## TL;DR
A clean abort is a designed behavior, not an accident: the agent must know the window deadline, stop starting new targets before it, let in-flight installs reach a safe checkpoint (never kill a package manager mid-transaction), mark each host state precisely (patched, in-progress-safe, untouched), and hand the remainder to the next window.

```text
agent failed to abort cleanly when patch window overran
```

## Use this when
- After an overrun, some hosts have half-configured packages or pending operations nobody recorded.
- The agent was killed by an operator or a scheduler timeout at window end.
- The next wave has no reliable starting picture.

## Not for this skill when
- The wave finished but reporting was lost. That is a reporting bug, not an abort-behavior bug.
- A single host hung its install indefinitely. That is a per-host hang; abort design assumes installs eventually checkpoint.

## Steps
1. Define the window contract in the coordinator: a soft deadline after which no new targets start, sized to the longest single-target patch time. Verify: the deadline and buffer are explicit config values
2. Implement graceful stop: on deadline or abort signal, the agent stops dequeuing, signals in-flight steps to finish the current package transaction, and waits a bounded grace period. Verify: a test abort never kills dpkg, rpm, or the Windows installer mid-transaction
3. Write per-host terminal states for the wave (complete, safe-partial with the exact step, untouched) to the tracker before exiting. Verify: after a test abort, every target has a state and a next action
4. Generate the carry-over list automatically: untouched and safe-partial hosts become the head of the next window queue. Verify: the next wave plan starts with the carry-over list
5. Review the abort in the wave report: how many completed, carried over, and why the wave overran (estimate error versus host slowness). Verify: the report drives a sizing change for the next window

## Variant phrasings
### patch window overrun graceful abort agent design
The design phrasing.
### never kill package manager mid transaction abort
The safety-rule phrasing.
### carry over list next maintenance window patching
The continuity phrasing.

Compatibility: Compatibility: Any coordinator with a scheduler or window concept; grace mechanics differ by package manager but the state model is portable.

## Why it happens
Patch windows are hard external constraints (business hours return whether the wave is done or not), while package transactions are unsafe to interrupt. An agent without an abort design resolves that tension in the worst way: it either runs past the window or dies mid-transaction. The fix is to treat the deadline as an input the planner respects, not a wall the executor crashes into.

## Edge cases / pitfalls
- Size waves from measured per-host patch times, not averages across unlike hosts; the tail is what overruns windows.
- Some updates cannot checkpoint mid-way (firmware, certain drivers); the planner should schedule those first in the window, never last.
- An abort that leaves a host safe-partial must also leave a note of which reboot or step remains, or the next operator guesses.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_yQZE_b_rn4yzg1O0BBPH9A