@@ -580,8 +580,9 @@ OpenAPI 3 spec).
      A path inside another path of the same commit gets no copy of its own:
      the item holding it is copied and trashed whole, the inner path is listed
      in `trashed` with it — once the disk no longer shows it — and counted
-     once, and one undo puts both back (or, when the item holding it is not
-     confirmed moved, it is in `unverified` with it; when that item is not
+     once, and one undo puts both back while the Time Capsule holds that copy
+     (or, when the item holding it is not confirmed moved, it is in
+     `unverified` with it; when that item is not
      deleted, it is in `skipped`, saying so; when the Trash reports taking that
      item but the disk still shows the inner path in its place, the inner path
      is in `skipped` with code `NOT_DELETED`, and when its place cannot be
 
@@ -218,7 +218,7 @@ The weights live in **Settings → Reclaim Score** and are yours to change, with
 
 **Preview after** re-lays the treemap out with the staged items taken out and hatches what would come back, under a banner that says nothing has been deleted. The freed space stays on the map rather than the survivors growing into it: area means bytes, and a rectangle that silently became worth more bytes than it was a second ago would make every size comparison against the live map wrong. Exiting restores the map exactly as it was. It is pure arithmetic in the browser — no scan, no server call, nothing on disk.
 
-Committing runs a **dry run first, always**: the exact manifest, every path with its size, and anything that will be **left in place** with the reason. Then the whole batch goes through the **Time Capsule** as one run — copied, verified, and only then trashed — so **Undo this run** puts every file back at its original path, even after you have emptied the Trash, until the Time Capsule removes its copies (after 30 days by default, or sooner to stay under its size cap). Anything too large for the capsule to protect is **left undeleted rather than deleted unprotected**, said in the manifest before you click rather than in a summary afterwards. Undo puts files back byte for byte, **with their permissions and the dates they were last modified and opened** — including a folder's own, restored after its contents so that writing the children back does not re-stamp it. (Not the date each was created: no system lets a program set that back.)
+Committing runs a **dry run first, always**: the exact manifest, every path with its size, and anything that will be **left in place** with the reason. Then the whole batch goes through the **Time Capsule** as one run — copied, verified, and only then trashed — so **Undo this run** puts every file back at its original path, even after you have emptied the Trash, until the Time Capsule removes its copies (after 30 days by default, or sooner to stay under its size cap). Anything too large for the capsule to protect is **left undeleted rather than deleted unprotected**, said in the manifest before you click rather than in a summary afterwards. Undo puts files back byte for byte while the Time Capsule holds their copies, **with their permissions and the dates they were last modified and opened** — including a folder's own, restored after its contents so that writing the children back does not re-stamp it. (Not the date each was created: no system lets a program set that back.)
 
 An optional **cleanup target** in Settings — "free 50 GB" — gives the cart a meter filling toward it. A meter, and nothing else: no streaks, no badges, no confetti. A progress meter is information; a reward loop pointed at deleting your own files is manipulation.
 
 
@@ -64,8 +64,9 @@ import { AsyncMutex } from '../utils/asyncMutex';
  *    policy pointed at the wrong folder cannot empty it overnight.
  *  - **Cooldown** keeps a policy from running again immediately, and doubles as
  *    the schedule — one knob instead of two that can disagree.
- *  - **Undo** puts a whole run back from the Time Capsule, which is why every
- *    run stamps its own id onto the capsule entries it creates.
+ *  - **Undo** puts a whole run back from the Time Capsule, while it holds the
+ *    run's copies — which is why every run stamps its own id onto the capsule
+ *    entries it creates.
  *
  * Every one of these refuses *loudly*: a run that did not delete still writes a
  * run record saying what it would have done and why it stopped.
 
@@ -128,8 +128,8 @@ interface ManifestMember {
   /** Symlinks only: whether what it pointed at was a folder, when that could be seen (FG3f #9). */
   targetIsDir?: boolean;
   /**
-   * Modification and access time, so a restore puts back the file that was
-   * taken rather than a copy of it made today.
+   * Modification and access time, so what a restore puts back is the file
+   * that was taken rather than a copy of it made today.
    *
    * Optional because manifests written before this existed do not carry it,
    * and a restore of one of those must still work — it simply leaves the
 
@@ -938,7 +938,7 @@ test('what the server and the docs tell an agent about the Trash says when the w
   assert.ok(seen >= 6, `the sweep found the server's and the docs' own "recoverable" (${seen})`);
 });
 
-test('no sentence in the docs, in what an agent is told or in a result the server writes offers a way back with no end — "any time", "can be put back", "puts it back", "even after the Trash is emptied" each say until when (review F1.2, F1.8, F2.2, F2.5 of QA third pass D06)', () => {
+test('no sentence in the docs, in what an agent is told or in a result the server writes offers a way back with no end — "any time", "can be put back", "puts it back", "even after the Trash is emptied" each say until when (review F1.2, F1.8, F2.2, F2.5, F3.4 of QA third pass D06)', () => {
   // The sweep above reads only the word "recoverable", so README's "undo
   // from Finder/Explorer any time", SECURITY's "can be put back" and "a run
   // can be undone even after the Trash is emptied", AGENTS' cart undo "even
@@ -958,6 +958,41 @@ test('no sentence in the docs, in what an agent is told or in a result the serve
   const WAY_BACK = /\brecoverabl|\brestor(?:e|ed)\b|\bundo(?:ne)?\b|\bput\b[^.;]*\bback\b|\bcan be recovered\b/i;
   /** Whether, after the phrase at `m` and before its clause ends, the sentence says when that way back ends. */
   const endsLater = (s: string, m: RegExpExecArray) => /^[^;.]*?\b(?:until|while|as long as)\b/i.test(s.slice(m.index + m[0].length));
+  /**
+   * Every "puts … back" in `s` that offers a way back — "puts it back", "puts every file back",
+   * "puts back what was trashed" — and whether it is bounded. Every one is examined (review F3.4:
+   * the rule read four trailing shapes and passed every other), and passes only by saying until
+   * when, or by being one of three shapes that offer no way back, each named here: a condition on
+   * the item's place ("only if its place is empty by then", "once", "there") says how an undo
+   * works, not whether one still can; "before it puts any back" says the order of a restore's
+   * steps; and a "puts back" with no object ("what an undo puts back", "copies an undo puts back
+   * now") names the copies rather than promising them. Keyboard focus is no deleted item.
+   */
+  const putsBackIn = (s: string): Array<{ phrase: string; bounded: boolean }> => {
+    const offers: Array<{ phrase: string; bounded: boolean }> = [];
+    for (const m of s.matchAll(/\bputs((?: (?!back\b)[\w’'`-]+){0,3}) back\b/gi)) {
+      const what = m[1].trim();
+      const before = s.slice(0, m.index);
+      const after = s.slice(m.index! + m[0].length);
+      if (/^focus$/i.test(what)) continue;
+      if (!what && /^\s*(?:$|[,.;:)\]]|(?:now|is|are)\b)/i.test(after)) continue;
+      const bounded = /^[^;.]*?\b(?:until|while|as long as)\b/i.test(after)
+        || /^[^;.]*?\b(?:only if|once|there)\b/i.test(after)
+        || /\bbefore (?:it|an undo|a restore|the undo|the restore) $/i.test(before);
+      offers.push({ phrase: m[0], bounded });
+    }
+    return offers;
+  };
+  // The rule itself, on the shapes the review found it blind to: each is a way back with no end.
+  for (const s of ['Undo puts it back, whenever you ask.', 'Undo puts it back from the Time Capsule.', 'Undo puts it back where it was.',
+    'The undo puts back what was trashed.', 'A run is undone with a click and puts back every file it trashed.', 'Undo puts every file back.']) {
+    assert.deepEqual(putsBackIn(s).map((o) => o.bounded), [false], `the rule reads "${s}" as a way back with no end`);
+  }
+  // And the shapes that say until when, or how, are let through.
+  for (const s of ['Undo puts it back until the Time Capsule removes its copies.', 'An undo puts it back only if its place is empty by then.',
+    'An undo puts each back once its place is empty.', 'An undo puts it back, and looks for it, there.']) {
+    assert.deepEqual(putsBackIn(s).map((o) => o.bounded), [true], `the rule lets "${s}" through`);
+  }
   const seen = { wayBack: 0, pastEmptied: 0, canBe: 0, putsBack: 0 };
   for (const [file, text] of agentTexts(RESULT_SOURCES)) {
     for (const s of sentencesOf(file, text)) {
@@ -976,16 +1011,12 @@ test('no sentence in the docs, in what an agent is told or in a result the serve
         seen.canBe++;
         assert.ok(endsLater(s, can), `${file}: "${can[0]}" with no end — "${s}"`);
       }
-      // An undo that "puts it back" with nothing after it is a promise that it still can — or one
-      // that says until when. One qualified by a condition ("only if its place is empty by then",
-      // "once", "there") says how an undo works, not whether one still can, and is not this rule's.
-      const puts = /\bputs (?:it|them|everything) back(?=\s*(?:[.;'"`)]|$|\b(?:until|while|as long as)\b))|\bputs back (?:exactly what|everything)\b/i.exec(s);
-      if (puts) {
+      for (const offer of putsBackIn(s)) {
         seen.putsBack++;
-        assert.ok(endsLater(s, puts), `${file}: "${puts[0]}" with no end — "${s}"`);
+        assert.ok(offer.bounded, `${file}: "${offer.phrase}" with no end — "${s}"`);
       }
     }
   }
   // Each rule read the sentences it is about: a split that merged or lost them would pass by seeing nothing.
-  assert.ok(seen.wayBack >= 100 && seen.pastEmptied >= 5 && seen.canBe >= 8 && seen.putsBack >= 3, `the sweep read the docs' ways back: ${JSON.stringify(seen)}`);
+  assert.ok(seen.wayBack >= 100 && seen.pastEmptied >= 5 && seen.canBe >= 8 && seen.putsBack >= 19, `the sweep read the docs' ways back: ${JSON.stringify(seen)}`);
 });