []fakePR{pr(1, "feat/a", "main", "alice")}
+	owed := f.read(false)
+	if f.forge.calls != 0 {
+		t.Fatalf("present: %d forge calls, want none", f.forge.calls)
+	}
+	if !has(owed, OwedUnpushed, "feat/a") || !has(owed, OwedRenewal, "iss-3") || has(owed, OwedUncarried, "iss-3") {
+		t.Fatalf("present reads renewals due and unpushed branches only: %s", describe(owed))
+	}
+	// A record past its end is not away either.
+	o := f.opts()
+	rec := f.awayRecord(false)
+	o.Record = rec
+	o.Now = func() time.Time { return rec.Ends().Add(time.Minute) }
+	f.readWith(o)
+	if f.forge.calls != 0 {
+		t.Fatalf("a lapsed record is not away: %d forge calls", f.forge.calls)
+	}
+}
+
+// TestForgeListingDeadline: the listing runs under a ten-second deadline; a
+// hung listing ends at it, and the check fails open to the disk kinds with a
+// "not read" note: a branch with a pull request is compared on disk naming
+// the fetch time, and a reservation is never reported as uncarried.
+func TestForgeListingDeadline(t *testing.T) {
+	f := newFx(t)
+	f.git("branch", "feat/a")
+	f.commitOn("feat/a", "work", "")
+	f.push("feat/a")
+	f.own("feat/a")
+	f.commitOn("main", "main moves on", "")
+	f.git("push", "-q", "origin", "main")
+	f.reserveFresh("iss-4")
+
+	f.forge.err = errors.New("gh: not signed in")
+	o := f.opts()
+	o.Record = f.awayRecord(false)
+	start := time.Now()
+	f.readWith(o)
+	if len(f.forge.ctxs) != 1 {
+		t.Fatalf("one listing per check, got %d", len(f.forge.ctxs))
+	}
+	dl, ok := f.forge.ctxs[0].Deadline()
+	if !ok || dl.Sub(start) > ForgeDeadline+time.Second || dl.Sub(start) < ForgeDeadline-time.Second {
+		t.Fatalf("the listing's deadline is %v from the start, want %v", dl.Sub(start), ForgeDeadline)
+	}
+
+	f.forge.err = nil
+	f.forge.hang = true
+	o.ForgeDeadline = 300 * time.Millisecond
+	start = time.Now()
+	owed := f.readWith(o)
+	if took := time.Since(start); took > 5*time.Second {
+		t.Fatalf("a hung listing must end at its deadline; the check took %v", took)
+	}
+	notes := strings.Join(owed.Notes, " ")
+	if !strings.Contains(notes, "not read") {
+		t.Fatalf("a failed listing is named as not read: %s", describe(owed))
+	}
+	it, ok := find(owed, OwedBehind, "feat/a")
+	if !ok || !strings.Contains(it.Reason, "origin/main") || !strings.Contains(it.Reason, "fetched") {
+		t.Fatalf("a pushed branch is compared on disk with the default branch, naming the fetch: %s", describe(owed))
+	}
+	if has(owed, OwedUncarried, "iss-4") {
+		t.Fatalf("a reservation is never reported uncarried when the listing failed: %s", describe(owed))
+	}
+}
+
+// TestOwedOrderFixed: the items come in the fixed order, and the next item is
+// the first of a renewal due, a failing pull request, a behind one, a stacked
+// branch, an unpushed branch and unhanded work.
+func TestOwedOrderFixed(t *testing.T) {
+	f := newFx(t)
+	f.stack()
+	f.commitOn("feat/base", "base moves on", "")
+	f.git("branch", "feat/u")
+	f.commitOn("feat/u", "work", "")
+	f.own("feat/u")
+	for _, b := range []string{"feat/fail", "feat/behind"} {
+		f.git("branch", b)
+		f.commitOn(b, "work", "")
+		f.push(b)
+		f.own(b)
+	}
+	failing := pr(3, "feat/fail", "main", "alice")
+	failing.StatusCheckRollup = rollupFailing
+	behind := pr(4, "feat/behind", "main", "alice")
+	behind.MergeStateStatus = "BEHIND"
+	f.forge.prs = []fakePR{behind, failing}
+	f.reserve("iss-40", claim.CopyThis, f.now.Add(-3*time.Hour), f.now.Add(time.Hour))
+	owed := f.read(true)
+	var kinds []OwedKind
+	for _, i := range owed.Items {
+		if len(kinds) == 0 || kinds[len(kinds)-1] != i.Kind {
+			kinds = append(kinds, i.Kind)
+		}
+	}
+	want := OwedKinds()
+	if len(kinds) != len(want) {
+		t.Fatalf("kinds %v, want each of %v once in order: %s", kinds, want, describe(owed))
+	}
+	for i := range want {
+		if kinds[i] != want[i] {
+			t.Fatalf("kinds %v, want %v", kinds, want)
+		}
+	}
+	if next, _ := owed.Next(); next.Kind != OwedRenewal {
+		t.Fatalf("the next item is the renewal: %+v", next)
+	}
+}
diff --git a/internal/core/landing/primitives.go b/internal/core/landing/primitives.go
index c87aafc99c..8b6d114757 100644
--- a/internal/core/landing/primitives.go
+++ b/internal/core/landing/primitives.go
@@ -100,15 +100,25 @@ var ErrNoForgeClient = errors.New("the forge client `gh` is not installed")
 // that comes from a record or a branch rides in its flag's own argument
 // (--flag=value) at the caller, so none can be read as a flag of its own.
 func GH(dir string, args ...string) (string, error) {
+	return GHContext(context.Background(), dir, args...)
+}
+
+// GHContext is GH bound to ctx as well as to ForgeTimeout: the client is
+// killed at whichever ends first, and a process it started that still holds
+// its output open is waited for at most a second more, so a caller's own
+// deadline (the away mode's stop check, which lists the forge under ten
+// seconds) holds.
+func GHContext(parent context.Context, dir string, args ...string) (string, error) {
 	bin, err := exec.LookPath("gh")
 	if err != nil {
 		return "", ErrNoForgeClient
 	}
-	ctx, cancel := context.WithTimeout(context.Background(), ForgeTimeout)
+	ctx, cancel := context.WithTimeout(parent, ForgeTimeout)
 	defer cancel()
 	cmd := exec.CommandContext(ctx, bin, args...)
 	cmd.Dir = dir
 	cmd.Env = append(gitutil.ScrubbedEnv(), "GH_PROMPT_DISABLED=1", "GH_NO_UPDATE_NOTIFIER=1")
+	cmd.WaitDelay = time.Second
 	return runCapped(cmd, "gh "+strings.Join(args[:min(2, len(args))], " "))
 }
 

From 632b60b865f34ae9c98043e4e683bd097fcfd38f Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 13:09:46 +0100
Subject: [PATCH 21/58] docs: mark the recorder and owed-work steps landed and
 record the lane's choices

Refs: itd-2610180912189125
Assisted-by: Claude:claude-opus-5-5
---
 ...489-a-session-told-to-work-on-while-its.md | 63 +++++++++++++++++++
 1 file changed, 63 insertions(+)

diff --git a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
index 6f1e7b43be..3ceeff819c 100644
--- a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
+++ b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
@@ -574,6 +574,67 @@ lane's choice, recorded for review; none changes a test the step names.
   `08-abcd.md` keeps the badge and points at the new chapter. The three
   sub-verbs' sentences and the queue's worked example go in
   `internal/core/surface`, as every visible verb's do.
+- 2026-10-18 (lane 2's choice, steps 3 and 4, for review): **The
+  created-branch list holds a hundred names**, the oldest dropped
+  (`autonomy.MaxCreatedBranches`): a hundred names at git's 255-byte limit
+  stay well within the store's 64 KiB per file. A rename keeps the record's
+  place and time.
+- 2026-10-18 (lane 2's choice, for review): **The recorder reads literal
+  words only, and runs before the registry loads.** A word a substitution or
+  a variable prints makes the command no act; `git -C <dir>` is stepped over,
+  not followed, and every name is judged against the session copy's
+  repository. It runs ahead of the registry, so a disabled or unloaded
+  registry does not stop a branch being recorded. `git worktree add <path>
+  <commit-ish>` records the name when it is a branch or resolves to nothing
+  (git then creates it), never a tag or an object name; `--detach` and
+  `--orphan` record nothing; `git branch -c|-C` is recorded as a creation.
+- 2026-10-18 (lane 2's choice, for review): **The copy is the payload
+  `cwd`'s worktree until step 2's start-copy note lands.** The recorder
+  resolves it in one function (`awayCopyRoot` in `internal/surface/cli`) for
+  step 2 to route through its note, and `autonomy.ReadOwed` takes the copy
+  root from its caller (`ReadOptions.Root`).
+- 2026-10-18 (lane 2's choice, for review): **The away listing lists every
+  open pull request, not only the person's,** so a branch whose pull request
+  another person authored can be told apart: the person is the holder name
+  reservations resolve without a network read (`claim.ReaderHolder`), and
+  when that is unknown the listing asks `--author @me` and that rule is not
+  applied. At most 200 are listed. The ADR's decision says "the person's
+  open pull requests"; invariant 7's clause says "the open pull requests".
+- 2026-10-18 (lane 2's choice, for review): **"Recent" is a commit beyond
+  the default branch whose author email is this checkout's, made or
+  rewritten (the later of its author and committer dates) within 14 days.**
+  A live reservation links a branch by its name too (the record id on word
+  boundaries), not only through a pull request. The reflog route reads both
+  ends of each `checkout: moving from A to B` line and the branch checked out
+  now.
+- 2026-10-18 (lane 2's choice, for review): **A stacked branch whose base
+  has moved on is still found without a pull request:** the branch they share
+  a commit with, outside the default branch, is its base when that commit
+  was the other branch's own tip by its reflog (set there other than by the
+  branch's creation, which tells a base from a branch cut from it). A stacked
+  branch is one `stacked` item naming what it needs, never a separate behind
+  or failing item; a stacked pull request with no checks reported, where no
+  receipts are minted, is not verified and owed.
+- 2026-10-18 (lane 2's choice, for review): **When the listing fails, "a
+  branch with a pull request" is read as an own branch with an upstream that
+  is not gone**, compared on disk with the last-fetched default branch; the
+  fetch time is the default branch's reflog, else `claim.LastFetched`.
+- 2026-10-18 (lane 2's choice, for review): **A release reservation
+  (`rel-…`) is never owed as uncarried work,** since no pull request carries
+  a release; its renewal due still counts.
+- 2026-10-18 (lane 2's choice, for review): **A queued step names a branch
+  as a whole name in which `.`, `_`, `/` and `-` continue the name,** so
+  `feat/p` is never found in `feat/p-2`: stricter than the record id's word
+  boundary, where `-` ends the id so `fix/iss-5-x` names iss-5. `ReadOwed`
+  records each hand-back itself (`Store.RecordHandBack`), and the unpushed
+  item's reason is the fact alone; the push wording is the verdict's (step 5).
+- 2026-10-18 (lane 2's choice, for review): **The run states are read
+  leniently, for their lanes alone**, rather than through the loop's strict
+  decoder: a run counts while a spec step is pending or a lane is not done,
+  and a lane counts while its stage is not done, discarded or handed back.
+  `landing.GHContext` was added beside `landing.GH` to bind the forge client
+  to the ten-second deadline, and the guard's `abcd guard` and `abcd guard
+  hook` sentences now name the branch record they write.
 
 ## Footprint
 
@@ -650,6 +711,7 @@ lane's choice, recorded for review; none changes a test the step names.
      write leaves a stderr line); TestBranchRecorderUnderLock (two recordings
      racing keep both). commands/guard.md and the brief's guard chapter say
      the hook records a created branch and refuses nothing for it.
+   - landed: 710b9626b
 4. Owed work, and invariant 7's clause
    - packages: internal/core/autonomy, .abcd/development/brief/02-constraints/03-invariants.md
    - tests: internal/core/autonomy
@@ -705,6 +767,7 @@ lane's choice, recorded for review; none changes a test the step names.
      reservation is never reported as uncarried);
      TestOwedOrderFixed. Brief invariant 7 gains the away mode's one listing
      per check and its deadline, citing adr-2610181003541997.
+   - landed: 1ad31a522
 5. The stop verdict, the Stop and StopFailure hooks
    - packages: internal/core/autonomy, internal/surface/cli, hooks
    - tests: internal/core/autonomy, internal/surface/cli

From 5d754f95b57c64b2e6e4518bab03388e8c3be372 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 13:23:23 +0100
Subject: [PATCH 22/58] feat: wire the away mode's stop check to the Stop and
 StopFailure hooks

abcd hook stop maps the Stop payload onto the verdict: it reads the
session's start copy from the session-start note, the away record, the
owed set through one seam the owed reader fills, and the session's
state, then answers {"decision":"block","reason":...} on a block, a
systemMessage naming owed work while the person is present, and
nothing otherwise. It records accepted hand-backs and the stop passing
the host's cap (CLAUDE_CODE_STOP_HOOK_BLOCK_CAP raises it) under the
store's lock. A malformed payload, an unreadable record or session
state, or a lock not had allows the stop with a stderr line. abcd hook
stop-failure records a turn ended on an API error, with its type, while
the record holds, and writes nothing while the person is present. The
manifest gains Stop (30-second timeout) and StopFailure entries whose
scripts never download the binary, and the brief's hook paragraphs name
them.

Refs: itd-2610180912189125
Assisted-by: Claude:claude-opus-5-5
---
 .../development/brief/04-surfaces/01-ahoy.md  |  13 +-
 .../brief/05-internals/03-configuration.md    |   9 +-
 .abcd/development/release/surface.json        |  10 +
 hooks/hooks.json                              |  21 ++
 hooks/stop-failure.sh                         |   4 +
 hooks/stop.sh                                 |   4 +
 internal/surface/cli/cli.go                   |   5 +
 internal/surface/cli/hook_stop.go             | 284 ++++++++++++++++++
 internal/surface/cli/hook_stop_test.go        | 267 ++++++++++++++++
 internal/surface/cli/hooks_homestop_test.go   |   2 +
 .../cli/hooks_selfprovision_count_test.go     |   2 +-
 .../surface/cli/hooks_selfprovision_test.go   |   2 +
 internal/surface/cli/hooks_timeout_test.go    |   2 +
 13 files changed, 619 insertions(+), 6 deletions(-)
 create mode 100644 hooks/stop-failure.sh
 create mode 100644 hooks/stop.sh
 create mode 100644 internal/surface/cli/hook_stop.go
 create mode 100644 internal/surface/cli/hook_stop_test.go

diff --git a/.abcd/development/brief/04-surfaces/01-ahoy.md b/.abcd/development/brief/04-surfaces/01-ahoy.md
index 99f2f934cb..f180909a76 100644
--- a/.abcd/development/brief/04-surfaces/01-ahoy.md
+++ b/.abcd/development/brief/04-surfaces/01-ahoy.md
@@ -659,7 +659,7 @@ carries the prompt-router entries it expects. Neither install nor uninstall ever
 mutates it: the manifest is plugin-static. A missing or malformed manifest
 surfaces as a non-resolvable diagnostic.
 
-The shipped manifest wires seven event types, and every event command is a
+The shipped manifest wires nine event types, and every event command is a
 resolving shim rather than a plain binary call. Five of them self-provision.
 `UserPromptSubmit`, `PreToolUse`, `PostToolUse` and `PreCompact` each attempt
 `hooks/bootstrap.sh` only when the plugin-root binary is missing, recording the
@@ -668,8 +668,10 @@ window. `UserPromptSubmit`, the hook that runs on every message, declares a
 120-second `timeout`, the time a salvage on a slow link has before the host
 cancels it; `PreToolUse`, `PostToolUse` and `PreCompact` declare none and take
 the host's ten-minute default, so a slow first download finishes there. `SessionStart`
-declares 240 seconds, the script's worst case with room to spare, and
-`SessionEnd` and `SubagentStop` declare none. Every event that runs the script,
+declares 240 seconds, the script's worst case with room to spare,
+`SessionEnd`, `SubagentStop` and `StopFailure` declare none, and `Stop` declares
+30 seconds, room for the away mode's stop check to make its one forge listing
+under its own ten-second deadline and its git reads. Every event that runs the script,
 `SessionStart` included, names a `statusMessage` the host shows as its spinner
 text while the hook runs, so the wait is never a silent stall: the salvage
 itself sends the script's output nowhere. The message states no duration,
@@ -689,6 +691,11 @@ capture (iss-2608210934566223). Each resolves the plugin root, then `PATH`, then
 says in one line that the transcript was not captured. `SubagentStop` never
 returns a non-zero code of its own beyond that refusal, because exit 2 is the
 host's BLOCKING status on that event and would stop the sub-agent finishing.
+`Stop` and `StopFailure`, which carry the away mode's stop check
+(spc-2610180914469489), download nothing either: both fire at a turn's end, where
+a fetch would hold the session, and each resolves the plugin root, then `PATH`,
+then says in one line that the stop check did not run, with exit 1, never the
+`Stop` event's blocking 2.
 
 **The `PATH` rung is owned-only** (GHSA-gx3m-3224-qqcv, CWE-426). It accepts only
 an absolute resolution out of a directory that is neither under the shim's
diff --git a/.abcd/development/brief/05-internals/03-configuration.md b/.abcd/development/brief/05-internals/03-configuration.md
index aaddb6ad7d..9e7b1ce306 100644
--- a/.abcd/development/brief/05-internals/03-configuration.md
+++ b/.abcd/development/brief/05-internals/03-configuration.md
@@ -1310,14 +1310,19 @@ names a `statusMessage`, the host's spinner text while the hook runs, because th
 salvage sends the script's output nowhere; the text states no duration, since
 those limits differ. A test pins every event's timeout and the message
 (`internal/surface/cli/hooks_timeout_test.go`). `SessionEnd` and
-`SubagentStop` are the two
+`SubagentStop` are among the four
 exceptions and download nothing at all: each fires where the harness cancels a slow
 hook rather than wait — one as the session exits, the other inside a live session as
 a sub-agent finishes — so a fetch there races that cancellation and loses the
 transcript the hook exists to capture (iss-2608210934566223). Both resolve the
 plugin root, then PATH, then say the transcript was not captured. `SubagentStop`
 additionally never exits non-zero beyond that refusal, because exit 2 is the host's
-BLOCKING code on that event.
+BLOCKING code on that event. `Stop` and `StopFailure` carry the away
+mode's stop check (`hook stop`, `hook stop-failure`, spc-2610180914469489) and fire
+at a turn's end, where a fetch would hold the session; each resolves the plugin
+root, then PATH, then says the stop check did not run, at exit 1, never `Stop`'s
+blocking 2. `Stop` declares a 30-second `timeout`, room for the check's one forge
+listing under its own ten-second deadline; `StopFailure` declares none.
 
 `SessionEnd` carries `hook session-end`, which stages the session's own transcript;
 `SubagentStop` carries `hook subagent-stop`, which stages a finished sub-agent's
diff --git a/.abcd/development/release/surface.json b/.abcd/development/release/surface.json
index 81d8d7d9b8..a8d1e69760 100644
--- a/.abcd/development/release/surface.json
+++ b/.abcd/development/release/surface.json
@@ -1779,6 +1779,16 @@
       "hidden": false,
       "flags": []
     },
+    {
+      "path": "abcd hook stop",
+      "hidden": false,
+      "flags": []
+    },
+    {
+      "path": "abcd hook stop-failure",
+      "hidden": false,
+      "flags": []
+    },
     {
       "path": "abcd hook subagent-stop",
       "hidden": false,
diff --git a/hooks/hooks.json b/hooks/hooks.json
index 406c3b00ec..f06e0ba9e3 100644
--- a/hooks/hooks.json
+++ b/hooks/hooks.json
@@ -78,6 +78,27 @@
           }
         ]
       }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "timeout": 30,
+            "command": "sh \"${CLAUDE_PLUGIN_ROOT}/hooks/stop.sh\""
+          }
+        ]
+      }
+    ],
+    "StopFailure": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "sh \"${CLAUDE_PLUGIN_ROOT}/hooks/stop-failure.sh\""
+          }
+        ]
+      }
     ]
   }
 }
diff --git a/hooks/stop-failure.sh b/hooks/stop-failure.sh
new file mode 100644
index 0000000000..fe3aa397ac
--- /dev/null
+++ b/hooks/stop-failure.sh
@@ -0,0 +1,4 @@
+#!/bin/sh
+# abcd's StopFailure hook. hooks/hooks.json runs this file with sh, so the host's
+# hook-error line names this short command rather than the whole script.
+r="${CLAUDE_PLUGIN_ROOT:-}"; [ -n "$r" ] || exit 0; z=""; case "${HOME:-}" in /*) if [ -e "$HOME/.abcd" ] || [ -L "$HOME/.abcd" ]; then z=1; fi ;; esac; if [ -n "$z" ]; then if [ -f "$r/abcd" ] && [ -x "$r/abcd" ]; then exec "$r/abcd" hook stop-failure; fi; if [ -e "$HOME/.abcd.noindex" ] || [ -L "$HOME/.abcd.noindex" ]; then printf '%s\n' 'abcd: Both ~/.abcd and ~/.abcd.noindex exist, so abcd has written nothing and moves neither. Keep the one you want, named ~/.abcd.noindex, and take the other out of your home folder, reconnect the working copies kept there with `find ~/.abcd.noindex/worktrees -type d -exec test -e {}/.git \; -prune -exec test -f {}/.git \; -exec git -C {} worktree repair \;` (each `repair: gitdir incorrect` line it prints is a link it fixed), then run abcd again.' >&2; else printf '%s\n' 'abcd: abcd'\''s folder is now ~/.abcd.noindex, a name the Mac'\''s search indexer passes over, and ~/.abcd still stands, so abcd has written nothing. Rename it with `mv ~/.abcd ~/.abcd.noindex`, reconnect the working copies kept there with `find ~/.abcd.noindex/worktrees -type d -exec test -e {}/.git \; -prune -exec test -f {}/.git \; -exec git -C {} worktree repair \;` (each `repair: gitdir incorrect` line it prints is a link it fixed), then run abcd again.' >&2; fi; exit 1; fi; g=""; if [ -f "$r/abcd" ] && [ -x "$r/abcd" ]; then g="$r/abcd"; fi; if [ -z "$g" ]; then c=$(command -v abcd 2>/dev/null); if [ -n "$c" ]; then y=""; case "$c" in /*) dd=${c%/*}; [ -n "$dd" ] || dd=/; d=$(cd -P "$dd" 2>/dev/null && pwd -P); if [ -z "$d" ]; then y="its directory could not be resolved"; else q=$(pwd -P); case "$d/" in "$q"/*) y="it lives inside the working tree" ;; esac; fi; if [ -z "$y" ]; then case "$(/bin/ls -ld "$d" 2>/dev/null)" in ????????w*) y="its directory is world-writable" ;; esac; fi; if [ -z "$y" ]; then case "$(/bin/ls -ldL "$c" 2>/dev/null)" in ????????w*) y="the binary itself is world-writable" ;; esac; fi ;; *) y="it did not resolve to an absolute path" ;; esac; if [ -z "$y" ]; then o=""; w=""; e="${HOME:-}/.abcd.noindex/path-entry"; if [ -n "${HOME:-}" ] && [ -f "$e" ]; then if [ -L "${HOME}/.abcd.noindex" ]; then w=2; elif [ -n "$(find "$e" -maxdepth 0 -type f -user "$(id -un 2>/dev/null)" ! -perm -0020 ! -perm -0002 2>/dev/null)" ]; then while IFS= read -r ln || [ -n "$ln" ]; do case "$ln" in path=*) if [ "${ln#path=}" = "$c" ]; then o=1; fi ;; esac; done < "$e"; else w=1; fi; fi; if [ "$w" = 2 ]; then y="~/.abcd.noindex is a symlink, so its path-entry record is not read (replace the link with a real directory)"; elif [ -n "$w" ]; then y="its ~/.abcd.noindex/path-entry record is not owned by you or is writable by others"; else [ -n "$o" ] || y="~/.abcd.noindex/path-entry does not record it as the abcd installed here"; fi; fi; if [ -n "$y" ]; then p=$(printf '%s' "$c" | tr -d '\000-\037\177'); printf '%s\n' "abcd: ignoring the abcd found on PATH at $p because $y — a hook runs only the abcd recorded in ~/.abcd.noindex/path-entry by the documented install, from an ordinary user directory such as ~/.local/bin that neither the project nor another local user can replace; re-run the install per https://github.com/intentdriven/abcd#install to record it" >&2; else g="$c"; fi; fi; fi; if [ -n "$g" ]; then exec "$g" hook stop-failure; fi; printf '%s\n' "abcd: the plugin binary is missing, so a turn ended on an API error was not recorded — install per https://github.com/intentdriven/abcd#install" >&2; exit 1
diff --git a/hooks/stop.sh b/hooks/stop.sh
new file mode 100644
index 0000000000..a59b3772a3
--- /dev/null
+++ b/hooks/stop.sh
@@ -0,0 +1,4 @@
+#!/bin/sh
+# abcd's Stop hook. hooks/hooks.json runs this file with sh, so the host's
+# hook-error line names this short command rather than the whole script.
+r="${CLAUDE_PLUGIN_ROOT:-}"; [ -n "$r" ] || exit 0; z=""; case "${HOME:-}" in /*) if [ -e "$HOME/.abcd" ] || [ -L "$HOME/.abcd" ]; then z=1; fi ;; esac; if [ -n "$z" ]; then if [ -f "$r/abcd" ] && [ -x "$r/abcd" ]; then exec "$r/abcd" hook stop; fi; if [ -e "$HOME/.abcd.noindex" ] || [ -L "$HOME/.abcd.noindex" ]; then printf '%s\n' 'abcd: Both ~/.abcd and ~/.abcd.noindex exist, so abcd has written nothing and moves neither. Keep the one you want, named ~/.abcd.noindex, and take the other out of your home folder, reconnect the working copies kept there with `find ~/.abcd.noindex/worktrees -type d -exec test -e {}/.git \; -prune -exec test -f {}/.git \; -exec git -C {} worktree repair \;` (each `repair: gitdir incorrect` line it prints is a link it fixed), then run abcd again.' >&2; else printf '%s\n' 'abcd: abcd'\''s folder is now ~/.abcd.noindex, a name the Mac'\''s search indexer passes over, and ~/.abcd still stands, so abcd has written nothing. Rename it with `mv ~/.abcd ~/.abcd.noindex`, reconnect the working copies kept there with `find ~/.abcd.noindex/worktrees -type d -exec test -e {}/.git \; -prune -exec test -f {}/.git \; -exec git -C {} worktree repair \;` (each `repair: gitdir incorrect` line it prints is a link it fixed), then run abcd again.' >&2; fi; exit 1; fi; g=""; if [ -f "$r/abcd" ] && [ -x "$r/abcd" ]; then g="$r/abcd"; fi; if [ -z "$g" ]; then c=$(command -v abcd 2>/dev/null); if [ -n "$c" ]; then y=""; case "$c" in /*) dd=${c%/*}; [ -n "$dd" ] || dd=/; d=$(cd -P "$dd" 2>/dev/null && pwd -P); if [ -z "$d" ]; then y="its directory could not be resolved"; else q=$(pwd -P); case "$d/" in "$q"/*) y="it lives inside the working tree" ;; esac; fi; if [ -z "$y" ]; then case "$(/bin/ls -ld "$d" 2>/dev/null)" in ????????w*) y="its directory is world-writable" ;; esac; fi; if [ -z "$y" ]; then case "$(/bin/ls -ldL "$c" 2>/dev/null)" in ????????w*) y="the binary itself is world-writable" ;; esac; fi ;; *) y="it did not resolve to an absolute path" ;; esac; if [ -z "$y" ]; then o=""; w=""; e="${HOME:-}/.abcd.noindex/path-entry"; if [ -n "${HOME:-}" ] && [ -f "$e" ]; then if [ -L "${HOME}/.abcd.noindex" ]; then w=2; elif [ -n "$(find "$e" -maxdepth 0 -type f -user "$(id -un 2>/dev/null)" ! -perm -0020 ! -perm -0002 2>/dev/null)" ]; then while IFS= read -r ln || [ -n "$ln" ]; do case "$ln" in path=*) if [ "${ln#path=}" = "$c" ]; then o=1; fi ;; esac; done < "$e"; else w=1; fi; fi; if [ "$w" = 2 ]; then y="~/.abcd.noindex is a symlink, so its path-entry record is not read (replace the link with a real directory)"; elif [ -n "$w" ]; then y="its ~/.abcd.noindex/path-entry record is not owned by you or is writable by others"; else [ -n "$o" ] || y="~/.abcd.noindex/path-entry does not record it as the abcd installed here"; fi; fi; if [ -n "$y" ]; then p=$(printf '%s' "$c" | tr -d '\000-\037\177'); printf '%s\n' "abcd: ignoring the abcd found on PATH at $p because $y — a hook runs only the abcd recorded in ~/.abcd.noindex/path-entry by the documented install, from an ordinary user directory such as ~/.local/bin that neither the project nor another local user can replace; re-run the install per https://github.com/intentdriven/abcd#install to record it" >&2; else g="$c"; fi; fi; fi; if [ -n "$g" ]; then exec "$g" hook stop; fi; printf '%s\n' "abcd: the plugin binary is missing, so the away mode's stop check did not run — install per https://github.com/intentdriven/abcd#install" >&2; exit 1
diff --git a/internal/surface/cli/cli.go b/internal/surface/cli/cli.go
index 4f7d789969..1c257d6466 100644
--- a/internal/surface/cli/cli.go
+++ b/internal/surface/cli/cli.go
@@ -152,6 +152,7 @@ func applyHookPlaneFailOpen(root *cobra.Command) {
 		{"hook"}, {"hook", "prompt-router"}, {"hook", "prompt-router-reset"},
 		{"hook", "session-start"}, {"hook", "session-end"},
 		{"hook", "subagent-stop"}, {"hook", "question-answered"},
+		{"hook", "stop"}, {"hook", "stop-failure"},
 	} {
 		if cmd := findByPath(root, path); cmd != nil {
 			cmd.SetFlagErrorFunc(failOpenFlagError)
@@ -2288,6 +2289,10 @@ envelope carries it as system_message.`,
 	// store resolution it needs.
 	hookCmd.AddCommand(newSubagentStopCommand())
 
+	// stop and stop-failure — Stop and StopFailure: the away mode's stop
+	// check (spc-2610180914469489 step 5). Their bodies live in hook_stop.go.
+	hookCmd.AddCommand(newHookStopCommand(), newHookStopFailureCommand())
+
 	return hookCmd
 }
 
diff --git a/internal/surface/cli/hook_stop.go b/internal/surface/cli/hook_stop.go
new file mode 100644
index 0000000000..68a9aabd75
--- /dev/null
+++ b/internal/surface/cli/hook_stop.go
@@ -0,0 +1,284 @@
+package cli
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"regexp"
+	"strconv"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/core/autonomy"
+	"github.com/intentdriven/abcd/internal/fsutil"
+	"github.com/intentdriven/abcd/internal/termsafe"
+	"github.com/spf13/cobra"
+)
+
+// hook_stop.go — `abcd hook stop` and `abcd hook stop-failure`, the front
+// doors onto the away mode's stop check (spc-2610180914469489 step 5).
+//
+// Every path is fail-open and loud, the guard's contract: a malformed
+// payload, an unreadable record or session state, an owed set that could not
+// be read, or the away store's lock not had within its two seconds allows the
+// stop and says so on stderr. A stop is never blocked on abcd's own fault.
+
+// stopReadOptions is what the stop check hands the owed reader: the
+// session's working copy (its start copy, from the session-start note), the
+// away record (not holding, the reader reads disk only and never calls the
+// forge), the home the away store lives under, and the clock.
+//
+// TODO(merge): this is a local stand-in for autonomy.ReadOptions, which step
+// 4's branch adds with these fields among others; at the merge the type
+// becomes autonomy.ReadOptions and the seam's default autonomy.ReadOwed.
+type stopReadOptions struct {
+	Root   string
+	Record *autonomy.Record
+	Home   string
+	Now    func() time.Time
+}
+
+// stopOwedReader is the seam the owed reader (spc-2610180914469489 step 4,
+// built in parallel, autonomy.ReadOwed) fills: it returns the owed set, its
+// forge listing under its own ten-second deadline while away. Until it is
+// wired the seam reads nothing owed, so the verdict judges an empty set. A
+// test replaces it with constructed sets.
+var stopOwedReader = func(context.Context, stopReadOptions) (autonomy.Owed, error) {
+	return autonomy.Owed{}, nil
+}
+
+// stopReadBudget bounds the owed read inside the Stop hook's 30-second
+// timeout, leaving the hook time to judge, record and answer.
+const stopReadBudget = 25 * time.Second
+
+// stopBlockCapEnv names the host's setting that raises its continuation cap.
+const stopBlockCapEnv = "CLAUDE_CODE_STOP_HOOK_BLOCK_CAP"
+
+// stopPayload is the Stop and StopFailure payload, the fields the stop check
+// reads.
+type stopPayload struct {
+	SessionID            string                    `json:"session_id"`
+	Cwd                  string                    `json:"cwd"`
+	StopHookActive       bool                      `json:"stop_hook_active"`
+	LastAssistantMessage string                    `json:"last_assistant_message"`
+	BackgroundTasks      []autonomy.BackgroundTask `json:"background_tasks"`
+	SessionCrons         []autonomy.SessionCron    `json:"session_crons"`
+	// Error is StopFailure's error type (rate_limit, overloaded, …).
+	Error string `json:"error"`
+}
+
+func readStopPayload(cmd *cobra.Command) (stopPayload, error) {
+	raw, err := io.ReadAll(io.LimitReader(cmd.InOrStdin(), maxHookStdinBytes+1))
+	if err != nil {
+		return stopPayload{}, err
+	}
+	if len(raw) > maxHookStdinBytes {
+		return stopPayload{}, fmt.Errorf("payload is over the %d-byte cap; it was discarded unparsed", maxHookStdinBytes)
+	}
+	var p stopPayload
+	if err := json.Unmarshal(raw, &p); err != nil {
+		return stopPayload{}, err
+	}
+	if p.Cwd == "" {
+		if wd, err := os.Getwd(); err == nil {
+			p.Cwd = wd
+		}
+	}
+	return p, nil
+}
+
+// stopAllow names on stderr why the stop is allowed, and allows it.
+func stopAllow(cmd *cobra.Command, format string, a ...any) error {
+	diagnosticLine(cmd.ErrOrStderr(), "abcd stop: "+format+"; the stop is allowed", a...)
+	return nil
+}
+
+func newHookStopCommand() *cobra.Command {
+	return &cobra.Command{
+		Use:   "stop",
+		Short: "Stop: keep a session working while the person is away and work is owed",
+		Long: `The Stop hook's front door onto the away mode's stop check.
+
+While the away record holds (abcd mode autonomous), a turn's end is blocked
+while work is owed, naming the next item, and is allowed only with a
+session cron whose latest fire time, the host's lateness included, falls
+before the deadline: within half an hour while work is owed (an hour when
+none is) and before the session's reservations need renewing. A wake
+releases an unchanged set of work the session can do itself at most twice
+in a row, and a last message ending on a question is blocked once. Plain
+stdout is then {"decision":"block","reason":...}; the block passing the
+host's cap of consecutive continuations (eight, or
+CLAUDE_CODE_STOP_HOOK_BLOCK_CAP) is recorded in the away record as a stop
+possibly forced by the cap. While the person is present the check reads disk
+only and, with work owed, allows the stop with a systemMessage naming it.
+
+The session's state is kept per session id in its start copy's local tier,
+.abcd/.work.local/autonomy/sessions/<session-id>.json. A malformed payload,
+an unreadable record or a lock not had allows the stop, naming why on
+stderr; every outcome exits 0.`,
+		Args: cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			p, err := readStopPayload(cmd)
+			if err != nil {
+				return stopAllow(cmd, "unreadable Stop payload (%s)", termsafe.Sanitize(err.Error()))
+			}
+			if p.Cwd == "" {
+				return nil
+			}
+			copyRoot, st, err := autonomy.ResolveCopy(p.Cwd, p.SessionID, autonomy.Options{})
+			if err != nil {
+				return nil // not a checkout abcd can key a store on: nothing to check
+			}
+			now := time.Now()
+			rec, away, err := st.Away(now)
+			if err != nil {
+				return stopAllow(cmd, "%s; read as not away", fsutil.RedactHome(err.Error()))
+			}
+			if away && !autonomy.ValidSessionID(p.SessionID) {
+				return stopAllow(cmd, "the session id %q is not [A-Za-z0-9_-]{1,128}", termsafe.CleanProseLine(p.SessionID, 64))
+			}
+			ctx, cancel := context.WithTimeout(context.Background(), stopReadBudget)
+			defer cancel()
+			home, _ := os.UserHomeDir()
+			owed, err := stopOwedReader(ctx, stopReadOptions{Root: copyRoot, Record: rec, Home: home, Now: func() time.Time { return now }})
+			if err != nil {
+				return stopAllow(cmd, "owed work could not be read (%s)", fsutil.RedactHome(err.Error()))
+			}
+			in := autonomy.StopInput{
+				SessionID: p.SessionID, StopHookActive: p.StopHookActive, LastAssistantMessage: p.LastAssistantMessage,
+				SessionCrons: p.SessionCrons, BackgroundTasks: p.BackgroundTasks, Cap: stopBlockCap(cmd.ErrOrStderr()),
+			}
+			var prev autonomy.SessionState
+			if away {
+				if prev, err = autonomy.LoadSession(copyRoot, p.SessionID); err != nil {
+					return stopAllow(cmd, "the session's state could not be read (%s)", fsutil.RedactHome(err.Error()))
+				}
+			}
+			v := autonomy.Judge(rec, owed, in, prev, now)
+			if v.Save {
+				if err := autonomy.SaveSession(copyRoot, p.SessionID, v.State); err != nil {
+					return stopAllow(cmd, "the session's state could not be saved (%s)", fsutil.RedactHome(err.Error()))
+				}
+			}
+			for _, h := range v.HandBacks {
+				if _, err := st.RecordHandBack(h.Branch, h.Head, now); err != nil {
+					return stopAllow(cmd, "the hand-back of %s was not recorded (%s)", termsafe.CleanProseLine(h.Branch, 128), stopStoreWords(err))
+				}
+			}
+			if v.Stop != nil {
+				if _, err := st.RecordStop(*v.Stop, now); err != nil {
+					return stopAllow(cmd, "the stop was not recorded (%s)", stopStoreWords(err))
+				}
+			}
+			return emitStop(cmd, v)
+		},
+	}
+}
+
+// stopStoreWords names an away-store failure, the lock's included.
+func stopStoreWords(err error) string {
+	if errors.Is(err, autonomy.ErrLockBusy) {
+		return "the away store's lock was not had in time: " + fsutil.RedactHome(err.Error())
+	}
+	return fsutil.RedactHome(err.Error())
+}
+
+// stopBlockCap is the host's continuation cap as the environment sets it;
+// 0 (the default of eight) when it is unset or not a positive number.
+func stopBlockCap(stderr io.Writer) int {
+	raw := os.Getenv(stopBlockCapEnv)
+	if raw == "" {
+		return 0
+	}
+	n, err := strconv.Atoi(raw)
+	if err != nil || n <= 0 {
+		diagnosticLine(stderr, "abcd stop: %s=%q is not a positive number; counting to the host's default of %d",
+			stopBlockCapEnv, termsafe.CleanProseLine(raw, 32), autonomy.DefaultBlockCap)
+		return 0
+	}
+	return n
+}
+
+type stopBlockOutput struct {
+	Decision string `json:"decision"`
+	Reason   string `json:"reason"`
+}
+
+type stopMessageOutput struct {
+	SystemMessage string `json:"systemMessage"`
+}
+
+// emitStop writes the host's answer: the block object, the person's line, or
+// nothing.
+func emitStop(cmd *cobra.Command, v autonomy.Verdict) error {
+	var obj any
+	switch {
+	case v.Block:
+		obj = stopBlockOutput{Decision: "block", Reason: v.Reason}
+	case v.SystemMessage != "":
+		obj = stopMessageOutput{SystemMessage: termsafe.CleanProseLine(v.SystemMessage, 1024)}
+	default:
+		return nil
+	}
+	var b bytes.Buffer
+	enc := json.NewEncoder(&b)
+	enc.SetEscapeHTML(false)
+	if err := enc.Encode(obj); err != nil {
+		return stopAllow(cmd, "the answer could not be written (%s)", err.Error())
+	}
+	if _, err := io.Copy(cmd.OutOrStdout(), &b); err != nil {
+		diagnosticLine(cmd.ErrOrStderr(), "abcd stop: the answer could not be written (%s)", err.Error())
+	}
+	return nil
+}
+
+// stopErrorRe is the shape of the host's error types; anything else is
+// recorded as unknown.
+var stopErrorRe = regexp.MustCompile(`^[a-z][a-z0-9_]{0,63}$`)
+
+func newHookStopFailureCommand() *cobra.Command {
+	return &cobra.Command{
+		Use:   "stop-failure",
+		Short: "StopFailure: record a turn the host ended on an API error while the person is away",
+		Long: `The StopFailure hook's front door. While the away record holds, a turn the
+host ended on an API error is recorded in it as "stopped on an API error"
+with the error type, under the store's lock; abcd mode back prints it. The
+host ignores this hook's output and it cannot continue the session. While
+the person is present nothing is written. Every outcome exits 0.`,
+		Args: cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			p, err := readStopPayload(cmd)
+			if err != nil {
+				diagnosticLine(cmd.ErrOrStderr(), "abcd stop: unreadable StopFailure payload (%s); nothing recorded", termsafe.Sanitize(err.Error()))
+				return nil
+			}
+			if p.Cwd == "" {
+				return nil
+			}
+			_, st, err := autonomy.ResolveCopy(p.Cwd, p.SessionID, autonomy.Options{})
+			if err != nil {
+				return nil
+			}
+			now := time.Now()
+			_, away, err := st.Away(now)
+			if err != nil {
+				diagnosticLine(cmd.ErrOrStderr(), "abcd stop: %s; read as not away, nothing recorded", fsutil.RedactHome(err.Error()))
+				return nil
+			}
+			if !away {
+				return nil
+			}
+			kind := p.Error
+			if !stopErrorRe.MatchString(kind) {
+				kind = "unknown"
+			}
+			if _, err := st.RecordStop(autonomy.Stop{Kind: autonomy.StopAPIError, ErrorType: kind}, now); err != nil {
+				diagnosticLine(cmd.ErrOrStderr(), "abcd stop: the API-error stop was not recorded (%s)", stopStoreWords(err))
+			}
+			return nil
+		},
+	}
+}
diff --git a/internal/surface/cli/hook_stop_test.go b/internal/surface/cli/hook_stop_test.go
new file mode 100644
index 0000000000..8f5aaf5291
--- /dev/null
+++ b/internal/surface/cli/hook_stop_test.go
@@ -0,0 +1,267 @@
+package cli
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/core/autonomy"
+)
+
+// hook_stop_test.go — step 5 of spc-2610180914469489: `abcd hook stop` and
+// `abcd hook stop-failure`, the front doors onto the stop verdict.
+
+// fakeOwed replaces the owed reader for one test with one answering owed, and
+// counts the calls and what each was asked.
+func fakeOwed(t *testing.T, owed *autonomy.Owed) *[]stopReadOptions {
+	t.Helper()
+	var asked []stopReadOptions
+	prev := stopOwedReader
+	stopOwedReader = func(_ context.Context, q stopReadOptions) (autonomy.Owed, error) {
+		asked = append(asked, q)
+		return *owed, nil
+	}
+	t.Cleanup(func() { stopOwedReader = prev })
+	return &asked
+}
+
+func stopHookPayload(t *testing.T, session, cwd string, active bool, last string, crons ...string) string {
+	t.Helper()
+	var cs []map[string]any
+	for i, c := range crons {
+		cs = append(cs, map[string]any{"id": "cron-" + string(rune('a'+i)), "schedule": c, "recurring": true, "prompt": "look"})
+	}
+	b, err := json.Marshal(map[string]any{
+		"session_id": session, "cwd": cwd, "hook_event_name": "Stop",
+		"stop_hook_active": active, "last_assistant_message": last,
+		"background_tasks": []any{}, "session_crons": cs,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return string(b)
+}
+
+type stopOut struct {
+	Decision      string `json:"decision"`
+	Reason        string `json:"reason"`
+	SystemMessage string `json:"systemMessage"`
+}
+
+func runStop(t *testing.T, payload string) (stopOut, string, string) {
+	t.Helper()
+	so, se, err := runSplit(t, payload, "hook", "stop")
+	if err != nil {
+		t.Fatalf("hook stop exited non-zero: %v\nstderr: %s", err, se)
+	}
+	var out stopOut
+	if strings.TrimSpace(so) != "" {
+		if err := json.Unmarshal([]byte(so), &out); err != nil {
+			t.Fatalf("hook stop stdout is not one object: %v\n%s", err, so)
+		}
+	}
+	return out, so, se
+}
+
+var behindItem = autonomy.OwedItem{Kind: autonomy.OwedBehind, Capped: true, Branch: "feat/behind", PR: 12, Head: "aaaa"}
+
+// TestHookStopOutput: `{"decision":"block","reason":…}` only on a block, a
+// systemMessage while present with work owed; a malformed payload, an
+// unreadable record or a held lock allows with a stderr line.
+func TestHookStopOutput(t *testing.T) {
+	root := awayCheckout(t)
+	owed := autonomy.Owed{Items: []autonomy.OwedItem{behindItem}}
+	asked := fakeOwed(t, &owed)
+
+	// Present, work owed: allowed, flagged, the reader asked for disk only.
+	out, so, _ := runStop(t, stopHookPayload(t, "s1", root, false, "Done."))
+	if out.Decision != "" || !strings.Contains(out.SystemMessage, "feat/behind") {
+		t.Errorf("present with work owed: %s", so)
+	}
+	if len(*asked) != 1 || (*asked)[0].Record.Holds(time.Now()) {
+		t.Errorf("present: the reader was asked %+v, want once, not away", *asked)
+	}
+	// Present, nothing owed: silent.
+	owed = autonomy.Owed{}
+	if _, so, _ := runStop(t, stopHookPayload(t, "s1", root, false, "Done.")); so != "" {
+		t.Errorf("present with nothing owed printed %q", so)
+	}
+
+	// Away, work owed: blocked.
+	setAway(t)
+	owed = autonomy.Owed{Items: []autonomy.OwedItem{behindItem}}
+	out, so, _ = runStop(t, stopHookPayload(t, "s1", root, false, "Done.", "*/10 * * * *"))
+	if out.Decision != "block" || !strings.Contains(out.Reason, "feat/behind") || out.SystemMessage != "" {
+		t.Errorf("away with work owed, first stop: %s", so)
+	}
+	if q := (*asked)[len(*asked)-1]; q.Root != root || !q.Record.Holds(time.Now()) || q.Home == "" {
+		t.Errorf("away: the reader was asked %+v", q)
+	}
+	// Away, nothing owed, a qualifying wake: allowed, silent.
+	owed = autonomy.Owed{}
+	if _, so, _ := runStop(t, stopHookPayload(t, "s2", root, false, "Done.", "*/30 * * * *")); so != "" {
+		t.Errorf("away, nothing owed, a wake: printed %q", so)
+	}
+
+	// A malformed payload allows, with a stderr line.
+	if _, so, se := runStop(t, "{not json"); so != "" || !strings.Contains(se, "allow") {
+		t.Errorf("malformed payload: stdout %q stderr %q", so, se)
+	}
+	// A bad session id while away allows, with a stderr line.
+	if _, so, se := runStop(t, stopHookPayload(t, "../evil", root, false, "Done.")); so != "" || !strings.Contains(se, "session id") {
+		t.Errorf("bad session id: stdout %q stderr %q", so, se)
+	}
+
+	// A held lock, when the stop must be recorded, allows with a stderr line.
+	owed = autonomy.Owed{Items: []autonomy.OwedItem{behindItem}}
+	st := awayStore(t, root)
+	if err := autonomy.SaveSession(root, "s3", autonomy.SessionState{
+		Fingerprint: owed.Fingerprint(), WakeFingerprint: owed.CappedFingerprint(), Blocks: autonomy.DefaultBlockCap,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	var held stopOut
+	var heldOut, heldErr string
+	if err := st.WithLock(func() error {
+		held, heldOut, heldErr = runStop(t, stopHookPayload(t, "s3", root, true, "Done."))
+		return nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if held.Decision != "" || heldOut != "" || !strings.Contains(heldErr, "lock") {
+		t.Errorf("held lock: stdout %q stderr %q; want the stop allowed and the lock named", heldOut, heldErr)
+	}
+
+	// An unreadable record allows, with a stderr line.
+	if err := os.WriteFile(st.RecordPath(), []byte("{garbage"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if _, so, se := runStop(t, stopHookPayload(t, "s1", root, false, "Done.")); so != "" || !strings.Contains(se, "not away") {
+		t.Errorf("unreadable record: stdout %q stderr %q", so, se)
+	}
+}
+
+// TestHookStopCapFromEnvironment: CLAUDE_CODE_STOP_HOOK_BLOCK_CAP sets the
+// cap, and the block passing it records the stop, labelled possibly forced by
+// the cap, in the away record.
+func TestHookStopCapFromEnvironment(t *testing.T) {
+	root := awayCheckout(t)
+	setAway(t)
+	owed := autonomy.Owed{Items: []autonomy.OwedItem{behindItem}}
+	fakeOwed(t, &owed)
+	t.Setenv("CLAUDE_CODE_STOP_HOOK_BLOCK_CAP", "3")
+	for i := 1; i <= 4; i++ {
+		out, so, _ := runStop(t, stopHookPayload(t, "cap-1", root, i > 1, "Done."))
+		if out.Decision != "block" {
+			t.Fatalf("block %d: %s", i, so)
+		}
+		stops := readAway(t, root).Stops
+		if want := map[bool]int{true: 1, false: 0}[i == 4]; len(stops) != want {
+			t.Fatalf("after block %d the record holds %d stops, want %d", i, len(stops), want)
+		}
+	}
+	s := readAway(t, root).Stops[0]
+	if s.Kind != autonomy.StopWorkOwed || !s.PossiblyForcedByCap || !strings.Contains(s.Detail, "feat/behind") {
+		t.Errorf("recorded %+v", s)
+	}
+}
+
+// TestHookStopWakeCountAcrossRuns: the wake count and its fingerprint are
+// read back from the session's state file by each hook run, kept in the
+// session's start copy even when the hook runs from a worktree it made.
+func TestHookStopWakeCountAcrossRuns(t *testing.T) {
+	root := awayCheckout(t)
+	if _, _, err := runSplit(t, awayStartPayload("wake-1", root, "startup"), "hook", "session-start"); err != nil {
+		t.Fatal(err)
+	}
+	made := filepath.Join(t.TempDir(), "made")
+	gitAt(t, root, "worktree", "add", "-q", "-b", "feat/made", made)
+	made = realPath(t, made)
+	setAway(t)
+	owed := autonomy.Owed{Items: []autonomy.OwedItem{behindItem}}
+	asked := fakeOwed(t, &owed)
+	var blocks []bool
+	for i := 0; i < 5; i++ {
+		out, _, _ := runStop(t, stopHookPayload(t, "wake-1", made, false, "Done.", "*/10 * * * *"))
+		blocks = append(blocks, out.Decision == "block")
+	}
+	want := []bool{true, false, false, true, true}
+	for i := range want {
+		if blocks[i] != want[i] {
+			t.Fatalf("stops blocked %v, want %v (first block, two wakes, then blocked)", blocks, want)
+		}
+	}
+	if q := (*asked)[0]; q.Root != root {
+		t.Errorf("the reader was asked about %s, want the start copy %s", q.Root, root)
+	}
+	st, err := autonomy.LoadSession(root, "wake-1")
+	if err != nil || st.Wakes != 2 || st.WakeFingerprint != owed.CappedFingerprint() {
+		t.Errorf("the start copy's state file: %+v (%v)", st, err)
+	}
+	if _, err := os.Stat(filepath.Join(made, filepath.FromSlash(autonomy.SessionsDir))); err == nil {
+		t.Errorf("the made worktree holds session state; it belongs to the start copy")
+	}
+}
+
+// TestHookStopRecordsHandBack: a hand-back the verdict accepts is recorded
+// in the away record, once per branch and head, and counted on the person's
+// line.
+func TestHookStopRecordsHandBack(t *testing.T) {
+	root := awayCheckout(t)
+	setAway(t, "--hold-pushes")
+	item := autonomy.OwedItem{Kind: autonomy.OwedUnpushed, Capped: true, Branch: "feat/ready", Head: strings.Repeat("c", 40)}
+	owed := autonomy.Owed{HandedBack: []autonomy.OwedItem{item}}
+	fakeOwed(t, &owed)
+	for i := 0; i < 2; i++ {
+		if out, so, _ := runStop(t, stopHookPayload(t, "hb-1", root, false, "Done.", "*/30 * * * *")); out.Decision != "" {
+			t.Fatalf("a handed-back item kept the stop blocked: %s", so)
+		}
+	}
+	rec := readAway(t, root)
+	if len(rec.HandedBack) != 1 || rec.HandedBack[0].Branch != "feat/ready" {
+		t.Errorf("record holds hand-backs %+v, want feat/ready once", rec.HandedBack)
+	}
+	if !strings.Contains(rec.PersonLine(), "1 item handed back") {
+		t.Errorf("the person's line: %q", rec.PersonLine())
+	}
+}
+
+// TestHookStopFailureRecords: the error type is recorded while away, and
+// nothing is written while present.
+func TestHookStopFailureRecords(t *testing.T) {
+	root := awayCheckout(t)
+	payload := `{"session_id":"f1","cwd":"` + root + `","hook_event_name":"StopFailure","error":"rate_limit","error_details":"429 Too Many Requests","last_assistant_message":"API Error: Rate limit reached"}`
+	so, se, err := runSplit(t, payload, "hook", "stop-failure")
+	if err != nil || so != "" {
+		t.Fatalf("present: err %v stdout %q stderr %q", err, so, se)
+	}
+	if _, err := os.Stat(awayStore(t, root).Dir()); err == nil {
+		t.Errorf("present: the away store was created")
+	}
+	setAway(t)
+	for i := 0; i < 2; i++ {
+		if so, se, err := runSplit(t, payload, "hook", "stop-failure"); err != nil || so != "" {
+			t.Fatalf("away: err %v stdout %q stderr %q", err, so, se)
+		}
+	}
+	stops := readAway(t, root).Stops
+	if len(stops) != 1 || stops[0].Kind != autonomy.StopAPIError || stops[0].ErrorType != "rate_limit" || stops[0].Count != 2 {
+		t.Errorf("recorded %+v, want one api-error entry for rate_limit counted twice", stops)
+	}
+	// A malformed payload or an odd error type never fails the hook.
+	if _, _, err := runSplit(t, "{nope", "hook", "stop-failure"); err != nil {
+		t.Errorf("malformed payload: %v", err)
+	}
+	odd := strings.Replace(payload, "rate_limit", "rate limit\\u001b[31m", 1)
+	if _, _, err := runSplit(t, odd, "hook", "stop-failure"); err != nil {
+		t.Fatal(err)
+	}
+	last := readAway(t, root).Stops
+	if got := last[len(last)-1].ErrorType; got != "unknown" {
+		t.Errorf("an error type outside the host's shape was recorded as %q, want unknown", got)
+	}
+}
diff --git a/internal/surface/cli/hooks_homestop_test.go b/internal/surface/cli/hooks_homestop_test.go
index 75935eccb9..4d18b6ae53 100644
--- a/internal/surface/cli/hooks_homestop_test.go
+++ b/internal/surface/cli/hooks_homestop_test.go
@@ -35,6 +35,8 @@ var stopWrapperEvents = []struct {
 	{"PreCompact", 1, []string{"hook prompt-router-reset"}},
 	{"SessionEnd", 1, []string{"hook session-end"}},
 	{"SubagentStop", 1, []string{"hook subagent-stop"}},
+	{"Stop", 1, []string{"hook stop"}},
+	{"StopFailure", 1, []string{"hook stop-failure"}},
 }
 
 // oldHomeWithPathEntry stands up a home holding the old ~/.abcd, whose
diff --git a/internal/surface/cli/hooks_selfprovision_count_test.go b/internal/surface/cli/hooks_selfprovision_count_test.go
index 80aea6c7f7..a9fa8dd951 100644
--- a/internal/surface/cli/hooks_selfprovision_count_test.go
+++ b/internal/surface/cli/hooks_selfprovision_count_test.go
@@ -26,7 +26,7 @@ import (
 // invention rather than ignored as an unknown word.
 var hookEventVocabulary = []string{
 	"SessionStart", "SessionEnd", "UserPromptSubmit", "PreToolUse", "PostToolUse",
-	"PostToolUseFailure", "PreCompact", "Stop", "SubagentStart", "SubagentStop",
+	"PostToolUseFailure", "PreCompact", "Stop", "StopFailure", "SubagentStart", "SubagentStop",
 	"Notification", "PermissionRequest",
 }
 
diff --git a/internal/surface/cli/hooks_selfprovision_test.go b/internal/surface/cli/hooks_selfprovision_test.go
index 0740ede9d4..1c6729e383 100644
--- a/internal/surface/cli/hooks_selfprovision_test.go
+++ b/internal/surface/cli/hooks_selfprovision_test.go
@@ -54,6 +54,8 @@ var binaryHooks = []binaryHook{
 	{event: "PreCompact", verb: "prompt-router-reset"},
 	{event: "SessionEnd", verb: "session-end", neverBootstraps: true},
 	{event: "SubagentStop", verb: "subagent-stop", neverBootstraps: true},
+	{event: "Stop", verb: "stop", neverBootstraps: true},
+	{event: "StopFailure", verb: "stop-failure", neverBootstraps: true},
 }
 
 // hookCommand returns the single command string for an event, failing on any
diff --git a/internal/surface/cli/hooks_timeout_test.go b/internal/surface/cli/hooks_timeout_test.go
index ea649d94c3..bf2dec39d0 100644
--- a/internal/surface/cli/hooks_timeout_test.go
+++ b/internal/surface/cli/hooks_timeout_test.go
@@ -35,6 +35,8 @@ var wantHookTimeouts = map[string]int{
 	"PreCompact":       0,
 	"SessionEnd":       0,
 	"SubagentStop":     0,
+	"Stop":             30,
+	"StopFailure":      0,
 }
 
 // decodedHooksManifest reads the committed manifest through the same decoded

From d4b10b44a34bb53d225508f2d5ef1f72d06f89d8 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 13:23:42 +0100
Subject: [PATCH 23/58] docs: mark the stop check's steps landed and record
 lane 1's choices

Steps 2 and 5 of the overnight-stall plan are landed; the plan's
Settled here section records the readings build lane 1 chose where the
plan was silent, for review, among them the owed reader's seam and the
placeholder for the question reroute's text.

Refs: itd-2610180912189125
Assisted-by: Claude:claude-opus-5-5
---
 ...489-a-session-told-to-work-on-while-its.md | 72 +++++++++++++++++++
 1 file changed, 72 insertions(+)

diff --git a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
index 6f1e7b43be..b62a4d2a90 100644
--- a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
+++ b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
@@ -575,6 +575,76 @@ lane's choice, recorded for review; none changes a test the step names.
   sub-verbs' sentences and the queue's worked example go in
   `internal/core/surface`, as every visible verb's do.
 
+Choices made while building steps 2 and 5 on 2026-10-18, by build lane 1,
+each recorded for review; none changes a test the steps name.
+
+- 2026-10-18 (lane 1's choice, for review): **The start-copy note.** The
+  session-start hook notes a session's start worktree in the away store's
+  `sessions.json` only in a checkout with `.abcd/` at its root, and only the
+  first time for a session id, so a compaction or resume run after the
+  session changed into a worktree it made keeps the start. Notes older than
+  30 days, and past 256, are dropped. `autonomy.ResolveCopy` reads it back
+  for the stop check and for step 3's recorder.
+- 2026-10-18 (lane 1's choice, for review): **The prompt hook's read.** It
+  reads the away record through the live drain's root-commit lookup, so the
+  router still makes one such lookup a prompt, and appends the away block
+  after the rules, the memory notes and the status block. The block's words
+  come from the owner-only home store, never a tracked file, which is why
+  the session-start hook may print it on stdout where its notices stay on
+  stderr.
+- 2026-10-18 (lane 1's choice, for review): **The person's lines.** While
+  the record holds: "abcd: away until <time>, set by <who> from <copy>; N
+  steps queued, M items handed back. `abcd mode back` ends it." (with
+  "pushes wait for you" under `--hold-pushes`). Lapsed and unclosed: one
+  line counting the queued steps and recorded stops, as the plan names, not
+  the hand-backs. Both are `Record.PersonLine` and `Record.LapsedLine`.
+- 2026-10-18 (lane 1's choice, for review): **The owed seam.** The plan
+  names no reader, so the stop hook takes the owed set through one function
+  value, `stopOwedReader` in `internal/surface/cli/hook_stop.go`, shaped as
+  step 4's `autonomy.ReadOwed` (asked with the start copy, the record, the
+  home and the clock; the record not holding means disk only). Until step
+  4's reader fills it, it reads nothing owed. Recording a hand-back is
+  idempotent per branch and head, so the reader and the front door may both
+  record one.
+- 2026-10-18 (lane 1's choice, for review): **Two fields on `Owed`.**
+  `NextRenewal`, the earliest renewal due among the live reservations under
+  this copy's key, due or not yet, which the deadline needs and no owed item
+  carries; and `HandedBack`, the items a queued step handed back, which the
+  verdict judges. Both are additive.
+- 2026-10-18 (lane 1's choice, for review): **The hand-back at the
+  verdict.** `Judge` accepts a hand-back only while away, under
+  `--hold-pushes`, and only of an unpushed branch's item naming its branch
+  and head; any other item the reader hands back is put back among the owed
+  items. The front door records each accepted one under the lock.
+- 2026-10-18 (lane 1's choice, for review): **Rows the plan leaves open.**
+  The prose-question block (row 1) does not take the owed set as seen, so
+  the next check names it; at the cap it records nothing, since the plan
+  names rows 2, 4, 5 and 7. A block past the cap leaves the session's state
+  "stopped". The push sentence goes with an unpushed branch, an uncarried
+  reservation, and a behind or failing pull request, the items whose next
+  act the plan calls a push. The next look is the earliest-matching
+  qualifying wake; a recurring task with no following match by the deadline
+  plus an hour is taken as up to 30 minutes late.
+- 2026-10-18 (lane 1's choice, for review): **The parser's edges.** Names
+  (`MON`), `@` forms and a step on a single value are not read, so they
+  never qualify. The day-of-month and day-of-week "written from `*`" rule
+  takes a field starting with `*`.
+- 2026-10-18 (lane 1's choice, for review): **abcd's own faults allow.**
+  Present, the session's state is neither read nor written. Away, a session
+  state that cannot be read or saved, and an owed set the reader could not
+  return, allow the stop with a stderr line, as a malformed payload does. A
+  StopFailure error type outside `[a-z][a-z0-9_]{0,63}` is recorded as
+  `unknown`. `hooks/stop.sh` and `hooks/stop-failure.sh` never download the
+  binary, as `hooks/subagent-stop.sh` does not, and exit 1 when it is
+  missing, never the Stop event's blocking 2; the brief's hook paragraphs
+  name them among the exceptions.
+- 2026-10-18 (lane 1's choice, for review): **One text for the person-only
+  acts.** The away block and the prose-question block carry
+  `autonomy.QuestionRoute()`, step 6's statement of the list. Until that
+  lane's branch merges, `internal/core/autonomy/question_placeholder.go`
+  stands in for its `question.go` with exactly its text; it is deleted at
+  the merge.
+
 ## Footprint
 
 - packages: internal/core/autonomy, internal/core/mode, internal/core/guard, internal/surface/cli, hooks, commands/mode.md, commands/guard.md, .abcd/development/brief/02-constraints/03-invariants.md, .abcd/development/brief/04-surfaces/08-abcd.md, .abcd/development/brief/04-surfaces/17-guard.md
@@ -634,6 +704,7 @@ lane's choice, recorded for review; none changes a test the step names.
      line naming `abcd mode back` on every prompt until `mode back` closes
      it, and one with neither shows nothing); all inside the hook's existing
      deadline.
+   - landed: 472488938
 3. The created-branch recorder
    - packages: internal/core/guard, internal/core/autonomy, internal/surface/cli, commands/guard.md, .abcd/development/brief/04-surfaces/17-guard.md
    - tests: internal/core/guard, internal/core/autonomy, internal/surface/cli
@@ -760,6 +831,7 @@ lane's choice, recorded for review; none changes a test the step names.
      and `hooks/stop-failure.sh` take the same bootstrap and home checks as
      `hooks/subagent-stop.sh` (the hook-shape tests cover them); `go generate
      ./internal/surface/cli` refreshes the derived appendix.
+   - landed: 5d754f95b
 6. The question reroute
    - packages: internal/surface/cli, internal/core/autonomy, .abcd/development/brief/04-surfaces/17-guard.md
    - tests: internal/surface/cli, internal/core/autonomy

From 4be6706fabb075d1901315f7f62bb1febff02d82 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 13:29:41 +0100
Subject: [PATCH 24/58] feat: fill the owed set's next renewal and hand-backs
 for the verdict

ReadOwed now returns Owed.NextRenewal, the earliest renewal due among
the live reservations under this copy's key, which the wake deadline
needs, and moves a queued push's unpushed item into Owed.HandedBack
instead of recording it. The verdict accepts a hand-back and the stop
hook records what it accepted, so a hand-back has one owner and is never
recorded for an item the verdict puts back among the owed.

Assisted-by: Claude:claude-opus-5-5
---
 internal/core/autonomy/doc.go           |  7 +++-
 internal/core/autonomy/owedread.go      | 36 ++++++++---------
 internal/core/autonomy/owedread_test.go | 51 +++++++++++++++++++++----
 3 files changed, 66 insertions(+), 28 deletions(-)

diff --git a/internal/core/autonomy/doc.go b/internal/core/autonomy/doc.go
index 051ed04334..80a5a2db81 100644
--- a/internal/core/autonomy/doc.go
+++ b/internal/core/autonomy/doc.go
@@ -150,8 +150,11 @@
 // unmet condition is checks still running is not capped. With --hold-pushes,
 // an unpushed own branch a queued step names as a whole name, whose head
 // contains its base's last-fetched tip and has a receipt, is handed back:
-// left out of the set and recorded once per branch and head
-// (Store.RecordHandBack). The items come sorted by OwedKinds' order. The
+// moved out of Owed.Items into Owed.HandedBack. ReadOwed records nothing:
+// the verdict accepts the hand-back (Verdict.HandBacks) and the stop hook
+// records it, once per branch and head (Store.RecordHandBack), so a
+// hand-back has one owner. Owed.NextRenewal is filled present or away. The
+// items come sorted by OwedKinds' order. The
 // error is a root that is not a working copy; anything else ReadOwed could
 // not read is a note in Owed.Notes.
 package autonomy
diff --git a/internal/core/autonomy/owedread.go b/internal/core/autonomy/owedread.go
index 2c84b78668..e23fad8f26 100644
--- a/internal/core/autonomy/owedread.go
+++ b/internal/core/autonomy/owedread.go
@@ -76,8 +76,10 @@ func (o ReadOptions) now() time.Time {
 // is late is named in Owed.Notes and the check judges from disk alone
 // (adr-2610181003541997). With --hold-pushes, an unpushed own branch a queued
 // step names, whose head contains its base's last-fetched tip and has a
-// preflight receipt, is handed back: left out of the set and recorded once
-// per branch and head in the away record.
+// preflight receipt, is handed back: moved out of Owed.Items into
+// Owed.HandedBack, for the verdict to accept and the stop hook to record.
+// Owed.NextRenewal is the earliest renewal due among the live reservations
+// under this copy's key, due or not yet, present or away.
 //
 // The error is a root that is not a working copy; every other failure to read
 // something is a note, and the set is judged without it.
@@ -144,7 +146,7 @@ func ReadOwed(ctx context.Context, o ReadOptions) (Owed, error) {
 		}
 		return a.Record < b.Record
 	})
-	return Owed{Items: r.items, Notes: r.notes}, nil
+	return Owed{Items: r.items, Notes: r.notes, NextRenewal: r.nextRenewal, HandedBack: r.handed}, nil
 }
 
 // owedReader is one ReadOwed's state.
@@ -169,8 +171,10 @@ type owedReader struct {
 	own            map[string]bool
 	stackBase      map[string]string // a branch's base's tip on disk, for the hand-back
 
-	items []OwedItem
-	notes []string
+	items       []OwedItem
+	handed      []OwedItem // handed back by a queued step, for the verdict to accept
+	nextRenewal time.Time  // the earliest renewal due among r.mine
+	notes       []string
 }
 
 type localBranch struct {
@@ -774,7 +778,11 @@ func (r *owedReader) unpushed(b *localBranch) bool {
 // subject, which no pull request carries, aside).
 func (r *owedReader) reservationItems() {
 	for _, res := range r.mine {
-		if half := res.ClaimedAt.Add(res.EffectiveExpiry.Sub(res.ClaimedAt) / 2); !r.now.Before(half) {
+		half := res.ClaimedAt.Add(res.EffectiveExpiry.Sub(res.ClaimedAt) / 2)
+		if r.nextRenewal.IsZero() || half.Before(r.nextRenewal) {
+			r.nextRenewal = half
+		}
+		if !r.now.Before(half) {
 			r.add(OwedItem{Kind: OwedRenewal, Record: res.Record,
 				Reason: fmt.Sprintf("the reservation of %s is due for renewal (it lapses %s): renew it with `abcd reserve %s`",
 					res.Record, showTime(res.EffectiveExpiry), res.Record)})
@@ -800,17 +808,13 @@ func (r *owedReader) reservationItems() {
 // --hold-pushes, a queued step naming an own branch hands back that branch's
 // unpushed item, while its head contains its base's last-fetched tip and a
 // preflight receipt names it where the repository mints receipts. Each is
-// recorded once per branch and head.
+// moved from the owed items to r.handed for the verdict, which accepts it;
+// the stop hook records what the verdict accepted, once per branch and head,
+// so the reader records nothing.
 func (r *owedReader) handBack() {
 	if !r.away || !r.rec.HoldPushes || len(r.rec.Queue) == 0 || !r.receiptsMinted {
 		return
 	}
-	var st *Store
-	if r.home != "" {
-		if s, err := OpenStore(r.home, r.root); err == nil {
-			st = &s
-		}
-	}
 	kept := r.items[:0]
 	for _, it := range r.items {
 		if it.Kind != OwedUnpushed || !r.queued(it.Branch) {
@@ -825,11 +829,7 @@ func (r *owedReader) handBack() {
 			kept = append(kept, it)
 			continue
 		}
-		if st != nil {
-			if _, err := st.RecordHandBack(it.Branch, it.Head, r.now); err != nil {
-				r.note("the hand-back of %s was not recorded (%s)", it.Branch, err)
-			}
-		}
+		r.handed = append(r.handed, it)
 	}
 	r.items = kept
 }
diff --git a/internal/core/autonomy/owedread_test.go b/internal/core/autonomy/owedread_test.go
index 47c83e6957..3e55c468c5 100644
--- a/internal/core/autonomy/owedread_test.go
+++ b/internal/core/autonomy/owedread_test.go
@@ -437,6 +437,39 @@ func TestReservationCopyKeyFilter(t *testing.T) {
 	}
 }
 
+// TestNextRenewalEarliestLive: Owed.NextRenewal is the earliest renewal due
+// (halfway between the latest claim and the expiry) among the live
+// reservations under this copy's key, due or not yet, which the stop
+// verdict's deadline needs; a sibling copy's or a lapsed reservation does not
+// count, and with none it is zero. It is filled while present too, since it
+// is read from disk.
+func TestNextRenewalEarliestLive(t *testing.T) {
+	f := newFx(t)
+	if owed := f.read(true); !owed.NextRenewal.IsZero() {
+		t.Fatalf("with no reservation NextRenewal is zero, got %s", owed.NextRenewal)
+	}
+	// due in 1h30: claimed an hour ago, expiring in four hours
+	f.reserve("iss-1", claim.CopyThis, f.now.Add(-time.Hour), f.now.Add(4*time.Hour))
+	// due in 30m, but a sibling copy's
+	f.reserve("iss-2", "", f.now.Add(-time.Hour), f.now.Add(2*time.Hour))
+	// due in 45m: claimed 15 minutes ago, a two-hour lease
+	f.reserve("iss-3", claim.CopyThis, f.now.Add(-15*time.Minute), f.now.Add(105*time.Minute))
+	// lapsed
+	f.res = append(f.res, claim.Reservation{Record: "iss-4", Copy: claim.CopyThis, State: claim.StateExpired,
+		ClaimedAt: f.now.Add(-5 * time.Hour), EffectiveExpiry: f.now.Add(-time.Hour)})
+	want := f.now.Add(45 * time.Minute)
+	for _, away := range []bool{true, false} {
+		if got := f.read(away).NextRenewal; !got.Equal(want) {
+			t.Fatalf("away=%v: NextRenewal = %s, want iss-3's due %s", away, got, want)
+		}
+	}
+	// a renewal already due still counts: it is the earliest
+	f.reserve("iss-5", claim.CopyThis, f.now.Add(-3*time.Hour), f.now.Add(time.Hour))
+	if got, want := f.read(true).NextRenewal, f.now.Add(-time.Hour); !got.Equal(want) {
+		t.Fatalf("a renewal already due is the earliest: NextRenewal = %s, want %s", got, want)
+	}
+}
+
 // TestReservationLinkByHeadOrClosingTrailer: the record id in the head branch
 // or on a Resolves: or Delivers: line links; a green linked pull request is
 // not owed until renewal is due.
@@ -723,16 +756,18 @@ func TestQueuedPushHandsItemBack(t *testing.T) {
 	})
 	t.Run("hold-pushes verified", func(t *testing.T) {
 		f := setup(t)
-		if owed := readWith(f, true, "push feat/p"); has(owed, OwedUnpushed, "feat/p") {
+		owed := readWith(f, true, "push feat/p")
+		if has(owed, OwedUnpushed, "feat/p") {
 			t.Fatalf("a verified branch's queued push is handed back: %s", describe(owed))
 		}
-		o := f.opts()
-		st, _ := OpenStore(f.home, f.root)
-		o.Record, _ = st.Read()
-		f.readWith(o)
-		hb := handedBack(t, f)
-		if len(hb) != 1 || hb[0].Branch != "feat/p" || hb[0].Head != f.head("feat/p") {
-			t.Fatalf("the hand-back is recorded once per branch and head: %+v", hb)
+		if len(owed.HandedBack) != 1 || owed.HandedBack[0].Kind != OwedUnpushed ||
+			owed.HandedBack[0].Branch != "feat/p" || owed.HandedBack[0].Head != f.head("feat/p") {
+			t.Fatalf("the handed-back item goes to the verdict in Owed.HandedBack, with its branch and head: %+v", owed.HandedBack)
+		}
+		// The verdict accepts a hand-back and the stop hook records it; the
+		// reader records nothing, so one owner writes it once.
+		if hb := handedBack(t, f); len(hb) != 0 {
+			t.Fatalf("the reader records no hand-back itself: %+v", hb)
 		}
 	})
 	t.Run("hold-pushes base moved", func(t *testing.T) {

From df169395fea40f8774c081e1055b4a7638004f88 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 13:31:25 +0100
Subject: [PATCH 25/58] feat: read the stop check's owed work through the owed
 reader

The Stop hook's seam now defaults to autonomy.ReadOwed and is asked with
autonomy.ReadOptions, replacing lane 1's local stand-in, which read
nothing owed. An end-to-end test runs the hook against a real checkout
with an own branch holding unpushed commits and a stub forge client: away,
the stop is blocked with the push sentence that defers to the person's
standing instruction; present, it is allowed and the forge never asked.

Assisted-by: Claude:claude-opus-5-5
---
 internal/surface/cli/hook_stop.go          | 32 ++-----
 internal/surface/cli/hook_stop_e2e_test.go | 99 ++++++++++++++++++++++
 internal/surface/cli/hook_stop_test.go     |  6 +-
 3 files changed, 110 insertions(+), 27 deletions(-)
 create mode 100644 internal/surface/cli/hook_stop_e2e_test.go

diff --git a/internal/surface/cli/hook_stop.go b/internal/surface/cli/hook_stop.go
index 68a9aabd75..f1ace42ddd 100644
--- a/internal/surface/cli/hook_stop.go
+++ b/internal/surface/cli/hook_stop.go
@@ -26,29 +26,13 @@ import (
 // be read, or the away store's lock not had within its two seconds allows the
 // stop and says so on stderr. A stop is never blocked on abcd's own fault.
 
-// stopReadOptions is what the stop check hands the owed reader: the
-// session's working copy (its start copy, from the session-start note), the
-// away record (not holding, the reader reads disk only and never calls the
-// forge), the home the away store lives under, and the clock.
-//
-// TODO(merge): this is a local stand-in for autonomy.ReadOptions, which step
-// 4's branch adds with these fields among others; at the merge the type
-// becomes autonomy.ReadOptions and the seam's default autonomy.ReadOwed.
-type stopReadOptions struct {
-	Root   string
-	Record *autonomy.Record
-	Home   string
-	Now    func() time.Time
-}
-
-// stopOwedReader is the seam the owed reader (spc-2610180914469489 step 4,
-// built in parallel, autonomy.ReadOwed) fills: it returns the owed set, its
-// forge listing under its own ten-second deadline while away. Until it is
-// wired the seam reads nothing owed, so the verdict judges an empty set. A
-// test replaces it with constructed sets.
-var stopOwedReader = func(context.Context, stopReadOptions) (autonomy.Owed, error) {
-	return autonomy.Owed{}, nil
-}
+// stopOwedReader is the seam onto the owed reader (spc-2610180914469489 step
+// 4): autonomy.ReadOwed, asked with the session's working copy (its start
+// copy, from the session-start note), the away record (not holding, the
+// reader reads disk only and never calls the forge), the home the away store
+// lives under, and the clock. While away its forge listing runs under its own
+// ten-second deadline. A test replaces it with constructed sets.
+var stopOwedReader = autonomy.ReadOwed
 
 // stopReadBudget bounds the owed read inside the Stop hook's 30-second
 // timeout, leaving the hook time to judge, record and answer.
@@ -143,7 +127,7 @@ stderr; every outcome exits 0.`,
 			ctx, cancel := context.WithTimeout(context.Background(), stopReadBudget)
 			defer cancel()
 			home, _ := os.UserHomeDir()
-			owed, err := stopOwedReader(ctx, stopReadOptions{Root: copyRoot, Record: rec, Home: home, Now: func() time.Time { return now }})
+			owed, err := stopOwedReader(ctx, autonomy.ReadOptions{Root: copyRoot, Record: rec, Home: home, Now: func() time.Time { return now }})
 			if err != nil {
 				return stopAllow(cmd, "owed work could not be read (%s)", fsutil.RedactHome(err.Error()))
 			}
diff --git a/internal/surface/cli/hook_stop_e2e_test.go b/internal/surface/cli/hook_stop_e2e_test.go
new file mode 100644
index 0000000000..46d3c6537a
--- /dev/null
+++ b/internal/surface/cli/hook_stop_e2e_test.go
@@ -0,0 +1,99 @@
+package cli
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// hook_stop_e2e_test.go — the away mode's stop check end to end, through the
+// real owed reader (spc-2610180914469489 steps 4 and 5 joined at the seam):
+// real git in a temporary checkout with a bare origin, and a stub forge client
+// first on PATH, so nothing reaches a real forge.
+
+// ownedUnpushedCheckout is a managed checkout with a bare origin whose default
+// branch is fetched, and an own branch, feat/x, checked out in this copy and
+// back (so its HEAD reflog holds it), pushed once and then given a commit of
+// this checkout's author that is not pushed. A stub gh answers the away
+// listing with no open pull request and logs every call to the returned file.
+func ownedUnpushedCheckout(t *testing.T) (root, ghLog string) {
+	t.Helper()
+	root = awayCheckout(t)
+	gitAt(t, root, "config", "--local", "user.email", "alice@example.invalid")
+	gitAt(t, root, "config", "--local", "commit.gpgsign", "false")
+	origin := filepath.Join(t.TempDir(), "origin.git")
+	gitAt(t, root, "init", "-q", "--bare", origin)
+	gitAt(t, root, "remote", "add", "origin", origin)
+	main := gitAt(t, root, "rev-parse", "--abbrev-ref", "HEAD")
+	gitAt(t, root, "push", "-q", "origin", main)
+	gitAt(t, root, "remote", "set-head", "origin", main)
+	gitAt(t, root, "checkout", "-q", "-b", "feat/x")
+	gitAt(t, root, "commit", "-q", "--allow-empty", "-m", "the first half")
+	gitAt(t, root, "push", "-q", "-u", "origin", "feat/x")
+	gitAt(t, root, "commit", "-q", "--allow-empty", "-m", "the second half, not pushed")
+	gitAt(t, root, "checkout", "-q", main)
+
+	bin := t.TempDir()
+	ghLog = filepath.Join(t.TempDir(), "gh-calls.log")
+	script := "#!/bin/sh\n" +
+		"printf '%s\\n' \"$*\" >> '" + ghLog + "'\n" +
+		"if [ \"$1 $2\" = 'pr list' ]; then echo '[]'; exit 0; fi\n" +
+		"echo \"gh stub: unexpected call: $*\" >&2\nexit 1\n"
+	if err := os.WriteFile(filepath.Join(bin, "gh"), []byte(script), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("PATH", bin+string(os.PathListSeparator)+os.Getenv("PATH"))
+	return root, ghLog
+}
+
+func ghCalls(t *testing.T, log string) string {
+	t.Helper()
+	b, err := os.ReadFile(log)
+	if err != nil && !os.IsNotExist(err) {
+		t.Fatal(err)
+	}
+	return string(b)
+}
+
+// TestHookStopEndToEndOwnUnpushedBranch: while the away record holds, an own
+// branch with commits not pushed blocks the stop, naming the branch and the
+// push sentence that defers to the person's standing instruction, and the
+// forge is asked for the open pull requests. With no away record the same
+// checkout's stop is allowed, the owed branch named to the person, and the
+// forge is never asked.
+func TestHookStopEndToEndOwnUnpushedBranch(t *testing.T) {
+	t.Run("away blocks", func(t *testing.T) {
+		root, ghLog := ownedUnpushedCheckout(t)
+		setAway(t)
+		out, so, se := runStop(t, stopHookPayload(t, "e2e-away", root, false, "Done for now."))
+		if out.Decision != "block" {
+			t.Fatalf("away with an own unpushed branch: want a block, got %s\nstderr: %s", so, se)
+		}
+		for _, want := range []string{
+			"feat/x",
+			"push if your standing instruction allows",
+			"queue it with `abcd mode queue",
+		} {
+			if !strings.Contains(out.Reason, want) {
+				t.Errorf("the block's reason lacks %q:\n%s", want, out.Reason)
+			}
+		}
+		if calls := ghCalls(t, ghLog); !strings.Contains(calls, "pr list") {
+			t.Errorf("away, the forge was not asked for the open pull requests; calls: %q", calls)
+		}
+	})
+	t.Run("present allows", func(t *testing.T) {
+		root, ghLog := ownedUnpushedCheckout(t)
+		out, so, se := runStop(t, stopHookPayload(t, "e2e-present", root, false, "Done for now."))
+		if out.Decision == "block" {
+			t.Fatalf("with no away record the stop is allowed, got %s\nstderr: %s", so, se)
+		}
+		if !strings.Contains(out.SystemMessage, "feat/x") {
+			t.Errorf("present, the owed branch is named to the person: got %s", so)
+		}
+		if calls := ghCalls(t, ghLog); calls != "" {
+			t.Errorf("present, the check reads disk only, but the forge was asked: %q", calls)
+		}
+	})
+}
diff --git a/internal/surface/cli/hook_stop_test.go b/internal/surface/cli/hook_stop_test.go
index 8f5aaf5291..c766b9fb42 100644
--- a/internal/surface/cli/hook_stop_test.go
+++ b/internal/surface/cli/hook_stop_test.go
@@ -17,11 +17,11 @@ import (
 
 // fakeOwed replaces the owed reader for one test with one answering owed, and
 // counts the calls and what each was asked.
-func fakeOwed(t *testing.T, owed *autonomy.Owed) *[]stopReadOptions {
+func fakeOwed(t *testing.T, owed *autonomy.Owed) *[]autonomy.ReadOptions {
 	t.Helper()
-	var asked []stopReadOptions
+	var asked []autonomy.ReadOptions
 	prev := stopOwedReader
-	stopOwedReader = func(_ context.Context, q stopReadOptions) (autonomy.Owed, error) {
+	stopOwedReader = func(_ context.Context, q autonomy.ReadOptions) (autonomy.Owed, error) {
 		asked = append(asked, q)
 		return *owed, nil
 	}

From a242bccddba8422ccc67754949c3e85893da1567 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 13:32:34 +0100
Subject: [PATCH 26/58] feat: key a recorded branch on the session's start copy

The created-branch recorder now resolves its copy through the
session-start note (autonomy.ResolveCopy), falling back to the payload
cwd's worktree when the session has no note, so a branch a session cuts
after changing into a worktree it made is recorded under the copy the
stop check reads.

Assisted-by: Claude:claude-opus-5-5
---
 internal/surface/cli/guard.go               |  5 +-
 internal/surface/cli/guard_branches.go      | 20 +++++---
 internal/surface/cli/guard_branches_test.go | 52 +++++++++++++++++++++
 3 files changed, 69 insertions(+), 8 deletions(-)

diff --git a/internal/surface/cli/guard.go b/internal/surface/cli/guard.go
index a8dfe1b41c..34263bf55f 100644
--- a/internal/surface/cli/guard.go
+++ b/internal/surface/cli/guard.go
@@ -389,7 +389,7 @@ func guardHookDecide(cmd *cobra.Command) error {
 	// The away mode's created-branch recorder runs first and refuses
 	// nothing, so the registry's state never decides whether a branch the
 	// session cuts is seen as its own (spc-2610180914469489 step 3).
-	recordCreatedBranches(cmd.ErrOrStderr(), cwd, in.ToolInput.Workdir, candidate)
+	recordCreatedBranches(cmd.ErrOrStderr(), cwd, in.SessionID, in.ToolInput.Workdir, candidate)
 	sessionRoot := rulesRoot(cwd, cmd.ErrOrStderr())
 	// The fail-safe posture is decided in core (guard.LoadRepo,
 	// iss-2608291814576261); the hook only formats it. A dropped repo layer
@@ -543,6 +543,9 @@ func hookToolName(raw []byte) (name string, known bool) {
 // guardHookInput is the subset of the host's pre-tool-use payload the adapter
 // reads. Unknown fields are ignored: the host owns this schema and adds to it.
 type guardHookInput struct {
+	// SessionID names the session, whose start copy the created-branch
+	// recorder keys on (awayCopyRoot).
+	SessionID string `json:"session_id"`
 	Cwd       string `json:"cwd"`
 	ToolName  string `json:"tool_name"`
 	ToolInput struct {
diff --git a/internal/surface/cli/guard_branches.go b/internal/surface/cli/guard_branches.go
index b3b23254b6..6a00258419 100644
--- a/internal/surface/cli/guard_branches.go
+++ b/internal/surface/cli/guard_branches.go
@@ -10,10 +10,16 @@ import (
 	"github.com/intentdriven/abcd/internal/gitutil"
 )
 
-// awayCopyRoot is the working copy a hook acts for: the worktree root of the
-// session's directory. The stop check reads the copy's owed work from the same
-// root (spc-2610180914469489, "Which copy").
-func awayCopyRoot(cwd string) (string, bool) {
+// awayCopyRoot is the working copy a hook acts for: the session's start copy,
+// as the session-start hook noted it (autonomy.ResolveCopy), else the worktree
+// root of the payload's cwd. The stop check reads the copy's owed work from
+// the same root (spc-2610180914469489, "Which copy"), so a branch a session
+// cuts after changing into a worktree it made is recorded where the check
+// looks.
+func awayCopyRoot(cwd, sessionID string) (string, bool) {
+	if root, _, err := autonomy.ResolveCopy(cwd, sessionID, autonomy.Options{}); err == nil {
+		return root, true
+	}
 	root, err := gitutil.CheckoutRoot(cwd, autonomy.StoreName)
 	if err != nil {
 		return "", false
@@ -24,15 +30,15 @@ func awayCopyRoot(cwd string) (string, bool) {
 // recordCreatedBranches is the created-branch recorder of the away mode
 // (spc-2610180914469489 step 3): before the guard judges command, the
 // branches it creates, checks out into a new worktree or renames are recorded
-// under the session copy's key in the away store, whether or not the person
+// under the session copy's key (awayCopyRoot) in the away store, whether or not the person
 // is away. It refuses nothing: a store it cannot write leaves one line on w
 // and the command goes on to the guard's own judgement.
-func recordCreatedBranches(w io.Writer, cwd string, workdir json.RawMessage, command string) {
+func recordCreatedBranches(w io.Writer, cwd, sessionID string, workdir json.RawMessage, command string) {
 	acts := guard.BranchActs(command)
 	if len(acts) == 0 {
 		return
 	}
-	copyRoot, ok := awayCopyRoot(cwd)
+	copyRoot, ok := awayCopyRoot(cwd, sessionID)
 	if !ok {
 		return
 	}
diff --git a/internal/surface/cli/guard_branches_test.go b/internal/surface/cli/guard_branches_test.go
index 51d0ad0ff0..37fb0795f8 100644
--- a/internal/surface/cli/guard_branches_test.go
+++ b/internal/surface/cli/guard_branches_test.go
@@ -1,6 +1,7 @@
 package cli
 
 import (
+	"encoding/json"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -128,3 +129,54 @@ func TestBranchRecorderNeverRefuses(t *testing.T) {
 		t.Fatalf("no branch act, no line: %q", stderr)
 	}
 }
+
+// TestBranchRecorderUsesSessionStartCopy: the recorder keys a branch on the
+// session's start copy, the one the session-start hook noted, so a session
+// that changed into a worktree it made still records under the copy the stop
+// check reads; with no note for the session it keys on the payload cwd's
+// worktree.
+func TestBranchRecorderUsesSessionStartCopy(t *testing.T) {
+	root := awayCheckout(t)
+	wt := filepath.Join(t.TempDir(), "wt")
+	gitAt(t, root, "worktree", "add", "-q", "-b", "feat/wt", wt)
+	wt = realPath(t, wt)
+	if err := os.MkdirAll(filepath.Join(wt, ".abcd", ".work.local"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	payload := func(session, command string) string {
+		b, err := json.Marshal(map[string]any{
+			"session_id": session, "cwd": wt, "hook_event_name": "PreToolUse", "tool_name": "Bash",
+			"tool_input": map[string]any{"command": command, "description": "x"},
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+		return string(b)
+	}
+	run := func(session, command string) {
+		t.Helper()
+		stdout, stderr, code := runGuard(payload(session, command), "guard", "hook")
+		if strings.Contains(stdout, `"deny"`) || code == 2 {
+			t.Fatalf("%q was refused: stdout %q stderr %q code %d", command, stdout, stderr, code)
+		}
+	}
+
+	if _, err := awayStore(t, root).NoteSessionCopy("noted", root, time.Now()); err != nil {
+		t.Fatal(err)
+	}
+	run("noted", "git switch -c feat/from-noted")
+	if got := createdBranches(t, root); !slices.Contains(got, "feat/from-noted") {
+		t.Fatalf("a noted session's branch is recorded under its start copy: start copy holds %v", got)
+	}
+	if got := createdBranches(t, wt); slices.Contains(got, "feat/from-noted") {
+		t.Fatalf("a noted session's branch is not recorded under the worktree it ran in: worktree holds %v", got)
+	}
+
+	run("unnoted", "git switch -c feat/from-unnoted")
+	if got := createdBranches(t, wt); !slices.Contains(got, "feat/from-unnoted") {
+		t.Fatalf("with no note the branch is recorded under the payload cwd's worktree: worktree holds %v", got)
+	}
+	if got := createdBranches(t, root); slices.Contains(got, "feat/from-unnoted") {
+		t.Fatalf("with no note nothing is recorded under another copy: start copy holds %v", got)
+	}
+}

From 82e8c46c5fd1c33e2f67f7367b2790393536fd62 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 13:33:42 +0100
Subject: [PATCH 27/58] docs: say the away listing covers every open pull
 request when the login is known

adr-2610181003541997, still proposed, is amended in place: the stop
check's one listing covers every open pull request when the person's
forge login is known, since the reader needs other people's pull
requests to keep them out of the session's own, and the person's own
alone when it is not. Invariant 7's clause and the spec's design text say
the same. The spec records the integration's choices: the placeholder
removed in the merge, the stop hook as the one owner of the hand-back
record, the wired seam and the recorder keyed on the start copy.

Assisted-by: Claude:claude-opus-5-5
---
 .../brief/02-constraints/03-invariants.md     |  5 ++-
 ...97-the-away-mode-s-stop-check-reads-the.md | 13 ++++--
 ...489-a-session-told-to-work-on-while-its.md | 43 +++++++++++++++++--
 3 files changed, 54 insertions(+), 7 deletions(-)

diff --git a/.abcd/development/brief/02-constraints/03-invariants.md b/.abcd/development/brief/02-constraints/03-invariants.md
index 8aa7ca8806..45c87df462 100644
--- a/.abcd/development/brief/02-constraints/03-invariants.md
+++ b/.abcd/development/brief/02-constraints/03-invariants.md
@@ -122,7 +122,10 @@ The following are non-negotiable invariants — any architectural choice that vi
    for as long as it holds, the stop check's one read of the forge at each
    turn's end, at most one listing of the open pull requests through the
    forge client (`gh pr list`: head and base branch, author, body, merge
-   state, review decision and check rollup) under a ten-second deadline, with
+   state, review decision and check rollup), every open one when the
+   person's forge login is known, so another person's pull request can be
+   told from the session's own, and the person's own alone when it is not,
+   under a ten-second deadline, with
    no cache, so a run of eight blocked stops costs up to eight bounded
    listings. A listing that fails or is late is named as not read, never
    hidden, and the check judges from disk alone: a branch with a pull request
diff --git a/.abcd/development/decisions/adrs/2610181003541997-the-away-mode-s-stop-check-reads-the.md b/.abcd/development/decisions/adrs/2610181003541997-the-away-mode-s-stop-check-reads-the.md
index 11a7fb87b4..af25e1fb3b 100644
--- a/.abcd/development/decisions/adrs/2610181003541997-the-away-mode-s-stop-check-reads-the.md
+++ b/.abcd/development/decisions/adrs/2610181003541997-the-away-mode-s-stop-check-reads-the.md
@@ -35,9 +35,16 @@ verb.
 We will treat setting the away mode (`abcd mode autonomous`, which the
 person runs or asks a session to run, and which grants no push rights,
 dcn-2610181016510153) as invoking the stop check's forge read while the mode holds:
-at most one pull-request listing of the person's open pull requests per
-check (head and base branch, author, body, merge state, review decision and
-check rollup), under a ten-second deadline. There is no cache, so a run of
+at most one pull-request listing per check (head and base branch, author,
+body, merge state, review decision and check rollup, at most 200 pull
+requests), under a ten-second deadline. When the person's forge login is
+known (the holder name reservations resolve without a network read), the
+listing covers every open pull request in the repository, not only the
+person's: the reader needs other people's pull requests to tell a branch
+whose open pull request another person authored from the session's own, and
+to leave it out. When the login is unknown, the listing asks for the
+person's own pull requests alone (`--author @me`) and that rule is not
+applied. There is no cache, so a run of
 eight blocks costs up to eight listings, each bounded by the deadline; a
 reuse cache is remaining work of itd-2610170638184486 (dcn-2610181017056307).
 
diff --git a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
index 32bdc9905a..8b3709e7df 100644
--- a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
+++ b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
@@ -335,9 +335,11 @@ dcn-2610181003488355):
   adr-2610181003541997).** While the person is present the check reads disk
   only: renewals due (reservations as last fetched, `claim.LastFetched`) and
   unpushed own branches. It never calls the forge, so no turn's end touches
-  the network. While away it adds at most one `gh pr list` of the person's
-  open pull requests (head and base branch, author, body, merge state,
-  review decision, check rollup; each field among those
+  the network. While away it adds at most one `gh pr list` of the open pull
+  requests, every open one when the person's forge login is known (so a
+  branch whose pull request another person authored is left out of "own"),
+  the person's own alone when it is not (head and base branch, author,
+  body, merge state, review decision, check rollup; each field among those
   `internal/ghcontract` pins) under a ten-second deadline. On a failure or
   timeout it fails open to the disk kinds, naming the pull requests as not
   read: a branch with a pull request is compared on disk with the
@@ -741,6 +743,41 @@ each recorded for review; none changes a test the steps name.
   stands in for its `question.go` with exactly its text; it is deleted at
   the merge.
 
+Choices made while integrating the three lanes on 2026-10-18, each recorded
+for review; none changes a test a step names.
+
+- 2026-10-18 (integration's choice, for review): **The placeholder went in
+  the merge.** Step 6's `question.go` and lane 1's
+  `question_placeholder.go` declared the same names word for word, so the
+  placeholder was removed in the merge commit that brought step 6 in, to
+  keep every commit building.
+- 2026-10-18 (integration's choice, for review): **The stop hook owns the
+  hand-back record.** Lane 2's reader recorded a hand-back as it found one,
+  and lane 1's front door recorded each the verdict accepted. `ReadOwed` now
+  records nothing: it moves the handed-back item from `Owed.Items` into
+  `Owed.HandedBack`, the verdict accepts it (`Verdict.HandBacks`), and the
+  stop hook records what was accepted under the lock, once per branch and
+  head. One owner, and an item the verdict puts back among the owed is never
+  recorded as handed back. This replaces lane 2's "`ReadOwed` records each
+  hand-back itself" and lane 1's "the reader and the front door may both
+  record one" above. `ReadOwed` also fills `Owed.NextRenewal`, present or
+  away, from the same halfway point its renewal items use.
+- 2026-10-18 (integration's choice, for review): **The seam is wired.** The
+  stop hook's `stopOwedReader` defaults to `autonomy.ReadOwed` and is asked
+  with `autonomy.ReadOptions`; lane 1's stand-in type is gone.
+- 2026-10-18 (integration's choice, for review): **The recorder keys on the
+  start copy.** `awayCopyRoot` resolves the copy through
+  `autonomy.ResolveCopy` with the hook payload's session id, falling back
+  to the payload cwd's worktree when the session has no note or the store
+  cannot be opened, so the branch list and the stop check read the same
+  copy's key.
+- 2026-10-18 (integration's choice, for review): **The ADR says what the
+  listing covers.** adr-2610181003541997, still proposed, now says the
+  listing covers every open pull request when the person's forge login is
+  known, and the person's own alone when it is not, as lane 2's reader does
+  and invariant 7's clause now says too; lane 2's note above on the
+  mismatch is answered by it.
+
 ## Footprint
 
 - packages: internal/core/autonomy, internal/core/mode, internal/core/guard, internal/surface/cli, hooks, commands/mode.md, commands/guard.md, .abcd/development/brief/02-constraints/03-invariants.md, .abcd/development/brief/04-surfaces/08-abcd.md, .abcd/development/brief/04-surfaces/17-guard.md

From f403910acab647510915c18f3c9d98fa1123d306 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 13:37:32 +0100
Subject: [PATCH 28/58] test: count the stop hooks' launcher warnings in the
 guard's sweep

hooks/stop.sh and hooks/stop-failure.sh, added with the away mode's
stop check, are the same launcher as hooks/subagent-stop.sh and each
warns as unrecognised-launcher twice, as that one does, so the sweep's
warn ceiling rises from 29 to 33 with the reason beside it.

Assisted-by: Claude:claude-opus-5-5
---
 internal/core/guard/sweep_test.go | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/internal/core/guard/sweep_test.go b/internal/core/guard/sweep_test.go
index e53b0e0726..ce6aa724f0 100644
--- a/internal/core/guard/sweep_test.go
+++ b/internal/core/guard/sweep_test.go
@@ -38,9 +38,15 @@ import (
 // Blocks raised to 26 when the installer's refuse_older landed
 // (hooks/bootstrap.sh): its printf argument line, read alone, blocks as
 // program-name-unknown, the same way say_refusal's argument line already did.
+//
+// Warns raised to 33 when the away mode's stop check landed
+// (spc-2610180914469489 step 5): hooks/stop.sh and hooks/stop-failure.sh are
+// the same launcher as hooks/subagent-stop.sh, and each warns as
+// unrecognised-launcher twice, its command line and the file whole, exactly
+// as that one already did.
 const (
 	maxSweepBlocks = 26
-	maxSweepWarns  = 29
+	maxSweepWarns  = 33
 )
 
 func TestFalsePositiveSweepCeiling(t *testing.T) {

From d0249f35680c82672a6f846fd7e4db8991335a68 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 14:02:55 +0100
Subject: [PATCH 29/58] docs: record the overnight-stall fix's live session
 captures

Assisted-by: Claude:claude-opus-5-5
---
 ...489-a-session-told-to-work-on-while-its.md | 221 ++++++++++++++++++
 1 file changed, 221 insertions(+)

diff --git a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
index 8b3709e7df..f597e1f5b5 100644
--- a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
+++ b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
@@ -1012,6 +1012,227 @@ for review; none changes a test a step names.
      after the change on the same checkout, as the release lesson on host
      fixes requires.
 
+## Live captures
+
+Run on 2026-10-18, 13:44 to 14:02 BST, with Claude Code 2.1.302
+(`claude-opus-5-5`), against the branch at f403910ac. API spend for all the
+runs together: about 1.70 USD.
+
+**The harness.** Everything sits in one scratch folder, `<scratch>`, outside
+every working tree:
+
+- `<scratch>/plugin` is `git archive f403910ac`. Its binary rung `abcd` is a
+  wrapper that runs `<scratch>/abcd-stall`, which is `go build ./cmd/abcd` at
+  f403910ac, with `HOME=<scratch>/home`, so the away store and every other
+  file of abcd's lands there. The before capture uses `<scratch>/plugin-before`
+  and `<scratch>/abcd-before`, the same build at the branch's merge base
+  646f2fb04.
+- `<scratch>/repo` is the lab checkout. It holds `CLAUDE.md` with abcd's
+  marker block, `.abcd/config.json` and a gitignored local tier. Its bare
+  origin is `<scratch>/origin.git`. `feat/x` was made in this checkout with
+  `git checkout -b`, so its HEAD reflog holds it, then pushed once, then given
+  a second commit by `user.email` that was not pushed. The checkout then went
+  back to `main`.
+- `<scratch>/pathbin` comes first on PATH. It holds a stub `gh` that logs
+  every call and answers `pr list` with `[]`, so no real forge is touched. It
+  also holds the same `abcd` wrapper, for the session's own `abcd mode queue`.
+- `claude -p` runs with `--plugin-dir`, `--setting-sources project,local`,
+  `--output-format stream-json --verbose --include-hook-events`,
+  `--no-session-persistence`, `--permission-prompts none`, a narrow
+  `--allowedTools` (never `git push`, so no capture shows a push clearing an
+  item) and `--max-budget-usd 3` (`<scratch>/run-session.sh`). The runs that
+  need several prompts in one session, or `/compact`, use stream-json input
+  through `<scratch>/drive.py`, which sends each prompt only after the turn
+  before it has ended.
+- Transcripts are `<scratch>/transcripts/<n>.jsonl`, with `.stderr` beside
+  each, and `<scratch>/summarise.py` turns each into `<n>.summary.txt`.
+  Nothing under the account's own Claude configuration was edited.
+
+The person's `!` command and a relayed `!` are not checked here. Those checks
+moved to the checklist draft with the guard entries ("Trim after round 2").
+
+**0. Before the change** (`0-before`). The merge-base plugin, the same lab and
+the same owed `feat/x`, with the prompt "Say hello and stop." There is no Stop
+hook: the session answers "Hello!" and the turn ends (`turns=1`). This is the
+stall.
+
+**1. Present, no away record** (`1-present`). The prompt is "Say hello and
+stop." SessionStart and the prompt hook add nothing. The Stop hook allows the
+stop with `{"systemMessage":"abcd: stopped with work owed (1 item); next:
+branch feat/x has commits not pushed …"}`, and the host shows it as "Stop
+says: …". The stub `gh` was never called. Verdict: as designed.
+
+**2. Away, no standing instruction to push** (`2-away`). The record was set
+with `abcd mode autonomous --until 15:45` (two hours ahead), then the same
+prompt was sent.
+
+- SessionStart:startup returns the `## AWAY` block, with "grants no rights",
+  the person-only list and "Run `abcd mode back` only on the person's word in
+  this session".
+- The prompt hook's `systemMessage` is "abcd: away until 2026-10-18 15:45 BST,
+  set by Alice from repo; 0 steps queued, 0 items handed back. `abcd mode
+  back` ends it.", and the host shows it to the person.
+- The first Stop is blocked: `{"decision":"block","reason":"abcd: the person
+  is away and work is owed (1 item). Next: branch feat/x has commits not
+  pushed … Do the local work, then push if your standing instruction allows;
+  queue only if the person has said pushes wait. A push you may not send stays
+  owed: queue it with \`abcd mode queue …\`"}`.
+- Claude goes on. It says the away mode is no standing instruction and runs
+  `abcd mode queue "Push branch feat/x …"`.
+- With no `--hold-pushes`, the queued push hands nothing back. The next stop
+  is blocked again, adding "If it cannot move, take another or schedule a look
+  before 14:15 BST", which is the 30-minute ceiling.
+- Every later reply has no tool call, and each one is blocked rather than
+  allowed. After ten blocks the host prints "A hook blocked the turn from
+  ending 9 consecutive times — overriding and ending turn."
+- The stub `gh` logged ten `pr list … --author @me` calls, one per check.
+- The away record holds the queued step and one stop, `work-owed`,
+  `possibly_forced_by_cap: true`, with count 2. The two are blocks 9 and 10:
+  abcd's count ran 1 to 10, since `stop_hook_active` stayed true across the
+  tool call.
+
+Verdict: as designed. One block, a tool call, then nine blocks with no tool
+call before the host overrode the stop. So **the host's count resets on a
+tool call and overrides at the ninth block since**, which is the eighth
+continuation. abcd's count does not see that reset, so it records the cap one
+block early as well as at the real one. That errs toward recording, as the
+spec says.
+
+**3. A question while away.** Print mode does not offer the host's question
+tool. `AskUserQuestion` is missing from the session's tool list even with
+`--tools AskUserQuestion,Bash,Read`, and missing again in stream-json input
+mode. **The live refusal by the host was therefore not captured.**
+
+- *Live* (`3-question`): asked to use AskUserQuestion, the session cannot. It
+  follows the away block instead: it decides the choice itself, intends to
+  record it with `abcd decide`, queues the push, and is blocked to the cap
+  again. That is ten more `gh` calls for ten checks.
+- *Hook level* (`3b-question-hook`): an AskUserQuestion PreToolUse payload was
+  sent through `sh <scratch>/plugin/hooks/pre-tool-use.sh`, the command the
+  host runs. It returns `permissionDecision: "deny"` with "Blocked by the abcd
+  guard (question tool): the person is away (abcd mode autonomous), so no
+  question is put to them, whatever its chip and whoever wrote it. Route the
+  question by the act it asks about …", followed by the full person-only list
+  and the route to `abcd decide`.
+
+Verdict: the reroute text is right at the hook. The host side remains to
+capture in an interactive session.
+
+**4. Compaction re-injection** (`4-compact`). Stream-json input sent "Say
+hello and stop." and then `/compact`.
+
+- The first stop is blocked, and Claude queues the push.
+- The second stop is blocked and names the deadline "before 14:19 BST".
+  Claude then calls CronCreate with a one-shot `13 14 18 10 *`, and the host
+  answers "Next run: Oct 18 2:13pm".
+- The third stop is allowed silently. The session state reads `waiting`,
+  `next_look` `2026-10-18T14:13:00+01:00` (the host's own next run) and
+  `wakes: 1`.
+- `/compact` (trigger `manual`) runs PreCompact, and then
+  **SessionStart:compact returns the `## AWAY` block again**.
+
+Verdict: as designed, captured live.
+
+**5. Cron wakes, compared with the host** (`5-cron`). Three prompts went to one
+session, each sent after the turn before it ended.
+
+- *Turn 1.* CronCreate `0 7 * * *`. The host's CronList row is "Every day at
+  7:00 AM (recurring) [session-only], next run Oct 19 7:30am". abcd computes
+  the same latest fire time: the 07:00 match plus the host's lateness, at most
+  30 minutes. The first stop is blocked (the first block of the session). The
+  second, with only the morning cron, is **refused as a wake**: it is blocked
+  with "schedule a look before 14:21 BST". Claude then adds `*/10 * * * *`;
+  the host lists "next run Oct 18 2:01pm" (13:51 now). abcd's bound is the
+  14:00 match plus half the gap, 14:05, before the 14:21 deadline, and the
+  host's 14:01 falls inside it. That stop is **allowed** (wake 1).
+- *Turn 2*, with the owed set unchanged: allowed (wake 2).
+- *Turn 3*: blocked with "The set has not moved over two wakes, so a wake no
+  longer releases this stop: move the item, or take another." Then nine
+  one-word replies with no tool call. The host overrides at the ninth block,
+  and abcd's count reaches nine at that same block and records the stop.
+- 13 `gh` calls for 13 checks.
+
+A first attempt sent all three prompts at once. The host merged them into
+one turn, which gave nine blocks in a row with no tool call and the host's
+override at the ninth. Its transcript was overwritten by the rerun, and its
+one recorded stop stays in the record's count.
+
+Verdict: as designed. The `*/10` wake released twice and the third stop was
+blocked, and abcd's fire times agree with what the host lists.
+
+**6. `--hold-pushes`, a stacked branch, the hand-back** (`6-hold-stacked`).
+
+- *Setup.* `abcd mode autonomous --until 14:01 --hold-pushes` (eight minutes
+  ahead; the queue and the stop were kept). A hand-made receipt file named
+  `feat/x`'s head went into `.abcd/.work.local/preflight-receipts/`.
+- *Prompt 1.* The session runs `git worktree add -b feat/stacked
+  <scratch>/wt-stacked feat/x`. The pre-tool hook records the branch.
+- *First stop.* `feat/x` is already handed back: an earlier queued step names
+  it, its head contains `origin/main` and has a receipt. Only the new branch
+  is owed: "work is owed (1 item). Next: branch feat/stacked has commits not
+  pushed … With --hold-pushes the person has said pushes wait: finish the
+  local work …, then queue the push naming the branch, as \`abcd mode queue
+  "push feat/stacked"\`."
+- The stacked condition itself is not owed: the receipt and an equal base tip
+  meet the clearing rule. So the item shown is the stacked branch's unpushed
+  one.
+- Claude queues "push feat/stacked", and the next stop hands that back too.
+  Nothing is owed, so row 7 blocks with "take the next ready item first …
+  schedule a look before 14:54 BST", which is the one-hour ceiling.
+- Claude creates a one-shot cron for 14:37 (host: "Next run: Oct 18 2:37pm"),
+  and the stop is allowed.
+- *Prompt 2.* The person's line reads "pushes wait for you; 4 steps queued,
+  **2 items handed back**". The stop is allowed silently.
+
+Verdict: as designed.
+
+**7. The window lapsed** (`7-lapsed`, after 14:01).
+
+- The prompt hook shows "abcd: the away window ended at 2026-10-18 14:01 BST
+  with 4 steps queued and 2 stops recorded, not yet read. `abcd mode back`
+  prints them and closes it."
+- The stop is checked as present: allowed with "stopped with work owed (2
+  items); next: branch feat/stacked has commits not pushed …".
+- No `gh` call.
+
+**8. StopFailure** (`8-stopfailure-hook`, hook level). Triggering a real API
+error was not possible cheaply, so a payload `{"hook_event_name":
+"StopFailure","error":"rate_limit",…}` was sent through `sh
+<scratch>/plugin/hooks/stop-failure.sh` while away. It exits 0 with no output,
+and the record gains `{"kind":"api-error","error_type":"rate_limit"}`. **A
+live StopFailure was not captured**, so the host's field name is not proven
+here.
+
+**9. `abcd mode back`** (`9-mode-back`, run by hand). It prints one line per
+queued step (four), per handed-back item ("handed back: feat/x at
+512f75b1df8a", the same for feat/stacked), and per recorded stop ("stopped
+with work owed, possibly forced by the cap: … (6 times, first … 13:46 BST,
+last … 13:52 BST)", "stopped on an API error (rate_limit) …"). It ends with
+"the away window ended at 2026-10-18 14:01 BST; closed by Alice from repo".
+
+**Not captured, and why.**
+
+- The behind pull request: the stub forge answers `[]`, and a real lab base
+  that requires up-to-date branches was out of reach here.
+- The host's question refusal live: print mode has no question tool (above).
+- A live StopFailure.
+- A push clearing an item: pushes were withheld on purpose.
+
+**Seen in passing, none of them blocking.**
+
+- The item's text repeats itself: "branch feat/x has commits not pushed
+  (feat/x has commits not pushed)", in the reason, in the person's message
+  and in the recorded stop.
+- The host marks the first block of each turn with a notification "Stop hook
+  error occurred · ctrl+o to see", although the hook exited 0 with outcome
+  `success` and empty stderr. That wording is the host's, but a person sees
+  it.
+- The stops' count overstates the forced stops: 6 recorded against 4 the host
+  forced, from the early record when a tool call reset the host's count.
+- Bounded by the cap, the blocked session repeats itself. In `3-question` it
+  called the hook "faulty" for keeping a queued push owed, which is the
+  designed behaviour without `--hold-pushes`.
+
 ## Size
 
 Re-estimated after review round 3 at 7.5 working days of work, up from the

From 3ee662d6d3d69fda923feacd67e6b9aee9c532e0 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 14:03:05 +0100
Subject: [PATCH 30/58] docs: mark the live session capture step landed

Assisted-by: Claude:claude-opus-5-5
---
 .../spc-2610180914469489-a-session-told-to-work-on-while-its.md  | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
index f597e1f5b5..9b460ddc4b 100644
--- a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
+++ b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
@@ -1011,6 +1011,7 @@ for review; none changes a test a step names.
      show the stop allowed and flagged with no forge call. Capture before and
      after the change on the same checkout, as the release lesson on host
      fixes requires.
+   - landed: d0249f356
 
 ## Live captures
 

From 93d34a1efc17e68b9cb926e67c647d5b9c3eada5 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 14:10:45 +0100
Subject: [PATCH 31/58] fix: act on a turn's end only in a checkout abcd
 manages

The Stop hook resolved a store for any git checkout, so with the plugin
installed for every repository an unrelated repo on an own branch with
an unpushed commit got "stopped with work owed" after every turn and paid
the reflog and log reads. Stop, StopFailure, session start and the prompt
router's away read now all ask one question first: is `.abcd/` at the
checkout's root, or, for a linked worktree, at its main worktree's root.
Outside one they read nothing, say nothing, and run no git past naming
the roots.

Assisted-by: Claude:claude-opus-5-5
---
 internal/core/autonomy/verbs.go        | 12 ++++
 internal/surface/cli/cli.go            |  2 +-
 internal/surface/cli/hook_away.go      | 49 ++++++++++---
 internal/surface/cli/hook_stop.go      | 12 ++--
 internal/surface/cli/hook_stop_test.go | 95 ++++++++++++++++++++++++++
 5 files changed, 154 insertions(+), 16 deletions(-)

diff --git a/internal/core/autonomy/verbs.go b/internal/core/autonomy/verbs.go
index 283d657484..1a911b56e0 100644
--- a/internal/core/autonomy/verbs.go
+++ b/internal/core/autonomy/verbs.go
@@ -90,6 +90,18 @@ func Resolve(cwd string, o Options) (root string, st Store, err error) {
 	return root, st, err
 }
 
+// Managed reports whether abcd manages the checkout at root: `.abcd/` is a
+// directory at its root (a symbolic link is not). The away mode's hooks act
+// only in such a checkout, so a plugin installed for every repository reads
+// nothing, runs no git past naming the root, and says nothing in any other.
+func Managed(root string) bool {
+	if root == "" {
+		return false
+	}
+	fi, err := os.Lstat(filepath.Join(root, ".abcd"))
+	return err == nil && fi.IsDir()
+}
+
 // SetAway is `abcd mode autonomous [--until <time>] [--hold-pushes]` from
 // cwd: until "" is open-ended. A past or unreadable --until, one past seven
 // days, no checkout, and a checkout without the local tier are refused with
diff --git a/internal/surface/cli/cli.go b/internal/surface/cli/cli.go
index 1c257d6466..463d99a1ef 100644
--- a/internal/surface/cli/cli.go
+++ b/internal/surface/cli/cli.go
@@ -1793,8 +1793,8 @@ envelope carries it as system_message.`,
 			// is shown to the person. Read before the rules, for the drain's
 			// reason, from the drain's root-commit lookup, and inside the
 			// hook's one deadline: the status read below takes what it leaves.
-			away := readPromptAway(cmd.ErrOrStderr(), drained)
 			root := rulesRoot(cwd, cmd.ErrOrStderr())
+			away := readPromptAway(cmd.ErrOrStderr(), drained, root)
 			rs, err := rules.Load(root)
 			if err != nil {
 				// rules.Load errors already carry their own "rules:" prefix, so
diff --git a/internal/surface/cli/hook_away.go b/internal/surface/cli/hook_away.go
index 8316cfa096..c9afff36fb 100644
--- a/internal/surface/cli/hook_away.go
+++ b/internal/surface/cli/hook_away.go
@@ -52,11 +52,12 @@ type awayView struct {
 
 // readPromptAway reads the away record for the repository whose root commit
 // the live drain already looked up for this prompt, so the router still makes
-// one root-commit lookup a prompt. It fails open: a record that cannot be read
+// one root-commit lookup a prompt, and only when abcd manages the checkout at
+// root (the loader's root for this prompt). It fails open: a record that cannot be read
 // safely is named on stderr and adds nothing; with no root commit (outside a
 // checkout, or git not answering in time) it adds nothing silently.
-func readPromptAway(stderr io.Writer, drained rootLookup) awayView {
-	if !drained.asked || drained.err != nil || drained.sha == "" {
+func readPromptAway(stderr io.Writer, drained rootLookup, root string) awayView {
+	if !autonomy.Managed(root) || !drained.asked || drained.err != nil || drained.sha == "" {
 		return awayView{}
 	}
 	home, err := os.UserHomeDir()
@@ -101,19 +102,47 @@ func readAwayFailOpen(stderr io.Writer, cwd string) (*autonomy.Record, bool, boo
 	return rec, holds, true
 }
 
-// sessionStartAway notes the session's start copy and returns the away block
-// when the record holds. The note is written only in a checkout abcd manages
-// (one with `.abcd/` at its root), and only the first time for a session, so
-// a compaction or resume run from a worktree the session made keeps the start.
-func sessionStartAway(stderr io.Writer, in hookInput, cwd string) string {
+// managedRoot is the root of the checkout cwd stands in, and whether abcd
+// manages it (autonomy.Managed): `.abcd/` at its root, or, for a linked
+// worktree, at the root of the repository's main worktree, since a worktree
+// a session makes shares the repository's away store and a branch cut before
+// `.abcd/` was committed (or a `.abcd/` never committed) leaves it out. Every
+// away hook asks it first: outside a managed checkout the hook reads nothing
+// and says nothing, and the git it runs only names the roots.
+func managedRoot(cwd string) (string, bool) {
 	if cwd == "" {
-		return ""
+		return "", false
 	}
 	root, err := gitutil.CheckoutRoot(cwd, autonomy.StoreName)
 	if err != nil {
+		return "", false
+	}
+	if autonomy.Managed(root) {
+		return root, true
+	}
+	if fi, err := os.Lstat(filepath.Join(root, ".git")); err != nil || !fi.Mode().IsRegular() {
+		return "", false // not a linked worktree: there is no main worktree to ask
+	}
+	common, err := gitutil.RevParseAbsPath(root, "--git-common-dir")
+	if err != nil || filepath.Base(common) != ".git" {
+		return "", false
+	}
+	if !autonomy.Managed(filepath.Dir(common)) {
+		return "", false
+	}
+	return root, true
+}
+
+// sessionStartAway notes the session's start copy and returns the away block
+// when the record holds. Both happen only in a checkout abcd manages (one with
+// `.abcd/` at its root), and the note only the first time for a session, so a
+// compaction or resume run from a worktree the session made keeps the start.
+func sessionStartAway(stderr io.Writer, in hookInput, cwd string) string {
+	root, ok := managedRoot(cwd)
+	if !ok {
 		return ""
 	}
-	if fi, err := os.Lstat(filepath.Join(root, ".abcd")); err == nil && fi.IsDir() && autonomy.ValidSessionID(in.SessionID) {
+	if autonomy.ValidSessionID(in.SessionID) {
 		if _, st, err := autonomy.Resolve(root, autonomy.Options{}); err == nil {
 			if _, err := st.NoteSessionCopy(in.SessionID, root, time.Now()); err != nil {
 				diagnosticLine(stderr, "abcd mode: the session's start copy was not noted (%s)", fsutil.RedactHome(err.Error()))
diff --git a/internal/surface/cli/hook_stop.go b/internal/surface/cli/hook_stop.go
index f1ace42ddd..5fd83c2875 100644
--- a/internal/surface/cli/hook_stop.go
+++ b/internal/surface/cli/hook_stop.go
@@ -109,10 +109,11 @@ stderr; every outcome exits 0.`,
 			if err != nil {
 				return stopAllow(cmd, "unreadable Stop payload (%s)", termsafe.Sanitize(err.Error()))
 			}
-			if p.Cwd == "" {
-				return nil
+			root, ok := managedRoot(p.Cwd)
+			if !ok {
+				return nil // not a checkout abcd manages: nothing to check, and no git spent
 			}
-			copyRoot, st, err := autonomy.ResolveCopy(p.Cwd, p.SessionID, autonomy.Options{})
+			copyRoot, st, err := autonomy.ResolveCopy(root, p.SessionID, autonomy.Options{})
 			if err != nil {
 				return nil // not a checkout abcd can key a store on: nothing to check
 			}
@@ -239,10 +240,11 @@ the person is present nothing is written. Every outcome exits 0.`,
 				diagnosticLine(cmd.ErrOrStderr(), "abcd stop: unreadable StopFailure payload (%s); nothing recorded", termsafe.Sanitize(err.Error()))
 				return nil
 			}
-			if p.Cwd == "" {
+			root, ok := managedRoot(p.Cwd)
+			if !ok {
 				return nil
 			}
-			_, st, err := autonomy.ResolveCopy(p.Cwd, p.SessionID, autonomy.Options{})
+			_, st, err := autonomy.ResolveCopy(root, p.SessionID, autonomy.Options{})
 			if err != nil {
 				return nil
 			}
diff --git a/internal/surface/cli/hook_stop_test.go b/internal/surface/cli/hook_stop_test.go
index c766b9fb42..a90932a265 100644
--- a/internal/surface/cli/hook_stop_test.go
+++ b/internal/surface/cli/hook_stop_test.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -265,3 +266,97 @@ func TestHookStopFailureRecords(t *testing.T) {
 		t.Errorf("an error type outside the host's shape was recorded as %q, want unknown", got)
 	}
 }
+
+// gitCallLog puts a git on PATH that logs each call's arguments to the
+// returned file and runs the real git.
+func gitCallLog(t *testing.T) string {
+	t.Helper()
+	real, err := exec.LookPath("git")
+	if err != nil {
+		t.Skip("git not on PATH")
+	}
+	bin := t.TempDir()
+	log := filepath.Join(t.TempDir(), "git-calls.log")
+	script := "#!/bin/sh\nprintf '%s\\n' \"$*\" >> '" + log + "'\nexec '" + real + "' \"$@\"\n"
+	if err := os.WriteFile(filepath.Join(bin, "git"), []byte(script), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("PATH", bin+string(os.PathListSeparator)+os.Getenv("PATH"))
+	return log
+}
+
+// unmanagedOwnUnpushed is a checkout abcd does not manage (no .abcd/ at its
+// root) on an own branch, pushed without -u to nowhere: a commit of the
+// checkout's author no remote holds.
+func unmanagedOwnUnpushed(t *testing.T) string {
+	t.Helper()
+	repo := realPath(t, t.TempDir())
+	gitInitAt(t, repo)
+	gitAt(t, repo, "config", "--local", "user.email", "alice@example.invalid")
+	gitAt(t, repo, "config", "--local", "user.name", "Alice")
+	gitAt(t, repo, "config", "--local", "commit.gpgsign", "false")
+	gitAt(t, repo, "commit", "-q", "--allow-empty", "-m", "seed")
+	gitAt(t, repo, "checkout", "-q", "-b", "feat/elsewhere")
+	gitAt(t, repo, "commit", "-q", "--allow-empty", "-m", "not pushed")
+	return repo
+}
+
+// TestHookStopUnmanagedRepoSilent: in a checkout abcd does not manage the
+// stop hook allows silently, never reads the owed work and runs no git past
+// naming the checkout's root; StopFailure records nothing there, and the
+// session-start and prompt hooks add no away block, even with an away record
+// holding for the repository (set from a managed copy of it).
+func TestHookStopUnmanagedRepoSilent(t *testing.T) {
+	t.Run("stop", func(t *testing.T) {
+		awayCheckout(t) // the sandboxed HOME
+		repo := unmanagedOwnUnpushed(t)
+		owed := autonomy.Owed{Items: []autonomy.OwedItem{{Kind: autonomy.OwedUnpushed, Capped: true, Branch: "feat/elsewhere", Head: "aaaa"}}}
+		asked := fakeOwed(t, &owed)
+		log := gitCallLog(t)
+		_, so, se := runStop(t, stopHookPayload(t, "u1", repo, false, "Done."))
+		if so != "" || se != "" {
+			t.Errorf("an unmanaged checkout: stdout %q stderr %q, want nothing", so, se)
+		}
+		if len(*asked) != 0 {
+			t.Errorf("an unmanaged checkout's owed work was read: %+v", *asked)
+		}
+		for _, line := range strings.Split(strings.TrimSpace(ghCalls(t, log)), "\n") {
+			// `git version` is the client's version probe, read once a
+			// process, not a read of the repository.
+			if line != "" && line != "version" && !strings.Contains(line, "rev-parse --show-toplevel") {
+				t.Errorf("an unmanaged checkout ran git past naming its root: %q", line)
+			}
+		}
+	})
+	t.Run("away record from a managed copy", func(t *testing.T) {
+		root := awayCheckout(t)
+		// A clone shares the repository's root commit, so its away store,
+		// but has no .abcd/ at its root (the fixture's .abcd/ is untracked).
+		sib := filepath.Join(t.TempDir(), "sib")
+		gitAt(t, root, "clone", "-q", root, sib)
+		sib = realPath(t, sib)
+		setAway(t)
+		owed := autonomy.Owed{Items: []autonomy.OwedItem{behindItem}}
+		asked := fakeOwed(t, &owed)
+		if _, so, se := runStop(t, stopHookPayload(t, "u2", sib, false, "Done.")); so != "" || len(*asked) != 0 {
+			t.Errorf("stop from an unmanaged copy: stdout %q stderr %q, reader asked %d times", so, se, len(*asked))
+		}
+		fail := `{"session_id":"u2","cwd":"` + sib + `","hook_event_name":"StopFailure","error":"rate_limit"}`
+		if _, _, err := runSplit(t, fail, "hook", "stop-failure"); err != nil {
+			t.Fatal(err)
+		}
+		if stops := readAway(t, root).Stops; len(stops) != 0 {
+			t.Errorf("StopFailure from an unmanaged copy recorded %+v", stops)
+		}
+		if so, _, _ := runSplit(t, awayStartPayload("u2", sib, "startup"), "hook", "session-start"); strings.Contains(so, "## AWAY") {
+			t.Errorf("session start in an unmanaged copy added the away block:\n%s", so)
+		}
+		if so, _, _ := runSplit(t, awayPromptPayload("u2", sib, "hello"), "hook", "prompt-router"); strings.Contains(so, "AWAY") || strings.Contains(so, "away") {
+			t.Errorf("a prompt in an unmanaged copy carried the away block or line:\n%s", so)
+		}
+		// The managed copy is unchanged.
+		if out, so, _ := runStop(t, stopHookPayload(t, "u3", root, false, "Done.")); out.Decision != "block" {
+			t.Errorf("the managed copy no longer blocks: %s", so)
+		}
+	})
+}

From 546c22e407f8f6d3093b9679982706b78f655412 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 14:14:20 +0100
Subject: [PATCH 32/58] fix: do not owe a no-upstream branch whose work has
 already landed

A branch pushed without -u, then squash-merged with its remote branch
deleted and pruned, has no upstream and no commit in any remote ref, so
it read as unpushed for fourteen days and, while away, blocked every stop
to the cap with a phantom recorded stop. Before owing such a branch the
reader now merges it into the default branch as last fetched without
writing anything (merge-tree, repository merge drivers replaced as the
conflict probe replaces them): no change is landed, which covers a squash
of several commits. A merge that conflicts falls to git cherry, where
every commit upstream by patch id is landed; anything else it cannot
decide is named in a note instead of an item.

The owed-reader fixture's commits now add a file each: a commit that
changes nothing has landed wherever its branch is merged.

Assisted-by: Claude:claude-opus-5-5
---
 internal/core/autonomy/owedread.go      |  91 ++++++++++++++-
 internal/core/autonomy/owedread_test.go | 140 +++++++++++++++++++++++-
 2 files changed, 224 insertions(+), 7 deletions(-)

diff --git a/internal/core/autonomy/owedread.go b/internal/core/autonomy/owedread.go
index e23fad8f26..0f08dcfe24 100644
--- a/internal/core/autonomy/owedread.go
+++ b/internal/core/autonomy/owedread.go
@@ -757,8 +757,9 @@ func (r *owedReader) stacked(name, head, base, baseTip string, p pullRequest, ha
 }
 
 // unpushed reports whether b holds commits not on its upstream, or, with no
-// upstream configured, not in any remote-tracking ref. A branch whose upstream
-// is gone never counts.
+// upstream configured, not in any remote-tracking ref and not already landed
+// in the default branch (r.landed). A branch whose upstream is gone never
+// counts.
 func (r *owedReader) unpushed(b *localBranch) bool {
 	if b.upstream != "" {
 		if b.upstreamGone {
@@ -769,7 +770,91 @@ func (r *owedReader) unpushed(b *localBranch) bool {
 		return err == nil && n > 0
 	}
 	out, err := r.git("rev-list", "-n", "1", b.head, "--not", "--remotes", "--")
-	return err == nil && strings.TrimSpace(out) != ""
+	if err != nil || strings.TrimSpace(out) == "" {
+		return false
+	}
+	switch r.landed(b) {
+	case landedYes:
+		return false
+	case landedUnknown:
+		r.note("%s has commits in no remote branch and no upstream, and could not be told landed in %s or not (its change conflicts with it and its commits' patches are not all there), so it is not counted as unpushed",
+			b.name, r.defLabel())
+		return false
+	}
+	return true
+}
+
+// landedness is whether a branch's work is already in the default branch.
+type landedness int
+
+const (
+	landedNo landedness = iota
+	landedYes
+	landedUnknown
+)
+
+// maxLandedOutput bounds the merge and patch reads of r.landed.
+const maxLandedOutput = 1 << 20
+
+// landed decides whether a branch with no upstream and commits in no remote
+// branch has nonetheless landed in the default branch as last fetched: the
+// usual shape of a branch pushed without -u, squash- or rebase-merged, and
+// its remote branch deleted and pruned. Merging it into the default branch
+// (`merge-tree --write-tree`, writing nothing, with the repository's merge
+// drivers replaced by git's built-in merge, as the conflict probe pins them)
+// changing nothing is landed, which covers a squash of several commits; a
+// clean merge that changes the tree is not landed. A merge that conflicts,
+// or fails, falls to `git cherry`: every commit already upstream by patch id
+// ('-' lines only) is landed, which covers a single commit main has edited
+// over since; otherwise it cannot be told. No default branch to compare with
+// cannot be told either.
+func (r *owedReader) landed(b *localBranch) landedness {
+	if r.defTip == "" {
+		return landedUnknown
+	}
+	if overrides, err := gitutil.MergeDriverOverrides(r.root); err == nil {
+		args := append(overrides, "-c", "merge.union.driver="+gitutil.BuiltinMergeDriver(), "-c", "merge.renormalize=false",
+			"merge-tree", "--write-tree", "--name-only", "--no-messages", "-z", r.defTip, b.head)
+		out, conflicted, err := gitutil.RunCappedExitOne(r.root, maxLandedOutput, args...)
+		if err == nil && !conflicted {
+			tree, _, _ := strings.Cut(string(out), "\x00")
+			tree = strings.TrimSpace(tree)
+			defTree, terr := r.git("rev-parse", "--verify", "--quiet", r.defTip+"^{tree}")
+			if gitutil.IsFullSHA(tree) && terr == nil {
+				if tree == strings.TrimSpace(defTree) {
+					return landedYes
+				}
+				return landedNo
+			}
+		}
+	}
+	out, err := gitutil.RunCapped(r.root, maxLandedOutput, "cherry", r.defTip, b.head)
+	if err != nil {
+		return landedUnknown
+	}
+	lines := 0
+	for _, line := range strings.Split(out, "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		lines++
+		if !strings.HasPrefix(line, "- ") {
+			return landedUnknown
+		}
+	}
+	if lines == 0 {
+		return landedUnknown
+	}
+	return landedYes
+}
+
+// defLabel names the default branch as last fetched, for a note.
+func (r *owedReader) defLabel() string {
+	if r.def == "" {
+		return "the default branch"
+	}
+	return gitutil.ShortRef(r.def) + " as last fetched"
 }
 
 // reservationItems judges this copy's live reservations: a renewal due
diff --git a/internal/core/autonomy/owedread_test.go b/internal/core/autonomy/owedread_test.go
index 3e55c468c5..833ac3eca3 100644
--- a/internal/core/autonomy/owedread_test.go
+++ b/internal/core/autonomy/owedread_test.go
@@ -4,7 +4,9 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"strings"
 	"sync"
@@ -91,6 +93,7 @@ type fx struct {
 	forge  *fakeForge
 	res    []claim.Reservation
 	email  string
+	files  int // the files commitOn has added, for the next one's name
 }
 
 func newFx(t *testing.T) *fx {
@@ -118,11 +121,39 @@ func newFx(t *testing.T) *fx {
 
 func (f *fx) git(args ...string) string { f.t.Helper(); return f.repo.Git(args...) }
 
-// commitOn records an empty commit on branch without checking it out, by
-// author (the fixture's own when ""), and returns it.
+// gitIn runs git in the fixture with stdin, under the fixture's isolated
+// environment.
+func (f *fx) gitIn(stdin string, args ...string) string {
+	f.t.Helper()
+	cmd := exec.Command("git", append([]string{"-C", f.root}, args...)...)
+	cmd.Env = f.repo.Env()
+	cmd.Stdin = strings.NewReader(stdin)
+	out, err := cmd.Output()
+	if err != nil {
+		f.t.Fatalf("git %v: %v", args, err)
+	}
+	return strings.TrimSpace(string(out))
+}
+
+// treeWith is branch's tree with one file added, written to the object store.
+func (f *fx) treeWith(branch, name, content string) string {
+	f.t.Helper()
+	blob := f.gitIn(content, "hash-object", "-w", "--stdin")
+	entries := f.git("ls-tree", branch+"^{tree}")
+	if entries != "" {
+		entries += "\n"
+	}
+	return f.gitIn(entries+"100644 blob "+blob+"\t"+name+"\n", "mktree")
+}
+
+// commitOn records a commit on branch without checking it out, by author
+// (the fixture's own when ""), and returns it. The commit adds a file of its
+// own, so its change is real: a commit that changes nothing has, by
+// definition, already landed wherever its branch is merged.
 func (f *fx) commitOn(branch, msg, author string) string {
 	f.t.Helper()
-	tree := f.git("rev-parse", branch+"^{tree}")
+	f.files++
+	tree := f.treeWith(branch, fmt.Sprintf("f-%d.txt", f.files), msg+"\n")
 	args := []string{}
 	if author != "" {
 		args = append(args, "-c", "user.email="+author, "-c", "user.name="+strings.Split(author, "@")[0])
@@ -269,7 +300,11 @@ func TestOwnBranchFromRecordedCreation(t *testing.T) {
 	f := newFx(t)
 	wt := filepath.Join(t.TempDir(), "s")
 	f.git("worktree", "add", "-q", "-b", "feat/s", wt)
-	f.git("-C", wt, "commit", "-q", "--allow-empty", "-m", "stacked work")
+	if err := os.WriteFile(filepath.Join(wt, "s.txt"), []byte("stacked\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	f.git("-C", wt, "add", "s.txt")
+	f.git("-C", wt, "commit", "-q", "-m", "stacked work")
 	if owed := f.read(false); has(owed, OwedUnpushed, "feat/s") {
 		t.Fatalf("an unrecorded branch in another worktree is not own: %s", describe(owed))
 	}
@@ -964,3 +999,100 @@ func TestOwedOrderFixed(t *testing.T) {
 		t.Fatalf("the next item is the renewal: %+v", next)
 	}
 }
+
+// change commits content to file on branch, checking it out and back to
+// main, and returns the commit.
+func (f *fx) change(branch, file, content string) string {
+	f.t.Helper()
+	f.git("checkout", "-q", branch)
+	f.repo.Write(file, content)
+	f.git("add", "--", file)
+	f.git("commit", "-q", "-m", "change "+file+" on "+branch)
+	c := f.git("rev-parse", "HEAD")
+	f.git("checkout", "-q", "main")
+	return c
+}
+
+// squashLand squash-merges branch into main, pushes main, and deletes and
+// prunes the remote branch the branch was pushed to without -u.
+func (f *fx) squashLand(branch string) {
+	f.t.Helper()
+	f.git("push", "-q", "origin", branch) // no -u: no upstream configured
+	f.git("merge", "-q", "--squash", branch)
+	f.git("commit", "-q", "-m", "squash "+branch)
+	f.git("push", "-q", "origin", "main")
+	f.git("push", "-q", "origin", "--delete", branch)
+	f.git("fetch", "-q", "--prune", "origin")
+}
+
+// TestNoUpstreamLandedBranchNotOwed: a branch pushed without -u, then
+// squash-merged with its remote branch deleted and pruned, has no upstream
+// and no commit in any remote ref, but its work is already in the default
+// branch: it is not owed, whether it held several commits (the squash's
+// patch matches none of them) or one that main has since edited over.
+func TestNoUpstreamLandedBranchNotOwed(t *testing.T) {
+	t.Run("multi-commit squash", func(t *testing.T) {
+		f := newFx(t)
+		f.git("branch", "feat/sq")
+		f.change("feat/sq", "a.txt", "one\n")
+		f.change("feat/sq", "b.txt", "two\n")
+		f.own("feat/sq")
+		f.squashLand("feat/sq")
+		f.change("main", "c.txt", "later\n")
+		f.git("push", "-q", "origin", "main")
+		f.git("fetch", "-q", "origin")
+		if owed := f.read(false); has(owed, OwedUnpushed, "feat/sq") || strings.Contains(describe(owed), "feat/sq") {
+			t.Fatalf("a squash-merged, pruned branch is not owed: %s", describe(owed))
+		}
+	})
+	t.Run("one commit edited over since", func(t *testing.T) {
+		f := newFx(t)
+		f.git("branch", "feat/one")
+		f.change("feat/one", "a.txt", "one\n")
+		f.own("feat/one")
+		f.squashLand("feat/one")
+		f.change("main", "a.txt", "one, edited\n")
+		f.git("push", "-q", "origin", "main")
+		f.git("fetch", "-q", "origin")
+		if owed := f.read(false); has(owed, OwedUnpushed, "feat/one") || strings.Contains(describe(owed), "feat/one") {
+			t.Fatalf("a landed commit main has edited over since is not owed: %s", describe(owed))
+		}
+	})
+}
+
+// TestNoUpstreamUnlandedBranchOwed: a no-upstream branch holding a commit
+// whose change the default branch lacks is still owed.
+func TestNoUpstreamUnlandedBranchOwed(t *testing.T) {
+	f := newFx(t)
+	f.git("branch", "feat/new")
+	f.change("feat/new", "n.txt", "new\n")
+	f.own("feat/new")
+	f.change("main", "m.txt", "moved on\n")
+	f.git("push", "-q", "origin", "main")
+	f.git("fetch", "-q", "origin")
+	if owed := f.read(false); !has(owed, OwedUnpushed, "feat/new") {
+		t.Fatalf("an unpushed, unlanded branch is owed: %s", describe(owed))
+	}
+}
+
+// TestNoUpstreamUndecidedBranchNoted: a no-upstream branch whose change
+// conflicts with the default branch and whose patch is not upstream cannot
+// be told landed or not: it is named in a note, not owed.
+func TestNoUpstreamUndecidedBranchNoted(t *testing.T) {
+	f := newFx(t)
+	f.change("main", "a.txt", "base\n")
+	f.git("push", "-q", "origin", "main")
+	f.git("branch", "feat/c")
+	f.change("feat/c", "a.txt", "theirs\n")
+	f.own("feat/c")
+	f.change("main", "a.txt", "ours\n")
+	f.git("push", "-q", "origin", "main")
+	f.git("fetch", "-q", "origin")
+	owed := f.read(false)
+	if has(owed, OwedUnpushed, "feat/c") {
+		t.Fatalf("an undecidable branch is not owed: %s", describe(owed))
+	}
+	if !strings.Contains(strings.Join(owed.Notes, " "), "feat/c") {
+		t.Fatalf("an undecidable branch is named in a note: %s", describe(owed))
+	}
+}

From 3b8b14fac41e2784bcec3a6cd28eefbf6431d102 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 14:14:47 +0100
Subject: [PATCH 33/58] test: make the stop check's end-to-end origin with
 gittest.InitBare

TestNoTestMakesABareRepositoryByHand refused the hand-made bare origin
in hook_stop_e2e_test.go: a bare fixture needs the maintenance config
InitBare writes.

Assisted-by: Claude:claude-opus-5-5
---
 internal/surface/cli/hook_stop_e2e_test.go | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/internal/surface/cli/hook_stop_e2e_test.go b/internal/surface/cli/hook_stop_e2e_test.go
index 46d3c6537a..1a3ca7fbd5 100644
--- a/internal/surface/cli/hook_stop_e2e_test.go
+++ b/internal/surface/cli/hook_stop_e2e_test.go
@@ -5,6 +5,8 @@ import (
 	"path/filepath"
 	"strings"
 	"testing"
+
+	"github.com/intentdriven/abcd/internal/gittest"
 )
 
 // hook_stop_e2e_test.go — the away mode's stop check end to end, through the
@@ -23,7 +25,7 @@ func ownedUnpushedCheckout(t *testing.T) (root, ghLog string) {
 	gitAt(t, root, "config", "--local", "user.email", "alice@example.invalid")
 	gitAt(t, root, "config", "--local", "commit.gpgsign", "false")
 	origin := filepath.Join(t.TempDir(), "origin.git")
-	gitAt(t, root, "init", "-q", "--bare", origin)
+	gittest.InitBare(t, origin)
 	gitAt(t, root, "remote", "add", "origin", origin)
 	main := gitAt(t, root, "rev-parse", "--abbrev-ref", "HEAD")
 	gitAt(t, root, "push", "-q", "origin", main)

From 231a6984f2019b13bfa1394fba4651770b6f57ac Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 14:15:38 +0100
Subject: [PATCH 34/58] fix: read a pull-request listing at its limit as
 possibly truncated

A listing that returns exactly its limit of 200 may have left open pull
requests out, and a reservation whose pull request was left out read as
work no pull request carries. Such a listing now adds a note saying it
may be truncated, and a reservation it does not show carried is unknown,
not owed.

Assisted-by: Claude:claude-opus-5-5
---
 internal/core/autonomy/forge.go         |  6 +++++-
 internal/core/autonomy/owedread.go      |  5 ++++-
 internal/core/autonomy/owedread_test.go | 25 +++++++++++++++++++++++++
 3 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/internal/core/autonomy/forge.go b/internal/core/autonomy/forge.go
index 7913adc8af..0c2383b661 100644
--- a/internal/core/autonomy/forge.go
+++ b/internal/core/autonomy/forge.go
@@ -104,6 +104,10 @@ type listing struct {
 	// mine is whether every listed pull request is the person's (a listing
 	// by `--author @me`, made when the person's forge name is not known).
 	mine bool
+	// truncated is a listing that returned exactly prListLimit pull
+	// requests, so more may be open than it shows: a pull request it does
+	// not show is unknown, never absent.
+	truncated bool
 }
 
 // listOpen makes the listing under deadline: every open pull request when the
@@ -130,7 +134,7 @@ func listOpen(ctx context.Context, forge Forge, dir, person string, deadline tim
 	if err := json.Unmarshal([]byte(out), &prs); err != nil {
 		return listing{unread: "the forge's listing of the pull requests does not parse"}
 	}
-	return listing{read: true, prs: prs, mine: mine}
+	return listing{read: true, prs: prs, mine: mine, truncated: len(prs) >= prListLimit}
 }
 
 // byHead is the open pull request whose head is branch in this repository
diff --git a/internal/core/autonomy/owedread.go b/internal/core/autonomy/owedread.go
index 0f08dcfe24..e2e49738b1 100644
--- a/internal/core/autonomy/owedread.go
+++ b/internal/core/autonomy/owedread.go
@@ -129,6 +129,9 @@ func ReadOwed(ctx context.Context, o ReadOptions) (Owed, error) {
 		if !r.list.read {
 			r.note("the pull requests were not read (%s), so the check judged from disk alone", r.list.unread)
 		}
+		if r.list.truncated {
+			r.note("the forge listed %d open pull requests, its limit, so the listing may be truncated: a reservation no listed pull request carries is not counted as uncarried", len(r.list.prs))
+		}
 	}
 	r.receiptsMinted = receiptsMinted(root)
 	r.readLanes()
@@ -882,7 +885,7 @@ func (r *owedReader) reservationItems() {
 				break
 			}
 		}
-		if !carried {
+		if !carried && !r.list.truncated {
 			r.add(OwedItem{Kind: OwedUncarried, Capped: true, Record: res.Record,
 				Reason: fmt.Sprintf("no open pull request carries the work of %s yet: finish it and open one", res.Record)})
 		}
diff --git a/internal/core/autonomy/owedread_test.go b/internal/core/autonomy/owedread_test.go
index 833ac3eca3..3e7036fa06 100644
--- a/internal/core/autonomy/owedread_test.go
+++ b/internal/core/autonomy/owedread_test.go
@@ -1096,3 +1096,28 @@ func TestNoUpstreamUndecidedBranchNoted(t *testing.T) {
 		t.Fatalf("an undecidable branch is named in a note: %s", describe(owed))
 	}
 }
+
+// TestForgeListingAtLimitTruncated: a listing that returns exactly its limit
+// may be truncated, so a note says so and a reservation no listed pull
+// request carries is not reported as uncarried; one short of the limit is
+// whole, and the reservation is.
+func TestForgeListingAtLimitTruncated(t *testing.T) {
+	for _, n := range []int{prListLimit, prListLimit - 1} {
+		f := newFx(t)
+		f.reserveFresh("iss-77")
+		for i := 0; i < n; i++ {
+			f.forge.prs = append(f.forge.prs, pr(1000+i, fmt.Sprintf("other/%d", i), "main", "bob"))
+		}
+		owed := f.read(true)
+		notes := strings.Join(owed.Notes, " ")
+		if n == prListLimit {
+			if has(owed, OwedUncarried, "iss-77") || !strings.Contains(notes, "truncated") {
+				t.Errorf("a listing at its limit of %d: %s", n, describe(owed))
+			}
+			continue
+		}
+		if !has(owed, OwedUncarried, "iss-77") || strings.Contains(notes, "truncated") {
+			t.Errorf("a listing of %d, under its limit: %s", n, describe(owed))
+		}
+	}
+}

From e0d16ae76211c2bfde3c069db7c1ec1b06578c55 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 14:19:58 +0100
Subject: [PATCH 35/58] fix: say each owed item once, quote suggested commands,
 record row-1 stops
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three findings of the diff review, all in the verdict's words:
- describeItem appended the reader's reason to words that already said
  it ("branch feat/x has commits not pushed (feat/x has commits not
  pushed)") in the reason, the person's line and the recorded stop. The
  reader's reason, when there is one, is now the item's words, and the
  unpushed reason names the branch as "branch <name>".
- The suggested `abcd mode queue "push <branch>"` and `abcd reserve <id>`
  interpolated names a refname may fill with `$(…)` or backquotes. Each
  is now one shell word, single-quoted with shellquote.Single unless it
  holds only characters no shell reads specially.
- A question blocked past the host's cap recorded no stop. It now records
  work owed when anything is owed, else no next look.

Assisted-by: Claude:claude-opus-5-5
---
 internal/core/autonomy/judge.go      | 38 ++++++++++++++----
 internal/core/autonomy/judge_test.go | 60 ++++++++++++++++++++++++++++
 internal/core/autonomy/owedread.go   |  4 +-
 3 files changed, 93 insertions(+), 9 deletions(-)

diff --git a/internal/core/autonomy/judge.go b/internal/core/autonomy/judge.go
index 4fd52c5776..cce42e0b3b 100644
--- a/internal/core/autonomy/judge.go
+++ b/internal/core/autonomy/judge.go
@@ -7,6 +7,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/intentdriven/abcd/internal/shellquote"
 	"github.com/intentdriven/abcd/internal/termsafe"
 )
 
@@ -158,7 +159,16 @@ func Judge(rec *Record, owed Owed, in StopInput, st SessionState, now time.Time)
 		limit = DefaultBlockCap
 	}
 	if next.Blocks > limit {
-		switch v.Row {
+		row := v.Row
+		if row == 1 {
+			// A question blocked past the cap is a stop like any other:
+			// with work owed, or with none and no look scheduled.
+			row = 7
+			if !owed.Empty() {
+				row = 2
+			}
+		}
+		switch row {
 		case 2, 4, 5:
 			item, _ := owed.Next()
 			v.Stop = &Stop{Kind: StopWorkOwed, Detail: describeItem(item), PossiblyForcedByCap: true}
@@ -239,17 +249,34 @@ func needsPush(k OwedKind) bool {
 // person's standing instruction and never names the away mode as leave.
 func pushWords(rec *Record, item OwedItem) string {
 	if rec != nil && rec.HoldPushes {
-		target := "the branch"
+		target := "<branch>"
 		if item.Branch != "" {
 			target = clean(item.Branch)
 		}
-		return fmt.Sprintf("With --hold-pushes the person has said pushes wait: finish the local work (the merge from the base, the preflight), then queue the push naming the branch, as `abcd mode queue \"push %s\"`.", target)
+		return fmt.Sprintf("With --hold-pushes the person has said pushes wait: finish the local work (the merge from the base, the preflight), then queue the push naming the branch, as `abcd mode queue %s`.", shellWord("push "+target))
 	}
 	return "Do the local work, then push if your standing instruction allows; queue only if the person has said pushes wait. A push you may not send stays owed: queue it with `abcd mode queue \"<step>\"` for the person and take another item meanwhile."
 }
 
-// describeItem names an owed item in plain words.
+// shellWord is s as one word of a command the reason suggests: as it is when
+// it holds only characters no shell reads specially, else single-quoted
+// (shellquote.Single), so a branch name or record id holding `$(…)`, a
+// backquote or a quote cannot run anything when the suggestion is pasted.
+func shellWord(s string) string {
+	if s != "" && strings.IndexFunc(s, func(r rune) bool {
+		return !(r >= 'a' && r <= 'z' || r >= 'A' && r <= 'Z' || r >= '0' && r <= '9' || strings.ContainsRune("._/-", r))
+	}) < 0 {
+		return s
+	}
+	return shellquote.Single(s)
+}
+
+// describeItem names an owed item in plain words: the reader's reason when it
+// wrote one, which already names the item, else words built from its fields.
 func describeItem(i OwedItem) string {
+	if i.Reason != "" {
+		return termsafe.CleanProseLine(i.Reason, 256)
+	}
 	pr := ""
 	if i.PR > 0 {
 		pr = fmt.Sprintf("pull request #%d", i.PR)
@@ -274,9 +301,6 @@ func describeItem(i OwedItem) string {
 	default:
 		s = clean(string(i.Kind)) + " " + clean(i.Branch+i.Record)
 	}
-	if i.Reason != "" {
-		s += " (" + termsafe.CleanProseLine(i.Reason, 256) + ")"
-	}
 	return s
 }
 
diff --git a/internal/core/autonomy/judge_test.go b/internal/core/autonomy/judge_test.go
index bfba02beb2..c8d0fdb38c 100644
--- a/internal/core/autonomy/judge_test.go
+++ b/internal/core/autonomy/judge_test.go
@@ -529,3 +529,63 @@ func TestSessionIDShape(t *testing.T) {
 		t.Errorf("state path %s, want %s", p, want)
 	}
 }
+
+// TestReasonSaysItOnce: an item's words appear once, in the agent's reason,
+// the person's line and the recorded stop alike, with the reader's reason as
+// it writes it.
+func TestReasonSaysItOnce(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	item := OwedItem{Kind: OwedUnpushed, Capped: true, Branch: "feat/x", Head: "cccc", Reason: "branch feat/x has commits not pushed"}
+	owed := owedOf(item)
+	if got, want := presentLine(owed), "abcd: stopped with work owed (1 item); next: branch feat/x has commits not pushed."; got != want {
+		t.Errorf("the person's line:\n got %q\nwant %q", got, want)
+	}
+	v := judgeAt(t, awayRec(now, false), owed, StopInput{}, SessionState{}, now)
+	if want := "abcd: the person is away and work is owed (1 item). Next: branch feat/x has commits not pushed. Do the local work"; !strings.HasPrefix(v.Reason, want) {
+		t.Errorf("the reason:\n got %q\nwant it to begin %q", v.Reason, want)
+	}
+	seen := SessionState{Fingerprint: owed.Fingerprint(), WakeFingerprint: owed.CappedFingerprint(), Blocks: DefaultBlockCap}
+	v = judgeAt(t, awayRec(now, false), owed, StopInput{StopHookActive: true}, seen, now)
+	if v.Stop == nil || v.Stop.Detail != "branch feat/x has commits not pushed" {
+		t.Errorf("the recorded stop: %+v", v.Stop)
+	}
+}
+
+// TestSuggestedQueueCommandQuotesBranch: a branch name holding `$(…)`, a
+// backquote or a single quote, all legal in a refname, reaches the suggested
+// `abcd mode queue` command as one single-quoted shell word.
+func TestSuggestedQueueCommandQuotesBranch(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	for branch, want := range map[string]string{
+		"feat/x":                   "`abcd mode queue 'push feat/x'`",
+		"feat/$(touch${IFS}pwned)": "`abcd mode queue 'push feat/$(touch${IFS}pwned)'`",
+		"feat/`id`":                "`abcd mode queue 'push feat/`id`'`",
+		"feat/it's":                `abcd mode queue 'push feat/it'\''s'`,
+	} {
+		item := OwedItem{Kind: OwedUnpushed, Capped: true, Branch: branch, Head: "cccc"}
+		v := judgeAt(t, awayRec(now, true), owedOf(item), StopInput{}, SessionState{}, now)
+		if !strings.Contains(v.Reason, want) {
+			t.Errorf("branch %q: the reason lacks %s:\n%s", branch, want, v.Reason)
+		}
+	}
+}
+
+// TestRowOnePastCapRecordsStop: a question blocked once more past the cap
+// records the stop: work owed when anything is, else no next look.
+func TestRowOnePastCapRecordsStop(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	rec := awayRec(now, false)
+	for _, c := range []struct {
+		owed Owed
+		kind StopKind
+	}{{owedOf(behindPR), StopWorkOwed}, {Owed{}, StopNoNextLook}} {
+		st := SessionState{Fingerprint: c.owed.Fingerprint(), WakeFingerprint: c.owed.CappedFingerprint(), Blocks: DefaultBlockCap}
+		v := judgeAt(t, rec, c.owed, StopInput{StopHookActive: true, LastAssistantMessage: "Shall I merge it?"}, st, now)
+		if v.Row != 1 || !v.Block {
+			t.Fatalf("row %d block %v, want row 1 blocked", v.Row, v.Block)
+		}
+		if v.Stop == nil || v.Stop.Kind != c.kind || !v.Stop.PossiblyForcedByCap || v.State.State != StateStopped {
+			t.Errorf("row 1 past the cap with %d owed: stop %+v state %q, want %s", len(c.owed.Items), v.Stop, v.State.State, c.kind)
+		}
+	}
+}
diff --git a/internal/core/autonomy/owedread.go b/internal/core/autonomy/owedread.go
index e2e49738b1..228be2b59b 100644
--- a/internal/core/autonomy/owedread.go
+++ b/internal/core/autonomy/owedread.go
@@ -650,7 +650,7 @@ func (r *owedReader) branchItems() {
 		}
 		if b != nil && r.unpushed(b) {
 			r.add(OwedItem{Kind: OwedUnpushed, Capped: true, Branch: name, Head: head,
-				Reason: fmt.Sprintf("%s has commits not pushed", name)})
+				Reason: fmt.Sprintf("branch %s has commits not pushed", name)})
 		}
 	}
 }
@@ -873,7 +873,7 @@ func (r *owedReader) reservationItems() {
 		if !r.now.Before(half) {
 			r.add(OwedItem{Kind: OwedRenewal, Record: res.Record,
 				Reason: fmt.Sprintf("the reservation of %s is due for renewal (it lapses %s): renew it with `abcd reserve %s`",
-					res.Record, showTime(res.EffectiveExpiry), res.Record)})
+					res.Record, showTime(res.EffectiveExpiry), shellWord(res.Record))})
 		}
 		if !r.away || !r.list.read || strings.HasPrefix(res.Record, "rel-") {
 			continue

From 060d253352ea74c52c1497b034a91875d0c6f932 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 14:21:33 +0100
Subject: [PATCH 36/58] fix: block a stop with the host's Stop feedback, not a
 hook error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The host shows {"decision":"block"} as "Stop hook error occurred" on the
first block of each turn. Its hooks reference ("Stop decision control")
documents hookSpecificOutput.additionalContext as non-error feedback that
keeps the conversation going under the same loop protections, the
stop_hook_active input and the continuation cap, and recommends it for a
hook working as designed. A block is now
{"hookSpecificOutput":{"hookEventName":"Stop","additionalContext":…}}.
The verbs' help says they act only in a checkout abcd manages.

Assisted-by: Claude:claude-opus-5-5
---
 internal/surface/cli/hook_stop.go      | 27 +++++++++++++----
 internal/surface/cli/hook_stop_test.go | 40 ++++++++++++++++++++++++--
 2 files changed, 58 insertions(+), 9 deletions(-)

diff --git a/internal/surface/cli/hook_stop.go b/internal/surface/cli/hook_stop.go
index 5fd83c2875..4b6a426fc8 100644
--- a/internal/surface/cli/hook_stop.go
+++ b/internal/surface/cli/hook_stop.go
@@ -93,7 +93,9 @@ before the deadline: within half an hour while work is owed (an hour when
 none is) and before the session's reservations need renewing. A wake
 releases an unchanged set of work the session can do itself at most twice
 in a row, and a last message ending on a question is blocked once. Plain
-stdout is then {"decision":"block","reason":...}; the block passing the
+stdout is then the host's non-error Stop feedback,
+{"hookSpecificOutput":{"hookEventName":"Stop","additionalContext":...}},
+which continues the session as a block does; the block passing the
 host's cap of consecutive continuations (eight, or
 CLAUDE_CODE_STOP_HOOK_BLOCK_CAP) is recorded in the away record as a stop
 possibly forced by the cap. While the person is present the check reads disk
@@ -102,7 +104,9 @@ only and, with work owed, allows the stop with a systemMessage naming it.
 The session's state is kept per session id in its start copy's local tier,
 .abcd/.work.local/autonomy/sessions/<session-id>.json. A malformed payload,
 an unreadable record or a lock not had allows the stop, naming why on
-stderr; every outcome exits 0.`,
+stderr; every outcome exits 0. Outside a checkout abcd manages (no .abcd/
+at its root, nor at its main worktree's) it reads nothing and prints
+nothing.`,
 		Args: cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, _ []string) error {
 			p, err := readStopPayload(cmd)
@@ -187,9 +191,19 @@ func stopBlockCap(stderr io.Writer) int {
 	return n
 }
 
+// stopBlockOutput is a block written as the host's non-error feedback for a
+// Stop hook: hookSpecificOutput.additionalContext keeps the session going
+// under the same loop protections as {"decision":"block"} (stop_hook_active
+// and the continuation cap), and the host labels it "Stop hook feedback"
+// rather than showing a hook error, its documented form for a hook working as
+// designed (code.claude.com/docs/en/hooks, "Stop decision control").
 type stopBlockOutput struct {
-	Decision string `json:"decision"`
-	Reason   string `json:"reason"`
+	HookSpecificOutput stopBlockFields `json:"hookSpecificOutput"`
+}
+
+type stopBlockFields struct {
+	HookEventName     string `json:"hookEventName"`
+	AdditionalContext string `json:"additionalContext"`
 }
 
 type stopMessageOutput struct {
@@ -202,7 +216,7 @@ func emitStop(cmd *cobra.Command, v autonomy.Verdict) error {
 	var obj any
 	switch {
 	case v.Block:
-		obj = stopBlockOutput{Decision: "block", Reason: v.Reason}
+		obj = stopBlockOutput{HookSpecificOutput: stopBlockFields{HookEventName: "Stop", AdditionalContext: v.Reason}}
 	case v.SystemMessage != "":
 		obj = stopMessageOutput{SystemMessage: termsafe.CleanProseLine(v.SystemMessage, 1024)}
 	default:
@@ -232,7 +246,8 @@ func newHookStopFailureCommand() *cobra.Command {
 host ended on an API error is recorded in it as "stopped on an API error"
 with the error type, under the store's lock; abcd mode back prints it. The
 host ignores this hook's output and it cannot continue the session. While
-the person is present nothing is written. Every outcome exits 0.`,
+the person is present, or outside a checkout abcd manages, nothing is
+written. Every outcome exits 0.`,
 		Args: cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, _ []string) error {
 			p, err := readStopPayload(cmd)
diff --git a/internal/surface/cli/hook_stop_test.go b/internal/surface/cli/hook_stop_test.go
index a90932a265..f4330bde05 100644
--- a/internal/surface/cli/hook_stop_test.go
+++ b/internal/surface/cli/hook_stop_test.go
@@ -47,10 +47,20 @@ func stopHookPayload(t *testing.T, session, cwd string, active bool, last string
 	return string(b)
 }
 
+// stopOut is the Stop hook's answer as the host reads it. A block is the
+// host's non-error feedback, hookSpecificOutput.additionalContext, which
+// keeps the session going under the same loop protections as a decision
+// block without the "Stop hook error" notice; Decision and Reason are filled
+// from it, and Raw keeps what was printed.
 type stopOut struct {
-	Decision      string `json:"decision"`
-	Reason        string `json:"reason"`
-	SystemMessage string `json:"systemMessage"`
+	Decision           string `json:"decision"`
+	Reason             string `json:"reason"`
+	SystemMessage      string `json:"systemMessage"`
+	HookSpecificOutput struct {
+		HookEventName     string `json:"hookEventName"`
+		AdditionalContext string `json:"additionalContext"`
+	} `json:"hookSpecificOutput"`
+	Raw map[string]any `json:"-"`
 }
 
 func runStop(t *testing.T, payload string) (stopOut, string, string) {
@@ -64,6 +74,10 @@ func runStop(t *testing.T, payload string) (stopOut, string, string) {
 		if err := json.Unmarshal([]byte(so), &out); err != nil {
 			t.Fatalf("hook stop stdout is not one object: %v\n%s", err, so)
 		}
+		_ = json.Unmarshal([]byte(so), &out.Raw)
+		if c := out.HookSpecificOutput.AdditionalContext; c != "" && out.HookSpecificOutput.HookEventName == "Stop" {
+			out.Decision, out.Reason = "block", c
+		}
 	}
 	return out, so, se
 }
@@ -360,3 +374,23 @@ func TestHookStopUnmanagedRepoSilent(t *testing.T) {
 		}
 	})
 }
+
+// TestHookStopBlockIsFeedback: a block is written as the host's non-error
+// feedback, {"hookSpecificOutput":{"hookEventName":"Stop","additionalContext":…}},
+// never as {"decision":"block"}, which the host shows as a hook error.
+func TestHookStopBlockIsFeedback(t *testing.T) {
+	root := awayCheckout(t)
+	setAway(t)
+	owed := autonomy.Owed{Items: []autonomy.OwedItem{behindItem}}
+	fakeOwed(t, &owed)
+	out, so, _ := runStop(t, stopHookPayload(t, "fb-1", root, false, "Done."))
+	if _, ok := out.Raw["decision"]; ok {
+		t.Errorf("a block is written as a decision, which the host shows as an error: %s", so)
+	}
+	if out.HookSpecificOutput.HookEventName != "Stop" || !strings.Contains(out.HookSpecificOutput.AdditionalContext, "feat/behind") {
+		t.Errorf("a block is the Stop hook's additionalContext naming the item: %s", so)
+	}
+	if len(out.Raw) != 1 {
+		t.Errorf("a block carries only hookSpecificOutput: %s", so)
+	}
+}

From e1d64652a50915d1c3de31db080823016934958e Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 14:24:22 +0100
Subject: [PATCH 37/58] fix: leave an unmanaged repository alone in the branch
 recorder too

The created-branch recorder resolved the session's copy, a full-history
root-commit read, before finding the checkout unmanaged. The managed
question moves into autonomy.Managed (`.abcd/` at the checkout's root, or
at its main worktree's for a linked worktree), and the recorder asks it
first, so outside a managed checkout every hook path of the away mode
prints nothing, writes nothing and runs no git past naming the roots.
The recorder's own check follows the same rule rather than the local
tier, which a fresh worktree of a managed repository lacks.

Assisted-by: Claude:claude-opus-5-5
---
 internal/core/autonomy/branches.go         | 11 +--
 internal/core/autonomy/verbs.go            | 24 +++++-
 internal/surface/cli/guard_branches.go     | 19 +++--
 internal/surface/cli/hook_away.go          | 25 +-----
 internal/surface/cli/hook_stop_e2e_test.go |  4 +-
 internal/surface/cli/hook_stop_test.go     | 91 ++++++++++++++++++++++
 6 files changed, 131 insertions(+), 43 deletions(-)

diff --git a/internal/core/autonomy/branches.go b/internal/core/autonomy/branches.go
index dd036d4b32..03ffc5eae7 100644
--- a/internal/core/autonomy/branches.go
+++ b/internal/core/autonomy/branches.go
@@ -5,12 +5,9 @@ import (
 	"errors"
 	"fmt"
 	"io/fs"
-	"os"
-	"path/filepath"
 	"time"
 
 	"github.com/intentdriven/abcd/internal/core/claim"
-	"github.com/intentdriven/abcd/internal/core/mode"
 	"github.com/intentdriven/abcd/internal/gitutil"
 )
 
@@ -144,15 +141,15 @@ func applyBranchChanges(list []CreatedBranch, changes []BranchChange, now time.T
 // names nothing git can resolve) and records what passes under the copy's key
 // (claim.CopyKey, minted as a reservation verb mints it) in the away store.
 // copyRoot is the session's working copy; runDir is where the command runs,
-// whose current branch a rename with no old name renames. A checkout without
-// the local tier, or with no root commit, records nothing and is no error:
-// abcd does not manage it. The error is a store the recorder could not write;
+// whose current branch a rename with no old name renames. A checkout
+// abcd does not manage (Managed), or with no root commit, records nothing and
+// is no error. The error is a store the recorder could not write;
 // it never refuses the command.
 func RecordCreated(copyRoot, runDir string, changes []BranchChange, o Options) error {
 	if len(changes) == 0 {
 		return nil
 	}
-	if fi, err := os.Lstat(filepath.Join(copyRoot, filepath.FromSlash(mode.TierRelPath))); err != nil || !fi.IsDir() {
+	if !Managed(copyRoot) {
 		return nil
 	}
 	home, err := o.home()
diff --git a/internal/core/autonomy/verbs.go b/internal/core/autonomy/verbs.go
index 1a911b56e0..a2d451d727 100644
--- a/internal/core/autonomy/verbs.go
+++ b/internal/core/autonomy/verbs.go
@@ -91,13 +91,31 @@ func Resolve(cwd string, o Options) (root string, st Store, err error) {
 }
 
 // Managed reports whether abcd manages the checkout at root: `.abcd/` is a
-// directory at its root (a symbolic link is not). The away mode's hooks act
-// only in such a checkout, so a plugin installed for every repository reads
-// nothing, runs no git past naming the root, and says nothing in any other.
+// directory at its root (a symbolic link is not), or root is a linked
+// worktree of a repository whose main worktree has one. A worktree a session
+// makes shares the repository's away store, and a branch cut before `.abcd/`
+// was committed, or a `.abcd/` never committed, leaves it out of the
+// worktree. The away mode's hooks and recorder act only in such a checkout,
+// so a plugin installed for every repository reads nothing, writes nothing,
+// runs no git past naming the roots, and says nothing in any other.
 func Managed(root string) bool {
 	if root == "" {
 		return false
 	}
+	if hasAbcd(root) {
+		return true
+	}
+	if fi, err := os.Lstat(filepath.Join(root, ".git")); err != nil || !fi.Mode().IsRegular() {
+		return false // not a linked worktree: there is no main worktree to ask
+	}
+	common, err := gitutil.RevParseAbsPath(root, "--git-common-dir")
+	if err != nil || filepath.Base(common) != ".git" {
+		return false
+	}
+	return hasAbcd(filepath.Dir(common))
+}
+
+func hasAbcd(root string) bool {
 	fi, err := os.Lstat(filepath.Join(root, ".abcd"))
 	return err == nil && fi.IsDir()
 }
diff --git a/internal/surface/cli/guard_branches.go b/internal/surface/cli/guard_branches.go
index 6a00258419..40fabf3b1e 100644
--- a/internal/surface/cli/guard_branches.go
+++ b/internal/surface/cli/guard_branches.go
@@ -7,23 +7,22 @@ import (
 
 	"github.com/intentdriven/abcd/internal/core/autonomy"
 	"github.com/intentdriven/abcd/internal/core/guard"
-	"github.com/intentdriven/abcd/internal/gitutil"
 )
 
 // awayCopyRoot is the working copy a hook acts for: the session's start copy,
 // as the session-start hook noted it (autonomy.ResolveCopy), else the worktree
-// root of the payload's cwd. The stop check reads the copy's owed work from
-// the same root (spc-2610180914469489, "Which copy"), so a branch a session
-// cuts after changing into a worktree it made is recorded where the check
-// looks.
+// root of the payload's cwd; and nothing at all outside a checkout abcd
+// manages (managedRoot). The stop check reads the copy's owed work from the
+// same root (spc-2610180914469489, "Which copy"), so a branch a session cuts
+// after changing into a worktree it made is recorded where the check looks.
 func awayCopyRoot(cwd, sessionID string) (string, bool) {
-	if root, _, err := autonomy.ResolveCopy(cwd, sessionID, autonomy.Options{}); err == nil {
-		return root, true
-	}
-	root, err := gitutil.CheckoutRoot(cwd, autonomy.StoreName)
-	if err != nil {
+	root, ok := managedRoot(cwd)
+	if !ok {
 		return "", false
 	}
+	if c, _, err := autonomy.ResolveCopy(root, sessionID, autonomy.Options{}); err == nil {
+		return c, true
+	}
 	return root, true
 }
 
diff --git a/internal/surface/cli/hook_away.go b/internal/surface/cli/hook_away.go
index c9afff36fb..d291b915f4 100644
--- a/internal/surface/cli/hook_away.go
+++ b/internal/surface/cli/hook_away.go
@@ -6,7 +6,6 @@ import (
 	"errors"
 	"io"
 	"os"
-	"path/filepath"
 	"strings"
 	"time"
 
@@ -103,31 +102,15 @@ func readAwayFailOpen(stderr io.Writer, cwd string) (*autonomy.Record, bool, boo
 }
 
 // managedRoot is the root of the checkout cwd stands in, and whether abcd
-// manages it (autonomy.Managed): `.abcd/` at its root, or, for a linked
-// worktree, at the root of the repository's main worktree, since a worktree
-// a session makes shares the repository's away store and a branch cut before
-// `.abcd/` was committed (or a `.abcd/` never committed) leaves it out. Every
-// away hook asks it first: outside a managed checkout the hook reads nothing
-// and says nothing, and the git it runs only names the roots.
+// manages it (autonomy.Managed). Every away hook and the branch recorder ask
+// it first: outside a managed checkout they read nothing, write nothing and
+// say nothing, and the git they run only names the roots.
 func managedRoot(cwd string) (string, bool) {
 	if cwd == "" {
 		return "", false
 	}
 	root, err := gitutil.CheckoutRoot(cwd, autonomy.StoreName)
-	if err != nil {
-		return "", false
-	}
-	if autonomy.Managed(root) {
-		return root, true
-	}
-	if fi, err := os.Lstat(filepath.Join(root, ".git")); err != nil || !fi.Mode().IsRegular() {
-		return "", false // not a linked worktree: there is no main worktree to ask
-	}
-	common, err := gitutil.RevParseAbsPath(root, "--git-common-dir")
-	if err != nil || filepath.Base(common) != ".git" {
-		return "", false
-	}
-	if !autonomy.Managed(filepath.Dir(common)) {
+	if err != nil || !autonomy.Managed(root) {
 		return "", false
 	}
 	return root, true
diff --git a/internal/surface/cli/hook_stop_e2e_test.go b/internal/surface/cli/hook_stop_e2e_test.go
index 1a3ca7fbd5..b18045a60e 100644
--- a/internal/surface/cli/hook_stop_e2e_test.go
+++ b/internal/surface/cli/hook_stop_e2e_test.go
@@ -91,8 +91,8 @@ func TestHookStopEndToEndOwnUnpushedBranch(t *testing.T) {
 		if out.Decision == "block" {
 			t.Fatalf("with no away record the stop is allowed, got %s\nstderr: %s", so, se)
 		}
-		if !strings.Contains(out.SystemMessage, "feat/x") {
-			t.Errorf("present, the owed branch is named to the person: got %s", so)
+		if want := "abcd: stopped with work owed (1 item); next: branch feat/x has commits not pushed."; out.SystemMessage != want {
+			t.Errorf("present, the owed branch is named to the person once:\n got %s\nwant %q", so, want)
 		}
 		if calls := ghCalls(t, ghLog); calls != "" {
 			t.Errorf("present, the check reads disk only, but the forge was asked: %q", calls)
diff --git a/internal/surface/cli/hook_stop_test.go b/internal/surface/cli/hook_stop_test.go
index f4330bde05..20f47c4d48 100644
--- a/internal/surface/cli/hook_stop_test.go
+++ b/internal/surface/cli/hook_stop_test.go
@@ -6,6 +6,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -394,3 +395,93 @@ func TestHookStopBlockIsFeedback(t *testing.T) {
 		t.Errorf("a block carries only hookSpecificOutput: %s", so)
 	}
 }
+
+// homeFiles lists every path under dir, relative, for a before-and-after
+// compare.
+func homeFiles(t *testing.T, dir string) []string {
+	t.Helper()
+	var out []string
+	_ = filepath.WalkDir(dir, func(p string, _ os.DirEntry, err error) error {
+		if err == nil && p != dir {
+			rel, _ := filepath.Rel(dir, p)
+			out = append(out, rel)
+		}
+		return nil
+	})
+	return out
+}
+
+// TestAwayHooksLeaveUnmanagedRepoAlone: in a repository abcd does not manage
+// every hook path of the away mode returns at once: the stop check (with the
+// real owed reader), StopFailure and the branch recorder print nothing,
+// create nothing under abcd's home folder, exit 0 and run no git past
+// naming the checkout's root; the session-start and prompt hooks add no away
+// block and create no away store, session note or state file. (The away
+// store has no record here; a record shared with a managed copy is
+// TestHookStopUnmanagedRepoSilent's.)
+func TestAwayHooksLeaveUnmanagedRepoAlone(t *testing.T) {
+	awayCheckout(t) // the sandboxed HOME
+	home := os.Getenv("HOME")
+	repo := unmanagedOwnUnpushed(t)
+	abcdHome := filepath.Join(home, ".abcd.noindex")
+	before := homeFiles(t, abcdHome)
+	log := gitCallLog(t)
+	onlyRoot := func(what string) {
+		t.Helper()
+		for _, line := range strings.Split(strings.TrimSpace(ghCalls(t, log)), "\n") {
+			if line != "" && line != "version" && !strings.Contains(line, "rev-parse --show-toplevel") {
+				t.Errorf("%s ran git past naming the root: %q", what, line)
+			}
+		}
+		if err := os.WriteFile(log, nil, 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	so, se, err := runSplit(t, stopHookPayload(t, "un-1", repo, false, "Done."), "hook", "stop")
+	if err != nil || so != "" {
+		t.Errorf("stop: err %v stdout %q stderr %q", err, so, se)
+	}
+	onlyRoot("stop")
+	fail := `{"session_id":"un-1","cwd":"` + repo + `","hook_event_name":"StopFailure","error":"rate_limit"}`
+	if so, se, err := runSplit(t, fail, "hook", "stop-failure"); err != nil || so != "" {
+		t.Errorf("stop-failure: err %v stdout %q stderr %q", err, so, se)
+	}
+	onlyRoot("stop-failure")
+	baseline := func(command string) string {
+		t.Helper()
+		so, se, code := runGuard(preToolUse(t, "Bash", command, repo), "guard", "hook")
+		if code != 0 || strings.Contains(so, "deny") {
+			t.Fatalf("guard hook on %q: code %d stdout %q stderr %q", command, code, so, se)
+		}
+		return ghCalls(t, log)
+	}
+	// The guard's own reading of a command is not the recorder's: a command
+	// with no branch act sets the baseline the branch acts must not exceed.
+	_ = os.WriteFile(log, nil, 0o600)
+	plain := baseline("git status --porcelain")
+	for _, c := range []string{"git switch -c feat/new", "git worktree add -b feat/wt ../wt", "git checkout -b feat/co"} {
+		_ = os.WriteFile(log, nil, 0o600)
+		got := baseline(c)
+		for _, line := range strings.Split(strings.TrimSpace(got), "\n") {
+			if line != "" && line != "version" && !strings.Contains(line, "rev-parse --show-toplevel") && !strings.Contains(plain, line) {
+				t.Errorf("the recorder ran git for %q in an unmanaged checkout: %q", c, line)
+			}
+		}
+	}
+	if after := homeFiles(t, abcdHome); !slices.Equal(before, after) {
+		t.Errorf("abcd's home folder changed: before %v after %v", before, after)
+	}
+
+	so, _, _ = runSplit(t, awayStartPayload("un-1", repo, "startup"), "hook", "session-start")
+	so2, _, _ := runSplit(t, awayPromptPayload("un-1", repo, "hello"), "hook", "prompt-router")
+	if strings.Contains(so+so2, "AWAY") || strings.Contains(so2, "away until") {
+		t.Errorf("an unmanaged checkout got the away block or line:\n%s\n%s", so, so2)
+	}
+	if _, err := os.Stat(filepath.Join(abcdHome, autonomy.StoreDir)); err == nil {
+		t.Errorf("an unmanaged checkout created the away store")
+	}
+	if _, err := os.Stat(filepath.Join(repo, ".abcd")); err == nil {
+		t.Errorf("an unmanaged checkout gained a .abcd/ folder")
+	}
+}

From 61f1e0e40af8a6e399a768cd2060d3cbda80d408 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 14:24:58 +0100
Subject: [PATCH 38/58] fix: allow the stop when the stop check panics

A panic in `abcd hook stop` exited 2, which the host reads as a block on
the Stop event. Both stop hooks now recover: Stop allows the stop with a
stderr line naming the failure, and StopFailure records nothing and
says so.

Assisted-by: Claude:claude-opus-5-5
---
 internal/surface/cli/hook_stop.go      | 17 +++++++++++++++--
 internal/surface/cli/hook_stop_test.go | 24 ++++++++++++++++++++++++
 2 files changed, 39 insertions(+), 2 deletions(-)

diff --git a/internal/surface/cli/hook_stop.go b/internal/surface/cli/hook_stop.go
index 4b6a426fc8..3d2665ce49 100644
--- a/internal/surface/cli/hook_stop.go
+++ b/internal/surface/cli/hook_stop.go
@@ -108,7 +108,14 @@ stderr; every outcome exits 0. Outside a checkout abcd manages (no .abcd/
 at its root, nor at its main worktree's) it reads nothing and prints
 nothing.`,
 		Args: cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, _ []string) error {
+		RunE: func(cmd *cobra.Command, _ []string) (ret error) {
+			// A panic allows the stop: exit 2 is the host's block on this
+			// event, and a stop is never blocked on abcd's own fault.
+			defer func() {
+				if r := recover(); r != nil {
+					ret = stopAllow(cmd, "the stop check failed (%s)", termsafe.CleanProseLine(fsutil.RedactHome(fmt.Sprint(r)), 256))
+				}
+			}()
 			p, err := readStopPayload(cmd)
 			if err != nil {
 				return stopAllow(cmd, "unreadable Stop payload (%s)", termsafe.Sanitize(err.Error()))
@@ -249,7 +256,13 @@ host ignores this hook's output and it cannot continue the session. While
 the person is present, or outside a checkout abcd manages, nothing is
 written. Every outcome exits 0.`,
 		Args: cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, _ []string) error {
+		RunE: func(cmd *cobra.Command, _ []string) (ret error) {
+			defer func() {
+				if r := recover(); r != nil {
+					diagnosticLine(cmd.ErrOrStderr(), "abcd stop: the API-error stop was not recorded (%s)", termsafe.CleanProseLine(fsutil.RedactHome(fmt.Sprint(r)), 256))
+					ret = nil
+				}
+			}()
 			p, err := readStopPayload(cmd)
 			if err != nil {
 				diagnosticLine(cmd.ErrOrStderr(), "abcd stop: unreadable StopFailure payload (%s); nothing recorded", termsafe.Sanitize(err.Error()))
diff --git a/internal/surface/cli/hook_stop_test.go b/internal/surface/cli/hook_stop_test.go
index 20f47c4d48..395ba74caf 100644
--- a/internal/surface/cli/hook_stop_test.go
+++ b/internal/surface/cli/hook_stop_test.go
@@ -485,3 +485,27 @@ func TestAwayHooksLeaveUnmanagedRepoAlone(t *testing.T) {
 		t.Errorf("an unmanaged checkout gained a .abcd/ folder")
 	}
 }
+
+// TestHookStopPanicAllows: a panic inside the stop check allows the stop,
+// exits 0 and names it on stderr; it never reaches the host as exit 2, which
+// a Stop hook reads as a block.
+func TestHookStopPanicAllows(t *testing.T) {
+	root := awayCheckout(t)
+	setAway(t)
+	prev := stopOwedReader
+	stopOwedReader = func(context.Context, autonomy.ReadOptions) (autonomy.Owed, error) { panic("boom") }
+	t.Cleanup(func() { stopOwedReader = prev })
+	var so, se string
+	var err error
+	func() {
+		defer func() {
+			if r := recover(); r != nil {
+				t.Fatalf("the panic escaped the hook: %v", r)
+			}
+		}()
+		so, se, err = runSplit(t, stopHookPayload(t, "p-1", root, false, "Done."), "hook", "stop")
+	}()
+	if err != nil || so != "" || !strings.Contains(se, "allowed") || !strings.Contains(se, "boom") {
+		t.Errorf("a panic: err %v stdout %q stderr %q", err, so, se)
+	}
+}

From e101881f24ad94e4cb531efb5b4a3d2d770a23d1 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 14:31:15 +0100
Subject: [PATCH 39/58] fix: let the person end the away mode whatever state
 its record is in

A record filled by about 200 alternating stops, or 95 long queued
steps, made `abcd mode back` fail with "would hold 65690 bytes", so the
mode could not be ended for up to seven days. Now:
- AddStop collapses an identical stop anywhere in the list, and past its
  own bound lets the stop seen least recently go, counted; hand-backs
  rotate the same way; a queue past its bound refuses the next step
  (ErrQueueFull) and never cuts what the person will read.
- Back prints every line it can read, then closes and fits the record.
  A record that does not parse, names another schema or is not safely
  this account's is replaced by a closed record, printing nothing from
  it; parts of the wrong shape are left out; a lock not had in time, or
  not safe to take, is gone around and the write re-checked. Each is
  named in a note, printed and in the --json envelope.
- Begin carries a record past its bound, fitted and counted.

Assisted-by: Claude:claude-opus-5-5
---
 docs/reference/cli/commands.md             |  13 +-
 internal/core/autonomy/doc.go              |  23 ++-
 internal/core/autonomy/end.go              | 171 +++++++++++++++++
 internal/core/autonomy/record.go           | 112 ++++++++++-
 internal/core/autonomy/record_full_test.go | 211 +++++++++++++++++++++
 internal/core/autonomy/record_test.go      |   6 +-
 internal/core/autonomy/store.go            |   7 +-
 internal/core/autonomy/store_test.go       |  11 +-
 internal/core/autonomy/verbs.go            |  36 ++--
 internal/surface/cli/mode_away.go          |  24 ++-
 internal/surface/cli/mode_away_test.go     |  21 ++
 11 files changed, 591 insertions(+), 44 deletions(-)
 create mode 100644 internal/core/autonomy/end.go
 create mode 100644 internal/core/autonomy/record_full_test.go

diff --git a/docs/reference/cli/commands.md b/docs/reference/cli/commands.md
index 7e3ecba157..c4bba6c0ec 100644
--- a/docs/reference/cli/commands.md
+++ b/docs/reference/cli/commands.md
@@ -4104,9 +4104,12 @@ the cap"), record who ended it and from which working copy, and close the record
 On a record whose time has already passed it prints the same and closes it. With
 no record, or one already closed, it says there is nothing to end.
 
-A session runs it only on the person's word in that session. Exit 2 when the
-record or its lock is not safely this account's, naming the file, with nothing
-written. No network request.
+A session runs it only on the person's word in that session. It ends the mode
+whatever state the record is in: one past its 64 KiB is printed whole and kept
+with its oldest lines let go and counted; one that does not parse, or is not
+safely this account's, is replaced by a closed record, printing nothing from
+it; and a lock not had in time is gone around. Each is named on its own line.
+No network request.
 
 #### `abcd mode queue`
 
@@ -4119,8 +4122,8 @@ the person may approve, which a session queues instead of asking, then carries o
 with other work. `abcd mode back` prints each queued step on one line.
 
 Exit 2 when no away record holds (ask the person instead), on an empty step or one
-over 500 characters, and when the record or its lock is not safely this account's,
-with nothing written. No network request.
+over 500 characters, when the queue is full (it is never cut), and when the record
+or its lock is not safely this account's, with nothing written. No network request.
 
 **Example:**
 
diff --git a/internal/core/autonomy/doc.go b/internal/core/autonomy/doc.go
index 80a5a2db81..5c3dc67640 100644
--- a/internal/core/autonomy/doc.go
+++ b/internal/core/autonomy/doc.go
@@ -40,7 +40,13 @@
 //
 // Store.Away is the hooks' read: an unreadable or unsafe record (or lock)
 // reads as not away, with the reason returned for a stderr line. A verb asked
-// to change such a record refuses, naming the file.
+// to change such a record refuses, naming the file, except Back: ending the
+// mode never depends on the record (end.go). A record past its bound is
+// printed whole and kept fitted (Record.Fit); one that does not parse, names
+// another schema or is not safely this account's is replaced by a closed
+// record, printing nothing from it; parts of the wrong shape are left out;
+// and a lock not had within LockTimeout, or not safe to take, is gone
+// around, the atomic write re-checked. BackResult.Notes names each.
 //
 // # Record
 //
@@ -57,8 +63,14 @@
 //	queue           []QueuedStep: steps for the person (`abcd mode queue`)
 //	handed_back     []HandBack: items the stop check handed back, by branch
 //	                and head, once each
-//	stops           []Stop: the stops recorded, a stop identical to the last
-//	                kept as that entry with a count and the last time
+//	stops           []Stop: the stops recorded, a stop identical to one
+//	                already recorded, anywhere, kept as that entry with a
+//	                count and the last time
+//	dropped_*       what was let go to stay within MaxFileBytes, counted:
+//	                the oldest stops and hand-backs past their own bounds,
+//	                and queued steps only when Begin carries, or Back
+//	                closes, a record past its bound; a queue past its bound
+//	                refuses the next step (ErrQueueFull) instead
 //	closed          *Closing: once ended by word, who ended it and from
 //	                which copy
 //
@@ -108,8 +120,9 @@
 // is CreatedFile(copyKey) in the away store, keyed on the working copy's
 // reservation copy key (claim.CopyKey), written under the store's lock
 // (Store.RecordBranches) and capped at MaxCreatedBranches, the oldest
-// dropped; Store.CreatedBranches reads it. A checkout without the local tier
-// records nothing.
+// dropped; Store.CreatedBranches reads it. A checkout abcd does not manage
+// (Managed: no `.abcd/` at its root, nor at its main worktree's) records
+// nothing, and every away hook returns at once there.
 //
 // # Reading the owed work
 //
diff --git a/internal/core/autonomy/end.go b/internal/core/autonomy/end.go
new file mode 100644
index 0000000000..98d8e991d2
--- /dev/null
+++ b/internal/core/autonomy/end.go
@@ -0,0 +1,171 @@
+package autonomy
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"time"
+
+	"github.com/intentdriven/abcd/internal/fsutil"
+)
+
+// end.go — ending the away mode whatever state its record is in (the diff
+// review's major 3, spc-2610180914469489 "Diff review round 1"): a record
+// past its bound, partly or wholly unparsable, not safely this account's, or
+// behind a lock held past its timeout never keeps the person from ending
+// the mode. Setting the mode again carries a record past its bound too.
+
+// lenientCap bounds the lenient read: far past MaxFileBytes, so a record a
+// harness or an older build left over its bound is still read and closed.
+const lenientCap = 4 << 20
+
+// lenientRead is the record as far as it could be read, and notes saying
+// what could not.
+type lenientRead struct {
+	rec *Record
+	// unreadable is a file that stands there but yielded no record to trust:
+	// it does not parse, names another schema, is past lenientCap, or is not
+	// safely this account's. Nothing from it is printed.
+	unreadable bool
+	// partial is a record that parsed with parts of it of the wrong shape,
+	// which were left out.
+	partial bool
+	notes   []string
+}
+
+// readLenient reads the record as Back needs it: whatever can be trusted,
+// with a note for everything else. Only an absent record reads as none.
+func (s Store) readLenient() lenientRead {
+	name := s.Display(RecordFile)
+	raw, refusal, err := fsutil.ReadHomeDeclaration(s.home, s.Rel()+"/"+RecordFile, lenientCap)
+	switch {
+	case refusal == fsutil.DeclarationAbsent && errors.Is(err, fs.ErrNotExist):
+		return lenientRead{}
+	case refusal == fsutil.DeclarationOK:
+	case refusal == fsutil.DeclarationAbsent || refusal == fsutil.DeclarationUnreadable:
+		return lenientRead{unreadable: true, notes: []string{fmt.Sprintf("%s could not be read (%s), so nothing from it is printed", name, refusalWords(refusal, err))}}
+	default:
+		return lenientRead{unreadable: true, notes: []string{fmt.Sprintf("%s is not safely this account's (it %s), so nothing from it is printed", name, refusalWords(refusal, err))}}
+	}
+	var r Record
+	err = json.Unmarshal(raw, &r)
+	var typeErr *json.UnmarshalTypeError
+	out := lenientRead{rec: &r}
+	switch {
+	case errors.As(err, &typeErr):
+		out.partial = true
+		out.notes = append(out.notes, fmt.Sprintf("parts of %s could not be read (the field %q is not of its shape) and are left out", name, typeErr.Field))
+	case err != nil:
+		return lenientRead{unreadable: true, notes: []string{fmt.Sprintf("%s could not be read (it does not parse), so nothing from it is printed", name)}}
+	}
+	if r.SchemaVersion != SchemaVersion {
+		return lenientRead{unreadable: true, notes: []string{fmt.Sprintf("%s could not be read (schema_version %d, this abcd reads %d), so nothing from it is printed", name, r.SchemaVersion, SchemaVersion)}}
+	}
+	if len(raw) > MaxFileBytes {
+		out.notes = append(out.notes, fmt.Sprintf("%s held %d bytes, past its %d KiB; every line is printed, and the oldest are let go from the record kept", name, len(raw), MaxFileBytes>>10))
+	}
+	return out
+}
+
+// closedStub is the least closed record that ends the mode: prev's who,
+// from where and window when prev is known, and the closing.
+func closedStub(prev *Record, who Who, now time.Time) *Record {
+	r := &Record{SchemaVersion: SchemaVersion, Start: now.Truncate(time.Second), Until: now.Truncate(time.Second)}
+	if prev != nil {
+		r.SetBy, r.SetFrom, r.Start, r.Until, r.OpenEnded, r.HoldPushes = prev.SetBy, prev.SetFrom, prev.Start, prev.Until, prev.OpenEnded, prev.HoldPushes
+	}
+	r.Close(who, now)
+	return r
+}
+
+func (s Store) writeRecord(r *Record) error {
+	raw, err := json.MarshalIndent(r, "", "  ")
+	if err != nil {
+		return err
+	}
+	return s.WriteFile(RecordFile, append(raw, '\n'))
+}
+
+// endRecord is Back's work on the record, under the lock or, when the lock
+// cannot be had, without it: it prints what can be read, closes, fits and
+// writes; a record it cannot write whole, or cannot read at all, is replaced
+// by a closed stub.
+func (s Store) endRecord(res *BackResult, who Who, now time.Time) (*Record, error) {
+	lr := s.readLenient()
+	res.Notes = append(res.Notes, lr.notes...)
+	if lr.unreadable {
+		res.State = "unreadable"
+		stub := closedStub(nil, who, now)
+		if err := s.writeRecord(stub); err != nil {
+			return nil, err
+		}
+		res.Notes = append(res.Notes, "it was replaced with a closed record")
+		return stub, nil
+	}
+	cur := lr.rec
+	if cur == nil || cur.Closed != nil {
+		res.State = "none"
+		return cur, nil
+	}
+	res.State = "lapsed"
+	if cur.Holds(now) {
+		res.State = "away"
+	}
+	res.Lines = cur.Lines()
+	cur.Close(who, now)
+	cur.Fit()
+	if err := s.writeRecord(cur); err != nil {
+		stub := closedStub(cur, who, now)
+		if err2 := s.writeRecord(stub); err2 != nil {
+			return nil, err
+		}
+		res.Notes = append(res.Notes, fmt.Sprintf("the closed record could not be written whole (%s); a closed record without its lines was written instead", err))
+		return stub, nil
+	}
+	return cur, nil
+}
+
+// endUnlocked is endRecord for a lock that could not be had: the write is
+// atomic, and a writer that held the lock and wrote after it is caught by
+// re-reading and closing again, a few times.
+func (s Store) endUnlocked(res *BackResult, who Who, now time.Time) (*Record, error) {
+	var rec *Record
+	var err error
+	for try := 0; try < 3; try++ {
+		*res = BackResult{State: res.State, Lines: res.Lines, Notes: res.Notes}
+		if try > 0 {
+			time.Sleep(100 * time.Millisecond)
+		}
+		first := try == 0
+		var r BackResult
+		rec, err = s.endRecord(&r, who, now)
+		if err != nil {
+			return nil, err
+		}
+		if first {
+			*res = BackResult{State: r.State, Lines: r.Lines, Notes: append(res.Notes, r.Notes...)}
+		}
+		time.Sleep(50 * time.Millisecond)
+		if again := s.readLenient(); again.unreadable || again.rec == nil || again.rec.Closed != nil {
+			return rec, nil
+		}
+	}
+	return rec, nil
+}
+
+// carryRead is SetAway's read under the lock: a record past its bound is
+// carried (Begin fits it); one that is unreadable, partial or not safely
+// this account's is refused, naming the file, for `abcd mode back` to end.
+func (s Store) carryRead() (*Record, error) {
+	lr := s.readLenient()
+	if lr.unreadable || lr.partial {
+		return nil, fmt.Errorf("%w: %s; `abcd mode back` ends it", ErrUnsafe, lr.notes[0])
+	}
+	if lr.rec != nil {
+		if err := s.vetLock(); err != nil {
+			return nil, err
+		}
+	}
+	return lr.rec, nil
+}
diff --git a/internal/core/autonomy/record.go b/internal/core/autonomy/record.go
index caad79823c..a05cbeb59d 100644
--- a/internal/core/autonomy/record.go
+++ b/internal/core/autonomy/record.go
@@ -1,6 +1,7 @@
 package autonomy
 
 import (
+	"encoding/json"
 	"errors"
 	"fmt"
 	"regexp"
@@ -40,6 +41,8 @@ var (
 	ErrStepEmpty = errors.New("autonomy: the step is empty")
 	// ErrStepTooLong is a queued step past MaxStepLen.
 	ErrStepTooLong = errors.New("autonomy: the step is too long")
+	// ErrQueueFull is a step the queue has no room for.
+	ErrQueueFull = errors.New("autonomy: the queue is full")
 )
 
 // Who names a person acting on the record and the working copy they act from
@@ -62,6 +65,13 @@ type Record struct {
 	HandedBack    []HandBack   `json:"handed_back"`
 	Stops         []Stop       `json:"stops"`
 	Closed        *Closing     `json:"closed,omitempty"`
+	// DroppedStops, DroppedHandBacks and DroppedSteps count what was let go
+	// to keep the record within MaxFileBytes: the oldest stops (by their
+	// counts) and hand-backs as new ones arrive, and, only when a record
+	// past its bound is carried or closed, the oldest queued steps.
+	DroppedStops     int `json:"dropped_stops,omitempty"`
+	DroppedHandBacks int `json:"dropped_handed_back,omitempty"`
+	DroppedSteps     int `json:"dropped_queue,omitempty"`
 }
 
 // QueuedStep is one step queued for the person's return.
@@ -142,10 +152,70 @@ func Begin(prev *Record, who Who, now, until time.Time, holdPushes bool) (*Recor
 		r.Queue = append(r.Queue, prev.Queue...)
 		r.HandedBack = append(r.HandedBack, prev.HandedBack...)
 		r.Stops = append(r.Stops, prev.Stops...)
+		r.DroppedStops, r.DroppedHandBacks, r.DroppedSteps = prev.DroppedStops, prev.DroppedHandBacks, prev.DroppedSteps
 	}
+	r.Fit()
 	return r, nil
 }
 
+// The parts' bounds keep a record within MaxFileBytes in use, each in its
+// JSON form: the queue refuses a step past queueBudget, and the stops and
+// hand-backs let their oldest go past theirs. The rest of the record (who,
+// from where, when) is a few hundred bytes.
+const (
+	queueBudget    = 24 << 10
+	stopsBudget    = 24 << 10
+	handBackBudget = 8 << 10
+	// fitBudget is what Fit leaves a record, under MaxFileBytes with room
+	// for the closing Back adds and the newline the store writes.
+	fitBudget = MaxFileBytes - 1<<10
+)
+
+func jsonLen(v any) int {
+	raw, err := json.MarshalIndent(v, "", "  ")
+	if err != nil {
+		return 0
+	}
+	return len(raw)
+}
+
+// oldestStop is the index of the stop seen least recently.
+func (r *Record) oldestStop() int {
+	o := 0
+	for i, s := range r.Stops {
+		if s.Last.Before(r.Stops[o].Last) {
+			o = i
+		}
+	}
+	return o
+}
+
+func (r *Record) dropStop(i int) {
+	r.DroppedStops += max(r.Stops[i].Count, 1)
+	r.Stops = append(r.Stops[:i:i], r.Stops[i+1:]...)
+}
+
+// Fit lets go of what a record past its bound cannot hold, oldest first and
+// counted: stops, then hand-backs, then queued steps. A record within its
+// bound is unchanged. Begin fits what it carries and Back what it closes, so
+// neither ever fails on size; Back prints every line before it fits.
+func (r *Record) Fit() {
+	for jsonLen(r) > fitBudget {
+		switch {
+		case len(r.Stops) > 0:
+			r.dropStop(r.oldestStop())
+		case len(r.HandedBack) > 0:
+			r.HandedBack = r.HandedBack[1:]
+			r.DroppedHandBacks++
+		case len(r.Queue) > 0:
+			r.Queue = r.Queue[1:]
+			r.DroppedSteps++
+		default:
+			return
+		}
+	}
+}
+
 // Ends is when the record ends: its stored end, but never later than seven
 // days after its start, whatever is stored.
 func (r *Record) Ends() time.Time {
@@ -184,23 +254,33 @@ func (r *Record) AddStep(step, from string, now time.Time) error {
 	if n := utf8.RuneCountInString(step); n > MaxStepLen {
 		return fmt.Errorf("%w: %d characters, at most %d", ErrStepTooLong, n, MaxStepLen)
 	}
-	r.Queue = append(r.Queue, QueuedStep{Step: step, At: now.Truncate(time.Second), From: from})
+	q := append(r.Queue[:len(r.Queue):len(r.Queue)], QueuedStep{Step: step, At: now.Truncate(time.Second), From: from})
+	if jsonLen(q) > queueBudget {
+		return fmt.Errorf("%w: %d steps are queued, as many as the record holds; nothing is dropped, and `abcd mode back` prints them", ErrQueueFull, len(r.Queue))
+	}
+	r.Queue = q
 	return nil
 }
 
-// AddStop records a stop at now. A stop identical to the last one recorded
-// (same kind, error type, detail and cap label) adds to that entry's count and
-// last time instead, so a wake every ten minutes cannot grow the record past
-// its 64 KiB check.
+// AddStop records a stop at now. A stop identical to one already recorded,
+// anywhere in the list (same kind, error type, detail, which names the item,
+// and cap label), adds to that entry's count and last time instead, so two
+// copies blocked on different items, alternating, keep two entries. Past
+// stopsBudget the stop seen least recently goes, counted in DroppedStops.
 func (r *Record) AddStop(s Stop, now time.Time) {
 	now = now.Truncate(time.Second)
-	if n := len(r.Stops); n > 0 && sameStop(r.Stops[n-1], s) {
-		r.Stops[n-1].Count++
-		r.Stops[n-1].Last = now
-		return
+	for i := range r.Stops {
+		if sameStop(r.Stops[i], s) {
+			r.Stops[i].Count++
+			r.Stops[i].Last = now
+			return
+		}
 	}
 	s.Count, s.First, s.Last = 1, now, now
 	r.Stops = append(r.Stops, s)
+	for len(r.Stops) > 1 && jsonLen(r.Stops) > stopsBudget {
+		r.dropStop(r.oldestStop())
+	}
 }
 
 func sameStop(a, b Stop) bool {
@@ -216,6 +296,10 @@ func (r *Record) AddHandBack(branch, head string, now time.Time) bool {
 		}
 	}
 	r.HandedBack = append(r.HandedBack, HandBack{Branch: branch, Head: head, At: now.Truncate(time.Second)})
+	for len(r.HandedBack) > 1 && jsonLen(r.HandedBack) > handBackBudget {
+		r.HandedBack = r.HandedBack[1:]
+		r.DroppedHandBacks++
+	}
 	return true
 }
 
@@ -251,6 +335,16 @@ func (r *Record) Lines() []string {
 	for _, s := range r.Stops {
 		lines = append(lines, stopLine(s))
 	}
+	const kept = "were let go to keep the record within 64 KiB"
+	if r.DroppedSteps > 0 {
+		lines = append(lines, fmt.Sprintf("%s %s", count(r.DroppedSteps, "earlier queued step", "earlier queued steps"), kept))
+	}
+	if r.DroppedHandBacks > 0 {
+		lines = append(lines, fmt.Sprintf("%s %s", count(r.DroppedHandBacks, "earlier item handed back", "earlier items handed back"), kept))
+	}
+	if r.DroppedStops > 0 {
+		lines = append(lines, fmt.Sprintf("%s %s", count(r.DroppedStops, "earlier stop", "earlier stops"), kept))
+	}
 	return lines
 }
 
diff --git a/internal/core/autonomy/record_full_test.go b/internal/core/autonomy/record_full_test.go
new file mode 100644
index 0000000000..ee8fbe85b7
--- /dev/null
+++ b/internal/core/autonomy/record_full_test.go
@@ -0,0 +1,211 @@
+package autonomy
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+	"time"
+)
+
+// record_full_test.go — the diff review's major 3 (spc-2610180914469489,
+// "Diff review round 1"): a record that fills must never stop the person
+// ending the mode, and normal use must keep it within its 64 KiB.
+
+func recordBytes(t *testing.T, r *Record) int {
+	t.Helper()
+	raw, err := json.MarshalIndent(r, "", "  ")
+	if err != nil {
+		t.Fatal(err)
+	}
+	return len(raw) + 1
+}
+
+// TestAddStopCollapsesAnywhere: two copies blocked on different items,
+// alternating, keep two entries, each counted, not one entry per stop.
+func TestAddStopCollapsesAnywhere(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	r, _ := Begin(nil, alice, now, time.Time{}, false)
+	a := Stop{Kind: StopWorkOwed, Detail: "pull request #12 (feat/a) is behind its base", PossiblyForcedByCap: true}
+	b := Stop{Kind: StopWorkOwed, Detail: "pull request #13 (feat/b) is failing its checks", PossiblyForcedByCap: true}
+	for i := 0; i < 200; i++ {
+		s := a
+		if i%2 == 1 {
+			s = b
+		}
+		r.AddStop(s, now.Add(time.Duration(i)*5*time.Minute))
+	}
+	if len(r.Stops) != 2 || r.Stops[0].Count != 100 || r.Stops[1].Count != 100 {
+		t.Fatalf("alternating stops = %d entries %+v, want two of 100 each", len(r.Stops), r.Stops)
+	}
+}
+
+// TestRecordStaysWithinBoundInUse: hundreds of distinct stops and hand-backs
+// rotate out the oldest, counted and named on `mode back`; queued steps stop
+// at their own bound with ErrQueueFull, nothing dropped; the record stays
+// within 64 KiB throughout.
+func TestRecordStaysWithinBoundInUse(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	r, _ := Begin(nil, alice, now, time.Time{}, false)
+	long := strings.Repeat("<", 240)
+	for i := 0; i < 600; i++ {
+		r.AddStop(Stop{Kind: StopWorkOwed, Detail: fmt.Sprintf("%d %s", i, long), PossiblyForcedByCap: true}, now.Add(time.Duration(i)*time.Minute))
+		r.AddHandBack(fmt.Sprintf("feat/%d-%s", i, strings.Repeat("x", 100)), strings.Repeat("a", 40), now)
+	}
+	full := false
+	for i := 0; i < 600 && !full; i++ {
+		err := r.AddStep(fmt.Sprintf("%d %s", i, strings.Repeat("<", MaxStepLen-8)), "/work/a", now)
+		if errors.Is(err, ErrQueueFull) {
+			full = true
+		} else if err != nil {
+			t.Fatal(err)
+		}
+	}
+	if !full {
+		t.Fatalf("the queue took 600 steps of %d characters", MaxStepLen)
+	}
+	if n := recordBytes(t, r); n > MaxFileBytes {
+		t.Fatalf("the record holds %d bytes, past %d", n, MaxFileBytes)
+	}
+	if r.DroppedStops == 0 || r.DroppedHandBacks == 0 {
+		t.Fatalf("dropped stops %d, hand-backs %d: want the oldest of each rotated out", r.DroppedStops, r.DroppedHandBacks)
+	}
+	lines := strings.Join(r.Lines(), "\n")
+	for _, want := range []string{fmt.Sprintf("%d earlier stops", r.DroppedStops), fmt.Sprintf("%d earlier items handed back", r.DroppedHandBacks)} {
+		if !strings.Contains(lines, want) {
+			t.Errorf("mode back's lines lack %q", want)
+		}
+	}
+}
+
+// fillRecord writes the stored record as one too full to write back: past
+// the store's bound, as a record from before the bounds, or a harness, can
+// leave it.
+func fillRecord(t *testing.T, st Store, now time.Time) {
+	t.Helper()
+	r, _ := Begin(nil, alice, now.Add(-time.Hour), time.Time{}, false)
+	r.Queue = append(r.Queue, QueuedStep{Step: "approve the embargo close", At: now, From: "/work/a"})
+	for i := 0; i < 400; i++ {
+		r.Stops = append(r.Stops, Stop{Kind: StopWorkOwed, Detail: fmt.Sprintf("%d %s", i, strings.Repeat("x", 200)), Count: 1, First: now, Last: now})
+	}
+	raw, _ := json.MarshalIndent(r, "", "  ")
+	if len(raw) <= MaxFileBytes {
+		t.Fatalf("the fixture holds %d bytes, not past the bound", len(raw))
+	}
+	if err := st.WithLock(func() error { return os.WriteFile(st.RecordPath(), raw, 0o600) }); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// TestBackEndsAnyRecord: `abcd mode back` ends the mode whatever state the
+// record is in: past its bound, partly or wholly unparsable, not safely this
+// account's, or with its lock held past the timeout. It prints what could be
+// read, says what could not, and afterwards the record reads closed.
+func TestBackEndsAnyRecord(t *testing.T) {
+	type spoil func(t *testing.T, st Store, now time.Time)
+	for _, c := range []struct {
+		name      string
+		spoil     spoil
+		wantLine  string // a line Back prints
+		wantNote  string // a note Back prints
+		readAfter bool   // the store's own read sees the closed record after
+	}{
+		{"past its bound", fillRecord, "399 xxxxx", "past its 64 KiB", true},
+		{"partly unparsable", func(t *testing.T, st Store, now time.Time) {
+			raw := `{"schema_version":1,"set_by":"alice","start":"` + now.Add(-time.Hour).Format(time.RFC3339) + `","until":"` + now.Add(time.Hour).Format(time.RFC3339) + `","queue":[{"step":"approve the embargo close"}],"stops":"garbled"}`
+			if err := os.WriteFile(st.RecordPath(), []byte(raw), 0o600); err != nil {
+				t.Fatal(err)
+			}
+		}, "approve the embargo close", "could not be read", true},
+		{"unparsable", func(t *testing.T, st Store, now time.Time) {
+			if err := os.WriteFile(st.RecordPath(), []byte("{not json"), 0o600); err != nil {
+				t.Fatal(err)
+			}
+		}, "", "could not be read", true},
+		{"writable by others", func(t *testing.T, st Store, now time.Time) { mustChmod(t, st.RecordPath(), 0o666) }, "", "not safely this account's", true},
+		{"lock writable by others", func(t *testing.T, st Store, now time.Time) { mustChmod(t, st.LockPath(), 0o666) }, "approve the embargo close", "lock", false},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			root, home := managedCopy(t)
+			now := time.Now().Truncate(time.Second)
+			o := fixedOptions(home, now)
+			if _, err := SetAway(root, "", false, o); err != nil {
+				t.Fatal(err)
+			}
+			if _, err := QueueStep(root, "approve the embargo close", o); err != nil {
+				t.Fatal(err)
+			}
+			st, _ := OpenStore(home, root)
+			c.spoil(t, st, now)
+			res, err := Back(root, o)
+			if err != nil {
+				t.Fatalf("back: %v", err)
+			}
+			all := strings.Join(append(res.Lines, res.Notes...), "\n")
+			if c.wantLine != "" && !strings.Contains(strings.Join(res.Lines, "\n"), c.wantLine) {
+				t.Errorf("back printed %q, want a line with %q", all, c.wantLine)
+			}
+			if !strings.Contains(strings.Join(res.Notes, "\n"), c.wantNote) {
+				t.Errorf("back's notes %q lack %q", res.Notes, c.wantNote)
+			}
+			if c.readAfter {
+				rec, err := st.Read()
+				if err != nil || rec == nil || rec.Closed == nil {
+					t.Fatalf("after back the record reads %+v (%v), want closed", rec, err)
+				}
+				raw, _ := os.ReadFile(st.RecordPath())
+				if len(raw) > MaxFileBytes {
+					t.Errorf("the closed record holds %d bytes", len(raw))
+				}
+			}
+			if _, holds, _ := st.Away(now); holds {
+				t.Errorf("the mode still holds after back")
+			}
+		})
+	}
+}
+
+// TestBackWithLockHeld: a lock held past the timeout does not keep the mode
+// on: back closes the record without it and says so.
+func TestBackWithLockHeld(t *testing.T) {
+	root, home := managedCopy(t)
+	now := time.Now().Truncate(time.Second)
+	o := fixedOptions(home, now)
+	if _, err := SetAway(root, "", false, o); err != nil {
+		t.Fatal(err)
+	}
+	st, _ := OpenStore(home, root)
+	var res BackResult
+	var berr error
+	if err := st.WithLock(func() error {
+		res, berr = Back(root, o)
+		return nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if berr != nil || res.State != "away" || !strings.Contains(strings.Join(res.Notes, " "), "lock") {
+		t.Fatalf("back with the lock held: %+v (%v)", res, berr)
+	}
+	if rec, err := st.Read(); err != nil || rec.Closed == nil {
+		t.Fatalf("after back the record reads %+v (%v), want closed", rec, err)
+	}
+}
+
+// TestBeginCarriesAFullRecord: setting the mode again over an unclosed record
+// past its bound carries what fits, counting what it dropped.
+func TestBeginCarriesAFullRecord(t *testing.T) {
+	root, home := managedCopy(t)
+	now := time.Now().Truncate(time.Second)
+	o := fixedOptions(home, now)
+	st, _ := OpenStore(home, root)
+	fillRecord(t, st, now)
+	rec, err := SetAway(root, "", false, o)
+	if err != nil {
+		t.Fatalf("set over a full record: %v", err)
+	}
+	if rec.DroppedStops == 0 || len(rec.Queue) != 1 {
+		t.Errorf("carried %d steps, dropped %d stops", len(rec.Queue), rec.DroppedStops)
+	}
+}
diff --git a/internal/core/autonomy/record_test.go b/internal/core/autonomy/record_test.go
index fd77bfe4b2..1ad5892340 100644
--- a/internal/core/autonomy/record_test.go
+++ b/internal/core/autonomy/record_test.go
@@ -199,8 +199,10 @@ func TestRepeatedStopCollapses(t *testing.T) {
 	}
 	r.AddStop(b, now.Add(30*time.Minute))
 	r.AddStop(a, now.Add(40*time.Minute))
-	if len(r.Stops) != 3 {
-		t.Errorf("stops = %+v, want three entries", r.Stops)
+	// An identical stop anywhere in the list collapses into its entry, not
+	// only the one just before it (the diff review's major 3).
+	if len(r.Stops) != 2 || r.Stops[0].Count != 3 || !r.Stops[0].Last.Equal(now.Add(40*time.Minute)) {
+		t.Errorf("stops = %+v, want two entries, the first counted three times", r.Stops)
 	}
 	if r.Stops[1].Count != 1 {
 		t.Errorf("a first stop's count = %d, want 1", r.Stops[1].Count)
diff --git a/internal/core/autonomy/store.go b/internal/core/autonomy/store.go
index 8942c4859a..8e9064385d 100644
--- a/internal/core/autonomy/store.go
+++ b/internal/core/autonomy/store.go
@@ -245,9 +245,14 @@ func (s Store) Away(now time.Time) (*Record, bool, error) {
 // is written. Update returns the record written, or the one read when nothing
 // was.
 func (s Store) Update(fn func(cur *Record) (*Record, error)) (*Record, error) {
+	return s.update(s.Read, fn)
+}
+
+// update is Update with the read under the lock named.
+func (s Store) update(read func() (*Record, error), fn func(cur *Record) (*Record, error)) (*Record, error) {
 	var out *Record
 	err := s.WithLock(func() error {
-		cur, err := s.Read()
+		cur, err := read()
 		if err != nil {
 			return err
 		}
diff --git a/internal/core/autonomy/store_test.go b/internal/core/autonomy/store_test.go
index 382494caf6..bad4d1496d 100644
--- a/internal/core/autonomy/store_test.go
+++ b/internal/core/autonomy/store_test.go
@@ -188,8 +188,15 @@ func TestRecordOwnershipFailsOpen(t *testing.T) {
 			if _, err := QueueStep(root, "push feat/x", o); err == nil || !errors.Is(err, ErrUnsafe) || !strings.Contains(err.Error(), c.file) {
 				t.Errorf("queue on a spoilt %s: err = %v, want ErrUnsafe naming it", c.file, err)
 			}
-			if _, err := Back(root, o); err == nil || !strings.Contains(err.Error(), c.file) {
-				t.Errorf("back on a spoilt %s: err = %v, want a refusal naming it", c.file, err)
+			// Ending the mode never depends on the record (the diff review's
+			// major 3): back succeeds, naming the spoilt file in a note, and
+			// the mode no longer holds.
+			res, err := Back(root, o)
+			if err != nil || !strings.Contains(strings.Join(res.Notes, " "), c.file) {
+				t.Errorf("back on a spoilt %s: %+v (%v), want it ended with a note naming the file", c.file, res, err)
+			}
+			if _, holds, _ := st.Away(now); holds {
+				t.Errorf("back on a spoilt %s left the mode holding", c.file)
 			}
 		})
 	}
diff --git a/internal/core/autonomy/verbs.go b/internal/core/autonomy/verbs.go
index a2d451d727..eb4cc6dfb1 100644
--- a/internal/core/autonomy/verbs.go
+++ b/internal/core/autonomy/verbs.go
@@ -151,7 +151,7 @@ func SetAway(cwd, until string, holdPushes bool, o Options) (*Record, error) {
 	if _, err := Begin(nil, who, now, end, holdPushes); err != nil {
 		return nil, err
 	}
-	return st.Update(func(cur *Record) (*Record, error) {
+	return st.update(st.carryRead, func(cur *Record) (*Record, error) {
 		return Begin(cur, who, now, end, holdPushes)
 	})
 }
@@ -166,30 +166,40 @@ type BackResult struct {
 	Record *Record
 	// Lines are the record's lines, printed one each.
 	Lines []string
+	// Notes say what could not be read or done as usual on the way to
+	// ending the mode (a record past its bound, unparsable or not safely
+	// this account's; a lock held past its timeout), one line each.
+	Notes []string
 }
 
 // Back is `abcd mode back` from cwd: under the lock it reads the record's
 // lines, records who ended it and from which copy, and closes it, on a
-// record whose time has passed as on one that holds.
+// record whose time has passed as on one that holds. It ends the mode
+// whatever state the record is in (end.go): a record past its bound is
+// printed whole and kept fitted; one it cannot read, or not safely this
+// account's, is replaced by a closed record, printing nothing from it; and a
+// lock not had within its timeout, or not safe to take, is gone around,
+// closing without it. Each is named in the result's notes.
 func Back(cwd string, o Options) (BackResult, error) {
 	root, st, err := Resolve(cwd, o)
 	if err != nil {
 		return BackResult{}, err
 	}
 	now := o.now()
+	who := Who{Name: o.who(root, st.home), Copy: root}
 	res := BackResult{State: "none"}
-	rec, err := st.Update(func(cur *Record) (*Record, error) {
-		if cur == nil || cur.Closed != nil {
-			return nil, nil
-		}
-		res.State = "lapsed"
-		if cur.Holds(now) {
-			res.State = "away"
-		}
-		res.Lines = cur.Lines()
-		cur.Close(Who{Name: o.who(root, st.home), Copy: root}, now)
-		return cur, nil
+	ran := false
+	var rec *Record
+	err = st.WithLock(func() error {
+		ran = true
+		var e error
+		rec, e = st.endRecord(&res, who, now)
+		return e
 	})
+	if err != nil && !ran {
+		res = BackResult{State: "none", Notes: []string{fmt.Sprintf("the store's lock was not had (%s), so the record was closed without it", err)}}
+		rec, err = st.endUnlocked(&res, who, now)
+	}
 	res.Record = rec
 	return res, err
 }
diff --git a/internal/surface/cli/mode_away.go b/internal/surface/cli/mode_away.go
index aad79a0dfd..9e910b4f3a 100644
--- a/internal/surface/cli/mode_away.go
+++ b/internal/surface/cli/mode_away.go
@@ -11,6 +11,7 @@ import (
 	"github.com/intentdriven/abcd/internal/core/autonomy"
 	"github.com/intentdriven/abcd/internal/fsutil"
 	"github.com/intentdriven/abcd/internal/gitutil"
+	"github.com/intentdriven/abcd/internal/termsafe"
 	"github.com/spf13/cobra"
 )
 
@@ -35,6 +36,9 @@ type backOutput struct {
 	Lines     []string `json:"lines"`
 	EndedBy   string   `json:"ended_by,omitempty"`
 	EndedFrom string   `json:"ended_from,omitempty"`
+	// Notes say what could not be read or done as usual on the way to
+	// ending the mode.
+	Notes []string `json:"notes,omitempty"`
 }
 
 // queueOutput is the --json envelope of `abcd mode queue`.
@@ -106,9 +110,12 @@ func newModeBackCommand(asJSON *bool) *cobra.Command {
 			"the cap\"), record who ended it and from which working copy, and close the record.\n" +
 			"On a record whose time has already passed it prints the same and closes it. With\n" +
 			"no record, or one already closed, it says there is nothing to end.\n\n" +
-			"A session runs it only on the person's word in that session. Exit 2 when the\n" +
-			"record or its lock is not safely this account's, naming the file, with nothing\n" +
-			"written. No network request.",
+			"A session runs it only on the person's word in that session. It ends the mode\n" +
+			"whatever state the record is in: one past its 64 KiB is printed whole and kept\n" +
+			"with its oldest lines let go and counted; one that does not parse, or is not\n" +
+			"safely this account's, is replaced by a closed record, printing nothing from\n" +
+			"it; and a lock not had in time is gone around. Each is named on its own line.\n" +
+			"No network request.",
 		Args: cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, _ []string) error {
 			cwd, err := os.Getwd()
@@ -119,7 +126,7 @@ func newModeBackCommand(asJSON *bool) *cobra.Command {
 			if err != nil {
 				return awayRefusal("back", err)
 			}
-			out := backOutput{State: res.State, Lines: res.Lines}
+			out := backOutput{State: res.State, Lines: res.Lines, Notes: res.Notes}
 			if out.Lines == nil {
 				out.Lines = []string{}
 			}
@@ -131,6 +138,9 @@ func newModeBackCommand(asJSON *bool) *cobra.Command {
 				for _, l := range out.Lines {
 					fmt.Fprintln(w, l)
 				}
+				for _, n := range out.Notes {
+					fmt.Fprintln(w, "abcd: "+termsafe.CleanProseLine(n, 512))
+				}
 				switch res.State {
 				case "none":
 					fmt.Fprintln(w, "abcd: not in the away mode; nothing to end")
@@ -154,8 +164,8 @@ func newModeQueueCommand(asJSON *bool) *cobra.Command {
 			"the person may approve, which a session queues instead of asking, then carries on\n" +
 			"with other work. `abcd mode back` prints each queued step on one line.\n\n" +
 			"Exit 2 when no away record holds (ask the person instead), on an empty step or one\n" +
-			"over 500 characters, and when the record or its lock is not safely this account's,\n" +
-			"with nothing written. No network request.",
+			"over 500 characters, when the queue is full (it is never cut), and when the record\n" +
+			"or its lock is not safely this account's, with nothing written. No network request.",
 		Args: cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			cwd, err := os.Getwd()
@@ -187,7 +197,7 @@ func whoWords(name string) string {
 func awayRefusal(verb string, err error) error {
 	for _, sentinel := range []error{
 		autonomy.ErrUntilUnreadable, autonomy.ErrUntilPast, autonomy.ErrUntilBeyondCap,
-		autonomy.ErrStepEmpty, autonomy.ErrStepTooLong, autonomy.ErrNotAway,
+		autonomy.ErrStepEmpty, autonomy.ErrStepTooLong, autonomy.ErrQueueFull, autonomy.ErrNotAway,
 		autonomy.ErrNoLocalTier, autonomy.ErrUnsafe, autonomy.ErrLockBusy, autonomy.ErrRecordFull,
 		autonomy.ErrNoRootCommit, autonomy.ErrNoHome, gitutil.ErrNoCheckoutRoot,
 	} {
diff --git a/internal/surface/cli/mode_away_test.go b/internal/surface/cli/mode_away_test.go
index 917da03fe7..5e49b4bafb 100644
--- a/internal/surface/cli/mode_away_test.go
+++ b/internal/surface/cli/mode_away_test.go
@@ -281,3 +281,24 @@ func TestModeQueueRefusals(t *testing.T) {
 		t.Errorf("queue on a record others can write: err = %v, want exit 2 naming %s", err, autonomy.RecordFile)
 	}
 }
+
+// TestModeBackEndsAnUnreadableRecord: `abcd mode back` on a record that does
+// not parse exits 0, says the record could not be read and was replaced, and
+// the mode no longer holds; the --json envelope carries the notes.
+func TestModeBackEndsAnUnreadableRecord(t *testing.T) {
+	root := awayCheckout(t)
+	setAway(t)
+	if err := os.WriteFile(awayStore(t, root).RecordPath(), []byte("{not json"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	stdout, stderr, err := runSplit(t, "", "mode", "back", "--json")
+	if err != nil {
+		t.Fatalf("mode back on an unreadable record: %v\n%s", err, stderr)
+	}
+	if !strings.Contains(stdout, `"notes"`) || !strings.Contains(stdout, "could not be read") {
+		t.Errorf("the envelope lacks the notes:\n%s", stdout)
+	}
+	if rec := readAway(t, root); rec.Closed == nil || rec.Holds(time.Now()) {
+		t.Errorf("after mode back the record holds: %+v", rec)
+	}
+}

From fa7f6a8f28826c081dc1e0d8826548d0080b9cdd Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 14:32:51 +0100
Subject: [PATCH 40/58] fix: record no branch another worktree has checked out

The recorder runs before the command, so `git worktree add ../r feat/sib`
naming a branch a sibling worktree has checked out, which git refuses,
still recorded the sibling's branch; with one author email on the
machine the copy was then told to fix and push the sibling's pull
request. A checked-out name a worktree already holds is now skipped.

Assisted-by: Claude:claude-opus-5-5
---
 internal/core/autonomy/branches.go          | 43 +++++++++++++++++----
 internal/core/autonomy/doc.go               |  5 ++-
 internal/surface/cli/guard_branches_test.go | 19 +++++++++
 3 files changed, 57 insertions(+), 10 deletions(-)

diff --git a/internal/core/autonomy/branches.go b/internal/core/autonomy/branches.go
index 03ffc5eae7..4c0ae39ff0 100644
--- a/internal/core/autonomy/branches.go
+++ b/internal/core/autonomy/branches.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"io/fs"
+	"strings"
 	"time"
 
 	"github.com/intentdriven/abcd/internal/core/claim"
@@ -137,14 +138,14 @@ func applyBranchChanges(list []CreatedBranch, changes []BranchChange, now time.T
 // RecordCreated is the created-branch recorder the guard's pre-tool hook
 // runs, before the command does, whether or not the person is away: it judges
 // each change against the repository as it stands (a created branch only when
-// no branch of that name exists yet; a checked-out one when it is a branch or
-// names nothing git can resolve) and records what passes under the copy's key
-// (claim.CopyKey, minted as a reservation verb mints it) in the away store.
-// copyRoot is the session's working copy; runDir is where the command runs,
-// whose current branch a rename with no old name renames. A checkout
-// abcd does not manage (Managed), or with no root commit, records nothing and
-// is no error. The error is a store the recorder could not write;
-// it never refuses the command.
+// no branch of that name exists yet; a checked-out one when it is a branch no
+// worktree has checked out, or names nothing git can resolve) and records
+// what passes under the copy's key (claim.CopyKey, minted as a reservation
+// verb mints it) in the away store. copyRoot is the session's working copy;
+// runDir is where the command runs, whose current branch a rename with no old
+// name renames. A checkout abcd does not manage (Managed), or with no root
+// commit, records nothing and is no error. The error is a store the recorder
+// could not write; it never refuses the command.
 func RecordCreated(copyRoot, runDir string, changes []BranchChange, o Options) error {
 	if len(changes) == 0 {
 		return nil
@@ -164,6 +165,7 @@ func RecordCreated(copyRoot, runDir string, changes []BranchChange, o Options) e
 		return err
 	}
 	var keep []BranchChange
+	var checkedOut map[string]bool
 	for _, c := range changes {
 		switch c.Kind {
 		case BranchCreated:
@@ -171,6 +173,15 @@ func RecordCreated(copyRoot, runDir string, changes []BranchChange, o Options) e
 				keep = append(keep, c)
 			}
 		case BranchCheckedOut:
+			if checkedOut == nil {
+				checkedOut = worktreeBranches(copyRoot)
+			}
+			// git refuses to check out a branch another worktree has
+			// checked out, and the recorder runs before the command, so
+			// such a name is a peer's branch, not this session's.
+			if checkedOut[c.Name] {
+				continue
+			}
 			if branchExists(copyRoot, c.Name) || !resolves(copyRoot, c.Name) {
 				keep = append(keep, c)
 			}
@@ -195,6 +206,22 @@ func RecordCreated(copyRoot, runDir string, changes []BranchChange, o Options) e
 	return st.RecordBranches(key, keep, o.now())
 }
 
+// worktreeBranches are the branches the repository's worktrees have checked
+// out, by short name; empty when they cannot be listed.
+func worktreeBranches(root string) map[string]bool {
+	out := map[string]bool{}
+	wts, err := gitutil.ListWorktrees(root, gitutil.MaxWorktreeListing)
+	if err != nil {
+		return out
+	}
+	for _, wt := range wts {
+		if name, ok := strings.CutPrefix(wt.Branch, "refs/heads/"); ok {
+			out[name] = true
+		}
+	}
+	return out
+}
+
 // branchExists reports whether refs/heads/name names a commit in the
 // repository at root.
 func branchExists(root, name string) bool {
diff --git a/internal/core/autonomy/doc.go b/internal/core/autonomy/doc.go
index 5c3dc67640..48206b9b00 100644
--- a/internal/core/autonomy/doc.go
+++ b/internal/core/autonomy/doc.go
@@ -115,8 +115,9 @@
 // (spc-2610180914469489 step 3) through RecordCreated(copyRoot, runDir,
 // changes, Options), whether or not the person is away: a BranchCreated name
 // only when no branch of that name exists yet, a BranchCheckedOut one (`git
-// worktree add <path> [<branch>]`) when it is a branch or names nothing git
-// resolves, and a BranchMoved rename carrying a record by whole name. The list
+// worktree add <path> [<branch>]`) when it is a branch no worktree has
+// checked out (git refuses that command, which runs after the recorder) or
+// names nothing git resolves, and a BranchMoved rename carrying a record by whole name. The list
 // is CreatedFile(copyKey) in the away store, keyed on the working copy's
 // reservation copy key (claim.CopyKey), written under the store's lock
 // (Store.RecordBranches) and capped at MaxCreatedBranches, the oldest
diff --git a/internal/surface/cli/guard_branches_test.go b/internal/surface/cli/guard_branches_test.go
index 37fb0795f8..5a2f6b328f 100644
--- a/internal/surface/cli/guard_branches_test.go
+++ b/internal/surface/cli/guard_branches_test.go
@@ -180,3 +180,22 @@ func TestBranchRecorderUsesSessionStartCopy(t *testing.T) {
 		t.Fatalf("with no note nothing is recorded under another copy: start copy holds %v", got)
 	}
 }
+
+// TestBranchRecorderSkipsBranchCheckedOutElsewhere: `git worktree add <path>
+// <branch>` naming a branch another worktree has checked out fails in git,
+// so the recorder, which runs before the command, records nothing for it;
+// the same command naming a branch no worktree has checked out is recorded.
+func TestBranchRecorderSkipsBranchCheckedOutElsewhere(t *testing.T) {
+	root := awayCheckout(t)
+	sib := filepath.Join(t.TempDir(), "b")
+	gitAt(t, root, "worktree", "add", "-q", "-b", "feat/sib", sib)
+	gitAt(t, root, "branch", "feat/free")
+	hookAllows(t, root, "git worktree add ../r feat/sib")
+	if got := createdBranches(t, root); slices.Contains(got, "feat/sib") {
+		t.Errorf("a branch another worktree has checked out was recorded: %v", got)
+	}
+	hookAllows(t, root, "git worktree add ../f feat/free")
+	if got := createdBranches(t, root); !slices.Contains(got, "feat/free") {
+		t.Errorf("a branch no worktree has checked out was not recorded: %v", got)
+	}
+}

From 31b5ac33753827845631887c9741b8318e67df9a Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 14:38:15 +0100
Subject: [PATCH 41/58] fix: keep the stop check inside its time budget,
 failing open past it

stopReadBudget bounded only the forge listing: every other git call ran
unbounded, and the stack-base search made about six git calls per pair
of own branches with no pull request, so 40 branches took 61 seconds at
load 28 and the host killed the hook at 30, recording nothing. Now:
- every git call of the owed read is bound to the hook's context, which
  runs 14 seconds from the hook's start, so the hook ends within about
  20 seconds;
- the stack-base search reads each own branch's reflog once and walks
  each branch's own history once, newest first in topological order, so
  its cost grows with the branches, not their pairs;
- a reading the budget cuts short is marked incomplete and says what was
  not read; the verdict allows the stop with a line naming it and, while
  away, records it as a stop the budget allowed.

Assisted-by: Claude:claude-opus-5-5
---
 internal/core/autonomy/doc.go           |  12 ++
 internal/core/autonomy/judge.go         |  30 +++++
 internal/core/autonomy/judge_test.go    |  21 +++
 internal/core/autonomy/owed.go          |   4 +
 internal/core/autonomy/owedread.go      | 162 +++++++++++++++++-------
 internal/core/autonomy/owedread_test.go |  77 +++++++++++
 internal/core/autonomy/record.go        |   6 +
 internal/surface/cli/hook_stop.go       |  19 ++-
 internal/surface/cli/hook_stop_test.go  |  34 +++++
 9 files changed, 314 insertions(+), 51 deletions(-)

diff --git a/internal/core/autonomy/doc.go b/internal/core/autonomy/doc.go
index 48206b9b00..848f9c3144 100644
--- a/internal/core/autonomy/doc.go
+++ b/internal/core/autonomy/doc.go
@@ -171,4 +171,16 @@
 // items come sorted by OwedKinds' order. The
 // error is a root that is not a working copy; anything else ReadOwed could
 // not read is a note in Owed.Notes.
+//
+// Every git call ReadOwed makes is bound to ctx, and the stack-base search
+// reads each own branch's reflog once a check and walks each branch's own
+// history once, so its cost grows with the branches, not their pairs. A
+// context that ends before everything is read stops the reading where it
+// is: Owed.Incomplete is set, a note says what was not read, and Judge
+// allows the stop with a line naming it, recording a StopCheckIncomplete
+// while away. A branch with no upstream and no commit in any remote branch
+// is owed only when merging it into the last-fetched default branch would
+// change it; one squash- or rebase-merged already is not, and one that
+// cannot be told is a note. A listing at its limit of 200 may be truncated:
+// a note says so, and no reservation is reported uncarried from it.
 package autonomy
diff --git a/internal/core/autonomy/judge.go b/internal/core/autonomy/judge.go
index cce42e0b3b..28cb2c942f 100644
--- a/internal/core/autonomy/judge.go
+++ b/internal/core/autonomy/judge.go
@@ -90,6 +90,16 @@ type Verdict struct {
 // passes the cap is recorded as a stop possibly forced by the cap.
 func Judge(rec *Record, owed Owed, in StopInput, st SessionState, now time.Time) Verdict {
 	away := rec.Holds(now)
+	if owed.Incomplete {
+		// The check ran out of its time budget: it fails open, allowing the
+		// stop with a line naming what was not read, and, while away,
+		// recording the stop. The session's state is left as it was.
+		v := Verdict{SystemMessage: incompleteLine(owed)}
+		if away {
+			v.Stop = &Stop{Kind: StopCheckIncomplete, Detail: incompleteDetail(owed)}
+		}
+		return v
+	}
 	owed, handBacks := settleHandBacks(rec, owed, away)
 	if !away {
 		if owed.Empty() {
@@ -311,6 +321,26 @@ func orBranch(pr, branch string) string {
 	return "branch " + clean(branch)
 }
 
+// incompleteDetail is what an incomplete reading's notes say was not read.
+func incompleteDetail(owed Owed) string {
+	for _, n := range owed.Notes {
+		if strings.Contains(n, "ran out of its time budget") {
+			return termsafe.CleanProseLine(n, 256)
+		}
+	}
+	return "the check ran out of its time budget"
+}
+
+// incompleteLine is the person's line on a stop allowed because the check ran
+// out of its time budget.
+func incompleteLine(owed Owed) string {
+	line := "abcd: the stop was allowed: " + incompleteDetail(owed)
+	if item, ok := owed.Next(); ok {
+		line += "; work read as owed so far: " + describeItem(item)
+	}
+	return line + "."
+}
+
 // presentLine is the person's line on a stop while present with work owed.
 func presentLine(owed Owed) string {
 	item, _ := owed.Next()
diff --git a/internal/core/autonomy/judge_test.go b/internal/core/autonomy/judge_test.go
index c8d0fdb38c..71218e8d31 100644
--- a/internal/core/autonomy/judge_test.go
+++ b/internal/core/autonomy/judge_test.go
@@ -589,3 +589,24 @@ func TestRowOnePastCapRecordsStop(t *testing.T) {
 		}
 	}
 }
+
+// TestIncompleteReadAllows: a reading the time budget cut short allows the
+// stop, present or away, naming what was not read to the person; while away
+// it records the stop.
+func TestIncompleteReadAllows(t *testing.T) {
+	now := at(t, "2026-10-18 21:00")
+	owed := Owed{Items: []OwedItem{behindPR}, Incomplete: true, Notes: []string{"the check ran out of its time budget before reading 3 of 9 own branches"}}
+	for _, away := range []bool{true, false} {
+		var rec *Record
+		if away {
+			rec = awayRec(now, false)
+		}
+		v := judgeAt(t, rec, owed, StopInput{}, SessionState{}, now)
+		if v.Block || !strings.Contains(v.SystemMessage, "3 of 9 own branches") {
+			t.Errorf("away %v: block %v message %q, want allowed and named", away, v.Block, v.SystemMessage)
+		}
+		if got := v.Stop != nil && v.Stop.Kind == StopCheckIncomplete; got != away {
+			t.Errorf("away %v: stop %+v", away, v.Stop)
+		}
+	}
+}
diff --git a/internal/core/autonomy/owed.go b/internal/core/autonomy/owed.go
index 5d4d7f1868..0f8ddf85d1 100644
--- a/internal/core/autonomy/owed.go
+++ b/internal/core/autonomy/owed.go
@@ -87,6 +87,10 @@ type Owed struct {
 	// only an unpushed branch's item, with its head, under --hold-pushes,
 	// and puts any other back among the owed items.
 	HandedBack []OwedItem `json:"handed_back,omitempty"`
+	// Incomplete is a reading the check's time budget cut short: Notes say
+	// what was not read, and the verdict allows the stop, naming it, rather
+	// than judge from part of the work.
+	Incomplete bool `json:"incomplete,omitempty"`
 }
 
 // Empty reports whether nothing is owed.
diff --git a/internal/core/autonomy/owedread.go b/internal/core/autonomy/owedread.go
index 228be2b59b..53bf445bd1 100644
--- a/internal/core/autonomy/owedread.go
+++ b/internal/core/autonomy/owedread.go
@@ -98,6 +98,7 @@ func ReadOwed(ctx context.Context, o ReadOptions) (Owed, error) {
 		}
 	}
 	r := &owedReader{
+		ctx:   ctx,
 		root:  root,
 		home:  home,
 		now:   o.now(),
@@ -149,11 +150,12 @@ func ReadOwed(ctx context.Context, o ReadOptions) (Owed, error) {
 		}
 		return a.Record < b.Record
 	})
-	return Owed{Items: r.items, Notes: r.notes, NextRenewal: r.nextRenewal, HandedBack: r.handed}, nil
+	return Owed{Items: r.items, Notes: r.notes, NextRenewal: r.nextRenewal, HandedBack: r.handed, Incomplete: r.incomplete}, nil
 }
 
 // owedReader is one ReadOwed's state.
 type owedReader struct {
+	ctx        context.Context
 	root, home string
 	now        time.Time
 	away       bool
@@ -172,6 +174,8 @@ type owedReader struct {
 
 	receiptsMinted bool
 	own            map[string]bool
+	stacks         *stackIndex       // read once, for diskStackBase
+	incomplete     bool              // the time budget ran out before everything was read
 	stackBase      map[string]string // a branch's base's tip on disk, for the hand-back
 
 	items       []OwedItem
@@ -200,16 +204,33 @@ func (r *owedReader) note(format string, a ...any) {
 	r.notes = append(r.notes, fmt.Sprintf(format, a...))
 }
 
+// git runs one git command bound to the check's context: past its deadline
+// git is killed and the call fails.
 func (r *owedReader) git(args ...string) (string, error) {
-	return gitutil.RunLimited(r.root, 1<<20, args...)
+	return gitutil.RunLimitedContext(r.ctx, r.root, 1<<20, args...)
 }
 
+// ancestor reports whether a is an ancestor of b; false when git cannot say,
+// the deadline passed included.
 func (r *owedReader) ancestor(a, b string) bool {
 	if a == "" || b == "" {
 		return false
 	}
-	ok, err := gitutil.IsAncestor(r.root, a, b)
-	return err == nil && ok
+	_, err := r.git("merge-base", "--is-ancestor", a, b)
+	return err == nil
+}
+
+// expired reports whether the check's time budget has run out.
+func (r *owedReader) expired() bool { return r.ctx.Err() != nil }
+
+// ranOut marks the reading incomplete, once noting what was not read: the
+// verdict then allows the stop, naming it (spc-2610180914469489, "Diff review
+// round 1", major 6).
+func (r *owedReader) ranOut(what string) {
+	if !r.incomplete {
+		r.note("the check ran out of its time budget before reading %s", what)
+	}
+	r.incomplete = true
 }
 
 // readRefs reads the default branch as last fetched and every local branch
@@ -494,11 +515,16 @@ func (r *owedReader) findOwn() {
 	for _, h := range linkedHeads {
 		linked[h] = true
 	}
-	for _, name := range append(r.reflogBranches(), r.recordedBranches()...) {
+	candidates := append(r.reflogBranches(), r.recordedBranches()...)
+	for i, name := range candidates {
 		b, ok := r.branches[name]
 		if !ok || r.own[name] {
 			continue
 		}
+		if r.expired() {
+			r.ranOut(fmt.Sprintf("which branches are this copy's own (%d of %d not checked)", len(candidates)-i, len(candidates)))
+			break
+		}
 		if linked[name] || r.linksByName(name) || r.authoredRecently(b) {
 			r.own[name] = true
 		}
@@ -545,58 +571,93 @@ func (r *owedReader) fetchedAt() string {
 	return "an unknown time"
 }
 
-// diskStackBase is the nearest other own branch whose tip is an ancestor of
-// b's and is not in the last-fetched default branch, or nil. A base that has
-// moved on since b was cut is no longer an ancestor of b's tip, so it is found
-// too by the commit they share, when that commit is not in the default branch
-// and was the other branch's own tip (its reflog set it there other than by
-// creating the branch, which tells the base from a branch cut from it).
-func (r *owedReader) diskStackBase(b *localBranch) *localBranch {
-	var best *localBranch
-	for _, name := range r.ownNames() {
-		c, ok := r.branches[name]
-		if !ok || c.name == b.name || c.head == b.head || !r.ancestor(c.head, b.head) || r.ancestor(c.head, r.defTip) {
-			continue
-		}
-		if best == nil || r.ancestor(best.head, c.head) {
-			best = c
-		}
-	}
-	if best != nil {
-		return best
+// stackWalk bounds how far back diskStackBase looks in a branch's own
+// history (its commits not in the last-fetched default branch).
+const stackWalk = 1000
+
+// stackIndex is what diskStackBase reads once a check, so finding every own
+// branch's base takes a fixed number of git calls a branch rather than one a
+// pair: the own branches by their current head, and by each tip their reflog
+// set other than by creating the branch.
+type stackIndex struct {
+	heads map[string][]string // a commit -> the own branches whose head it is
+	tips  map[string][]string // a commit -> the own branches it was a set tip of
+}
+
+func (r *owedReader) stackIdx() *stackIndex {
+	if r.stacks != nil {
+		return r.stacks
 	}
-	var bestFork string
+	idx := &stackIndex{heads: map[string][]string{}, tips: map[string][]string{}}
 	for _, name := range r.ownNames() {
 		c, ok := r.branches[name]
-		if !ok || c.name == b.name || r.ancestor(b.head, c.head) {
+		if !ok || r.expired() {
 			continue
 		}
-		out, err := r.git("merge-base", c.head, b.head)
-		fork := strings.TrimSpace(out)
-		if err != nil || fork == "" || fork == b.head || r.ancestor(fork, r.defTip) || !r.wasOwnTip(c.name, fork) {
+		idx.heads[c.head] = append(idx.heads[c.head], name)
+		out, err := r.git("reflog", "show", "-n", "1000", "--format=%H%x09%gs", "refs/heads/"+name, "--")
+		if err != nil {
 			continue
 		}
-		if best == nil || r.ancestor(bestFork, fork) {
-			best, bestFork = c, fork
+		seen := map[string]bool{}
+		for _, line := range strings.Split(out, "\n") {
+			h, msg, _ := strings.Cut(line, "\t")
+			if h == "" || seen[h] || strings.HasPrefix(msg, "branch: Created from") {
+				continue
+			}
+			seen[h] = true
+			idx.tips[h] = append(idx.tips[h], name)
 		}
 	}
-	return best
+	r.stacks = idx
+	return idx
 }
 
-// wasOwnTip reports whether branch's reflog shows sha as its tip, set there
-// other than by the branch's creation.
-func (r *owedReader) wasOwnTip(branch, sha string) bool {
-	out, err := r.git("reflog", "show", "-n", "1000", "--format=%H%x09%gs", "refs/heads/"+branch, "--")
+// diskStackBase is the nearest other own branch whose tip is in b's own
+// history (an ancestor of b's head not in the last-fetched default branch),
+// or nil. A base that has moved on since b was cut no longer has its tip
+// there, so it is found too by a commit of b's own history that was the
+// other branch's tip (its reflog set it there other than by creating the
+// branch, which tells the base from a branch cut from it) and is still in
+// its history. One walk of b's own history, newest first in topological
+// order, finds the nearest; the reflogs are read once a check (stackIdx).
+func (r *owedReader) diskStackBase(b *localBranch) *localBranch {
+	args := []string{"rev-list", "--topo-order", "-n", strconv.Itoa(stackWalk), b.head}
+	if r.defTip != "" {
+		args = append(args, "--not", r.defTip)
+	}
+	out, err := r.git(append(args, "--")...)
 	if err != nil {
-		return false
+		return nil
 	}
-	for _, line := range strings.Split(out, "\n") {
-		h, msg, _ := strings.Cut(line, "\t")
-		if h == sha && !strings.HasPrefix(msg, "branch: Created from") {
-			return true
+	idx := r.stackIdx()
+	pick := func(names []string) *localBranch {
+		for _, n := range names {
+			if c, ok := r.branches[n]; ok && n != b.name && c.head != b.head {
+				return c
+			}
 		}
+		return nil
 	}
-	return false
+	history := strings.Fields(out)
+	for _, h := range history {
+		if c := pick(idx.heads[h]); c != nil {
+			return c
+		}
+	}
+	for _, h := range history {
+		if h == b.head {
+			continue
+		}
+		for _, n := range idx.tips[h] {
+			c, ok := r.branches[n]
+			if !ok || n == b.name || r.ancestor(b.head, c.head) || !r.ancestor(h, c.head) {
+				continue
+			}
+			return c
+		}
+	}
+	return nil
 }
 
 // baseTipOnDisk is a base branch's tip as it stands on disk: the local branch,
@@ -631,7 +692,12 @@ func (r *owedReader) add(i OwedItem) { r.items = append(r.items, i) }
 // stacked branches by the clearing rule, and unpushed commits.
 func (r *owedReader) branchItems() {
 	r.stackBase = map[string]string{}
-	for _, name := range r.ownNames() {
+	names := r.ownNames()
+	for i, name := range names {
+		if r.expired() {
+			r.ranOut(fmt.Sprintf("%d of %d own branches (from %s on)", len(names)-i, len(names), name))
+			return
+		}
 		b := r.branches[name]
 		head := ""
 		if b != nil {
@@ -780,7 +846,11 @@ func (r *owedReader) unpushed(b *localBranch) bool {
 	case landedYes:
 		return false
 	case landedUnknown:
-		r.note("%s has commits in no remote branch and no upstream, and could not be told landed in %s or not (its change conflicts with it and its commits' patches are not all there), so it is not counted as unpushed",
+		if r.expired() {
+			r.ranOut("whether " + b.name + " has landed")
+			return false
+		}
+		r.note("%s has commits in no remote branch and no upstream, and could not be told landed in %s or not (there is no default branch to compare with, or its change conflicts with it and its commits' patches are not all there), so it is not counted as unpushed",
 			b.name, r.defLabel())
 		return false
 	}
@@ -812,7 +882,7 @@ const maxLandedOutput = 1 << 20
 // over since; otherwise it cannot be told. No default branch to compare with
 // cannot be told either.
 func (r *owedReader) landed(b *localBranch) landedness {
-	if r.defTip == "" {
+	if r.defTip == "" || r.expired() {
 		return landedUnknown
 	}
 	if overrides, err := gitutil.MergeDriverOverrides(r.root); err == nil {
@@ -831,7 +901,7 @@ func (r *owedReader) landed(b *localBranch) landedness {
 			}
 		}
 	}
-	out, err := gitutil.RunCapped(r.root, maxLandedOutput, "cherry", r.defTip, b.head)
+	out, err := gitutil.RunLimitedContext(r.ctx, r.root, maxLandedOutput, "cherry", r.defTip, b.head)
 	if err != nil {
 		return landedUnknown
 	}
diff --git a/internal/core/autonomy/owedread_test.go b/internal/core/autonomy/owedread_test.go
index 3e7036fa06..ae2db6eb0b 100644
--- a/internal/core/autonomy/owedread_test.go
+++ b/internal/core/autonomy/owedread_test.go
@@ -1121,3 +1121,80 @@ func TestForgeListingAtLimitTruncated(t *testing.T) {
 		}
 	}
 }
+
+// manyOwnBranches makes n own branches, each with a commit of the fixture's
+// own not in any remote, none with a pull request.
+func (f *fx) manyOwnBranches(n int) {
+	f.t.Helper()
+	for i := 0; i < n; i++ {
+		b := fmt.Sprintf("feat/m%02d", i)
+		f.git("branch", b)
+		f.commitOn(b, "work "+b, "")
+		f.own(b)
+	}
+}
+
+// countGit puts a git on PATH that counts its calls into the returned file.
+func countGit(t *testing.T) func() int {
+	t.Helper()
+	real, err := exec.LookPath("git")
+	if err != nil {
+		t.Skip("git not on PATH")
+	}
+	bin := t.TempDir()
+	log := filepath.Join(t.TempDir(), "calls")
+	script := "#!/bin/sh\necho x >> '" + log + "'\nexec '" + real + "' \"$@\"\n"
+	if err := os.WriteFile(filepath.Join(bin, "git"), []byte(script), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("PATH", bin+string(os.PathListSeparator)+os.Getenv("PATH"))
+	return func() int {
+		raw, _ := os.ReadFile(log)
+		_ = os.WriteFile(log, nil, 0o600)
+		return strings.Count(string(raw), "\n")
+	}
+}
+
+// TestStackBaseSearchLinear: finding the bases of own branches with no pull
+// request (the listing failed) costs git calls in proportion to the
+// branches, not to their pairs: doubling the branches far less than
+// quadruples the calls.
+func TestStackBaseSearchLinear(t *testing.T) {
+	calls := map[int]int{}
+	for _, n := range []int{10, 20} {
+		f := newFx(t)
+		f.manyOwnBranches(n)
+		f.forge.err = errors.New("listing failed")
+		count := countGit(t)
+		count()
+		f.read(true)
+		calls[n] = count()
+	}
+	if calls[20] > calls[10]*3 {
+		t.Fatalf("git calls: %d for 10 branches, %d for 20; want them to grow linearly", calls[10], calls[20])
+	}
+}
+
+// TestReadOwedHonoursDeadline: a check whose time budget runs out stops
+// reading, returns promptly, marks the reading incomplete and says what was
+// not read.
+func TestReadOwedHonoursDeadline(t *testing.T) {
+	f := newFx(t)
+	f.manyOwnBranches(30)
+	f.forge.err = errors.New("listing failed")
+	o := f.opts()
+	o.Record = f.awayRecord(false)
+	ctx, cancel := context.WithTimeout(context.Background(), 150*time.Millisecond)
+	defer cancel()
+	start := time.Now()
+	owed, err := ReadOwed(ctx, o)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if took := time.Since(start); took > 5*time.Second {
+		t.Errorf("the read took %s past a 150ms budget", took)
+	}
+	if !owed.Incomplete || !strings.Contains(strings.Join(owed.Notes, " "), "ran out of its time budget") {
+		t.Fatalf("a read cut short is marked incomplete with a note: incomplete %v, %s", owed.Incomplete, describe(owed))
+	}
+}
diff --git a/internal/core/autonomy/record.go b/internal/core/autonomy/record.go
index a05cbeb59d..226e4cc435 100644
--- a/internal/core/autonomy/record.go
+++ b/internal/core/autonomy/record.go
@@ -99,6 +99,10 @@ const (
 	StopNoNextLook StopKind = "no-next-look"
 	// StopAPIError is a turn the host ended on an API error.
 	StopAPIError StopKind = "api-error"
+	// StopCheckIncomplete is a stop allowed because the check's time budget
+	// ran out before it had read the owed work; Detail says what was not
+	// read.
+	StopCheckIncomplete StopKind = "check-incomplete"
 )
 
 // Stop is one recorded stop. Count, First and Last are kept by AddStop: a stop
@@ -355,6 +359,8 @@ func stopLine(s Stop) string {
 		b.WriteString("stopped with work owed")
 	case StopNoNextLook:
 		b.WriteString("stopped with no next look")
+	case StopCheckIncomplete:
+		b.WriteString("allowed to stop, the check out of time")
 	case StopAPIError:
 		b.WriteString("stopped on an API error")
 		if s.ErrorType != "" {
diff --git a/internal/surface/cli/hook_stop.go b/internal/surface/cli/hook_stop.go
index 3d2665ce49..daf612ec68 100644
--- a/internal/surface/cli/hook_stop.go
+++ b/internal/surface/cli/hook_stop.go
@@ -34,9 +34,14 @@ import (
 // ten-second deadline. A test replaces it with constructed sets.
 var stopOwedReader = autonomy.ReadOwed
 
-// stopReadBudget bounds the owed read inside the Stop hook's 30-second
-// timeout, leaving the hook time to judge, record and answer.
-const stopReadBudget = 25 * time.Second
+// stopReadBudget bounds the owed read, counted from the hook's start (the
+// checkout's root and root commit included), its forge listing's own
+// ten-second deadline inside it. Judging, the session's state and at most a
+// few store writes under their two-second lock follow, so the hook ends
+// within about 20 seconds, well inside the host's 30-second timeout. A read
+// the budget cuts short is incomplete, and the stop is allowed, naming what
+// was not read (spc-2610180914469489, "Diff review round 1", major 6).
+const stopReadBudget = 14 * time.Second
 
 // stopBlockCapEnv names the host's setting that raises its continuation cap.
 const stopBlockCapEnv = "CLAUDE_CODE_STOP_HOOK_BLOCK_CAP"
@@ -100,6 +105,10 @@ host's cap of consecutive continuations (eight, or
 CLAUDE_CODE_STOP_HOOK_BLOCK_CAP) is recorded in the away record as a stop
 possibly forced by the cap. While the person is present the check reads disk
 only and, with work owed, allows the stop with a systemMessage naming it.
+The owed work is read within 14 seconds of the hook's start, so the hook
+ends well inside the host's 30-second timeout; a reading cut short allows
+the stop with a systemMessage naming what was not read, recorded in the away
+record while the person is away.
 
 The session's state is kept per session id in its start copy's local tier,
 .abcd/.work.local/autonomy/sessions/<session-id>.json. A malformed payload,
@@ -116,6 +125,8 @@ nothing.`,
 					ret = stopAllow(cmd, "the stop check failed (%s)", termsafe.CleanProseLine(fsutil.RedactHome(fmt.Sprint(r)), 256))
 				}
 			}()
+			ctx, cancel := context.WithTimeout(context.Background(), stopReadBudget)
+			defer cancel()
 			p, err := readStopPayload(cmd)
 			if err != nil {
 				return stopAllow(cmd, "unreadable Stop payload (%s)", termsafe.Sanitize(err.Error()))
@@ -136,8 +147,6 @@ nothing.`,
 			if away && !autonomy.ValidSessionID(p.SessionID) {
 				return stopAllow(cmd, "the session id %q is not [A-Za-z0-9_-]{1,128}", termsafe.CleanProseLine(p.SessionID, 64))
 			}
-			ctx, cancel := context.WithTimeout(context.Background(), stopReadBudget)
-			defer cancel()
 			home, _ := os.UserHomeDir()
 			owed, err := stopOwedReader(ctx, autonomy.ReadOptions{Root: copyRoot, Record: rec, Home: home, Now: func() time.Time { return now }})
 			if err != nil {
diff --git a/internal/surface/cli/hook_stop_test.go b/internal/surface/cli/hook_stop_test.go
index 395ba74caf..af68a7c05e 100644
--- a/internal/surface/cli/hook_stop_test.go
+++ b/internal/surface/cli/hook_stop_test.go
@@ -509,3 +509,37 @@ func TestHookStopPanicAllows(t *testing.T) {
 		t.Errorf("a panic: err %v stdout %q stderr %q", err, so, se)
 	}
 }
+
+// TestHookStopBudgetFailsOpen: the owed read runs under a deadline well
+// inside the host's 30-second hook timeout, leaving room to judge and record
+// within about 20 seconds in all; a reading the deadline cut short allows the
+// stop with a line naming what was not read, and records the stop while away.
+func TestHookStopBudgetFailsOpen(t *testing.T) {
+	root := awayCheckout(t)
+	setAway(t)
+	var left time.Duration
+	prev := stopOwedReader
+	stopOwedReader = func(ctx context.Context, _ autonomy.ReadOptions) (autonomy.Owed, error) {
+		if d, ok := ctx.Deadline(); ok {
+			left = time.Until(d)
+		}
+		return autonomy.Owed{Items: []autonomy.OwedItem{behindItem}, Incomplete: true,
+			Notes: []string{"the check ran out of its time budget before reading 4 of 40 own branches (from feat/m36 on)"}}, nil
+	}
+	t.Cleanup(func() { stopOwedReader = prev })
+	start := time.Now()
+	out, so, _ := runStop(t, stopHookPayload(t, "bud-1", root, false, "Done."))
+	if left <= 0 || left > 15*time.Second {
+		t.Errorf("the owed read had %s left on its deadline, want at most 15s", left)
+	}
+	if time.Since(start) > 20*time.Second {
+		t.Errorf("the hook took %s", time.Since(start))
+	}
+	if out.Decision != "" || !strings.Contains(out.SystemMessage, "4 of 40 own branches") {
+		t.Errorf("a reading cut short: %s, want the stop allowed and named", so)
+	}
+	stops := readAway(t, root).Stops
+	if len(stops) != 1 || stops[0].Kind != autonomy.StopCheckIncomplete {
+		t.Errorf("recorded %+v, want the stop allowed by the budget", stops)
+	}
+}

From 3e4676f327c24262d5fc836eb6ad8eb634207892 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 14:40:24 +0100
Subject: [PATCH 42/58] fix: let a wake release a renewal that is only due

A renewal falls due halfway through its lease, and the wake deadline was
that time less the skew, already past once it was due, so a renewal only
due could never release on a wake, though the spec says it keeps
releasing; the test passed only through an owed set with no renewal time,
which the reader never produces. The reader now also reports WakeBy, the
earliest of each live reservation's renewal while not yet due and its
lapse once due, and the deadline reads it. The test builds its renewal
as the reader does.

Assisted-by: Claude:claude-opus-5-5
---
 internal/core/autonomy/doc.go           |  4 ++-
 internal/core/autonomy/judge_test.go    |  6 ++++
 internal/core/autonomy/owed.go          |  6 ++++
 internal/core/autonomy/owedread.go      | 10 ++++++-
 internal/core/autonomy/owedread_test.go | 38 +++++++++++++++++++++++++
 internal/core/autonomy/wake.go          | 13 ++++++---
 6 files changed, 71 insertions(+), 6 deletions(-)

diff --git a/internal/core/autonomy/doc.go b/internal/core/autonomy/doc.go
index 848f9c3144..84327d7551 100644
--- a/internal/core/autonomy/doc.go
+++ b/internal/core/autonomy/doc.go
@@ -90,7 +90,9 @@
 // work no pull request carries. Owed.Fingerprint and Owed.CappedFingerprint
 // compare two owed sets item by item, ignoring order and reasons.
 // Owed.NextRenewal is the earliest renewal due among the live reservations
-// under this copy's key (zero when none), and Owed.HandedBack the items a
+// under this copy's key (zero when none), Owed.WakeBy the latest a wake may
+// fire for them (a renewal not yet due, or the lapse of one already due, so
+// a renewal only due keeps releasing on a wake), and Owed.HandedBack the items a
 // queued step handed back, which the verdict accepts only under
 // --hold-pushes and only for an unpushed branch's item with its head.
 //
diff --git a/internal/core/autonomy/judge_test.go b/internal/core/autonomy/judge_test.go
index 71218e8d31..be6a8f209e 100644
--- a/internal/core/autonomy/judge_test.go
+++ b/internal/core/autonomy/judge_test.go
@@ -176,6 +176,12 @@ func TestWakeReleasesUnchangedSetTwice(t *testing.T) {
 	for _, item := range []OwedItem{renewalDue, stackedWait} {
 		s := newSequence(t, awayRec(now, false), now)
 		owed := owedOf(item)
+		if item.Kind == OwedRenewal {
+			// As the reader produces a renewal due: its renewal time past,
+			// its lease lapsing in three hours, past the six stops ten minutes
+			// apart (TestDueRenewalReleasesOnWake).
+			owed.NextRenewal, owed.WakeBy = now.Add(-time.Hour), now.Add(3*time.Hour)
+		}
 		s.stop(owed, wake)
 		for i := 0; i < 5; i++ {
 			if v := s.stop(owed, wake); v.Block {
diff --git a/internal/core/autonomy/owed.go b/internal/core/autonomy/owed.go
index 0f8ddf85d1..0f5d07bc1e 100644
--- a/internal/core/autonomy/owed.go
+++ b/internal/core/autonomy/owed.go
@@ -82,6 +82,12 @@ type Owed struct {
 	// stop verdict's deadline is it less lease.Skew, when that is sooner than
 	// the ceiling (dcn-2610181003455731).
 	NextRenewal time.Time `json:"next_renewal,omitempty"`
+	// WakeBy is the latest a wake may fire for this copy's live
+	// reservations: the earliest of each one's renewal while it is not yet
+	// due, and its lapse once it is. A renewal already due is owed, and a
+	// wake before the lease lapses releases it as the spec has it; zero when
+	// there is no reservation, and Deadline then reads NextRenewal.
+	WakeBy time.Time `json:"wake_by,omitempty"`
 	// HandedBack are the items a queued step handed back this check, taken
 	// out of Items by the reader (dcn-2610181035355741). The verdict accepts
 	// only an unpushed branch's item, with its head, under --hold-pushes,
diff --git a/internal/core/autonomy/owedread.go b/internal/core/autonomy/owedread.go
index 53bf445bd1..b8c43c1640 100644
--- a/internal/core/autonomy/owedread.go
+++ b/internal/core/autonomy/owedread.go
@@ -150,7 +150,7 @@ func ReadOwed(ctx context.Context, o ReadOptions) (Owed, error) {
 		}
 		return a.Record < b.Record
 	})
-	return Owed{Items: r.items, Notes: r.notes, NextRenewal: r.nextRenewal, HandedBack: r.handed, Incomplete: r.incomplete}, nil
+	return Owed{Items: r.items, Notes: r.notes, NextRenewal: r.nextRenewal, WakeBy: r.wakeBy, HandedBack: r.handed, Incomplete: r.incomplete}, nil
 }
 
 // owedReader is one ReadOwed's state.
@@ -181,6 +181,7 @@ type owedReader struct {
 	items       []OwedItem
 	handed      []OwedItem // handed back by a queued step, for the verdict to accept
 	nextRenewal time.Time  // the earliest renewal due among r.mine
+	wakeBy      time.Time  // the latest a wake may fire for r.mine (Owed.WakeBy)
 	notes       []string
 }
 
@@ -940,6 +941,13 @@ func (r *owedReader) reservationItems() {
 		if r.nextRenewal.IsZero() || half.Before(r.nextRenewal) {
 			r.nextRenewal = half
 		}
+		need := half
+		if !r.now.Before(half) {
+			need = res.EffectiveExpiry
+		}
+		if r.wakeBy.IsZero() || need.Before(r.wakeBy) {
+			r.wakeBy = need
+		}
 		if !r.now.Before(half) {
 			r.add(OwedItem{Kind: OwedRenewal, Record: res.Record,
 				Reason: fmt.Sprintf("the reservation of %s is due for renewal (it lapses %s): renew it with `abcd reserve %s`",
diff --git a/internal/core/autonomy/owedread_test.go b/internal/core/autonomy/owedread_test.go
index ae2db6eb0b..23fc8737ac 100644
--- a/internal/core/autonomy/owedread_test.go
+++ b/internal/core/autonomy/owedread_test.go
@@ -1198,3 +1198,41 @@ func TestReadOwedHonoursDeadline(t *testing.T) {
 		t.Fatalf("a read cut short is marked incomplete with a note: incomplete %v, %s", owed.Incomplete, describe(owed))
 	}
 }
+
+// TestDueRenewalReleasesOnWake: a set of only a renewal already due, as the
+// reader produces it (its renewal time past, its lease not yet lapsed), is
+// released by a wake that fires before the lease lapses less the skew, as
+// the spec's "a renewal only due keeps releasing" says; a wake past the
+// lapse does not qualify.
+func TestDueRenewalReleasesOnWake(t *testing.T) {
+	f := newFx(t)
+	f.now = at(t, "2026-10-18 21:01")
+	f.reserve("iss-9", claim.CopyThis, f.now.Add(-3*time.Hour), f.now.Add(time.Hour))
+	f.forge.prs = []fakePR{pr(1, "fix/iss-9", "main", "alice")}
+	rec := f.awayRecord(false)
+	o := f.opts()
+	o.Record = rec
+	owed := f.readWith(o)
+	if len(owed.Items) != 1 || owed.Items[0].Kind != OwedRenewal {
+		t.Fatalf("want only the renewal due: %s", describe(owed))
+	}
+	if d := Deadline(owed, f.now); !d.After(f.now) {
+		t.Fatalf("the deadline for a due renewal is %s, already past at %s", d, f.now)
+	}
+	st := SessionState{}
+	wake := StopInput{SessionCrons: crons("*/10 * * * *"), Location: london(t)}
+	v := Judge(rec, owed, wake, st, f.now)
+	if v.Row != 2 {
+		t.Fatalf("first stop row %d, want 2", v.Row)
+	}
+	for i := 0; i < 3; i++ {
+		v = Judge(rec, owed, wake, v.State, f.now)
+		if v.Block {
+			t.Fatalf("wake %d: a due renewal alone blocked (row %d); want it released", i+1, v.Row)
+		}
+	}
+	late := StopInput{SessionCrons: crons("0 23 * * *"), Location: london(t)}
+	if v := Judge(rec, owed, late, v.State, f.now); !v.Block {
+		t.Errorf("a wake past the lease's lapse released the stop")
+	}
+}
diff --git a/internal/core/autonomy/wake.go b/internal/core/autonomy/wake.go
index 28fe6020a6..f2cc1d9109 100644
--- a/internal/core/autonomy/wake.go
+++ b/internal/core/autonomy/wake.go
@@ -39,8 +39,9 @@ type BackgroundTask struct {
 }
 
 // Deadline is the latest a wake may fire for the stop to wait on it: the
-// earlier of the earliest renewal due among the live reservations under this
-// copy's key less lease.Skew, and now plus a ceiling, OwedCeiling while work
+// earlier of Owed.WakeBy (the earliest renewal not yet due among the live
+// reservations under this copy's key, or the lapse of one already due; else
+// Owed.NextRenewal) less lease.Skew, and now plus a ceiling, OwedCeiling while work
 // is owed and IdleCeiling when none is (dcn-2610181003455731).
 func Deadline(owed Owed, now time.Time) time.Time {
 	ceiling := IdleCeiling
@@ -48,8 +49,12 @@ func Deadline(owed Owed, now time.Time) time.Time {
 		ceiling = OwedCeiling
 	}
 	d := now.Add(ceiling)
-	if !owed.NextRenewal.IsZero() {
-		if r := owed.NextRenewal.Add(-lease.Skew); r.Before(d) {
+	by := owed.WakeBy
+	if by.IsZero() {
+		by = owed.NextRenewal
+	}
+	if !by.IsZero() {
+		if r := by.Add(-lease.Skew); r.Before(d) {
 			d = r
 		}
 	}

From 29f62682bdb46ed61f8acd1fe174e278ee3c263d Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 14:42:51 +0100
Subject: [PATCH 43/58] fix: count only own pull requests as carrying, and
 sibling-held branches as not own

Two minors of the diff review:
- The carried check accepted a fork's or another person's pull request
  naming the reservation, which findOwn excludes; it now applies the
  same filter, so such a pull request carries nothing.
- Sibling copies on one machine share the author email, so a branch this
  copy only checked out once to review read as its own. A branch from the
  reflog that another worktree has checked out now is that worktree's,
  unless this copy's sessions recorded creating it or a linked pull
  request names it.

Assisted-by: Claude:claude-opus-5-5
---
 internal/core/autonomy/owedread.go      | 43 ++++++++++++++++++++++++-
 internal/core/autonomy/owedread_test.go | 40 +++++++++++++++++++++++
 2 files changed, 82 insertions(+), 1 deletion(-)

diff --git a/internal/core/autonomy/owedread.go b/internal/core/autonomy/owedread.go
index b8c43c1640..329afd0d89 100644
--- a/internal/core/autonomy/owedread.go
+++ b/internal/core/autonomy/owedread.go
@@ -516,12 +516,26 @@ func (r *owedReader) findOwn() {
 	for _, h := range linkedHeads {
 		linked[h] = true
 	}
-	candidates := append(r.reflogBranches(), r.recordedBranches()...)
+	reflog, recorded := r.reflogBranches(), r.recordedBranches()
+	isRecorded := map[string]bool{}
+	for _, n := range recorded {
+		isRecorded[n] = true
+	}
+	elsewhere := r.checkedOutElsewhere()
+	candidates := append(reflog, recorded...)
 	for i, name := range candidates {
 		b, ok := r.branches[name]
 		if !ok || r.own[name] {
 			continue
 		}
+		// A branch this copy only checked out once, which another worktree
+		// has checked out now, is that worktree's: sibling copies on one
+		// machine share the author email, so the email cannot tell. One
+		// this copy's sessions recorded creating, or a worktree they made
+		// for it, is still this copy's.
+		if elsewhere[name] && !isRecorded[name] && !linked[name] {
+			continue
+		}
 		if r.expired() {
 			r.ranOut(fmt.Sprintf("which branches are this copy's own (%d of %d not checked)", len(candidates)-i, len(candidates)))
 			break
@@ -548,6 +562,28 @@ func (r *owedReader) findOwn() {
 	}
 }
 
+// checkedOutElsewhere are the branches a worktree other than this copy has
+// checked out.
+func (r *owedReader) checkedOutElsewhere() map[string]bool {
+	out := map[string]bool{}
+	wts, err := gitutil.ListWorktrees(r.root, gitutil.MaxWorktreeListing)
+	if err != nil {
+		return out
+	}
+	here, _ := os.Stat(r.root)
+	for _, wt := range wts {
+		name, ok := strings.CutPrefix(wt.Branch, "refs/heads/")
+		if !ok {
+			continue
+		}
+		if fi, err := os.Stat(wt.Path); err == nil && here != nil && os.SameFile(fi, here) {
+			continue
+		}
+		out[name] = true
+	}
+	return out
+}
+
 func (r *owedReader) ownNames() []string {
 	names := make([]string, 0, len(r.own))
 	for n := range r.own {
@@ -958,6 +994,11 @@ func (r *owedReader) reservationItems() {
 		}
 		carried := false
 		for _, p := range r.list.prs {
+			// Only a pull request findOwn would count carries: in this
+			// repository, and the person's.
+			if p.IsCrossRepository || !r.list.authoredBy(p, r.person) {
+				continue
+			}
 			if r.prLinks(p, res.Record, r.own[p.HeadRefName]) {
 				carried = true
 				break
diff --git a/internal/core/autonomy/owedread_test.go b/internal/core/autonomy/owedread_test.go
index 23fc8737ac..a077ba55d5 100644
--- a/internal/core/autonomy/owedread_test.go
+++ b/internal/core/autonomy/owedread_test.go
@@ -1236,3 +1236,43 @@ func TestDueRenewalReleasesOnWake(t *testing.T) {
 		t.Errorf("a wake past the lease's lapse released the stop")
 	}
 }
+
+// TestReviewCheckoutSameEmailNotOwn: on one machine sibling copies share the
+// author email, so a branch this copy once checked out to review, which a
+// sibling worktree now has checked out, holds commits of "this checkout's"
+// email; it is the sibling's, not this copy's own, and is not owed here.
+func TestReviewCheckoutSameEmailNotOwn(t *testing.T) {
+	f := newFx(t)
+	f.git("branch", "feat/sibling")
+	f.commitOn("feat/sibling", "sibling's work", "")
+	f.own("feat/sibling") // checked out here once, to look at it
+	sib := filepath.Join(t.TempDir(), "sib")
+	f.git("worktree", "add", "-q", sib, "feat/sibling")
+	if owed := f.read(false); has(owed, OwedUnpushed, "feat/sibling") {
+		t.Fatalf("a branch a sibling worktree has checked out is not this copy's own: %s", describe(owed))
+	}
+}
+
+// TestCarriedOnlyByOwnPullRequest: a reservation is carried only by a pull
+// request findOwn would count: in this repository and the person's; a fork's
+// or another person's pull request naming it does not carry it.
+func TestCarriedOnlyByOwnPullRequest(t *testing.T) {
+	for _, c := range []struct {
+		name string
+		p    fakePR
+	}{
+		{"another person's", func() fakePR { p := pr(1, "fix/x", "main", "bob"); p.Body = "Resolves: iss-21"; return p }()},
+		{"a fork's", func() fakePR {
+			p := pr(2, "fix/iss-21", "main", "alice")
+			p.IsCrossRepository = true
+			return p
+		}()},
+	} {
+		f := newFx(t)
+		f.reserveFresh("iss-21")
+		f.forge.prs = []fakePR{c.p}
+		if owed := f.read(true); !has(owed, OwedUncarried, "iss-21") {
+			t.Errorf("%s pull request carried the reservation: %s", c.name, describe(owed))
+		}
+	}
+}

From f018d09970c19cff54a4069519c6c4da6fb66f10 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 14:45:15 +0100
Subject: [PATCH 44/58] docs: record the stop check's diff review round 1 and
 its fixes

The spec gains the "Diff review round 1" table, one row per finding with
its fix and tests, the fix round's choices under "Settled here", and the
hooks reference read again: the Stop feedback form and StopFailure's
input. The mode command page says `back` ends the mode whatever state
the record is in, and that a full queue refuses.

Assisted-by: Claude:claude-opus-5-5
---
 ...489-a-session-told-to-work-on-while-its.md | 100 +++++++++++++++++-
 commands/mode.md                              |  10 +-
 2 files changed, 106 insertions(+), 4 deletions(-)

diff --git a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
index 9b460ddc4b..7513bd11e6 100644
--- a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
+++ b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
@@ -73,10 +73,24 @@ docs.claude.com hooks page redirects there):
   host's task registry is reachable. Output `{"decision": "block", "reason":
   …}` prevents the stop. Claude Code caps this at eight consecutive
   continuations, overriding the next block; the count resets each time Claude
-  calls a tool, and `CLAUDE_CODE_STOP_HOOK_BLOCK_CAP` raises it.
+  calls a tool, and `CLAUDE_CODE_STOP_HOOK_BLOCK_CAP` raises it. Read again on
+  2026-10-18 ("Stop decision control"): `hookSpecificOutput.additionalContext`
+  is "Non-error feedback for Claude. The conversation continues so Claude can
+  act on it, but unlike `decision: "block"` it is shown in the transcript as
+  hook feedback rather than a hook error"; use it "when the hook is working as
+  designed", and it "keeps the conversation going through the same loop
+  protections as `decision: "block"`, namely the `stop_hook_active` input and
+  the 8-consecutive-continuation cap, but the transcript labels it `Stop hook
+  feedback` and no hook error notification is shown". The stop check blocks
+  with `{"hookSpecificOutput":{"hookEventName":"Stop","additionalContext":…}}`
+  (Diff review round 1, item 7).
 - **StopFailure.** Fires instead of Stop "when the turn ends due to an API
   error"; its matcher is the error type (`rate_limit`, `overloaded`,
   `server_error` and others). It cannot block, and its output is ignored.
+  Its input carries `error`, "the error type and is used for matcher
+  filtering", with optional `error_details` and `last_assistant_message`
+  (here the API error string); "StopFailure hooks have no decision control".
+  `abcd hook stop-failure` reads `error`.
 - **SessionStart.** The matcher values include `compact` ("auto or manual
   compaction"). Plain stdout, or `hookSpecificOutput.additionalContext`, is
   added to Claude's context.
@@ -778,6 +792,60 @@ for review; none changes a test a step names.
   and invariant 7's clause now says too; lane 2's note above on the
   mismatch is answered by it.
 
+- 2026-10-18 (fix round 1's choice, for review): **"Managed" reaches a
+  linked worktree's main worktree.** Every away hook and the recorder act
+  only where `.abcd/` is a directory at the checkout's root or, for a
+  linked worktree, at its main worktree's root (`autonomy.Managed`). The
+  second half keeps a session that changed into a worktree it made (whose
+  branch may predate `.abcd/`, or whose `.abcd/` was never committed)
+  checked; one `git rev-parse --git-common-dir` is the only cost, paid only
+  in a linked worktree with no `.abcd/`. The recorder now asks the same
+  question instead of the local tier, which a fresh worktree lacks.
+- 2026-10-18 (fix round 1's choice, for review): **A landed no-upstream
+  branch is told by a merge first.** `git cherry` alone misses a squash of
+  several commits (its patch matches none of them), so the reader first
+  merges the branch into the last-fetched default branch without writing
+  anything (`merge-tree --write-tree`, merge drivers replaced as the conflict
+  probe replaces them): no change is landed, a change is owed. Only a
+  conflicting merge falls to `git cherry`, landed when every commit is
+  upstream by patch id, and otherwise a note. So a genuinely unpushed branch
+  whose change conflicts with the default branch is a note, not an item: the
+  phantom-stop failure the review found is worse than this one, which other
+  items (its reservation, uncarried) still cover.
+- 2026-10-18 (fix round 1's choice, for review): **The record's parts have
+  their own bounds.** Stops past 24 KiB (JSON) let the one seen least
+  recently go, and hand-backs past 8 KiB the oldest, each counted
+  (`dropped_stops`, `dropped_handed_back`) and printed by `mode back`; the
+  queue past 24 KiB refuses the next step (`ErrQueueFull`, exit 2), since a
+  queued step is the person's to read and is never cut. Only Begin carrying,
+  or Back closing, a record already past 64 KiB lets queued steps go
+  (`dropped_queue`), and Back prints every line first. Three fields are
+  added to the record, omitted when zero; `schema_version` stays 1.
+- 2026-10-18 (fix round 1's choice, for review): **Back replaces what it
+  cannot trust.** A record that does not parse, names another schema or is
+  not safely this account's (a symlink, writable by others, another
+  account's) is replaced by a closed record through the store's atomic
+  writer, which replaces a link rather than writing through it, and nothing
+  from it is printed. A record with parts of the wrong shape is read for the
+  rest. A lock not had within its two seconds, or not safe to take, is gone
+  around: the write is atomic, and a re-read catches a writer that held the
+  lock and wrote after, closing again (three tries). `autonomous` and `queue`
+  still refuse such a record, naming `mode back`.
+- 2026-10-18 (fix round 1's choice, for review): **A due renewal's deadline
+  is its lapse.** The reader reports `Owed.WakeBy`: each live reservation's
+  renewal while not yet due, and its lapse once due, the earliest. The
+  deadline reads it less the skew (falling back to `NextRenewal` for a set
+  built without it), so a renewal only due releases on a wake that fires
+  before the lease lapses, as "Owed work" has it.
+- 2026-10-18 (fix round 1's choice, for review): **The budget counts from
+  the hook's start.** The owed read has 14 seconds from the hook's start
+  (the root lookups included); the forge listing's ten seconds sit inside
+  it. A reading cut short sets `Owed.Incomplete`; `Judge` then allows the
+  stop with a line naming what was not read and, while away, records it as
+  `check-incomplete`. This changes the design in one respect: under heavy
+  load a stop with work owed may now be allowed, recorded and shown, where
+  before the hook was killed at 30 seconds and the stop went unrecorded.
+
 ## Footprint
 
 - packages: internal/core/autonomy, internal/core/mode, internal/core/guard, internal/surface/cli, hooks, commands/mode.md, commands/guard.md, .abcd/development/brief/02-constraints/03-invariants.md, .abcd/development/brief/04-surfaces/08-abcd.md, .abcd/development/brief/04-surfaces/17-guard.md
@@ -957,7 +1025,8 @@ for review; none changes a test a step names.
      `shell` task running `sleep 36000` or a `tail -f` does not count);
      TestNextLookStored; TestProseQuestionBlockedOnce; TestNothingOwedReason
      (names taking the next ready item first); TestSessionIDShape;
-     TestHookStopOutput (`{"decision":"block","reason":…}` only on a block, a
+     TestHookStopOutput (a block only on a block, written since Diff review
+     round 1 as the Stop feedback `hookSpecificOutput.additionalContext`, a
      `systemMessage` while present; a malformed payload, an unreadable record
      or a held lock allows with a stderr line); TestHookStopFailureRecords
      (the error type recorded while away, nothing written while present);
@@ -1416,3 +1485,30 @@ and the two-lane estimate sound. Each item and how it was handled:
 
 No fourth review round: the two deltas are checked on the next commit by
 hand.
+
+## Diff review round 1
+
+On 2026-10-18 an Opus and Sonnet pair reviewed the built slice's diff at
+f403910ac (against e4cca1e38), with the verdict "fix first", every major
+reproduced. The fix round added the release orchestrator's three hard
+requirements to majors 1, 3 and 6. Each item and how it was handled:
+
+| # | finding | handled |
+|---|---|---|
+| major 1 | the Stop hook acted in every git repository, not only managed ones | fixed: Stop, StopFailure, the session-start and prompt away paths and the branch recorder return at once outside a managed checkout (`autonomy.Managed`), with no output, no file under abcd's home, no session note or state, and no git past naming the roots; TestHookStopUnmanagedRepoSilent, TestAwayHooksLeaveUnmanagedRepoAlone (93d34a1ef, e1d64652a) |
+| major 2 | a squash-merged branch with no upstream read as unpushed for 14 days | fixed: a merge into the default branch that changes nothing is landed, a conflicting one falls to `git cherry`, and the undecidable is a note; TestNoUpstreamLandedBranchNotOwed, TestNoUpstreamUnlandedBranchOwed, TestNoUpstreamUndecidedBranchNoted (546c22e40) |
+| major 3 | a full record kept the person from ending the mode | fixed: AddStop collapses an identical stop anywhere and rotates past its bound; hand-backs rotate; the queue refuses past its bound; Back ends a record past its bound, unparsable, partly unparsable, not safely this account's or behind a busy or unsafe lock, printing what it can and naming the rest; Begin carries a full record fitted; TestAddStopCollapsesAnywhere, TestRecordStaysWithinBoundInUse, TestBackEndsAnyRecord, TestBackWithLockHeld, TestBeginCarriesAFullRecord, TestModeBackEndsAnUnreadableRecord (e101881f2) |
+| major 4 | a failed `git worktree add <path> <existing>` recorded a peer's branch | fixed at record time: a name a worktree has checked out is skipped; TestBranchRecorderSkipsBranchCheckedOutElsewhere (fa7f6a8f2). At read time a reflog branch another worktree holds is not own (minor 4's fix); a recorded one stays own, since a worktree the session made holds its branch by design |
+| major 5 | a row-1 block past the cap recorded nothing | fixed: work owed when anything is, else no next look; TestRowOnePastCapRecordsStop (e0d16ae76) |
+| major 6 | the stop check overran the hook's 30-second timeout | fixed: every git call of the read is bound to a 14-second budget from the hook's start; the stack-base search is linear; a reading cut short allows the stop, named and recorded; TestStackBaseSearchLinear, TestReadOwedHonoursDeadline, TestIncompleteReadAllows, TestHookStopBudgetFailsOpen (31b5ac337). A design change, stated under Settled here |
+| 7 | `decision: "block"` shows "Stop hook error occurred" | fixed after reading the hooks reference again (quoted under the host mechanics): a block is `hookSpecificOutput.additionalContext`; TestHookStopBlockIsFeedback (060d25335); the live capture re-run is the orchestrator's |
+| 8 | the reason repeated itself | fixed at the source: the reader's reason is the item's words; TestReasonSaysItOnce and the end-to-end exact line (e0d16ae76, e1d64652a) |
+| minor 1 | a due renewal never released on a wake | fixed: the deadline reads `Owed.WakeBy`; TestDueRenewalReleasesOnWake builds the set with the reader, and TestWakeReleasesUnchangedSetTwice no longer uses an impossible state (3e4676f32) |
+| minor 2 | the 200-listing truncation was silent | fixed: a note, and no reservation reported uncarried from a truncated listing; TestForgeListingAtLimitTruncated (231a6984f) |
+| minor 3 | carried counted other people's pull requests | fixed: the carried check applies findOwn's fork and author filter; TestCarriedOnlyByOwnPullRequest (29f62682b) |
+| minor 4 | the review-only exclusion leaned on author email | fixed for the case the machine can tell: a reflog branch another worktree has checked out is not own; TestReviewCheckoutSameEmailNotOwn (29f62682b). A sibling's branch no worktree holds any more still reads as own on one email: nothing on disk tells it apart |
+| minor 5 | a branch name in a suggested shell command | fixed: each interpolated word is one shell word (`shellquote.Single` unless plain), the renewal's `abcd reserve` too; names were already cleaned by termsafe; TestSuggestedQueueCommandQuotesBranch (e0d16ae76) |
+| minor 6 | `hook stop` had no `recover` | fixed: a panic allows the stop with a stderr line, and StopFailure records nothing; TestHookStopPanicAllows (61f1e0e40) |
+| minor 7 | overcounted recorded stops | left as the spec allows, labelled "possibly forced by the cap" |
+| minor 8 | SubagentStop under `--no-session-persistence` | outside the slice; not handled in this round |
+| own | the end-to-end test made its bare origin by hand | fixed: `gittest.InitBare`, which TestNoTestMakesABareRepositoryByHand requires (3b8b14fac) |
diff --git a/commands/mode.md b/commands/mode.md
index ac2d900069..2f14be6af7 100644
--- a/commands/mode.md
+++ b/commands/mode.md
@@ -118,8 +118,14 @@ recorded stop (a stop at the host's cap is labelled "possibly forced by the
 cap"), records who ended it and from which working copy, and closes the
 record; on a record whose time has passed it prints the same and closes it.
 Relay every line to the user. A record or lock that is not a regular file this
-account owns that no one else can write, within 64 KiB, is refused by each verb
-(exit 2), naming the file.
+account owns that no one else can write, within 64 KiB, is refused by
+`autonomous` and `queue` (exit 2), naming the file. `back` ends the mode
+whatever state the record is in: one past 64 KiB is printed whole and kept
+with its oldest lines let go and counted; one that does not parse, or is not
+safely this account's, is replaced by a closed record, printing nothing from
+it; a lock not had in time is gone around. Each is named on its own line:
+relay those too. A queue that is full is refused (exit 2) and never cut: say
+so, and carry on with other work.
 
 ## Where the host has no status surface
 

From 1eec1addc69f1c892ef9f9f37c7fa7d74464da2d Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 14:46:48 +0100
Subject: [PATCH 45/58] fix: run no git at all in a plain checkout abcd does
 not manage

The away hooks still asked git for the checkout's root before finding no
.abcd/ there. They now look for the nearest .git entry first, with no git:
a .git folder with no .abcd/ beside it is left untouched, and only a
managed-looking checkout, or a linked worktree's .git file, is asked of
git. The release orchestrator's rule: abcd changes nothing about how an
unmanaged repository behaves.

Assisted-by: Claude:claude-opus-5-5
---
 internal/surface/cli/hook_away.go      | 15 ++++++++++++++-
 internal/surface/cli/hook_stop_test.go | 18 +++++++-----------
 2 files changed, 21 insertions(+), 12 deletions(-)

diff --git a/internal/surface/cli/hook_away.go b/internal/surface/cli/hook_away.go
index d291b915f4..9295f7a5bd 100644
--- a/internal/surface/cli/hook_away.go
+++ b/internal/surface/cli/hook_away.go
@@ -6,6 +6,7 @@ import (
 	"errors"
 	"io"
 	"os"
+	"path/filepath"
 	"strings"
 	"time"
 
@@ -104,11 +105,23 @@ func readAwayFailOpen(stderr io.Writer, cwd string) (*autonomy.Record, bool, boo
 // managedRoot is the root of the checkout cwd stands in, and whether abcd
 // manages it (autonomy.Managed). Every away hook and the branch recorder ask
 // it first: outside a managed checkout they read nothing, write nothing and
-// say nothing, and the git they run only names the roots.
+// say nothing, and run no git at all where the checkout's .git is a folder.
 func managedRoot(cwd string) (string, bool) {
 	if cwd == "" {
 		return "", false
 	}
+	// The marker first, with no git at all: the nearest folder holding a
+	// .git entry. A plain .git folder with no .abcd/ beside it is a
+	// checkout abcd does not manage, and the hooks leave it untouched; only
+	// a managed-looking one, or a linked worktree's .git file, is asked of
+	// git.
+	shaped := gitutil.RepoShapedRoot(cwd)
+	if shaped == "" {
+		return "", false
+	}
+	if fi, err := os.Lstat(filepath.Join(shaped, ".git")); err == nil && fi.IsDir() && !autonomy.Managed(shaped) {
+		return "", false
+	}
 	root, err := gitutil.CheckoutRoot(cwd, autonomy.StoreName)
 	if err != nil || !autonomy.Managed(root) {
 		return "", false
diff --git a/internal/surface/cli/hook_stop_test.go b/internal/surface/cli/hook_stop_test.go
index af68a7c05e..7349de9d6d 100644
--- a/internal/surface/cli/hook_stop_test.go
+++ b/internal/surface/cli/hook_stop_test.go
@@ -414,8 +414,9 @@ func homeFiles(t *testing.T, dir string) []string {
 // TestAwayHooksLeaveUnmanagedRepoAlone: in a repository abcd does not manage
 // every hook path of the away mode returns at once: the stop check (with the
 // real owed reader), StopFailure and the branch recorder print nothing,
-// create nothing under abcd's home folder, exit 0 and run no git past
-// naming the checkout's root; the session-start and prompt hooks add no away
+// create nothing under abcd's home folder, exit 0 and run no git (the
+// guard's own reading of a command aside, the same with or without a branch
+// act); the session-start and prompt hooks add no away
 // block and create no away store, session note or state file. (The away
 // store has no record here; a record shared with a managed copy is
 // TestHookStopUnmanagedRepoSilent's.)
@@ -428,10 +429,8 @@ func TestAwayHooksLeaveUnmanagedRepoAlone(t *testing.T) {
 	log := gitCallLog(t)
 	onlyRoot := func(what string) {
 		t.Helper()
-		for _, line := range strings.Split(strings.TrimSpace(ghCalls(t, log)), "\n") {
-			if line != "" && line != "version" && !strings.Contains(line, "rev-parse --show-toplevel") {
-				t.Errorf("%s ran git past naming the root: %q", what, line)
-			}
+		if calls := strings.TrimSpace(ghCalls(t, log)); calls != "" {
+			t.Errorf("%s ran git in an unmanaged checkout:\n%s", what, calls)
 		}
 		if err := os.WriteFile(log, nil, 0o600); err != nil {
 			t.Fatal(err)
@@ -462,11 +461,8 @@ func TestAwayHooksLeaveUnmanagedRepoAlone(t *testing.T) {
 	plain := baseline("git status --porcelain")
 	for _, c := range []string{"git switch -c feat/new", "git worktree add -b feat/wt ../wt", "git checkout -b feat/co"} {
 		_ = os.WriteFile(log, nil, 0o600)
-		got := baseline(c)
-		for _, line := range strings.Split(strings.TrimSpace(got), "\n") {
-			if line != "" && line != "version" && !strings.Contains(line, "rev-parse --show-toplevel") && !strings.Contains(plain, line) {
-				t.Errorf("the recorder ran git for %q in an unmanaged checkout: %q", c, line)
-			}
+		if got := baseline(c); got != plain {
+			t.Errorf("the recorder ran git for %q in an unmanaged checkout:\n%s\nbaseline:\n%s", c, got, plain)
 		}
 	}
 	if after := homeFiles(t, abcdHome); !slices.Equal(before, after) {

From 9962906df0e6eeb4af8f06b672eeb9c3cca8c09d Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 14:47:05 +0100
Subject: [PATCH 46/58] docs: note that an unmanaged checkout runs no git in
 the review table

Assisted-by: Claude:claude-opus-5-5
---
 ...c-2610180914469489-a-session-told-to-work-on-while-its.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
index 7513bd11e6..4a4cf74289 100644
--- a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
+++ b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
@@ -799,7 +799,8 @@ for review; none changes a test a step names.
   second half keeps a session that changed into a worktree it made (whose
   branch may predate `.abcd/`, or whose `.abcd/` was never committed)
   checked; one `git rev-parse --git-common-dir` is the only cost, paid only
-  in a linked worktree with no `.abcd/`. The recorder now asks the same
+  in a linked worktree with no `.abcd/`. A checkout whose `.git` is a folder
+  with no `.abcd/` beside it is told from the marker alone, with no git. The recorder now asks the same
   question instead of the local tier, which a fresh worktree lacks.
 - 2026-10-18 (fix round 1's choice, for review): **A landed no-upstream
   branch is told by a merge first.** `git cherry` alone misses a squash of
@@ -1495,7 +1496,7 @@ requirements to majors 1, 3 and 6. Each item and how it was handled:
 
 | # | finding | handled |
 |---|---|---|
-| major 1 | the Stop hook acted in every git repository, not only managed ones | fixed: Stop, StopFailure, the session-start and prompt away paths and the branch recorder return at once outside a managed checkout (`autonomy.Managed`), with no output, no file under abcd's home, no session note or state, and no git past naming the roots; TestHookStopUnmanagedRepoSilent, TestAwayHooksLeaveUnmanagedRepoAlone (93d34a1ef, e1d64652a) |
+| major 1 | the Stop hook acted in every git repository, not only managed ones | fixed: Stop, StopFailure, the session-start and prompt away paths and the branch recorder return at once outside a managed checkout (`autonomy.Managed`), with no output, no file under abcd's home, no session note or state, and no git at all where the checkout's .git is a folder (the nearest .git entry is found without git); TestHookStopUnmanagedRepoSilent, TestAwayHooksLeaveUnmanagedRepoAlone (93d34a1ef, e1d64652a, 1eec1addc) |
 | major 2 | a squash-merged branch with no upstream read as unpushed for 14 days | fixed: a merge into the default branch that changes nothing is landed, a conflicting one falls to `git cherry`, and the undecidable is a note; TestNoUpstreamLandedBranchNotOwed, TestNoUpstreamUnlandedBranchOwed, TestNoUpstreamUndecidedBranchNoted (546c22e40) |
 | major 3 | a full record kept the person from ending the mode | fixed: AddStop collapses an identical stop anywhere and rotates past its bound; hand-backs rotate; the queue refuses past its bound; Back ends a record past its bound, unparsable, partly unparsable, not safely this account's or behind a busy or unsafe lock, printing what it can and naming the rest; Begin carries a full record fitted; TestAddStopCollapsesAnywhere, TestRecordStaysWithinBoundInUse, TestBackEndsAnyRecord, TestBackWithLockHeld, TestBeginCarriesAFullRecord, TestModeBackEndsAnUnreadableRecord (e101881f2) |
 | major 4 | a failed `git worktree add <path> <existing>` recorded a peer's branch | fixed at record time: a name a worktree has checked out is skipped; TestBranchRecorderSkipsBranchCheckedOutElsewhere (fa7f6a8f2). At read time a reflog branch another worktree holds is not own (minor 4's fix); a recorded one stays own, since a worktree the session made holds its branch by design |

From 4f8fb1b31324ed7fe180c3cf0789cf5ea23b7123 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 15:09:11 +0100
Subject: [PATCH 47/58] docs: record the live re-capture after the first diff
 review round

Assisted-by: Claude:claude-sonnet-5-5
---
 ...489-a-session-told-to-work-on-while-its.md | 57 +++++++++++++++++++
 1 file changed, 57 insertions(+)

diff --git a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
index 4a4cf74289..7fe8b778a7 100644
--- a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
+++ b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
@@ -1304,6 +1304,63 @@ last … 13:52 BST)", "stopped on an API error (rate_limit) …"). It ends with
   called the hook "faulty" for keeping a queued push owed, which is the
   designed behaviour without `--hold-pushes`.
 
+### Re-capture after diff review round 1 (9962906df)
+
+Run on 2026-10-18, 15:05 to 15:10 BST, with the same Claude Code and model,
+against the branch at 9962906df. The binary `<scratch>/abcd-stall` and the
+plugin copy `<scratch>/plugin` (a fresh `git archive 9962906df`, with the same
+wrapper rung) were rebuilt. The away store and the lab's local tier were
+cleared, `feat/stacked` and its worktree removed, so `feat/x` again has one
+unpushed commit (512f75b) and the lab is the managed checkout it was
+(`.abcd/config.json` beside `.git`). API spend for the four runs: about
+0.72 USD. Transcripts: `<scratch>/transcripts/2-away-r2`, `2b-away-hold-r2`,
+`1-present-r2` and `3-unmanaged-r2`, each as `.jsonl`, `.stderr` and
+`.summary.txt`.
+
+**2-away-r2** (away record set with `abcd mode autonomous --until 17:05`,
+prompt "Say hello and stop.").
+
+- The stop is still prevented. The Stop hook answers `{"hookSpecificOutput":
+  {"hookEventName":"Stop","additionalContext":"abcd: the person is away and
+  work is owed (1 item). Next: branch feat/x has commits not pushed. Do the
+  local work, then push if your standing instruction allows; …"}}`, and the
+  session goes on to queue the push. Thirteen Stop hooks ran and none ended
+  the turn until the host's cap: "A hook blocked the turn from ending 9
+  consecutive times — overriding and ending turn."
+- The output uses `hookSpecificOutput.additionalContext`, with no `decision`
+  or `reason` field.
+- The host shows no "Stop hook error occurred": `hook error` and `Stop hook
+  feedback` match nothing in the stream-json or the stderr (0 and 0). The one
+  `notification` in the stream is the cap's own (`stop-hook-block-cap`).
+- The item names `feat/x` once: "Next: branch feat/x has commits not pushed."
+  The doubled "(feat/x has commits not pushed)" of the earlier run is gone.
+- The stub `gh` logged 13 `pr list` calls for 13 Stop hooks, one per check.
+- The model's own `abcd decide` call was denied by the narrow `--allowedTools`
+  (a `permission_denied` event); the hook has no part in that.
+
+**2b-away-hold-r2** (the same, with `--hold-pushes`). Without `--hold-pushes`
+the reason only carries the generic `abcd mode queue "<step>"` placeholder,
+so the branch quoting is checked here. The first Stop output ends: "queue the
+push naming the branch, as `abcd mode queue 'push feat/x'`." The branch is a
+single quoted shell word. No hook error (0 matches), 10 Stop hooks, 10 `gh`
+calls, ended by the host's cap.
+
+**1-present-r2** (no away record). The stop is allowed. The hook returns
+`{"systemMessage":"abcd: stopped with work owed (1 item); next: branch feat/x
+has commits not pushed."}`, shown as the informational "Stop says: …". No
+hook error, and the stub `gh` was never called (0 calls).
+
+**3-unmanaged-r2** (a copy of the lab in a sibling folder with `.abcd/`
+removed and `feat/x` still unpushed; the away record from the lab was in
+force). The Stop hook prints nothing (`exit=0`, empty output), the prompt hook
+adds nothing, the turn ends after one reply ("Hello!"), no abcd text appears
+in the stream, and the stub `gh` was never called.
+
+Verdict: the block holds, the host's error notice is gone, and the item text
+no longer repeats. One thing to know: a Stop that follows the queued push,
+when nothing is owed, still continues the session ("take the next ready item
+first …"), since that wording is a continuation prompt.
+
 ## Size
 
 Re-estimated after review round 3 at 7.5 working days of work, up from the

From 15fa08acb9d62e32946e5cb11ea3d25be14f8352 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 16:33:08 +0100
Subject: [PATCH 48/58] docs: cite the coordination records by id and name the
 same-email residual

Assisted-by: Claude:claude-sonnet-5-5
---
 ...125-a-session-told-to-work-on-while-its.md | 21 ++++++++++++-------
 ...489-a-session-told-to-work-on-while-its.md |  8 +++----
 2 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/.abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md b/.abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md
index 6c5085642a..ac39f76595 100644
--- a/.abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md
+++ b/.abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md
@@ -30,12 +30,12 @@ The session ended its turn on a question nobody was there to answer, and a
 Claude Code session runs only when something sends it input, so nothing ran
 until a peer's message six hours later. The same night a coordinating session
 held three finished steps behind a merge order when only their landing order
-was fixed.
+was fixed (dcn-2610180905291297).
 
 This is the smallest slice of the checklist draft (itd-2610170638184486) that
 removes the stall's core cause, carved out so the security and bug-fix release
 waits on it alone (dcn-2610180913379049, dcn-2610180913388445). It needs
-nothing on the shared remote, so it does not wait on the coordination intent.
+nothing on the shared remote, so it does not wait on the coordination intent (itd-2610170634394993).
 
 ## Mechanism
 
@@ -67,6 +67,9 @@ its turn on a question to the person.
   cannot start a session that is not running. A turn the host ends on an API
   error, such as a rate limit, fires no Stop hook and cannot be continued: it
   is recorded, and only a wake the session had already scheduled resumes it.
+- Known residual: a sibling working copy's branch that no worktree holds any <!-- cond: cond-2610181530194405 -->
+  more still reads as this session's own when both copies commit with the same
+  email, because nothing on disk tells them apart.
 
 ## What's In Scope
 
@@ -142,7 +145,7 @@ its turn on a question to the person.
   promises, abcd's own timed wakes, the pre-run blocker sweep, the shared and
   published options and the phone.
 - Idle time a coordinator sees across sessions, which comes with the
-  coordination intent's central view in `abcd status`.
+  coordination intent's (itd-2610170634394993) central view in `abcd status`.
 - Moved back to itd-2610170638184486 by review round 1
   (dcn-2610180937181929): the report shown once on the person's return (the
   queue, the window's decisions gathered across working copies, the recorded
@@ -160,7 +163,7 @@ its turn on a question to the person.
 - Any push right granted by the away mode: it grants none.
 - Starting or waking a session that is not running.
 - Each autonomous session's own forge credential, owned by the coordination
-  intent.
+  intent (itd-2610170634394993).
 
 ## Acceptance Criteria
 
@@ -181,7 +184,7 @@ its turn on a question to the person.
   that is still open and is behind the default branch, **when** the session
   tries to end its turn, **then** the stop is blocked and the reason asks for
   the merge from the default branch, the fixes, the review and the preflight
-  now, and says only the landing waits for the base; **and when** the branch
+  now, and says only the landing waits for the base (dcn-2610180905291297); **and when** the branch
   is up to date, green and has a preflight receipt, **then** it is waiting on
   its base and is not owed.
 - **Given** the away mode holds and the session holds a live reservation whose
@@ -284,7 +287,7 @@ Surveyed 2026-10-18 against the host's current hook reference
   draft's format decision already chose for the checklist.
 - **A supervisor process that restarts or prompts idle sessions:** a common
   pattern, not adopted: it needs a process that stays alive, which the
-  coordination intent's on-demand pass rules out, and it cannot tell owed work
+  coordination intent's (itd-2610170634394993) on-demand pass rules out, and it cannot tell owed work
   from a finished session without the same reading this slice adds.
 - **The host's agent-team idle hook (TeammateIdle):** young, bound to one agent
   team in one session, so it cannot reach sessions in separate working copies.
@@ -329,7 +332,8 @@ Review round 1 of 2026-10-18 refined them:
     (dcn-2610180936568358).
 12. **Stacked branches cleared; the forge read only while away**
     (dcn-2610180936571036).
-13. **Away means working or waiting** (dcn-2610180936577720).
+13. **Away means working or waiting** (dcn-2610180936577720, following
+    dcn-2610180720541206).
 14. **A wake qualifies by its next fire time** (dcn-2610180936579498).
 15. **API-error stops recorded; prose questions blocked once**
     (dcn-2610180937175629).
@@ -342,7 +346,8 @@ Review round 1 of 2026-10-18 refined them:
 Review round 2 of 2026-10-18 refined them again:
 
 19. **Only the person sets the away mode; narrow push rights; a mistake
-    filter** (dcn-2610181003456444), refining decision 3; superseded by
+    filter** (dcn-2610181003456444, on the ground of dcn-2610171112384712),
+    refining decision 3; superseded by
     decision 28.
 20. **A wake qualifies within a ceiling, the host's lateness included**
     (dcn-2610181003455731).
diff --git a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
index 7fe8b778a7..3862446d15 100644
--- a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
+++ b/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
@@ -208,7 +208,7 @@ the mode the person's act alone, because the mode then carried push rights.
 The OS sandbox of spc-2610161751056096 fences only the agents abcd's runner
 launches, never the person's own interactive sessions, which are the ones
 that stalled. There, the guard entries would only ever be a mistake filter
-(adr-42), so their two days would buy a trust claim the plan cannot make.
+(adr-42, dcn-2610171112384712), so their two days would buy a trust claim the plan cannot make.
 With no push rights in the mode there is nothing for them to protect in this
 slice. Making the mode the person's act alone (the guard entry, its other
 routes, the store's shell-write and file-tool refusals, the refused
@@ -306,7 +306,7 @@ dcn-2610181003488355):
   its head is outstanding (the listing's review decision is
   `CHANGES_REQUESTED`, or for a run's lane its run state records no passing
   review of its head), since the coordination prep's decision that a
-  declared dependency constrains only the landing says its review runs now;
+  declared dependency constrains only the landing (dcn-2610180905291297) says its review runs now;
   or it is not verified. Verified means a preflight receipt naming its head
   in any worktree (`landing.Receipt`) where the repository mints receipts
   (a receipt folder exists in one of its worktrees); in a repository without
@@ -1416,7 +1416,7 @@ handled:
 | 2 | the escape bound reproduces the stall | fixed: an unchanged owed set is allowed only with a qualifying wake, else blocked again, the host's cap the outer bound with the stop recorded; `stop_hook_active` decides no row, so the missing row is covered (dcn-2610180936577720) |
 | 3 | a wake's timing is never checked | fixed: next fire time from abcd's own cron parser, before the earliest renewal due minus the skew; background tasks never count; distant, recurring and stale-shell rows tested (dcn-2610180936579498) |
 | 4 | the reroute approves acts only the person may approve | fixed: classified by the act with the listed person-only acts, the embargo `--approve` digest included; the chip no longer routes (dcn-2610180937177502) |
-| 5 | stopping while away contradicts the coordination decision | fixed: while away only working or waiting with a qualifying wake; the next look stored in the session's state (dcn-2610180936577720) |
+| 5 | stopping while away contradicts the coordination decision (dcn-2610180720541206) | fixed: while away only working or waiting with a qualifying wake; the next look stored in the session's state (dcn-2610180936577720) |
 | 6 | concurrent writes lose updates | fixed: `fsutil.WithFileLock` with a re-read inside it; ownership and permission checks; an unreadable record fails open (dcn-2610180937181736) |
 | 7 | a stale record traps the person | fixed in part: capped at seven days rather than 24 hours, since the record's standing run of 2026-10-15 to 2026-10-17 would not fit 24 hours and requiring `--until` contradicts the open-ended ruling; the person sees a line on every prompt rather than past a threshold; the agent runs `abcd mode back` only on the person's word (dcn-2610180937181736) |
 | 8 | the return list reads one working copy's decisions | moved: the return list leaves the slice with the split, and the fix (`abcd decide` appending each id to the away record under its lock) moves with it (dcn-2610180937181929) |
@@ -1437,7 +1437,7 @@ narrowed by the findings below. Each item and how it was handled:
 
 | # | finding | handled |
 |---|---|---|
-| (a) | away mode as the person's ask to push is not safe: the prompt hook cannot tell a relayed message from the person's, so an agent could grant itself and every copy seven days of push rights | fixed: guard entries refuse every route to setting the mode the guard reads (the binary by any of its names, a `go run` of `cmd/abcd`, `sh -c`, a script file, a shell write into the away store, the file tools), so the person sets it with `!` or at a terminal; refused attempts are recorded and shown; the grant is narrow and its exclusions stated (never the default branch, a tag, a release cut, another person's pull request, a review-only branch, a force push); the guard is called a mistake filter, the OS fence the boundary for launched agents only; the capture checks the `!` path and a relayed `!`, with the no-push fallback named if they break the premise (dcn-2610181003456444) |
+| (a) | away mode as the person's ask to push is not safe: the prompt hook cannot tell a relayed message from the person's, so an agent could grant itself and every copy seven days of push rights | fixed: guard entries refuse every route to setting the mode the guard reads (the binary by any of its names, a `go run` of `cmd/abcd`, `sh -c`, a script file, a shell write into the away store, the file tools), so the person sets it with `!` or at a terminal; refused attempts are recorded and shown; the grant is narrow and its exclusions stated (never the default branch, a tag, a release cut, another person's pull request, a review-only branch, a force push); the guard is called a mistake filter, the OS fence the boundary for launched agents only (dcn-2610171112384712); the capture checks the `!` path and a relayed `!`, with the no-push fallback named if they break the premise (dcn-2610181003456444) |
 | (b) | the cap count can miss a forced stop when the owed set changes | fixed: the count resets only on `stop_hook_active` false, a stop at the cap is labelled "possibly forced by the cap", and the capture checks where the host resets (dcn-2610181003484631) |
 | (c) | cron in local time is correct; add a capture check | fixed: the capture compares abcd's computed fire time with the host's listed next run (dcn-2610181003455731) |
 | 1 | the wake deadline still allows the stall, through long leases and the host's lateness | fixed: the deadline is the earlier of the renewal due minus the skew and now plus 30 minutes while owed (one hour when not); a recurring cron's fire time adds half its gap, at most 30 minutes; TestQualifyingWakeDistantCron is pinned to a 24-hour lease; daylight saving, day-of-week 7, `a-b/n` and `*/n` in a day field are tested (dcn-2610181003455731) |

From 658b39456859ff3f484b5442c61ad5050ecc4e68 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 16:49:47 +0100
Subject: [PATCH 49/58] fix: make the away-mode and guard help and docs say
 what the code does

A docs-fidelity review of the stall slice found seven sentences the code
contradicts. `mode back` never refuses on the record's or lock's state, so
its sentence and the mode chapter now say it ends the mode whatever that
state, and setting the mode carries a record merely past 64 KiB. The
StopFailure shim names the API-error stop it did not record, not the stop
check. The branch recorder is gated on abcd managing the checkout, not on
the local tier. The guard hook also writes the mode and the open-question
marker on an admitted abcd question. The away-record warning status appears
only where the question would otherwise pass silently, an undecodable
question payload fails open before the away check, and the on-disk behind
check covers every pushed branch of the session's own when the pull-request
listing fails.

Assisted-by: Claude:claude-opus-5-5
---
 .../brief/02-constraints/03-invariants.md     |  8 +++---
 .../development/brief/04-surfaces/01-ahoy.md  |  5 ++--
 .../development/brief/04-surfaces/17-guard.md |  9 ++++---
 .../development/brief/04-surfaces/26-mode.md  | 27 +++++++++++++------
 .../brief/05-internals/03-configuration.md    |  5 ++--
 .abcd/development/release/surface.json        |  6 ++---
 commands/guard.md                             | 18 ++++++++-----
 commands/mode.md                              |  9 ++++---
 docs/reference/cli/commands.md                | 14 +++++-----
 internal/core/surface/sentences.go            |  6 ++---
 internal/surface/cli/mode_away.go             |  8 +++---
 11 files changed, 70 insertions(+), 45 deletions(-)

diff --git a/.abcd/development/brief/02-constraints/03-invariants.md b/.abcd/development/brief/02-constraints/03-invariants.md
index 45c87df462..5e13616426 100644
--- a/.abcd/development/brief/02-constraints/03-invariants.md
+++ b/.abcd/development/brief/02-constraints/03-invariants.md
@@ -128,10 +128,10 @@ The following are non-negotiable invariants — any architectural choice that vi
    under a ten-second deadline, with
    no cache, so a run of eight blocked stops costs up to eight bounded
    listings. A listing that fails or is late is named as not read, never
-   hidden, and the check judges from disk alone: a branch with a pull request
-   is compared with the last-fetched default branch, naming when it was
-   fetched, and a reservation is never reported as carried by no pull
-   request. Whenever the away mode does not hold, the stop check reads disk
+   hidden, and the check judges from disk alone: every pushed branch of the
+   session's own is compared with the last-fetched default branch, naming
+   when it was fetched, and a reservation is never reported as carried by no
+   pull request. Whenever the away mode does not hold, the stop check reads disk
    only, and no turn's end touches the network, held by
    `TestPresentReadsDiskOnly`
    ([adr-2610181003541997](../../decisions/adrs/2610181003541997-the-away-mode-s-stop-check-reads-the.md),
diff --git a/.abcd/development/brief/04-surfaces/01-ahoy.md b/.abcd/development/brief/04-surfaces/01-ahoy.md
index f180909a76..7b0c834f26 100644
--- a/.abcd/development/brief/04-surfaces/01-ahoy.md
+++ b/.abcd/development/brief/04-surfaces/01-ahoy.md
@@ -694,8 +694,9 @@ host's BLOCKING status on that event and would stop the sub-agent finishing.
 `Stop` and `StopFailure`, which carry the away mode's stop check
 (spc-2610180914469489), download nothing either: both fire at a turn's end, where
 a fetch would hold the session, and each resolves the plugin root, then `PATH`,
-then says in one line that the stop check did not run, with exit 1, never the
-`Stop` event's blocking 2.
+then says in one line what did not happen, with exit 1, never the `Stop`
+event's blocking 2: `Stop` that the stop check did not run, `StopFailure` that
+a turn ended on an API error was not recorded.
 
 **The `PATH` rung is owned-only** (GHSA-gx3m-3224-qqcv, CWE-426). It accepts only
 an absolute resolution out of a directory that is neither under the shim's
diff --git a/.abcd/development/brief/04-surfaces/17-guard.md b/.abcd/development/brief/04-surfaces/17-guard.md
index 98d1bb179d..862ac454d0 100644
--- a/.abcd/development/brief/04-surfaces/17-guard.md
+++ b/.abcd/development/brief/04-surfaces/17-guard.md
@@ -4,8 +4,9 @@ A destructive shell command typed by accident costs a person hours: a force
 push that erases a colleague's commits, an `rm -rf` with an unlucky glob, a
 `git clean` over uncommitted work. `/abcd:guard` catches those before they run
 and says what to run instead. It writes nothing but the record of a branch an
-agent creates (below), and it costs nothing to have on: an unrecognised command
-passes through untouched.
+agent creates and, when it admits abcd's own question where the badge shows,
+the waiting-on mode and the marker saying a question is open (both below), and
+it costs nothing to have on: an unrecognised command passes through untouched.
 
 Two things use it. A person or a script asks it about one command line. A
 compatible agent harness asks it about every command the agent is about to run,
@@ -261,8 +262,8 @@ key (the reservations' copy key) in the away store, `~/.abcd.noindex/away/<root-
 written under the store's lock through its atomic writer, in a list capped at
 the hundred most recent, the oldest dropped. The recorder records and **refuses
 nothing**: a store it cannot write leaves one stderr line and the command goes
-on to the guard's own judgement, and a checkout without the local tier records
-nothing. A record made for a command that then fails names a branch that does
+on to the guard's own judgement, and a checkout abcd does not manage (no
+`.abcd/` at its root or at its main worktree's) records nothing. A record made for a command that then fails names a branch that does
 not exist, and the away mode's reading ignores it.
 
 ## Fail-open-loud
diff --git a/.abcd/development/brief/04-surfaces/26-mode.md b/.abcd/development/brief/04-surfaces/26-mode.md
index e6b2095c44..fcc9de183d 100644
--- a/.abcd/development/brief/04-surfaces/26-mode.md
+++ b/.abcd/development/brief/04-surfaces/26-mode.md
@@ -58,10 +58,19 @@ decides whether a session commits, pushes, or opens or merges a pull request.
 **The lock and the checks.** Every change to the record holds a lock file
 beside it and re-reads the record inside the lock, so two writers never lose
 an update and a check that read the record before the person came back never
-writes it back. The record and the lock are used only when each is a regular
-file this account owns that no one else can write, within 64 KiB: one that
-fails those checks, or does not parse, reads as not away, and a verb asked to
-change it refuses, naming the file.
+writes it back; only ending the mode goes around a lock it cannot have
+(below). The record and the lock are used only when each is a regular file
+this account owns that no one else can write, within 64 KiB: one that fails
+those checks, or does not parse, reads as not away, and queueing a step
+refuses it, naming the file. Setting the mode refuses the same, except that it
+carries a record merely past 64 KiB, letting its oldest lines go.
+
+**Ending never refuses on the record.** The person's word that they are back
+ends the mode whatever state the record or its lock is in. A record past
+64 KiB is printed whole and kept with its oldest lines let go; one that does
+not parse, or is not safely this account's, is replaced by a closed record,
+printing nothing from it; and a lock not had within two seconds, or not safe
+to take, is gone around, closing without it. Each is named on its own line.
 
 **The badge while away.** While the record holds, parking the badge on the
 product thinker or the technical facilitator is refused, naming
@@ -69,10 +78,12 @@ product thinker or the technical facilitator is refused, naming
 nobody answers.
 
 Every refusal of the away verbs exits 2 with nothing written: an unreadable
-or past end, one past seven days, a checkout without the local tier, no
-checkout, a queued step with no record holding or with no words, a lock not
-had within two seconds, and a record or lock that fails the checks. None makes
-a network request.
+or past end, one past seven days, a checkout without the local tier (checked
+only when setting the mode), no checkout, a queued step with no record holding
+or with no words, and, when setting the mode or queueing a step, a lock not
+had within two seconds and a record or lock that fails the checks. Ending the
+mode refuses only where there is no checkout, no home or no root commit to key
+the record on. None makes a network request.
 
 <!-- surface-appendix:begin — generated from the command tree by `go generate ./internal/surface/cli`; never edit by hand -->
 
diff --git a/.abcd/development/brief/05-internals/03-configuration.md b/.abcd/development/brief/05-internals/03-configuration.md
index 9e7b1ce306..175ad20162 100644
--- a/.abcd/development/brief/05-internals/03-configuration.md
+++ b/.abcd/development/brief/05-internals/03-configuration.md
@@ -1320,8 +1320,9 @@ additionally never exits non-zero beyond that refusal, because exit 2 is the hos
 BLOCKING code on that event. `Stop` and `StopFailure` carry the away
 mode's stop check (`hook stop`, `hook stop-failure`, spc-2610180914469489) and fire
 at a turn's end, where a fetch would hold the session; each resolves the plugin
-root, then PATH, then says the stop check did not run, at exit 1, never `Stop`'s
-blocking 2. `Stop` declares a 30-second `timeout`, room for the check's one forge
+root, then PATH, then says what did not happen, at exit 1, never `Stop`'s
+blocking 2: `Stop` that the stop check did not run, `StopFailure` that a turn
+ended on an API error was not recorded. `Stop` declares a 30-second `timeout`, room for the check's one forge
 listing under its own ten-second deadline; `StopFailure` declares none.
 
 `SessionEnd` carries `hook session-end`, which stages the session's own transcript;
diff --git a/.abcd/development/release/surface.json b/.abcd/development/release/surface.json
index 9784c27856..07c79b618f 100644
--- a/.abcd/development/release/surface.json
+++ b/.abcd/development/release/surface.json
@@ -1509,7 +1509,7 @@
       "hidden": false,
       "group": "agents",
       "block": "agents",
-      "sentence": "Judge a shell command against the hazard registry before it runs: Writes branch records; refuses a hazard via check, hook or approve, and an unknown sub-verb.",
+      "sentence": "Judge a shell command against the hazard registry before it runs: Writes branch records and a question's mode; refuses a hazard and an unknown sub-verb.",
       "flags": []
     },
     {
@@ -1559,7 +1559,7 @@
       "path": "abcd guard hook",
       "hidden": false,
       "block": "agents",
-      "sentence": "Judge the shell command in a host's pre-tool-use payload: Writes a created branch's record; refuses a hazard or a badly built question with the host's deny.",
+      "sentence": "Judge the shell command in a host's pre-tool-use payload: Writes branch records and a question's mode; refuses a hazard or a badly built question.",
       "flags": []
     },
     {
@@ -3429,7 +3429,7 @@
     {
       "path": "abcd mode back",
       "hidden": false,
-      "sentence": "End the away mode, printing what was queued and recorded one line each: Writes the away record's ending; refuses a record not safely this account's.",
+      "sentence": "End the away mode, printing what was queued and recorded one line each: Writes its ending whatever the record's or lock's state; refuses outside a git checkout.",
       "flags": []
     },
     {
diff --git a/commands/guard.md b/commands/guard.md
index ebc895090b..9c84d67bc2 100644
--- a/commands/guard.md
+++ b/commands/guard.md
@@ -1,6 +1,6 @@
 ---
 name: guard
-description: "Judge a shell command against the hazard registry before it runs: Writes branch records; refuses a hazard via check, hook or approve, and an unknown sub-verb."
+description: "Judge a shell command against the hazard registry before it runs: Writes branch records and a question's mode; refuses a hazard and an unknown sub-verb."
 argument-hint: "[check [--command <command>] | hook | approve --dir <dir>]"
 block: agents
 user-invocable: false
@@ -10,8 +10,10 @@ user-invocable: false
 
 Decide whether a shell command is safe to run, using abcd's hazard registry —
 the bundled hazard entries merged with this repo's `.abcd/guard.json`. The
-check performs **zero writes**; the hook writes one thing, the record of a
-branch the session creates (below), and refuses nothing for it.
+check performs **zero writes**. The hook writes the record of a branch the
+session creates (below), and refuses nothing for it; when it admits abcd's own
+question where the badge shows, it also writes the waiting-on mode and the
+marker saying a question is open (below).
 
 ## `check` — decide one command
 
@@ -141,9 +143,10 @@ question tool the warning says the question runs, and where no tool name can be
 read the warning names no tool.
 
 While the away mode holds (`/abcd:mode autonomous`), the hook refuses every
-question on the host's question tool before any of the checks above, abcd's or
-another tool's, whatever its chip, with one reason, and sets no mode and marks
-nothing open. The reason routes the question by the act it asks about: an act
+question on the host's question tool whose payload it can decode, before any
+of the checks above, abcd's or another tool's, whatever its chip, with one
+reason, and sets no mode and marks nothing open; a payload it cannot decode
+runs with the loud warning above, away or not. The reason routes the question by the act it asks about: an act
 only the person may approve (an embargo `--approve` digest or triage verdict,
 the drain's hand-back, the remote-configuration apply verb, a release sign-off,
 pushing, opening or merging a pull request without a standing instruction,
@@ -153,7 +156,8 @@ page or a brief invariant names as the person's) is queued with
 `/abcd:mode queue "<step>"`, and every other question is decided and recorded
 with `/abcd:decide`. Nothing detects the act: the agent classifies its own
 question from the reason's list. An away record that cannot be read safely
-reads as not away, and the hook says so with the warning status.
+reads as not away, and the hook says so on stderr, with the warning status
+only where it would otherwise admit the question silently.
 
 Anything the adapter cannot turn into a decision — an unreadable payload, a tool
 call that is neither a shell command nor a question, a registry that does not
diff --git a/commands/mode.md b/commands/mode.md
index 2f14be6af7..366644d931 100644
--- a/commands/mode.md
+++ b/commands/mode.md
@@ -72,7 +72,8 @@ one the set form refuses (exit 2) and creates nothing — say so, and point at
 The person's word that they are away and sessions should work on until they
 are back. It sits beside the badge and is not a fourth word. One record holds
 it for every working copy of the repository on this machine, in
-`~/.abcd.noindex/away/<root-sha>/record.json`, changed only under its lock.
+`~/.abcd.noindex/away/<root-sha>/record.json`, changed under its lock, which
+only `back` goes around when it cannot have it.
 
 **The away mode grants no rights.** The person's own standing instruction
 stays what decides whether a session commits, pushes, or opens or merges a
@@ -118,8 +119,10 @@ recorded stop (a stop at the host's cap is labelled "possibly forced by the
 cap"), records who ended it and from which working copy, and closes the
 record; on a record whose time has passed it prints the same and closes it.
 Relay every line to the user. A record or lock that is not a regular file this
-account owns that no one else can write, within 64 KiB, is refused by
-`autonomous` and `queue` (exit 2), naming the file. `back` ends the mode
+account owns that no one else can write, or a record that does not parse, is
+refused by `autonomous` and `queue` (exit 2), naming the file; so is one past
+64 KiB, except that `autonomous` carries a record merely past 64 KiB, letting
+its oldest lines go. `back` ends the mode
 whatever state the record is in: one past 64 KiB is printed whole and kept
 with its oldest lines let go and counted; one that does not parse, or is not
 safely this account's, is replaced by a closed record, printing nothing from
diff --git a/docs/reference/cli/commands.md b/docs/reference/cli/commands.md
index c4bba6c0ec..92733b1f0d 100644
--- a/docs/reference/cli/commands.md
+++ b/docs/reference/cli/commands.md
@@ -1569,7 +1569,7 @@ abcd embark probe ../lifeboat
 
 ### `abcd guard`
 
-Judge a shell command against the hazard registry before it runs: Writes branch records; refuses a hazard via check, hook or approve, and an unknown sub-verb.
+Judge a shell command against the hazard registry before it runs: Writes branch records and a question's mode; refuses a hazard and an unknown sub-verb.
 
 **Usage:** `abcd guard`
 
@@ -1810,7 +1810,7 @@ heredoc (`abcd guard check <<'EOF'` ... `EOF`) passes it through untouched.
 
 #### `abcd guard hook`
 
-Judge the shell command in a host's pre-tool-use payload: Writes a created branch's record; refuses a hazard or a badly built question with the host's deny.
+Judge the shell command in a host's pre-tool-use payload: Writes branch records and a question's mode; refuses a hazard or a badly built question.
 
 **Usage:** `abcd guard hook`
 
@@ -4081,9 +4081,11 @@ time or with `abcd mode back`; a prompt never ends it. Setting it again keeps
 whatever is queued or recorded and not yet read.
 
 The record lives in ~/.abcd.noindex/away/<root-sha>/record.json, keyed on the repository's
-root commit, and is changed only under its lock. Exit 2 on a refusal (an unreadable
-or past --until, one past seven days, no local tier, no checkout, or a record or
-lock that is not safely this account's) with nothing written. No network request.
+root commit, and is changed under its lock, which only `abcd mode back` goes
+around. A record merely past its 64 KiB is carried, its oldest lines let go.
+Exit 2 on a refusal (an unreadable or past --until, one past seven days, no local
+tier, no checkout, or a record or lock that is not safely this account's) with
+nothing written. No network request.
 
 **Flags:**
 
@@ -4094,7 +4096,7 @@ lock that is not safely this account's) with nothing written. No network request
 
 #### `abcd mode back`
 
-End the away mode, printing what was queued and recorded one line each: Writes the away record's ending; refuses a record not safely this account's.
+End the away mode, printing what was queued and recorded one line each: Writes its ending whatever the record's or lock's state; refuses outside a git checkout.
 
 **Usage:** `abcd mode back`
 
diff --git a/internal/core/surface/sentences.go b/internal/core/surface/sentences.go
index 0c60d03ec9..37dc660f5e 100644
--- a/internal/core/surface/sentences.go
+++ b/internal/core/surface/sentences.go
@@ -139,13 +139,13 @@ var sentences = map[string]string{
 		"Writes nothing; refuses a lifeboat whose manifest does not verify.",
 
 	"abcd guard": "Judge a shell command against the hazard registry before it runs: " +
-		"Writes branch records; refuses a hazard via check, hook or approve, and an unknown sub-verb.",
+		"Writes branch records and a question's mode; refuses a hazard and an unknown sub-verb.",
 	"abcd guard check": "Judge one shell command against the hazard registry: " +
 		"Writes nothing; refuses a hazard with exit 1 and a command it cannot parse with exit 2.",
 	"abcd guard approve": "Answer a headless agent's permission prompts over MCP: " +
 		"Writes nothing; refuses every prompt but a shell command the guard reads whole and clears.",
 	"abcd guard hook": "Judge the shell command in a host's pre-tool-use payload: " +
-		"Writes a created branch's record; refuses a hazard or a badly built question with the host's deny.",
+		"Writes branch records and a question's mode; refuses a hazard or a badly built question.",
 
 	"abcd history": "Keep session transcripts in the user-level store and read them back: " +
 		"Writes nothing bare, and redacts each one it stores; refuses an unknown sub-verb.",
@@ -355,7 +355,7 @@ var sentences = map[string]string{
 	"abcd mode autonomous": "Record that the person is away and sessions work on, until a time or open-ended: " +
 		"Writes the away record; refuses an end already past or past seven days.",
 	"abcd mode back": "End the away mode, printing what was queued and recorded one line each: " +
-		"Writes the away record's ending; refuses a record not safely this account's.",
+		"Writes its ending whatever the record's or lock's state; refuses outside a git checkout.",
 	"abcd mode queue": "Queue one step for the person's return while they are away: " +
 		"Writes the away record; refuses when no away record holds.",
 
diff --git a/internal/surface/cli/mode_away.go b/internal/surface/cli/mode_away.go
index 9e910b4f3a..dd68453307 100644
--- a/internal/surface/cli/mode_away.go
+++ b/internal/surface/cli/mode_away.go
@@ -66,9 +66,11 @@ func newModeAutonomousCommand(asJSON *bool) *cobra.Command {
 			"time or with `abcd mode back`; a prompt never ends it. Setting it again keeps\n" +
 			"whatever is queued or recorded and not yet read.\n\n" +
 			"The record lives in " + abcdhome.Display(autonomy.StoreDir, "<root-sha>", autonomy.RecordFile) + ", keyed on the repository's\n" +
-			"root commit, and is changed only under its lock. Exit 2 on a refusal (an unreadable\n" +
-			"or past --until, one past seven days, no local tier, no checkout, or a record or\n" +
-			"lock that is not safely this account's) with nothing written. No network request.",
+			"root commit, and is changed under its lock, which only `abcd mode back` goes\n" +
+			"around. A record merely past its 64 KiB is carried, its oldest lines let go.\n" +
+			"Exit 2 on a refusal (an unreadable or past --until, one past seven days, no local\n" +
+			"tier, no checkout, or a record or lock that is not safely this account's) with\n" +
+			"nothing written. No network request.",
 		Args: cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, _ []string) error {
 			cwd, err := os.Getwd()

From ddda9c2d014dc3925022893e130b59b47a09e25f Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 16:51:10 +0100
Subject: [PATCH 50/58] feat: ship the away mode that keeps an autonomous
 session working

While the person is marked away, a session that tries to end its turn
with work it owns still owed is sent back to it; a waiting session
needs a wake in time to keep its reservations; a question is routed by
the act to a recorded decision or the person's return queue; and the
away record is repeated at every start, compaction and prompt.

Delivers: itd-2610180912189125
Resolves: iss-2610170619247185
Assisted-by: Claude:claude-opus-5-5
---
 ...d-2610180912189125-a-session-told-to-work-on-while-its.md | 4 +++-
 ...c-2610180914469489-a-session-told-to-work-on-while-its.md | 0
 ...0170619247185-an-autonomous-session-sat-idle-overnight.md | 5 +++++
 3 files changed, 8 insertions(+), 1 deletion(-)
 rename .abcd/development/intents/{planned => shipped}/itd-2610180912189125-a-session-told-to-work-on-while-its.md (99%)
 rename .abcd/development/specs/{open => closed}/spc-2610180914469489-a-session-told-to-work-on-while-its.md (100%)
 rename .abcd/work/issues/{open => resolved}/iss-2610170619247185-an-autonomous-session-sat-idle-overnight.md (87%)

diff --git a/.abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md b/.abcd/development/intents/shipped/itd-2610180912189125-a-session-told-to-work-on-while-its.md
similarity index 99%
rename from .abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md
rename to .abcd/development/intents/shipped/itd-2610180912189125-a-session-told-to-work-on-while-its.md
index ac39f76595..52348bbb0d 100644
--- a/.abcd/development/intents/planned/itd-2610180912189125-a-session-told-to-work-on-while-its.md
+++ b/.abcd/development/intents/shipped/itd-2610180912189125-a-session-told-to-work-on-while-its.md
@@ -385,7 +385,9 @@ amended by the trim to one uncached listing per check.
 
 ## Audit Notes
 
-_Empty. Populated by intent-auditor when intent moves to shipped/._
+<!-- abcd-review: OWED receipt=rcp-6da79a9df4b4 -->
+Fidelity review OWED (receipt rcp-6da79a9df4b4).
+<!-- abcd-review-end receipt=rcp-6da79a9df4b4 -->
 
 ## Grounds
 
diff --git a/.abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md b/.abcd/development/specs/closed/spc-2610180914469489-a-session-told-to-work-on-while-its.md
similarity index 100%
rename from .abcd/development/specs/open/spc-2610180914469489-a-session-told-to-work-on-while-its.md
rename to .abcd/development/specs/closed/spc-2610180914469489-a-session-told-to-work-on-while-its.md
diff --git a/.abcd/work/issues/open/iss-2610170619247185-an-autonomous-session-sat-idle-overnight.md b/.abcd/work/issues/resolved/iss-2610170619247185-an-autonomous-session-sat-idle-overnight.md
similarity index 87%
rename from .abcd/work/issues/open/iss-2610170619247185-an-autonomous-session-sat-idle-overnight.md
rename to .abcd/work/issues/resolved/iss-2610170619247185-an-autonomous-session-sat-idle-overnight.md
index 15dc69d983..35d78c50e7 100644
--- a/.abcd/work/issues/open/iss-2610170619247185-an-autonomous-session-sat-idle-overnight.md
+++ b/.abcd/work/issues/resolved/iss-2610170619247185-an-autonomous-session-sat-idle-overnight.md
@@ -12,6 +12,11 @@ related_intents: [itd-2610170638184486, itd-2610180912189125]
 found_at: "the agent loop between turns in an autonomous run"
 lapsed_at: "2026-10-16T19:48:14Z"
 remedy: "Make an autonomous run abcd state rather than chat: an 'abcd mode autonomous --until <time>' state per checkout that the prompt and session-start hooks inject (so compaction and peer relays cannot drop it); a Stop hook that, while that state holds, refuses to end a turn that has owed work (its reservations, its behind or failing pull requests, its unpushed branches) and names the next item, bounded by the host's stop_hook_active flag; the question check rerouting a product question in that state to 'abcd decide' with only website-only steps queued for the morning; and idle time per session in 'abcd peers' so a coordinator sees a stall."
+resolution: "Fixed by the away mode (itd-2610180912189125): while the person is marked away, a session that tries to end its turn with work it owns still owed is sent back to it, a waiting session must have a timely wake, questions are routed by the act to a recorded decision or the person's return queue, and the away record is repeated at every start, compaction and prompt so it never lives only in context. Proved by live Claude Code captures recorded in spc-2610180914469489."
+impact: fix
+resolved_by:
+  intent: "itd-2610180912189125"
+  spec: "spc-2610180914469489"
 ---
 
 An agent session told to work autonomously overnight sat idle for about ten of the eleven and a half hours between 20:48 BST on 2026-10-16 and 07:13 BST on 2026-10-17, while it held owed work it could have done alone.

From 1d5d7bcb0112a16f9fc46a8c50d957f76256c8f2 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 17:05:30 +0100
Subject: [PATCH 51/58] docs: keep the live-capture quotes inside the site's
 code spans

Assisted-by: Claude:claude-opus-5-5
---
 ...-2610180914469489-a-session-told-to-work-on-while-its.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.abcd/development/specs/closed/spc-2610180914469489-a-session-told-to-work-on-while-its.md b/.abcd/development/specs/closed/spc-2610180914469489-a-session-told-to-work-on-while-its.md
index 3862446d15..0ad864308d 100644
--- a/.abcd/development/specs/closed/spc-2610180914469489-a-session-told-to-work-on-while-its.md
+++ b/.abcd/development/specs/closed/spc-2610180914469489-a-session-told-to-work-on-while-its.md
@@ -1141,13 +1141,13 @@ prompt was sent.
   the person-only list and "Run `abcd mode back` only on the person's word in
   this session".
 - The prompt hook's `systemMessage` is "abcd: away until 2026-10-18 15:45 BST,
-  set by Alice from repo; 0 steps queued, 0 items handed back. `abcd mode
-  back` ends it.", and the host shows it to the person.
+  set by Alice from repo; 0 steps queued, 0 items handed back.
+  `abcd mode back` ends it.", and the host shows it to the person.
 - The first Stop is blocked: `{"decision":"block","reason":"abcd: the person
   is away and work is owed (1 item). Next: branch feat/x has commits not
   pushed … Do the local work, then push if your standing instruction allows;
   queue only if the person has said pushes wait. A push you may not send stays
-  owed: queue it with \`abcd mode queue …\`"}`.
+  owed: queue it with abcd mode queue …"}`.
 - Claude goes on. It says the away mode is no standing instruction and runs
   `abcd mode queue "Push branch feat/x …"`.
 - With no `--hold-pushes`, the queued push hands nothing back. The next stop

From 343bef3338f651e1a125c89d7fb4431a281037e4 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 17:28:36 +0100
Subject: [PATCH 52/58] test: build the unmanaged-repo home fixture through
 abcdhome.Path

TestAwayHooksLeaveUnmanagedRepoAlone joined the home folder's name by
hand, which the home-name boundary refuses in a test; the fixture now
follows the name when it changes.

Assisted-by: Claude:claude-opus-5-5
---
 internal/surface/cli/hook_stop_test.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/internal/surface/cli/hook_stop_test.go b/internal/surface/cli/hook_stop_test.go
index 7349de9d6d..2e93fc18cb 100644
--- a/internal/surface/cli/hook_stop_test.go
+++ b/internal/surface/cli/hook_stop_test.go
@@ -11,6 +11,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/intentdriven/abcd/internal/abcdhome"
 	"github.com/intentdriven/abcd/internal/core/autonomy"
 )
 
@@ -424,7 +425,7 @@ func TestAwayHooksLeaveUnmanagedRepoAlone(t *testing.T) {
 	awayCheckout(t) // the sandboxed HOME
 	home := os.Getenv("HOME")
 	repo := unmanagedOwnUnpushed(t)
-	abcdHome := filepath.Join(home, ".abcd.noindex")
+	abcdHome := abcdhome.Path(home)
 	before := homeFiles(t, abcdHome)
 	log := gitCallLog(t)
 	onlyRoot := func(what string) {

From 9f2d5941ba70a12d1a6de935f604728aec99f3ca Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 17:28:38 +0100
Subject: [PATCH 53/58] test: pin the mode surface chapter in the release-gate
 manifest

The away mode added 04-surfaces/26-mode.md without joining briefDocs, so
the brief-surface crosscheck would not read it. It is pinned in
chapter-slug order, between memory and reading.

Assisted-by: Claude:claude-opus-5-5
---
 .abcd/development/release-gate/manifest.json | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.abcd/development/release-gate/manifest.json b/.abcd/development/release-gate/manifest.json
index 1cca9a0b14..aa419dba7f 100644
--- a/.abcd/development/release-gate/manifest.json
+++ b/.abcd/development/release-gate/manifest.json
@@ -47,6 +47,7 @@
     ".abcd/development/brief/04-surfaces/07-library.md",
     ".abcd/development/brief/04-surfaces/16-lint.md",
     ".abcd/development/brief/04-surfaces/37-memory.md",
+    ".abcd/development/brief/04-surfaces/26-mode.md",
     ".abcd/development/brief/04-surfaces/23-reading.md",
     ".abcd/development/brief/04-surfaces/09-reflect.md",
     ".abcd/development/brief/04-surfaces/29-report.md",

From 72b0cb337087fa3369193f45bf5ce87c85a9ac46 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 17:28:39 +0100
Subject: [PATCH 54/58] refactor: unexport the autonomy functions no front door
 reaches

Eleven exported functions in internal/core/autonomy were reached only
from their own package, or from tests in the CLI package: begin,
createdFile, latestFire, openStore, owedKinds, parseCron, parseUntil,
qualifyingWake, resolveWho, sessionStatePath, and wakeDeadline (renamed
from Deadline so it does not collide with the deadline locals it is
assigned to). PersonOnlyActs is gone: its own test reads the list
directly, and the guard test now holds the refusal to QuestionRoute, which
carries every act. The CLI tests that opened the store or built a record
by hand now go through Resolve and SetAway, the paths the verbs take.

Assisted-by: Claude:claude-opus-5-5
---
 .../development/brief/04-surfaces/17-guard.md |  4 +-
 internal/core/autonomy/branches.go            | 12 +++---
 internal/core/autonomy/branches_test.go       |  2 +-
 internal/core/autonomy/cron.go                |  4 +-
 internal/core/autonomy/cron_test.go           | 14 +++----
 internal/core/autonomy/doc.go                 | 14 +++----
 internal/core/autonomy/end.go                 |  2 +-
 internal/core/autonomy/judge.go               |  4 +-
 internal/core/autonomy/judge_test.go          | 34 ++++++++---------
 internal/core/autonomy/owed.go                | 12 +++---
 internal/core/autonomy/owedread.go            |  2 +-
 internal/core/autonomy/owedread_test.go       | 10 ++---
 internal/core/autonomy/question.go            |  7 ----
 internal/core/autonomy/question_test.go       |  4 +-
 internal/core/autonomy/record.go              | 10 ++---
 internal/core/autonomy/record_full_test.go    | 12 +++---
 internal/core/autonomy/record_test.go         | 38 +++++++++----------
 internal/core/autonomy/session_state.go       |  4 +-
 internal/core/autonomy/store.go               |  4 +-
 internal/core/autonomy/store_test.go          |  4 +-
 internal/core/autonomy/verbs.go               | 18 ++++-----
 internal/core/autonomy/wake.go                | 16 ++++----
 .../surface/cli/guard_question_away_test.go   |  9 +++--
 internal/surface/cli/hook_away_test.go        | 11 +++---
 internal/surface/cli/mode_away_test.go        |  2 +-
 25 files changed, 124 insertions(+), 129 deletions(-)

diff --git a/.abcd/development/brief/04-surfaces/17-guard.md b/.abcd/development/brief/04-surfaces/17-guard.md
index 862ac454d0..2e61ae0b47 100644
--- a/.abcd/development/brief/04-surfaces/17-guard.md
+++ b/.abcd/development/brief/04-surfaces/17-guard.md
@@ -219,8 +219,8 @@ from any working copy of the repository. Nothing past the away check runs, so
 no mode is set from a chip and no question is marked open; the badge's
 chip-set path is never reached while away. The reason names none of the asking
 rules, so the agent reroutes the question rather than redrafting it. It routes
-the question by the act it asks about (`autonomy.QuestionRoute`, the list in
-`autonomy.PersonOnlyActs`): an act only the person may approve is queued with
+the question by the act it asks about (`autonomy.QuestionRoute`, which carries
+the list of acts only the person may approve): such an act is queued with
 the queue `abcd mode` keeps for their return, and the session carries on with
 other work. The acts are an embargo close's approval digest, the embargo
 triage verdict, the drain's hand-back, the confirmed apply verb for remote
diff --git a/internal/core/autonomy/branches.go b/internal/core/autonomy/branches.go
index 4c0ae39ff0..cf545a4fc0 100644
--- a/internal/core/autonomy/branches.go
+++ b/internal/core/autonomy/branches.go
@@ -21,9 +21,9 @@ const MaxCreatedBranches = 100
 // createdSchemaVersion is the created-branch list's shape version.
 const createdSchemaVersion = 1
 
-// CreatedFile is the store file holding the branches the working copy whose
+// createdFile is the store file holding the branches the working copy whose
 // key is copyKey created.
-func CreatedFile(copyKey string) string { return "branches-" + copyKey + ".json" }
+func createdFile(copyKey string) string { return "branches-" + copyKey + ".json" }
 
 // CreatedBranch is one branch a session in the working copy created, and when
 // it was recorded.
@@ -64,7 +64,7 @@ type BranchChange struct {
 // copyKey, oldest first; empty when none is kept. A list the store's checks
 // refuse, or that does not parse, is ErrUnsafe.
 func (s Store) CreatedBranches(copyKey string) ([]CreatedBranch, error) {
-	raw, err := s.ReadFile(CreatedFile(copyKey))
+	raw, err := s.ReadFile(createdFile(copyKey))
 	if errors.Is(err, fs.ErrNotExist) && !errors.Is(err, ErrUnsafe) {
 		return nil, nil
 	}
@@ -73,7 +73,7 @@ func (s Store) CreatedBranches(copyKey string) ([]CreatedBranch, error) {
 	}
 	var l createdList
 	if err := json.Unmarshal(raw, &l); err != nil || l.SchemaVersion != createdSchemaVersion {
-		return nil, fmt.Errorf("%w: %s does not parse as a created-branch list", ErrUnsafe, s.Display(CreatedFile(copyKey)))
+		return nil, fmt.Errorf("%w: %s does not parse as a created-branch list", ErrUnsafe, s.Display(createdFile(copyKey)))
 	}
 	return l.Branches, nil
 }
@@ -98,7 +98,7 @@ func (s Store) RecordBranches(copyKey string, changes []BranchChange, now time.T
 		if err != nil {
 			return err
 		}
-		return s.WriteFile(CreatedFile(copyKey), append(raw, '\n'))
+		return s.WriteFile(createdFile(copyKey), append(raw, '\n'))
 	})
 }
 
@@ -157,7 +157,7 @@ func RecordCreated(copyRoot, runDir string, changes []BranchChange, o Options) e
 	if err != nil {
 		return err
 	}
-	st, err := OpenStore(home, copyRoot)
+	st, err := openStore(home, copyRoot)
 	if errors.Is(err, ErrNoRootCommit) {
 		return nil
 	}
diff --git a/internal/core/autonomy/branches_test.go b/internal/core/autonomy/branches_test.go
index 5f4f28e3c0..b7a80da91d 100644
--- a/internal/core/autonomy/branches_test.go
+++ b/internal/core/autonomy/branches_test.go
@@ -12,7 +12,7 @@ const testCopyKey = "0123456789abcdef0123456789abcdef"
 func testStore(t *testing.T) Store {
 	t.Helper()
 	root, home := managedCopy(t)
-	st, err := OpenStore(home, root)
+	st, err := openStore(home, root)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/internal/core/autonomy/cron.go b/internal/core/autonomy/cron.go
index 7bdbc3fdf0..726fc70c13 100644
--- a/internal/core/autonomy/cron.go
+++ b/internal/core/autonomy/cron.go
@@ -30,10 +30,10 @@ type cronField struct {
 
 var cronFields = [5]cronField{{0, 59}, {0, 23}, {1, 31}, {1, 12}, {0, 7}}
 
-// ParseCron reads a five-field expression: each field a comma list of `*`,
+// parseCron reads a five-field expression: each field a comma list of `*`,
 // `*/n`, `a`, `a-b` or `a-b/n`, in numbers (no names, no `@` forms); day of
 // week takes 0 or 7 for Sunday. Anything else is ErrCron.
-func ParseCron(expr string) (Cron, error) {
+func parseCron(expr string) (Cron, error) {
 	f := strings.Fields(expr)
 	if len(f) != 5 {
 		return Cron{}, fmt.Errorf("%w: %d fields, want 5", ErrCron, len(f))
diff --git a/internal/core/autonomy/cron_test.go b/internal/core/autonomy/cron_test.go
index 873c65e589..9521951ff9 100644
--- a/internal/core/autonomy/cron_test.go
+++ b/internal/core/autonomy/cron_test.go
@@ -9,9 +9,9 @@ import (
 // read in loc.
 func cronNext(t *testing.T, expr string, from, until time.Time, loc *time.Location) (time.Time, bool) {
 	t.Helper()
-	c, err := ParseCron(expr)
+	c, err := parseCron(expr)
 	if err != nil {
-		t.Fatalf("ParseCron(%q): %v", expr, err)
+		t.Fatalf("parseCron(%q): %v", expr, err)
 	}
 	return c.Next(from, until, loc)
 }
@@ -20,9 +20,9 @@ func cronNext(t *testing.T, expr string, from, until time.Time, loc *time.Locati
 // stepping from the start of day to its end in loc.
 func matchDays(t *testing.T, expr string, from time.Time, days int, loc *time.Location) []string {
 	t.Helper()
-	c, err := ParseCron(expr)
+	c, err := parseCron(expr)
 	if err != nil {
-		t.Fatalf("ParseCron(%q): %v", expr, err)
+		t.Fatalf("parseCron(%q): %v", expr, err)
 	}
 	var got []string
 	end := from.AddDate(0, 0, days)
@@ -68,10 +68,10 @@ func TestCronNextFire(t *testing.T) {
 	}
 	for _, bad := range []string{"", "* * * *", "* * * * * *", "60 * * * *", "* 24 * * *", "* * 0 * *", "* * * 13 *",
 		"* * * * 8", "a * * * *", "*/0 * * * *", "5-1 * * * *", "1,,2 * * * *", "0 9 * * MON", "@daily", "-1 * * * *"} {
-		if _, err := ParseCron(bad); err == nil {
-			t.Errorf("ParseCron(%q) parsed; want refused", bad)
+		if _, err := parseCron(bad); err == nil {
+			t.Errorf("parseCron(%q) parsed; want refused", bad)
 		}
-		if _, _, ok := LatestFire(SessionCron{Schedule: bad, Recurring: true}, now, now.Add(time.Hour), loc); ok {
+		if _, _, ok := latestFire(SessionCron{Schedule: bad, Recurring: true}, now, now.Add(time.Hour), loc); ok {
 			t.Errorf("an unparsable %q gave a fire time", bad)
 		}
 	}
diff --git a/internal/core/autonomy/doc.go b/internal/core/autonomy/doc.go
index 84327d7551..e1d4081a2f 100644
--- a/internal/core/autonomy/doc.go
+++ b/internal/core/autonomy/doc.go
@@ -68,7 +68,7 @@
 //	                count and the last time
 //	dropped_*       what was let go to stay within MaxFileBytes, counted:
 //	                the oldest stops and hand-backs past their own bounds,
-//	                and queued steps only when Begin carries, or Back
+//	                and queued steps only when SetAway carries, or Back
 //	                closes, a record past its bound; a queue past its bound
 //	                refuses the next step (ErrQueueFull) instead
 //	closed          *Closing: once ended by word, who ended it and from
@@ -85,7 +85,7 @@
 // OwedKind, whether it is capped (an item the session can act on itself, which
 // a wake releases at most twice in a row), and its branch or record id (plus
 // its pull request and head where it has them). The kinds, in the order the
-// next item is chosen (OwedKinds): a renewal due, a failing pull request, a
+// next item is chosen (owedKinds): a renewal due, a failing pull request, a
 // behind one, a stacked branch, an unpushed branch, and a reservation whose
 // work no pull request carries. Owed.Fingerprint and Owed.CappedFingerprint
 // compare two owed sets item by item, ignoring order and reasons.
@@ -103,9 +103,9 @@
 // rows of the plan decide, from the owed set, the host's payload (StopInput:
 // stop_hook_active, the last message, session_crons, background_tasks, the
 // host's cap) and the session's SessionState. A wake qualifies
-// (QualifyingWake) when a session cron's latest fire time (LatestFire: its
-// next match, by abcd's own five-field cron parser, ParseCron, plus the
-// host's lateness) is no later than Deadline. The session's state lives in
+// (qualifyingWake) when a session cron's latest fire time (latestFire: its
+// next match, by abcd's own five-field cron parser, parseCron, plus the
+// host's lateness) is no later than wakeDeadline. The session's state lives in
 // the copy's local tier (SessionsDir, LoadSession, SaveSession), keyed by a
 // session id ValidSessionID accepts. The session-start hook notes each
 // session's start copy in the store (Store.NoteSessionCopy); ResolveCopy
@@ -120,7 +120,7 @@
 // worktree add <path> [<branch>]`) when it is a branch no worktree has
 // checked out (git refuses that command, which runs after the recorder) or
 // names nothing git resolves, and a BranchMoved rename carrying a record by whole name. The list
-// is CreatedFile(copyKey) in the away store, keyed on the working copy's
+// is createdFile(copyKey) in the away store, keyed on the working copy's
 // reservation copy key (claim.CopyKey), written under the store's lock
 // (Store.RecordBranches) and capped at MaxCreatedBranches, the oldest
 // dropped; Store.CreatedBranches reads it. A checkout abcd does not manage
@@ -170,7 +170,7 @@
 // the verdict accepts the hand-back (Verdict.HandBacks) and the stop hook
 // records it, once per branch and head (Store.RecordHandBack), so a
 // hand-back has one owner. Owed.NextRenewal is filled present or away. The
-// items come sorted by OwedKinds' order. The
+// items come sorted by owedKinds' order. The
 // error is a root that is not a working copy; anything else ReadOwed could
 // not read is a note in Owed.Notes.
 //
diff --git a/internal/core/autonomy/end.go b/internal/core/autonomy/end.go
index 98d8e991d2..75cd02cb1a 100644
--- a/internal/core/autonomy/end.go
+++ b/internal/core/autonomy/end.go
@@ -155,7 +155,7 @@ func (s Store) endUnlocked(res *BackResult, who Who, now time.Time) (*Record, er
 }
 
 // carryRead is SetAway's read under the lock: a record past its bound is
-// carried (Begin fits it); one that is unreadable, partial or not safely
+// carried (begin fits it); one that is unreadable, partial or not safely
 // this account's is refused, naming the file, for `abcd mode back` to end.
 func (s Store) carryRead() (*Record, error) {
 	lr := s.readLenient()
diff --git a/internal/core/autonomy/judge.go b/internal/core/autonomy/judge.go
index 28cb2c942f..b487f11ebd 100644
--- a/internal/core/autonomy/judge.go
+++ b/internal/core/autonomy/judge.go
@@ -116,8 +116,8 @@ func Judge(rec *Record, owed Owed, in StopInput, st SessionState, now time.Time)
 	fp := owed.Fingerprint()
 	changed := fp != st.Fingerprint
 	next.Fingerprint = fp
-	deadline := Deadline(owed, now)
-	_, look, wake := QualifyingWake(in.SessionCrons, now, deadline, in.Location)
+	deadline := wakeDeadline(owed, now)
+	_, look, wake := qualifyingWake(in.SessionCrons, now, deadline, in.Location)
 
 	v := Verdict{Save: true, HandBacks: handBacks}
 	qhash := ""
diff --git a/internal/core/autonomy/judge_test.go b/internal/core/autonomy/judge_test.go
index be6a8f209e..181c95e574 100644
--- a/internal/core/autonomy/judge_test.go
+++ b/internal/core/autonomy/judge_test.go
@@ -11,7 +11,7 @@ import (
 // the owed set, the session's state and the host's payload.
 
 func awayRec(now time.Time, holdPushes bool) *Record {
-	r, err := Begin(nil, alice, now.Add(-time.Hour), time.Time{}, holdPushes)
+	r, err := begin(nil, alice, now.Add(-time.Hour), time.Time{}, holdPushes)
 	if err != nil {
 		panic(err)
 	}
@@ -353,18 +353,18 @@ func TestJudgeHandBackOnlyUnderHoldPushes(t *testing.T) {
 // that minus the skew.
 func TestDeadlineCeiling(t *testing.T) {
 	now := at(t, "2026-10-18 21:00")
-	if got := Deadline(owedOf(behindPR), now); !got.Equal(now.Add(30 * time.Minute)) {
+	if got := wakeDeadline(owedOf(behindPR), now); !got.Equal(now.Add(30 * time.Minute)) {
 		t.Errorf("owed, no reservation: %s", got)
 	}
-	if got := Deadline(Owed{}, now); !got.Equal(now.Add(time.Hour)) {
+	if got := wakeDeadline(Owed{}, now); !got.Equal(now.Add(time.Hour)) {
 		t.Errorf("nothing owed: %s", got)
 	}
 	soon := Owed{NextRenewal: now.Add(20 * time.Minute)}
-	if got := Deadline(soon, now); !got.Equal(now.Add(15 * time.Minute)) {
+	if got := wakeDeadline(soon, now); !got.Equal(now.Add(15 * time.Minute)) {
 		t.Errorf("renewal in 20 minutes: deadline %s, want 15 minutes on", got)
 	}
 	late := Owed{Items: []OwedItem{behindPR}, NextRenewal: now.Add(12 * time.Hour)}
-	if got := Deadline(late, now); !got.Equal(now.Add(30 * time.Minute)) {
+	if got := wakeDeadline(late, now); !got.Equal(now.Add(30 * time.Minute)) {
 		t.Errorf("renewal in 12 hours: deadline %s, want the ceiling", got)
 	}
 }
@@ -376,10 +376,10 @@ func TestQualifyingWakeDistantCron(t *testing.T) {
 	claimed := at(t, "2026-10-18 20:00")
 	now := at(t, "2026-10-18 21:00")
 	owed := Owed{Items: []OwedItem{uncarried}, NextRenewal: claimed.Add(12 * time.Hour)}
-	if _, _, ok := QualifyingWake(crons("0 7 * * *"), now, Deadline(owed, now), loc); ok {
+	if _, _, ok := qualifyingWake(crons("0 7 * * *"), now, wakeDeadline(owed, now), loc); ok {
 		t.Error("0 7 * * * seen at 21:00 qualified with work owed")
 	}
-	if _, _, ok := QualifyingWake(crons("0 7 * * *"), now, Deadline(Owed{NextRenewal: owed.NextRenewal}, now), loc); ok {
+	if _, _, ok := qualifyingWake(crons("0 7 * * *"), now, wakeDeadline(Owed{NextRenewal: owed.NextRenewal}, now), loc); ok {
 		t.Error("0 7 * * * seen at 21:00 qualified with nothing owed")
 	}
 }
@@ -390,25 +390,25 @@ func TestQualifyingWakeDistantCron(t *testing.T) {
 func TestQualifyingWakeJitter(t *testing.T) {
 	loc := london(t)
 	now := at(t, "2026-10-18 21:00")
-	deadline := Deadline(owedOf(behindPR), now) // 21:30
-	if _, _, ok := QualifyingWake(crons("27 * * * *"), now, deadline, loc); ok {
+	deadline := wakeDeadline(owedOf(behindPR), now) // 21:30
+	if _, _, ok := qualifyingWake(crons("27 * * * *"), now, deadline, loc); ok {
 		t.Error("an hourly cron at 21:27 qualified for a 21:30 deadline; it may run 30 minutes late")
 	}
 	for _, e := range []string{"*/5 * * * *", "*/10 * * * *"} {
-		if _, _, ok := QualifyingWake(crons(e), now, deadline, loc); !ok {
+		if _, _, ok := qualifyingWake(crons(e), now, deadline, loc); !ok {
 			t.Errorf("%q did not qualify", e)
 		}
 	}
 	oneShot := []SessionCron{{ID: "once", Schedule: "30 21 18 10 *", Recurring: false}}
-	if _, look, ok := QualifyingWake(oneShot, now, deadline, loc); !ok || !look.Equal(deadline) {
+	if _, look, ok := qualifyingWake(oneShot, now, deadline, loc); !ok || !look.Equal(deadline) {
 		t.Errorf("a one-shot at the deadline: ok %v look %s", ok, look)
 	}
 	// */5 runs on time, any other every-five-minutes form gets half its gap.
-	_, lateFive, _ := LatestFire(SessionCron{Schedule: "*/5 * * * *", Recurring: true}, now, deadline, loc)
+	_, lateFive, _ := latestFire(SessionCron{Schedule: "*/5 * * * *", Recurring: true}, now, deadline, loc)
 	if !lateFive.Equal(now.Add(5 * time.Minute)) {
 		t.Errorf("*/5 latest fire %s, want its match", lateFive)
 	}
-	_, lateTen, _ := LatestFire(SessionCron{Schedule: "*/10 * * * *", Recurring: true}, now, deadline, loc)
+	_, lateTen, _ := latestFire(SessionCron{Schedule: "*/10 * * * *", Recurring: true}, now, deadline, loc)
 	if !lateTen.Equal(now.Add(15 * time.Minute)) {
 		t.Errorf("*/10 latest fire %s, want its match plus five minutes", lateTen)
 	}
@@ -418,7 +418,7 @@ func TestQualifyingWakeJitter(t *testing.T) {
 func TestQualifyingWakeRecurringCron(t *testing.T) {
 	loc := london(t)
 	now := at(t, "2026-10-18 21:05")
-	if _, look, ok := QualifyingWake(crons("*/30 * * * *"), now, Deadline(Owed{}, now), loc); !ok || !look.Equal(at(t, "2026-10-18 21:30")) {
+	if _, look, ok := qualifyingWake(crons("*/30 * * * *"), now, wakeDeadline(Owed{}, now), loc); !ok || !look.Equal(at(t, "2026-10-18 21:30")) {
 		t.Errorf("*/30 with nothing owed: ok %v look %s", ok, look)
 	}
 }
@@ -429,10 +429,10 @@ func TestQualifyingWakeAfterLeaseLapse(t *testing.T) {
 	loc := london(t)
 	now := at(t, "2026-10-18 21:00")
 	owed := Owed{Items: []OwedItem{renewalDue}, NextRenewal: now.Add(12 * time.Minute)} // deadline 21:07
-	if _, _, ok := QualifyingWake([]SessionCron{{Schedule: "10 21 * * *"}}, now, Deadline(owed, now), loc); ok {
+	if _, _, ok := qualifyingWake([]SessionCron{{Schedule: "10 21 * * *"}}, now, wakeDeadline(owed, now), loc); ok {
 		t.Error("a one-shot at 21:10 qualified past a renewal due at 21:12 less the skew")
 	}
-	if _, _, ok := QualifyingWake([]SessionCron{{Schedule: "6 21 * * *"}}, now, Deadline(owed, now), loc); !ok {
+	if _, _, ok := qualifyingWake([]SessionCron{{Schedule: "6 21 * * *"}}, now, wakeDeadline(owed, now), loc); !ok {
 		t.Error("a one-shot at 21:06 did not qualify before 21:07")
 	}
 }
@@ -530,7 +530,7 @@ func TestSessionIDShape(t *testing.T) {
 			t.Errorf("LoadSession(%q) read", bad)
 		}
 	}
-	p, _ := SessionStatePath(root, "abc")
+	p, _ := sessionStatePath(root, "abc")
 	if want := filepath.Join(root, ".abcd", ".work.local", "autonomy", "sessions", "abc.json"); p != want {
 		t.Errorf("state path %s, want %s", p, want)
 	}
diff --git a/internal/core/autonomy/owed.go b/internal/core/autonomy/owed.go
index 0f5d07bc1e..16fb6540ac 100644
--- a/internal/core/autonomy/owed.go
+++ b/internal/core/autonomy/owed.go
@@ -34,18 +34,18 @@ const (
 	OwedUncarried OwedKind = "uncarried"
 )
 
-// OwedKinds returns the kinds in the order the next item is chosen.
-func OwedKinds() []OwedKind {
+// owedKinds returns the kinds in the order the next item is chosen.
+func owedKinds() []OwedKind {
 	return []OwedKind{OwedRenewal, OwedFailing, OwedBehind, OwedStacked, OwedUnpushed, OwedUncarried}
 }
 
 func kindRank(k OwedKind) int {
-	for i, o := range OwedKinds() {
+	for i, o := range owedKinds() {
 		if o == k {
 			return i
 		}
 	}
-	return len(OwedKinds())
+	return len(owedKinds())
 }
 
 // OwedItem is one owed item.
@@ -86,7 +86,7 @@ type Owed struct {
 	// reservations: the earliest of each one's renewal while it is not yet
 	// due, and its lapse once it is. A renewal already due is owed, and a
 	// wake before the lease lapses releases it as the spec has it; zero when
-	// there is no reservation, and Deadline then reads NextRenewal.
+	// there is no reservation, and wakeDeadline then reads NextRenewal.
 	WakeBy time.Time `json:"wake_by,omitempty"`
 	// HandedBack are the items a queued step handed back this check, taken
 	// out of Items by the reader (dcn-2610181035355741). The verdict accepts
@@ -112,7 +112,7 @@ func (o Owed) HasCapped() bool {
 	return false
 }
 
-// Next is the item the session is handed: the first by OwedKinds' order, the
+// Next is the item the session is handed: the first by owedKinds' order, the
 // items of one kind in the order they were given.
 func (o Owed) Next() (OwedItem, bool) {
 	if len(o.Items) == 0 {
diff --git a/internal/core/autonomy/owedread.go b/internal/core/autonomy/owedread.go
index 329afd0d89..69025ec144 100644
--- a/internal/core/autonomy/owedread.go
+++ b/internal/core/autonomy/owedread.go
@@ -424,7 +424,7 @@ func (r *owedReader) recordedBranches() []string {
 	if key == "" || r.home == "" {
 		return nil
 	}
-	st, err := OpenStore(r.home, r.root)
+	st, err := openStore(r.home, r.root)
 	if err != nil {
 		return nil
 	}
diff --git a/internal/core/autonomy/owedread_test.go b/internal/core/autonomy/owedread_test.go
index a077ba55d5..bc3e8086c1 100644
--- a/internal/core/autonomy/owedread_test.go
+++ b/internal/core/autonomy/owedread_test.go
@@ -308,7 +308,7 @@ func TestOwnBranchFromRecordedCreation(t *testing.T) {
 	if owed := f.read(false); has(owed, OwedUnpushed, "feat/s") {
 		t.Fatalf("an unrecorded branch in another worktree is not own: %s", describe(owed))
 	}
-	st, err := OpenStore(f.home, f.root)
+	st, err := openStore(f.home, f.root)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -437,7 +437,7 @@ func TestSiblingBranchNotOwn(t *testing.T) {
 	wt := filepath.Join(t.TempDir(), "sib")
 	f.git("worktree", "add", "-q", "-b", "feat/sib", wt)
 	f.git("-C", wt, "commit", "-q", "--allow-empty", "-m", "sibling work")
-	st, _ := OpenStore(f.home, f.root)
+	st, _ := openStore(f.home, f.root)
 	if err := st.RecordBranches("fedcba9876543210fedcba9876543210", []BranchChange{{Kind: BranchCreated, Name: "feat/sib"}}, f.now); err != nil {
 		t.Fatal(err)
 	}
@@ -772,7 +772,7 @@ func TestQueuedPushHandsItemBack(t *testing.T) {
 		return f.readWith(o)
 	}
 	handedBack := func(t *testing.T, f *fx) []HandBack {
-		st, _ := OpenStore(f.home, f.root)
+		st, _ := openStore(f.home, f.root)
 		rec, err := st.Read()
 		if err != nil {
 			t.Fatal(err)
@@ -986,7 +986,7 @@ func TestOwedOrderFixed(t *testing.T) {
 			kinds = append(kinds, i.Kind)
 		}
 	}
-	want := OwedKinds()
+	want := owedKinds()
 	if len(kinds) != len(want) {
 		t.Fatalf("kinds %v, want each of %v once in order: %s", kinds, want, describe(owed))
 	}
@@ -1216,7 +1216,7 @@ func TestDueRenewalReleasesOnWake(t *testing.T) {
 	if len(owed.Items) != 1 || owed.Items[0].Kind != OwedRenewal {
 		t.Fatalf("want only the renewal due: %s", describe(owed))
 	}
-	if d := Deadline(owed, f.now); !d.After(f.now) {
+	if d := wakeDeadline(owed, f.now); !d.After(f.now) {
 		t.Fatalf("the deadline for a due renewal is %s, already past at %s", d, f.now)
 	}
 	st := SessionState{}
diff --git a/internal/core/autonomy/question.go b/internal/core/autonomy/question.go
index 28e68970d6..391c364ba0 100644
--- a/internal/core/autonomy/question.go
+++ b/internal/core/autonomy/question.go
@@ -34,13 +34,6 @@ var personOnlyActs = []string{
 	"any other act a command page or a brief invariant names as the person's",
 }
 
-// PersonOnlyActs are the acts only the person may approve, which a session
-// queues with `abcd mode queue` while the person is away instead of asking:
-// one line each, the catch-all last. The slice is a copy.
-func PersonOnlyActs() []string {
-	return append([]string(nil), personOnlyActs...)
-}
-
 // QuestionRoute is how a question is routed while the person is away, one
 // line each: the queue route and the person-only acts, then the decide route
 // for every other question, then that nothing detects the act and the away
diff --git a/internal/core/autonomy/question_test.go b/internal/core/autonomy/question_test.go
index f1bed2e0bb..1d603c6eeb 100644
--- a/internal/core/autonomy/question_test.go
+++ b/internal/core/autonomy/question_test.go
@@ -44,9 +44,9 @@ func TestAwayReasonListsPersonOnlyActs(t *testing.T) {
 			t.Errorf("the reason does not name %s (%q):\n%s", want.what, want.phrase, route)
 		}
 	}
-	acts := PersonOnlyActs()
+	acts := personOnlyActs
 	if len(acts) == 0 {
-		t.Fatal("PersonOnlyActs is empty")
+		t.Fatal("personOnlyActs is empty")
 	}
 	for _, a := range acts {
 		if !strings.Contains(route, a) {
diff --git a/internal/core/autonomy/record.go b/internal/core/autonomy/record.go
index 226e4cc435..6ed49e7bde 100644
--- a/internal/core/autonomy/record.go
+++ b/internal/core/autonomy/record.go
@@ -127,12 +127,12 @@ type Closing struct {
 	At   time.Time `json:"at"`
 }
 
-// Begin is the record `abcd mode autonomous` writes at now: until zero is
+// begin is the record `abcd mode autonomous` writes at now: until zero is
 // open-ended (seven days at most), and otherwise must be after now and no
 // later than seven days on. prev is the record already stored, or nil: an
 // unclosed one's queue, hand-backs and stops are still unread, so they are
 // carried into the new record rather than dropped.
-func Begin(prev *Record, who Who, now, until time.Time, holdPushes bool) (*Record, error) {
+func begin(prev *Record, who Who, now, until time.Time, holdPushes bool) (*Record, error) {
 	now = now.Truncate(time.Second)
 	r := &Record{
 		SchemaVersion: SchemaVersion,
@@ -201,7 +201,7 @@ func (r *Record) dropStop(i int) {
 
 // Fit lets go of what a record past its bound cannot hold, oldest first and
 // counted: stops, then hand-backs, then queued steps. A record within its
-// bound is unchanged. Begin fits what it carries and Back what it closes, so
+// bound is unchanged. begin fits what it carries and Back what it closes, so
 // neither ever fails on size; Back prints every line before it fits.
 func (r *Record) Fit() {
 	for jsonLen(r) > fitBudget {
@@ -416,11 +416,11 @@ var clockRe = regexp.MustCompile(`^(\d{1,2}):(\d{2})$`)
 // which names its own offset, is tried first.
 var localLayouts = []string{"2006-01-02T15:04:05", "2006-01-02T15:04", "2006-01-02 15:04:05", "2006-01-02 15:04"}
 
-// ParseUntil reads --until against now, in now's location (the machine's
+// parseUntil reads --until against now, in now's location (the machine's
 // local time at the front door): a clock time is its next occurrence after
 // now; a timestamp is RFC 3339 or a date and time read in local time. One
 // that is neither is ErrUntilUnreadable, and one not after now ErrUntilPast.
-func ParseUntil(s string, now time.Time) (time.Time, error) {
+func parseUntil(s string, now time.Time) (time.Time, error) {
 	raw := s
 	s = strings.TrimSpace(s)
 	loc := now.Location()
diff --git a/internal/core/autonomy/record_full_test.go b/internal/core/autonomy/record_full_test.go
index ee8fbe85b7..037371227d 100644
--- a/internal/core/autonomy/record_full_test.go
+++ b/internal/core/autonomy/record_full_test.go
@@ -27,7 +27,7 @@ func recordBytes(t *testing.T, r *Record) int {
 // alternating, keep two entries, each counted, not one entry per stop.
 func TestAddStopCollapsesAnywhere(t *testing.T) {
 	now := at(t, "2026-10-18 21:00")
-	r, _ := Begin(nil, alice, now, time.Time{}, false)
+	r, _ := begin(nil, alice, now, time.Time{}, false)
 	a := Stop{Kind: StopWorkOwed, Detail: "pull request #12 (feat/a) is behind its base", PossiblyForcedByCap: true}
 	b := Stop{Kind: StopWorkOwed, Detail: "pull request #13 (feat/b) is failing its checks", PossiblyForcedByCap: true}
 	for i := 0; i < 200; i++ {
@@ -48,7 +48,7 @@ func TestAddStopCollapsesAnywhere(t *testing.T) {
 // within 64 KiB throughout.
 func TestRecordStaysWithinBoundInUse(t *testing.T) {
 	now := at(t, "2026-10-18 21:00")
-	r, _ := Begin(nil, alice, now, time.Time{}, false)
+	r, _ := begin(nil, alice, now, time.Time{}, false)
 	long := strings.Repeat("<", 240)
 	for i := 0; i < 600; i++ {
 		r.AddStop(Stop{Kind: StopWorkOwed, Detail: fmt.Sprintf("%d %s", i, long), PossiblyForcedByCap: true}, now.Add(time.Duration(i)*time.Minute))
@@ -85,7 +85,7 @@ func TestRecordStaysWithinBoundInUse(t *testing.T) {
 // leave it.
 func fillRecord(t *testing.T, st Store, now time.Time) {
 	t.Helper()
-	r, _ := Begin(nil, alice, now.Add(-time.Hour), time.Time{}, false)
+	r, _ := begin(nil, alice, now.Add(-time.Hour), time.Time{}, false)
 	r.Queue = append(r.Queue, QueuedStep{Step: "approve the embargo close", At: now, From: "/work/a"})
 	for i := 0; i < 400; i++ {
 		r.Stops = append(r.Stops, Stop{Kind: StopWorkOwed, Detail: fmt.Sprintf("%d %s", i, strings.Repeat("x", 200)), Count: 1, First: now, Last: now})
@@ -137,7 +137,7 @@ func TestBackEndsAnyRecord(t *testing.T) {
 			if _, err := QueueStep(root, "approve the embargo close", o); err != nil {
 				t.Fatal(err)
 			}
-			st, _ := OpenStore(home, root)
+			st, _ := openStore(home, root)
 			c.spoil(t, st, now)
 			res, err := Back(root, o)
 			if err != nil {
@@ -176,7 +176,7 @@ func TestBackWithLockHeld(t *testing.T) {
 	if _, err := SetAway(root, "", false, o); err != nil {
 		t.Fatal(err)
 	}
-	st, _ := OpenStore(home, root)
+	st, _ := openStore(home, root)
 	var res BackResult
 	var berr error
 	if err := st.WithLock(func() error {
@@ -199,7 +199,7 @@ func TestBeginCarriesAFullRecord(t *testing.T) {
 	root, home := managedCopy(t)
 	now := time.Now().Truncate(time.Second)
 	o := fixedOptions(home, now)
-	st, _ := OpenStore(home, root)
+	st, _ := openStore(home, root)
 	fillRecord(t, st, now)
 	rec, err := SetAway(root, "", false, o)
 	if err != nil {
diff --git a/internal/core/autonomy/record_test.go b/internal/core/autonomy/record_test.go
index 1ad5892340..c7de9c1707 100644
--- a/internal/core/autonomy/record_test.go
+++ b/internal/core/autonomy/record_test.go
@@ -47,23 +47,23 @@ func TestUntilClockTimeAndTimestamp(t *testing.T) {
 		{"2026-10-20T09:00", at(t, "2026-10-20 09:00")},
 		{"2026-10-20 09:00", at(t, "2026-10-20 09:00")},
 	} {
-		got, err := ParseUntil(c.in, now)
+		got, err := parseUntil(c.in, now)
 		if err != nil {
-			t.Errorf("ParseUntil(%q): %v", c.in, err)
+			t.Errorf("parseUntil(%q): %v", c.in, err)
 			continue
 		}
 		if !got.Equal(c.want) {
-			t.Errorf("ParseUntil(%q) = %s, want %s", c.in, got, c.want)
+			t.Errorf("parseUntil(%q) = %s, want %s", c.in, got, c.want)
 		}
 	}
 	for _, in := range []string{"", "tomorrow", "25:00", "09:60", "2026-13-01T09:00"} {
-		if _, err := ParseUntil(in, now); !errors.Is(err, ErrUntilUnreadable) {
-			t.Errorf("ParseUntil(%q) err = %v, want ErrUntilUnreadable", in, err)
+		if _, err := parseUntil(in, now); !errors.Is(err, ErrUntilUnreadable) {
+			t.Errorf("parseUntil(%q) err = %v, want ErrUntilUnreadable", in, err)
 		}
 	}
 	for _, in := range []string{"2026-10-18T20:00", "2026-10-18 21:00"} {
-		if _, err := ParseUntil(in, now); !errors.Is(err, ErrUntilPast) {
-			t.Errorf("ParseUntil(%q) err = %v, want ErrUntilPast", in, err)
+		if _, err := parseUntil(in, now); !errors.Is(err, ErrUntilPast) {
+			t.Errorf("parseUntil(%q) err = %v, want ErrUntilPast", in, err)
 		}
 	}
 }
@@ -73,7 +73,7 @@ func TestUntilClockTimeAndTimestamp(t *testing.T) {
 // the cap (a hand edit) is read as the cap.
 func TestStaleRecordCapSevenDays(t *testing.T) {
 	now := at(t, "2026-10-18 21:00")
-	r, err := Begin(nil, alice, now, time.Time{}, false)
+	r, err := begin(nil, alice, now, time.Time{}, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -89,10 +89,10 @@ func TestStaleRecordCapSevenDays(t *testing.T) {
 	if r.Holds(now.Add(MaxWindow)) {
 		t.Error("record still holds seven days on")
 	}
-	if _, err := Begin(nil, alice, now, now.Add(MaxWindow+time.Minute), false); !errors.Is(err, ErrUntilBeyondCap) {
+	if _, err := begin(nil, alice, now, now.Add(MaxWindow+time.Minute), false); !errors.Is(err, ErrUntilBeyondCap) {
 		t.Errorf("--until past seven days: err = %v, want ErrUntilBeyondCap", err)
 	}
-	if _, err := Begin(nil, alice, now, now.Add(MaxWindow), false); err != nil {
+	if _, err := begin(nil, alice, now, now.Add(MaxWindow), false); err != nil {
 		t.Errorf("--until at exactly seven days refused: %v", err)
 	}
 	edited := *r
@@ -107,7 +107,7 @@ func TestStaleRecordCapSevenDays(t *testing.T) {
 // past it reads as ended, lapsed until it is closed.
 func TestRecordPastEndReadsEnded(t *testing.T) {
 	now := at(t, "2026-10-18 21:00")
-	r, err := Begin(nil, alice, now, now.Add(time.Hour), false)
+	r, err := begin(nil, alice, now, now.Add(time.Hour), false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -134,7 +134,7 @@ func TestRecordPastEndReadsEnded(t *testing.T) {
 // was queued; an empty step or one past the length bound is refused.
 func TestQueueAppends(t *testing.T) {
 	now := at(t, "2026-10-18 21:00")
-	r, err := Begin(nil, alice, now, time.Time{}, false)
+	r, err := begin(nil, alice, now, time.Time{}, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -161,7 +161,7 @@ func TestQueueAppends(t *testing.T) {
 	}
 
 	// Setting the mode again keeps what is still unread.
-	again, err := Begin(r, alice, now.Add(time.Hour), time.Time{}, true)
+	again, err := begin(r, alice, now.Add(time.Hour), time.Time{}, true)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -169,7 +169,7 @@ func TestQueueAppends(t *testing.T) {
 		t.Errorf("setting the mode again dropped the unread queue: %+v", again.Queue)
 	}
 	r.Close(alice, now.Add(2*time.Hour))
-	fresh, err := Begin(r, alice, now.Add(3*time.Hour), time.Time{}, false)
+	fresh, err := begin(r, alice, now.Add(3*time.Hour), time.Time{}, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -183,7 +183,7 @@ func TestQueueAppends(t *testing.T) {
 // first one again after a different one, is its own entry.
 func TestRepeatedStopCollapses(t *testing.T) {
 	now := at(t, "2026-10-18 21:00")
-	r, err := Begin(nil, alice, now, time.Time{}, false)
+	r, err := begin(nil, alice, now, time.Time{}, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -214,11 +214,11 @@ func TestRepeatedStopCollapses(t *testing.T) {
 // mode grants no rights whether or not pushes are held.
 func TestHoldPushesRecorded(t *testing.T) {
 	now := at(t, "2026-10-18 21:00")
-	held, err := Begin(nil, alice, now, at(t, "2026-10-19 09:00"), true)
+	held, err := begin(nil, alice, now, at(t, "2026-10-19 09:00"), true)
 	if err != nil {
 		t.Fatal(err)
 	}
-	plain, err := Begin(nil, alice, now, at(t, "2026-10-19 09:00"), false)
+	plain, err := begin(nil, alice, now, at(t, "2026-10-19 09:00"), false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -262,7 +262,7 @@ func TestHoldPushesRecorded(t *testing.T) {
 // the count included.
 func TestBackLinesOnePerItem(t *testing.T) {
 	now := at(t, "2026-10-18 21:00")
-	r, err := Begin(nil, alice, now, time.Time{}, false)
+	r, err := begin(nil, alice, now, time.Time{}, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -295,7 +295,7 @@ func TestBackLinesOnePerItem(t *testing.T) {
 // order the items arrive in, its fingerprint ignores order and reasons, and
 // the capped fingerprint reads the capped items alone.
 func TestOwedShape(t *testing.T) {
-	kinds := OwedKinds()
+	kinds := owedKinds()
 	want := []OwedKind{OwedRenewal, OwedFailing, OwedBehind, OwedStacked, OwedUnpushed, OwedUncarried}
 	if len(kinds) != len(want) {
 		t.Fatalf("kinds = %v", kinds)
diff --git a/internal/core/autonomy/session_state.go b/internal/core/autonomy/session_state.go
index 0c48623a13..acc067ad12 100644
--- a/internal/core/autonomy/session_state.go
+++ b/internal/core/autonomy/session_state.go
@@ -41,9 +41,9 @@ type SessionState struct {
 	WakeFingerprint string `json:"wake_fingerprint,omitempty"`
 }
 
-// SessionStatePath is the session's state file below the working copy at
+// sessionStatePath is the session's state file below the working copy at
 // copyRoot; an id outside [A-Za-z0-9_-]{1,128} is ErrSessionID.
-func SessionStatePath(copyRoot, sessionID string) (string, error) {
+func sessionStatePath(copyRoot, sessionID string) (string, error) {
 	if !ValidSessionID(sessionID) {
 		return "", ErrSessionID
 	}
diff --git a/internal/core/autonomy/store.go b/internal/core/autonomy/store.go
index 8e9064385d..5e535c0d63 100644
--- a/internal/core/autonomy/store.go
+++ b/internal/core/autonomy/store.go
@@ -49,10 +49,10 @@ type Store struct {
 	rootSHA string
 }
 
-// OpenStore is the away store of the repository whose working copy is at
+// openStore is the away store of the repository whose working copy is at
 // repoRoot, below home: keyed on the repository's root commit, so every
 // working copy of it opens the same store. Nothing is created.
-func OpenStore(home, repoRoot string) (Store, error) {
+func openStore(home, repoRoot string) (Store, error) {
 	sha := gitutil.RootCommit(repoRoot)
 	if !gitutil.IsFullSHA(sha) {
 		return Store{}, ErrNoRootCommit
diff --git a/internal/core/autonomy/store_test.go b/internal/core/autonomy/store_test.go
index bad4d1496d..a40ab238ca 100644
--- a/internal/core/autonomy/store_test.go
+++ b/internal/core/autonomy/store_test.go
@@ -68,7 +68,7 @@ func TestConcurrentWritesUnderLock(t *testing.T) {
 			t.Fatal(err)
 		}
 	}
-	st, err := OpenStore(home, root)
+	st, err := openStore(home, root)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -168,7 +168,7 @@ func TestRecordOwnershipFailsOpen(t *testing.T) {
 			if _, err := SetAway(root, "", false, o); err != nil {
 				t.Fatal(err)
 			}
-			st, err := OpenStore(home, root)
+			st, err := openStore(home, root)
 			if err != nil {
 				t.Fatal(err)
 			}
diff --git a/internal/core/autonomy/verbs.go b/internal/core/autonomy/verbs.go
index eb4cc6dfb1..a3fa7bd086 100644
--- a/internal/core/autonomy/verbs.go
+++ b/internal/core/autonomy/verbs.go
@@ -33,7 +33,7 @@ type Options struct {
 	// Now is the clock; nil means time.Now.
 	Now func() time.Time
 	// Who names the person acting in the checkout at root; nil means
-	// ResolveWho.
+	// resolveWho.
 	Who func(root string) string
 }
 
@@ -59,13 +59,13 @@ func (o Options) who(root, home string) string {
 	if o.Who != nil {
 		return o.Who(root)
 	}
-	return ResolveWho(root, home)
+	return resolveWho(root, home)
 }
 
-// ResolveWho names the person acting in the checkout at root: the holder
+// resolveWho names the person acting in the checkout at root: the holder
 // name reservations resolve without a network read, else git's user.name,
 // else "".
-func ResolveWho(root, home string) string {
+func resolveWho(root, home string) string {
 	if h := claim.ReaderHolder(root, claim.Options{Home: home}); h != "" {
 		return h
 	}
@@ -86,7 +86,7 @@ func Resolve(cwd string, o Options) (root string, st Store, err error) {
 	if err != nil {
 		return "", Store{}, err
 	}
-	st, err = OpenStore(home, root)
+	st, err = openStore(home, root)
 	return root, st, err
 }
 
@@ -128,7 +128,7 @@ func SetAway(cwd, until string, holdPushes bool, o Options) (*Record, error) {
 	now := o.now()
 	var end time.Time
 	if until != "" {
-		t, err := ParseUntil(until, now)
+		t, err := parseUntil(until, now)
 		if err != nil {
 			return nil, err
 		}
@@ -148,11 +148,11 @@ func SetAway(cwd, until string, holdPushes bool, o Options) (*Record, error) {
 	}
 	who := Who{Name: o.who(root, st.home), Copy: root}
 	// Judge the window before anything is created on disk.
-	if _, err := Begin(nil, who, now, end, holdPushes); err != nil {
+	if _, err := begin(nil, who, now, end, holdPushes); err != nil {
 		return nil, err
 	}
 	return st.update(st.carryRead, func(cur *Record) (*Record, error) {
-		return Begin(cur, who, now, end, holdPushes)
+		return begin(cur, who, now, end, holdPushes)
 	})
 }
 
@@ -230,7 +230,7 @@ func AwayAt(root string, o Options) (*Record, bool, error) {
 	if err != nil {
 		return nil, false, err
 	}
-	st, err := OpenStore(home, root)
+	st, err := openStore(home, root)
 	if err != nil {
 		return nil, false, err
 	}
diff --git a/internal/core/autonomy/wake.go b/internal/core/autonomy/wake.go
index f2cc1d9109..2036ccfc9b 100644
--- a/internal/core/autonomy/wake.go
+++ b/internal/core/autonomy/wake.go
@@ -38,12 +38,12 @@ type BackgroundTask struct {
 	Command     string `json:"command,omitempty"`
 }
 
-// Deadline is the latest a wake may fire for the stop to wait on it: the
+// wakeDeadline is the latest a wake may fire for the stop to wait on it: the
 // earlier of Owed.WakeBy (the earliest renewal not yet due among the live
 // reservations under this copy's key, or the lapse of one already due; else
 // Owed.NextRenewal) less lease.Skew, and now plus a ceiling, OwedCeiling while work
 // is owed and IdleCeiling when none is (dcn-2610181003455731).
-func Deadline(owed Owed, now time.Time) time.Time {
+func wakeDeadline(owed Owed, now time.Time) time.Time {
 	ceiling := IdleCeiling
 	if !owed.Empty() {
 		ceiling = OwedCeiling
@@ -61,14 +61,14 @@ func Deadline(owed Owed, now time.Time) time.Time {
 	return d
 }
 
-// LatestFire is a task's next match after now, no later than deadline, and
+// latestFire is a task's next match after now, no later than deadline, and
 // the latest the host may run it: for a recurring task the match plus half
 // the gap to the following match, at most MaxLateness, and nothing for
 // exactly `*/5 * * * *`; a one-shot task is taken as matched, since the host
 // only ever runs one early. ok is false for an expression abcd cannot parse
 // or one with no match by the deadline.
-func LatestFire(c SessionCron, now, deadline time.Time, loc *time.Location) (match, latest time.Time, ok bool) {
-	cr, err := ParseCron(c.Schedule)
+func latestFire(c SessionCron, now, deadline time.Time, loc *time.Location) (match, latest time.Time, ok bool) {
+	cr, err := parseCron(c.Schedule)
 	if err != nil {
 		return time.Time{}, time.Time{}, false
 	}
@@ -88,15 +88,15 @@ func LatestFire(c SessionCron, now, deadline time.Time, loc *time.Location) (mat
 	return match, match.Add(late), true
 }
 
-// QualifyingWake is the task whose latest fire time is no later than
+// qualifyingWake is the task whose latest fire time is no later than
 // deadline, the earliest-matching of them, and its next match, the session's
 // next look. ok is false when none qualifies.
-func QualifyingWake(crons []SessionCron, now, deadline time.Time, loc *time.Location) (SessionCron, time.Time, bool) {
+func qualifyingWake(crons []SessionCron, now, deadline time.Time, loc *time.Location) (SessionCron, time.Time, bool) {
 	var best SessionCron
 	var look time.Time
 	found := false
 	for _, c := range crons {
-		match, latest, ok := LatestFire(c, now, deadline, loc)
+		match, latest, ok := latestFire(c, now, deadline, loc)
 		if !ok || latest.After(deadline) {
 			continue
 		}
diff --git a/internal/surface/cli/guard_question_away_test.go b/internal/surface/cli/guard_question_away_test.go
index 27285c853b..28686bf815 100644
--- a/internal/surface/cli/guard_question_away_test.go
+++ b/internal/surface/cli/guard_question_away_test.go
@@ -86,10 +86,11 @@ func TestAwayQuestionDeniedOneReason(t *testing.T) {
 			if !strings.Contains(reason, "the person is away") {
 				t.Errorf("the reason does not say the person is away:\n%s", reason)
 			}
-			for _, act := range autonomy.PersonOnlyActs() {
-				if !strings.Contains(reason, act) {
-					t.Errorf("the reason leaves out the person-only act %q", act)
-				}
+			// The route carries every person-only act (autonomy's own test
+			// holds the route to the list), so the reason carrying it whole
+			// carries each act.
+			if !strings.Contains(reason, autonomy.QuestionRoute()) {
+				t.Errorf("the reason leaves out the question route and its person-only acts:\n%s", reason)
 			}
 			if strings.Contains(reason, "asking rules") {
 				t.Errorf("an away refusal names the asking rules, so the agent would redraft instead of rerouting:\n%s", reason)
diff --git a/internal/surface/cli/hook_away_test.go b/internal/surface/cli/hook_away_test.go
index ffb4a2fb67..c65bc3f90f 100644
--- a/internal/surface/cli/hook_away_test.go
+++ b/internal/surface/cli/hook_away_test.go
@@ -2,6 +2,7 @@ package cli
 
 import (
 	"encoding/json"
+	"os"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -225,11 +226,11 @@ func TestPromptRouterLapsedWindowLine(t *testing.T) {
 	lapse := func(queue, stop bool) {
 		t.Helper()
 		past := time.Now().Add(-3 * time.Hour)
-		if _, err := st.Update(func(*autonomy.Record) (*autonomy.Record, error) {
-			r, err := autonomy.Begin(nil, autonomy.Who{Name: "Alice", Copy: root}, past, past.Add(time.Hour), false)
-			if err != nil {
-				return nil, err
-			}
+		o := autonomy.Options{Home: os.Getenv("HOME"), Now: func() time.Time { return past }, Who: func(string) string { return "Alice" }}
+		if _, err := autonomy.SetAway(root, past.Add(time.Hour).Format(time.RFC3339), false, o); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := st.Update(func(r *autonomy.Record) (*autonomy.Record, error) {
 			if queue {
 				_ = r.AddStep("push feat/x", root, past)
 			}
diff --git a/internal/surface/cli/mode_away_test.go b/internal/surface/cli/mode_away_test.go
index 5e49b4bafb..b6a0660f99 100644
--- a/internal/surface/cli/mode_away_test.go
+++ b/internal/surface/cli/mode_away_test.go
@@ -38,7 +38,7 @@ func gitAt(t *testing.T, dir string, args ...string) string {
 
 func awayStore(t *testing.T, root string) autonomy.Store {
 	t.Helper()
-	st, err := autonomy.OpenStore(os.Getenv("HOME"), root)
+	_, st, err := autonomy.Resolve(root, autonomy.Options{Home: os.Getenv("HOME")})
 	if err != nil {
 		t.Fatal(err)
 	}

From 3fbe0fcc01dadaf79397b8ceeea3f13a3dec7db0 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 17:48:06 +0100
Subject: [PATCH 55/58] test: warm up the guard's one-time git check before the
 unmanaged-repo baseline

Run alone, the test counted the guard's once-per-process git version
check as the recorder's work.

Assisted-by: Claude:claude-opus-5-5
---
 internal/surface/cli/hook_stop_test.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/internal/surface/cli/hook_stop_test.go b/internal/surface/cli/hook_stop_test.go
index 2e93fc18cb..9c6e25ee0f 100644
--- a/internal/surface/cli/hook_stop_test.go
+++ b/internal/surface/cli/hook_stop_test.go
@@ -458,6 +458,9 @@ func TestAwayHooksLeaveUnmanagedRepoAlone(t *testing.T) {
 	}
 	// The guard's own reading of a command is not the recorder's: a command
 	// with no branch act sets the baseline the branch acts must not exceed.
+	// The guard checks the git version once per process; warm that up first
+	// so the baseline holds only what every command costs.
+	_ = baseline("git status --porcelain")
 	_ = os.WriteFile(log, nil, 0o600)
 	plain := baseline("git status --porcelain")
 	for _, c := range []string{"git switch -c feat/new", "git worktree add -b feat/wt ../wt", "git checkout -b feat/co"} {

From d044e44aa4a0c075ffc40f274a25d1be456ac153 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 18 Oct 2026 18:24:12 +0100
Subject: [PATCH 56/58] test: build the created-branch test's copy key at
 runtime

The literal tripped the secret scan's generic-api-key rule on the commit
that added it; that commit's line is fingerprinted as history residue.

Assisted-by: Claude:claude-opus-5-5
---
 .gitleaksignore                         | 6 ++++++
 internal/core/autonomy/branches_test.go | 5 ++++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/.gitleaksignore b/.gitleaksignore
index 5c1bd373aa..5300d8c4ef 100644
--- a/.gitleaksignore
+++ b/.gitleaksignore
@@ -8,3 +8,9 @@
 # the `Key = "…"` assignment as a credential. The key is a content hash, and
 # the constant is renamed at the branch tip.
 268da6f4aa61b7ef3cb58a886a3f4c6225009410:internal/core/capture/findingkey_test.go:generic-api-key:17
+
+# Commit 710b9626b added the away mode's created-branch test (itd-2610180912189125)
+# with `testCopyKey = "<32 hex>"`, and generic-api-key reads the `Key = "…"`
+# assignment as a credential. The value is a dummy copy key; the tip builds
+# it at runtime instead.
+710b9626ba07debc4e9c7e3f73eedaf81221b9f2:internal/core/autonomy/branches_test.go:generic-api-key:10
diff --git a/internal/core/autonomy/branches_test.go b/internal/core/autonomy/branches_test.go
index b7a80da91d..41043600ce 100644
--- a/internal/core/autonomy/branches_test.go
+++ b/internal/core/autonomy/branches_test.go
@@ -2,12 +2,15 @@ package autonomy
 
 import (
 	"fmt"
+	"strings"
 	"sync"
 	"testing"
 	"time"
 )
 
-const testCopyKey = "0123456789abcdef0123456789abcdef"
+// testCopyKey is a copy key's shape, built at runtime so no key-shaped
+// literal sits in source (principles/secret-shaped-fixtures-at-runtime.md).
+var testCopyKey = strings.Repeat("0123456789abcdef", 2)
 
 func testStore(t *testing.T) Store {
 	t.Helper()

From 4b913ee2b53735deaceeb4f4312d1e43ddc82ac4 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Thu, 22 Oct 2026 21:03:40 +0100
Subject: [PATCH 57/58] fix: handle RootCommit's error in the away store after
 main's change

Main changed gitutil.RootCommit to return (string, error), so a failed
git call is never read as a repository with no root commit. The away
store, written against the old signature, no longer built on the merge
result, and the merge queue dropped the PR twice for it.

openStore now stops with git's failure rather than ErrNoRootCommit, as
lab and the implement loop do. ResolveCopy treats a noted copy git
cannot answer for as unconfirmed and acts from cwd's worktree, as it
already did when Toplevel failed there.

Assisted-by: Claude:claude-opus-5-5
---
 internal/core/autonomy/sessions.go   |  8 ++++++--
 internal/core/autonomy/store.go      |  7 ++++++-
 internal/core/autonomy/store_test.go | 13 +++++++++++++
 3 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/internal/core/autonomy/sessions.go b/internal/core/autonomy/sessions.go
index 94ae307d5e..5139e1e343 100644
--- a/internal/core/autonomy/sessions.go
+++ b/internal/core/autonomy/sessions.go
@@ -133,8 +133,12 @@ func ResolveCopy(cwd, sessionID string, o Options) (string, Store, error) {
 		return root, st, err
 	}
 	if c, ok := st.SessionCopy(sessionID); ok {
-		if top, err := gitutil.Toplevel(c); err == nil && gitutil.RootCommit(top) == st.RootSHA() {
-			return top, st, nil
+		// A noted copy git cannot answer for is not confirmed, and the
+		// session acts from cwd's worktree, as when it is no repository.
+		if top, err := gitutil.Toplevel(c); err == nil {
+			if sha, err := gitutil.RootCommit(top); err == nil && sha == st.RootSHA() {
+				return top, st, nil
+			}
 		}
 	}
 	return root, st, nil
diff --git a/internal/core/autonomy/store.go b/internal/core/autonomy/store.go
index 5e535c0d63..92eec01256 100644
--- a/internal/core/autonomy/store.go
+++ b/internal/core/autonomy/store.go
@@ -53,7 +53,12 @@ type Store struct {
 // repoRoot, below home: keyed on the repository's root commit, so every
 // working copy of it opens the same store. Nothing is created.
 func openStore(home, repoRoot string) (Store, error) {
-	sha := gitutil.RootCommit(repoRoot)
+	sha, err := gitutil.RootCommit(repoRoot)
+	if err != nil {
+		// Not ErrNoRootCommit: git did not answer, and the store is neither
+		// keyed nor read on a guess.
+		return Store{}, fmt.Errorf("reading the repository's root commit to key the away store on: %w", err)
+	}
 	if !gitutil.IsFullSHA(sha) {
 		return Store{}, ErrNoRootCommit
 	}
diff --git a/internal/core/autonomy/store_test.go b/internal/core/autonomy/store_test.go
index a40ab238ca..0b2ab99576 100644
--- a/internal/core/autonomy/store_test.go
+++ b/internal/core/autonomy/store_test.go
@@ -12,6 +12,7 @@ import (
 	"github.com/intentdriven/abcd/internal/abcdhome"
 	"github.com/intentdriven/abcd/internal/fsutil"
 	"github.com/intentdriven/abcd/internal/gittest"
+	"github.com/intentdriven/abcd/internal/gitutil"
 )
 
 // managedCopy is a checkout with one commit and the local tier, under a HOME
@@ -40,6 +41,18 @@ func fixedOptions(home string, now time.Time) Options {
 	}
 }
 
+// TestOpenStoreRefusesWhenGitGivesNoRoot: a root commit git did not answer
+// for is not "no root commit". Opening the store stops with git's failure,
+// not ErrNoRootCommit, and the store is never keyed on a guess.
+func TestOpenStoreRefusesWhenGitGivesNoRoot(t *testing.T) {
+	root, home := managedCopy(t)
+	gittest.ShimGit(t, []string{"--max-parents=0"}, "", 128)
+	_, err := openStore(home, root)
+	if !errors.Is(err, gitutil.ErrNoRootAnswer) || errors.Is(err, ErrNoRootCommit) {
+		t.Fatalf("openStore with git failing = %v, want gitutil.ErrNoRootAnswer and not ErrNoRootCommit", err)
+	}
+}
+
 // TestConcurrentWritesUnderLock: queued steps racing keep every step, and a
 // stop recorded after `mode back` re-reads inside the lock and does not turn
 // the mode back on.

From e25a58de4bf95d48cef49d676ebf7eaabb3615db Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Thu, 22 Oct 2026 21:21:41 +0100
Subject: [PATCH 58/58] chore: capture the away Stop hook's silent allow on a
 git failure

The review pair on the RootCommit adaptation found that the Stop hook
allows a stop with nothing on stderr when git does not answer for the
root commit. The behaviour predates the adaptation; it is filed rather
than changed on the release's critical path.

Refs: iss-2610222021318139
Assisted-by: Claude:claude-opus-5-5
---
 ...18139-the-away-mode-stop-hook-allows-a-stop.md | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 .abcd/work/issues/open/iss-2610222021318139-the-away-mode-stop-hook-allows-a-stop.md

diff --git a/.abcd/work/issues/open/iss-2610222021318139-the-away-mode-stop-hook-allows-a-stop.md b/.abcd/work/issues/open/iss-2610222021318139-the-away-mode-stop-hook-allows-a-stop.md
new file mode 100644
index 0000000000..da830e4975
--- /dev/null
+++ b/.abcd/work/issues/open/iss-2610222021318139-the-away-mode-stop-hook-allows-a-stop.md
@@ -0,0 +1,15 @@
+---
+schema_version: 1
+id: "iss-2610222021318139"
+slug: "the-away-mode-stop-hook-allows-a-stop"
+severity: "minor"
+category: "bug"
+source: "impl-review"
+found_during: "abcd-50 review pair of the RootCommit adaptation on PR #1101"
+origin: researcher-authored
+production_mode: hand-written
+found_at: "internal/surface/cli/hook_stop.go"
+remedy: "On a Resolve error that is not ErrNoRootCommit, keep allowing the stop but print one stderr line naming git's failure (and record it in the away record where the store is reachable); fix the comment at hook_stop.go:139 and the matching drop in owedread.go:427."
+---
+
+The away-mode Stop hook allows a stop silently when git does not answer for the repository's root commit. Resolve now returns ErrNoRootAnswer or ErrGitTimedOut (wrapped) instead of ErrNoRootCommit, and hook_stop.go returns nil on any Resolve error under a comment that says the folder is not a checkout abcd can key a store on. On a loaded machine where the rev-list is killed, an away session stops with nothing on stderr and nothing in the away record, though the hook's help says every allowed stop is explained. owedread.go drops the same error the same way, so recorded branches leave the stop check without a note.