From a05dd234ca89818328699429a42e43d147b79cb1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 31 Jul 2026 17:47:26 +0000
Subject: [PATCH 1/4] fix: drop a redundant usize cast in the git panel

`unicode_width::UnicodeWidthStr::width` already returns `usize`, so the
cast is a no-op that a newer clippy flags under `unnecessary_cast`,
failing the `cargo clippy -- -D warnings` gate on an otherwise clean
tree. Behavior is unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GGu65bNJ18EqsyGDmd74ZX
---
 src/ui/git_panel.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ui/git_panel.rs b/src/ui/git_panel.rs
index d9c1647..02f0030 100644
--- a/src/ui/git_panel.rs
+++ b/src/ui/git_panel.rs
@@ -454,7 +454,7 @@ pub(super) fn history_item(
     ]);
     // Right-align the short sha, leaving one trailing cell of margin.
     let sha_w = entry.short_sha.chars().count();
-    let used = subject_line.width() as usize;
+    let used = subject_line.width();
     let pad = content_width.saturating_sub(used + sha_w + 1).max(1);
     subject_line.spans.push(Span::raw(" ".repeat(pad)));
     subject_line.spans.push(Span::styled(

From f3189d6d903b365dca2ca48f6039f91c2e6af5ba Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 31 Jul 2026 17:47:44 +0000
Subject: [PATCH 2/4] feat(review): swap reviews without pausing first, and
 land on the working tree
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two changes to how a review session ends, both aimed at the same thing:
the reviewer should never be forced out of redquill to get somewhere else.

Confirming a second review while one is open used to refuse with "already
reviewing X — press q to finish or pause". It now pauses the open review
first and starts the requested one, on both launcher tabs. The pause is
also what makes the swap correct: the incoming review's worktree, base-ref,
and fetch machinery all read `stage_ops`/`repo_root`, which point *inside*
the outgoing review's worktree until the re-root happens. Confirming the
branch or PR already under review stays a no-op — there is nothing to swap
to, and rebuilding the session would only lose the reviewer's place.

Pause, finish, and (with nothing else to unwind) `Esc` no longer quit.
All three re-root back onto the origin checkout's working tree — the view
redquill opens in — through one shared `App::leave_review_session`, so what
a review leaves behind can't drift between them. Pause and swap keep the
worktree, the persisted progress, and every annotation; finish still removes
the worktree and deletes the state entry first. `Q`/Ctrl-C is now the one
keypress that leaves redquill from inside a review, and `q` takes two presses
(end the review, then quit the working-tree view it lands on).

Finish's stdout contract is unchanged from a consumer's side. Since it no
longer quits, the session's annotations move to `App::finished_annotations`
as it unwinds — out of the live store, so they can't bleed into the next
target's list panel or the next review's persisted state — and `main` renders
that buffer on exit regardless of the final `QuitOutcome`: an explicit finish
must not be undone by a later `Q`. Each annotation still reaches a consumer
exactly once, in the same markdown format.

`review_origin_root` is now recorded by every session entry point (it was
PR-only), since leaving needs somewhere to return to.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GGu65bNJ18EqsyGDmd74ZX
---
 src/annotate/store.rs                         |  21 ++
 src/main.rs                                   |  20 +-
 src/ui/app.rs                                 |  31 ++-
 src/ui/end_review.rs                          | 242 +++++++++++++++--
 src/ui/end_review_modal.rs                    |  11 +-
 src/ui/keymap.rs                              |   7 +-
 src/ui/mod.rs                                 |  70 +++--
 src/ui/modal_keys.rs                          |  82 ++++--
 src/ui/modes.rs                               |  51 ++--
 src/ui/pr_description_tests.rs                |  18 +-
 src/ui/review_launcher.rs                     | 133 ++++++---
 src/ui/review_launcher_integration_tests.rs   | 252 ++++++++++++++++++
 .../review_persistence_integration_tests.rs   |  33 ++-
 13 files changed, 807 insertions(+), 164 deletions(-)

diff --git a/src/annotate/store.rs b/src/annotate/store.rs
index 4a946fd..65e7d54 100644
--- a/src/annotate/store.rs
+++ b/src/annotate/store.rs
@@ -189,6 +189,27 @@ impl AnnotationStore {
     pub fn unpublished(&self) -> impl Iterator<Item = &Annotation> {
         self.annotations.iter().filter(|a| !a.published)
     }
+
+    /// Moves every annotation out of `self` (leaving it empty) and appends
+    /// them to the end of `dest`, in insertion order. Ids are reassigned from
+    /// `dest`'s own counter so the merged store keeps the "stable ordinal,
+    /// never reused" guarantee `add` establishes — the two stores were
+    /// numbered independently, so carrying the original ids across would
+    /// collide.
+    ///
+    /// Used when a finished review session hands its annotations to the
+    /// process-lifetime emit buffer (`ui::App::finished_annotations`): the
+    /// session's own store is cleared as it returns to the working tree,
+    /// while the annotations it produced survive to be rendered to stdout
+    /// exactly once on exit.
+    pub fn drain_into(&mut self, dest: &mut AnnotationStore) {
+        for mut annotation in std::mem::take(&mut self.annotations) {
+            annotation.id = dest.next_id;
+            dest.next_id += 1;
+            dest.annotations.push(annotation);
+        }
+        self.next_id = 0;
+    }
 }
 
 #[cfg(test)]
diff --git a/src/main.rs b/src/main.rs
index 832cdb8..f0884c7 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -270,6 +270,12 @@ fn run_tui(config: &RunConfig) -> anyhow::Result<()> {
 
     let mut app = App::with_git(snapshot, target.clone(), Box::new(runner.clone()));
     if let DiffTarget::Review { branch, .. } = &target {
+        // Recorded before `discovered` moves into `set_review_origin_ops`:
+        // pausing or finishing the review re-roots the app back onto this
+        // root's working tree rather than exiting (see
+        // `ui::end_review::App::leave_review_session`), so a `--review`
+        // launch needs it just as much as a launcher-started session does.
+        app.set_review_origin_root(discovered.root().to_path_buf());
         // Load + reconcile this branch's persisted progress before the
         // first render, so `Accepted`/`Deferred` files start collapsed and a
         // stale `Accepted` file starts marked `ChangedSinceAccepted` and
@@ -322,9 +328,19 @@ fn run_tui(config: &RunConfig) -> anyhow::Result<()> {
     ));
     let outcome = ui::run(&mut app)?;
 
+    // Reviews finished during the run already handed their annotations over
+    // (see `App::finished_annotations`); finish promised to emit them, so they
+    // go out regardless of how the process was eventually quit. The live
+    // session's own annotations join them only on `QuitOutcome::Emit`. One
+    // render, one presentation — a consumer still sees each annotation exactly
+    // once.
+    let mut emitted = std::mem::take(&mut app.finished_annotations);
     if let QuitOutcome::Emit = outcome {
-        let markdown = render_markdown(&app.annotations);
-        present_annotations(&markdown, app.annotations.len(), config.output.as_deref())?;
+        app.annotations.drain_into(&mut emitted);
+    }
+    if !emitted.is_empty() {
+        let markdown = render_markdown(&emitted);
+        present_annotations(&markdown, emitted.len(), config.output.as_deref())?;
     }
 
     Ok(())
diff --git a/src/ui/app.rs b/src/ui/app.rs
index 288fde8..d019a94 100644
--- a/src/ui/app.rs
+++ b/src/ui/app.rs
@@ -274,6 +274,17 @@ pub struct App {
     pub(super) help: HelpOverlayState,
     /// Annotations accumulated this session.
     pub annotations: AnnotationStore,
+    /// Annotations carried over from review sessions *finished* during this
+    /// run. Finishing a review no longer quits — it returns to the working
+    /// tree (see [`super::end_review::LeaveReason`]) — so the session's
+    /// annotations are moved here as it unwinds rather than left in
+    /// `annotations`, where they would bleed into the next target's list
+    /// panel and into the next review's persisted state. `main` renders this
+    /// buffer to stdout on exit regardless of the final [`super::QuitOutcome`]
+    /// (a later `Q` must not silently drop what an explicit finish already
+    /// promised to emit), so each annotation still reaches a consumer exactly
+    /// once. Empty unless a review was finished this run.
+    pub finished_annotations: AnnotationStore,
     /// The current interaction mode.
     pub mode: Mode,
     /// The Compose modal's state, when `mode == Mode::Compose`.
@@ -763,9 +774,12 @@ pub struct App {
     /// git-less/test contexts that never call finish.
     pub(super) review_origin_ops: Option<Box<dyn StageOps>>,
     /// The origin repository root the PR-checkout fetch/worktree ops run
-    /// from (outside any managed worktree), captured when a PR review session
-    /// starts so a mid-session refresh can re-root a fresh origin runner for
-    /// the fetch. `None` outside a PR review session.
+    /// from (outside any managed worktree), captured when a review session
+    /// starts. A mid-session PR refresh re-roots a fresh origin runner from
+    /// it for the fetch, and leaving a review ([`App::leave_review_session`])
+    /// re-roots the whole app back onto it. Set by every session entry point
+    /// — the CLI's `--review` bootstrap and both launcher tabs — so leaving
+    /// always has somewhere to return to; `None` outside a review session.
     pub(super) review_origin_root: Option<PathBuf>,
     /// The path `<git-common-dir>/redquill/review-state.json` resolves to
     /// for this session, set once at startup by
@@ -882,6 +896,7 @@ impl App {
             view: DiffViewState::new(files),
             help: HelpOverlayState::new(),
             annotations,
+            finished_annotations: AnnotationStore::new(),
             mode: Mode::Normal,
             compose: None,
             commit_message: None,
@@ -1148,6 +1163,16 @@ impl App {
         self.review_origin_ops = Some(ops);
     }
 
+    /// Records the origin checkout's root (outside any managed worktree) for
+    /// this review session — the directory [`App::leave_review_session`]
+    /// re-roots back onto when the review is paused, finished, or swapped for
+    /// another. Set alongside [`App::set_review_origin_ops`] by every session
+    /// entry point; without it, leaving a review has no working tree to
+    /// return to and degrades to a status message.
+    pub fn set_review_origin_root(&mut self, root: PathBuf) {
+        self.review_origin_root = Some(root);
+    }
+
     /// Sets the path this session persists review progress to
     /// (`<git-common-dir>/redquill/review-state.json`), resolved once by
     /// `main`'s review-session bootstrap before the first render. Every
diff --git a/src/ui/end_review.rs b/src/ui/end_review.rs
index c15a52d..5fbcb14 100644
--- a/src/ui/end_review.rs
+++ b/src/ui/end_review.rs
@@ -4,15 +4,74 @@
 //! and deleting the persisted state). Split out of `app.rs` alongside this
 //! state, mirroring [`super::switcher`]'s own state-plus-handlers split.
 //!
-//! Pausing has no dedicated method here: it's exactly the pre-existing quit
-//! path (`Flow::Quit(QuitOutcome::Discard)`, handled by
-//! [`super::modes::handle_end_review_key`]'s `end_review_choice`). Pause
-//! keeps the worktree, review state, and annotations on disk and emits
-//! nothing; quit-and-emit prints annotations exactly once.
+//! Ending a review does not end the process. Pause, finish, and the
+//! swap-to-another-review path all converge on [`App::leave_review_session`],
+//! which re-roots the app back onto the origin checkout's working tree — the
+//! view redquill opens in by default. Only `Q`/Ctrl-C, and `q` from outside a
+//! review, still quit.
+//!
+//! The three reasons differ in what they leave behind, not in where they land
+//! (see [`LeaveReason`]): pause keeps the worktree, the persisted state, and
+//! every annotation on disk; finish first removes the worktree and deletes the
+//! persisted entry ([`App::finish_review`]) and carries the session's
+//! annotations into [`App::finished_annotations`] for the one stdout emission
+//! finish has always promised; a swap behaves exactly like pause, so the
+//! review being left is resumable the moment the new one is done.
 
-use super::QuitOutcome;
 use super::app::{App, Mode, ModeOrigin};
 use super::modal_keys::EndReviewAction;
+use crate::git::{DiffTarget, GitRunner};
+
+/// Why a review session is being left — the one thing that differs between
+/// the three exits, all of which land on the origin working tree via
+/// [`App::leave_review_session`].
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum LeaveReason {
+    /// `p` in the end-review modal, or `Esc` from the diff view. Everything
+    /// (worktree, persisted state, annotations) stays on disk; the session's
+    /// in-memory annotations are dropped rather than emitted, so a consumer
+    /// reading stdout still sees each one exactly once — on finish.
+    Pause,
+    /// `f` in the end-review modal, after [`App::finish_review`] has already
+    /// removed the worktree and deleted the persisted entry. The session's
+    /// annotations move to [`App::finished_annotations`] to be emitted on
+    /// exit.
+    Finish,
+    /// Confirming a different branch or PR in the review launcher while a
+    /// review is already open. Identical to [`LeaveReason::Pause`] in effect;
+    /// distinct only so the status line can say the old review was paused
+    /// rather than claim the user asked to pause it.
+    Switch,
+}
+
+/// What [`App::pause_review_for_switch`] found and did — the three cases a
+/// launcher confirm has to tell apart before it starts a new review.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(super) enum SwitchPause {
+    /// No review was open; start the new one directly.
+    Nothing,
+    /// The named review was paused and the app is back on the origin
+    /// checkout, so `stage_ops`/`repo_root` are the origin's again. The
+    /// payload is the paused review's banner label, for the caller's
+    /// "paused X — starting Y" status line.
+    Paused(String),
+    /// A review was open and could not be left — the footer already says why.
+    /// The new review must not start: it would run rooted inside the outgoing
+    /// review's worktree.
+    Blocked,
+}
+
+impl SwitchPause {
+    /// The `"paused <label> \u{2014} "` prefix a launcher confirm puts in
+    /// front of what it is starting, so one footer line reports both halves
+    /// of the swap. Empty when nothing was paused.
+    pub(super) fn status_prefix(&self) -> String {
+        match self {
+            SwitchPause::Paused(label) => format!("paused {label} \u{2014} "),
+            SwitchPause::Nothing | SwitchPause::Blocked => String::new(),
+        }
+    }
+}
 
 impl App {
     /// Opens the end-review modal, capturing the mode `q` was pressed from
@@ -77,22 +136,25 @@ impl App {
     /// branch's persisted review entry — statuses and annotations live in
     /// one [`crate::review::store::PersistedReview`], so one
     /// [`crate::review::store::delete_review`] call removes both, and a
-    /// later fresh `--review` of the same branch starts clean. Returns
-    /// `Some(QuitOutcome::Emit)`, so the caller quits emitting
-    /// `app.annotations` exactly once. On failure (e.g. a dirty worktree, or
-    /// no origin backend/review session attached) the git message surfaces
-    /// as a status message, the modal closes back to its origin mode, and
-    /// the persisted state entry is left untouched for retry.
-    pub(super) fn finish_review(&mut self) -> Option<QuitOutcome> {
+    /// later fresh `--review` of the same branch starts clean. Returns `true`
+    /// on success, so the caller can hand off to
+    /// [`App::leave_review_session`] and land back on the working tree with
+    /// the session's annotations carried into [`App::finished_annotations`]
+    /// for the one stdout emission finish promises. On failure (e.g. a dirty
+    /// worktree, or no origin backend/review session attached) the git
+    /// message surfaces as a status message, the modal closes back to its
+    /// origin mode, the session stays open, and the persisted state entry is
+    /// left untouched for retry.
+    pub(super) fn finish_review(&mut self) -> bool {
         let Some(ops) = self.review_origin_ops.as_deref() else {
             self.set_status_message("finish unavailable (no origin git backend)");
             self.cancel_end_review();
-            return None;
+            return false;
         };
         let Some(path) = self.repo_root.clone() else {
             self.set_status_message("finish unavailable (no review worktree path)");
             self.cancel_end_review();
-            return None;
+            return false;
         };
         match ops.worktree_remove(&path) {
             Ok(()) => {
@@ -113,15 +175,150 @@ impl App {
                 {
                     let _ = crate::review::store::delete_review(&state_path, branch);
                 }
-                Some(QuitOutcome::Emit)
+                true
             }
             Err(e) => {
                 self.set_status_message(format!("finish failed: {e}"));
                 self.cancel_end_review();
-                None
+                false
             }
         }
     }
+
+    /// Pauses whatever review session is open so a different one can start in
+    /// its place — the review launcher's "switch reviews" step, and the only
+    /// caller of [`LeaveReason::Switch`]. Outside a review session this does
+    /// nothing and reports [`SwitchPause::Nothing`], so a launcher confirm can
+    /// call it unconditionally.
+    ///
+    /// A swap is a pause, not a finish: the outgoing review's worktree,
+    /// persisted progress, and annotations all stay exactly where they are, so
+    /// reopening it later resumes mid-review. What the swap really buys the
+    /// caller is the re-root — after this returns [`SwitchPause::Paused`],
+    /// `stage_ops` and `repo_root` point at the origin checkout again, which
+    /// is what the incoming review's worktree/fetch machinery expects to read
+    /// them as.
+    pub(super) fn pause_review_for_switch(&mut self) -> SwitchPause {
+        if !self.in_review_session() {
+            return SwitchPause::Nothing;
+        }
+        let label = self.review_banner_label();
+        if self.leave_review_session(LeaveReason::Switch) {
+            SwitchPause::Paused(label)
+        } else {
+            SwitchPause::Blocked
+        }
+    }
+
+    /// Whether the review session in flight is a forge review of PR/MR
+    /// `number` — the check a launcher confirm makes before treating `Enter`
+    /// as a swap, since "switching" to the PR already on screen would only
+    /// tear down and rebuild the session it is already showing.
+    pub(super) fn reviewing_pr(&self, number: u64) -> bool {
+        self.in_review_session()
+            && self
+                .review_forge
+                .as_ref()
+                .is_some_and(|forge| forge.number == number)
+    }
+
+    /// Leaves the active review session and re-roots the app back onto the
+    /// origin checkout's working tree ([`DiffTarget::WorkingTree`], the
+    /// default view), returning `true` once it has landed there.
+    ///
+    /// This is the single unwind path for all three exits — the end-review
+    /// modal's pause and finish, `Esc` from the diff view, and the review
+    /// launcher's swap-to-another-review — so what a review leaves behind can
+    /// never drift between them. `reason` governs only two things: the status
+    /// line's wording, and whether the session's annotations are carried into
+    /// [`App::finished_annotations`] (finish) or dropped (pause/switch, where
+    /// they are already durable in `review-state.json` and would otherwise be
+    /// emitted a second time on a later quit).
+    ///
+    /// The re-root is attempted *before* any session state is cleared, so a
+    /// failure — a missing origin root (never the case for a session started
+    /// through any of the real entry points, all of which record it), or a
+    /// repository that has since gone away — leaves the review fully intact
+    /// with git's own message in the footer, exactly like
+    /// [`App::confirm_worktree_switch`]'s failure path.
+    ///
+    /// Mode is deliberately untouched: the launcher stays open across a swap,
+    /// the diff view stays put on `Esc`, and the end-review modal's callers
+    /// restore their own origin mode first. Panel coherence is re-established
+    /// afterwards for the one mode that needs it.
+    pub(super) fn leave_review_session(&mut self, reason: LeaveReason) -> bool {
+        if !self.in_review_session() {
+            return false;
+        }
+        let Some(origin_root) = self.review_origin_root.clone() else {
+            self.set_status_message(
+                "can't return to the working tree (no origin repo recorded for this review)",
+            );
+            return false;
+        };
+        // Flush any status/annotation change that hasn't reached disk yet.
+        // A no-op for pause after a quiet moment (save-on-change has already
+        // written it) and for finish (whose entry is deleted below anyway,
+        // making a redundant save harmless).
+        if matches!(reason, LeaveReason::Pause | LeaveReason::Switch) {
+            self.persist_review_state();
+        }
+        let left = self.review_banner_label();
+        let runner = match GitRunner::discover_in(&origin_root) {
+            Ok(runner) => runner,
+            Err(e) => {
+                self.set_status_message(format!("can't return to the working tree: {e}"));
+                return false;
+            }
+        };
+        if let Err(e) = self.reroot(runner, DiffTarget::WorkingTree) {
+            self.set_status_message(format!("can't return to the working tree: {e}"));
+            return false;
+        }
+
+        // Past the point of no return: `reroot` has swapped the backend, the
+        // root, and the target, and cleared the forge/stale markers. Every
+        // remaining scrap of per-session state goes with it, so the working
+        // tree isn't left wearing the review's accept marks, annotations, or
+        // imported comment threads.
+        match reason {
+            LeaveReason::Finish => self.annotations.drain_into(&mut self.finished_annotations),
+            LeaveReason::Pause | LeaveReason::Switch => {
+                self.annotations = crate::annotate::AnnotationStore::new();
+            }
+        }
+        self.replies = super::draft_reply::DraftReplyStore::new();
+        self.review_states.clear();
+        self.review_blob_shas.clear();
+        self.review_origin_ops = None;
+        self.review_origin_root = None;
+        self.review_state_path = None;
+        self.thread_overlay.replace(Vec::new());
+        self.threads_unavailable = false;
+        // A thread fetch spawned for the PR just left must not repopulate the
+        // overlay once it lands (mirrors `spawn_thread_fetch`'s own bump).
+        self.thread_fetch_generation = self.thread_fetch_generation.wrapping_add(1);
+        self.list_cursor = 0;
+        self.list_filter = None;
+        self.rebuild_rows();
+        self.after_panel_coherence();
+
+        match reason {
+            LeaveReason::Pause => {
+                self.set_status_message(format!("paused {left} \u{2014} back on the working tree"));
+            }
+            LeaveReason::Finish => {
+                self.set_status_message(format!(
+                    "finished {left} \u{2014} back on the working tree"
+                ));
+            }
+            // Deliberately silent: the launcher immediately overwrites the
+            // footer with what it is starting, and folds the paused review's
+            // name into that one line rather than flashing two.
+            LeaveReason::Switch => {}
+        }
+        true
+    }
 }
 
 #[cfg(test)]
@@ -285,7 +482,10 @@ index 111..222 100644
 
         let outcome = app.finish_review();
 
-        assert_eq!(outcome, Some(QuitOutcome::Emit));
+        assert!(
+            outcome,
+            "a successful worktree removal reports finish succeeded"
+        );
         let state = crate::review::store::load(&state_path);
         assert!(
             !state.reviews.contains_key("feature"),
@@ -326,7 +526,7 @@ index 111..222 100644
 
         let outcome = app.finish_review();
 
-        assert_eq!(outcome, None);
+        assert!(!outcome);
         let state = crate::review::store::load(&state_path);
         assert!(
             state.reviews.contains_key("feature"),
@@ -345,7 +545,7 @@ index 111..222 100644
         app.open_end_review_modal();
 
         let outcome = app.finish_review();
-        assert_eq!(outcome, None, "a failed finish must not quit");
+        assert!(!outcome, "a failed finish must not report success");
         assert_eq!(
             app.mode,
             Mode::Normal,
@@ -365,7 +565,7 @@ index 111..222 100644
         let mut app = review_app();
         app.open_end_review_modal();
         let outcome = app.finish_review();
-        assert_eq!(outcome, None);
+        assert!(!outcome);
         assert_eq!(app.mode, Mode::Normal);
         assert!(app.status_message.is_some());
     }
diff --git a/src/ui/end_review_modal.rs b/src/ui/end_review_modal.rs
index 4537a00..51e18dc 100644
--- a/src/ui/end_review_modal.rs
+++ b/src/ui/end_review_modal.rs
@@ -26,10 +26,13 @@ use super::modal_keys::EndReviewAction;
 const CONTENT_WIDTH: u16 = 48;
 /// Total modal width: content + 2 columns of padding + 2 columns of border.
 const MODAL_WIDTH: u16 = CONTENT_WIDTH + 2 + 2;
-/// The caption under the three options: annotations print to stdout exactly
-/// once, on finish, whether they were made this session or restored from an
-/// earlier one — pause never emits.
-const CAPTION: &str = "annotations print to stdout once, on finish";
+/// The caption under the three options. Two facts a reviewer at this modal
+/// needs and can't read off the option rows: pause and finish both land back
+/// on the working tree rather than exiting redquill, and the annotations a
+/// finish earmarks — this session's and any restored from an earlier one —
+/// print to stdout exactly once, when redquill itself exits. Pause never
+/// emits. Kept within [`CONTENT_WIDTH`], which is sized to this line.
+const CAPTION: &str = "both return to the working tree; finish emits once";
 
 /// The three exits' display order, short label, and short description —
 /// the modal's own tuned prose, distinct from [`super::modal_keys::END_REVIEW_KEYS`]'s
diff --git a/src/ui/keymap.rs b/src/ui/keymap.rs
index 36cd274..778e16b 100644
--- a/src/ui/keymap.rs
+++ b/src/ui/keymap.rs
@@ -724,12 +724,13 @@ impl Keymap {
                 // the actual dispatch is a hand-written cascade in
                 // `mod.rs`'s `dispatch_key` (close help / cancel a Visual
                 // selection / return from a commit view opened via the
-                // History tab) — the same multi-duty-single-key pattern
-                // Visual-cancel uses.
+                // History tab / pause a review back onto the working tree)
+                // — the same multi-duty-single-key pattern Visual-cancel
+                // uses.
                 d(
                     KeySeq::one(Esc, none),
                     ToggleHelp,
-                    "Close help / cancel selection / return from a commit view",
+                    "Close help / cancel selection / return from a commit view / pause review",
                 ),
                 d(
                     KeySeq::one(Char('v'), none),
diff --git a/src/ui/mod.rs b/src/ui/mod.rs
index c9b4696..4cc8ca6 100644
--- a/src/ui/mod.rs
+++ b/src/ui/mod.rs
@@ -138,26 +138,29 @@ const POLL_INTERVAL: Duration = Duration::from_millis(50);
 /// actually changing, so idle ticks are cheap.
 const AUTO_REFRESH_INTERVAL: Duration = Duration::from_secs(2);
 
-/// How a TUI session ended: governs only the one stdout side effect (`main`'s
-/// `render_markdown(&app.annotations)` call on quit) — never what's kept in
-/// `app.annotations` itself or on disk, both of which are already settled by
-/// the time either variant is produced.
+/// How a TUI session ended: governs only whether the *live* view's
+/// annotations join `main`'s one stdout emission — never what's kept on disk,
+/// which is already settled by the time either variant is produced.
 ///
-/// [`QuitOutcome::Emit`]: a plain session's `q`, or a review session's `f`
-/// (finish, [`super::app::App::finish_review`]) — finish emits the complete
-/// annotation set exactly once, in the unchanged markdown format.
-/// [`QuitOutcome::Discard`]: a plain session's `Q`/Ctrl-C, or a review
-/// session's `p` (pause). Pause keeps the worktree, the review state, and
-/// every annotation on disk; only the stdout emission is suppressed, so a
-/// consumer piping redquill's output sees each annotation exactly once, on
-/// finish rather than once per pause plus once more on finish.
+/// A review session's `p` (pause) and `f` (finish) no longer produce either
+/// variant: neither ends the process, both return to the working tree (see
+/// [`end_review::LeaveReason`]). Finish's promised emission happens through
+/// `App::finished_annotations`, which `main` renders on exit whichever
+/// variant this eventually is — an explicit finish must not be undone by a
+/// later `Q`. So a consumer piping redquill's output still sees each
+/// annotation exactly once, on finish rather than once per pause plus once
+/// more on finish.
+///
+/// [`QuitOutcome::Emit`]: `q` outside a review session.
+/// [`QuitOutcome::Discard`]: `Q`/Ctrl-C, in any view.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum QuitOutcome {
-    /// Emit `app.annotations` to stdout on the way out.
+    /// Emit `app.annotations` to stdout on the way out, alongside any already
+    /// in `app.finished_annotations`.
     Emit,
-    /// Emit nothing; annotations already in `app.annotations` are simply
-    /// dropped from memory (not from disk — a review session's are already
-    /// persisted by this point).
+    /// Emit only `app.finished_annotations`; whatever is still in
+    /// `app.annotations` is dropped from memory (not from disk — a review
+    /// session's are already persisted by this point).
     Discard,
 }
 
@@ -294,9 +297,13 @@ enum Flow {
 /// (diff-scope [`dispatch_key`] and [`modes::handle_panel_key`]) so review
 /// mode's `q` can't drift between them: during a review
 /// session it opens the end-review modal instead of quitting; otherwise it
-/// quits exactly as before, emitting annotations. `Action::QuitDiscard`
-/// (`Q`) is untouched by this — its global "quit immediately, emit nothing"
-/// meaning holds in every mode, review session or not.
+/// quits exactly as before, emitting annotations. Since neither of that
+/// modal's exits quits either, leaving a review takes `q` twice — once to end
+/// the review, once to quit the working-tree view it lands on.
+/// `Action::QuitDiscard` (`Q`) is untouched by this — its global "quit
+/// immediately, emit nothing" meaning holds in every mode, review session or
+/// not, and remains the one keypress that leaves redquill from inside a
+/// review.
 fn quit_action(app: &mut App) -> Flow {
     if app.in_review_session() {
         app.open_end_review_modal();
@@ -445,13 +452,22 @@ fn dispatch_key(
             let just_started_sequence =
                 motion::count_survives_sequence_start(had_pending, pending.is_some());
 
-            // Esc only ever closes an already-open help overlay, cancels an
-            // in-progress Visual selection, or returns from a commit view
-            // opened via the git panel's History tab; it is
-            // never bound to opening help, unlike `?` (see keymap.rs). This
-            // runs only when nothing was pending — an Esc that cancelled a
-            // pending `g` prefix (handled inside `resolve`) stops there
-            // instead. Esc always cancels an in-progress count too.
+            // Esc closes an already-open help overlay, cancels an in-progress
+            // Visual selection, returns from a file/commit view opened via
+            // the git panel, or — with none of those claiming it — pauses an
+            // active review session back onto the working tree. It is never
+            // bound to opening help, unlike `?` (see keymap.rs). This runs
+            // only when nothing was pending — an Esc that cancelled a pending
+            // `g` prefix (handled inside `resolve`) stops there instead. Esc
+            // always cancels an in-progress count too.
+            //
+            // The review-pause arm is last on purpose: every overlay Esc
+            // already unwinds keeps its meaning, and only a "nothing left to
+            // close" Esc reaches the session itself. Pausing is
+            // non-destructive (the worktree, the persisted progress, and every
+            // annotation stay exactly where they are), so this needs no
+            // confirmation — `q`'s modal is still there for the finish that
+            // does destroy something.
             if key.code == KeyCode::Esc && !had_pending {
                 *pending_count = None;
                 if app.help.open {
@@ -466,6 +482,8 @@ fn dispatch_key(
                     app.return_from_file_view();
                 } else if app.viewing_commit() {
                     app.return_from_commit_view();
+                } else if app.in_review_session() {
+                    app.leave_review_session(end_review::LeaveReason::Pause);
                 }
                 return Flow::Continue;
             }
diff --git a/src/ui/modal_keys.rs b/src/ui/modal_keys.rs
index f838e6c..66661c3 100644
--- a/src/ui/modal_keys.rs
+++ b/src/ui/modal_keys.rs
@@ -1029,14 +1029,17 @@ pub(super) static FILTER_EDIT_KEYS: LazyLock<Vec<ModalBinding<FilterEditAction>>
 /// immediately regardless of the highlight.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub(super) enum EndReviewAction {
-    /// Quit emitting nothing; the worktree, review state, and every
-    /// annotation (already durable via save-on-change) are kept.
+    /// Return to the working tree emitting nothing; the worktree, review
+    /// state, and every annotation (already durable via save-on-change) are
+    /// kept, so the review resumes exactly where it left off.
     Pause,
-    /// Emit the complete annotation set (restored-from-earlier-sessions and
-    /// this session's own, together, exactly once), remove the worktree
-    /// (and delete the persisted review-state entry — statuses and
-    /// annotations together), then quit. On removal failure the modal
-    /// closes with the git error surfaced instead of quitting.
+    /// Remove the worktree (and delete the persisted review-state entry —
+    /// statuses and annotations together), then return to the working tree.
+    /// The complete annotation set (restored-from-earlier-sessions and this
+    /// session's own, together) is carried into
+    /// [`super::app::App::finished_annotations`] and emitted exactly once on
+    /// exit. On removal failure the modal closes with the git error surfaced
+    /// and the session stays open.
     Finish,
     /// Close the modal and keep reviewing; nothing happens.
     Cancel,
@@ -1080,7 +1083,7 @@ pub(super) static END_REVIEW_KEYS: LazyLock<Vec<ModalBinding<EndReviewAction>>>
     LazyLock::new(|| {
         vec![
             ModalBinding {
-                description: "Pause — quit, emit nothing (keep worktree)",
+                description: "Pause — back to the working tree (keep worktree)",
                 keys: vec![ModalKey::plain(KeyCode::Char('p'))],
                 action: EndReviewAction::Pause,
                 footer: Some(FooterHint {
@@ -1089,7 +1092,7 @@ pub(super) static END_REVIEW_KEYS: LazyLock<Vec<ModalBinding<EndReviewAction>>>
                 }),
             },
             ModalBinding {
-                description: "Finish — emit annotations once, remove worktree, quit",
+                description: "Finish — remove worktree, back to the working tree",
                 keys: vec![ModalKey::plain(KeyCode::Char('f'))],
                 action: EndReviewAction::Finish,
                 footer: Some(FooterHint {
@@ -4385,43 +4388,73 @@ index 111..222 100644
 
     /// An `App` mid-review, with `Mode::EndReview` already open (`origin:
     /// Normal`), so every end-review action has an observable effect.
-    fn end_review_app() -> App {
+    ///
+    /// The origin root is a throwaway git repo (returned alongside, so the
+    /// caller keeps it alive): pause and finish both re-root the app back onto
+    /// it, so without a real repository there they would degrade to a footer
+    /// message and become indistinguishable from cancel.
+    fn end_review_app() -> (App, tempfile::TempDir) {
+        let tmp = tempfile::TempDir::new().unwrap();
+        for args in [
+            &["init", "-q"][..],
+            &["config", "user.email", "test@redquill.invalid"],
+            &["config", "user.name", "redquill test"],
+        ] {
+            let out = std::process::Command::new("git")
+                .current_dir(tmp.path())
+                .args(args)
+                .output()
+                .expect("spawn git");
+            assert!(out.status.success(), "git {args:?} failed");
+        }
         let mut app = app();
         app.target = crate::git::DiffTarget::Review {
             base: "main".to_string(),
             branch: "feature".to_string(),
         };
+        app.set_review_origin_root(tmp.path().to_path_buf());
         app.open_end_review_modal();
-        app
+        (app, tmp)
     }
 
     #[test]
     fn every_end_review_table_entry_drives_its_documented_action() {
-        use crate::ui::{Flow, QuitOutcome, modes::handle_end_review_key};
+        use crate::ui::modes::handle_end_review_key;
 
         for binding in END_REVIEW_KEYS.iter() {
             for key in &binding.keys {
-                let mut app = end_review_app();
+                let (mut app, _tmp) = end_review_app();
                 let label = binding.key_label();
                 match binding.action {
                     EndReviewAction::Pause => {
-                        let flow = handle_end_review_key(&mut app, key.event());
+                        let _ = handle_end_review_key(&mut app, key.event());
                         assert!(
-                            matches!(flow, Flow::Quit(QuitOutcome::Discard)),
-                            "End review {label}: pause must quit emitting nothing (spec 08 Unit 6)"
+                            !app.in_review_session(),
+                            "End review {label}: pause must leave the review session"
+                        );
+                        assert_eq!(
+                            app.target,
+                            crate::git::DiffTarget::WorkingTree,
+                            "End review {label}: pause lands on the working tree, not on a quit"
                         );
                     }
                     EndReviewAction::Finish => {
-                        // No `review_origin_ops` attached here (no git
+                        // No `review_origin_ops` attached here (no worktree
                         // backend in this fixture), so finish degrades to a
-                        // footer message and stays open rather than quitting
-                        // — still proving `f` reaches `App::finish_review`.
+                        // footer message, keeps the session, and closes back
+                        // to the origin mode — still proving `f` reaches
+                        // `App::finish_review`, and distinct from pause, which
+                        // leaves the session from the same fixture.
                         let _ = handle_end_review_key(&mut app, key.event());
                         assert_eq!(
                             app.mode,
                             Mode::Normal,
                             "End review {label}: a failed finish closes back to the origin mode"
                         );
+                        assert!(
+                            app.in_review_session(),
+                            "End review {label}: a failed finish must keep the session"
+                        );
                         assert!(app.status_message.is_some());
                     }
                     EndReviewAction::Cancel => {
@@ -4431,6 +4464,10 @@ index 111..222 100644
                             Mode::Normal,
                             "End review {label}: cancel returns to the origin mode"
                         );
+                        assert!(
+                            app.in_review_session(),
+                            "End review {label}: cancel keeps reviewing"
+                        );
                     }
                     EndReviewAction::MoveDown => {
                         let _ = handle_end_review_key(&mut app, key.event());
@@ -4456,10 +4493,11 @@ index 111..222 100644
                         // The fixture opens with Pause (cursor 0)
                         // highlighted, so Enter must behave exactly like
                         // the `p` mnemonic.
-                        let flow = handle_end_review_key(&mut app, key.event());
+                        let _ = handle_end_review_key(&mut app, key.event());
                         assert!(
-                            matches!(flow, Flow::Quit(QuitOutcome::Discard)),
-                            "End review {label}: confirm on the highlighted Pause option must quit emitting nothing"
+                            !app.in_review_session(),
+                            "End review {label}: confirm on the highlighted Pause option must \
+                             leave the review session"
                         );
                     }
                 }
diff --git a/src/ui/modes.rs b/src/ui/modes.rs
index ec7bc9c..4e0dda2 100644
--- a/src/ui/modes.rs
+++ b/src/ui/modes.rs
@@ -846,18 +846,17 @@ pub(super) fn handle_review_launcher_key(app: &mut App, key: KeyEvent) {
 
 /// Handles one key event while [`super::Mode::EndReview`] is active (`q` in
 /// a review session opens this modal instead of quitting — see
-/// [`super::quit_action`]): `p` pauses (quits, emitting annotations through
-/// the ordinary on-quit path — the worktree and review state are
-/// untouched), `f` finishes (removes the worktree via
-/// [`super::App::finish_review`], quitting on success or surfacing the
-/// failure and staying open), `c`/`Esc` cancel back to the mode `q` was
-/// pressed from. `j`/`k`/arrows move a highlighted selection across the
-/// three options and `Enter` confirms whichever one is highlighted (acting
-/// exactly like its mnemonic; see [`EndReviewAction::from_cursor`]). Unlike
-/// most modal handlers this one returns [`super::Flow`] (like
-/// [`handle_panel_key`]): pause/a successful finish end the session, so the
-/// event loop must see the quit rather than this function looping it
-/// internally.
+/// [`super::quit_action`]): `p` pauses (worktree, review state, and
+/// annotations all kept on disk), `f` finishes (removes the worktree via
+/// [`super::App::finish_review`], or surfaces the failure and stays open),
+/// `c`/`Esc` cancel back to the mode `q` was pressed from. Neither exit ends
+/// the process any more — both return to the working tree via
+/// [`super::App::leave_review_session`]. `j`/`k`/arrows move a highlighted
+/// selection across the three options and `Enter` confirms whichever one is
+/// highlighted (acting exactly like its mnemonic; see
+/// [`EndReviewAction::from_cursor`]). Returns [`super::Flow`] like
+/// [`handle_panel_key`] for signature symmetry with the other `Flow`-shaped
+/// handlers; every arm now continues.
 pub(super) fn handle_end_review_key(app: &mut App, key: KeyEvent) -> super::Flow {
     use super::Flow;
     let Some(action) = modal_keys::resolve(&app.modal_keys.end_review, key) else {
@@ -891,17 +890,25 @@ pub(super) fn handle_end_review_key(app: &mut App, key: KeyEvent) -> super::Flow
 /// never produces them, and [`handle_end_review_key`]'s own match never
 /// passes them here — this is a defensive fallback, not a reachable path).
 fn end_review_choice(app: &mut App, choice: EndReviewAction) -> super::Flow {
-    use super::{Flow, QuitOutcome};
+    use super::Flow;
+    use super::end_review::LeaveReason;
     match choice {
-        // Pause discards rather than emits, so a consumer sees each
-        // annotation exactly once — on finish. The worktree, review state,
-        // and every annotation made this session are still kept; only the
-        // stdout side effect changes (see `QuitOutcome`'s doc).
-        EndReviewAction::Pause => Flow::Quit(QuitOutcome::Discard),
-        EndReviewAction::Finish => match app.finish_review() {
-            Some(outcome) => Flow::Quit(outcome),
-            None => Flow::Continue,
-        },
+        // Both exits close the modal back to the mode `q` was pressed from
+        // *first*, then unwind the session onto the working tree — so the
+        // restored mode is the one the re-rooted view lands in, and a failed
+        // unwind leaves the user exactly where cancelling would have.
+        EndReviewAction::Pause => {
+            app.cancel_end_review();
+            app.leave_review_session(LeaveReason::Pause);
+            Flow::Continue
+        }
+        EndReviewAction::Finish => {
+            if app.finish_review() {
+                app.cancel_end_review();
+                app.leave_review_session(LeaveReason::Finish);
+            }
+            Flow::Continue
+        }
         EndReviewAction::Cancel => {
             app.cancel_end_review();
             Flow::Continue
diff --git a/src/ui/pr_description_tests.rs b/src/ui/pr_description_tests.rs
index 6d7a6c8..70d2a19 100644
--- a/src/ui/pr_description_tests.rs
+++ b/src/ui/pr_description_tests.rs
@@ -284,16 +284,24 @@ fn enter_is_a_no_op_when_the_overlay_was_opened_from_a_session() {
 }
 
 /// `Enter` from a launcher-opened overlay routes back through the launcher's
-/// own confirm — including its guards. With a review already in progress that
-/// guard refuses and says so, which is the observable proof the confirm ran
-/// (rather than the keypress being swallowed by the overlay).
+/// own confirm — including its guards. With PR 42 already the one under
+/// review, that guard refuses and says so, which is the observable proof the
+/// confirm ran (rather than the keypress being swallowed by the overlay).
 #[test]
 fn enter_from_the_launcher_runs_the_tabs_own_confirm_guards() {
     let mut app = launcher_app(&[42], FakeDetail::Ok);
     app.target = DiffTarget::Review {
         base: "origin/main".to_string(),
-        branch: "feature".to_string(),
+        branch: "redquill/pr/42".to_string(),
     };
+    app.review_forge = Some(ForgeMetadata {
+        provider: ForgeProviderKind::GitHub,
+        host: "github.com".to_string(),
+        number: 42,
+        title: "title 42".to_string(),
+        last_head_sha: "abc".to_string(),
+        diff_refs: None,
+    });
     app.open_pr_description_from_launcher();
     app.pr_description_confirm();
 
@@ -306,7 +314,7 @@ fn enter_from_the_launcher_runs_the_tabs_own_confirm_guards() {
         app.status_message
             .as_deref()
             .is_some_and(|m| m.contains("already reviewing")),
-        "the launcher's in-session guard must have run: {:?}",
+        "the launcher's same-PR guard must have run: {:?}",
         app.status_message
     );
 }
diff --git a/src/ui/review_launcher.rs b/src/ui/review_launcher.rs
index d923144..75c8b72 100644
--- a/src/ui/review_launcher.rs
+++ b/src/ui/review_launcher.rs
@@ -41,6 +41,7 @@ use crate::review::store::{ForgeMetadata, ForgeProviderKind};
 
 use super::app::{App, Mode, ModeOrigin};
 use super::background::TaskId;
+use super::end_review::SwitchPause;
 use super::list_filter::ListFilter;
 use super::review_session::{
     ensure_review_worktree, load_reconciled_review_state, resolve_review_base,
@@ -573,20 +574,20 @@ impl App {
     /// resolves. The fetch runs off the render loop (see
     /// [`App::spawn_pr_checkout`]).
     ///
-    /// Guarded first by the in-session check (a nested review is
-    /// unsupported), second by the single-in-flight rules a running remote
-    /// op or an already-running checkout impose — mirroring
+    /// Guarded by the single-in-flight rules a running remote op or an
+    /// already-running checkout impose — mirroring
     /// [`App::confirm_launcher_branch_review`]. A no-op on an out-of-range
     /// cursor (empty, still loading, or a degraded state with nothing
-    /// selectable).
+    /// selectable), and on the PR already under review (re-entering it would
+    /// only churn the session it is already showing; `r` refreshes it).
+    ///
+    /// An *unrelated* review already in flight is not an obstacle: it is
+    /// paused first ([`App::leave_review_session`]), which also puts
+    /// `stage_ops`/`repo_root` back on the origin checkout — exactly what the
+    /// checkout below reads them for. Only a pause that fails to land (its
+    /// message already in the footer) stops the switch, since the checkout
+    /// would otherwise run rooted inside the outgoing review's worktree.
     fn confirm_launcher_pr(&mut self, cursor: usize) {
-        if self.in_review_session() {
-            self.set_status_message(format!(
-                "already reviewing {} \u{2014} press q to finish or pause",
-                self.review_branch().unwrap_or("this branch")
-            ));
-            return;
-        }
         if let Some(label) = self.running_op_label() {
             self.set_status_message(format!(
                 "{label} is running \u{2014} wait before starting a review"
@@ -603,6 +604,16 @@ impl App {
         let number = pr.number;
         let title = Some(pr.title.clone());
         let base_ref = pr.base_ref.clone();
+        if self.reviewing_pr(number) {
+            self.set_status_message(format!(
+                "already reviewing #{number} \u{2014} press r to refresh it"
+            ));
+            return;
+        }
+        let paused = self.pause_review_for_switch();
+        if paused == SwitchPause::Blocked {
+            return;
+        }
         // The checkout follows whichever provider the tab's background list
         // already resolved for this host (peeked, never re-resolved), so a
         // GitLab MR fetches its `refs/merge-requests/<iid>/head` and a GitHub
@@ -627,7 +638,10 @@ impl App {
                  check the origin URL or run glab auth login",
             );
         } else {
-            self.set_status_message(format!("checking out #{number} \u{2026}"));
+            self.set_status_message(format!(
+                "{}checking out #{number} \u{2026}",
+                paused.status_prefix()
+            ));
         }
         self.spawn_pr_checkout(number, base_ref, host, title, provider, false);
     }
@@ -984,13 +998,14 @@ impl App {
     /// for why this is the one "ensure a review session" path shared with
     /// the CLI's `--review` flag.
     ///
-    /// Guarded first by the in-session check: starting a second review from
-    /// inside one is unsupported (nested worktrees would tangle the
-    /// banner/finish bookkeeping), so this only ever sets a status message
-    /// naming `q` — no branch lookup, no worktree call, no mode change.
-    /// Guarded second by the same single-in-flight rule
+    /// Guarded by the same single-in-flight rule
     /// [`App::request_remote_op`]/[`App::switcher_confirm`] enforce: a
-    /// running fetch/pull/push blocks starting a review.
+    /// running fetch/pull/push blocks starting a review. A review already in
+    /// flight is not a blocker — it is paused first
+    /// ([`App::pause_review_for_switch`]), which also puts `stage_ops` back on
+    /// the origin checkout, where the worktree and base-ref resolution below
+    /// have to run from. Confirming the branch already under review is a no-op
+    /// beyond a status line, since nothing about the session would change.
     ///
     /// On success the launcher closes into the re-rooted review view (see
     /// [`App::close_review_launcher_after_start`]); `after_panel_coherence`
@@ -999,13 +1014,6 @@ impl App {
     /// message surfaced as a status line — the launcher is one keystroke
     /// away again for a retry.
     fn confirm_launcher_branch_review(&mut self, cursor: usize) {
-        if self.in_review_session() {
-            self.set_status_message(format!(
-                "already reviewing {} \u{2014} press q to finish or pause",
-                self.review_branch().unwrap_or("this branch")
-            ));
-            return;
-        }
         if let Some(label) = self.running_op_label() {
             self.set_status_message(format!(
                 "{label} is running \u{2014} wait before starting a review"
@@ -1015,6 +1023,14 @@ impl App {
         let Some(branch) = self.launcher_branches.get(cursor).map(|b| b.name.clone()) else {
             return;
         };
+        if self.review_branch() == Some(branch.as_str()) {
+            self.set_status_message(format!("already reviewing {branch}"));
+            return;
+        }
+        let paused = self.pause_review_for_switch();
+        if paused == SwitchPause::Blocked {
+            return;
+        }
         let Some(ops) = self.stage_ops.as_deref() else {
             self.set_status_message("review unavailable (no git backend)");
             return;
@@ -1055,9 +1071,12 @@ impl App {
         // The backend `finish_review` later runs `worktree_remove`/`prune`
         // through: discovered fresh at the *current* (pre-reroot) repo root,
         // since it must be rooted outside the worktree being removed, which
-        // the worktree about to become `self.repo_root` is not.
-        let origin_runner = self
-            .repo_root
+        // the worktree about to become `self.repo_root` is not. The same root
+        // is recorded on the session (`review_origin_root`) so leaving the
+        // review has a working tree to re-root back onto — see
+        // [`App::leave_review_session`].
+        let origin_root = self.repo_root.clone();
+        let origin_runner = origin_root
             .as_deref()
             .and_then(|root| GitRunner::discover_in(root).ok());
 
@@ -1067,6 +1086,7 @@ impl App {
         };
         match self.reroot(session_runner, target) {
             Ok(()) => {
+                self.review_origin_root = origin_root;
                 if let Some(origin) = origin_runner {
                     self.set_review_origin_ops(Box::new(origin));
                 }
@@ -1080,7 +1100,7 @@ impl App {
                 }
                 self.close_review_launcher_after_start();
                 self.after_panel_coherence();
-                self.set_status_message(format!("reviewing {branch}"));
+                self.set_status_message(format!("{}reviewing {branch}", paused.status_prefix()));
             }
             Err(e) => {
                 self.set_status_message(format!("review failed: {e}"));
@@ -1790,15 +1810,20 @@ index 111..222 100644
         );
     }
 
-    // -- Branches tab: in-session guard (FR-10) ------------------------------
+    // -- Branches tab: same-branch guard --------------------------------------
 
+    /// Confirming the branch *already* under review changes nothing: there is
+    /// no other session to swap to, so tearing this one down and rebuilding it
+    /// would only lose the reviewer's place. A different branch is a swap
+    /// instead (covered against real git in
+    /// `review_launcher_integration_tests.rs`).
     #[test]
-    fn confirm_during_an_active_review_session_emits_the_hint_and_mutates_nothing() {
+    fn confirm_on_the_branch_already_under_review_mutates_nothing() {
         let mut app = app_with_branches(vec![branch("alpha")]);
         app.open_review_launcher();
         app.target = crate::git::DiffTarget::Review {
             base: "main".to_string(),
-            branch: "feature".to_string(),
+            branch: "alpha".to_string(),
         };
 
         app.review_launcher_confirm();
@@ -1814,11 +1839,15 @@ index 111..222 100644
             "the launcher stays open and on the Branches tab, got {:?}",
             app.mode
         );
+        assert!(
+            app.in_review_session(),
+            "the session under review must survive untouched"
+        );
         assert!(
             app.status_message
                 .as_deref()
-                .is_some_and(|m| m.contains("feature") && m.contains('q')),
-            "the hint must name the branch under review and point at q, got {:?}",
+                .is_some_and(|m| m.contains("alpha")),
+            "the hint must name the branch already under review, got {:?}",
             app.status_message
         );
         // `BranchListOps::worktree_add`/`git_common_dir`/`default_base` all
@@ -1830,15 +1859,17 @@ index 111..222 100644
     /// FR-12): a locked filter narrows two real branches down to one
     /// (`"zulu-target"`, real index 1 — deliberately not the first row, so
     /// this can't pass by coincidence the way an unfiltered index-0 case
-    /// could), yet the in-session guard still fires before any branch
-    /// lookup or worktree call, exactly as the unfiltered case above.
+    /// could), and the guard reads *that* translated row, not row 0. Without
+    /// the translation the highlighted branch would resolve to `"alpha"`, the
+    /// confirm would be treated as a swap, and `BranchListOps`' panicking
+    /// worktree calls would fire.
     #[test]
-    fn confirm_during_an_active_review_session_emits_the_hint_and_mutates_nothing_under_a_filter() {
+    fn confirm_on_the_branch_already_under_review_mutates_nothing_under_a_filter() {
         let mut app = app_with_branches(vec![branch("alpha"), branch("zulu-target")]);
         app.open_review_launcher();
         app.target = crate::git::DiffTarget::Review {
             base: "main".to_string(),
-            branch: "feature".to_string(),
+            branch: "zulu-target".to_string(),
         };
 
         app.review_launcher_enter_filter();
@@ -1865,11 +1896,15 @@ index 111..222 100644
             "the launcher stays open and on the Branches tab, got {:?}",
             app.mode
         );
+        assert!(
+            app.in_review_session(),
+            "the session under review must survive untouched"
+        );
         assert!(
             app.status_message
                 .as_deref()
-                .is_some_and(|m| m.contains("feature") && m.contains('q')),
-            "the hint must name the branch under review and point at q, got {:?}",
+                .is_some_and(|m| m.contains("zulu-target")),
+            "the hint must name the branch already under review, got {:?}",
             app.status_message
         );
         // `BranchListOps::worktree_add`/`git_common_dir`/`default_base` all
@@ -3024,7 +3059,7 @@ index 111..222 100644
     /// The in-session guard: `Enter` on a PR row while already reviewing must
     /// emit the same hint the Branches tab does and start no checkout.
     #[test]
-    fn confirm_on_prs_tab_during_a_review_session_emits_the_hint_and_starts_nothing() {
+    fn confirm_on_the_pr_already_under_review_starts_no_checkout() {
         let mut app = app_with_pr_outcome(PrFetchOutcome::Loaded {
             repo_label: "org/repo".to_string(),
             prs: vec![pr(7, "add widgets")],
@@ -3037,16 +3072,28 @@ index 111..222 100644
         app.ensure_launcher_prs_fresh();
         app.target = DiffTarget::Review {
             base: "main".to_string(),
-            branch: "feature".to_string(),
+            branch: "redquill/pr/7".to_string(),
         };
+        app.review_forge = Some(ForgeMetadata {
+            provider: ForgeProviderKind::GitHub,
+            host: "github.com".to_string(),
+            number: 7,
+            title: "add widgets".to_string(),
+            last_head_sha: "abc123".to_string(),
+            diff_refs: None,
+        });
 
         app.review_launcher_confirm();
 
         assert!(app.pr_checkout_in_flight.is_none(), "no checkout may start");
+        assert!(
+            app.in_review_session(),
+            "the session under review must survive untouched"
+        );
         assert!(
             app.status_message
                 .as_deref()
-                .is_some_and(|m| m.contains("feature") && m.contains('q')),
+                .is_some_and(|m| m.contains("#7")),
             "got {:?}",
             app.status_message
         );
diff --git a/src/ui/review_launcher_integration_tests.rs b/src/ui/review_launcher_integration_tests.rs
index 3d6320d..56ba2d4 100644
--- a/src/ui/review_launcher_integration_tests.rs
+++ b/src/ui/review_launcher_integration_tests.rs
@@ -1565,3 +1565,255 @@ fn forge_unresolvable_host_journey_transcript() {
 
     drop(tmp);
 }
+
+// -- Scenarios: leaving a review lands on the working tree, never on a quit --
+//
+// The four exits a reviewer has (`q`+`p`, `q`+`f`, `Esc`, and confirming a
+// different review from the launcher) all re-root back onto the origin
+// checkout. These run against real git because that re-root is the whole
+// behavior: a fake backend would prove the flag flipped, not that the app is
+// genuinely rooted outside the managed worktree afterwards.
+
+/// Two candidate branches, each one commit ahead of `main` on its own file —
+/// so a review of either produces a non-empty diff, and swapping from one to
+/// the other is observable in the file list as well as in the target.
+fn repo_with_two_branches_ahead_of_main() -> TempDir {
+    let tmp = TempDir::new().unwrap();
+    let dir = tmp.path();
+    assert_inside_tempdir(dir, &tmp);
+    git(dir, &["init", "-q", "-b", "main"]);
+    configure_identity(dir);
+    write(dir, "a.rs", "fn a() {}\n");
+    git(dir, &["add", "."]);
+    git(dir, &["commit", "-q", "-m", "initial"]);
+    for (branch, file) in [("alpha", "alpha.rs"), ("zulu", "zulu.rs")] {
+        git(dir, &["checkout", "-q", "-b", branch, "main"]);
+        write(dir, file, "fn tip() {}\n");
+        git(dir, &["add", "."]);
+        git(dir, &["commit", "-q", "-m", branch]);
+    }
+    git(dir, &["checkout", "-q", "main"]);
+    tmp
+}
+
+/// Opens the launcher and confirms `branch`, navigating to its row first.
+/// The Branches tab excludes whatever branch the *current* root has checked
+/// out, so the row index differs between the origin checkout and a review
+/// worktree — resolving it from the loaded list keeps that off the tests.
+fn launch_review_of(app: &mut App, keymap: &Keymap, pending: &mut Option<KeyEvent>, branch: &str) {
+    press(app, keymap, pending, KeyCode::Char('R'));
+    let row = app
+        .launcher_branches
+        .iter()
+        .position(|b| b.name == branch)
+        .unwrap_or_else(|| {
+            panic!(
+                "{branch} must be listed, got {:?}",
+                app.launcher_branches
+                    .iter()
+                    .map(|b| &b.name)
+                    .collect::<Vec<_>>()
+            )
+        });
+    for _ in 0..row {
+        press(app, keymap, pending, KeyCode::Char('j'));
+    }
+    press(app, keymap, pending, KeyCode::Enter);
+}
+
+/// The headline behavior: confirming a second review while one is already
+/// open no longer refuses. The first is paused — its worktree and persisted
+/// progress survive, so reopening it resumes — and the app lands in the
+/// second. Without the pause the second review's worktree/base resolution
+/// would run rooted *inside* the first review's worktree.
+#[test]
+fn confirming_a_second_review_pauses_the_first_and_starts_the_second() {
+    let tmp = repo_with_two_branches_ahead_of_main();
+    let dir = tmp.path();
+    let mut app = app_for(dir);
+    let keymap = Keymap::default_map();
+    let mut pending: Option<KeyEvent> = None;
+
+    launch_review_of(&mut app, &keymap, &mut pending, "alpha");
+    assert!(
+        matches!(&app.target, DiffTarget::Review { branch, .. } if branch == "alpha"),
+        "sanity: the first review must have started, got {:?}",
+        app.target
+    );
+    // Accept a file so `alpha` has persisted progress worth preserving
+    // across the swap.
+    app.select_file_by_path("alpha.rs");
+    press(&mut app, &keymap, &mut pending, KeyCode::Char(' '));
+    assert_eq!(app.review_status("alpha.rs"), ReviewStatus::Accepted);
+    let alpha_root = canon(app.repo_root.as_ref().expect("repo root set"));
+
+    launch_review_of(&mut app, &keymap, &mut pending, "zulu");
+
+    assert!(
+        matches!(&app.target, DiffTarget::Review { branch, .. } if branch == "zulu"),
+        "the swap must land in the second review, got {:?}",
+        app.target
+    );
+    let zulu_root = canon(app.repo_root.as_ref().expect("repo root set"));
+    assert_ne!(
+        zulu_root, alpha_root,
+        "the app must be rooted in zulu's worktree, not still in alpha's"
+    );
+    assert!(
+        app.view.files.iter().any(|f| f.path == "zulu.rs"),
+        "the diff must be zulu's, got {:?}",
+        app.view.files.iter().map(|f| &f.path).collect::<Vec<_>>()
+    );
+    assert!(
+        !app.review_states.contains_key("alpha.rs"),
+        "alpha's accept marks must not carry into zulu's session"
+    );
+
+    // Paused, not finished: alpha's worktree is still registered and its
+    // progress is still on disk, so reopening it resumes mid-review.
+    let wt_list = git_out(dir, &["worktree", "list"]);
+    assert!(
+        wt_list.contains(alpha_root.to_str().unwrap()),
+        "alpha's worktree must survive the swap: {wt_list}"
+    );
+    let common_dir = GitRunner::discover_in(dir)
+        .unwrap()
+        .git_common_dir()
+        .unwrap();
+    let saved = store::load(&common_dir.join("redquill").join("review-state.json"));
+    assert_eq!(
+        saved.reviews["alpha"].files["alpha.rs"].status,
+        store::PersistedStatus::Accepted,
+        "alpha's accepted file must still be persisted after the swap"
+    );
+
+    drop(tmp);
+}
+
+/// `q` then `p` returns to the working tree instead of quitting, leaving the
+/// review resumable. The regression this catches is the app either exiting
+/// (the old behavior) or staying rooted inside the managed worktree while
+/// claiming to show the working tree.
+#[test]
+fn pausing_a_review_returns_to_the_origin_working_tree() {
+    let tmp = repo_with_two_branches_ahead_of_main();
+    let dir = tmp.path();
+    let mut app = app_for(dir);
+    let keymap = Keymap::default_map();
+    let mut pending: Option<KeyEvent> = None;
+    let origin_root = canon(app.repo_root.as_ref().expect("repo root set"));
+
+    launch_review_of(&mut app, &keymap, &mut pending, "alpha");
+    let review_root = canon(app.repo_root.as_ref().expect("repo root set"));
+
+    press(&mut app, &keymap, &mut pending, KeyCode::Char('q'));
+    assert!(
+        matches!(app.mode, Mode::EndReview { .. }),
+        "q must open the end-review modal, got {:?}",
+        app.mode
+    );
+    press(&mut app, &keymap, &mut pending, KeyCode::Char('p'));
+
+    assert_eq!(app.target, DiffTarget::WorkingTree);
+    assert_eq!(
+        canon(app.repo_root.as_ref().expect("repo root set")),
+        origin_root,
+        "pause must re-root back onto the origin checkout"
+    );
+    assert!(app.review_states.is_empty());
+    let wt_list = git_out(dir, &["worktree", "list"]);
+    assert!(
+        wt_list.contains(review_root.to_str().unwrap()),
+        "pause must keep the worktree for the resumed review: {wt_list}"
+    );
+
+    drop(tmp);
+}
+
+/// `Esc` with nothing else to unwind pauses the review the same way. It must
+/// still yield to the overlays that already own `Esc` — proven here by the
+/// help overlay, which closes on the first `Esc` and leaves the session alone.
+#[test]
+fn esc_closes_an_overlay_first_and_only_then_pauses_the_review() {
+    let tmp = repo_with_two_branches_ahead_of_main();
+    let dir = tmp.path();
+    let mut app = app_for(dir);
+    let keymap = Keymap::default_map();
+    let mut pending: Option<KeyEvent> = None;
+    let origin_root = canon(app.repo_root.as_ref().expect("repo root set"));
+
+    launch_review_of(&mut app, &keymap, &mut pending, "alpha");
+
+    press(&mut app, &keymap, &mut pending, KeyCode::Char('?'));
+    assert!(app.help.open, "sanity: the help overlay must be open");
+    press(&mut app, &keymap, &mut pending, KeyCode::Esc);
+    assert!(!app.help.open, "the first Esc closes help");
+    assert!(
+        app.in_review_session(),
+        "the Esc that closed help must not also have ended the review"
+    );
+
+    press(&mut app, &keymap, &mut pending, KeyCode::Esc);
+
+    assert_eq!(app.target, DiffTarget::WorkingTree);
+    assert_eq!(
+        canon(app.repo_root.as_ref().expect("repo root set")),
+        origin_root
+    );
+
+    drop(tmp);
+}
+
+/// `q` then `f` removes the worktree and returns to the working tree, handing
+/// the session's annotations to the buffer `main` renders on exit. The
+/// regression this catches is finish silently dropping the annotations it
+/// promised to emit now that it no longer quits.
+#[test]
+fn finishing_a_review_returns_to_the_working_tree_and_carries_its_annotations() {
+    use crate::annotate::{Classification, Target};
+
+    let tmp = repo_with_two_branches_ahead_of_main();
+    let dir = tmp.path();
+    let mut app = app_for(dir);
+    let keymap = Keymap::default_map();
+    let mut pending: Option<KeyEvent> = None;
+    let origin_root = canon(app.repo_root.as_ref().expect("repo root set"));
+
+    launch_review_of(&mut app, &keymap, &mut pending, "alpha");
+    let review_root = canon(app.repo_root.as_ref().expect("repo root set"));
+    app.annotations
+        .add(Target::file("alpha.rs"), Classification::Question, "why?")
+        .unwrap();
+
+    press(&mut app, &keymap, &mut pending, KeyCode::Char('q'));
+    press(&mut app, &keymap, &mut pending, KeyCode::Char('f'));
+
+    assert_eq!(
+        app.target,
+        DiffTarget::WorkingTree,
+        "finish must land on the working tree, not quit: {:?}",
+        app.status_message
+    );
+    assert_eq!(
+        canon(app.repo_root.as_ref().expect("repo root set")),
+        origin_root
+    );
+    assert!(
+        !review_root.exists(),
+        "finish must remove the managed worktree"
+    );
+    assert_eq!(
+        app.finished_annotations
+            .iter()
+            .map(|a| a.body.as_str())
+            .collect::<Vec<_>>(),
+        vec!["why?"],
+        "the finished review's annotations must reach the exit-time emit buffer"
+    );
+    assert!(
+        app.annotations.is_empty(),
+        "and must not also stay behind to be emitted a second time"
+    );
+
+    drop(tmp);
+}
diff --git a/src/ui/review_persistence_integration_tests.rs b/src/ui/review_persistence_integration_tests.rs
index 6f0a3e5..34a36ef 100644
--- a/src/ui/review_persistence_integration_tests.rs
+++ b/src/ui/review_persistence_integration_tests.rs
@@ -320,8 +320,7 @@ fn resume_staleness_re_accept_and_finish_round_trip_against_real_git() {
 
     // -- Finish: worktree removed, admin records pruned, state entry gone. --
     app.open_end_review_modal();
-    let outcome = app.finish_review();
-    assert_eq!(outcome, Some(super::QuitOutcome::Emit));
+    assert!(app.finish_review());
 
     assert!(!worktree_path.exists(), "finish must remove the worktree");
     let worktree_list = git_out(repo.path(), &["worktree", "list", "--porcelain"]);
@@ -395,14 +394,12 @@ fn annotate_pause_resume_restores_and_finish_emits_the_complete_set_once() {
         wait_for_review_save(&mut app);
 
         assert_eq!(app.annotations.len(), 1);
-        // Pause: `app` is simply dropped here — exactly like the end-review
-        // modal's `p`, which quits via `Flow::Quit(QuitOutcome::Discard)`
-        // (see `modal_keys.rs`'s drift test for that wiring) and therefore
-        // never reaches `main.rs`'s `render_markdown` call at all. Nothing
-        // in this in-crate test observes stdout directly (that gate is
-        // `main.rs`'s job, already pinned by `modal_keys.rs`'s
-        // `every_end_review_table_entry_drives_its_documented_action`); this
-        // test's job is the persistence/restore half of the contract.
+        // Pause: `app` is simply dropped here. The live pause gesture returns
+        // to the working tree instead of quitting, but it emits nothing
+        // either way, and what this test is about is the persistence/restore
+        // half of the contract — that the annotation is on disk before the
+        // session goes away. Where the reviewer lands afterwards is pinned by
+        // `end_review.rs`'s own tests.
     }
     let after_pause = store::load(&state_path);
     let saved_review = after_pause
@@ -439,6 +436,7 @@ fn annotate_pause_resume_restores_and_finish_emits_the_complete_set_once() {
     app.set_review_states(states, blob_shas);
     app.set_review_state_path(state_path.clone());
     app.set_review_origin_ops(Box::new(GitRunner::discover_in(repo.path()).unwrap()));
+    app.set_review_origin_root(repo.path().to_path_buf());
 
     // Restore happens before anything else, exactly mirroring `main.rs`'s
     // bootstrap ordering (`set_review_states` then `restore_review_annotations`,
@@ -480,11 +478,15 @@ fn annotate_pause_resume_restores_and_finish_emits_the_complete_set_once() {
     assert_eq!(app.annotations.len(), 2);
 
     // -- Finish: emits the complete restored-plus-new set exactly once. -----
+    // Finish no longer quits — it removes the worktree and returns to the
+    // origin working tree, handing the session's annotations to the buffer
+    // `main` renders on exit. Both halves run here, so the emitted set is
+    // read from where `main` actually reads it.
     app.open_end_review_modal();
-    let outcome = app.finish_review();
-    assert_eq!(outcome, Some(super::QuitOutcome::Emit));
+    assert!(app.finish_review());
+    assert!(app.leave_review_session(super::end_review::LeaveReason::Finish));
 
-    let markdown = crate::annotate::render_markdown(&app.annotations);
+    let markdown = crate::annotate::render_markdown(&app.finished_annotations);
     assert_eq!(
         markdown.matches("first note").count(),
         1,
@@ -495,6 +497,11 @@ fn annotate_pause_resume_restores_and_finish_emits_the_complete_set_once() {
         1,
         "the new annotation must appear exactly once in the emitted set"
     );
+    assert!(
+        app.annotations.is_empty(),
+        "the finished session's annotations move to the emit buffer rather than \
+         staying behind to be emitted a second time on the next quit"
+    );
 
     // -- One lifecycle: finish deletes the whole entry, annotations included. --
     let final_state = store::load(&state_path);

From 4e00237a491e97d32669dc30bfb64ffc37c64035 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 1 Aug 2026 00:39:19 +0000
Subject: [PATCH 3/4] fix(review): leaving a review never emits
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Correcting the previous commit, which built a `finished_annotations` buffer
so finish could still reach the annotation presentation after it stopped
quitting. That was based on a wrong reading of what finish did: the
presentation is `present_annotations`, which copies to the *clipboard* (plus
`-o <file>`) and only writes markdown to stdout when the clipboard is
unavailable — so "finish emits to stdout" was stale doc language, not
behavior, and deferring it to process exit would have concatenated two
finished reviews into one clipboard copy at exit rather than giving each its
own.

A review's annotations already have their destinations: `review-state.json`
while it is open, and the forge submit flow for a PR/MR. So none of the three
exits presents anything. `leave_review_session` simply clears the session's
annotations — which is also what keeps them out of the working tree's list
panel and out of the next review's persisted state — and `main`'s
presentation stays exactly as it was, reachable only from a non-review
session's `q`.

`AnnotationStore::drain_into` and `App::finished_annotations` go with it.
`QuitOutcome`'s doc now states the clipboard destination and that it is a
non-review-session contract. Finish's option row names the consequence
("remove worktree & comments") rather than the modal caption promising an
emission that never happens.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GGu65bNJ18EqsyGDmd74ZX
---
 src/annotate/store.rs                         | 21 ------
 src/main.rs                                   | 19 ++---
 src/ui/app.rs                                 | 20 ++---
 src/ui/end_review.rs                          | 73 ++++++++++---------
 src/ui/end_review_modal.rs                    | 22 ++++--
 src/ui/mod.rs                                 | 31 ++++----
 src/ui/modal_keys.rs                          | 11 ++-
 src/ui/review_launcher_integration_tests.rs   | 23 +++---
 .../review_persistence_integration_tests.rs   | 40 +++++-----
 9 files changed, 116 insertions(+), 144 deletions(-)

diff --git a/src/annotate/store.rs b/src/annotate/store.rs
index 65e7d54..4a946fd 100644
--- a/src/annotate/store.rs
+++ b/src/annotate/store.rs
@@ -189,27 +189,6 @@ impl AnnotationStore {
     pub fn unpublished(&self) -> impl Iterator<Item = &Annotation> {
         self.annotations.iter().filter(|a| !a.published)
     }
-
-    /// Moves every annotation out of `self` (leaving it empty) and appends
-    /// them to the end of `dest`, in insertion order. Ids are reassigned from
-    /// `dest`'s own counter so the merged store keeps the "stable ordinal,
-    /// never reused" guarantee `add` establishes — the two stores were
-    /// numbered independently, so carrying the original ids across would
-    /// collide.
-    ///
-    /// Used when a finished review session hands its annotations to the
-    /// process-lifetime emit buffer (`ui::App::finished_annotations`): the
-    /// session's own store is cleared as it returns to the working tree,
-    /// while the annotations it produced survive to be rendered to stdout
-    /// exactly once on exit.
-    pub fn drain_into(&mut self, dest: &mut AnnotationStore) {
-        for mut annotation in std::mem::take(&mut self.annotations) {
-            annotation.id = dest.next_id;
-            dest.next_id += 1;
-            dest.annotations.push(annotation);
-        }
-        self.next_id = 0;
-    }
 }
 
 #[cfg(test)]
diff --git a/src/main.rs b/src/main.rs
index f0884c7..4523816 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -328,19 +328,14 @@ fn run_tui(config: &RunConfig) -> anyhow::Result<()> {
     ));
     let outcome = ui::run(&mut app)?;
 
-    // Reviews finished during the run already handed their annotations over
-    // (see `App::finished_annotations`); finish promised to emit them, so they
-    // go out regardless of how the process was eventually quit. The live
-    // session's own annotations join them only on `QuitOutcome::Emit`. One
-    // render, one presentation — a consumer still sees each annotation exactly
-    // once.
-    let mut emitted = std::mem::take(&mut app.finished_annotations);
+    // Only a non-review session's `q` ever reaches here with `Emit` (see
+    // `QuitOutcome`): a review's own annotations belong to its persisted
+    // entry and, for a PR/MR, to the forge submit flow, and are cleared from
+    // `app.annotations` as the review is left — so nothing a review produced
+    // can arrive here to be presented.
     if let QuitOutcome::Emit = outcome {
-        app.annotations.drain_into(&mut emitted);
-    }
-    if !emitted.is_empty() {
-        let markdown = render_markdown(&emitted);
-        present_annotations(&markdown, emitted.len(), config.output.as_deref())?;
+        let markdown = render_markdown(&app.annotations);
+        present_annotations(&markdown, app.annotations.len(), config.output.as_deref())?;
     }
 
     Ok(())
diff --git a/src/ui/app.rs b/src/ui/app.rs
index d019a94..4734f36 100644
--- a/src/ui/app.rs
+++ b/src/ui/app.rs
@@ -272,19 +272,14 @@ pub struct App {
     /// mirroring lazygit), and the mode/scope `?` was pressed from. Reset by
     /// [`Action::ToggleHelp`] whenever the overlay opens or closes.
     pub(super) help: HelpOverlayState,
-    /// Annotations accumulated this session.
+    /// Annotations accumulated this session. Cleared when a review session is
+    /// left (see [`super::end_review::App::leave_review_session`]): a review's
+    /// annotations belong to that review — persisted in `review-state.json`
+    /// and, for a PR/MR, submitted to the forge — and must not follow the
+    /// reviewer back to the working tree, where they would show up in the
+    /// list panel against a diff they don't describe and be written into the
+    /// *next* review's persisted state.
     pub annotations: AnnotationStore,
-    /// Annotations carried over from review sessions *finished* during this
-    /// run. Finishing a review no longer quits — it returns to the working
-    /// tree (see [`super::end_review::LeaveReason`]) — so the session's
-    /// annotations are moved here as it unwinds rather than left in
-    /// `annotations`, where they would bleed into the next target's list
-    /// panel and into the next review's persisted state. `main` renders this
-    /// buffer to stdout on exit regardless of the final [`super::QuitOutcome`]
-    /// (a later `Q` must not silently drop what an explicit finish already
-    /// promised to emit), so each annotation still reaches a consumer exactly
-    /// once. Empty unless a review was finished this run.
-    pub finished_annotations: AnnotationStore,
     /// The current interaction mode.
     pub mode: Mode,
     /// The Compose modal's state, when `mode == Mode::Compose`.
@@ -896,7 +891,6 @@ impl App {
             view: DiffViewState::new(files),
             help: HelpOverlayState::new(),
             annotations,
-            finished_annotations: AnnotationStore::new(),
             mode: Mode::Normal,
             compose: None,
             commit_message: None,
diff --git a/src/ui/end_review.rs b/src/ui/end_review.rs
index 5fbcb14..6f9bd73 100644
--- a/src/ui/end_review.rs
+++ b/src/ui/end_review.rs
@@ -10,32 +10,37 @@
 //! view redquill opens in by default. Only `Q`/Ctrl-C, and `q` from outside a
 //! review, still quit.
 //!
-//! The three reasons differ in what they leave behind, not in where they land
-//! (see [`LeaveReason`]): pause keeps the worktree, the persisted state, and
-//! every annotation on disk; finish first removes the worktree and deletes the
-//! persisted entry ([`App::finish_review`]) and carries the session's
-//! annotations into [`App::finished_annotations`] for the one stdout emission
-//! finish has always promised; a swap behaves exactly like pause, so the
-//! review being left is resumable the moment the new one is done.
+//! The three reasons differ only in what they leave *on disk* (see
+//! [`LeaveReason`]) and in the status line's wording: pause and a swap keep
+//! the worktree and the persisted entry, so the review resumes exactly where
+//! it stopped; finish removes both first ([`App::finish_review`]).
+//!
+//! **Leaving a review never emits.** A review's annotations have their own
+//! destinations — `review-state.json` while it is open, and for a PR/MR the
+//! forge submit flow (`super::forge_submit`) — so none of the three exits
+//! hands anything to the clipboard/stdout presentation `main` runs on quit.
+//! That path belongs to non-review sessions, whose `q` still emits exactly as
+//! it always has. The session's in-memory annotations are simply dropped as
+//! it unwinds, which is also what keeps them out of the working tree's list
+//! panel and out of the *next* review's persisted state.
 
 use super::app::{App, Mode, ModeOrigin};
 use super::modal_keys::EndReviewAction;
 use crate::git::{DiffTarget, GitRunner};
 
-/// Why a review session is being left — the one thing that differs between
-/// the three exits, all of which land on the origin working tree via
-/// [`App::leave_review_session`].
+/// Why a review session is being left. All three land on the origin working
+/// tree via [`App::leave_review_session`] and clear the same in-memory state;
+/// what they leave on disk was already settled by the caller before it got
+/// here, so this only picks the status line's wording.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub(super) enum LeaveReason {
-    /// `p` in the end-review modal, or `Esc` from the diff view. Everything
-    /// (worktree, persisted state, annotations) stays on disk; the session's
-    /// in-memory annotations are dropped rather than emitted, so a consumer
-    /// reading stdout still sees each one exactly once — on finish.
+    /// `p` in the end-review modal, or `Esc` from the diff view. The
+    /// worktree, the persisted entry, and every annotation in it stay on
+    /// disk, so reopening this review resumes mid-review.
     Pause,
     /// `f` in the end-review modal, after [`App::finish_review`] has already
-    /// removed the worktree and deleted the persisted entry. The session's
-    /// annotations move to [`App::finished_annotations`] to be emitted on
-    /// exit.
+    /// removed the worktree and deleted the persisted entry — annotations
+    /// included, since one entry holds both.
     Finish,
     /// Confirming a different branch or PR in the review launcher while a
     /// review is already open. Identical to [`LeaveReason::Pause`] in effect;
@@ -138,13 +143,12 @@ impl App {
     /// [`crate::review::store::delete_review`] call removes both, and a
     /// later fresh `--review` of the same branch starts clean. Returns `true`
     /// on success, so the caller can hand off to
-    /// [`App::leave_review_session`] and land back on the working tree with
-    /// the session's annotations carried into [`App::finished_annotations`]
-    /// for the one stdout emission finish promises. On failure (e.g. a dirty
-    /// worktree, or no origin backend/review session attached) the git
-    /// message surfaces as a status message, the modal closes back to its
-    /// origin mode, the session stays open, and the persisted state entry is
-    /// left untouched for retry.
+    /// [`App::leave_review_session`] and land back on the working tree.
+    /// Nothing is emitted on the way — see this module's doc. On failure
+    /// (e.g. a dirty worktree, or no origin backend/review session attached)
+    /// the git message surfaces as a status message, the modal closes back to
+    /// its origin mode, the session stays open, and the persisted state entry
+    /// is left untouched for retry.
     pub(super) fn finish_review(&mut self) -> bool {
         let Some(ops) = self.review_origin_ops.as_deref() else {
             self.set_status_message("finish unavailable (no origin git backend)");
@@ -229,11 +233,15 @@ impl App {
     /// This is the single unwind path for all three exits — the end-review
     /// modal's pause and finish, `Esc` from the diff view, and the review
     /// launcher's swap-to-another-review — so what a review leaves behind can
-    /// never drift between them. `reason` governs only two things: the status
-    /// line's wording, and whether the session's annotations are carried into
-    /// [`App::finished_annotations`] (finish) or dropped (pause/switch, where
-    /// they are already durable in `review-state.json` and would otherwise be
-    /// emitted a second time on a later quit).
+    /// never drift between them. `reason` picks the status line's wording and
+    /// nothing else: every exit clears the same in-memory state, and what
+    /// survives on disk was already settled before this was called (pause
+    /// leaves the persisted entry alone, finish deleted it).
+    ///
+    /// Nothing is emitted here. A review's annotations reach their consumer
+    /// through the persisted entry and, for a PR/MR, the forge — never the
+    /// clipboard/stdout presentation, which belongs to a non-review session's
+    /// `q`. See this module's doc.
     ///
     /// The re-root is attempted *before* any session state is cleared, so a
     /// failure — a missing origin root (never the case for a session started
@@ -281,12 +289,7 @@ impl App {
         // remaining scrap of per-session state goes with it, so the working
         // tree isn't left wearing the review's accept marks, annotations, or
         // imported comment threads.
-        match reason {
-            LeaveReason::Finish => self.annotations.drain_into(&mut self.finished_annotations),
-            LeaveReason::Pause | LeaveReason::Switch => {
-                self.annotations = crate::annotate::AnnotationStore::new();
-            }
-        }
+        self.annotations = crate::annotate::AnnotationStore::new();
         self.replies = super::draft_reply::DraftReplyStore::new();
         self.review_states.clear();
         self.review_blob_shas.clear();
diff --git a/src/ui/end_review_modal.rs b/src/ui/end_review_modal.rs
index 51e18dc..a6d11bc 100644
--- a/src/ui/end_review_modal.rs
+++ b/src/ui/end_review_modal.rs
@@ -26,13 +26,12 @@ use super::modal_keys::EndReviewAction;
 const CONTENT_WIDTH: u16 = 48;
 /// Total modal width: content + 2 columns of padding + 2 columns of border.
 const MODAL_WIDTH: u16 = CONTENT_WIDTH + 2 + 2;
-/// The caption under the three options. Two facts a reviewer at this modal
-/// needs and can't read off the option rows: pause and finish both land back
-/// on the working tree rather than exiting redquill, and the annotations a
-/// finish earmarks — this session's and any restored from an earlier one —
-/// print to stdout exactly once, when redquill itself exits. Pause never
-/// emits. Kept within [`CONTENT_WIDTH`], which is sized to this line.
-const CAPTION: &str = "both return to the working tree; finish emits once";
+/// The caption under the three options: the one fact a reviewer at this
+/// modal can't read off the option rows — pause and finish both land back on
+/// the working tree rather than exiting redquill, which is what they used to
+/// do. What each does to the review itself is on its own row. Kept within
+/// [`CONTENT_WIDTH`], which is sized to this line.
+const CAPTION: &str = "both return to the working tree, not to a quit";
 
 /// The three exits' display order, short label, and short description —
 /// the modal's own tuned prose, distinct from [`super::modal_keys::END_REVIEW_KEYS`]'s
@@ -41,7 +40,14 @@ const CAPTION: &str = "both return to the working tree; finish emits once";
 /// control keys, not exits, so they have no row of their own.
 const OPTIONS: [(EndReviewAction, &str, &str); 3] = [
     (EndReviewAction::Pause, "Pause", "keep worktree & state"),
-    (EndReviewAction::Finish, "Finish", "remove worktree"),
+    // Names the comments explicitly: finish deletes the persisted entry, and
+    // a review's annotations live in that entry, so anything not already
+    // submitted to the forge goes with it. Nothing is emitted on the way out.
+    (
+        EndReviewAction::Finish,
+        "Finish",
+        "remove worktree & comments",
+    ),
     (EndReviewAction::Cancel, "Cancel", "keep reviewing"),
 ];
 
diff --git a/src/ui/mod.rs b/src/ui/mod.rs
index 4cc8ca6..6e65ba8 100644
--- a/src/ui/mod.rs
+++ b/src/ui/mod.rs
@@ -138,29 +138,28 @@ const POLL_INTERVAL: Duration = Duration::from_millis(50);
 /// actually changing, so idle ticks are cheap.
 const AUTO_REFRESH_INTERVAL: Duration = Duration::from_secs(2);
 
-/// How a TUI session ended: governs only whether the *live* view's
-/// annotations join `main`'s one stdout emission — never what's kept on disk,
-/// which is already settled by the time either variant is produced.
+/// How a TUI session ended: governs only whether `main` presents
+/// `app.annotations` on the way out (`present_annotations` — the clipboard,
+/// plus `-o <file>` when given, with stdout as the headless fallback) — never
+/// what's kept on disk, which is already settled by the time either variant
+/// is produced.
 ///
-/// A review session's `p` (pause) and `f` (finish) no longer produce either
-/// variant: neither ends the process, both return to the working tree (see
-/// [`end_review::LeaveReason`]). Finish's promised emission happens through
-/// `App::finished_annotations`, which `main` renders on exit whichever
-/// variant this eventually is — an explicit finish must not be undone by a
-/// later `Q`. So a consumer piping redquill's output still sees each
-/// annotation exactly once, on finish rather than once per pause plus once
-/// more on finish.
+/// This is a **non-review-session** contract. A review's `p` (pause) and `f`
+/// (finish) produce neither variant: neither ends the process, both return to
+/// the working tree and clear `app.annotations` on the way (see
+/// [`end_review::LeaveReason`]). A review's annotations reach their consumer
+/// through its persisted entry and, for a PR/MR, the forge submit flow — so
+/// nothing a review produced is ever presented here, whichever variant the
+/// eventual quit yields.
 ///
 /// [`QuitOutcome::Emit`]: `q` outside a review session.
 /// [`QuitOutcome::Discard`]: `Q`/Ctrl-C, in any view.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum QuitOutcome {
-    /// Emit `app.annotations` to stdout on the way out, alongside any already
-    /// in `app.finished_annotations`.
+    /// Present `app.annotations` on the way out.
     Emit,
-    /// Emit only `app.finished_annotations`; whatever is still in
-    /// `app.annotations` is dropped from memory (not from disk — a review
-    /// session's are already persisted by this point).
+    /// Present nothing; annotations still in `app.annotations` are simply
+    /// dropped from memory.
     Discard,
 }
 
diff --git a/src/ui/modal_keys.rs b/src/ui/modal_keys.rs
index 66661c3..5b6d39d 100644
--- a/src/ui/modal_keys.rs
+++ b/src/ui/modal_keys.rs
@@ -1035,11 +1035,10 @@ pub(super) enum EndReviewAction {
     Pause,
     /// Remove the worktree (and delete the persisted review-state entry —
     /// statuses and annotations together), then return to the working tree.
-    /// The complete annotation set (restored-from-earlier-sessions and this
-    /// session's own, together) is carried into
-    /// [`super::app::App::finished_annotations`] and emitted exactly once on
-    /// exit. On removal failure the modal closes with the git error surfaced
-    /// and the session stays open.
+    /// The review is over, so its annotations go with the entry; anything
+    /// meant to outlive it should already have been submitted to the forge.
+    /// On removal failure the modal closes with the git error surfaced and
+    /// the session stays open.
     Finish,
     /// Close the modal and keep reviewing; nothing happens.
     Cancel,
@@ -1092,7 +1091,7 @@ pub(super) static END_REVIEW_KEYS: LazyLock<Vec<ModalBinding<EndReviewAction>>>
                 }),
             },
             ModalBinding {
-                description: "Finish — remove worktree, back to the working tree",
+                description: "Finish — remove worktree & comments, back to the working tree",
                 keys: vec![ModalKey::plain(KeyCode::Char('f'))],
                 action: EndReviewAction::Finish,
                 footer: Some(FooterHint {
diff --git a/src/ui/review_launcher_integration_tests.rs b/src/ui/review_launcher_integration_tests.rs
index 56ba2d4..5e1394b 100644
--- a/src/ui/review_launcher_integration_tests.rs
+++ b/src/ui/review_launcher_integration_tests.rs
@@ -1764,12 +1764,14 @@ fn esc_closes_an_overlay_first_and_only_then_pauses_the_review() {
     drop(tmp);
 }
 
-/// `q` then `f` removes the worktree and returns to the working tree, handing
-/// the session's annotations to the buffer `main` renders on exit. The
-/// regression this catches is finish silently dropping the annotations it
-/// promised to emit now that it no longer quits.
+/// `q` then `f` removes the worktree, returns to the working tree, and takes
+/// the review's annotations with it. The regression this catches is a
+/// finished review's annotations surviving into the working-tree view, where
+/// a later plain `q` would present them to the clipboard — a review's
+/// comments belong to its persisted entry and to the forge, and finishing
+/// deletes that entry.
 #[test]
-fn finishing_a_review_returns_to_the_working_tree_and_carries_its_annotations() {
+fn finishing_a_review_returns_to_the_working_tree_and_drops_its_annotations() {
     use crate::annotate::{Classification, Target};
 
     let tmp = repo_with_two_branches_ahead_of_main();
@@ -1802,17 +1804,10 @@ fn finishing_a_review_returns_to_the_working_tree_and_carries_its_annotations()
         !review_root.exists(),
         "finish must remove the managed worktree"
     );
-    assert_eq!(
-        app.finished_annotations
-            .iter()
-            .map(|a| a.body.as_str())
-            .collect::<Vec<_>>(),
-        vec!["why?"],
-        "the finished review's annotations must reach the exit-time emit buffer"
-    );
     assert!(
         app.annotations.is_empty(),
-        "and must not also stay behind to be emitted a second time"
+        "the finished review's annotations must not follow the reviewer back \
+         to the working tree"
     );
 
     drop(tmp);
diff --git a/src/ui/review_persistence_integration_tests.rs b/src/ui/review_persistence_integration_tests.rs
index 34a36ef..ec218b2 100644
--- a/src/ui/review_persistence_integration_tests.rs
+++ b/src/ui/review_persistence_integration_tests.rs
@@ -477,33 +477,35 @@ fn annotate_pause_resume_restores_and_finish_emits_the_complete_set_once() {
     wait_for_review_save(&mut app);
     assert_eq!(app.annotations.len(), 2);
 
-    // -- Finish: emits the complete restored-plus-new set exactly once. -----
-    // Finish no longer quits — it removes the worktree and returns to the
-    // origin working tree, handing the session's annotations to the buffer
-    // `main` renders on exit. Both halves run here, so the emitted set is
-    // read from where `main` actually reads it.
+    // Restored-plus-new, each exactly once: the resume replayed the persisted
+    // copy into a store that then took a live addition, and neither half
+    // doubled the other. This is the defect the two-session shape exists to
+    // catch — a re-entry bug that appends a second copy of every restored
+    // annotation is invisible in a single-session test.
+    let saved_before_finish = store::load(&state_path);
+    let bodies: Vec<&str> = saved_before_finish.reviews["feature"]
+        .annotations
+        .iter()
+        .map(|a| a.body.as_str())
+        .collect();
+    assert_eq!(bodies, vec!["first note", "second note"]);
+
+    // -- Finish: the whole entry goes, annotations included. ----------------
+    // Finish neither quits nor emits: it removes the worktree, deletes the
+    // persisted entry, and returns to the origin working tree. A review's
+    // annotations belong to that entry (and, for a PR, to the forge), so
+    // finishing is the point at which they stop existing.
     app.open_end_review_modal();
     assert!(app.finish_review());
     assert!(app.leave_review_session(super::end_review::LeaveReason::Finish));
 
-    let markdown = crate::annotate::render_markdown(&app.finished_annotations);
-    assert_eq!(
-        markdown.matches("first note").count(),
-        1,
-        "the restored annotation must appear exactly once in the emitted set"
-    );
-    assert_eq!(
-        markdown.matches("second note").count(),
-        1,
-        "the new annotation must appear exactly once in the emitted set"
-    );
+    assert_eq!(app.target, DiffTarget::WorkingTree);
     assert!(
         app.annotations.is_empty(),
-        "the finished session's annotations move to the emit buffer rather than \
-         staying behind to be emitted a second time on the next quit"
+        "the finished review's annotations must not follow the reviewer back \
+         to the working tree, where a later plain `q` would present them"
     );
 
-    // -- One lifecycle: finish deletes the whole entry, annotations included. --
     let final_state = store::load(&state_path);
     assert!(
         !final_state.reviews.contains_key("feature"),

From bdd34fb3e03e42fa96eac5b327ff318ae75caafe Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 1 Aug 2026 17:15:18 +0000
Subject: [PATCH 4/4] feat(annotate): U copies annotations to the clipboard off
 a PR
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`U` (submit-forge-review) was inert outside a forge PR review — "submit
unavailable — not a PR review" — which left every other target with no way
to hand a review to an agent short of quitting redquill. It now means the
same thing everywhere: hand off my review. On a PR that is still the submit
modal, unchanged, verdict picker and confirm and all. On the working tree,
`--staged`, a commit or range, or a local branch review with no PR behind it,
it copies the annotations to the clipboard as the same public markdown
`main` presents on quit, and reports it in the footer.

No modal on the copy path: there is no verdict to choose and nothing
irreversible to confirm, so a confirm step would be ceremony in front of a
clipboard write.

Copying consumes nothing — the reviewer can keep annotating and copy again,
and the same annotations still reach the on-quit presentation. `U` is
therefore no longer hidden by `binding_hidden`'s review-session gate, so the
`?` overlay and the footer strip list it on every target, including the
plain working tree where most sessions start.

`main`'s inline `copy_to_clipboard` moves to a shared `clipboard` module.
It caches its `arboard` handle for the process lifetime: on X11 the
clipboard is served by the owning process, so the create-and-drop shape
`main` could get away with on the way out would leave a mid-session copy
pointing at nothing while the TUI is still on screen.

The clipboard write is injected into the copy gesture as a closure, so the
suite covers what actually reaches the clipboard without `cargo test`
writing to the developer's own — the same host-isolation rule the tempdir
convention exists for. The empty-set path returns before touching it at all.

The `[keys]` config id stays `submit-forge-review` despite the broader
meaning: renaming it would silently break existing config files.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GGu65bNJ18EqsyGDmd74ZX
---
 CLAUDE.md                           |   1 +
 README.md                           |   4 +-
 src/clipboard.rs                    |  70 +++++++++
 src/lib.rs                          |   1 +
 src/main.rs                         |  11 +-
 src/ui/annotation_export.rs         | 211 ++++++++++++++++++++++++++++
 src/ui/footer_tests.rs              |  14 +-
 src/ui/forge_submit.rs              |  26 +++-
 src/ui/forge_submit_tests.rs        |  12 +-
 src/ui/help.rs                      |   6 +-
 src/ui/history_integration_tests.rs |   1 -
 src/ui/keymap.rs                    |  27 ++--
 src/ui/mod.rs                       |   1 +
 13 files changed, 349 insertions(+), 36 deletions(-)
 create mode 100644 src/clipboard.rs
 create mode 100644 src/ui/annotation_export.rs

diff --git a/CLAUDE.md b/CLAUDE.md
index 7bcbd49..c2b483b 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -41,6 +41,7 @@ Keep these boundaries clean; they're the seams for testing and for future work:
 - `git/` — runs git commands, parses porcelain/diff output into typed structs. No TUI types leak in here.
 - `diff/` — diff model: files, hunks, lines, intra-line word diff. Pure data + transforms; heavily unit-tested.
 - `annotate/` — annotation model, persistence, stdout serialization.
+- `clipboard.rs` — the one seam around `arboard`, shared by `ui`'s in-app copy gesture (`U` off a PR) and `main`'s on-quit presentation. Caches its handle for the process lifetime: on X11 the clipboard is served by the owning process, so a handle created and dropped per copy would leave the reviewer with nothing while the TUI is still running.
 - `lsp/` — server lifecycle + the three requests. Must be fully async and never block the render loop; missing/slow servers degrade silently.
 - `ui/` — ratatui widgets, layout, event loop, keymap. Keymap is data (remappable), not hardcoded match arms scattered through widgets.
 - `review/` — per-file review-status model (spec 08 Unit 3, docs/specs/08-spec-branch-review-mode/08-spec-branch-review-mode.md): pure `ReviewStatus` tri-state and transition functions, no TUI types. Persistence (`review-state.json`, blob-SHA reconciliation) lands as a `review::store` submodule in spec 08 task 4.0.
diff --git a/README.md b/README.md
index d2aa67a..91e1ea7 100644
--- a/README.md
+++ b/README.md
@@ -25,8 +25,8 @@ brew install sdavisde/tap/redquill
 
 2. Run `redquill` in the git repo you want to review
 3. Press \` to open the git panel, and `?` for help — it opens on a "This context" view scoped to wherever you pressed it from (plus a curated list of common workflows), with the full reference one `Tab` away. Pause after `g` or `z` and the footer shows what keys can follow.
-4. When viewing the diff, press `c` to leave a comment. When the session ends, your comments are copied to the clipboard so you can paste them straight into an agent.
-5. Reviewing a teammate's pull request? Press `R` to open the Review launcher's Pull Requests tab — see [`docs/forge-setup.md`](docs/forge-setup.md) for supported providers and setup.
+4. When viewing the diff, press `c` to leave a comment and `U` to hand the review off — your comments are copied to the clipboard as markdown, ready to paste straight into an agent, without leaving redquill. Quitting a plain session copies them too.
+5. Reviewing a teammate's pull request? Press `R` to open the Review launcher's Pull Requests tab — see [`docs/forge-setup.md`](docs/forge-setup.md) for supported providers and setup. There `U` submits the review to the forge instead, behind a confirm modal where you pick the verdict.
 
 ## Documentation
 
diff --git a/src/clipboard.rs b/src/clipboard.rs
new file mode 100644
index 0000000..9eaaa24
--- /dev/null
+++ b/src/clipboard.rs
@@ -0,0 +1,70 @@
+//! The system clipboard: one thin seam around `arboard`, shared by the two
+//! places redquill hands the reviewer their annotations — the in-app
+//! `submit-forge-review` gesture on a non-PR target (see
+//! `ui::forge_submit`'s copy path) and `main`'s on-quit presentation.
+//!
+//! # Why the handle is cached
+//!
+//! On X11 the clipboard is *served by the owning process*: the content lives
+//! as long as some live `arboard::Clipboard` keeps announcing ownership, and
+//! evaporates when the last one drops. `main`'s exit-time copy can get away
+//! with a throwaway handle because the process is about to end either way
+//! (the documented X11 caveat). A copy made from inside the running TUI
+//! cannot — a handle created and dropped per keypress would leave the
+//! reviewer with an empty clipboard while redquill is still on screen, which
+//! is the exact case the in-app gesture exists to serve.
+//!
+//! So the handle is created lazily on first use and kept for the process
+//! lifetime, in a `thread_local` rather than on `App`: `arboard::Clipboard`
+//! is not `Sync`, both call sites run on the main thread, and keeping it out
+//! of `App` avoids threading a non-`Sync` field through a struct whose other
+//! members are all plain data. A failed creation is not cached — a clipboard
+//! that was unavailable at one keypress (no display server yet, a
+//! transiently busy selection owner) may be available at the next.
+//!
+//! # Error contract
+//!
+//! Failures surface as [`ClipboardError`] for the caller to report; nothing
+//! here degrades silently, because a copy the reviewer asked for and did not
+//! get is exactly the thing they must be told about. `main` falls back to
+//! writing the markdown on stdout; the TUI reports the error in the footer
+//! (it has no fallback — stdout belongs to the annotation format and writing
+//! there mid-render would corrupt the screen).
+
+use std::cell::RefCell;
+
+/// A clipboard write that didn't land, carrying `arboard`'s own message —
+/// the reason is always environmental (no display server, no clipboard
+/// backend compiled in, a selection owner that refused), never something the
+/// caller passed in, so there is nothing to distinguish beyond the text.
+#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
+#[error("{0}")]
+pub struct ClipboardError(String);
+
+thread_local! {
+    /// The cached handle (see the module doc). `None` until the first
+    /// successful creation.
+    static HANDLE: RefCell<Option<arboard::Clipboard>> = const { RefCell::new(None) };
+}
+
+/// Copies `text` to the system clipboard, reusing this thread's cached
+/// handle (creating it on first use) so the content survives for as long as
+/// the process runs.
+pub fn copy(text: &str) -> Result<(), ClipboardError> {
+    HANDLE.with(|cell| {
+        let mut slot = cell.borrow_mut();
+        if slot.is_none() {
+            // Not cached on failure: see the module doc.
+            *slot = Some(arboard::Clipboard::new().map_err(|e| ClipboardError(e.to_string()))?);
+        }
+        let Some(clipboard) = slot.as_mut() else {
+            // Unreachable in practice — the block above either filled the
+            // slot or returned — but written as a fallback rather than an
+            // `expect`, per this repo's no-panic rule.
+            return Err(ClipboardError("clipboard unavailable".to_string()));
+        };
+        clipboard
+            .set_text(text.to_owned())
+            .map_err(|e| ClipboardError(e.to_string()))
+    })
+}
diff --git a/src/lib.rs b/src/lib.rs
index 346633e..e15ec3e 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -4,6 +4,7 @@
 //! integration tests exercise them directly.
 
 pub mod annotate;
+pub mod clipboard;
 pub mod config;
 pub mod diff;
 pub mod forge;
diff --git a/src/main.rs b/src/main.rs
index 4523816..c3fbae7 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -365,7 +365,7 @@ fn present_annotations(
     if count == 0 {
         return Ok(());
     }
-    match copy_to_clipboard(markdown) {
+    match redquill::clipboard::copy(markdown) {
         Ok(()) => {
             let noun = if count == 1 {
                 "annotation"
@@ -384,15 +384,6 @@ fn present_annotations(
     Ok(())
 }
 
-/// Copies `text` to the system clipboard, returning any backend error so the
-/// caller can fall back. Kept as a thin seam around `arboard` so the fallback
-/// policy lives in one place ([`present_annotations`]).
-fn copy_to_clipboard(text: &str) -> anyhow::Result<()> {
-    let mut clipboard = arboard::Clipboard::new()?;
-    clipboard.set_text(text.to_owned())?;
-    Ok(())
-}
-
 fn main() -> anyhow::Result<()> {
     let cli = Cli::parse();
     let config = RunConfig::from(cli);
diff --git a/src/ui/annotation_export.rs b/src/ui/annotation_export.rs
new file mode 100644
index 0000000..6019fa1
--- /dev/null
+++ b/src/ui/annotation_export.rs
@@ -0,0 +1,211 @@
+//! Handing the reviewer their annotations without quitting: the clipboard
+//! half of the `submit-forge-review` gesture (`U`).
+//!
+//! A forge PR review submits to the forge; every other target — the working
+//! tree, `--staged`, a commit or range, a local branch review with no PR
+//! behind it — has nowhere to submit, so the same key copies the annotations
+//! to the clipboard in the public markdown format (see
+//! [`crate::annotate::render_markdown`], the same bytes `main` presents on
+//! quit). Nothing is consumed or cleared by a copy: the reviewer can keep
+//! annotating and copy again, and the same annotations still reach `main`'s
+//! on-quit presentation. See [`super::forge_submit::App::open_submit_forge`]
+//! for the branch that picks between the two destinations.
+//!
+//! The copy is synchronous. It is a user-initiated one-shot on a cached
+//! clipboard handle (see [`crate::clipboard`]) rather than a per-tick or
+//! per-keystroke cost, so it doesn't belong on a background thread the way
+//! git subprocesses and state saves do.
+
+use crate::annotate::render_markdown;
+
+use super::app::App;
+
+/// The footer line for a copy attempt: `count` annotations were offered and
+/// `error` is the clipboard's own message if the write failed.
+///
+/// Pure and separate from the gesture so the one thing that actually matters
+/// here is testable without a system clipboard: a failed copy must never read
+/// as a successful one. A reviewer who is told their review is on the
+/// clipboard, and then pastes an empty buffer into an agent prompt, has lost
+/// the review — so "clipboard unavailable" has to be as visible as the
+/// success line.
+pub(super) fn copy_status_message(count: usize, error: Option<&str>) -> String {
+    match (count, error) {
+        (0, _) => "no annotations to copy".to_string(),
+        (_, Some(e)) => format!("clipboard unavailable ({e}) \u{2014} nothing copied"),
+        (1, None) => "copied 1 annotation to the clipboard".to_string(),
+        (n, None) => format!("copied {n} annotations to the clipboard"),
+    }
+}
+
+impl App {
+    /// Copies every annotation in this session to the clipboard as markdown
+    /// and reports the outcome in the footer. A no-op (beyond the footer
+    /// line) with nothing to copy.
+    ///
+    /// There is no stdout fallback here, unlike `main`'s on-quit
+    /// presentation: stdout carries the annotation format for other programs
+    /// to parse, and writing to it mid-render would corrupt the screen. A
+    /// clipboard failure is reported and nothing else happens — the reviewer
+    /// still has the on-quit path, and the annotations are untouched.
+    pub(super) fn copy_annotations_to_clipboard(&mut self) {
+        self.copy_annotations_with(|markdown| {
+            crate::clipboard::copy(markdown).map_err(|e| e.to_string())
+        });
+    }
+
+    /// [`App::copy_annotations_to_clipboard`]'s body, with the clipboard
+    /// write injected — the seam this repo puts in front of every external
+    /// service, kept as a plain closure rather than a trait because there is
+    /// exactly one operation and no state behind it.
+    ///
+    /// It also means the tests never touch the developer's real clipboard:
+    /// `cargo test` runs on a machine whose clipboard belongs to a person,
+    /// not to the suite, so a test that exercised the live path would be a
+    /// host side effect of the kind this repo's tempdir rules exist to
+    /// prevent. `copy` is not called at all when there is nothing to copy.
+    fn copy_annotations_with(&mut self, copy: impl FnOnce(&str) -> Result<(), String>) {
+        let count = self.annotations.len();
+        if count == 0 {
+            self.set_status_message(copy_status_message(0, None));
+            return;
+        }
+        let markdown = render_markdown(&self.annotations);
+        let error = copy(&markdown).err();
+        self.set_status_message(copy_status_message(count, error.as_deref()));
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::annotate::{Classification, Target};
+    use crate::diff::FileDiff;
+    use crate::git::RawFilePatch;
+    use std::cell::RefCell;
+
+    /// "… to the clipboard" is the phrase that constitutes the promise; a
+    /// message without it is not claiming the annotations got there.
+    fn claims_success(message: &str) -> bool {
+        message.contains("to the clipboard")
+    }
+
+    /// The guardrail: whichever way a copy goes, the footer must not tell the
+    /// reviewer their annotations are on the clipboard unless they are.
+    #[test]
+    fn a_failed_or_empty_copy_never_reads_as_a_successful_one() {
+        let ok = copy_status_message(3, None);
+        assert!(claims_success(&ok), "got {ok:?}");
+        assert!(ok.contains('3'), "the count must be reported: {ok:?}");
+
+        let failed = copy_status_message(3, Some("no display server"));
+        assert!(
+            !claims_success(&failed),
+            "a failed copy must not read as a success: {failed:?}"
+        );
+        assert!(
+            failed.contains("no display server"),
+            "the clipboard's own reason must surface: {failed:?}"
+        );
+
+        let empty = copy_status_message(0, None);
+        assert!(
+            !claims_success(&empty),
+            "an empty set must not claim a copy: {empty:?}"
+        );
+    }
+
+    fn app_with_annotations(bodies: &[&str]) -> App {
+        let raw = "\
+diff --git a/src/a.rs b/src/a.rs
+index 111..222 100644
+--- a/src/a.rs
++++ b/src/a.rs
+@@ -1,2 +1,2 @@
+ fn main() {
+-    old();
++    new();
+";
+        let file = FileDiff::from_patch(&RawFilePatch {
+            path: "src/a.rs".to_string(),
+            old_path: None,
+            raw: raw.to_string(),
+            is_binary: false,
+        })
+        .unwrap();
+        let mut app = App::new(vec![file]);
+        for body in bodies {
+            app.annotations
+                .add(Target::file("src/a.rs"), Classification::Question, *body)
+                .unwrap();
+        }
+        app
+    }
+
+    /// What reaches the clipboard is the public markdown format over the
+    /// whole annotation set — the same bytes `main` presents on quit, since
+    /// the point of the gesture is to hand an agent a review without quitting
+    /// first. The defect this catches is the copy shipping a partial set (a
+    /// stray `unpublished()` filter, say) or some other rendering.
+    #[test]
+    fn the_copy_hands_over_the_public_markdown_for_every_annotation() {
+        let mut app = app_with_annotations(&["first note", "second note"]);
+        let seen = RefCell::new(None);
+
+        app.copy_annotations_with(|markdown| {
+            *seen.borrow_mut() = Some(markdown.to_string());
+            Ok(())
+        });
+
+        let copied = seen.into_inner().expect("the clipboard write must run");
+        assert_eq!(copied, crate::annotate::render_markdown(&app.annotations));
+        assert!(copied.contains("first note"), "got {copied:?}");
+        assert!(copied.contains("second note"), "got {copied:?}");
+        assert!(
+            app.status_message.as_deref().is_some_and(claims_success),
+            "got {:?}",
+            app.status_message
+        );
+        assert_eq!(
+            app.annotations.len(),
+            2,
+            "a copy must not consume the annotations — the reviewer keeps working"
+        );
+    }
+
+    /// Nothing to copy means the clipboard is never touched at all, rather
+    /// than an empty string replacing whatever the reviewer had on it.
+    #[test]
+    fn an_empty_annotation_set_never_reaches_the_clipboard() {
+        let mut app = app_with_annotations(&[]);
+        let called = RefCell::new(false);
+
+        app.copy_annotations_with(|_| {
+            *called.borrow_mut() = true;
+            Ok(())
+        });
+
+        assert!(!called.into_inner(), "the clipboard must be left alone");
+        assert!(
+            app.status_message
+                .as_deref()
+                .is_some_and(|m| !claims_success(m)),
+            "got {:?}",
+            app.status_message
+        );
+    }
+
+    /// A clipboard that refuses is reported, not swallowed — the reviewer
+    /// must not paste an empty buffer into an agent prompt believing the
+    /// review went with it.
+    #[test]
+    fn a_clipboard_failure_surfaces_instead_of_reading_as_success() {
+        let mut app = app_with_annotations(&["a note"]);
+
+        app.copy_annotations_with(|_| Err("no display server".to_string()));
+
+        let message = app.status_message.as_deref().unwrap_or_default();
+        assert!(!claims_success(message), "got {message:?}");
+        assert!(message.contains("no display server"), "got {message:?}");
+    }
+}
diff --git a/src/ui/footer_tests.rs b/src/ui/footer_tests.rs
index 25973c1..277e9a7 100644
--- a/src/ui/footer_tests.rs
+++ b/src/ui/footer_tests.rs
@@ -56,7 +56,10 @@ fn keys(entries: &[FooterEntry]) -> Vec<String> {
 fn normal_mode_hints_match_the_curated_list_in_order() {
     let km = Keymap::default_map();
     let entries = normal_hints(&km, true, true, false, false, None);
-    assert_eq!(keys(&entries), vec!["Space", "S", "c", "d", "e", "x", "?"]);
+    assert_eq!(
+        keys(&entries),
+        vec!["Space", "S", "c", "d", "e", "x", "U", "?"]
+    );
     assert_eq!(
         labels(&entries),
         vec![
@@ -66,6 +69,10 @@ fn normal_mode_hints_match_the_curated_list_in_order() {
             "restore",
             "edit",
             "delete",
+            // `U` is in the plain strip too, not just a review session's:
+            // outside a PR it copies the annotations to the clipboard, which
+            // is the ordinary way to hand a working-tree review to an agent.
+            "submit",
             "help",
         ]
     );
@@ -93,8 +100,9 @@ fn normal_mode_hints_exclude_staging_when_not_allowed() {
     let entries = normal_hints(&km, false, true, false, false, None);
     assert!(!labels(&entries).contains(&"stage hunk"));
     assert!(!labels(&entries).contains(&"stage file"));
-    // Everything else survives (edit/delete are staging-independent).
-    assert_eq!(entries.len(), 4);
+    // Everything else survives (comment/edit/delete/submit are all
+    // staging-independent).
+    assert_eq!(entries.len(), 5);
     assert_eq!(labels(&entries).last(), Some(&"help"), "help stays last");
 }
 
diff --git a/src/ui/forge_submit.rs b/src/ui/forge_submit.rs
index dfa2921..335f42b 100644
--- a/src/ui/forge_submit.rs
+++ b/src/ui/forge_submit.rs
@@ -453,15 +453,27 @@ pub(super) fn build_preview<'a>(
 }
 
 impl App {
-    /// The imperative `submit-forge-review` entry: opens the modal in a forge
-    /// PR review session, or leaves a one-line hint everywhere else (a plain
-    /// review session with no forge PR, or no review at all — the action is
-    /// listed in the Review group but inert outside a PR review, matching the
-    /// "no-op with a hint" contract). A no-op with a hint while a prior submit
-    /// is still publishing (single-flight).
+    /// The imperative `submit-forge-review` entry — "hand off my review",
+    /// whatever the target is. One gesture, two destinations, picked by
+    /// whether there is a PR/MR to send to:
+    ///
+    /// - **A forge PR review** opens the modal below, where the reviewer
+    ///   picks a verdict and confirms. Nothing is sent from the keypress
+    ///   itself; the modal is the safety boundary (see the module doc).
+    /// - **Everything else** — the working tree, `--staged`, a commit or
+    ///   range, and a local branch review with no PR behind it — has no forge
+    ///   to submit to, so the annotations go to the clipboard instead
+    ///   ([`App::copy_annotations_to_clipboard`]), in the same markdown format
+    ///   `main` presents on quit. No modal: there is no verdict to choose and
+    ///   nothing irreversible to confirm, so a confirm step would be
+    ///   ceremony. Its whole point is that handing a review to an agent no
+    ///   longer requires quitting redquill first.
+    ///
+    /// A no-op with a hint while a prior submit is still publishing
+    /// (single-flight).
     pub(super) fn open_submit_forge(&mut self) {
         let Some(forge) = self.review_forge.clone() else {
-            self.set_status_message("submit unavailable \u{2014} not a PR review");
+            self.copy_annotations_to_clipboard();
             return;
         };
         if self.forge_submit_in_flight.is_some() {
diff --git a/src/ui/forge_submit_tests.rs b/src/ui/forge_submit_tests.rs
index 0170111..83cc011 100644
--- a/src/ui/forge_submit_tests.rs
+++ b/src/ui/forge_submit_tests.rs
@@ -268,8 +268,14 @@ fn reply_preview_falls_back_to_the_thread_id_when_the_thread_is_missing() {
 
 // -- open / not-a-forge-session no-op ----------------------------------------
 
+/// Off a PR, `U` routes to the clipboard copy instead of the modal — there
+/// is no verdict to pick and no forge to send to. Driven with an empty
+/// annotation set on purpose: that path reports and returns *before* touching
+/// the clipboard, so this proves the routing without `cargo test` writing to
+/// the developer's real clipboard. What the copy actually hands over is
+/// covered in `annotation_export`, against an injected fake.
 #[test]
-fn open_submit_forge_is_a_no_op_hint_outside_a_forge_session() {
+fn open_submit_forge_copies_to_the_clipboard_outside_a_forge_session() {
     let mut app = App::new(vec![file("src/a.rs")]);
     // A plain diff, no review_forge.
     app.open_submit_forge();
@@ -278,7 +284,9 @@ fn open_submit_forge_is_a_no_op_hint_outside_a_forge_session() {
     assert!(
         app.status_message
             .as_deref()
-            .is_some_and(|m| m.contains("not a PR review"))
+            .is_some_and(|m| m.contains("copy")),
+        "the copy path must report itself, got {:?}",
+        app.status_message
     );
 }
 
diff --git a/src/ui/help.rs b/src/ui/help.rs
index 2731d75..a5b6028 100644
--- a/src/ui/help.rs
+++ b/src/ui/help.rs
@@ -185,6 +185,11 @@ fn key_line(key: &str, description: &str, key_width: usize, theme: &Theme) -> Li
 ///   hidden rather than listed-but-inert. `OpenPrDescription` (`gi`) rides it
 ///   too: there is no PR to describe outside a review session, and the same
 ///   description is reachable from the launcher's own `d` there.
+/// - `SubmitForgeReview` (`U`) doesn't ride `review_session` either, and is
+///   never hidden: it means "hand off my review" on every target. On a PR it
+///   opens the submit modal; everywhere else — including the working tree,
+///   where most of redquill's use starts — it copies the annotations to the
+///   clipboard. A key that acts in every view is listed in every view.
 /// - `gx` doesn't ride `review_session` at all: it's gated on `web_target`,
 ///   `Some` in any view with a forge counterpart (a PR/MR review, a branch
 ///   review, a commit view — see [`super::app::App::web_target`]) and `None`
@@ -214,7 +219,6 @@ pub(super) fn binding_hidden(
                 Action::ToggleAccept
                     | Action::AcceptFile
                     | Action::ToggleDefer
-                    | Action::SubmitForgeReview
                     | Action::OpenThread
                     | Action::NextThread
                     | Action::PrevThread
diff --git a/src/ui/history_integration_tests.rs b/src/ui/history_integration_tests.rs
index 9792743..3b404fb 100644
--- a/src/ui/history_integration_tests.rs
+++ b/src/ui/history_integration_tests.rs
@@ -836,7 +836,6 @@ fn commit_view_help_overlay_shows_only_truthful_keys() {
                 | Action::ToggleAccept
                 | Action::AcceptFile
                 | Action::ToggleDefer
-                | Action::SubmitForgeReview
                 | Action::OpenInBrowser
                 | Action::OpenThread
                 | Action::NextThread
diff --git a/src/ui/keymap.rs b/src/ui/keymap.rs
index 778e16b..c7ab946 100644
--- a/src/ui/keymap.rs
+++ b/src/ui/keymap.rs
@@ -217,11 +217,18 @@ pub enum Action {
     /// `gT` in the diff view: moves the cursor to the previous imported
     /// thread's anchor (wrapping).
     PrevThread,
-    /// `U` in the diff view: opens the submit-review modal in a forge PR
-    /// review session (see [`super::app::Mode::SubmitForge`]). A no-op with a
-    /// status hint everywhere else (a plain review session, or no review) —
-    /// nothing is ever sent from the keypress itself; the modal is the safety
-    /// boundary.
+    /// `U` in the diff view: hands off the review. In a forge PR review
+    /// session that opens the submit-review modal (see
+    /// [`super::app::Mode::SubmitForge`]) — nothing is ever *sent* from the
+    /// keypress itself; the modal is the safety boundary. On every other
+    /// target (working tree, staged, commit/range, a local branch review with
+    /// no PR behind it) there is no forge to submit to, so it copies the
+    /// annotations to the clipboard as markdown instead (see
+    /// `super::annotation_export`). Never a dead key.
+    ///
+    /// The config id stays `submit-forge-review` even though the gesture now
+    /// covers both destinations: it is a user-facing `[keys]` name, and
+    /// renaming it would silently break existing config files.
     SubmitForgeReview,
     /// `gx` in the diff view (vim's "open the thing under the cursor in a
     /// browser" gesture): hands the PR/MR under review to the platform's
@@ -776,14 +783,14 @@ impl Keymap {
                     PrevThread,
                     "Jump to previous comment thread",
                 ),
-                // Submit the whole review (comments, replies, verdict) from
-                // the confirm modal — PR review sessions only, a no-op hint
-                // elsewhere. `U` (uppercase, "pUblish/submit") was free in
-                // this scope.
+                // Hand off the review: the whole thing (comments, replies,
+                // verdict) through the confirm modal on a PR, or the
+                // annotations to the clipboard on every other target. `U`
+                // (uppercase, "pUblish/submit") was free in this scope.
                 d(
                     KeySeq::one(Char('U'), none),
                     SubmitForgeReview,
-                    "Submit review to the forge (PR review)",
+                    "Submit review to the forge (PR) / copy annotations (elsewhere)",
                 )
                 .footer(9, "submit"),
                 // Open the PR/MR under review on its forge. `gx` is vim's own
diff --git a/src/ui/mod.rs b/src/ui/mod.rs
index 6e65ba8..5a163af 100644
--- a/src/ui/mod.rs
+++ b/src/ui/mod.rs
@@ -15,6 +15,7 @@
 //! lifecycle — raw mode, alternate screen, panic-safe restoration, and the
 //! blocking event loop — and returns which way the session ended.
 
+mod annotation_export;
 mod annotation_list;
 mod annotation_overlap;
 mod app;