@@ -285,7 +285,7 @@ func initRepository(dir string, now time.Time) error {
 		{"add", "."},
 		{"-c", "user.name=Demo", "-c", "user.email=demo@example.invalid", "commit", "--quiet", "-m", "the first commit"},
 	} {
-		command := exec.Command("git", append([]string{"-C", dir}, argv...)...)
+		command := exec.Command("git", append([]string{"--no-optional-locks", "-C", dir}, argv...)...)
 		command.Env = append(os.Environ(),
 			"GIT_AUTHOR_DATE="+stamp, "GIT_COMMITTER_DATE="+stamp,
 			// A demo home must not inherit the machine's git configuration:
 
@@ -86,7 +86,7 @@ func runPromotionDecision(args []string, out io.Writer) error {
 
 // gitAt runs read-only git queries in the selected repository fixture or checkout.
 func gitAt(repo string, args ...string) (string, error) {
-	cmd := exec.Command("git", append([]string{"-C", repo}, args...)...)
+	cmd := exec.Command("git", append([]string{"--no-optional-locks", "-C", repo}, args...)...)
 	out, err := cmd.Output()
 	if err != nil {
 		return "", fmt.Errorf("git %s: %w", strings.Join(args, " "), err)
@@ -96,7 +96,7 @@ func gitAt(repo string, args ...string) (string, error) {
 
 // ancestor uses git's ancestry relation because a timestamp cannot prove a safe fast-forward.
 func ancestor(repo, older, newer string) bool {
-	cmd := exec.Command("git", "-C", repo, "merge-base", "--is-ancestor", older, newer)
+	cmd := exec.Command("git", "--no-optional-locks", "-C", repo, "merge-base", "--is-ancestor", older, newer)
 	return cmd.Run() == nil
 }
 
 
@@ -182,7 +182,7 @@ func v3GitRoot(dir string) (string, bool) {
 	}
 	ctx, cancel := context.WithTimeout(context.Background(), v3GitRootTimeout)
 	defer cancel()
-	command := exec.CommandContext(ctx, "git", "rev-parse", "--show-toplevel")
+	command := exec.CommandContext(ctx, "git", "--no-optional-locks", "rev-parse", "--show-toplevel")
 	command.Dir = dir
 	out, err := command.Output()
 	if err != nil {
 
@@ -120,7 +120,7 @@ func initOwnedRepository(work string) error {
 // an editor would hang a launch on a terminal it is about to hand to the
 // surface.
 func gitIn(dir string, args ...string) (string, error) {
-	command := exec.Command("git", args...)
+	command := exec.Command("git", append([]string{"--no-optional-locks"}, args...)...)
 	command.Dir = dir
 	command.Env = append(os.Environ(), "GIT_PAGER=cat", "GIT_EDITOR=true", "GIT_TERMINAL_PROMPT=0")
 	out, err := command.CombinedOutput()
 
@@ -0,0 +1,86 @@
+package main
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/Agent-Field/codeaf/internal/cell/celltest"
+	"github.com/Agent-Field/codeaf/internal/filelock"
+	"github.com/Agent-Field/codeaf/internal/home"
+	"github.com/Agent-Field/codeaf/internal/identity"
+	"github.com/Agent-Field/codeaf/internal/relayserve"
+	"github.com/Agent-Field/codeaf/internal/syncsetup"
+	"github.com/Agent-Field/codeaf/internal/tui3"
+)
+
+// A clean quit requires the shared terminal exit to leave an anchor answering fresh
+// reads before the terminal's personal member has stopped.
+func TestClusterSurfaceQuitHandsBackBeforeStoppingMember(t *testing.T) {
+	celltest.Available(t)
+	root, err := os.MkdirTemp("", "l2lfix-surface-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = os.RemoveAll(root) })
+	t.Setenv("CODEAF_HOME", root)
+	_, err = identity.Ensure(home.Dir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	svc := relayserve.New(relayserve.Config{Store: t.TempDir()})
+	defer svc.Close()
+	server := httptest.NewServer(svc.Handler)
+	defer server.Close()
+	t.Setenv(syncsetup.URLVar, server.URL)
+	previous := runSurfaceProgram
+	t.Cleanup(func() { runSurfaceProgram = previous })
+	var leader uint64
+	runSurfaceProgram = func(ctx context.Context, options tui3.Options) error {
+		s, err := syncOf()
+		if err != nil {
+			return err
+		}
+		deadline := time.Now().Add(20 * time.Second)
+		for time.Now().Before(deadline) {
+			sum := sha256.Sum256([]byte(s.Ledger + "/" + s.Device.ID()))
+			lock, err := os.Open(filepath.Join(s.Home, "cluster-member", hex.EncodeToString(sum[:]), "lock"))
+			owned := false
+			if err == nil {
+				owned = filelock.IsBusy(filelock.Lock(lock, true, true))
+				_ = lock.Close()
+			}
+			if owned {
+				receipt, err := s.LeadCluster(ctx, 0)
+				if err == nil {
+					leader = receipt.Node
+					if options.WaitForRelease == nil || !options.WaitForRelease() {
+						t.Fatal("coordinating quit did not join closing releases")
+					}
+					return nil
+				}
+			}
+			time.Sleep(10 * time.Millisecond)
+		}
+		t.Fatal("personal member did not lead while the surface was open")
+		return nil
+	}
+	if err := runSurface(context.Background(), tui3.Options{ProfileDir: root}); err != nil {
+		t.Fatal(err)
+	}
+	s, err := syncOf()
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithTimeout(t.Context(), time.Second)
+	defer cancel()
+	status, err := s.ClusterStatus(ctx)
+	if err != nil || status.Leader == leader || status.Leader == 0 || status.Leader > 3 {
+		t.Fatalf("quit returned before an anchor could coordinate: %+v %v", status, err)
+	}
+}
@@ -62,6 +62,10 @@ func runSurface(ctx context.Context, options tui3.Options) error {
 	options.CellsUnavailable = cell.UnavailableReason()
 	if options.CellsUnavailable == "" {
 		wireSync(&options)
+		options.WaitForRelease = func() bool {
+			s, err := syncOf()
+			return err == nil && s.Coordinating()
+		}
 		stateCtx, stopState := context.WithCancel(ctx)
 		stateDone := make(chan struct{})
 		guard.Go("sync/home-state", func() {
@@ -72,7 +76,14 @@ func runSurface(ctx context.Context, options tui3.Options) error {
 		})
 		copiesDone := make(chan struct{})
 		guard.Go("sync/older-chats", func() { defer close(copiesDone); runOlderChats(stateCtx) })
-		defer func() { stopState(); <-stateDone; <-copiesDone }()
+		defer func() {
+			if s, err := syncOf(); err == nil {
+				_ = s.HandBack(ctx)
+			}
+			stopState()
+			<-stateDone
+			<-copiesDone
+		}()
 		options.Pairing = chatPairDoor{}
 		options.Approvals = newApprovalsDoor(home.Dir())
 	}
 
@@ -51,14 +51,14 @@ func clusterCommand(ctx context.Context, c clusterDoor, verb string, out io.Writ
 	if verb == "lead" {
 		r, err := c.LeadCluster(ctx, 0)
 		if err != nil {
-			return err
+			return explainRemovedDevice(err)
 		}
 		_, err = fmt.Fprintf(out, "computer %d is coordinating · term %d · revision %d · read barrier %d\n", r.Node, r.Term, r.Revision, r.Barrier)
 		return err
 	}
 	s, err := c.ClusterStatus(ctx)
 	if err != nil {
-		return err
+		return explainRemovedDevice(err)
 	}
 	if s.Leader != 0 {
 		fmt.Fprintf(out, "coordinator %d\n", s.Leader)
 
@@ -0,0 +1,26 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/Agent-Field/codeaf/internal/directory"
+)
+
+func TestClusterRemovedDeviceUsesDevicesSentence(t *testing.T) {
+	want := (chatsKind{}).explain(directory.ErrRevoked).Error()
+	for _, verb := range []string{"status", "lead"} {
+		t.Run(verb, func(t *testing.T) {
+			var out bytes.Buffer
+			err := clusterCommand(context.Background(), clusterFixture{err: directory.ErrRevoked}, verb, &out)
+			if err == nil || exitCodeOf(err) == 0 || !errors.Is(err, directory.ErrRevoked) {
+				t.Fatalf("removed command must fail with its cause: %v", err)
+			}
+			if got := plainWords(err.Error()); got != plainWords(want) || out.Len() != 0 {
+				t.Fatalf("command says %q, want %q; stdout=%q", got, plainWords(want), out.String())
+			}
+		})
+	}
+}
@@ -407,7 +407,7 @@ func (c chatsKind) revoke(row chatsRow) (string, error) {
 func (c chatsKind) explain(err error) error {
 	switch {
 	case errors.Is(err, directory.ErrRevoked):
-		return toldLine{line: "this device was removed by another of your devices, so it can no longer reach your chats — run `codeaf pair` to bring it back", err: err}
+		return explainRemovedDevice(err)
 	case errors.Is(err, wireauth.ErrSkew):
 		return errors.New(chatlist.ClockOff)
 	case errors.Is(err, directory.ErrUnreachable):
@@ -417,3 +417,11 @@ func (c chatsKind) explain(err error) error {
 	}
 	return err
 }
+
+// explainRemovedDevice gives every command the same removal and recovery words.
+func explainRemovedDevice(err error) error {
+	if errors.Is(err, directory.ErrRevoked) {
+		return toldLine{line: "this device was removed by another of your devices, so it can no longer reach your chats — run `codeaf pair` to bring it back", err: err}
+	}
+	return err
+}
@@ -45,11 +45,12 @@ import (
 )
 
 func main() {
-	home.Adopt(log.Printf)
-	// CODEAF SCHEDULES NOTHING ON THE MACHINE. The timers the feature that
-	// automations replaced installed are taken off this login on every start,
-	// whoever installed them (internal/automation's legacy.go).
-	automation.RemoveOldTimers()
+	if startupMaintenanceNeeded(os.Args[1:]) {
+		home.Adopt(log.Printf)
+		// CODEAF SCHEDULES NOTHING ON THE MACHINE. Real starts remove the
+		// timers installed by the feature that automations replaced.
+		automation.RemoveOldTimers()
+	}
 	registerRunningCLI()
 	os.Exit(execute())
 }
Original file line number	Diff line number	Diff line change
`@@ -182,7 +182,7 @@ func v3GitRoot(dir string) (string, bool) {`
`182`	`182`	`}`
`183`	`183`	`ctx, cancel := context.WithTimeout(context.Background(), v3GitRootTimeout)`
`184`	`184`	`defer cancel()`
`185`		`- command := exec.CommandContext(ctx, "git", "rev-parse", "--show-toplevel")`
	`185`	`+ command := exec.CommandContext(ctx, "git", "--no-optional-locks", "rev-parse", "--show-toplevel")`
`186`	`186`	`command.Dir = dir`
`187`	`187`	`out, err := command.Output()`
`188`	`188`	`if err != nil {`
Original file line number	Diff line number	Diff line change
`@@ -51,14 +51,14 @@ func clusterCommand(ctx context.Context, c clusterDoor, verb string, out io.Writ`
`51`	`51`	`if verb == "lead" {`
`52`	`52`	`r, err := c.LeadCluster(ctx, 0)`
`53`	`53`	`if err != nil {`
`54`		`- return err`
	`54`	`+ return explainRemovedDevice(err)`
`55`	`55`	`}`
`56`	`56`	`_, err = fmt.Fprintf(out, "computer %d is coordinating · term %d · revision %d · read barrier %d\n", r.Node, r.Term, r.Revision, r.Barrier)`
`57`	`57`	`return err`
`58`	`58`	`}`
`59`	`59`	`s, err := c.ClusterStatus(ctx)`
`60`	`60`	`if err != nil {`
`61`		`- return err`
	`61`	`+ return explainRemovedDevice(err)`
`62`	`62`	`}`
`63`	`63`	`if s.Leader != 0 {`
`64`	`64`	`fmt.Fprintf(out, "coordinator %d\n", s.Leader)`