@tablation/crew 0.15.0 → 0.17.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { resolve as resolve4, dirname as dirname10, join as join19, basename as basename7 } from "path";
+import { resolve as resolve4, dirname as dirname11, join as join20, basename as basename7 } from "path";
 import { fileURLToPath } from "url";
 import { hostname as hostname2, homedir as homedir5 } from "os";
 import { spawnSync as spawnSync3 } from "child_process";
@@ -1796,7 +1796,9 @@ var DEFAULT_CONTRACT = {
     epic: "epic_id",
     author: "filed_by_id",
     ship: "ship_id",
-    heldBy: "held_by_ship_id"
+    heldBy: "held_by_ship_id",
+    verifiedSha: "verified_sha",
+    prRef: "pr_ref"
   },
   comments: {
     parent: "ticket_id",
@@ -2782,7 +2784,8 @@ async function detectClosure(o) {
     const code = await o.mergedHook({
       CREW_TICKET: o.key,
       CREW_BRANCH: o.pushedBranch,
-      CREW_BASE: base
+      CREW_BASE: base,
+      ...o.pr ? { CREW_PR: o.pr } : {}
     });
     if (code === 0) {
       const mergedAt = findKeyOnBase(o.cwd, [o.key, ...aliases], remote, base, o.since) ?? void 0;
@@ -2952,8 +2955,8 @@ var CHECKOUT_LOCK_STALE_MS = 5 * 60 * 1e3;
 function checkoutLockPath(dir) {
   return `${dir}.sync.lock`;
 }
-function sleepSync(ms) {
-  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+function sleepSync(ms2) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms2);
 }
 function acquireCheckoutLock(dir, timeoutMs = 3e4) {
   const lockPath = checkoutLockPath(dir);
@@ -3046,6 +3049,29 @@ function baseAttention(repo, outcome, remote, base, nowIso = (/* @__PURE__ */ ne
   if (outcome.action === "level" || outcome.action === "fast-forwarded") return { clear: baseUnsafeKey(repo) };
   return null;
 }
+function repoStopFor(items, route) {
+  const stops = new Map(items.filter((i) => i.kind === "base_unsafe").map((i) => [i.key, i.message]));
+  if (stops.size === 0) return () => null;
+  return (t) => {
+    const name = repoTargetFor(route, t.repo_id)?.name;
+    return name ? stops.get(baseUnsafeKey(name)) ?? null : null;
+  };
+}
+function recheckBaseStops(state, route) {
+  const open = state.shipAttention().previous().filter((i) => i.kind === "base_unsafe");
+  const cleared = [];
+  for (const item of open) {
+    const target = reposOf(route).find((t) => baseUnsafeKey(t.name) === item.key);
+    if (!target) continue;
+    const cfg = resolveRepoConfig(loadRepoConfig(target.dir), void 0, target.dir);
+    const outcome = refreshBaseBranch(target.dir, cfg.branch.remote, cfg.branch.base, true);
+    if (outcome.action === "level" || outcome.action === "would-fast-forward") {
+      clearShipAttention(state, item.key);
+      cleared.push(target.name);
+    }
+  }
+  return cleared;
+}
 function openShipAttention(state, nowMs = Date.now()) {
   const stale = staleRelease(state.releaseHeartbeat().at(), nowMs);
   const stored = state.shipAttention().previous();
@@ -3122,7 +3148,7 @@ function releaseLockScope(route, repo) {
 }
 async function acquireBoardLock(client2, modelId, scope, holderLabel, ttlMs) {
   if (!modelId) return { ok: true, release: async () => {
-  } };
+  }, exclusion: "off" };
   const filters = JSON.stringify([{ columnName: "scope", operator: "EQ", value: scope }]);
   const rows = await client2.list(modelId, { filters, limit: 1 });
   const row = rows[0];
@@ -3139,6 +3165,7 @@ async function acquireBoardLock(client2, modelId, scope, holderLabel, ttlMs) {
   }
   return {
     ok: true,
+    exclusion: "taken",
     release: async () => {
       try {
         await client2.update(modelId, row.id, { holder: "" }, claimed.updated_at);
@@ -3605,6 +3632,18 @@ var Tracker = class {
       shipId: auth.shipId
     };
   }
+  /**
+   * Which of the optional review columns (`verified_sha`, `pr_ref`) the Issues
+   * table carries. A table without them has not adopted the review hand-off:
+   * the crew then pushes and moves the ticket without recording either.
+   */
+  async reviewColumns() {
+    const fields = await this.columnNames(this.models.issues);
+    return {
+      verifiedSha: fields.has(this.contract.columns.verifiedSha),
+      prRef: fields.has(this.contract.columns.prRef)
+    };
+  }
   /**
    * The authorship probe (CREW-1371), read once per process: which optional
    * `filed_by_id`/`ship_id` columns exist on Issues and Comments, and this
@@ -4005,6 +4044,10 @@ function withHoldCheck(affinity, i) {
   const a = affinityContext(i);
   return a ? { ...affinity, isHeldElsewhere: (t) => heldByOtherShip(t, a), isLiveHoldElsewhere: (t) => heldByLiveOtherShip(t, a) } : affinity;
 }
+function notInStoppedRepo(slice, i) {
+  const stop = i.repoStop;
+  return stop ? slice.filter((t) => stop(t) === null) : slice;
+}
 function notHeldByOtherShip(slice, i) {
   if (!i.ships) return slice;
   const a = { myShipId: i.ships.myShipId, ships: i.ships.rows, contract: i.contract ?? DEFAULT_CONTRACT, now: i.ships.now };
@@ -4013,7 +4056,7 @@ function notHeldByOtherShip(slice, i) {
 function buildingRoleHasWork(role, i) {
   const me = i.seats[role];
   if (!me) return { hasWork: false, reason: "this ship does not crew that role" };
-  const mine = notHeldByOtherShip(sliceFor(i.tickets, role), i);
+  const mine = notInStoppedRepo(notHeldByOtherShip(sliceFor(i.tickets, role), i), i);
   const startable = mine.filter(
     (t) => (t.status === "accepted" || t.status === "blocked") && !i.blocked.has(t.id) && !isHeld(t, i.holds)
   );
@@ -4063,7 +4106,7 @@ function roleCandidates(role, i) {
   if (role === "pair") return [];
   const me = i.seats[role];
   if (!me) return [];
-  return notHeldByOtherShip(sliceFor(i.tickets, role), i).filter(
+  return notInStoppedRepo(notHeldByOtherShip(sliceFor(i.tickets, role), i), i).filter(
     (t) => ((t.status === "accepted" || t.status === "blocked") && !i.blocked.has(t.id) || t.status === "in_progress" && (t.assignee_id === me || !t.assignee_id)) && !isHeld(t, i.holds)
   );
 }
@@ -4235,6 +4278,16 @@ function attentionTransitions(previous, current) {
   }
   return out;
 }
+function operatorTodo(tickets, contract, operatorId) {
+  const out = [];
+  for (const ticket of tickets) {
+    const reasons = attentionReasons(ticket, contract).filter(
+      (r) => r === "needs_planning" || r === "needs_info" && ticket.assignee_id === operatorId
+    );
+    if (reasons.length > 0) out.push({ ticket, reasons });
+  }
+  return out;
+}
 
 // src/digest.ts
 function displayKey2(t) {
@@ -4328,9 +4381,21 @@ ${sorted(ts).map(blockedRow).join("\n")}
   const step1 = i.tickets.filter(
     (t) => t.status === "in_progress" && (t.assignee_id === i.me || !t.assignee_id) || t.status === "needs_info"
   );
+  const stopOf = (t) => i.repoStop ? i.repoStop(t) : null;
   const step2 = i.tickets.filter(
-    (t) => (t.status === "accepted" || t.status === "blocked") && !isBlocked(t)
+    (t) => (t.status === "accepted" || t.status === "blocked") && !isBlocked(t) && stopOf(t) === null
   );
+  const held = i.tickets.filter((t) => (t.status === "accepted" || t.status === "blocked") && !isBlocked(t) && stopOf(t) !== null);
+  const heldTable = held.length === 0 ? "" : `
+### Held repos \u2014 this ship cannot start these right now
+
+Not yours to start this run: the ship's checkout of their repo is stopped. It
+resumes by itself once the checkout is level; no one needs to change the ticket.
+
+| ticket | why |
+|---|---|
+${sorted(held).map((t) => `| ${displayKey2(t)} | ${stopOf(t)} |`).join("\n")}
+`;
   return stream([
     "## Current queue \u2014 built for you by the poll\n",
     "\nAlready filtered to your lane, and already ordered by the Step 2 rule.\nTicket bodies are deliberately omitted: fetch the full record of only the\nticket you actually pick up. **Do not re-fetch the whole tracker.** This\ndigest comes from the same API call the poll just made, moments ago.\n",
@@ -4344,7 +4409,8 @@ ${sorted(ts).map(blockedRow).join("\n")}
     table(step2, i, header, row),
     "\n### Blocked \u2014 waiting on a dependency, not yours to start\n",
     '\nListed rather than hidden so "nothing to do" stays distinguishable from\n"everything is parked". The loop parks and restores these itself, on every\npoll: an approved ticket whose `Blocked by` entries are unresolved moves to\n`blocked`, and back to `accepted` once the last one resolves. **Do not pick\none up, do not set or clear `blocked` by hand, and do not "unblock" one by\nediting its `Blocked by` field** \u2014 if a blocker looks wrong, say so in your\nrun summary. A blocker counts as resolved at `verified`, `closed_deployed`,\n`closed_wont_fix` or `closed_duplicate`; `fixed` is still an unmerged branch\nawaiting QA, so it does not count.\n',
-    blockedTable(i.tickets.filter(isBlocked))
+    blockedTable(i.tickets.filter(isBlocked)),
+    ...heldTable ? [heldTable] : []
   ]);
 }
 function qaDigest(i) {
@@ -4394,6 +4460,9 @@ function branchTemplates(cfg, t) {
   const push = cfg.provenance["branch.push"] === "default" ? name : cfg.branch.push;
   return { name, push };
 }
+function pushedBranchForTicket(cfg, t, role) {
+  return branchRenderer(t, role)(branchTemplates(cfg, t).push);
+}
 function existingBranchForTicket(dir, cfg, t, role) {
   return branchForIssue(dir, t.issue_id, branchTemplates(cfg, t), branchRenderer(t, role));
 }
@@ -4419,6 +4488,102 @@ function materializeBranchForTicket(dir, cfg, t, role) {
 // src/poll.ts
 import { writeFileSync as writeFileSync3 } from "fs";
 import { join as join6 } from "path";
+
+// src/stalled.ts
+var STALLED_AFTER_CYCLES = 30;
+var CYCLE_MS = 120 * 1e3;
+var STALLED_AFTER_MS = STALLED_AFTER_CYCLES * CYCLE_MS;
+var STALLED_MARKER = "<!-- crew:stalled -->";
+var stalledKey = (issueId) => `stalled:${issueId}`;
+var ms = (iso) => {
+  const n = iso ? Date.parse(iso) : NaN;
+  return Number.isFinite(n) ? n : 0;
+};
+function planStalled(tickets, comments, ships, contract, holds2 = /* @__PURE__ */ new Set(), now = Date.now()) {
+  const watched = /* @__PURE__ */ new Set([contract.statuses.building, contract.statuses.handoff, contract.statuses.verifying]);
+  const byTicket = /* @__PURE__ */ new Map();
+  for (const c of comments) {
+    const list = byTicket.get(c.ticket_id);
+    if (list) list.push(c);
+    else byTicket.set(c.ticket_id, [c]);
+  }
+  const out = [];
+  for (const t of tickets) {
+    if (!watched.has(t.status)) continue;
+    if (t.assignee_id && holds2.has(t.assignee_id)) continue;
+    const mine = byTicket.get(t.id) ?? [];
+    const lastMarker = Math.max(0, ...mine.filter((c) => (c.body ?? "").includes(STALLED_MARKER)).map((c) => ms(c.created_at)));
+    const lastActivityAt = Math.max(
+      ms(t.updated_at),
+      ...mine.filter((c) => !(c.body ?? "").includes(STALLED_MARKER)).map((c) => ms(c.created_at))
+    );
+    if (now - lastActivityAt < STALLED_AFTER_MS) continue;
+    if (ships.some((s) => s.engaged && s.engaged_ticket_id === t.id)) continue;
+    out.push({
+      ticket: t,
+      holderShipId: ticketHolderShipId(t, contract),
+      lastActivityAt,
+      announced: lastMarker > lastActivityAt
+    });
+  }
+  return out;
+}
+function stalledComment(s, ships, now = Date.now()) {
+  const mins = Math.round((now - s.lastActivityAt) / 6e4);
+  const who2 = s.holderShipId ? `Held by ${shipName(ships, s.holderShipId)}, which is not engaged on it. That ship has an attention item open; the ticket is otherwise left as it is, and resumes the moment the ship picks it back up.` : `No ship holds it and none is engaged on it. It is waiting for the next ship that polls its lane; its status and assignee are left as they are.`;
+  return `${STALLED_MARKER}
+**Stalled \u2014 no activity on \`${s.ticket.issue_id}\` for ${mins} minutes (\`${s.ticket.status}\`).**
+
+${who2}`;
+}
+async function applyStalled(writer, stalled, ships, memberId, myShipId, log, dryRun, now = Date.now()) {
+  const r = { announced: 0, failed: 0, attention: [] };
+  for (const s of stalled) {
+    const x = { ticket: s.ticket.issue_id, step: "sweep" };
+    if (s.holderShipId && s.holderShipId === myShipId) {
+      r.attention.push({
+        kind: "stalled",
+        key: stalledKey(s.ticket.issue_id),
+        message: `${s.ticket.issue_id} is held by this ship but has been quiet for ${Math.round((now - s.lastActivityAt) / 6e4)} minutes with nothing engaged on it`,
+        since: new Date(s.lastActivityAt + STALLED_AFTER_MS).toISOString()
+      });
+    }
+    if (s.announced) continue;
+    if (dryRun) {
+      log.emit("would flag as stalled", x);
+      continue;
+    }
+    try {
+      await writer.postEvent(s.ticket.id, stalledComment(s, ships, now), memberId);
+      r.announced++;
+      log.warn(`stalled at ${s.ticket.status} \u2014 ${s.holderShipId ? "flagged on the holder" : "commented, no holder"}`, x);
+    } catch (e) {
+      r.failed++;
+      log.warn(`could not flag as stalled: ${e.message}`, x);
+    }
+  }
+  return r;
+}
+async function runStalledSweep(o, stalled) {
+  const r = await applyStalled(
+    o.tracker,
+    stalled,
+    o.ships,
+    o.memberId,
+    o.myShipId,
+    o.emit,
+    o.dryRun ?? false
+  );
+  if (o.dryRun) return r;
+  const keep = new Set(r.attention.map((i) => i.key));
+  for (const item of r.attention) await raiseShipAttention({ state: o.state, emit: o.emit, route: o.route, ship: o.ship }, item);
+  for (const open of o.state.shipAttention().previous()) {
+    if (open.kind === "stalled" && !keep.has(open.key)) clearShipAttention(o.state, open.key);
+  }
+  return r;
+}
+
+// src/poll.ts
 async function decideCycle(o) {
   const { route, ship, state, emit } = o;
   const tracker = new Tracker(route, ship);
@@ -4467,6 +4632,7 @@ async function decideCycle(o) {
   }
   const sweep = planSweep(tickets, info, blocked);
   const holdReleases = planHoldReleases(tickets, tracker.contract);
+  const stalled = planStalled(tickets, comments, ships, tracker.contract, holds2);
   const blockedIssues = tickets.filter((t) => blocked.has(t.id)).map((t) => t.issue_id);
   emit.emit(`${blockedIssues.length} ticket(s) parked as blocked`, { data: { blocked: blockedIssues } });
   const qaHeld = tickets.filter((t) => t.status === tracker.contract.statuses.verifying).map((t) => t.issue_id);
@@ -4526,7 +4692,11 @@ async function decideCycle(o) {
   }
   emit.enter("select");
   const watermark = state.watermark();
+  for (const repo of recheckBaseStops(state, route)) {
+    emit.emit(`${repo}: primary checkout is level again \u2014 building lanes resume for that repo`, { step: "select" });
+  }
   const selectionInput = {
+    repoStop: repoStopFor(openShipAttention(state), route),
     tickets,
     comments,
     watermark,
@@ -4549,6 +4719,7 @@ async function decideCycle(o) {
     sweep,
     epicSync,
     holdReleases,
+    stalled,
     stranded,
     selection,
     actionable,
@@ -4593,6 +4764,7 @@ function writeDigest(o, d, role, stateDir) {
     const render2 = (t) => branchRenderer(t, role);
     const input = {
       dirFor,
+      repoStop: repoStopFor(openShipAttention(o.state), o.route),
       branchFor: (t) => {
         const cfg = repoFor(dirFor(t) ?? o.route.dir);
         const { prefix } = ticketBranchContext(t);
@@ -5617,10 +5789,10 @@ function spawnAgent(plan, emit) {
         }));
       } catch {
       }
-      const ms = Date.now() - started;
+      const ms2 = Date.now() - started;
       emit.emit(`agent run finished (exit ${code ?? 1})`, {
         data: {
-          ms,
+          ms: ms2,
           code: code ?? 1,
           ...result?.sessionId ? { sessionId: result.sessionId } : {},
           ...result?.numTurns !== void 0 ? { numTurns: result.numTurns } : {},
@@ -5648,7 +5820,7 @@ function spawnAgent(plan, emit) {
           emit.warn(`could not report agent log: ${e.message}`, { step: "agent" });
         }
       }
-      resolve5({ code: code ?? 1, ms });
+      resolve5({ code: code ?? 1, ms: ms2 });
     });
     child.stdin.on("error", (err) => {
       emit.warn(`agent closed stdin before the prompt was delivered: ${err.message}`, { step: "agent" });
@@ -5657,14 +5829,348 @@ function spawnAgent(plan, emit) {
   });
 }
 
+// src/run-worktree.ts
+import { existsSync as existsSync9 } from "fs";
+import { dirname as dirname6, join as join9 } from "path";
+
+// src/ports.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { existsSync as existsSync8 } from "fs";
+import { join as join8 } from "path";
+var run = (cmd, args) => {
+  try {
+    return execFileSync2(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+  } catch {
+    return "";
+  }
+};
+function listeners() {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const add = (pid, port) => {
+    const key = `${pid}:${port}`;
+    if (!Number.isFinite(pid) || !Number.isFinite(port) || seen.has(key)) return;
+    seen.add(key);
+    out.push({ pid, port });
+  };
+  const lsof = run("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN"]);
+  if (lsof) {
+    for (const line of lsof.split("\n").slice(1)) {
+      const cols = line.split(/\s+/);
+      const addr = cols[8];
+      if (!addr) continue;
+      add(Number(cols[1]), Number(addr.slice(addr.lastIndexOf(":") + 1)));
+    }
+    return out;
+  }
+  const ss = run("ss", ["-ltnpH"]);
+  for (const line of ss.split("\n")) {
+    const local = line.trim().split(/\s+/)[3];
+    const pid = /pid=(\d+)/.exec(line)?.[1];
+    if (!local || !pid) continue;
+    add(Number(pid), Number(local.slice(local.lastIndexOf(":") + 1)));
+  }
+  return out;
+}
+var pidsOnPort = (port) => listeners().filter((l) => l.port === port).map((l) => l.pid);
+var DEFAULT_PORTS = { backendBase: 3e4, frontendBase: 4e4, span: 1e3 };
+function ticketForPort(port, s = DEFAULT_PORTS) {
+  if (port >= s.backendBase && port < s.backendBase + s.span) return { n: port - s.backendBase, role: "backend" };
+  if (port >= s.frontendBase && port < s.frontendBase + s.span) return { n: port - s.frontendBase, role: "frontend" };
+  return null;
+}
+function worktreeExists(parent, prefix, n) {
+  for (const name of [`${prefix}${n}`, `${prefix}${String(n).padStart(3, "0")}`]) {
+    if (existsSync8(join8(parent, name, ".git"))) return true;
+  }
+  return false;
+}
+var worktreeExistsIn = (where, n) => where.some((w) => worktreeExists(w.parent, w.prefix, n));
+function findOrphansIn(where, s = DEFAULT_PORTS) {
+  const orphans = [];
+  for (const l of listeners()) {
+    const t = ticketForPort(l.port, s);
+    if (!t) continue;
+    if (worktreeExistsIn(where, t.n)) continue;
+    orphans.push({ ...l, ...t });
+  }
+  return orphans;
+}
+async function killGently(pids, graceMs = 2e3) {
+  for (const pid of pids) {
+    try {
+      process.kill(pid, "SIGTERM");
+    } catch {
+    }
+  }
+  if (pids.length === 0) return;
+  await new Promise((r) => setTimeout(r, graceMs));
+  for (const pid of pids) {
+    try {
+      process.kill(pid, "SIGKILL");
+    } catch {
+    }
+  }
+}
+function pidsInWorktree(path, n, s = DEFAULT_PORTS) {
+  const pids = /* @__PURE__ */ new Set();
+  for (const port of [s.backendBase + n, s.frontendBase + n]) for (const p of pidsOnPort(port)) pids.add(p);
+  const matched = run("pgrep", ["-f", `${path}/`]);
+  for (const line of matched.split("\n")) {
+    const pid = Number(line.trim());
+    if (Number.isFinite(pid) && pid > 0 && pid !== process.pid) pids.add(pid);
+  }
+  return [...pids];
+}
+
+// src/run-worktree.ts
+var describeRunWorktreePlan = (p) => {
+  switch (p.action) {
+    case "cut-remote":
+      return `cut ${p.path} from the remote branch ${p.branch}`;
+    case "cut-fresh":
+      return `cut ${p.path} fresh from ${p.base} (no branch ${p.branch} anywhere yet)`;
+    case "reset":
+      return `fast-forwarded ${p.path} to the remote tip of ${p.branch}`;
+    case "reuse":
+      return `reusing ${p.path} (${p.branch} is already level with the remote)`;
+    case "recut":
+      return `${p.branch} is gone from the remote and ${p.path} held no work of its own \u2014 re-cut it fresh from ${p.base}`;
+    case "leave-dirty":
+      return `left ${p.path} alone: it has uncommitted changes (someone may be editing it by hand)`;
+    case "leave-unpushed":
+      return `left ${p.path} alone: ${p.branch} has commits that are not on the remote`;
+  }
+};
+var planIsUsable = (p) => p.action !== "leave-dirty" && p.action !== "leave-unpushed";
+function newBranchName(cfg, t, role) {
+  const { prefix } = ticketBranchContext(t);
+  return branchRenderer(t, role)(effectiveBranchTemplate(cfg, prefix));
+}
+function planRunWorktree(dir, cfg, t, role) {
+  const { remote, base } = cfg.branch;
+  const hasRemote = remoteConfigured(dir, remote);
+  if (hasRemote) fetchRemote(dir, remote);
+  const num = t.issue_id.replace(/^\D+/, "");
+  const existing = worktreeForNumber(dir, num);
+  const located = locateBranchForTicket(dir, cfg, t, role);
+  const baseRef = hasRemote ? `${remote}/${base}` : base;
+  if (existing && !existing.prunable && existsSync9(existing.path)) {
+    const branch = existing.branch;
+    if (status(existing.path).length > 0) return { action: "leave-dirty", path: existing.path, branch };
+    if (!branch) return { action: "leave-unpushed", path: existing.path, branch: "(detached HEAD)" };
+    if (!hasRemote) return { action: "reuse", path: existing.path, branch };
+    if (remoteBranchExists(dir, remote, branch)) {
+      const ahead = countCommits(existing.path, `${remote}/${branch}..HEAD`);
+      const behind = countCommits(existing.path, `HEAD..${remote}/${branch}`);
+      if (ahead > 0) return { action: "leave-unpushed", path: existing.path, branch };
+      return behind > 0 ? { action: "reset", path: existing.path, branch } : { action: "reuse", path: existing.path, branch };
+    }
+    if (countCommits(existing.path, `${baseRef}..HEAD`) > 0) return { action: "leave-unpushed", path: existing.path, branch };
+    return { action: "recut", path: existing.path, branch, base: baseRef };
+  }
+  const path = join9(dirname6(dir), worktreeForTicket(dir, cfg, t, role));
+  if (located?.where === "remote" || located && hasRemote && remoteBranchExists(dir, remote, located.branch)) {
+    return { action: "cut-remote", path, branch: located.branch };
+  }
+  if (located) {
+    return { action: "reuse", path, branch: located.branch };
+  }
+  return { action: "cut-fresh", path, branch: newBranchName(cfg, t, role), base: baseRef };
+}
+function applyRunWorktree(dir, cfg, plan) {
+  const { remote } = cfg.branch;
+  switch (plan.action) {
+    case "leave-dirty":
+    case "leave-unpushed":
+      return null;
+    case "reuse":
+      if (!worktrees(dir).some((w) => w.path === plan.path)) git(dir, ["worktree", "add", plan.path, plan.branch]);
+      return plan.path;
+    case "reset":
+      git(plan.path, ["merge", "--ff-only", `${remote}/${plan.branch}`]);
+      return plan.path;
+    case "cut-remote": {
+      const local = gitOk(dir, ["rev-parse", "-q", "--verify", `refs/heads/${plan.branch}`]) !== null;
+      if (local) {
+        git(dir, ["worktree", "add", plan.path, plan.branch]);
+        gitOk(plan.path, ["merge", "--ff-only", `${remote}/${plan.branch}`]);
+      } else {
+        git(dir, ["worktree", "add", "--track", "-b", plan.branch, plan.path, `${remote}/${plan.branch}`]);
+      }
+      return plan.path;
+    }
+    case "recut":
+      git(dir, ["worktree", "remove", "--force", plan.path]);
+      gitOk(dir, ["branch", "-D", plan.branch]);
+      git(dir, ["worktree", "add", "-b", plan.branch, plan.path, plan.base]);
+      return plan.path;
+    case "cut-fresh":
+      git(dir, ["worktree", "add", "-b", plan.branch, plan.path, plan.base]);
+      return plan.path;
+  }
+}
+async function finishRunWorktree(dir, cfg, branch) {
+  const wt = worktrees(dir).find((w) => w.branch === branch && !w.prunable && w.path !== dir);
+  if (!wt || !existsSync9(wt.path)) return { kind: "none" };
+  if (cfg.hooks.handoff) return { kind: "kept-handoff", path: wt.path };
+  if (status(wt.path).length > 0) return { kind: "kept-dirty", path: wt.path };
+  const n = Number(wt.path.match(/(\d+)$/)?.[1] ?? NaN);
+  if (Number.isFinite(n)) {
+    const pids = pidsInWorktree(wt.path, n);
+    if (pids.length) await killGently(pids);
+  }
+  gitOk(dir, ["worktree", "remove", wt.path]);
+  return existsSync9(wt.path) ? { kind: "kept-dirty", path: wt.path } : { kind: "removed", path: wt.path };
+}
+
+// src/handoff-guard.ts
+var HANDOFF_BOUNCED_MARKER = "<!-- crew:handoff-bounced -->";
+var pushedEventBody = (sha, remote, branch) => `pushed ${sha} to ${remote}/${branch}`;
+function remoteTip(dir, remote, branch) {
+  const out = gitOk(dir, ["ls-remote", "--heads", remote, `refs/heads/${branch}`]);
+  if (out === null) return null;
+  return out.split("\n").find((l) => l.endsWith(`	refs/heads/${branch}`))?.split("	")[0] ?? "";
+}
+function inspectHandoff(dir, cfg, ticket, role) {
+  const remote = cfg.branch.remote;
+  if (!remoteConfigured(dir, remote)) return { kind: "unverified", why: `no remote \`${remote}\` configured` };
+  const branch = existingBranchForTicket(dir, cfg, ticket, role);
+  if (!branch) {
+    return {
+      kind: "bounce",
+      branch: null,
+      remote,
+      local: null,
+      origin: null,
+      reason: `no branch for this ticket exists in this checkout, so there is nothing on \`${remote}\` to hand to QA`
+    };
+  }
+  const wt = worktrees(dir).find((w) => w.branch === branch);
+  const local = wt ? headSha(wt.path) : gitOk(dir, ["rev-parse", `refs/heads/${branch}`]);
+  const origin = remoteTip(dir, remote, branch);
+  if (origin === null) return { kind: "unverified", why: `could not reach \`${remote}\` to check \`${branch}\`` };
+  if (!origin) {
+    return {
+      kind: "bounce",
+      branch,
+      remote,
+      local,
+      origin: null,
+      reason: `\`${branch}\` does not exist on \`${remote}\` \u2014 it was never pushed (or the push failed)`
+    };
+  }
+  if (origin !== local) {
+    return {
+      kind: "bounce",
+      branch,
+      remote,
+      local,
+      origin,
+      reason: `\`${remote}/${branch}\` is at \`${origin}\`, not at this worktree's HEAD \u2014 the latest commits were not pushed, or the remote moved`
+    };
+  }
+  return { kind: "pushed", branch, sha: origin, remote };
+}
+function bounceComment(v, shipName2) {
+  return `${HANDOFF_BOUNCED_MARKER}
+**Hand-off bounced: the branch is not on \`${v.remote}\` at the tip this ticket was built to.**
+
+${shipName2 ? `Ship: ${shipName2}
+` : ""}Local HEAD: ${v.local ? `\`${v.local}\`` : "(no local branch)"}
+\`${v.remote}\`: ${v.origin ? `\`${v.origin}\`` : v.branch ? "(branch missing)" : "(no branch to look for)"}
+
+${v.reason[0].toUpperCase()}${v.reason.slice(1)}. Set back to \`in_progress\`, still held by this ship; push with a plain \`git push --set-upstream ${v.remote} <branch>\` (never \`--force\`) and set \`fixed\` again.`;
+}
+async function enforceHandoff(i) {
+  try {
+    const t = await i.writer.ticket(i.ticketId);
+    if (t.status !== i.contract.statuses.handoff) return { kind: "not-handed-off" };
+    const log = { ticket: t.issue_id, step: "handoff" };
+    const v = inspectHandoff(i.dir, i.cfg, t, i.role);
+    if (v.kind === "unverified") {
+      i.log.warn(`${t.issue_id} is at ${t.status} but the push was not checked: ${v.why}`, log);
+      return { kind: "unverified", why: v.why };
+    }
+    if (v.kind === "pushed") {
+      await i.writer.postEvent(t.id, pushedEventBody(v.sha, v.remote, v.branch), i.seatId);
+      i.log.emit(`${t.issue_id} pushed at ${v.sha.slice(0, 7)} \u2014 handed on to QA`, log);
+      return { kind: "pushed", sha: v.sha };
+    }
+    const heldBy = i.hold ? t[i.hold.column] : void 0;
+    await i.writer.updateTicket(t.id, {
+      status: i.contract.statuses.building,
+      ...t.assignee_id ? {} : { assignee_id: i.seatId },
+      ...i.hold && !heldBy ? { [i.hold.column]: i.hold.shipId } : {}
+    });
+    await i.writer.postEvent(t.id, bounceComment(v, i.shipName), i.seatId).catch(() => {
+      i.log.warn("bounced, but the note failed to post", log);
+    });
+    i.log.warn(`${t.issue_id} bounced back to ${i.contract.statuses.building}: ${v.reason}`, log);
+    return { kind: "bounced" };
+  } catch (e) {
+    i.log.warn(`could not check the hand-off: ${e.message}`, { step: "handoff" });
+    return { kind: "failed", why: e.message };
+  }
+}
+async function guardRunHandoff(route, ship, tracker, role, workingId, log) {
+  if (role !== "dev" && role !== "design" || !workingId) return null;
+  const seatId = route.resolved?.seats[role];
+  if (!seatId) return null;
+  try {
+    const t = await tracker.ticket(workingId);
+    const target = repoTargetFor(route, t.repo_id);
+    if (!target) return null;
+    const o = route.repoOverrides[target.name];
+    const cfg = resolveRepoConfig(loadRepoConfig(target.dir), {
+      hooks: { ...route.hooks, ...o?.hooks },
+      labels: { ...route.labels, ...o?.labels },
+      branch: { ...route.branch, ...o?.branch }
+    }, target.dir);
+    const affinity = await tracker.claimAffinity();
+    const outcome = await enforceHandoff({
+      writer: tracker,
+      contract: tracker.contract,
+      ticketId: workingId,
+      role,
+      dir: target.dir,
+      cfg,
+      seatId,
+      shipName: ship.name,
+      hold: affinity ? { column: affinity.column, shipId: affinity.shipId } : void 0,
+      log
+    });
+    if (outcome.kind === "pushed") await retireRunWorktree(tracker, target.dir, cfg, t, role, seatId, ship.name, log);
+    return outcome;
+  } catch (e) {
+    log.warn(`could not check the hand-off: ${e.message}`, { step: "handoff" });
+    return null;
+  }
+}
+async function retireRunWorktree(tracker, dir, cfg, t, role, seatId, shipName2, log) {
+  try {
+    const branch = existingBranchForTicket(dir, cfg, t, role);
+    if (!branch) return;
+    const o = await finishRunWorktree(dir, cfg, branch);
+    const at = { ticket: t.issue_id, step: "handoff" };
+    if (o.kind === "removed") log.emit(`${t.issue_id}: removed the run's worktree ${o.path} \u2014 the branch is on ${cfg.branch.remote}`, at);
+    else if (o.kind === "kept-handoff") {
+      log.emit(`${t.issue_id}: kept worktree ${o.path} \u2014 this repo's handoff hook serves from it`, at);
+      await tracker.postEvent(t.id, `worktree kept on ship ${shipName2} at \`${o.path}\`: the repo's \`handoff\` hook serves from it. QA on another ship cuts its own from \`${cfg.branch.remote}/${branch}\` instead.`, seatId);
+    } else if (o.kind === "kept-dirty") log.warn(`${t.issue_id}: left worktree ${o.path} \u2014 it has uncommitted changes`, at);
+  } catch (e) {
+    log.warn(`could not retire the run's worktree: ${e.message}`, { step: "handoff" });
+  }
+}
+
 // src/connect-wizard.ts
-import { delimiter, dirname as dirname6, join as join8 } from "path";
-import { accessSync as accessSync2, constants as constants2, existsSync as existsSync8, mkdirSync as mkdirSync6, writeFileSync as writeFileSync5 } from "fs";
+import { delimiter, dirname as dirname7, join as join10 } from "path";
+import { accessSync as accessSync2, constants as constants2, existsSync as existsSync10, mkdirSync as mkdirSync6, writeFileSync as writeFileSync5 } from "fs";
 import { stringify } from "yaml";
 var HOST_PASSENGERS_DOCS_URL = "https://crew.tablation.dev/host-passengers";
 function shouldRunWizard(opts) {
   if (!opts.isTTY) return false;
-  const exists = opts.configExists ?? existsSync8;
+  const exists = opts.configExists ?? existsSync10;
   return !configSearchPath(opts.crewHome).some((p) => exists(p));
 }
 function firstRunConfigPath() {
@@ -5681,7 +6187,7 @@ function defaultIsExecutable(p) {
 function findOnPath2(name, pathEnv, isExecutable = defaultIsExecutable) {
   for (const dir of pathEnv.split(delimiter)) {
     if (!dir) continue;
-    const candidate = join8(dir, name);
+    const candidate = join10(dir, name);
     if (isExecutable(candidate)) return candidate;
   }
   return void 0;
@@ -5707,9 +6213,9 @@ async function runWizard(p, env) {
     if (entered && isExec(entered)) agentBin = entered;
     else p.say(entered ? `${entered} is not an executable file.` : "A path is required.");
   }
-  const nodeDir = dirname6(env.nodePath);
+  const nodeDir = dirname7(env.nodePath);
   const pnpmPath = findOnPath2("pnpm", env.pathEnv, isExec);
-  const baseDirs = [nodeDir, pnpmPath ? dirname6(pnpmPath) : void 0];
+  const baseDirs = [nodeDir, pnpmPath ? dirname7(pnpmPath) : void 0];
   p.say(
     `
 Host Passengers lets this machine run the agent sessions that other people's
@@ -5720,7 +6226,7 @@ Tablation workspaces ask for, in a container. More: ${HOST_PASSENGERS_DOCS_URL}`
     p.say("Docker is not available here, so nothing will be hosted until it is. Your answer is recorded anyway.");
   }
   const dockerPath = hostPassengers ? findOnPath2("docker", env.pathEnv, isExec) : void 0;
-  const extraPath = deriveExtraPath([...baseDirs, dockerPath ? dirname6(dockerPath) : void 0]);
+  const extraPath = deriveExtraPath([...baseDirs, dockerPath ? dirname7(dockerPath) : void 0]);
   if (extraPath) {
     p.say(`Hooks will get ${extraPath} on their PATH (where node, pnpm${dockerPath ? " and docker" : ""} live).`);
   }
@@ -5742,7 +6248,7 @@ routes:
 ${routeBlock}`;
 }
 function writeNewConfig(path, text) {
-  mkdirSync6(dirname6(path), { recursive: true });
+  mkdirSync6(dirname7(path), { recursive: true });
   try {
     writeFileSync5(path, text, { mode: 384, flag: "wx" });
     return true;
@@ -5776,8 +6282,8 @@ Wrote ${o.configPath}.
 }
 
 // src/release-run.ts
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync6, existsSync as existsSync9, copyFileSync, mkdirSync as mkdirSync7, mkdtempSync, rmSync as rmSync2 } from "fs";
-import { dirname as dirname7, join as join9 } from "path";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync6, existsSync as existsSync11, copyFileSync, mkdirSync as mkdirSync7, mkdtempSync, rmSync as rmSync2 } from "fs";
+import { dirname as dirname8, join as join11 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 
 // src/release.ts
@@ -6037,6 +6543,139 @@ async function applyExternalClosures(tracker, closures, contract, emit, dryRun,
   return stamped;
 }
 
+// src/review.ts
+function reviewApplies(repo, contract) {
+  return repo.release.mode === "external" && !!contract.statuses.reviewing;
+}
+function reviewProblems(repo, contract) {
+  if (!reviewApplies(repo, contract)) return [];
+  const problems = [];
+  const template = repo.branch.push ?? repo.branch.name;
+  if (!/\{(key|number|tag)\}/.test(template)) {
+    problems.push(
+      `branch.push "${template}" names none of {key}, {number} or {tag} \u2014 with release.mode "external" and a reviewing status, the pushed branch is the only link back to its ticket`
+    );
+  }
+  return problems;
+}
+function parsePrRef(output) {
+  const lines = output.split("\n").map((l) => l.trim()).filter(Boolean);
+  if (lines.length === 1) return lines[0].slice(0, 500);
+  for (const l of [...lines].reverse()) {
+    if (/^https?:\/\/\S+$/.test(l) || /^#?\d+$/.test(l)) return l;
+  }
+  return void 0;
+}
+function columnValue(t, column) {
+  const v = t[column];
+  return typeof v === "string" ? v.trim() : "";
+}
+function movedPast(r, t, branch, pushedAs) {
+  if (!r.columns.verifiedSha) return null;
+  const verified = columnValue(t, r.contract.columns.verifiedSha);
+  if (!verified) return null;
+  const head = resolve2(r.cwd, branch);
+  const remoteHead = resolve2(r.cwd, `${r.repo.branch.remote}/${pushedAs}`);
+  if (remoteHead && !isAncestor(r.cwd, remoteHead, verified) && remoteHead !== head) {
+    return { ticket: t, verified, head: remoteHead };
+  }
+  if (head && head !== verified && !isAncestor(r.cwd, head, verified)) {
+    return { ticket: t, verified, head };
+  }
+  return null;
+}
+async function runReview(r, verified, reviewing) {
+  const out = { handoffs: [], requeues: [] };
+  const remote = r.repo.branch.remote;
+  for (const { ticket, branch } of reviewing) {
+    const moved = movedPast(r, ticket, branch, pushedBranchForTicket(r.repo, ticket));
+    if (moved) out.requeues.push(moved);
+  }
+  for (const { ticket, branch } of verified) {
+    const pushedAs = pushedBranchForTicket(r.repo, ticket);
+    const moved = movedPast(r, ticket, branch, pushedAs);
+    if (moved) {
+      out.requeues.push(moved);
+      continue;
+    }
+    const head = resolve2(r.cwd, branch);
+    if (!head) continue;
+    if (r.dryRun) {
+      r.emit.emit(`would push ${branch} to ${remote}/${pushedAs} for review`, { ticket: ticket.issue_id });
+      continue;
+    }
+    try {
+      pushBranch(r.cwd, remote, branch, pushedAs);
+    } catch (e) {
+      r.emit.error(
+        `could not push ${branch} to ${remote}/${pushedAs} for review \u2014 ${e.message.split("\n")[0]}; left at verified, retried next cycle`,
+        { ticket: ticket.issue_id }
+      );
+      continue;
+    }
+    r.emit.emit(`pushed ${branch} to ${remote}/${pushedAs} for review`, { ticket: ticket.issue_id });
+    const handoff = { ticket, pushedAs, head };
+    const existing = r.columns.prRef ? columnValue(ticket, r.contract.columns.prRef) : "";
+    if (existing) {
+      handoff.prRef = existing;
+    } else {
+      const res = await r.runPrHook({
+        CREW_TICKET: ticket.issue_id,
+        CREW_BRANCH: pushedAs,
+        CREW_BASE: r.repo.branch.base,
+        CREW_TITLE: `${displayKey(ticket)}: ${ticket.title ?? ""}`.trim()
+      });
+      if (res && res.code !== 0) handoff.prFailure = { code: res.code, tail: lastLines(res.output, 5).trim() };
+      else if (res) handoff.prRef = parsePrRef(res.output);
+    }
+    out.handoffs.push(handoff);
+  }
+  return out;
+}
+async function applyReview(tracker, contract, outcome, remote, emit, seat, columns, dryRun) {
+  const reviewing = contract.statuses.reviewing;
+  for (const h of outcome.handoffs) {
+    if (!reviewing) break;
+    const t = h.ticket;
+    const lines = [`Pushed \`${h.pushedAs}\` (${h.head.slice(0, 8)}) to \`${remote}\` for review; moved to ${reviewing}.`];
+    if (h.prRef) lines.push(`Pull request: ${h.prRef}`);
+    if (h.prFailure) {
+      lines.push(
+        `\`hooks.pr\` exited ${h.prFailure.code}, so no pull request was recorded \u2014 the branch is pushed, open one by hand.
+
+\`\`\`
+${h.prFailure.tail}
+\`\`\``
+      );
+    }
+    try {
+      await tracker.updateTicket(t.id, {
+        [contract.columns.status]: reviewing,
+        ...h.prRef && columns.prRef ? { [contract.columns.prRef]: h.prRef } : {}
+      }, t.updated_at);
+      await tracker.postEvent(t.id, lines.join("\n\n"), seat);
+      emit.emit(`moved to ${reviewing}`, { ticket: t.issue_id });
+    } catch (e) {
+      emit.warn(`could not move to ${reviewing}: ${e.message}`, { ticket: t.issue_id });
+    }
+  }
+  for (const q of outcome.requeues) {
+    const t = q.ticket;
+    const body = `The branch is no longer what was verified: \`verified_sha\` is ${q.verified.slice(0, 8)}, the branch is now at ${q.head.slice(0, 8)}. Returned to ${contract.statuses.handoff} for QA to check what changed.`;
+    if (dryRun) {
+      emit.emit(`would return to ${contract.statuses.handoff} \u2014 branch moved past ${q.verified.slice(0, 8)}`, { ticket: t.issue_id });
+      continue;
+    }
+    try {
+      await tracker.updateTicket(t.id, { [contract.columns.status]: contract.statuses.handoff }, t.updated_at);
+      await tracker.postEvent(t.id, body, seat);
+      emit.emit(`returned to ${contract.statuses.handoff} \u2014 branch moved past ${q.verified.slice(0, 8)}`, { ticket: t.issue_id });
+    } catch (e) {
+      emit.warn(`could not return to ${contract.statuses.handoff}: ${e.message}`, { ticket: t.issue_id });
+    }
+  }
+}
+
 // src/release-run.ts
 function emitReleaseSummary(emit, summaries) {
   if (summaries.length <= 1) return;
@@ -6136,11 +6775,15 @@ async function detectExternalClosures(o, candidates) {
   const out = [];
   for (const c of candidates) {
     if (!c.branch) continue;
+    const prRef = c.ticket[o.contract.columns.prRef];
     const closure = await detectClosure({
       cwd: o.cwd,
       key: c.ticket.issue_id,
       aliases: referenceKeys(c.ticket).slice(1),
-      pushedBranch: c.branch,
+      // The name the remote knows it by — `branch.push`, which is not the
+      // local branch's when the repo sets one.
+      pushedBranch: pushedBranchForTicket(o.repo, c.ticket),
+      pr: typeof prRef === "string" && prRef.trim() ? prRef.trim() : void 0,
       remote: o.repo.branch.remote,
       base: o.repo.branch.base,
       mergedHook
@@ -6150,6 +6793,29 @@ async function detectExternalClosures(o, candidates) {
   }
   return out;
 }
+async function reviewHandoff(o, closures, verifiedCandidates, reviewing) {
+  if (!reviewApplies(o.repo, o.contract)) return void 0;
+  const problems = reviewProblems(o.repo, o.contract);
+  if (problems.length) {
+    for (const p of problems) o.emit.error(`${o.scope ?? "release"}: ${p}`);
+    return void 0;
+  }
+  const open = new Set(closures.filter((c) => c.closure.state !== "merged").map((c) => c.ticket.id));
+  const verified = verifiedCandidates.filter((c) => !!c.branch && open.has(c.ticket.id)).map((c) => ({ ticket: c.ticket, branch: c.branch }));
+  const outcome = await runReview({
+    cwd: o.cwd,
+    repo: o.repo,
+    contract: o.contract,
+    emit: o.emit,
+    dryRun: o.dryRun,
+    columns: o.reviewColumns ?? { verifiedSha: false, prRef: false },
+    runPrHook: async (env) => {
+      const r = await hook(o, "pr", env);
+      return r ? { code: r.code, output: r.output } : null;
+    }
+  }, verified, reviewing.filter((r) => open.has(r.ticket.id)));
+  return outcome.handoffs.length || outcome.requeues.length ? outcome : void 0;
+}
 async function confirmExternalReleased(o, closures) {
   if (!o.repo.hooks.released) return closures;
   const landed = closures.filter((c) => c.closure.state === "merged" && c.closure.mergedAt);
@@ -6240,9 +6906,9 @@ async function bump(o, size) {
     }
     return printed;
   }
-  const files = o.repo.release.versionFiles.map((f) => join9(o.cwd, f));
+  const files = o.repo.release.versionFiles.map((f) => join11(o.cwd, f));
   const first = files[0];
-  if (!existsSync9(first)) {
+  if (!existsSync11(first)) {
     o.emit.error(`no ${o.repo.release.versionFiles[0]} to read a version from`);
     return null;
   }
@@ -6272,13 +6938,13 @@ async function bump(o, size) {
 function writeChangelog(o, version, entries) {
   const file = o.repo.release.changelog;
   if (!file || entries.length === 0) return;
-  const path = join9(o.cwd, file);
+  const path = join11(o.cwd, file);
   const section = renderChangelogSection(version, (/* @__PURE__ */ new Date()).toISOString().slice(0, 10), entries);
   if (o.dryRun) {
     o.emit.emit(`would prepend ${entries.length} entr(ies) to ${file}`);
     return;
   }
-  const existing = existsSync9(path) ? readFileSync7(path, "utf8") : "# Changelog\n";
+  const existing = existsSync11(path) ? readFileSync7(path, "utf8") : "# Changelog\n";
   writeFileSync6(path, insertChangelogSection(existing, section));
 }
 async function confirm(o, expected) {
@@ -6360,8 +7026,8 @@ async function confirmLastRelease(o, decision) {
 function openReleaseCheckout(o) {
   const { remote, base } = o.repo.branch;
   const branch = `crew/release-${Date.now()}`;
-  const root = mkdtempSync(join9(tmpdir2(), "crew-release-"));
-  const dir = join9(root, "checkout");
+  const root = mkdtempSync(join11(tmpdir2(), "crew-release-"));
+  const dir = join11(root, "checkout");
   const close = () => {
     gitOk(o.cwd, ["worktree", "remove", "--force", dir]);
     rmSync2(root, { recursive: true, force: true });
@@ -6375,10 +7041,10 @@ function openReleaseCheckout(o) {
     throw e;
   }
   for (const f of o.repo.worktrees.copy) {
-    const src = join9(o.cwd, f);
-    if (!existsSync9(src)) continue;
-    mkdirSync7(dirname7(join9(dir, f)), { recursive: true });
-    copyFileSync(src, join9(dir, f));
+    const src = join11(o.cwd, f);
+    if (!existsSync11(src)) continue;
+    mkdirSync7(dirname8(join11(dir, f)), { recursive: true });
+    copyFileSync(src, join11(dir, f));
   }
   return { dir, branch, close };
 }
@@ -6424,9 +7090,18 @@ async function runRelease(o) {
   }
   if (o.repo.release.mode === "external") {
     o.emit.emit("release.mode is external \u2014 the crew hands work off and does not release");
-    const landed = await detectExternalClosures(o, decision.merges);
+    const reviewingStatus = o.contract.statuses.reviewing;
+    const reviewing = [];
+    if (reviewingStatus) {
+      for (const t of o.tickets.filter((x) => x.status === reviewingStatus)) {
+        const branch = locateBranchForTicket(o.cwd, o.repo, t)?.branch;
+        if (branch) reviewing.push({ ticket: t, branch });
+      }
+    }
+    const landed = await detectExternalClosures(o, [...decision.merges, ...reviewing]);
     const externalClosures = await confirmExternalReleased(o, landed);
-    return { merged: [], deployed: false, stopped: "external", decision, externalClosures };
+    const review = await reviewHandoff(o, externalClosures, decision.merges, reviewing);
+    return { merged: [], deployed: false, stopped: "external", decision, externalClosures, review };
   }
   const { remote, base } = o.repo.branch;
   if (o.dryRun || o.mergeOnly || !remoteBranchExists(o.cwd, remote, base)) {
@@ -6781,7 +7456,7 @@ function missingReleaserWarning(repo, release, ships, now = Date.now()) {
 }
 
 // src/watch.ts
-import { watch as watchFile, existsSync as existsSync10, statSync as statSync5, openSync as openSync2, readSync, closeSync as closeSync2 } from "fs";
+import { watch as watchFile, existsSync as existsSync12, statSync as statSync5, openSync as openSync2, readSync, closeSync as closeSync2 } from "fs";
 var E = "\x1B[";
 var dim = (s) => `${E}2m${s}${E}0m`;
 var bold = (s) => `${E}1m${s}${E}0m`;
@@ -6882,7 +7557,7 @@ function renderHeaders(states, now = Date.now()) {
   return states.map((s) => renderHeader(s, now)).join("");
 }
 function readFrom(file, from) {
-  if (!existsSync10(file)) return { events: [], offset: from };
+  if (!existsSync12(file)) return { events: [], offset: from };
   const size = statSync5(file).size;
   if (size < from) return readFrom(file, 0);
   if (size === from) return { events: [], offset: from };
@@ -6961,96 +7636,6 @@ function startWatch(o) {
   return stop;
 }
 
-// src/ports.ts
-import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync11 } from "fs";
-import { join as join10 } from "path";
-var run = (cmd, args) => {
-  try {
-    return execFileSync2(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
-  } catch {
-    return "";
-  }
-};
-function listeners() {
-  const out = [];
-  const seen = /* @__PURE__ */ new Set();
-  const add = (pid, port) => {
-    const key = `${pid}:${port}`;
-    if (!Number.isFinite(pid) || !Number.isFinite(port) || seen.has(key)) return;
-    seen.add(key);
-    out.push({ pid, port });
-  };
-  const lsof = run("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN"]);
-  if (lsof) {
-    for (const line of lsof.split("\n").slice(1)) {
-      const cols = line.split(/\s+/);
-      const addr = cols[8];
-      if (!addr) continue;
-      add(Number(cols[1]), Number(addr.slice(addr.lastIndexOf(":") + 1)));
-    }
-    return out;
-  }
-  const ss = run("ss", ["-ltnpH"]);
-  for (const line of ss.split("\n")) {
-    const local = line.trim().split(/\s+/)[3];
-    const pid = /pid=(\d+)/.exec(line)?.[1];
-    if (!local || !pid) continue;
-    add(Number(pid), Number(local.slice(local.lastIndexOf(":") + 1)));
-  }
-  return out;
-}
-var pidsOnPort = (port) => listeners().filter((l) => l.port === port).map((l) => l.pid);
-var DEFAULT_PORTS = { backendBase: 3e4, frontendBase: 4e4, span: 1e3 };
-function ticketForPort(port, s = DEFAULT_PORTS) {
-  if (port >= s.backendBase && port < s.backendBase + s.span) return { n: port - s.backendBase, role: "backend" };
-  if (port >= s.frontendBase && port < s.frontendBase + s.span) return { n: port - s.frontendBase, role: "frontend" };
-  return null;
-}
-function worktreeExists(parent, prefix, n) {
-  for (const name of [`${prefix}${n}`, `${prefix}${String(n).padStart(3, "0")}`]) {
-    if (existsSync11(join10(parent, name, ".git"))) return true;
-  }
-  return false;
-}
-var worktreeExistsIn = (where, n) => where.some((w) => worktreeExists(w.parent, w.prefix, n));
-function findOrphansIn(where, s = DEFAULT_PORTS) {
-  const orphans = [];
-  for (const l of listeners()) {
-    const t = ticketForPort(l.port, s);
-    if (!t) continue;
-    if (worktreeExistsIn(where, t.n)) continue;
-    orphans.push({ ...l, ...t });
-  }
-  return orphans;
-}
-async function killGently(pids, graceMs = 2e3) {
-  for (const pid of pids) {
-    try {
-      process.kill(pid, "SIGTERM");
-    } catch {
-    }
-  }
-  if (pids.length === 0) return;
-  await new Promise((r) => setTimeout(r, graceMs));
-  for (const pid of pids) {
-    try {
-      process.kill(pid, "SIGKILL");
-    } catch {
-    }
-  }
-}
-function pidsInWorktree(path, n, s = DEFAULT_PORTS) {
-  const pids = /* @__PURE__ */ new Set();
-  for (const port of [s.backendBase + n, s.frontendBase + n]) for (const p of pidsOnPort(port)) pids.add(p);
-  const matched = run("pgrep", ["-f", `${path}/`]);
-  for (const line of matched.split("\n")) {
-    const pid = Number(line.trim());
-    if (Number.isFinite(pid) && pid > 0 && pid !== process.pid) pids.add(pid);
-  }
-  return [...pids];
-}
-
 // src/inbox.ts
 function matchMembers(rows, query) {
   const q = query.trim().toLowerCase();
@@ -7176,8 +7761,8 @@ async function decideFleet(o) {
 }
 var LOUD_STREAK = 5;
 function since(iso, now = Date.now()) {
-  const ms = Math.max(0, now - Date.parse(iso));
-  const mins = Math.round(ms / 6e4);
+  const ms2 = Math.max(0, now - Date.parse(iso));
+  const mins = Math.round(ms2 / 6e4);
   if (mins < 60) return `${mins}m`;
   const hours = Math.round(mins / 60);
   if (hours < 48) return `${hours}h`;
@@ -7212,8 +7797,8 @@ function nextRoles(decision, ran) {
 }
 
 // src/agents.ts
-import { readFileSync as readFileSync8, existsSync as existsSync12 } from "fs";
-import { join as join11 } from "path";
+import { readFileSync as readFileSync8, existsSync as existsSync13 } from "fs";
+import { join as join12 } from "path";
 import { TablationClient as TablationClient2, StaleWriteError as StaleWriteError6, TablationApiError } from "@tablation/client";
 var PERSONA_NAME = {
   dev: "Developer",
@@ -7227,11 +7812,11 @@ var CREW_AGENT_COLUMN = "agent_id";
 var AgentsSyncError = class extends Error {
 };
 function personaDefaultPrompt(promptsDir, role) {
-  const briefPath = join11(promptsDir, "personas", `lane-${role}.md`);
-  if (!existsSync12(briefPath)) throw new AgentsSyncError(`no brief at ${briefPath}`);
+  const briefPath = join12(promptsDir, "personas", `lane-${role}.md`);
+  if (!existsSync13(briefPath)) throw new AgentsSyncError(`no brief at ${briefPath}`);
   if (role === "pair") return readFileSync8(briefPath, "utf8");
-  const commonPath = join11(promptsDir, "personas", "common.md");
-  if (!existsSync12(commonPath)) throw new AgentsSyncError(`no shared policy at ${commonPath}`);
+  const commonPath = join12(promptsDir, "personas", "common.md");
+  if (!existsSync13(commonPath)) throw new AgentsSyncError(`no shared policy at ${commonPath}`);
   return `${readFileSync8(commonPath, "utf8")}${readFileSync8(briefPath, "utf8")}`;
 }
 async function resolveAgentId(route, role, opts) {
@@ -7898,8 +8483,8 @@ import {
 } from "@tablation/client";
 
 // src/skills.ts
-import { readFileSync as readFileSync9, readdirSync as readdirSync2, existsSync as existsSync13 } from "fs";
-import { join as join12 } from "path";
+import { readFileSync as readFileSync9, readdirSync as readdirSync2, existsSync as existsSync14 } from "fs";
+import { join as join13 } from "path";
 import { parse as parseYaml } from "yaml";
 import { TablationClient as TablationClient3, StaleWriteError as StaleWriteError7, TablationApiError as TablationApiError2 } from "@tablation/client";
 var SkillSyncError = class extends Error {
@@ -7918,9 +8503,9 @@ function parseSkillFile(path) {
   return { name: meta.name, description: meta.description, prompt: body, file: path };
 }
 function listLocalSkills(promptsDir) {
-  const dir = join12(promptsDir, "skills");
-  if (!existsSync13(dir)) return [];
-  return readdirSync2(dir).filter((f) => f.endsWith(".md")).map((f) => parseSkillFile(join12(dir, f)));
+  const dir = join13(promptsDir, "skills");
+  if (!existsSync14(dir)) return [];
+  return readdirSync2(dir).filter((f) => f.endsWith(".md")).map((f) => parseSkillFile(join13(dir, f)));
 }
 async function syncSkills(route, opts) {
   if (!route.resolved) {
@@ -8247,7 +8832,7 @@ function resolveRepoProject(projects, opt, routeAreaId) {
 import { spawnSync as spawnSync2 } from "child_process";
 import { readFileSync as readFileSync10 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 var MCP_SERVER_NAME = "tablation";
 var redact = (s, key) => key ? s.split(key).join("sk_***") : s;
 function mcpUrlFor(baseUrl) {
@@ -8260,7 +8845,7 @@ function runClaude(bin, args) {
 }
 function userScopeEntry(home) {
   try {
-    const j = JSON.parse(readFileSync10(join13(home, ".claude.json"), "utf8"));
+    const j = JSON.parse(readFileSync10(join14(home, ".claude.json"), "utf8"));
     return j.mcpServers?.[MCP_SERVER_NAME];
   } catch {
     return void 0;
@@ -8347,7 +8932,7 @@ function schedulerInstalled(plan, exists, crontab) {
 }
 
 // src/worktree-sweep.ts
-import { existsSync as existsSync14 } from "fs";
+import { existsSync as existsSync15 } from "fs";
 import { basename as basename6 } from "path";
 function planWorktreeSweep(target, tickets, contract) {
   const terminal = new Set(contract.statuses.resolved.filter((s) => s !== contract.statuses.verified));
@@ -8371,7 +8956,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin")
   let removed = 0;
   let keptBranches = 0;
   for (const a of actions) {
-    if (!dryRun && existsSync14(a.path)) {
+    if (!dryRun && existsSync15(a.path)) {
       let dirty = false;
       try {
         dirty = status(a.path).length > 0;
@@ -8459,14 +9044,14 @@ function applyRemoteBranchCleanup(cwd, remote, branches2, dryRun, log) {
 }
 
 // src/stream-sweep.ts
-import { existsSync as existsSync15, readdirSync as readdirSync3, rmSync as rmSync3, statSync as statSync6 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync16, readdirSync as readdirSync3, rmSync as rmSync3, statSync as statSync6 } from "fs";
+import { join as join15 } from "path";
 var DAY_MS2 = 24 * 60 * 60 * 1e3;
 function planStreamSweep(stateDir, retentionDays, now = Date.now()) {
-  const dir = join14(stateDir, "streams");
-  if (!existsSync15(dir)) return [];
+  const dir = join15(stateDir, "streams");
+  if (!existsSync16(dir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
-  return readdirSync3(dir).map((name) => join14(dir, name)).filter((path) => {
+  return readdirSync3(dir).map((name) => join15(dir, name)).filter((path) => {
     try {
       return statSync6(path).mtimeMs < cutoff;
     } catch {
@@ -8493,24 +9078,24 @@ function applyStreamSweep(paths, dryRun, log) {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync14, existsSync as existsSync19, mkdirSync as mkdirSync11, writeFileSync as writeFileSync9, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync } from "fs";
+import { readFileSync as readFileSync14, existsSync as existsSync20, mkdirSync as mkdirSync11, writeFileSync as writeFileSync9, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync } from "fs";
 import { createInterface } from "readline/promises";
 import { dirname as dirOf, resolve as resolvePath } from "path";
 
 // src/ssh-keys.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { existsSync as existsSync16, mkdirSync as mkdirSync8, readFileSync as readFileSync11, chmodSync } from "fs";
-import { dirname as dirname9, join as join15 } from "path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync8, readFileSync as readFileSync11, chmodSync } from "fs";
+import { dirname as dirname10, join as join16 } from "path";
 var SshKeyError = class extends Error {
 };
 function shipSshKeyPathFor(stateDir) {
-  return join15(stateDir, "ssh", "id_ed25519");
+  return join16(stateDir, "ssh", "id_ed25519");
 }
 function ensureShipSshKeypair(stateDir) {
   const privateKeyPath = shipSshKeyPathFor(stateDir);
   const publicKeyPath = `${privateKeyPath}.pub`;
-  if (!existsSync16(privateKeyPath)) {
-    mkdirSync8(dirname9(privateKeyPath), { recursive: true });
+  if (!existsSync17(privateKeyPath)) {
+    mkdirSync8(dirname10(privateKeyPath), { recursive: true });
     try {
       execFileSync3("ssh-keygen", [
         "-t",
@@ -8530,7 +9115,7 @@ function ensureShipSshKeypair(stateDir) {
     }
     chmodSync(privateKeyPath, 384);
   }
-  if (!existsSync16(publicKeyPath)) {
+  if (!existsSync17(publicKeyPath)) {
     throw new SshKeyError(`${privateKeyPath} exists but ${publicKeyPath} does not \u2014 regenerate or restore it`);
   }
   const publicKey = readFileSync11(publicKeyPath, "utf8").trim();
@@ -8747,9 +9332,9 @@ function syncAllPassengerCheckouts(cfg) {
 
 // src/tunnel.ts
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync17, mkdirSync as mkdirSync9, readFileSync as readFileSync12, writeFileSync as writeFileSync7, unlinkSync as unlinkSync3, readdirSync as readdirSync4 } from "fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync9, readFileSync as readFileSync12, writeFileSync as writeFileSync7, unlinkSync as unlinkSync3, readdirSync as readdirSync4 } from "fs";
 import { randomInt } from "crypto";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 var DEFAULT_SPAWN_OPTIONS = { stdio: "ignore", detached: true };
 var defaultSpawn = (cmd, args) => spawn3(cmd, args, DEFAULT_SPAWN_OPTIONS);
 var SLUG_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
@@ -8816,11 +9401,11 @@ function startTunnel(opts) {
   };
 }
 function tunnelStatePath(stateDir, workspaceId) {
-  return join16(stateDir, "passengers", `${workspaceId}.json`);
+  return join17(stateDir, "passengers", `${workspaceId}.json`);
 }
 function readPersistedTunnel(stateDir, workspaceId) {
   const path = tunnelStatePath(stateDir, workspaceId);
-  if (!existsSync17(path)) return void 0;
+  if (!existsSync18(path)) return void 0;
   try {
     return JSON.parse(readFileSync12(path, "utf8"));
   } catch {
@@ -8829,7 +9414,7 @@ function readPersistedTunnel(stateDir, workspaceId) {
 }
 function writePersistedTunnel(stateDir, state) {
   const path = tunnelStatePath(stateDir, state.workspaceId);
-  mkdirSync9(join16(stateDir, "passengers"), { recursive: true });
+  mkdirSync9(join17(stateDir, "passengers"), { recursive: true });
   writeFileSync7(path, `${JSON.stringify(state, null, 2)}
 `);
 }
@@ -8927,8 +9512,8 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
   }
 }
 function readAllPersistedWorkspaceIds(stateDir) {
-  const dir = join16(stateDir, "passengers");
-  if (!existsSync17(dir)) return [];
+  const dir = join17(stateDir, "passengers");
+  if (!existsSync18(dir)) return [];
   return readdirSync4(dir).filter((f) => f.endsWith(".json") && !f.endsWith("-sync.json")).map((f) => f.slice(0, -".json".length));
 }
 
@@ -9049,8 +9634,8 @@ async function unregisterEndpoint(workspaceId, info, d) {
 import { createServer as createHttpServer } from "http";
 import { spawn as spawn4 } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync18, mkdirSync as mkdirSync10, readFileSync as readFileSync13, writeFileSync as writeFileSync8, unlinkSync as unlinkSync4, readdirSync as readdirSync5 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync10, readFileSync as readFileSync13, writeFileSync as writeFileSync8, unlinkSync as unlinkSync4, readdirSync as readdirSync5 } from "fs";
+import { join as join18 } from "path";
 
 // src/secret-compare.ts
 import { timingSafeEqual } from "crypto";
@@ -9139,11 +9724,11 @@ var defaultSpawn2 = (cmd, args, env) => {
   return child;
 };
 function syncDaemonStatePath(stateDir, workspaceId) {
-  return join17(stateDir, "passengers", `${workspaceId}-sync.json`);
+  return join18(stateDir, "passengers", `${workspaceId}-sync.json`);
 }
 function readPersistedSyncDaemon(stateDir, workspaceId) {
   const path = syncDaemonStatePath(stateDir, workspaceId);
-  if (!existsSync18(path)) return void 0;
+  if (!existsSync19(path)) return void 0;
   try {
     return JSON.parse(readFileSync13(path, "utf8"));
   } catch {
@@ -9152,7 +9737,7 @@ function readPersistedSyncDaemon(stateDir, workspaceId) {
 }
 function writePersistedSyncDaemon(stateDir, state) {
   const path = syncDaemonStatePath(stateDir, state.workspaceId);
-  mkdirSync10(join17(stateDir, "passengers"), { recursive: true });
+  mkdirSync10(join18(stateDir, "passengers"), { recursive: true });
   writeFileSync8(path, `${JSON.stringify(state, null, 2)}
 `);
 }
@@ -9163,8 +9748,8 @@ function removePersistedSyncDaemon(stateDir, workspaceId) {
   } catch {
   }
 }
-function sleepSync2(ms) {
-  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+function sleepSync2(ms2) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms2);
 }
 function waitForExit(pid, alive, timeoutMs = 5e3) {
   const deadline = Date.now() + timeoutMs;
@@ -9173,8 +9758,8 @@ function waitForExit(pid, alive, timeoutMs = 5e3) {
   }
 }
 function readAllPersistedSyncWorkspaceIds(stateDir) {
-  const dir = join17(stateDir, "passengers");
-  if (!existsSync18(dir)) return [];
+  const dir = join18(stateDir, "passengers");
+  if (!existsSync19(dir)) return [];
   const suffix = "-sync.json";
   return readdirSync5(dir).filter((f) => f.endsWith(suffix)).map((f) => f.slice(0, -suffix.length));
 }
@@ -9232,10 +9817,10 @@ function syncPassengerSyncDaemons(plans, cfg, stateDir, deps = {}) {
 
 // src/daemon.ts
 import { readdirSync as readdirSync6, statSync as statSync7 } from "fs";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 var DEFAULT_FLOOR_MS = 5e3;
 var DEFAULT_CEILING_MS = INTERVAL_SECONDS * 1e3;
-var defaultSleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+var defaultSleep = (ms2) => new Promise((resolve5) => setTimeout(resolve5, ms2));
 async function runDaemonLoop(o) {
   const floor = o.floorMs ?? DEFAULT_FLOOR_MS;
   const ceiling = o.ceilingMs ?? DEFAULT_CEILING_MS;
@@ -9271,7 +9856,7 @@ function latestMtime(path) {
   if (!stat.isDirectory()) return 0;
   let latest = stat.mtimeMs;
   for (const entry of readdirSync6(path, { withFileTypes: true })) {
-    latest = Math.max(latest, latestMtime(join18(path, entry.name)));
+    latest = Math.max(latest, latestMtime(join19(path, entry.name)));
   }
   return latest;
 }
@@ -9338,6 +9923,24 @@ async function runOnePass(o) {
     const tracker = new Tracker(o.route, o.ship);
     await applyHoldReleases(tracker, decision.holdReleases, tracker.contract, emit);
   }
+  {
+    const tracker = new Tracker(o.route, o.ship);
+    const memberId = o.route.resolved?.seats.qa ?? o.route.resolved?.seats.dev;
+    try {
+      if (memberId) await runStalledSweep({
+        tracker,
+        state: o.state,
+        emit,
+        route: o.route,
+        ship: o.ship,
+        ships: decision.ships,
+        memberId,
+        myShipId: shipIdByName(decision.ships, o.ship.name)
+      }, decision.stalled ?? []);
+    } catch (e) {
+      emit.warn(`could not sweep stalled tickets: ${e.message}`, { step: "sweep" });
+    }
+  }
   const order = [...decision.selection.pending].sort(
     (a, b) => (decision.selection.ranks[a] ?? Number.POSITIVE_INFINITY) - (decision.selection.ranks[b] ?? Number.POSITIVE_INFINITY)
   );
@@ -9499,6 +10102,7 @@ async function runRoleAgent(role, decision, ctx) {
   }
   try {
     await spawnAgent(plan, emit);
+    await guardRunHandoff(route, ship, tracker, role, workingId, emit);
   } finally {
     if (memberId) {
       try {
@@ -9536,7 +10140,7 @@ async function buildEnvironment(route, ship, ticket) {
 }
 
 // src/cli.ts
-var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname10(process.execPath) : resolve4(dirname10(fileURLToPath(import.meta.url)), "..");
+var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname11(process.execPath) : resolve4(dirname11(fileURLToPath(import.meta.url)), "..");
 var RELEASE_LOCK_TTL_MS = 20 * 60 * 1e3;
 var CYCLE_SECONDS2 = 120;
 var STALE_CYCLES = 3;
@@ -9661,6 +10265,7 @@ function usage() {
   crew reap [route]              kill orphaned servers, drop worktrees for closed tickets
   crew drop [route] NNN          remove a merged ticket's worktree and branch
   crew rotate-passenger-url [route]   force a Host Passengers tunnel to reconnect with a fresh public URL
+  crew worktree [route] NNN      cut (or refresh) this run's worktree for a ticket from the remote; prints its path
   crew unassign [route] NNN      hand back a session's ticket \u2014 clears assignee, next cycle picks it up
   crew sync [route]              fast-forward the checkout and its worktrees from the remote
   crew pause|resume [route] [R|release]  pause everything, one role, or releases only (merge/deploy/release; passengers keeps running).
@@ -10025,8 +10630,8 @@ if (command === "passenger-sync-daemon") {
     }
     if (host === "linux" && hasSystemd) {
       const label = labelFor(CREW_HOME, "run");
-      const staleTimer = join19(homedir5(), ".config", "systemd", "user", `${label}.timer`);
-      if (existsSync19(staleTimer)) {
+      const staleTimer = join20(homedir5(), ".config", "systemd", "user", `${label}.timer`);
+      if (existsSync20(staleTimer)) {
         process.stdout.write(
           `removing stale run timer from before the persistent-service cutover: ${staleTimer}${dryRun ? " (dry run)" : ""}
 `
@@ -10052,7 +10657,7 @@ if (command === "passenger-sync-daemon") {
     const tracker = new Tracker(c, cfg.ship);
     problems.push(...validateContract(tracker.contract).map((p) => `contract: ${p}`));
     for (const r of await resolvedRepos(c)) {
-      if (!existsSync19(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
+      if (!existsSync20(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
       if (!satisfies(host, r.config.platform)) problems.push(`repo ${r.name}: requires ${r.config.platform}, this host is ${host}`);
       problems.push(...validateEffective(r.config).map((p) => `repo ${r.name}: ${p}`));
     }
@@ -10070,7 +10675,7 @@ if (command === "passenger-sync-daemon") {
   }
   async function doctorFix(o) {
     const routes = await Promise.all(routesInScope(cfg.routes, named).map((c) => gatherHealth({ route: c.route, enabled: c.enabled, hasRepos: reposOf(c).length > 0 }, () => routeProblems(c))));
-    const unitExists = (p) => existsSync19(p);
+    const unitExists = (p) => existsSync20(p);
     const crontab = o.host === "linux" ? spawnSync3("crontab", ["-l"], { encoding: "utf8" }).stdout ?? "" : "";
     const schedulerAbsent = o.host !== "windows" ? !schedulerInstalled(planInstall(cfg.ship, CREW_HOME, o.host, detectSystemd(), "run"), unitExists, crontab) : true;
     const plan = planFix({ routes, schedulerAbsent, host: o.host });
@@ -10213,6 +10818,10 @@ ${changed2.map((c) => `  - ${c}
           return { scope, tests: "skipped", outcome: "skipped", detail: `release ${why} on the board` };
         }
         boardLock = got;
+        remit.emit(
+          got.exclusion === "taken" ? `took board lock ${scope}` : `this board has no Locks table \u2014 cross-ship exclusion for ${scope} is OFF`,
+          { step: "release" }
+        );
       }
       const all = await tracker.openTickets();
       const { byRepo, unplaceable } = ticketsByRepo(c, all);
@@ -10226,6 +10835,7 @@ ${changed2.map((c) => `  - ${c}
         emit: remit,
         scope,
         state: state.release(scope),
+        reviewColumns: repo.release.mode === "external" ? await tracker.reviewColumns() : void 0,
         dryRun,
         skipTests: flag("skip-tests"),
         shell: cfg.ship.shell,
@@ -10288,6 +10898,18 @@ ${changed2.map((c) => `  - ${c}
       if (outcome.externalClosures?.length) {
         await applyExternalClosures(tracker, outcome.externalClosures, tracker.contract, remit, dryRun, target.dir);
       }
+      if (outcome.review) {
+        await applyReview(
+          tracker,
+          tracker.contract,
+          outcome.review,
+          repo.branch.remote,
+          remit,
+          releaseSeat(c),
+          await tracker.reviewColumns(),
+          dryRun
+        );
+      }
       const news = describeRelease(outcome, scope);
       if (news) {
         const notified = await notify(c, cfg.ship, news, remit, dryRun);
@@ -10594,6 +11216,7 @@ ${changed2.map((c) => `  - ${c}
         }
         try {
           await spawnAgent(fleetPlan, wemit);
+          await guardRunHandoff(w.route, cfg.ship, fleetTracker, w.role, fleetWorkingId, wemit);
         } finally {
           dropLock();
           if (fleetMemberId) {
@@ -10804,6 +11427,7 @@ ${changed2.map((c) => `  - ${c}
         }
         try {
           await spawnAgent(plan, emit);
+          await guardRunHandoff(route, cfg.ship, tracker2, current, workingId, emit);
         } finally {
           dropLock();
           if (memberId) {
@@ -10901,7 +11525,7 @@ ${changed2.map((c) => `  - ${c}
         process.exit(1);
       }
       requireArmed("run the daemon loop");
-      const watchPaths = isCompiledBinary(import.meta.url) ? [process.execPath] : [join19(CREW_HOME, "src"), join19(CREW_HOME, "dist"), join19(CREW_HOME, "bin")];
+      const watchPaths = isCompiledBinary(import.meta.url) ? [process.execPath] : [join20(CREW_HOME, "src"), join20(CREW_HOME, "dist"), join20(CREW_HOME, "bin")];
       const spawnBreaker = new SpawnBreaker();
       const stopReason = await runDaemonLoop({
         runPass: () => runOnePass({
@@ -11049,7 +11673,7 @@ ${changed2.map((c) => `  - ${c}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync19(resolvedPath) ? JSON.parse(readFileSync14(resolvedPath, "utf8")) : {};
+        const raw = existsSync20(resolvedPath) ? JSON.parse(readFileSync14(resolvedPath, "utf8")) : {};
         raw.agentPersonas = personaResult.agentPersonas;
         raw.agentSkills = skillResult.agentSkills;
         mkdirSync11(dirOf(resolvedPath), { recursive: true });
@@ -11098,7 +11722,7 @@ ${changed2.map((c) => `  - ${c}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync19(resolvedPath) ? JSON.parse(readFileSync14(resolvedPath, "utf8")) : {};
+        const raw = existsSync20(resolvedPath) ? JSON.parse(readFileSync14(resolvedPath, "utf8")) : {};
         raw.agentSkills = result.agentSkills;
         mkdirSync11(dirOf(resolvedPath), { recursive: true });
         writeFileSync9(resolvedPath, `${JSON.stringify(raw, null, 2)}
@@ -11121,7 +11745,7 @@ ${changed2.map((c) => `  - ${c}
       if (sub === "list" && !routeName) usage2();
       if (sub === "add") {
         try {
-          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync19(resolvePath(p.replace(/^~(?=\/|$)/, homedir5()))));
+          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync20(resolvePath(p.replace(/^~(?=\/|$)/, homedir5()))));
           routeName = a.route;
           addPath = a.path;
           addName = a.name;
@@ -11136,7 +11760,7 @@ ${changed2.map((c) => `  - ${c}
       }
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, routeName);
       let resolvedRemotes;
-      if (existsSync19(resolvedFile)) {
+      if (existsSync20(resolvedFile)) {
         try {
           resolvedRemotes = JSON.parse(readFileSync14(resolvedFile, "utf8"));
         } catch {
@@ -11144,7 +11768,7 @@ ${changed2.map((c) => `  - ${c}
       }
       const originOf = (dir) => gitOk(dir, ["remote", "get-url", "origin"]) ?? void 0;
       const text = configText;
-      const base = dirname10(cfg.configFile);
+      const base = dirname11(cfg.configFile);
       try {
         if (sub === "list") {
           const repos = configuredRepos(text, routeName, base);
@@ -11153,14 +11777,14 @@ ${changed2.map((c) => `  - ${c}
           for (const r of repos) {
             const origin2 = originOf(r.dir);
             const row = matchRepoName(origin2, resolvedRemotes);
-            const note = !existsSync19(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
+            const note = !existsSync20(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
             process.stdout.write(`${r.name}	${r.dir}	${note}
 `);
           }
           break;
         }
         const target = resolvePath(addPath.replace(/^~(?=\/|$)/, homedir5()));
-        const top = existsSync19(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
+        const top = existsSync20(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
         if (!top) throw new ReposError(`${target} is not a git checkout`);
         const origin = originOf(top);
         const plan = planRepoAdd({
@@ -11208,7 +11832,7 @@ ${changed2.map((c) => `  - ${c}
           const created = await rowTracker.createRepoRow(rowPayload);
           process.stdout.write(`created Repos row ${String(rowPayload.name)} (${String(rowPayload.remote)}) ${created.id}
 `);
-          if (existsSync19(resolvedFile)) {
+          if (existsSync20(resolvedFile)) {
             const raw = JSON.parse(readFileSync14(resolvedFile, "utf8"));
             raw.repoNames = { ...raw.repoNames, [created.id]: String(rowPayload.name) };
             raw.repoRemotes = { ...raw.repoRemotes, [created.id]: String(rowPayload.remote) };
@@ -11453,7 +12077,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           operator = await pickOperator(found.holds);
         }
         let previous;
-        const hadPreviousFile = existsSync19(resolvedPath);
+        const hadPreviousFile = existsSync20(resolvedPath);
         if (hadPreviousFile) {
           try {
             previous = JSON.parse(readFileSync14(resolvedPath, "utf8"));
@@ -11517,7 +12141,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           process.stderr.write(`(dry run) would write resolved ids to ${resolvedPath}
 `);
         } else {
-          mkdirSync11(dirname10(resolvedPath), { recursive: true });
+          mkdirSync11(dirname11(resolvedPath), { recursive: true });
           if (hadPreviousFile) copyFileSync2(resolvedPath, `${resolvedPath}.bak`);
           const tmpPath = `${resolvedPath}.tmp${process.pid}`;
           writeFileSync9(tmpPath, `${JSON.stringify(resolved, null, 2)}
@@ -11534,7 +12158,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
             process.stderr.write(`(dry run) would write the minted API key to ${apiKeyFile}
 `);
           } else {
-            mkdirSync11(dirname10(apiKeyFile), { recursive: true });
+            mkdirSync11(dirname11(apiKeyFile), { recursive: true });
             writeFileSync9(apiKeyFile, `${apiKeyVar}=${apiKey}
 `, { mode: 384 });
             process.stderr.write(`API key written to ${apiKeyFile}
@@ -11544,7 +12168,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
         const keyPersisted = keychainBacked || apiKeyFile !== void 0;
         const wizard = firstRun;
         const writeFirstRun = wizard !== void 0 && !dryRun && keyPersisted;
-        const routeDir = value("dir") ?? (writeFirstRun ? join19(DEFAULT_REPOS_BASE_PATH, found.workspaceSlug) : void 0);
+        const routeDir = value("dir") ?? (writeFirstRun ? join20(DEFAULT_REPOS_BASE_PATH, found.workspaceSlug) : void 0);
         const routeBlock = renderConnection(
           found,
           route2,
@@ -11859,6 +12483,40 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
       emit.emit(`rotated the passenger tunnel for ${route.route} \u2014 it reconnects under a fresh slug and the registered endpoint follows on the next passengers cycle`);
       break;
     }
+    case "worktree": {
+      emit.enter("worktree");
+      const rawWt = positional[2] ?? positional[1];
+      const nWt = rawWt ? parseTicketNumber(rawWt) : null;
+      if (!nWt) {
+        process.stderr.write("worktree: need a ticket number (326, ISSUE-326, or TABL-326)\n");
+        process.exit(2);
+      }
+      const trackerWt = new Tracker(route, cfg.ship);
+      const cWt = trackerWt.contract;
+      const ticketWt = (await trackerWt.openTickets()).find((t) => t[cWt.columns.key] === `ISSUE-${nWt}`);
+      if (!ticketWt) {
+        process.stderr.write(`worktree: no open ticket ISSUE-${nWt} on ${route.route}
+`);
+        process.exit(2);
+      }
+      const repoWt = (await resolvedRepos(route)).find((r) => r.id === ticketWt.repo_id) ?? (await resolvedRepos(route))[0];
+      if (!repoWt) {
+        process.stderr.write("worktree: this route has no repository\n");
+        process.exit(2);
+      }
+      const roleWt = positional.find((p) => p === "dev" || p === "design" || p === "qa");
+      const planWt = planRunWorktree(repoWt.dir, repoWt.config, ticketWt, roleWt);
+      if (dryRun) {
+        emit.emit(`would ${describeRunWorktreePlan(planWt)}`);
+        break;
+      }
+      const pathWt = applyRunWorktree(repoWt.dir, repoWt.config, planWt);
+      emit.emit(describeRunWorktreePlan(planWt));
+      if (pathWt) process.stdout.write(`${pathWt}
+`);
+      if (!planIsUsable(planWt)) process.exitCode = 1;
+      break;
+    }
     case "unassign": {
       emit.enter("select");
       const rawUnassign = positional[2] ?? positional[1];
@@ -12027,6 +12685,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
       const engagedTicketIds = shipRows.map((s) => s.engaged_ticket_id).filter((id) => !!id);
       const engagedTickets = engagedTicketIds.length ? await statusTracker.ticketsByIds(engagedTicketIds) : [];
       const issueLabelById = new Map(engagedTickets.map((t) => [t.id, t.issue_id]));
+      const todo = await statusTracker.openTickets().then((open) => operatorTodo(open, statusTracker.contract, route.resolved?.operator ?? "")).catch(() => []);
       if (flag("json")) {
         const repos = await resolvedRepos(route);
         const seatIds = route.resolved?.seats ?? {};
@@ -12063,6 +12722,8 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
             // derived `release_stale`. `version` stays 1.
             attention: openShipAttention(state)
           },
+          // Additive (CREW-1402): what the operator owes. `version` stays 1.
+          todo: todo.map((i) => ({ ticket: displayKey(i.ticket), title: i.ticket.title ?? null, reasons: i.reasons })),
           crew: {
             paused: state.isPaused(),
             // The release timer honors the whole-crew pause too, so this is
@@ -12109,6 +12770,15 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
 `);
         break;
       }
+      const owed = [
+        ...todo.map((i) => `${displayKey(i.ticket)} \u2014 ${i.reasons.join(", ")}${i.ticket.title ? ` \u2014 ${i.ticket.title}` : ""}`),
+        ...openShipAttention(state).map((i) => `ship ${cfg.ship.name}: ${i.kind} \u2014 ${i.message}`),
+        ...shipRows.filter((s) => s.name !== cfg.ship.name).flatMap((s) => (s.attention ?? []).map((i) => `ship ${s.name}: ${i.kind} \u2014 ${i.message}`))
+      ];
+      if (owed.length) process.stdout.write(`to do (${owed.length}):
+${owed.map((l) => `  ${l}
+`).join("")}
+`);
       process.stdout.write(
         `ship:       ${cfg.ship.name} (${cfg.ship.platform})
 route:      ${route.route} -> ${route.dir}