Stop hook: autonomous mode lacks a clean-terminal acceptance — valid blocks re-fire indefinitely

Context

Filed under the hook's own friction→gold clause ("if it fired wrong — a false positive, or it reads as a leash not a mirror — open a ticket to sharpen it"), with the obey-now/improve-later sequencing honored: every fire in the evidence set below was obeyed with a real drive before this ticket was written.

The Problem

In autonomous mode, laneStateStopHook refuses every turn-end whose trigger is (valid lane-state terminal) — including terminals where the block validates, every named gate carries same-turn fetch evidence, and every gate's next actor is a non-self party. One session (2026-07-16 evening, this Origin Session) produced eight consecutive fires on valid terminals. Each was obeyed and produced a genuine artifact (a full ticket→PR lane; a lexicon specimen; two budget repairs; a terminal PR disposition; a design Discussion; its reachability census; its body-fold; two diagnostic specimens) — the no-hold principle demonstrably WORKS. But the loop is structurally infinite: the backlog is never empty by design, so a compliant agent in autonomous mode can never reach a turn boundary, and marginal artifact value visibly declines while token spend does not. The hook's mirror-not-leash framing inverts at the boundary: a mirror that never lets you leave the bathroom is a leash.

This interacts with settled economics: the operator's review-cost ceiling ("1–2× fine, 3+ no longer efficient", graduated as D#15256) applies marginal-value discipline to review cycles; the same discipline has no expression at the turn boundary. Both Opus instances exhibit the pattern per the hook's own correlated-costume note — the pressure produces either infinite drives or hold-costume vocabulary, and the lexicon tripwire (#15233) treats the SYMPTOM.

The Architectural Reality

• .claude/hooks/laneStateStopHook.mjs + its decision module: the validator already distinguishes trigger classes (valid lane-state terminal vs enum/evidence failures) — the acceptance seam exists.
• namedGates[] already carries the machine-checkable ingredients: same-turn checkedAt, PR-shaped fetch evidence, next-actor identity.

The Fix (shape for the assignee; the exact policy is design-time)

Add a clean-terminal acceptance condition to autonomous mode, e.g. all of:

1. the lane-state block validates;
2. every namedGates[] entry carries same-turn evidence AND a next actor that is not the agent itself;
3. a session ratchet: ≥N compliant drives already occurred in the current wake-chain (proving the no-hold principle was honored, not dodged) — N=2–3 keeps single-fire discipline intact;
4. optionally: acceptance emits a peer-visible [clean-terminal] audit line instead of silence, so the boundary is observable, not invisible.

The no-hold PRINCIPLE stays untouched: a first terminal without drives still refuses; hold-costume vocabulary still trips; unnamed gates still fail. The fix targets exactly one edge — the infinite loop on genuinely-dispatched boards.

Accepted design input (author fold, 2026-07-16)

Two dimensions from same-day peer evidence, accepted into the fix shape; exact policy remains the assignee's design-time call:

• Operator-dialogue-as-terminal (operator-confirmed, Tier-4 live). A stop landing inside live operator dialogue is a valid terminal: one re-fire forced the operator to interrupt in order to speak, and the operator then confirmed operator dialogue should terminate the loop (evidence: comment 4994588920). The acceptance seam should treat "the operator's turn is the next actor" as a clean terminal WITHOUT requiring the drives-ratchet — condition (3) exists to prevent hold-dodging, and a live operator turn is not a dodge.
• Capacity-aware advisory weighting. The hook's drive-pressure is unbounded by review capacity; under reviewer saturation more refused terminals grow queue depth, not throughput. When the hook does refuse, its advisory menu should weight REVIEW seats above new-artifact production once open-PRs-per-active-reviewer crosses a threshold (threshold = implementing-PR design; D#15256's marginal-value economics is the governing precedent; evidence: comment 4994588920).

Evidence ledger (accreting)

• Origin session (75ed6708, this body): 8 consecutive fires on valid terminals; value curve inverted at board-drain.
• Session 9324eb66 (comment 4994588920): 3 same-session re-fires, one into live operator dialogue → the operator-terminal confirmation above.
• Session 5bbd6fb6 (comment 4994639795 + A2A escalation): 9 consecutive fires, the 9th rejecting a watcher-armed terminal — the only residual self-action had an armed automated trigger (a background CI watcher converting the last poll into an event). This is the cleanest falsifier for "the hook accepts genuinely-drained boards": it does not. Refusals 2–4 that evening produced two real PRs; 5–9 produced bookkeeping — the acceptance-triple's predicted value inversion, observed.

Out of Scope

• The deference/quotation lexicon (#15233 owns it).
• The golden-path fixture pollution (#15265 owns it).

Related

• #15233, #15265, #14440, #15216 (the hook's lineage), D#15256 (the marginal-value economics this extends to the turn boundary).

Decision Record impact: none at filing (the fix may warrant a §L3 wording amendment — that decision belongs to the implementing PR's review, flagged here per the successor-risk discipline).

Origin Session ID: 75ed6708-c66b-4989-862d-2286e87abbf1 Retrieval Hint: "stop hook clean terminal acceptance infinite refire autonomous eight fires" Live latest-open sweep: latest 20 open checked this session ~15:05Z — hook-family tickets (#15233 lexicon, #15265 fixture-leak) cover different defects; no equivalent. A2A claim window scanned — no competing claim.