pause

Land what can land. Park the rest at a deliberate boundary. Write a resume point you can pick up cold.

Two outputs, in this order: an active wind-down that drives near-done PRs to merged, then a machine-readable marker and human-readable summary the companion /pause-resume reads when you sit back down.

This command never relaxes a gate. cr-merge-gate.md Steps 1–1d, 1b and the Step 2 AC verification bind unchanged. The hard stops in CLAUDE.md "PR MERGE AUTHORIZATION" (human CHANGES_REQUESTED on HEAD, failing/incomplete CI, unresolved threads, unchecked AC, protection-modifying bypass) are hard stops here. The window never makes a borderline PR eligible; it only decides how long to wait on already-eligible ones.

One parameter: --window Nm. Fifteen minutes is the default graceful shutdown runway and triage threshold; a caller may choose a shorter or longer non-negative window. The command stops earlier when all owned work is terminal. At the chosen deadline it stops leftovers; it never merely returns while billable work continues.

Step 0: Resolve helpers and parse arguments

/pause is invocable from any thread — including one whose cwd is not this repo. Resolve each helper the same way every other stop-style command does:

resolve_script() {
  local name="$1" candidate
  for candidate in \
    "$HOME/.claude/skills-worktree/.claude/scripts/$name" \
    "$HOME/.claude/scripts/$name"; do
    if [[ -x "$candidate" ]]; then echo "$candidate"; return 0; fi
  done
  return 1
}
SESSION_STATE_SH=$(resolve_script session-state.sh)     || SESSION_STATE_SH=""
HANDOFF_STATE_SH=$(resolve_script handoff-state.sh)     || HANDOFF_STATE_SH=""
MERGE_GATE_SH=$(resolve_script merge-gate.sh)           || MERGE_GATE_SH=""
AC_CHECKBOXES_SH=$(resolve_script ac-checkboxes.sh)     || AC_CHECKBOXES_SH=""
PR_STATE_SH=$(resolve_script pr-state.sh)               || PR_STATE_SH=""
LOCAL_REVIEW_SH=$(resolve_script local-review.sh)       || LOCAL_REVIEW_SH=""
CLEAN_BEHIND_SH=$(resolve_script clean-behind-check.sh) || CLEAN_BEHIND_SH=""
EXECUTION_PAUSE_SH=$(resolve_script execution-pause.sh) || EXECUTION_PAUSE_SH=""
TASK_REGISTRY_SH=$(resolve_script background-task-registry.sh) || TASK_REGISTRY_SH=""

# Resolve repository identity independently of session-state persistence so a
# degraded state helper does not make the recovery marker undiscoverable.
REPO_KEY=""
if [[ -n "$SESSION_STATE_SH" ]]; then
  REPO_KEY=$("$SESSION_STATE_SH" --repo-key 2>/dev/null) || REPO_KEY=""
fi
if [[ -z "$REPO_KEY" ]]; then
  REMOTE=$(git remote get-url origin 2>/dev/null) || REMOTE=""
  REPO_KEY=$(printf '%s' "$REMOTE" | sed -e 's|\.git$||' \
    -e 's|.*github\.com[:/]\([^/]*/[^/]*\)$|\1|')
  [[ "$REPO_KEY" =~ ^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$ ]] || REPO_KEY=""
  REPO_KEY=$(printf '%s' "$REPO_KEY" | tr '[:upper:]' '[:lower:]')
fi

Resolve background-task-shutdown.md from the skills-worktree, then the home install location, and read it in full before Step 1. Never fall back to the current checkout for scripts or instruction documents: /pause can be invoked from an unrelated or untrusted repository, whose executable bit is not a trust signal.

An unresolved session-state.sh is degraded-but-continue — say so when reporting and carry on, because the marker still gets written. An unresolved merge-gate.sh means the landing phase cannot classify PRs reliably; skip landing for all PRs and park them, naming the missing helper in each parked entry's waiting_on field.

An unresolved TASK_REGISTRY_SH, unreadable shutdown reference, or durable registry-failure marker makes the shutdown audit unavailable. Arm every gate that can still be armed, skip any claim that no tasks are live, and carry the missing control into Step 8 as INCOMPLETE SHUTDOWN; never interpret an unreadable inventory as an empty one.

Parse --window Nm: extract the integer N from the first --window argument; default to 15. --window 0 means skip landing and checkpoint time, then stop everything immediately. Accept a non-negative integer with an optional trailing m; normalize leading zeroes as decimal, and reject non-numeric, negative, or greater-than-1440-minute values. Stop processing --window arguments after the first valid value. Compute T_end once: