Development record
The away mode's stop check reads the forge once, as its documented meaning
Context
Brief invariant 7 says abcd asks the network nothing on its own: implicit checks read disk only, and a fetch happens only when the user invokes a verb or flag whose documented meaning is that fetch (adr-38). The stop check of itd-2610180912189125 runs from the host's Stop hook at every turn's end, which no one invokes by name.
Two of the four kinds of owed work live only on the forge: whether a session's own pull request is behind its base or failing its checks, and whether one carries a reservation's work. Plan review round 2 showed that the disk cannot answer the first in the night: the last-fetched default branch is stale, so a pull request that fell behind after the last fetch never reads as behind (blocker 2, dcn-2610181003464379). The drain's own reads of the remote were written into invariant 7 the same way, as the documented meaning of its verb.
Decision
We will treat setting the away mode (abcd mode autonomous, which the
person runs or asks a session to run, and which grants no push rights,
dcn-2610181016510153) as invoking the stop check's forge read while the mode holds:
at most one pull-request listing per check (head and base branch, author,
body, merge state, review decision and check rollup, at most 200 pull
requests), under a ten-second deadline. When the person's forge login is
known (the holder name reservations resolve without a network read), the
listing covers every open pull request in the repository, not only the
person's: the reader needs other people's pull requests to tell a branch
whose open pull request another person authored from the session's own, and
to leave it out. When the login is unknown, the listing asks for the
person's own pull requests alone (--author @me) and that rule is not
applied. There is no cache, so a run of
eight blocks costs up to eight listings, each bounded by the deadline; a
reuse cache is remaining work of itd-2610170638184486 (dcn-2610181017056307).
We will keep the check disk-only whenever the away mode does not hold: no turn's end while the person is present touches the network.
We will name a failed or late read, never hide it: the check fails open to the disk kinds alone, with the pull requests named as not read. A branch with a pull request is then compared on disk with the last-fetched default branch, naming the fetch time, and a reservation is never reported as uncarried, so a failed read cannot lead a session to open a duplicate pull request (plan review round 3).
We will add this listing to invariant 7 as the away mode's documented meaning, beside the drain's.
Alternatives Considered
- Disk only, always. Keeps invariant 7 untouched. Rejected: "behind" is then measured against a default branch nothing refreshes overnight, and a reservation's carrying pull request cannot be seen, so the stall the slice fixes (iss-2610170619247185) recurs on exactly the pull requests that fell behind in the night.
- A fetch of the default branch at each check. Answers "behind" from disk after a fetch. Rejected: it is a network read all the same, it still cannot see checks, reviews or links, and it would run while the person is present unless also confined to the away mode.
- One listing per check while away, chosen. One call, bounded in time, and only inside a window the person opened.
Consequences
- Invariant 7 gains a third verb-scoped meaning; the zero-network test harness must show the present-mode check makes no forge call (TestPresentReadsDiskOnly).
- The forge client must be signed in for the away check to read pull requests; when it is not, the check says so and judges from disk, which the intent's scope conditions already name.
- A later intent that wants the forge read while the person is present needs its own amendment; this record does not cover it.
Frontmatter
| id | adr-2610181003541997 |
|---|---|
| type | adr |
| status | proposed |
| date | 2026-10-18 |
.abcd/development/decisions/adrs/2610181003541997-the-away-mode-s-stop-check-reads-the.md
open on GitHub ↗ · commit history ↗
References2
- adr-38Implicit checks are disk-only — the network answers only an explicit askrelated
- itd-2610180912189125A session left to work on never stops while it has workrelated
Referenced by1
- adr-2611050740453233A stop is recorded state a person sets, and one shared folder is the exception to the owner-only storerelated
mentions7
- dcn-26101810034643792026-10-18 — While the person is away, a pull request is behind when the forge says so (facilitator-on-delegation, itd-2610180912189125 review round 2, blocker 2; refines dcn-2610180936571036): the stop check reads "behind" from the merge state (`mergeStateStatus` BEHIND) in its one pull-request listing, not from the last-fetched default branch, which nothing refreshes overnight, so a pull request that fell behind after the last fetch still reads as owed. Only a branch with no pull request is compared on disk, and the reason names when that ref was last fetched (grounds: plan review round 2, blocker 2; the pinned pull-request fields in internal/ghcontract)
- dcn-26101810165101532026-10-18 — The away mode grants no push rights: the person's own standing instruction stays the authority to commit, push, and open or merge a pull request, exactly as before the mode existed (facilitator-on-delegation on the release orchestrator's ruling, itd-2610180912189125 after plan review round 2; supersedes dcn-2610181003456444, round 2's choice (a), and with it the guard entries that made setting the mode the person's act alone). The OS sandbox of spc-2610161751056096 fences only the agents abcd's runner launches, never the person's own interactive sessions, so for the sessions that actually stalled on 2026-10-16 the guard entries would never become a boundary, and their two days would buy a trust claim the plan cannot make. The fallback dcn-2610181003456444 already named is taken now, not on the live capture's evidence. Where the stop check finds owed work that needs a push (an unpushed branch, a reservation whose work no pull request carries, a behind or failing pull request once its local fix is committed), its reason tells the session to push if its standing instruction allows, and otherwise to queue the push with abcd mode queue for the person's return; a queued step that names the item's branch or record id, on word boundaries, hands that item back to the person for the rest of the window (a branch only while it holds commits its upstream lacks, so only the push waits), and the stop check stops naming it. The away mode is never treated as permission. The person-only acts gain pushing, opening or merging a pull request without a standing instruction that allows it. Who sets the mode returns to dcn-2610180913399042: the person, or a session on their word in that session; since the mode grants nothing, a mode set on a relayed word only keeps sessions working and deciding instead of asking, and the person sees who set it, from which working copy, and the literal abcd mode back on their next prompt. Making the mode the person's act alone moves to itd-2610170638184486 as named remaining work: the guard entry refusing an agent's abcd mode autonomous, its other routes (sh -c and script files), the shell-write and file-tool refusals on the away store, the refused attempts recorded and shown, the capture's checks of the person's ! command and of a relayed !, and the guard reading go run ./cmd/abcd and built abcd-<goos>-<arch> binaries as abcd for every entry, the ledger flip included, a security-relevant widening that gets its own review there (grounds: the release orchestrator's ruling of 2026-10-18 and the reviewer's addendum, both recommending the fallback; spc-2610161751056096 and adr-2610161621415708, which fence launched agents only; iss-2610170619247185, whose standing instruction already allowed pushes and auto-merge; the fallback clause of dcn-2610181003456444)
- dcn-26101810170563072026-10-18 — The overnight-stall slice is trimmed to what closes iss-2610170619247185 and nothing else (facilitator-on-delegation on the release orchestrator's ruling, itd-2610180912189125 after plan review round 2; refines dcn-2610180937181929): it keeps (i) a session with owed work cannot end its turn silently, through the Stop hook stop check with the ownership rules, the qualifying wake and the cap handling the reviews required; (ii) questions rerouted by the act, every other question decided with abcd decide and the person-only acts queued; and (iii) the away record set, ended, lapsing after at most seven days, re-injected at start, compaction and every prompt, under its lock. Moved to itd-2610170638184486 as named remaining work: the person-only guard step (dcn-2610181016510153), with the guard's reading of go run ./cmd/abcd and built binaries as abcd; the ten-minute reuse cache of the away forge listing and its stale-cache fallback, so each away check makes at most one listing under its ten-second deadline and a failed read judges from disk naming the pull requests as not read (adr-2610181003541997, still proposed, amended to match); abcd mode back printing more than one plain line per queued step and per recorded stop (any grouping, formatting or window summary); and the refused-attempt lines on the prompt. Kept despite the trim, because a review finding's fix rests on each: the created-branch list recorded in any mode (round-2 blocker 3, the drain's stacked branches, instance 2 of the issue); the Refs rule and word-boundary matching (blocker 4); the stale-ownership bounds (blocker 5); the wake deadline with the host's lateness and the cron cases (blocker 1); the forge's merge state for behind, with the one bounded listing and invariant 7's clause (blocker 2); the person-only acts list (blocker 6); the every-prompt line and the lapsed-window line naming abcd mode back (blocker 7); the block count and its possibly-forced label (round-2 (b)); the clearing rule's review and receipt terms (round-2 minors); the record's lock, ownership checks and seven-day cap (round-1 findings 6 and 7); the recorded ender (round-1 finding 13); the StopFailure record and the prose-question block (round-1 finding 11); and the badge verbs refused while away, which keeps a question from waiting on the person through the badge (dcn-2610180913431493). Re-estimated at 5.75 working days over seven steps, down from eight; about four is not reachable without reopening blockers 1 to 5, since the owed-work reading and the stop verdict with its cron parser carry 3.5 days between them and every rule in them answers a finding; the verdict is pure over the owed set, so two lanes could bring the elapsed time to about four days if the release orchestrator chooses (grounds: the release orchestrator's ruling of 2026-10-18 and the reviewer's addendum listing what stays; the spec's review rounds 1 and 2; AGENTS.md wired or it isn't done)
- iss-2610170619247185An agent session told to work autonomously overnight sat idle for about ten of the eleven and a half hours between 20:48 BST on 2026-10-16 and 07:13 BST on 2026-10-17, while it held owed work it could have done alone.
- itd-2610170638184486Every session keeps a checklist on disk, so no run stalls and no stall spreads
- itd-2611041549471712A person stops the unattended runs of each account that chose a folder, with one command
- spc-2610180914469489A session left to work on never stops while it has work