@tablation/crew 0.10.2 → 0.12.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { resolve as resolve4, dirname as dirname9, join as join19, basename as basename7 } from "path";
+import { resolve as resolve4, dirname as dirname10, join as join19, basename as basename7 } from "path";
 import { fileURLToPath } from "url";
 import { hostname as hostname2, homedir as homedir5 } from "os";
 import { spawnSync as spawnSync3 } from "child_process";
@@ -1682,7 +1682,8 @@ var DEFAULT_CONTRACT = {
     reportType: "report_type",
     epic: "epic_id",
     author: "filed_by_id",
-    ship: "ship_id"
+    ship: "ship_id",
+    heldBy: "held_by_ship_id"
   },
   comments: {
     parent: "ticket_id",
@@ -2971,6 +2972,20 @@ var Tracker = class {
       ...auth.commentShip && auth.shipId ? { [this.contract.comments.ship]: auth.shipId } : {}
     });
   }
+  /**
+   * Ship affinity for a claim (CREW-1386): stamp this ship's Ships row on the
+   * ticket in the claim's own write, in the `held_by_ship_id` column (not
+   * `ship_id`, which means "filed from"). `undefined` — claim exactly as
+   * before — when the Issues table has no hold column or this ship has no row.
+   */
+  async claimAffinity() {
+    const auth = await this.authorshipProbe();
+    if (!auth.issueHeld || !auth.shipId) return void 0;
+    return {
+      column: this.contract.columns.heldBy,
+      shipId: auth.shipId
+    };
+  }
   /**
    * The authorship probe (CREW-1371), read once per process: which optional
    * `filed_by_id`/`ship_id` columns exist on Issues and Comments, and this
@@ -2992,6 +3007,7 @@ var Tracker = class {
     return {
       issueAuthor: issueFields.has(this.contract.columns.author),
       issueShip: issueFields.has(this.contract.columns.ship),
+      issueHeld: issueFields.has(this.contract.columns.heldBy),
       commentShip: commentFields.has(this.contract.comments.ship),
       shipId: shipRow?.id ?? null
     };
@@ -3013,6 +3029,7 @@ var Tracker = class {
     const missing = [];
     if (!auth.issueAuthor) missing.push(`Issues.${this.contract.columns.author}`);
     if (!auth.issueShip) missing.push(`Issues.${this.contract.columns.ship}`);
+    if (!auth.issueHeld) missing.push(`Issues.${this.contract.columns.heldBy}`);
     if (!auth.commentShip) missing.push(`Comments.${this.contract.comments.ship}`);
     return missing;
   }
@@ -3333,6 +3350,60 @@ function agedRankScalar(rawRank, aging, now) {
   return Math.round(rawRank * (1 - fraction));
 }
 
+// src/ship-affinity.ts
+var CYCLE_SECONDS = 120;
+var SHIP_DEAD_AFTER_CYCLES = 10;
+function shipIsAlive(ship, now) {
+  if (!ship?.last_seen) return false;
+  const seen = Date.parse(ship.last_seen);
+  return Number.isFinite(seen) && now - seen <= SHIP_DEAD_AFTER_CYCLES * CYCLE_SECONDS * 1e3;
+}
+function ticketHolderShipId(t, contract) {
+  const v = t[contract.columns.heldBy];
+  return typeof v === "string" && v ? v : null;
+}
+function heldByOtherShip(t, a) {
+  if (!a.myShipId) return false;
+  const statuses = a.contract.statuses;
+  if ([statuses.handoff, statuses.verifying].includes(t.status)) return false;
+  const holder = ticketHolderShipId(t, a.contract);
+  if (!holder || holder === a.myShipId) return false;
+  const owner = a.ships.find((s) => s.id === holder);
+  return shipIsAlive(owner, a.now ?? Date.now());
+}
+function shipIdByName(ships, name) {
+  const mine = ships.filter((r) => (r.name ?? "").trim() === name.trim());
+  return mine.length === 1 ? mine[0].id : null;
+}
+async function noteReaccepted(tracker, result, seat, shipLabel) {
+  if (!result.reaccepted || !result.ticket) return;
+  try {
+    await tracker.postEvent(
+      result.ticket.id,
+      `Re-accepted while held by ${shipLabel}; resuming there, not re-claiming. Setting a held ticket back to \`accepted\` is not needed \u2014 to move it to another ship, clear \`held_by_ship_id\`.`,
+      seat
+    );
+  } catch {
+  }
+}
+function planHoldReleases(tickets, contract) {
+  const ends = [contract.statuses.handoff, contract.statuses.verified];
+  return tickets.filter((t) => ends.includes(t.status) && ticketHolderShipId(t, contract) !== null);
+}
+async function applyHoldReleases(writer, tickets, contract, emit) {
+  let cleared = 0;
+  for (const t of tickets) {
+    try {
+      await writer.updateTicket(t.id, { [contract.columns.heldBy]: null }, t.updated_at);
+      cleared++;
+      emit.emit(`released ship hold (${t.status})`, { ticket: t.issue_id, step: "sweep" });
+    } catch (e) {
+      emit.warn(`could not release ship hold: ${e.message}`, { ticket: t.issue_id, step: "sweep" });
+    }
+  }
+  return cleared;
+}
+
 // src/select.ts
 var qaSlice = (tickets) => tickets.filter((t) => t.status === "fixed" || t.status === "qa");
 var buildingSlice = (tickets, role) => tickets.filter((t) => role === "design" ? t.needs_design === true : t.needs_design !== true);
@@ -3344,10 +3415,23 @@ function sliceFor(tickets, role) {
   return buildingSlice(tickets, role);
 }
 var isHeld = (t, holds2) => !!t.assignee_id && holds2.has(t.assignee_id);
+function affinityContext(i) {
+  return i.ships ? { myShipId: i.ships.myShipId, ships: i.ships.rows, contract: i.contract ?? DEFAULT_CONTRACT, now: i.ships.now } : null;
+}
+function withHoldCheck(affinity, i) {
+  if (!affinity) return void 0;
+  const a = affinityContext(i);
+  return a ? { ...affinity, isHeldElsewhere: (t) => heldByOtherShip(t, a) } : affinity;
+}
+function notHeldByOtherShip(slice, i) {
+  if (!i.ships) return slice;
+  const a = { myShipId: i.ships.myShipId, ships: i.ships.rows, contract: i.contract ?? DEFAULT_CONTRACT, now: i.ships.now };
+  return slice.filter((t) => !heldByOtherShip(t, a));
+}
 function buildingRoleHasWork(role, i) {
   const me = i.seats[role];
   if (!me) return { hasWork: false, reason: "this ship does not crew that role" };
-  const mine = sliceFor(i.tickets, role);
+  const mine = notHeldByOtherShip(sliceFor(i.tickets, role), i);
   const startable = mine.filter(
     (t) => (t.status === "accepted" || t.status === "blocked") && !i.blocked.has(t.id) && !isHeld(t, i.holds)
   );
@@ -3397,7 +3481,7 @@ function roleCandidates(role, i) {
   if (role === "pair") return [];
   const me = i.seats[role];
   if (!me) return [];
-  return sliceFor(i.tickets, role).filter(
+  return notHeldByOtherShip(sliceFor(i.tickets, role), i).filter(
     (t) => ((t.status === "accepted" || t.status === "blocked") && !i.blocked.has(t.id) || t.status === "in_progress" && (t.assignee_id === me || !t.assignee_id)) && !isHeld(t, i.holds)
   );
 }
@@ -3991,16 +4075,20 @@ function refreshBaseBranch(cwd, remote, base, dryRun = false) {
   const [behindStr, aheadStr] = counts.split(/\s+/);
   const behind = Number.parseInt(behindStr ?? "0", 10);
   const ahead = Number.parseInt(aheadStr ?? "0", 10);
+  const named = () => {
+    const subjects = (gitOk(cwd, ["log", "--format=%h %s", "-5", `${upstream}..${base}`]) ?? "").split("\n").filter(Boolean);
+    return subjects.length ? `: ${subjects.join("; ")}${ahead > subjects.length ? "; \u2026" : ""}` : "";
+  };
   if (ahead > 0 && behind > 0) {
     return {
       action: "diverged",
       ahead,
       behind,
-      detail: `${base} has diverged from ${upstream} (${ahead} ahead, ${behind} behind)`
+      detail: `${base} has diverged from ${upstream} (${ahead} ahead, ${behind} behind)${named()}`
     };
   }
   if (behind === 0 && ahead > 0) {
-    return { action: "ahead", ahead, detail: `${base} has ${ahead} commit(s) ${upstream} does not` };
+    return { action: "ahead", ahead, detail: `${base} has ${ahead} commit(s) ${upstream} does not${named()}` };
   }
   if (behind === 0) return { action: "level", detail: `${base} is level with ${upstream}` };
   if (dryRun) {
@@ -4015,8 +4103,22 @@ function refreshBaseBranch(cwd, remote, base, dryRun = false) {
     detail: `fast-forwarded ${base} to ${upstream} (${behind} commit(s) from elsewhere)`
   };
 }
-function pushBranch(cwd, remote, branch) {
-  git(cwd, ["push", remote, branch]);
+function recoverStrandedReleaseCheckouts(cwd) {
+  gitOk(cwd, ["worktree", "prune"]);
+  const out = gitOk(cwd, ["worktree", "list", "--porcelain"]) ?? "";
+  let path = "";
+  for (const line of out.split("\n")) {
+    if (line.startsWith("worktree ")) path = line.slice("worktree ".length);
+    else if (line.startsWith("branch refs/heads/crew/release-") && path) {
+      gitOk(cwd, ["worktree", "remove", "--force", path]);
+    }
+  }
+  const stranded = (gitOk(cwd, ["for-each-ref", "--format=%(refname:short)", "refs/heads/crew/release-*"]) ?? "").split("\n").filter(Boolean);
+  for (const b of stranded) gitOk(cwd, ["branch", "-q", "-D", b]);
+  return stranded;
+}
+function pushBranch(cwd, remote, branch, dst = branch) {
+  git(cwd, ["push", remote, `${branch}:${dst}`]);
 }
 function worktrees(cwd) {
   const out = gitOk(cwd, ["worktree", "list", "--porcelain"]) ?? "";
@@ -4202,6 +4304,7 @@ async function decideCycle(o) {
     emit.warn(`ticket(s) blocking themselves, parked permanently: ${diag.selfBlocked.join(", ")}`);
   }
   const sweep = planSweep(tickets, info, blocked);
+  const holdReleases = planHoldReleases(tickets, tracker.contract);
   const blockedIssues = tickets.filter((t) => blocked.has(t.id)).map((t) => t.issue_id);
   emit.emit(`${blockedIssues.length} ticket(s) parked as blocked`, { data: { blocked: blockedIssues } });
   const qaHeld = tickets.filter((t) => t.status === tracker.contract.statuses.verifying).map((t) => t.issue_id);
@@ -4269,7 +4372,8 @@ async function decideCycle(o) {
     holds: holds2,
     seats: route.resolved.seats,
     paused: state.pausedRoles(["dev", "design", "qa"]),
-    contract: tracker.contract
+    contract: tracker.contract,
+    ships: { myShipId: shipIdByName(ships, ship.name), rows: ships }
   };
   const selection = selectRole(selectionInput);
   const actionable = actionableSummary(selectionInput, selection.pending);
@@ -4282,6 +4386,7 @@ async function decideCycle(o) {
     info,
     sweep,
     epicSync,
+    holdReleases,
     stranded,
     selection,
     actionable,
@@ -4382,22 +4487,62 @@ function rosterFor(d, route, role) {
 
 // src/claim.ts
 import { StaleWriteError as StaleWriteError4 } from "@tablation/client";
-async function resolveTopCandidate(tracker, candidates, seat, approvedStatus, buildingStatus, isServable) {
+async function stampResumption(tracker, t, affinity) {
+  let current = t;
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      const stamped = await tracker.updateTicket(current.id, { [affinity.column]: affinity.shipId }, current.updated_at);
+      return { outcome: "stamped", ticket: { ...current, ...stamped } };
+    } catch (e) {
+      if (!(e instanceof StaleWriteError4)) throw e;
+    }
+    if (!tracker.ticket) return { outcome: "unknown" };
+    try {
+      current = await tracker.ticket(t.id);
+    } catch {
+      return { outcome: "unknown" };
+    }
+    if (affinity.isHeldElsewhere?.(current)) return { outcome: "held" };
+    if (current[affinity.column] === affinity.shipId) return { outcome: "stamped", ticket: current };
+  }
+  return { outcome: "unknown" };
+}
+async function resolveTopCandidate(tracker, candidates, seat, approvedStatus, buildingStatus, isServable, affinity) {
   const contended = [];
   const unservable = [];
+  const held = [];
   for (const t of candidates) {
+    if (affinity?.isHeldElsewhere?.(t)) {
+      held.push(t.issue_id);
+      continue;
+    }
     if (isServable && !isServable(t)) {
       unservable.push(t.issue_id);
       continue;
     }
-    if (t.status !== approvedStatus) return { ticket: t, claimed: false, contended, unservable };
+    if (t.status !== approvedStatus) {
+      if (affinity && t[affinity.column] !== affinity.shipId) {
+        const stamp = await stampResumption(tracker, t, affinity);
+        if (stamp.outcome === "stamped") {
+          return { ticket: stamp.ticket, claimed: false, contended, unservable, held, reaccepted: false };
+        }
+        (stamp.outcome === "held" ? held : contended).push(t.issue_id);
+        continue;
+      }
+      return { ticket: t, claimed: false, contended, unservable, held, reaccepted: false };
+    }
     try {
       const claimed = await tracker.updateTicket(
         t.id,
-        { status: buildingStatus, assignee_id: seat },
+        {
+          status: buildingStatus,
+          assignee_id: seat,
+          ...affinity ? { [affinity.column]: affinity.shipId } : {}
+        },
         t.updated_at
       );
-      return { ticket: { ...t, ...claimed }, claimed: true, contended, unservable };
+      const reaccepted = !!affinity && t[affinity.column] === affinity.shipId;
+      return { ticket: { ...t, ...claimed }, claimed: true, contended, unservable, held, reaccepted };
     } catch (e) {
       if (e instanceof StaleWriteError4) {
         contended.push(t.issue_id);
@@ -4406,7 +4551,7 @@ async function resolveTopCandidate(tracker, candidates, seat, approvedStatus, bu
       throw e;
     }
   }
-  return { ticket: null, claimed: false, contended, unservable };
+  return { ticket: null, claimed: false, contended, unservable, held, reaccepted: false };
 }
 
 // src/conflict.ts
@@ -5453,8 +5598,9 @@ Wrote ${o.configPath}.
 }
 
 // src/release-run.ts
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync6, existsSync as existsSync9 } from "fs";
-import { join as join9 } from "path";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync6, existsSync as existsSync9, copyFileSync, mkdirSync as mkdirSync7, mkdtempSync, rmSync as rmSync2 } from "fs";
+import { dirname as dirname7, join as join9 } from "path";
+import { tmpdir as tmpdir2 } from "os";
 
 // src/release.ts
 function describeUnplaceable(unplaceable, verifiedStatus) {
@@ -6029,6 +6175,31 @@ async function confirmLastRelease(o, decision) {
   if (!confirmed) o.emit.warn(`${decision.lastTag} is still not confirmed live \u2014 tickets stay verified`);
   return { confirmed, version };
 }
+function openReleaseCheckout(o) {
+  const { remote, base } = o.repo.branch;
+  const branch = `crew/release-${Date.now()}`;
+  const root = mkdtempSync(join9(tmpdir2(), "crew-release-"));
+  const dir = join9(root, "checkout");
+  const close = () => {
+    gitOk(o.cwd, ["worktree", "remove", "--force", dir]);
+    rmSync2(root, { recursive: true, force: true });
+    gitOk(o.cwd, ["worktree", "prune"]);
+    gitOk(o.cwd, ["branch", "-D", branch]);
+  };
+  try {
+    git(o.cwd, ["worktree", "add", "-q", "-b", branch, dir, `${remote}/${base}`]);
+  } catch (e) {
+    close();
+    throw e;
+  }
+  for (const f of o.repo.worktrees.copy) {
+    const src = join9(o.cwd, f);
+    if (!existsSync9(src)) continue;
+    mkdirSync7(dirname7(join9(dir, f)), { recursive: true });
+    copyFileSync(src, join9(dir, f));
+  }
+  return { dir, branch, close };
+}
 async function runRelease(o) {
   const scoped = (msg) => o.scope ? `${o.scope}: ${msg}` : msg;
   const tagPattern = o.repo.release.tagPattern ?? "v*";
@@ -6075,6 +6246,33 @@ async function runRelease(o) {
     const externalClosures = await confirmExternalReleased(o, landed);
     return { merged: [], deployed: false, stopped: "external", decision, externalClosures };
   }
+  const { remote, base } = o.repo.branch;
+  if (o.dryRun || o.mergeOnly || !remoteBranchExists(o.cwd, remote, base)) {
+    return mergeAndRelease(o, decision, fresh);
+  }
+  let checkout;
+  const stranded = recoverStrandedReleaseCheckouts(o.cwd);
+  if (stranded.length > 0) o.emit.warn(scoped(`dropped release checkout(s) stranded by a crash: ${stranded.join(", ")}`));
+  try {
+    checkout = openReleaseCheckout(o);
+  } catch (e) {
+    o.emit.error(scoped(`could not cut a release checkout from ${remote}/${base} \u2014 ${e.message}`));
+    return { merged: [], deployed: false, stopped: "release checkout failed", decision };
+  }
+  try {
+    return await mergeAndRelease({ ...o, cwd: checkout.dir }, decision, fresh, checkout.branch);
+  } finally {
+    checkout.close();
+    const refreshed = refreshBaseBranch(o.cwd, remote, base);
+    if (refreshed.action === "fast-forwarded" && o.repo.hooks.build) {
+      const r = await hook(o, "build");
+      if (r && r.code !== 0) {
+        o.emit.warn(scoped(`rebuilding the primary checkout after the release failed (exit ${r.code}) \u2014 its dist/ is stale until \`${o.repo.hooks.build}\` is run there`));
+      }
+    }
+  }
+}
+async function mergeAndRelease(o, decision, fresh, releaseBranch) {
   o.emit.enter("merge");
   const merged = [];
   const conflicts = [];
@@ -6236,6 +6434,16 @@ async function runRelease(o) {
       }
     }
   }
+  if (releaseBranch && !o.dryRun) {
+    const { remote, base } = o.repo.branch;
+    if (fetchRemote(o.cwd, remote) && remoteBranchExists(o.cwd, remote, base)) {
+      const moved = resolve2(o.cwd, `${remote}/${base}`);
+      if (moved && !isAncestor(o.cwd, moved, "HEAD")) {
+        o.emit.warn(`${remote}/${base} moved during the release \u2014 discarding it; the tickets stay verified and the next cycle retries`);
+        return { merged, conflicts, unbuildable, version, deployed: false, decision, stopped: "base branch moved during release" };
+      }
+    }
+  }
   let deployed = false;
   let integrated = false;
   if (o.repo.release.mode === "integrate") {
@@ -6265,7 +6473,7 @@ async function runRelease(o) {
       o.emit.emit(`would push ${o.repo.branch.base} to ${o.repo.branch.remote}`);
     } else {
       try {
-        pushBranch(o.cwd, o.repo.branch.remote, o.repo.branch.base);
+        pushBranch(o.cwd, o.repo.branch.remote, releaseBranch ?? o.repo.branch.base, o.repo.branch.base);
         o.emit.emit(`pushed ${o.repo.branch.base} to ${o.repo.branch.remote}`);
       } catch (e) {
         o.emit.error(
@@ -8020,7 +8228,7 @@ function applyRemoteBranchCleanup(cwd, remote, branches2, dryRun, log) {
 }
 
 // src/stream-sweep.ts
-import { existsSync as existsSync15, readdirSync as readdirSync3, rmSync as rmSync2, statSync as statSync6 } from "fs";
+import { existsSync as existsSync15, readdirSync as readdirSync3, rmSync as rmSync3, statSync as statSync6 } from "fs";
 import { join as join14 } from "path";
 var DAY_MS = 24 * 60 * 60 * 1e3;
 function planStreamSweep(stateDir, retentionDays, now = Date.now()) {
@@ -8043,7 +8251,7 @@ function applyStreamSweep(paths, dryRun, log) {
       continue;
     }
     try {
-      rmSync2(path, { force: true });
+      rmSync3(path, { force: true });
       removed++;
       log.emit(`removed stream artifact ${path}`, { step: "worktree" });
     } catch (e) {
@@ -8054,14 +8262,14 @@ function applyStreamSweep(paths, dryRun, log) {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync14, existsSync as existsSync19, mkdirSync as mkdirSync10, writeFileSync as writeFileSync9, unlinkSync as unlinkSync5, copyFileSync, renameSync } from "fs";
+import { readFileSync as readFileSync14, existsSync as existsSync19, mkdirSync as mkdirSync11, writeFileSync as writeFileSync9, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync } from "fs";
 import { createInterface } from "readline/promises";
 import { dirname as dirOf, resolve as resolvePath } from "path";
 
 // src/ssh-keys.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { existsSync as existsSync16, mkdirSync as mkdirSync7, readFileSync as readFileSync11, chmodSync } from "fs";
-import { dirname as dirname8, join as join15 } from "path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync8, readFileSync as readFileSync11, chmodSync } from "fs";
+import { dirname as dirname9, join as join15 } from "path";
 var SshKeyError = class extends Error {
 };
 function shipSshKeyPathFor(stateDir) {
@@ -8071,7 +8279,7 @@ function ensureShipSshKeypair(stateDir) {
   const privateKeyPath = shipSshKeyPathFor(stateDir);
   const publicKeyPath = `${privateKeyPath}.pub`;
   if (!existsSync16(privateKeyPath)) {
-    mkdirSync7(dirname8(privateKeyPath), { recursive: true });
+    mkdirSync8(dirname9(privateKeyPath), { recursive: true });
     try {
       execFileSync3("ssh-keygen", [
         "-t",
@@ -8308,7 +8516,7 @@ function syncAllPassengerCheckouts(cfg) {
 
 // src/tunnel.ts
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync17, mkdirSync as mkdirSync8, readFileSync as readFileSync12, writeFileSync as writeFileSync7, unlinkSync as unlinkSync3, readdirSync as readdirSync4 } from "fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync9, readFileSync as readFileSync12, writeFileSync as writeFileSync7, unlinkSync as unlinkSync3, readdirSync as readdirSync4 } from "fs";
 import { randomInt } from "crypto";
 import { join as join16 } from "path";
 var DEFAULT_SPAWN_OPTIONS = { stdio: "ignore", detached: true };
@@ -8390,7 +8598,7 @@ function readPersistedTunnel(stateDir, workspaceId) {
 }
 function writePersistedTunnel(stateDir, state) {
   const path = tunnelStatePath(stateDir, state.workspaceId);
-  mkdirSync8(join16(stateDir, "passengers"), { recursive: true });
+  mkdirSync9(join16(stateDir, "passengers"), { recursive: true });
   writeFileSync7(path, `${JSON.stringify(state, null, 2)}
 `);
 }
@@ -8610,7 +8818,7 @@ async function unregisterEndpoint(workspaceId, info, d) {
 import { createServer as createHttpServer } from "http";
 import { spawn as spawn4 } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync18, mkdirSync as mkdirSync9, readFileSync as readFileSync13, writeFileSync as writeFileSync8, unlinkSync as unlinkSync4, readdirSync as readdirSync5 } from "fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync10, readFileSync as readFileSync13, writeFileSync as writeFileSync8, unlinkSync as unlinkSync4, readdirSync as readdirSync5 } from "fs";
 import { join as join17 } from "path";
 
 // src/secret-compare.ts
@@ -8713,7 +8921,7 @@ function readPersistedSyncDaemon(stateDir, workspaceId) {
 }
 function writePersistedSyncDaemon(stateDir, state) {
   const path = syncDaemonStatePath(stateDir, state.workspaceId);
-  mkdirSync9(join17(stateDir, "passengers"), { recursive: true });
+  mkdirSync10(join17(stateDir, "passengers"), { recursive: true });
   writeFileSync8(path, `${JSON.stringify(state, null, 2)}
 `);
 }
@@ -8895,6 +9103,10 @@ async function runOnePass(o) {
       emit.warn(`could not sweep: ${e.message}`, { step: "sweep" });
     }
   }
+  if (decision.holdReleases?.length) {
+    const tracker = new Tracker(o.route, o.ship);
+    await applyHoldReleases(tracker, decision.holdReleases, tracker.contract, emit);
+  }
   const order = [...decision.selection.pending].sort(
     (a, b) => (decision.selection.ranks[a] ?? Number.POSITIVE_INFINITY) - (decision.selection.ranks[b] ?? Number.POSITIVE_INFINITY)
   );
@@ -8971,7 +9183,8 @@ async function runRoleAgent(role, decision, ctx) {
         seat,
         contract.statuses.approved,
         contract.statuses.building,
-        (t) => dirForRepo(route, t.repo_id) !== null
+        (t) => dirForRepo(route, t.repo_id) !== null,
+        withHoldCheck(await tracker.claimAffinity(), decision.selectionInput)
       );
       if (result.contended.length) {
         emit.emit(`claim contended for ${result.contended.join(", ")} \u2014 moved to the next candidate`, {
@@ -8985,6 +9198,10 @@ async function runRoleAgent(role, decision, ctx) {
           role
         });
       }
+      if (result.held.length) {
+        emit.emit(`skipped ${result.held.join(", ")} \u2014 held by another live ship`, { step: "select", role });
+      }
+      await noteReaccepted(tracker, result, seat, ship.name);
       if (!result.ticket) {
         emit.emit(`${role} skipped this cycle \u2014 every candidate was already claimed elsewhere`);
         return;
@@ -9077,14 +9294,14 @@ async function buildEnvironment(route, ship, ticket) {
 }
 
 // src/cli.ts
-var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname9(process.execPath) : resolve4(dirname9(fileURLToPath(import.meta.url)), "..");
+var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname10(process.execPath) : resolve4(dirname10(fileURLToPath(import.meta.url)), "..");
 var RELEASE_LOCK_TTL_MS = 20 * 60 * 1e3;
-var CYCLE_SECONDS = 120;
+var CYCLE_SECONDS2 = 120;
 var STALE_CYCLES = 3;
 function renderShipLine(s, issueLabelById) {
   const name = s.name ?? "(unnamed)";
   if (!s.last_seen) return `${name.padEnd(20)} never seen`;
-  const staleAfterMs = STALE_CYCLES * CYCLE_SECONDS * 1e3;
+  const staleAfterMs = STALE_CYCLES * CYCLE_SECONDS2 * 1e3;
   const ageMs = Date.now() - Date.parse(s.last_seen);
   if (ageMs > staleAfterMs) {
     return `${name.padEnd(20)} not seen recently \u2014 last seen ${since(s.last_seen)} ago`;
@@ -9931,6 +10148,11 @@ ${changed2.map((c) => `  - ${c}
           const tracker = new Tracker(e.route, cfg.ship);
           await applyEpicSync(tracker, e.decision.epicSync, tracker.contract, remit);
         }
+        for (const e of fleet.entries) {
+          if (dryRun || e.error || !e.decision?.holdReleases?.length) continue;
+          const tracker = new Tracker(e.route, cfg.ship);
+          await applyHoldReleases(tracker, e.decision.holdReleases, tracker.contract, emit.forRoute(e.route.route));
+        }
         for (const e of fleet.entries) {
           if (e.error || !e.decision || !e.decision.sweep.length) continue;
           const remit = emit.forRoute(e.route.route);
@@ -10022,7 +10244,8 @@ ${changed2.map((c) => `  - ${c}
               seat,
               contract.statuses.approved,
               contract.statuses.building,
-              (t) => dirForRepo(w.route, t.repo_id) !== null
+              (t) => dirForRepo(w.route, t.repo_id) !== null,
+              withHoldCheck(await fleetTracker.claimAffinity(), w.decision.selectionInput)
             );
             if (result.contended.length) {
               wemit.emit(`claim contended for ${result.contended.join(", ")} \u2014 moved to the next candidate`, {
@@ -10036,6 +10259,10 @@ ${changed2.map((c) => `  - ${c}
                 { step: "select", role: w.role }
               );
             }
+            if (result.held.length) {
+              wemit.emit(`skipped ${result.held.join(", ")} \u2014 held by another live ship`, { step: "select", role: w.role });
+            }
+            await noteReaccepted(fleetTracker, result, seat, cfg.ship.name);
             if (!result.ticket) {
               wemit.emit(`${w.role} skipped this cycle \u2014 every candidate was already claimed elsewhere`);
               if (!skipInlineRelease) await releaseFleet();
@@ -10146,6 +10373,10 @@ ${changed2.map((c) => `  - ${c}
           await applyEpicSync(tracker, decision.epicSync, tracker.contract, emit);
         }
       }
+      if (!dryRun && decision.holdReleases?.length) {
+        const tracker = new Tracker(route, cfg.ship);
+        await applyHoldReleases(tracker, decision.holdReleases, tracker.contract, emit);
+      }
       const role = value("role") ?? decision.selection.selected;
       if (command === "poll") break;
       if (!dryRun) {
@@ -10194,7 +10425,8 @@ ${changed2.map((c) => `  - ${c}
               seat,
               contract.statuses.approved,
               contract.statuses.building,
-              (t) => dirForRepo(route, t.repo_id) !== null
+              (t) => dirForRepo(route, t.repo_id) !== null,
+              withHoldCheck(await tracker2.claimAffinity(), decision.selectionInput)
             );
             if (result.contended.length) {
               emit.emit(`claim contended for ${result.contended.join(", ")} \u2014 moved to the next candidate`, {
@@ -10208,6 +10440,10 @@ ${changed2.map((c) => `  - ${c}
                 { step: "select", role: current }
               );
             }
+            if (result.held.length) {
+              emit.emit(`skipped ${result.held.join(", ")} \u2014 held by another live ship`, { step: "select", role: current });
+            }
+            await noteReaccepted(tracker2, result, seat, cfg.ship.name);
             if (!result.ticket) {
               emit.emit(`${current} skipped this cycle \u2014 every candidate was already claimed elsewhere`);
               dropLock();
@@ -10529,7 +10765,7 @@ ${changed2.map((c) => `  - ${c}
         const raw = existsSync19(resolvedPath) ? JSON.parse(readFileSync14(resolvedPath, "utf8")) : {};
         raw.agentPersonas = personaResult.agentPersonas;
         raw.agentSkills = skillResult.agentSkills;
-        mkdirSync10(dirOf(resolvedPath), { recursive: true });
+        mkdirSync11(dirOf(resolvedPath), { recursive: true });
         writeFileSync9(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
       }
@@ -10577,7 +10813,7 @@ ${changed2.map((c) => `  - ${c}
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
         const raw = existsSync19(resolvedPath) ? JSON.parse(readFileSync14(resolvedPath, "utf8")) : {};
         raw.agentSkills = result.agentSkills;
-        mkdirSync10(dirOf(resolvedPath), { recursive: true });
+        mkdirSync11(dirOf(resolvedPath), { recursive: true });
         writeFileSync9(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
       }
@@ -10621,7 +10857,7 @@ ${changed2.map((c) => `  - ${c}
       }
       const originOf = (dir) => gitOk(dir, ["remote", "get-url", "origin"]) ?? void 0;
       const text = configText;
-      const base = dirname9(cfg.configFile);
+      const base = dirname10(cfg.configFile);
       try {
         if (sub === "list") {
           const repos = configuredRepos(text, routeName, base);
@@ -10982,8 +11218,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           process.stderr.write(`(dry run) would write resolved ids to ${resolvedPath}
 `);
         } else {
-          mkdirSync10(dirname9(resolvedPath), { recursive: true });
-          if (hadPreviousFile) copyFileSync(resolvedPath, `${resolvedPath}.bak`);
+          mkdirSync11(dirname10(resolvedPath), { recursive: true });
+          if (hadPreviousFile) copyFileSync2(resolvedPath, `${resolvedPath}.bak`);
           const tmpPath = `${resolvedPath}.tmp${process.pid}`;
           writeFileSync9(tmpPath, `${JSON.stringify(resolved, null, 2)}
 `);
@@ -10999,7 +11235,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
             process.stderr.write(`(dry run) would write the minted API key to ${apiKeyFile}
 `);
           } else {
-            mkdirSync10(dirname9(apiKeyFile), { recursive: true });
+            mkdirSync11(dirname10(apiKeyFile), { recursive: true });
             writeFileSync9(apiKeyFile, `${apiKeyVar}=${apiKey}
 `, { mode: 384 });
             process.stderr.write(`API key written to ${apiKeyFile}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tablation/crew",
-  "version": "0.10.2",
+  "version": "0.12.0",
   "description": "A standing team of headless agents that picks work off a Tablation board, does it on a machine you control, and reports back.",
   "type": "module",
   "license": "MIT",

package/prompts/default/personas/common.md

@@ -198,7 +198,7 @@ since your last comment: an answer to a question, new direction, or a
   the remote has moved), stop: comment on the ticket with what it printed and
   set `needs_info`; do not merge or rebase it yourself.
 - A ticket QA has bounced back to you comes in as `in_progress`,
-  reassigned to your row, with a comment saying what still fails. Treat
+  reassigned to your row (or unassigned, when your ship holds it), with a comment saying what still fails. Treat
   that exactly like new direction from a hold: read the comment, fix what
   it names, and take it back to `fixed` when it's genuinely right. QA
   bouncing a ticket is the system working, not an accusation.
@@ -353,9 +353,12 @@ if `report_type` is either of those.
    reconcile it yourself. Post a comment on the ticket naming the repo and the
    counts `crew sync` printed, leave the ticket as you found it, and end the
    run — the operator reconciles the checkout. Otherwise, from
-   the primary checkout, `git worktree add` a sibling worktree for this
-   ticket, on a new branch cut from the base branch's current HEAD. The
-   digest's `worktree` and `branch` columns give this ticket's own directory
+   the primary checkout, `git worktree add <dir> -b <branch> <remote>/<base>`
+   a sibling worktree for this ticket, on a new branch cut from the base
+   branch's REMOTE-TRACKING ref (`origin/main`, say), never from the primary
+   checkout's own local base — that copy is a cache of the remote, and a
+   local commit on it would be carried into every ticket cut from it
+   (CREW-1383). The digest's `worktree` and `branch` columns give this ticket's own directory
    and branch name — use them verbatim. The Environment section names the
    base branch and describes the general pattern, but its own worked example
    is illustrative only (rendered before any ticket is chosen, so it cannot
@@ -529,6 +532,10 @@ if `report_type` is either of those.
    part).
 9. Set the ticket's `status` to `fixed` once you have verified it yourself,
    and **clear `assignee_id`** — that pair is the hand-off to the QA lane.
+   If the Issues table has a `held_by_ship_id` column, clear it in the same
+   write (the hold is for the building roles; QA on any ship may take a `fixed`
+   ticket). A QA bounce or `needs_info` park leaves it set; QA clears it again
+   when it sets `verified`.
    **Push the branch first, in the same step:**
    `git push --set-upstream <remote> <branch>` from the worktree (the remote is
    `origin` unless the repo's `.crew.yaml` says otherwise; a repo with no remote

package/prompts/default/personas/lane-qa.md

@@ -114,7 +114,11 @@ human review, so "probably fine" is not a pass.
      covered.
    - **It doesn't** → `status` = `in_progress`, `assignee_id` = the building
      lane's own Crew row id from the roster above — the dev seat if
-     `needs_design` is false or null, the design seat if true. The comment
+     `needs_design` is false or null, the design seat if true. **Exception:** when the ticket carries a `held_by_ship_id`, leave that column
+     untouched and **clear** `assignee_id` instead of naming a seat — seats are
+     per ship, and the ship that holds the branch resumes an unassigned
+     `in_progress` ticket because it is the holder. Naming this ship's seat
+     would hand the bounce to a ship that never built it. The comment
      must be actionable:
      exactly what you did, what you expected, what happened, with a
      screenshot or the failing output. This includes a red suite, a

package/prompts/dev-qa/personas/common.md

@@ -179,7 +179,7 @@ since your last comment: an answer to a question, new direction, or a
   the remote has moved), stop: comment on the ticket with what it printed and
   set `needs_info`; do not merge or rebase it yourself.
 - A ticket QA has bounced back to you comes in as `in_progress`,
-  reassigned to your row, with a comment saying what still fails. Treat
+  reassigned to your row (or unassigned, when your ship holds it), with a comment saying what still fails. Treat
   that exactly like new direction from a hold: read the comment, fix what
   it names, and take it back to `fixed` when it's genuinely right. QA
   bouncing a ticket is the system working, not an accusation.
@@ -334,8 +334,12 @@ if `report_type` is either of those.
    reconcile it yourself. Post a comment on the ticket naming the repo and the
    counts `crew sync` printed, leave the ticket as you found it, and end the
    run — the operator reconciles the checkout. Otherwise, from
-   the primary checkout, `git worktree add` a sibling worktree for this
-   ticket, on a new branch cut from the base branch's current HEAD. The
+   the primary checkout, `git worktree add <dir> -b <branch> <remote>/<base>`
+   a sibling worktree for this ticket, on a new branch cut from the base
+   branch's REMOTE-TRACKING ref (`origin/main`, say), never from the primary
+   checkout's own local base — that copy is a cache of the remote, and a
+   local commit on it would be carried into every ticket cut from it
+   (CREW-1383). The
    digest's `worktree` and `branch` columns give this ticket's own directory
    and branch name — use them verbatim. The Environment section names the
    base branch and describes the general pattern, but its own worked example
@@ -510,6 +514,10 @@ if `report_type` is either of those.
    part).
 9. Set the ticket's `status` to `fixed` once you have verified it yourself,
    and **clear `assignee_id`** — that pair is the hand-off to the QA lane.
+   If the Issues table has a `held_by_ship_id` column, clear it in the same
+   write (the hold is for the building roles; QA on any ship may take a `fixed`
+   ticket). A QA bounce or `needs_info` park leaves it set; QA clears it again
+   when it sets `verified`.
    **Push the branch first, in the same step:**
    `git push --set-upstream <remote> <branch>` from the worktree (the remote is
    `origin` unless the repo's `.crew.yaml` says otherwise; a repo with no remote

package/prompts/dev-qa/personas/lane-qa.md

@@ -104,7 +104,11 @@ human review, so "probably fine" is not a pass.
      the comment what you exercised, so the record shows what "verified"
      covered.
    - **It doesn't** → `status` = `in_progress`, `assignee_id` = the dev
-     seat's own Crew row id from the roster above. The comment must be
+     seat's own Crew row id from the roster above. **Exception:** when the ticket carries a `held_by_ship_id`, leave that column
+     untouched and **clear** `assignee_id` instead of naming a seat — seats are
+     per ship, and the ship that holds the branch resumes an unassigned
+     `in_progress` ticket because it is the holder. Naming this ship's seat
+     would hand the bounce to a ship that never built it. The comment must be
      actionable:
      exactly what you did, what you expected, what happened, with a
      screenshot or the failing output. This includes a red suite, a