feat: keep an autonomous session working while the person is away

.abcd/development/brief/02-constraints/03-invariants.md

@@ -117,6 +117,25 @@ The following are non-negotiable invariants — any architectural choice that vi
    status branch holding a standing announcement it has not asked about. The
    prompt hook shows the announcements, the doubts and the release holds from
    the last completed fetch, from disk alone, and asks the network nothing.
+   The away mode (itd-2610180912189125) is the person's word that sessions
+   work on while they are away: setting it (`abcd mode autonomous`) invokes,
+   for as long as it holds, the stop check's one read of the forge at each
+   turn's end, at most one listing of the open pull requests through the
+   forge client (`gh pr list`: head and base branch, author, body, merge
+   state, review decision and check rollup), every open one when the
+   person's forge login is known, so another person's pull request can be
+   told from the session's own, and the person's own alone when it is not,
+   under a ten-second deadline, with
+   no cache, so a run of eight blocked stops costs up to eight bounded
+   listings. A listing that fails or is late is named as not read, never
+   hidden, and the check judges from disk alone: every pushed branch of the
+   session's own is compared with the last-fetched default branch, naming
+   when it was fetched, and a reservation is never reported as carried by no
+   pull request. Whenever the away mode does not hold, the stop check reads disk
+   only, and no turn's end touches the network, held by
+   `TestPresentReadsDiskOnly`
+   ([adr-2610181003541997](../../decisions/adrs/2610181003541997-the-away-mode-s-stop-check-reads-the.md),
+   which refines adr-38 for this verb's meaning alone).
    Inbound, abcd listens on a network only through the dashboard, only while
    someone has started it on purpose, and only for the people let in: it
    listens on this computer's own Tailscale addresses alone, never every

.abcd/development/brief/04-surfaces/01-ahoy.md

@@ -659,7 +659,7 @@ carries the prompt-router entries it expects. Neither install nor uninstall ever
 mutates it: the manifest is plugin-static. A missing or malformed manifest
 surfaces as a non-resolvable diagnostic.
 
-The shipped manifest wires seven event types, and every event command is a
+The shipped manifest wires nine event types, and every event command is a
 resolving shim rather than a plain binary call. Five of them self-provision.
 `UserPromptSubmit`, `PreToolUse`, `PostToolUse` and `PreCompact` each attempt
 `hooks/bootstrap.sh` only when the plugin-root binary is missing, recording the
@@ -668,8 +668,10 @@ window. `UserPromptSubmit`, the hook that runs on every message, declares a
 120-second `timeout`, the time a salvage on a slow link has before the host
 cancels it; `PreToolUse`, `PostToolUse` and `PreCompact` declare none and take
 the host's ten-minute default, so a slow first download finishes there. `SessionStart`
-declares 240 seconds, the script's worst case with room to spare, and
-`SessionEnd` and `SubagentStop` declare none. Every event that runs the script,
+declares 240 seconds, the script's worst case with room to spare,
+`SessionEnd`, `SubagentStop` and `StopFailure` declare none, and `Stop` declares
+30 seconds, room for the away mode's stop check to make its one forge listing
+under its own ten-second deadline and its git reads. Every event that runs the script,
 `SessionStart` included, names a `statusMessage` the host shows as its spinner
 text while the hook runs, so the wait is never a silent stall: the salvage
 itself sends the script's output nowhere. The message states no duration,
@@ -689,6 +691,12 @@ capture (iss-2608210934566223). Each resolves the plugin root, then `PATH`, then
 says in one line that the transcript was not captured. `SubagentStop` never
 returns a non-zero code of its own beyond that refusal, because exit 2 is the
 host's BLOCKING status on that event and would stop the sub-agent finishing.
+`Stop` and `StopFailure`, which carry the away mode's stop check
+(spc-2610180914469489), download nothing either: both fire at a turn's end, where
+a fetch would hold the session, and each resolves the plugin root, then `PATH`,
+then says in one line what did not happen, with exit 1, never the `Stop`
+event's blocking 2: `Stop` that the stop check did not run, `StopFailure` that
+a turn ended on an API error was not recorded.
 
 **The `PATH` rung is owned-only** (GHSA-gx3m-3224-qqcv, CWE-426). It accepts only
 an absolute resolution out of a directory that is neither under the shim's

.abcd/development/brief/04-surfaces/08-abcd.md

@@ -22,14 +22,15 @@ answer.
 
 | Verb | Bucket | Status |
 |---|---|---|
-| `mode` | — | shipped |
 | `peers` | — | shipped |
 
 This is the bare command's chapter, so the rule compares its table with the
 command tree in neither direction: the surfaces index is what covers the
-top-level verbs. The rows are the two top-level verbs this chapter documents
-beneath the board, and neither registers a sub-verb of its own. The record-id
-form is a positional on the root, not a sub-verb.
+top-level verbs. The row is the top-level verb this chapter documents beneath
+the board, and it registers no sub-verb of its own. `abcd mode`, which stores
+the badge's state and keeps the away mode, has its own chapter,
+[`26-mode.md`](26-mode.md). The record-id form is a positional on the root,
+not a sub-verb.
 
 ## What ships today
 
@@ -621,12 +622,6 @@ _Generated from the command tree; a drift test fails `go test` when this appendi
 | `--version` | bool |
 | `--view` | string |
 
-### `abcd mode`
-
-Sub-verbs: none.
-
-Flags: none.
-
 ### `abcd peers`
 
 Sub-verbs: none.

.abcd/development/brief/04-surfaces/17-guard.md

@@ -3,8 +3,10 @@
 A destructive shell command typed by accident costs a person hours: a force
 push that erases a colleague's commits, an `rm -rf` with an unlucky glob, a
 `git clean` over uncommitted work. `/abcd:guard` catches those before they run
-and says what to run instead. It writes nothing, and it costs nothing to have
-on: an unrecognised command passes through untouched.
+and says what to run instead. It writes nothing but the record of a branch an
+agent creates and, when it admits abcd's own question where the badge shows,
+the waiting-on mode and the marker saying a question is open (both below), and
+it costs nothing to have on: an unrecognised command passes through untouched.
 
 Two things use it. A person or a script asks it about one command line. A
 compatible agent harness asks it about every command the agent is about to run,
@@ -206,6 +208,64 @@ them, is not a decision: the question runs and the hook says so on exit 1, the
 same fail-open-loud contract below. The manifest's pre-tool-use matcher names the
 shell tool and the question tool, and nothing else.
 
+**While the person is away** (spc-2610180914469489, "The question reroute";
+dcn-2610180937177502, dcn-2610181003477194), the gate reads the away record
+(`internal/core/autonomy`, the person's word that they are away, set through
+`abcd mode`) before anything above. While it holds, every call to the question
+tool is refused with the host's deny and one reason, whatever the chip: abcd's
+question or another
+tool's, chipped or not, and a questions field the check cannot read alike,
+from any working copy of the repository. Nothing past the away check runs, so
+no mode is set from a chip and no question is marked open; the badge's
+chip-set path is never reached while away. The reason names none of the asking
+rules, so the agent reroutes the question rather than redrafting it. It routes
+the question by the act it asks about (`autonomy.QuestionRoute`, which carries
+the list of acts only the person may approve): such an act is queued with
+the queue `abcd mode` keeps for their return, and the session carries on with
+other work. The acts are an embargo close's approval digest, the embargo
+triage verdict, the drain's hand-back, the confirmed apply verb for remote
+configuration, a release sign-off (a cut, or a step of one, that asks for the
+person by name or that no standing instruction of theirs allows; a standing
+permission for automatic cuts stands, and the away mode adds none), pushing,
+opening or merging a pull request without a standing instruction of the
+person's (the away mode is never that instruction), publishing, a visibility
+change or an outward comment or message, a new dependency, a secret, a
+credential or an App, a step only a website or a browser can do, a
+destructive act, anything that spends money, and any other act a command page
+or a brief invariant names as the person's. Every other question, product or
+technical, is decided and recorded with `abcd decide`, with its grounds and
+how to reverse it. **Nothing detects the act mechanically:** the agent
+classifies its own question from the reason's list, and the guard's registry
+entries enforce only what they name, a force push and a skipped hook among
+them. An away record or lock the store refuses reads as not away: the question
+is checked as if the person were present, and the hook says so on stderr,
+with exit 1 where it would otherwise admit the question silently.
+
+## The created-branch recorder
+
+The pre-tool-use hook also records each branch a shell command creates, for
+the away mode's reading of the session's own branches (itd-2610180912189125,
+spc-2610180914469489 step 3). The stacked drain branches of 2026-10-17 were cut
+with a plain `git worktree add` and left no upstream, no entry in the
+coordinating copy's reflog, no run state and no record id, so nothing else could
+tell they were the session's. Before the guard judges the command, the hook
+reads it for `git worktree add -b|-B <b>`, `git switch -c|-C <b>`, `git checkout
+-b|-B <b>` and `git branch <b>` (each recorded only when no branch of that name
+exists yet), a bare `git worktree add <path>` (the branch git names after the
+folder) and `git worktree add <path> <branch>`, and `git branch -m|-M <old>
+<new>`, which carries a record from the old name to the new. Branch names match
+as whole names, so `feat/x` never stands for `feat/x2`. A word a substitution
+or a variable prints is read as no branch.
+
+The record is kept whether or not the person is away, under the working copy's
+key (the reservations' copy key) in the away store, `~/.abcd.noindex/away/<root-sha>/`,
+written under the store's lock through its atomic writer, in a list capped at
+the hundred most recent, the oldest dropped. The recorder records and **refuses
+nothing**: a store it cannot write leaves one stderr line and the command goes
+on to the guard's own judgement, and a checkout abcd does not manage (no
+`.abcd/` at its root or at its main worktree's) records nothing. A record made for a command that then fails names a branch that does
+not exist, and the away mode's reading ignores it.
+
 ## Fail-open-loud
 
 A broken guard never bricks a session and never silently stops protecting one.

.abcd/development/brief/04-surfaces/26-mode.md

@@ -0,0 +1,121 @@
+# `/abcd:mode` — Whose Answer the Loop Waits On, and the Away Mode
+
+`/abcd:mode` holds two facts the agent loop is judged by. The first is the
+waiting-on state behind the status line's badge: `managed`, `facilitator` or
+`product-thinker`, stored per checkout at `.abcd/.work.local/mode`, printed by
+bare `abcd mode` and set by `abcd mode <state>` (itd-200, spc-70). The badge,
+who sets it and when it resets are described with the board that shows it, in
+[`08-abcd.md`](08-abcd.md) ("The presence line" and "The badge is true at
+every stop"). The second is the away mode, below: the person's word that they
+are away and sessions should work on (itd-2610180912189125,
+spc-2610180914469489).
+
+## Sub-verbs
+
+> _Machine-checked (`surface_coverage`, spc-27): each row records the verb's
+> adr-40 bucket (`lint` / `review` / `audit` / `gate`, or `—` for a
+> non-assessment verb) and its existence (`shipped` / `staged`). The existence
+> fact is verified against the committed command-tree snapshot in both
+> directions. The bucket cell is checked for membership of the closed adr-40
+> vocabulary only: the snapshot carries no bucket field, so a bucket that is
+> wrong but legal passes, and that cell stays a review-grain claim._
+
+| Verb | Bucket | Status |
+|---|---|---|
+| `autonomous` | — | shipped |
+| `back` | — | shipped |
+| `queue` | — | shipped |
+
+## The away mode
+
+Beside the badge, and never a fourth word, the away mode records the person's
+word that they are away and sessions should work on. Setting it records, once
+for every working copy of the repository on the machine, who set it (the
+holder name reservations resolve without a network read, else git's
+`user.name`), from which working copy, when, and when it ends. The record
+lives in `~/.abcd.noindex/away/<root-sha>/`, keyed on the root commit as the worktree
+store is.
+
+**When it ends.** The end is a clock time (its next occurrence, local time)
+or a timestamp, or nothing, which leaves the record open-ended. Every record
+ends seven days after it was set at most, so an end past that, or one already
+past, is refused with nothing written. The person may also say that pushes
+wait for their return; that word is kept in the record, narrows what sessions
+do, and grants nothing. A prompt never ends the mode; its time does, or the
+person's word that they are back.
+
+**The queue and the return.** While the record holds, a session keeps a step
+for the person's return instead of asking them: an act only the person may
+approve. On their return the record is ended by word, which prints one plain
+line per queued step, per item handed back and per recorded stop (a stop at
+the host's cap labelled "possibly forced by the cap"), records who ended it and
+from which working copy, and closes the record, on a record whose time has
+passed as on one that holds.
+
+**It grants no rights.** The person's own standing instruction stays what
+decides whether a session commits, pushes, or opens or merges a pull request.
+
+**The lock and the checks.** Every change to the record holds a lock file
+beside it and re-reads the record inside the lock, so two writers never lose
+an update and a check that read the record before the person came back never
+writes it back; only ending the mode goes around a lock it cannot have
+(below). The record and the lock are used only when each is a regular file
+this account owns that no one else can write, within 64 KiB: one that fails
+those checks, or does not parse, reads as not away, and queueing a step
+refuses it, naming the file. Setting the mode refuses the same, except that it
+carries a record merely past 64 KiB, letting its oldest lines go.
+
+**Ending never refuses on the record.** The person's word that they are back
+ends the mode whatever state the record or its lock is in. A record past
+64 KiB is printed whole and kept with its oldest lines let go; one that does
+not parse, or is not safely this account's, is replaced by a closed record,
+printing nothing from it; and a lock not had within two seconds, or not safe
+to take, is gone around, closing without it. Each is named on its own line.
+
+**The badge while away.** While the record holds, parking the badge on the
+product thinker or the technical facilitator is refused, naming
+`abcd decide`, since a stop parked on a person who is away is a question
+nobody answers.
+
+Every refusal of the away verbs exits 2 with nothing written: an unreadable
+or past end, one past seven days, a checkout without the local tier (checked
+only when setting the mode), no checkout, a queued step with no record holding
+or with no words, and, when setting the mode or queueing a step, a lock not
+had within two seconds and a record or lock that fails the checks. Ending the
+mode refuses only where there is no checkout, no home or no root commit to key
+the record on. None makes a network request.
+
+<!-- surface-appendix:begin — generated from the command tree by `go generate ./internal/surface/cli`; never edit by hand -->
+
+## Appendix: the shipped surface
+
+_Generated from the command tree; a drift test fails `go test` when this appendix and the tree disagree. It lists flags and sub-verbs only. What each flag means is in the [CLI reference](../../../../docs/reference/cli/commands.md), and exit codes, output fields and behaviour are the prose's to state._
+
+### `abcd mode`
+
+Sub-verbs: `abcd mode autonomous`, `abcd mode back`, `abcd mode queue`.
+
+Flags: none.
+
+### `abcd mode autonomous`
+
+Sub-verbs: none.
+
+| Flag | Type |
+|---|---|
+| `--hold-pushes` | bool |
+| `--until` | string |
+
+### `abcd mode back`
+
+Sub-verbs: none.
+
+Flags: none.
+
+### `abcd mode queue`
+
+Sub-verbs: none.
+
+Flags: none.
+
+<!-- surface-appendix:end -->

.abcd/development/brief/04-surfaces/README.md

@@ -34,7 +34,7 @@ are wiring rather than user-facing surface are listed separately under
 | 23 | `/abcd:reading` | shipped | Assemble what a cold reading may see, prove it, and validate what comes back | [`23-reading.md`](23-reading.md) |
 | 24 | `/abcd:decide` | shipped | Record a decision as one file that merges cleanly, list every decision newest first, or mint an ADR with its id, date and skeleton | [`24-decide.md`](24-decide.md) |
 | 25 | `/abcd:worktree` | staged | Keep session and agent worktrees in a machine-scoped store rather than beside the checkout (design target — [itd-2609091014076309](../../intents/planned/itd-2609091014076309-session-and-agent-worktrees-live-in-a.md)) | [`../05-internals/03-configuration.md` § The worktree store](../05-internals/03-configuration.md#the-worktree-store) |
-| 26 | `/abcd:mode` | shipped | Say whose answer the agent loop is waiting on, so the status line and the board show it | [`08-abcd.md`](08-abcd.md) |
+| 26 | `/abcd:mode` | shipped | Say whose answer the agent loop is waiting on, so the status line and the board show it, or that you are away and sessions should work on | [`26-mode.md`](26-mode.md) |
 | 27 | `/abcd:implement` | shipped | Share one autonomous run between two sessions: claim a record before its lane, keep the second session inside its bounds, and compare the ways of dividing the work from the run log | [`27-implement.md`](27-implement.md) |
 | 28 | `/abcd:peers` | shipped | See what the sibling worktrees and local branches hold before capturing, fixing or filing anything | [`08-abcd.md`](08-abcd.md) |
 | 29 | `/abcd:report` | shipped | Tell abcd about a defect or propose an enhancement from a repository it manages, into an inbox in your own account | [`29-report.md`](29-report.md) |

.abcd/development/brief/05-internals/03-configuration.md

@@ -1326,14 +1326,20 @@ names a `statusMessage`, the host's spinner text while the hook runs, because th
 salvage sends the script's output nowhere; the text states no duration, since
 those limits differ. A test pins every event's timeout and the message
 (`internal/surface/cli/hooks_timeout_test.go`). `SessionEnd` and
-`SubagentStop` are the two
+`SubagentStop` are among the four
 exceptions and download nothing at all: each fires where the harness cancels a slow
 hook rather than wait — one as the session exits, the other inside a live session as
 a sub-agent finishes — so a fetch there races that cancellation and loses the
 transcript the hook exists to capture (iss-2608210934566223). Both resolve the
 plugin root, then PATH, then say the transcript was not captured. `SubagentStop`
 additionally never exits non-zero beyond that refusal, because exit 2 is the host's
-BLOCKING code on that event.
+BLOCKING code on that event. `Stop` and `StopFailure` carry the away
+mode's stop check (`hook stop`, `hook stop-failure`, spc-2610180914469489) and fire
+at a turn's end, where a fetch would hold the session; each resolves the plugin
+root, then PATH, then says what did not happen, at exit 1, never `Stop`'s
+blocking 2: `Stop` that the stop check did not run, `StopFailure` that a turn
+ended on an API error was not recorded. `Stop` declares a 30-second `timeout`, room for the check's one forge
+listing under its own ten-second deadline; `StopFailure` declares none.
 
 `SessionEnd` carries `hook session-end`, which stages the session's own transcript;
 `SubagentStop` carries `hook subagent-stop`, which stages a finished sub-agent's