diff --git a/SPRINT.md b/SPRINT.md
index d862204..b7229f3 100644
--- a/SPRINT.md
+++ b/SPRINT.md
@@ -264,12 +264,18 @@ credit; persist one idempotency UUID before redemption. Never expose OAuth
 credentials to runner images, prompts, logs, or repository files.
 
 The proposed trigger is a quiescent run with at least 99% weekly usage, or the
-expiry guard at **2026-10-04T05:17:19.368242Z** after safely stopping work.
+final expiry guard at **2026-10-04T05:17:19.368242Z**. Justin selected a separate
+three-hour safe wind-down margin: request a safe stop of that exact run by
+**2026-10-04T02:32:19.368242Z** if it is still active. Do not redeem at wind-down
+alone when usage is below 99%; wait for the final guard and backend eligibility.
+Require a terminal run receipt and positive absence of its systemd/Docker work.
+The margin reduces expiry risk but cannot guarantee stuck verification settles.
+
 The expiry guard explicitly trades remaining old-window quota for preserving
-the expiring reset. Confirm backend eligibility first; a rejected or ambiguous
-redemption must not select another credit or create a new UUID. Record and
-reconcile the result using the same request ID. Redeem at most one credit;
-never automatically launch a second night or spend the newly reset window.
+the expiring reset. A rejected, ineligible, or ambiguous redemption must not
+select another credit, create a new UUID, or be reported as successful. Record
+and reconcile using the same request ID. Redeem at most one credit; never
+automatically launch a second night or spend the newly reset window.
 
 This policy maximizes useful work, not artificial token burn. Subscription
 throttling, an early finished product, or an unmet backend reset prerequisite