feat(wrap): add session teardown and shutdown to wrap-it-up

A bare "wrap it up" now tears the session down after the valediction: it kills the ai-term buffer and the aiv-<project> tmux session (which takes claude with it) and restores geometry. "wrap it up with summary" or "and summarize" keeps the buffer. "wrap it up and shutdown" gates on this being the only live ai-term session, then powers the machine off through an abort-able Emacs countdown.

Teardown can't run inline because it kills the session claude runs in, so the valediction would never flush. Step 6 instead drops a basename-keyed sentinel after commit+push is verified, and a new Stop hook (ai-wrap-teardown.sh) does the teardown when the response ends, by which point the valediction has rendered. The hook is a no-op on every normal stop because the sentinel only exists after a teardown wrap.

The runtime lives in .emacs.d/modules/ai-term.el (cj/ai-term-quit, cj/ai-term-live-count, cj/ai-term-shutdown-countdown), and the rulesets side calls it via emacsclient. I routed that companion to .emacs.d, so the feature is end-to-end once it lands. The hook has 8 bats tests. The live teardown and shutdown paths are a manual checklist in todo.org.

Built from the proposal. I went with both summary qualifiers, the Emacs-timer countdown, and the live-count gate.

Claude-Session: https://claude.ai/code/session_017PtX1nt1rtYVATuzmzBS4f

1 files changed, 35 insertions, 1 deletions

diff --git a/todo.org b/todo.org
index e39e893..5cf79c5 100644
--- a/todo.org
+++ b/todo.org
@@ -47,12 +47,46 @@ CLOSED: [2026-06-23 Tue]
 :END:
 Built per the Ready spec: =process-inbox= + =monitor-inbox= + =inbox-zero= merged into one =inbox.org= engine (shared core + process/monitor/roam modes + the interactive =auto inbox zero= =/loop= mode); =triage-intake= and =no-approvals= stay separate. Callers repointed (INDEX, protocols, startup Phase C, wrap-up Step 3), old files deleted, stale-ref grep clean, workflow-integrity + sync-check + full suite green. The fully-unattended =/schedule= cron pass is vNext (see the =[#D]= task above). [[file:docs/inbox-workflow-consolidation-spec.org][spec]].
 
-** TODO [#B] wrap-it-up teardown + "wrap it up and shutdown" :feature:
+** DOING [#B] wrap-it-up teardown + "wrap it up and shutdown" :feature:
 :PROPERTIES:
 :CREATED: [2026-06-23 Tue]
 :END:
 Two additions to =wrap-it-up.org=, designed by Craig (home, 2026-06-23). Item 1: bare "wrap it up" also tears down the session — kill the =aiv-<proj>= tmux session (takes =claude= with it), kill the vterm buffer, restore geometry. Teardown is the default; "wrap it up with summary" wraps without teardown (keeps the buffer readable). Must fire from a Stop/SessionEnd hook via a sentinel file, decoupled and last, so the valediction flushes before the session dies, and strictly after commit+push is verified. Item 2: "wrap it up and shutdown" → wrap, then a hard blocking gate (abort unless this is the only live =aiv-*= session), then an abort-able 10→1 countdown, then =sudo shutdown now=. Countdown can't run through the Bash tool (stdout buffers — prints all ten at once); needs a detached tty writer or an Emacs =run-at-time= timer. Companion: =cj/ai-term-quit= (and optional =cj/ai-term-live-count=) must live in =.emacs.d/modules/ai-term.el= — route there via inbox-send when building so both sides land together. Open decisions for Craig first: qualifier wording ("with summary" vs "and summarize"), countdown home (tty script vs Emacs timer), session-count mechanism (=tmux ls= / =pgrep claude= / helper). Shared-asset, review-gated. Proposal: [[file:docs/design/2026-06-23-wrap-teardown-shutdown-proposal.org][proposal]]. From home 2026-06-23.
 
+*** 2026-06-23 Tue @ 23:31:59 -0400 Built the rulesets side; companion routed to .emacs.d
+Craig's three decisions (2026-06-23): non-destructive qualifier is *both* "with summary" and "and summarize"; countdown is an Emacs =run-at-time= timer; the gate uses =cj/ai-term-live-count=. Built and pushed: =hooks/ai-wrap-teardown.sh= (Stop hook, sentinel-gated, 8 bats tests green), =hooks/settings-snippet.json= Stop wiring, =wrap-it-up.org= Teardown-mode section + Step 6 + checklist, INDEX trigger update. Architecture: both teardown and shutdown fire from the Stop hook via a basename-keyed sentinel (=/tmp/ai-wrap-teardown-<proj>=, =/tmp/ai-wrap-shutdown-<proj>=) dropped only at the end of Step 6 after commit+push, so the valediction flushes first. No bin script — the gate/countdown/teardown are all =emacsclient= calls into the companion. Companion spec (=cj/ai-term-quit=, =cj/ai-term-live-count=, =cj/ai-term-shutdown-countdown=) routed to .emacs.d via inbox-send. Remaining: .emacs.d lands the three functions, then the manual end-to-end validation below. Task stays DOING until both sides verify.
+
+*** TODO Manual testing and validation :test:
+What we're verifying: the wrap-teardown + shutdown feature end to end, once =.emacs.d/modules/ai-term.el= has the three companion functions and the =Stop= hook is installed (=make install-hooks= + the =settings-snippet.json= Stop block in =~/.claude/settings.json=). These need a live Emacs daemon + tmux + an =aiv-<proj>= ai-term session; they can't be driven from a script.
+
+**** Bare "wrap it up" tears down after the valediction
+What we're verifying: teardown is the default and fires only after the valediction renders.
+- In an ai-term =aiv-<proj>= session, say "wrap it up".
+- Watch the wrap run (summary, archive, commit, push, valediction).
+Expected: the valediction renders in full first, THEN the vterm buffer + =aiv-<proj>= tmux session + =claude= all disappear and the saved window geometry is restored. =/tmp/ai-wrap-teardown-<proj>= does not linger afterward.
+
+**** "wrap it up with summary" / "and summarize" keeps the buffer
+What we're verifying: the explicit qualifier opts out of teardown.
+- Say "wrap it up with summary" (then, separately, "wrap it up and summarize").
+Expected: the wrap completes (commit + push + archive), but the buffer and session stay up and readable. No teardown.
+
+**** "wrap it up and shutdown" aborts when another session is live
+What we're verifying: the safety gate refuses to power off out from under another session.
+- Start a second =aiv-*= ai-term session in another project.
+- In the first, say "wrap it up and shutdown".
+Expected: the wrap completes but the shutdown is refused; the other live =aiv-*= session is listed, and the valediction says it fell back to a normal wrap. No poweroff, no teardown, no sentinel dropped.
+
+**** "wrap it up and shutdown" as the sole session powers off (cancellable)
+What we're verifying: the happy path and the abort window.
+- With this as the only =aiv-*= session, say "wrap it up and shutdown".
+- During the countdown, first run it once and cancel with =C-g=; then run it again and let it complete. (Stub =sudo shutdown now= to an echo while validating so the box doesn't actually power off.)
+Expected: after commit + push, a 10→1 countdown renders one-per-second in the Emacs echo area; =C-g= cancels it cleanly (no shutdown); letting it finish fires =shutdown=.
+
+**** Teardown never precedes a verified push
+What we're verifying: no sentinel is dropped before commit + push succeeds.
+- Trigger a teardown wrap in a state where the push would fail (e.g. temporarily point the remote somewhere unreachable).
+Expected: the wrap surfaces the push failure and stops; no =/tmp/ai-wrap-*-<proj>= sentinel is created, so no teardown fires.
+
 ** DONE [#C] inbox-zero: delete empty roam entries on triage :feature:
 CLOSED: [2026-06-23 Tue]
 :PROPERTIES: