Development record

A session that takes over a run steps on from what abcd wrote down

intentplannedmajorstandaloneitd-2611041549461012

Press Release

When the session coordinating unattended runs dies, the next session picks the runs up from what abcd wrote down, and nothing is started twice. Alice runs abcd unattended on a second account of their computer. When the session driving the runs is gone (a crash, a lost connection, a compaction that forgot), the next session types abcd implement resume: it lists every run this machine drives, each lane's stage, each agent still alive or lost, the receipts that arrived while nobody collected them, the pull requests waiting on the queue and how far each lane's base has moved, and the work each lane left uncommitted, and it steps on from there. An agent whose receipt is waiting is collected before any fresh one starts, and work left uncommitted is saved aside and named before anyone builds over it. "I used to find a second implementer paid for the work the first had finished, and a step loop nobody owned still launching agents," said Alice, a solo founder. "Now a restart reads the record instead of guessing."

Why This Matters

The restart half of an unattended run has its evidence in the loop's own issues. A step loop a stopped session left in the background kept stepping its run and launching agents on a key nobody watched, and the successor could not learn from the run who drove it, from which process, or which key its launches spent (iss-2611022247128872); the run state's Driver is a string naming the kind of driver, not a live record. A finished agent was stranded when the step that would collect it was refused, and every later step asked for a fresh implementer though the receipt sat at the awaited path, which an unattended run would have paid for twice (iss-2611031337115764). Stopping a stage left no record of what it wrote, and a resume would have started a fresh implementer over ten changed files (iss-2611032348373007). A session's work in flight does not survive the host's compaction unless it wrote it down (iss-2610222026223032). A crashed copy stranded reserved records and left pull requests drifting (iss-2610241107435264, iss-2610241414414823), and a resume says nothing of how far a lane's base has moved (iss-2611040337228910). On 2026-11-03 the coordinator itself was a host session plus a polling script, so there is no coordinator to restart, only a session to replace; iss-2611031146255825 names the missing drive.

What already exists is the pieces: the run state and the drain state, each lane's checklist (abcd checklist), the restart of a gone implementer with its uncommitted work saved aside (internal/core/implement/loop/restart.go), the drain's first-signal cancel and second-signal kill, the run log's stop and intervention events (abcd implement log), and the launch ledger (itd-2611031342011261), whose entries carry each agent's process id so a reader judges liveness itself. The drain spec (spc-2610230813348813) already promises that a signal leaves a lane resumable and a second drive resumes it. This intent makes those pieces one path; its sibling, the stop switch (itd-2611041549471712), is the person's way to end the work on purpose.

Mechanism

We expect a successor to step on without starting anything twice because every fact it needs is a record the run wrote as it went, the live driver on the run state, each launch and its process in the ledger, each lane's work on its checklist and in the receipt path the await names, and the resume reads those records in one listing before it moves, collecting what arrived before it launches. The claim is shown wrong if a resume starts a fresh agent for an await whose receipt is already at its path, or builds a stage over uncommitted work without naming it first.

Scope Conditions

Holds for runs abcd drives on one machine: build runs, drain lanes and the terminal drive (itd-2610222215485265), whose plugin page stays an agent's command and whose terminal form stays the person's way to drive it (dcn-2611041550139264). A hosted runner's run is resumed by its host.
A process killed outright is outside the promise; the resume treats its agents as lost and its work as saved aside.
Recorded state means abcd's own files: the run and drain states, the checklist, the launch ledger and the log; never a session's transcript or memory.
Holds on macOS and Linux, where ~/.abcd.noindex/ is abcd's home; there is no Windows target.

Acceptance Criteria

Given a run, when a session drives it, then the state records the live driver (session, process id, start time) and each in-flight launch with its route, and a second driver is refused while the first is alive (iss-2611022247128872).
Given a driver that is gone, when the next session runs the resume, then it lists every run on the machine with each lane's stage, each agent alive or lost by its process, each receipt that arrived uncollected, each pull request waiting and how far each lane's base has moved (iss-2611040337228910), and the uncommitted work each lane holds; it collects an arrived receipt before it ever starts a fresh agent (iss-2611031337115764).
Given a lane with uncommitted work and no live agent, when the resume steps it, then the work is saved aside and named in the record before a fresh agent starts, never built on silently (iss-2611032348373007).
Given a drain stopped while awaiting a judgement, when it is resumed, then the judgement can be given or the entry is cleared (iss-2610110915210571).
Given a coordinator session that lost its context, when it resumes, then everything it needs is in the listing above and in the checklist, so nothing depends on the transcript (iss-2610222026223032).
Given a run the stop switch halted (itd-2611041549471712), when the stop is lifted and a session resumes, then the listing shows what the stop left in each lane and the reservations it released, and the resume reserves again before it steps.

Open Questions

None open. Every question the scratch draft of 2026-11-04 put for this half had one answer on the record: a stop takes hold at a tool-call boundary, never within one (dcn-2611031722512037); a coordinating session is walled where abcd starts it, and one the person starts off a profile is warned (dcn-2611031722512037, dcn-2611041550129278); the run's account of its launches is the ledger (itd-2611031342011261, decisions 7 to 12); a gone agent restarts fresh from its last commit with its uncommitted work saved aside (iss-2610080620372731).

Decisions

2026-11-04, the product thinker (dcn-2611041550139264): the restart path and the stop switch are two records, this one and itd-2611041549471712, as the scratch draft's decomposition proposed; the routing is confirmed.
2026-11-04, the product thinker (dcn-2611041550139264): a stop releases the run's claims on its work, so a resume after a stop reserves again before it steps.
2026-11-04, the product thinker (dcn-2611041550139264): the drain's plugin page stays an agent's command and the terminal form stays; the runs this path resumes include the terminal drive.

Decomposition

Hand-run four-piece table, 2026-11-04, from the scratch draft that held the stop switch and the restart path together; the product thinker confirmed the split (dcn-2611041550139264).

Part	Kind	Home
the resume listing, the live-driver record, collect-before-launch, saved-aside work, the drain's judging entry	capability	this intent
one command stops the runs of each account that chose the folder at their next move, lifted by the person's own command	capability	itd-2611041549471712, the stop switch
a stop is a recorded state read at each move, never a signal to a terminal; lifting it is the person's, by rule	trust rule	an ADR owed with the stop switch, extending adr-2610240850193281 (the grant permits, this withdraws) and dcn-2611031722512037; a brief invariant when accepted; not filed here
a run's account of itself lives in abcd's files, never in a session's memory	stance	a candidate principle, for the product thinker to confirm; not filed
the driver fields, the resume's output	plumbing	the brief's loop chapter, through this intent's spec

Verdict: SPLIT, confirmed. Typed links: refines itd-2610222215485265 (its spec's resume story becomes this path for every run); builds_on itd-2609201925079472 (the loop's pacing and checkpoints), itd-2611031342011261 (the ledger that names each agent's process) and itd-2610180912189125 (the autonomous mode's store, the shape a recorded state mirrors); related_issues as the frontmatter lists, whose remedies are the criteria above. Advisory reversal flags: none.

Audit Notes

Empty. Populated by intent-auditor when intent moves to shipped/.

Frontmatter

id	itd-2611041549461012
type	intent
lifecycle	planned
kind	standalone
severity	major

.abcd/development/intents/planned/itd-2611041549461012-when-the-session-coordinating-unattended.md
open on GitHub ↗ · commit history ↗

References3

itd-2609201925079472An autonomous run paces itself by default, and one flag sets the pacebuilds on
itd-2610180912189125A session left to work on never stops while it has workbuilds on
itd-2611031342011261abcd keeps a per-session ledger of every agent it launchesbuilds on

Referenced by10

adr-2611050740453233A stop is recorded state a person sets, and one shared folder is the exception to the owner-only storerelated
iss-2610110915210571A drain that an outage stops while it waits on a host judgement keeps its judging entry: that move prints 'awaiting the host judgement' beside 'ended: the run gave up', and a --judgement given afterwards is refused. Nothing wrong is written, but the drain both claims to wait and refuses the answer.related
iss-2610121528179959abcd has no shared handover place for concurrent sessions. On 2026-10-12 seven sessions had to close at once (usage limit) and resume days later as fresh sessions; the only convention, .abcd/.work.local/NEXT.md, holds one session's note and was stale from 2026-10-07, each session's scratchpad (lane briefs, cloud prompts, peer notes, security plans) is deleted when the session closes, and the coordinator improvised a per-session folder and template (.abcd/.work.local/handover-2026-10-14/) by message. Nothing lists which branches, worktrees, PRs, records on unmerged branches, private local-only branches and memory files each session leaves behind, so work can be orphaned across a closure.related
iss-2610241107435264A crashed copy strands records it reserved but never pushed, and nothing says so. After the 2026-10-24 crash, origin holds expired reservations whose footprints name records that exist nowhere on origin. Under reservation iss-2610222001116066 they are:related
iss-2610241414414823When a copy crashes, its open pull requests stay open and drift: by 2026-10-24 two of them (#1110 and #1116) conflicted with main after 89 and 128 commits, and nothing noticed or repaired them. A session had to find them, merge main into each by hand, resolve the conflicts and queue them, while the work they carried (a major issue's fix among it) stayed unmerged.related
iss-2611022247128872A step loop a stopped session left in the background keeps stepping its run and launching agents on a key nobody watches, and a preflight it started is orphaned (its parent gone): on 2026-11-02 a successor found run-2611020739372478 mid-step with no way to learn from the run who was driving it, from which process, or which key its launches spent.related
iss-2611032348373007Stopping a stage leaves no record of what it wrote, and nothing shows a lane's uncommitted work: on 2026-11-03 a coordinator stopped an implementer and recorded that it had written nothing, while its worktree held ten changed files, found only by the next session's own git status; implement status and step show nothing of them, so a resume would start a fresh implementer over them.related
iss-2611040337228910A resume does not report how far a lane's base has moved: on 2026-11-04 a lane resumed on a base seven hours old, so its pull request was behind main by more than twenty commits and its preflight judged the old base.related
spc-2611041706004822A session that takes over a run steps on from what abcd wrote downimplemented by
spc-2611050505250705the-restart-reads-the-forge-and-theimplemented by

mentions12

adr-2610240850193281A human-set autonomy grant permits, separately from the agent-written waiting-on badge
dcn-26110317225120372026-11-03 — The product thinker ruled on 2026-11-03 that drain --drive keeps its walled subscription route, and that watching is no control: a person cannot interrupt a tool call as it runs, so a person's presence never makes an unwalled agent acceptable. So every session that coordinates unattended work starts walled itself (no connectors or MCP servers, no personal memory, abcd's own guard hook kept), and a stage run as a host sub-agent gets only file and shell tools, never the person's connectors, browser or documents; a stage that cannot run within that limit does not run. This refines dcn-2611031720012399's host routing.
dcn-26110415501292782026-11-04 — The product thinker's rulings on the profiles draft itd-2611040344170206, at its planning interview. Every agent abcd starts unattended carries abcd's guard whichever way its work is paid for: a stage on the key route runs on a profile with hooks on, and the bare launch adr-2610222222326104 names for the key route gives way for stages. Each way of paying, a subscription or a named key, is one profile with its own login and its own bare settings; a worktree is where the files are, a profile is who pays and what an agent can reach, and abcd pairs one of each per agent. A subscription's profile needs one login by the person; a key's profile needs none. A session the person starts that runs work unattended off a profile is warned in a line that cannot be missed, never refused. Whether an agent on a profile may reach the machine's other sessions is a setting, off by default. A profile's name is a readable one, never a random string: abcd ships a neutral list, a themed one such as a television series' characters is the person's own in their machine configuration, and a name is fixed at creation and retired once used; this replaces the random names of the draft's fourth decision, and the registry records the name, the tool and the date. abcd ships a sensible default allow-list of tools and a repository configures it within one bound: a repository file may narrow the list, only the person's own machine configuration may widen it, and an agent can never widen it. The same stance settles every open question of that kind, those of the ledger draft itd-2611031342011261 among them: abcd ships a sensible default and the person configures it per repository. The draft's title and scope widen to every way of paying, keys included.
dcn-26110415501392642026-11-04 — The product thinker's rulings on the stop switch (itd-2611041549471712), the restart path (itd-2611041549461012) and the daily digest (itd-2611041549483696), at their filing. The stop lives on the machine that runs the work, in a shared folder chosen as an option at setup (/Users/Shared on macOS and its counterpart on Linux), on a machine no other person shares; the store ownership rule admits this one exception, and a stop that reaches the machine over a private network or through a cloud adapter is later work. The daily digest is a dated file in that same folder: the digest draft asked that one choice hold for both, and an unshared machine answers the privacy cost, so this followed from the ruling above and no question was put. A stop lets an agent in a call finish that call, then stops. A stop releases the run's claims on its work, so a peer may take it up. The drain's plugin page stays an agent's command and its terminal form stays the person's way to drive it; this changes the 2026-10-09 ruling on itd-2610090831227812 that the drain joins the person's menu when itd-82 ships.
iss-2610080620372731When an agent or sub-agent loses its network connection mid-task, the work stalls or fails instead of waiting the outage out, and this keeps happening on the product thinker's machine. An agent that notices a lost connection should pause and retry on a widening schedule: wait one minute and try again, then five minutes, then ten, then an hour. Sibling agents should also learn of the outage without depending on each other over the network, since they may have lost the connection too: a channel on the machine itself, such as the run state and run log abcd already shares between sessions, would let one agent record the outage and the others hold off instead of each failing on its own.
iss-2610222026223032Autonomous work does not reliably survive the host's automatic compaction: after a compaction a long-running session keeps only a summary, and the work it was in the middle of (which lanes it dispatched, which PRs it is watching, what it promised a peer, the next step of a multi-step plan) survives only if the session happened to write it down. The person wants every autonomous session's work to survive auto-compaction, for example through a to-do list kept in the checkout's local tier (.abcd/.work.local) that the session reads back after a compaction. Related: the draft intent every abcd session keeps a checklist (itd-2610170638184486), being planned on 2026-10-22.
iss-2611031146255825No abcd verb drives an intent build to done unattended: implement step takes one stage and exits, so a build of several steps needs something outside abcd to re-run it after each stage, wait out the merge queue, step again once the lane's pull request merges, and open the next lane. On 2026-11-03 the coordinator did this with a polling helper script (drive-run.sh) and timed wake-ups; drain --drive (itd-2610222215485265) covers drain lanes only, and itd-2610240933025076 starts a build but does not carry it through.
iss-2611031337115764A finished agent is stranded when the step that would collect it is refused: on run-2611031131030791 (2026-11-03) the routed implementer ran 1h37m, committed and wrote its receipt at 13:32, but the next implement step was refused on the run-state schema trap (iss-2611020719494343), and after the state was put right every further step asked the host to start a fresh implementer, though the receipt sat at the path the stage awaited. Only handing it in by hand with implement receipt moved the run on; an unattended run would have launched a second implementer and paid for the work twice.
iss-2611050840353717A long unattended run on one machine has nothing that restarts it after the machine reboots, and full-disk encryption can hold the machine at its login screen until someone signs in, so an update or a power cut ends the run and nothing says so. The restart path (itd-2611041549461012) begins with the next session's resume; nothing starts that session.
itd-2610222215485265abcd drain --drive works through the ledger from a plain terminal
itd-2611041549471712A person stops the unattended runs of each account that chose a folder, with one command
spc-2610230813348813abcd-drain-run-from-a-plain-terminal