@tablation/crew 0.94.0 → 0.96.0

package/dist/cli.js

@@ -2602,6 +2602,22 @@ function parseCloneScheme(v) {
   if (v === "ssh" || v === "https") return v;
   throw new ConfigError(`ship.cloneScheme must be "ssh" or "https", got ${JSON.stringify(v)}`);
 }
+function parseShipEnv(v) {
+  if (v === void 0 || v === null) return void 0;
+  if (typeof v !== "object" || Array.isArray(v)) throw new ConfigError("ship.env must be a map of variable name to value");
+  const out = {};
+  for (const [k, val] of Object.entries(v)) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(k)) throw new ConfigError(`ship.env: "${k}" is not a valid variable name`);
+    if (k === "PATH") throw new ConfigError("ship.env: PATH is set from ship.extraPath, not here");
+    if (typeof val !== "string" && typeof val !== "number" && typeof val !== "boolean") {
+      throw new ConfigError(`ship.env.${k} must be a string, number or boolean`);
+    }
+    const text = String(val);
+    if (/[\r\n\0]/.test(text)) throw new ConfigError(`ship.env.${k} must be a single line`);
+    out[k] = text;
+  }
+  return Object.keys(out).length ? out : void 0;
+}
 function parseShipForges(v) {
   try {
     return parseForges(v);
@@ -2641,7 +2657,8 @@ var SHIP_KEYS = /* @__PURE__ */ new Set([
   "previewHost",
   "maxPeriscopes",
   "periscopeIdleMinutes",
-  "secretStore"
+  "secretStore",
+  "env"
 ]);
 var ROUTE_KEYS = /* @__PURE__ */ new Set([
   "route",
@@ -2665,7 +2682,8 @@ var ROUTE_KEYS = /* @__PURE__ */ new Set([
   "promptSet",
   "hostPassengers",
   "hostPeriscopes",
-  "toolchain"
+  "toolchain",
+  "maxRunMinutes"
 ]);
 function parseWorktreeName(v, where, file) {
   const problem = typeof v === "string" ? worktreeNameProblem(v) : "must be a string";
@@ -3064,7 +3082,8 @@ Create the first of those:
       previewHost: shipRaw.previewHost ? String(shipRaw.previewHost).trim() || void 0 : void 0,
       maxPeriscopes,
       periscopeIdleMinutes,
-      secretStore
+      secretStore,
+      env: parseShipEnv(shipRaw.env)
     },
     routes,
     crewHome,
@@ -3075,7 +3094,21 @@ Create the first of those:
 function expandCommand(cmd, base) {
   return cmd.includes("/") || cmd.startsWith("~") ? expand(cmd, base) : cmd;
 }
-var TOOLCHAIN_KEYS = /* @__PURE__ */ new Set(["harness", "bin", "launcher", "launcherBin", "model", "tiers", "args", "env", "maxThinkingTokens", "auth"]);
+var TOOLCHAIN_KEYS = /* @__PURE__ */ new Set(["harness", "bin", "launcher", "launcherBin", "model", "tiers", "args", "env", "maxThinkingTokens", "auth", "maxRunMinutes"]);
+var MAX_RUN_MINUTES_CEILING = Math.floor((2 ** 31 - 1) / 6e4);
+function parseMaxRunMinutes(raw, where, missing) {
+  if (raw === void 0) return void 0;
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n < 0) {
+    missing.add(`${where} must be a non-negative integer number of minutes, 0 for no limit (got "${String(raw)}")`);
+    return void 0;
+  }
+  if (n > MAX_RUN_MINUTES_CEILING) {
+    missing.add(`${where} is too large (${n}); the most it can be is ${MAX_RUN_MINUTES_CEILING} minutes \u2014 use 0 for no limit`);
+    return void 0;
+  }
+  return n;
+}
 function parsePair(raw, missing) {
   if (raw === void 0) return void 0;
   if (!Array.isArray(raw)) {
@@ -3132,6 +3165,7 @@ function parseToolchains(raw, base, missing, file) {
     if (!Number.isInteger(maxThinkingTokens) || maxThinkingTokens < 0) {
       missing.add(`${where}.maxThinkingTokens must be a non-negative integer (got "${entryRaw.maxThinkingTokens}")`);
     }
+    const maxRunMinutes = parseMaxRunMinutes(entryRaw.maxRunMinutes, `${where}.maxRunMinutes`, missing);
     let auth;
     if (entryRaw.auth !== void 0) {
       if (entryRaw.auth !== "subscription" && entryRaw.auth !== "inherit") {
@@ -3153,7 +3187,8 @@ function parseToolchains(raw, base, missing, file) {
       tiers,
       args: Array.isArray(args) ? args.map(String) : [],
       env: Object.fromEntries(Object.entries(env).map(([k, v]) => [k, String(v)])),
-      maxThinkingTokens
+      maxThinkingTokens,
+      ...maxRunMinutes !== void 0 ? { maxRunMinutes } : {}
     });
   }
   return out;
@@ -3161,6 +3196,7 @@ function parseToolchains(raw, base, missing, file) {
 function parseOneRoute(c, where, file, base, stateDir, raw, missing, crewHome, toolchainNames) {
   rejectUnknownKeys(c, ROUTE_KEYS, `${where}`, file);
   const toolchain = c?.toolchain === void 0 ? void 0 : String(c.toolchain);
+  const maxRunMinutes = parseMaxRunMinutes(c?.maxRunMinutes, `${where}.maxRunMinutes`, missing);
   if (toolchain !== void 0 && !toolchainNames.has(toolchain)) {
     missing.add(`${where}.toolchain "${toolchain}" is not defined in ship.toolchains (have: ${[...toolchainNames].join(", ")})`);
   }
@@ -3224,6 +3260,7 @@ function parseOneRoute(c, where, file, base, stateDir, raw, missing, crewHome, t
     repoOverrides,
     worktreePrefix: c?.worktreePrefix ? String(c.worktreePrefix) : void 0,
     ...toolchain !== void 0 ? { toolchain } : {},
+    ...maxRunMinutes !== void 0 ? { maxRunMinutes } : {},
     promptsDir: resolvePromptsDir(c?.promptSet ? String(c.promptSet) : void 0, crewHome, base),
     weight,
     baseUrl: String(c?.baseUrl ?? raw.ship?.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, ""),
@@ -3698,7 +3735,7 @@ function recoveredFailureHeadlines(o, route2) {
 
 // src/install.ts
 import { dirname as dirname5, join as join13, extname } from "path";
-import { homedir as homedir7 } from "os";
+import { homedir as homedir7, userInfo } from "os";
 import { accessSync as accessSync2, constants as constants2, existsSync as existsSync11, mkdirSync as mkdirSync7, readdirSync as readdirSync3, readFileSync as readFileSync12, statSync as statSync4, writeFileSync as writeFileSync8, unlinkSync, realpathSync } from "fs";
 import { spawnSync as spawnSync4 } from "child_process";
 import { createHash as createHash3 } from "crypto";
@@ -3766,6 +3803,30 @@ function dockerPathProblem(ship, shellPath = process.env.PATH ?? "") {
   const inShell = findOnPath("docker", shellPath);
   return inShell ? `\`docker\` is not on the scheduler PATH (${schedulerPath}) but is at ${inShell} in your shell; add ${dirname5(inShell)} to ship.extraPath in crew.yaml and run \`crew install\`` : `\`docker\` is not on the scheduler PATH (${schedulerPath}) or your shell PATH; install Docker, then add its directory to ship.extraPath in crew.yaml and run \`crew install\``;
 }
+var USER_INSTALL = { root: false, user: "" };
+function installContext(env = process.env) {
+  const root = typeof process.getuid === "function" && process.getuid() === 0;
+  const user = root && env.SUDO_USER || userInfo().username;
+  return { root, user };
+}
+var SYSTEM_UNIT_DIR = "/etc/systemd/system";
+function systemUnitPathFor(label, suffix = "service") {
+  return join13(SYSTEM_UNIT_DIR, `${label}.${suffix}`);
+}
+function unitEnvironment(ship) {
+  return [["PATH", pathFor(ship)], ...Object.entries(ship.env ?? {})];
+}
+function systemdEnvLines(ship) {
+  return unitEnvironment(ship).map(([k, v]) => {
+    if (k === "PATH") return `Environment=PATH=${v}`;
+    const escaped = `${k}=${v}`.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/%/g, "%%");
+    return `Environment="${escaped}"`;
+  }).join("\n");
+}
+function shQuote(v) {
+  if (/^[A-Za-z0-9_/.:,@%+=-]+$/.test(v)) return v;
+  return `'${v.replace(/'/g, `'\\''`)}'`;
+}
 function xmlEscape(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
@@ -3798,8 +3859,8 @@ function planLaunchd(ship, crewHome, job) {
   </array>
   <key>EnvironmentVariables</key>
   <dict>
-    <key>PATH</key>
-    <string>${xmlEscape(pathFor(ship))}</string>
+${unitEnvironment(ship).map(([k, v]) => `    <key>${xmlEscape(k)}</key>
+    <string>${xmlEscape(v)}</string>`).join("\n")}
   </dict>
   <key>WorkingDirectory</key>
   <string>${xmlEscape(crewHome)}</string>
@@ -3823,9 +3884,17 @@ ${scheduleKeys}
     schedulerLog
   };
 }
-function planSystemd(ship, crewHome, job) {
+function planSystemd(ship, crewHome, job, ctx) {
   const label = labelFor(crewHome, job);
-  const unitDir = join13(homedir7(), ".config", "systemd", "user");
+  const unitDir = ctx.root ? SYSTEM_UNIT_DIR : join13(homedir7(), ".config", "systemd", "user");
+  const ctl = ctx.root ? ["systemctl"] : ["systemctl", "--user"];
+  const userLine = ctx.root && ctx.user && ctx.user !== "root" ? `User=${ctx.user}
+` : "";
+  const wantedBy = ctx.root ? "multi-user.target" : "default.target";
+  const linger = ctx.root || !ctx.user ? {} : {
+    lingerCommand: ["loginctl", "enable-linger", ctx.user],
+    lingerHint: `the daemon will stop when ${ctx.user} logs out; run \`sudo loginctl enable-linger ${ctx.user}\` once, or run \`crew install\` as root for a system unit`
+  };
   const servicePath = join13(unitDir, `${label}.service`);
   const crewLog = ship.logFile;
   const schedulerLog = schedulerLogFor(crewLog, job);
@@ -3837,9 +3906,9 @@ Description=${description}
 
 [Service]
 Type=simple
-ExecStart=${[...crewInvocation(crewHome), ...subcommandFor(job, "systemd")].join(" ")}
+${userLine}ExecStart=${[...crewInvocation(crewHome), ...subcommandFor(job, "systemd")].join(" ")}
 WorkingDirectory=${crewHome}
-Environment=PATH=${pathFor(ship)}
+${systemdEnvLines(ship)}
 StandardOutput=append:${schedulerLog}
 StandardError=append:${schedulerLog}
 Restart=on-failure
@@ -3849,7 +3918,7 @@ RestartSec=5
 KillMode=process
 
 [Install]
-WantedBy=default.target
+WantedBy=${wantedBy}
 `;
     return {
       mechanism: "systemd",
@@ -3859,11 +3928,12 @@ WantedBy=default.target
       cronMarker: null,
       preLoadCommands: [],
       loadCommands: [
-        ["systemctl", "--user", "daemon-reload"],
-        ["systemctl", "--user", "enable", "--now", `${label}.service`]
+        [...ctl, "daemon-reload"],
+        [...ctl, "enable", "--now", `${label}.service`]
       ],
       crewLog,
-      schedulerLog
+      schedulerLog,
+      ...linger
     };
   }
   const timerPath = join13(unitDir, `${label}.timer`);
@@ -3873,9 +3943,9 @@ Description=${description}
 
 [Service]
 Type=oneshot
-ExecStart=${[...crewInvocation(crewHome), ...subcommandFor(job, "systemd")].join(" ")}
+${userLine}ExecStart=${[...crewInvocation(crewHome), ...subcommandFor(job, "systemd")].join(" ")}
 WorkingDirectory=${crewHome}
-Environment=PATH=${pathFor(ship)}
+${systemdEnvLines(ship)}
 StandardOutput=append:${schedulerLog}
 StandardError=append:${schedulerLog}
 `;
@@ -3899,11 +3969,12 @@ WantedBy=timers.target
     cronMarker: null,
     preLoadCommands: [],
     loadCommands: [
-      ["systemctl", "--user", "daemon-reload"],
-      ["systemctl", "--user", "enable", "--now", `${label}.timer`]
+      [...ctl, "daemon-reload"],
+      [...ctl, "enable", "--now", `${label}.timer`]
     ],
     crewLog,
-    schedulerLog
+    schedulerLog,
+    ...linger
   };
 }
 function planCron(ship, crewHome, job) {
@@ -3911,7 +3982,7 @@ function planCron(ship, crewHome, job) {
   const crewLog = ship.logFile;
   const schedulerLog = schedulerLogFor(crewLog, job);
   const minutes = Math.max(1, Math.round(INTERVAL_SECONDS / 60));
-  const line = `*/${minutes} * * * * cd ${crewHome} && PATH=${pathFor(ship)} ${[...crewInvocation(crewHome), ...subcommandFor(job, "cron")].join(" ")} >> ${schedulerLog} 2>&1`;
+  const line = `*/${minutes} * * * * cd ${crewHome} && ${unitEnvironment(ship).map(([k, v]) => `${k}=${shQuote(v)}`).join(" ")} ${[...crewInvocation(crewHome), ...subcommandFor(job, "cron")].join(" ")} >> ${schedulerLog} 2>&1`;
   return {
     mechanism: "cron",
     unitPaths: [],
@@ -3931,9 +4002,9 @@ function unitAbandonsAgents(plan, read) {
   if (text === null) return null;
   return plan.mechanism === "launchd" ? /<key>AbandonProcessGroup<\/key>\s*<true\/>/.test(text) : /^KillMode=process\s*$/m.test(text);
 }
-function planInstall(ship, crewHome, hostShip, hasSystemd, job = "run") {
+function planInstall(ship, crewHome, hostShip, hasSystemd, job = "run", ctx = USER_INSTALL) {
   if (hostShip === "macos") return planLaunchd(ship, crewHome, job);
-  if (hostShip === "linux" && hasSystemd) return planSystemd(ship, crewHome, job);
+  if (hostShip === "linux" && hasSystemd) return planSystemd(ship, crewHome, job, ctx);
   if (hostShip === "linux") return planCron(ship, crewHome, job);
   throw new Error(`crew install: no scheduler support yet for ${hostShip} (Windows is planned, not built)`);
 }
@@ -3950,20 +4021,22 @@ function planUninstall(ship, crewHome, hostShip, hasSystemd, job = "run") {
     };
   }
   if (hostShip === "linux" && hasSystemd) {
-    const unitDir = join13(homedir7(), ".config", "systemd", "user");
+    const system = existsSync11(systemUnitPathFor(label));
+    const unitDir = system ? SYSTEM_UNIT_DIR : join13(homedir7(), ".config", "systemd", "user");
+    const ctl = system ? ["systemctl"] : ["systemctl", "--user"];
     if (job === "run") {
       return {
         mechanism: "systemd",
         unitPaths: [join13(unitDir, `${label}.service`)],
         crontabLine: null,
-        unloadCommands: [["systemctl", "--user", "disable", "--now", `${label}.service`]]
+        unloadCommands: [[...ctl, "disable", "--now", `${label}.service`]]
       };
     }
     return {
       mechanism: "systemd",
       unitPaths: [join13(unitDir, `${label}.service`), join13(unitDir, `${label}.timer`)],
       crontabLine: null,
-      unloadCommands: [["systemctl", "--user", "disable", "--now", `${label}.timer`]]
+      unloadCommands: [[...ctl, "disable", "--now", `${label}.timer`]]
     };
   }
   if (hostShip === "linux") {
@@ -3989,11 +4062,12 @@ function planDaemonControl(crewHome, hostShip, hasSystemd) {
   }
   if (hostShip === "linux" && hasSystemd) {
     const unit = `${label}.service`;
+    const ctl = existsSync11(systemUnitPathFor(label)) ? ["systemctl"] : ["systemctl", "--user"];
     return {
       mechanism: "systemd",
-      startCommand: ["systemctl", "--user", "start", unit],
-      stopCommand: ["systemctl", "--user", "stop", unit],
-      statusCommand: ["systemctl", "--user", "status", unit]
+      startCommand: [...ctl, "start", unit],
+      stopCommand: [...ctl, "stop", unit],
+      statusCommand: [...ctl, "status", unit]
     };
   }
   if (hostShip === "linux") {
@@ -4014,11 +4088,14 @@ function runAll(commands, cwd, log) {
   return true;
 }
 async function applyInstall(plan, crewHome, dryRun, log) {
+  let changed2 = plan.crontabLine !== null;
   for (const path of plan.unitPaths) {
     if (dryRun) {
       log.emit(`would write ${path}`);
       continue;
     }
+    const before = existsSync11(path) ? readFileSync12(path, "utf8") : null;
+    if (before !== plan.unitContent[path]) changed2 = true;
     mkdirSync7(dirname5(path), { recursive: true });
     writeFileSync8(path, plan.unitContent[path]);
     log.emit(`wrote ${path}`);
@@ -4048,8 +4125,18 @@ async function applyInstall(plan, crewHome, dryRun, log) {
       log.emit(`loaded (${plan.mechanism}), firing every ${INTERVAL_SECONDS}s starting ${INTERVAL_SECONDS}s from now`);
     }
   }
+  if (plan.lingerCommand) {
+    if (dryRun) {
+      log.emit(`would run: ${plan.lingerCommand.join(" ")}`);
+    } else if (runAll([plan.lingerCommand], crewHome, { emit: log.emit.bind(log), warn: () => void 0 })) {
+      log.emit(`lingering enabled for ${plan.lingerCommand[2]}: the unit survives logout`);
+    } else {
+      log.warn(`could not enable lingering \u2014 ${plan.lingerHint ?? "run loginctl enable-linger by hand"}`);
+    }
+  }
   log.emit(`crew's own log: ${plan.crewLog}`);
   log.emit(`scheduler log (only what escapes the crew, e.g. a crash before it starts): ${plan.schedulerLog}`);
+  return { changed: changed2 };
 }
 async function applyUninstall(plan, crewHome, dryRun, log) {
   if (plan.mechanism === "none") {
@@ -7563,6 +7650,28 @@ var Tracker = class {
     if (!auth.commentShip) missing.push(`Comments.${this.contract.comments.ship}`);
     return missing;
   }
+  /**
+   * The runtime-map columns (ISSUE-2791) this workspace's template has not
+   * taken yet, as `table.column` names for `crew doctor`. Each is read as its
+   * default when absent, so this is informational: `Repos.forge_host`
+   * (default `github.com`), `Ships.kind` (`developer_machine`),
+   * `Ships.instance_class` and `Ships.relay_url` (blank). A table the route
+   * does not have is skipped, not reported.
+   */
+  async missingRuntimeColumns() {
+    const wanted = [
+      [this.route.resolved?.reposModelId, "Repos", ["forge_host"]],
+      [this.route.resolved?.shipsModelId, "Ships", ["kind", "instance_class", "relay_url"]]
+    ];
+    const missing = [];
+    for (const [modelId, label, columns] of wanted) {
+      if (!modelId) continue;
+      const have = await this.columnNames(modelId);
+      if (have.size === 0) continue;
+      for (const c of columns) if (!have.has(c)) missing.push(`${label}.${c}`);
+    }
+    return missing;
+  }
   /**
    * The public `/v/<slug>/r/<token>` link for one ticket (ISSUE-928) —
    * fetch-or-create via `POST /views/:viewId/record-links`, so a repeated
@@ -9190,6 +9299,55 @@ function skillMarkerWarnings(promptsDir, personaPrompts) {
   return out;
 }
 
+// src/run-limit.ts
+var DEFAULT_MAX_RUN_MINUTES = 240;
+var KILL_GRACE_MS = 5e3;
+var WALL_CLOCK_REASON = "wall-clock";
+function resolveMaxRunMinutes(route2, toolchain) {
+  return route2 ?? toolchain ?? DEFAULT_MAX_RUN_MINUTES;
+}
+function deadlineFor(spawnedAt, maxRunMinutes) {
+  if (!maxRunMinutes || maxRunMinutes <= 0) return void 0;
+  const t = Date.parse(spawnedAt);
+  return Number.isNaN(t) ? void 0 : new Date(t + maxRunMinutes * 6e4).toISOString();
+}
+function msUntilDeadline(deadline, now = Date.now()) {
+  if (!deadline) return void 0;
+  const t = Date.parse(deadline);
+  return Number.isNaN(t) ? void 0 : t - now;
+}
+async function killRunGroup(pid, o = {}) {
+  const alive = o.isAlive ?? ((p) => {
+    try {
+      process.kill(p, 0);
+      return true;
+    } catch (e) {
+      return e.code === "EPERM";
+    }
+  });
+  const signal = (sig) => {
+    try {
+      process.kill(-pid, sig);
+    } catch {
+      try {
+        process.kill(pid, sig);
+      } catch {
+      }
+    }
+  };
+  signal("SIGTERM");
+  const end = Date.now() + (o.graceMs ?? KILL_GRACE_MS);
+  while (alive(pid) && Date.now() < end) await new Promise((r) => setTimeout(r, 50));
+  if (alive(pid)) signal("SIGKILL");
+}
+var RUN_KILLED_MARKER = "<!-- crew:run-killed -->";
+function runKilledComment(b) {
+  const tree = b.dirty === null ? "The worktree could not be checked." : b.dirty ? "The worktree has uncommitted changes \u2014 they are this seat's own, from that run." : "The worktree is clean.";
+  return `${RUN_KILLED_MARKER}
+
+The agent run on this ticket was stopped at its wall-clock limit of ${b.limitMinutes} minutes before it handed on${b.branch ? `; its branch is \`${b.branch}\`` : ""}. ${tree} The worktree is left as it was. The next run on this seat resumes from it rather than starting over.`;
+}
+
 // src/agent.ts
 var DIGEST_MAX_AGE_SECONDS = 600;
 var LEGACY_TOOLCHAIN_HARNESS = "claude";
@@ -9299,6 +9457,7 @@ function planAgentRun(o) {
     toolchain: toolchain.name,
     harness: toolchain.harness,
     provider: toolchainProvider(toolchain),
+    maxRunMinutes: resolveMaxRunMinutes(o.route.maxRunMinutes, toolchain.maxRunMinutes),
     resolution: { toolchain: seat.toolchainWhy, model: seat.modelWhy },
     warnings: [...seat.warnings ?? [], ...expanded.warnings],
     prompt,
@@ -9388,6 +9547,17 @@ function identityOf(plan, adapterHarness) {
     promptSha: plan.promptSha
   };
 }
+async function killForDeadline(pid, emit, role, ticket, spawnedAt, limitMinutes) {
+  const elapsedMs = Date.now() - Date.parse(spawnedAt);
+  const limit = limitMinutes ?? Math.round(elapsedMs / 6e4);
+  emit.emit(`run_killed: ${role} run exceeded its wall-clock limit of ${limit} min (ran ${Math.round(elapsedMs / 6e4)} min)`, {
+    role,
+    ...ticket ? { ticket } : {},
+    data: { event: "run_killed", reason: WALL_CLOCK_REASON, limitMinutes: limit, elapsedMs, pid }
+  });
+  await killRunGroup(pid);
+  return { limitMinutes: limit, elapsedMs };
+}
 var withoutKey = ({ apiKey: _apiKey, ...rest }) => rest;
 function openSink(path) {
   try {
@@ -9747,13 +9917,16 @@ function spawnAgent(plan, emit, hintMoved) {
       detached: true
     });
     closeSync3(streamFd);
+    const spawnedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const deadline = deadlineFor(spawnedAt, plan.maxRunMinutes);
     if (child.pid !== void 0) {
       const sidecar = {
         pid: child.pid,
         ownerPid: process.pid,
-        spawnedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        spawnedAt,
         role: plan.role,
         route: plan.route,
+        ...deadline ? { deadline, maxRunMinutes: plan.maxRunMinutes } : {},
         ticket: plan.ticket ?? null,
         ticketRecordId: plan.ticketRecordId ?? null,
         repo: plan.repo ?? null,
@@ -9773,25 +9946,45 @@ function spawnAgent(plan, emit, hintMoved) {
       }
     }
     const obs = new RunObserver(id, adapter, eventsSink, emit.cycle);
-    const meta = { pid: child.pid ?? null };
+    const meta = { pid: child.pid ?? null, ...deadline ? { deadline } : {} };
     obs.onClaim = () => writeRunMeta(id, startedAt, obs.liveTicket, meta);
     if (child.pid !== void 0) writeRunMeta(id, startedAt, obs.liveTicket, meta);
     const tail3 = new FileTail(plan.streamPath);
     const timer = setInterval(() => obs.feed(tail3.poll()), TAIL_POLL_MS);
+    let killed;
+    const limitTimer = child.pid !== void 0 && deadline ? setTimeout(() => {
+      const pid = child.pid;
+      void killForDeadline(pid, emit, plan.role, obs.liveTicket ?? plan.ticket ?? null, spawnedAt, plan.maxRunMinutes).then((k) => {
+        killed = k;
+      });
+    }, Math.max(0, msUntilDeadline(deadline) ?? 0)) : void 0;
     let spawnFailed = false;
     child.on("error", (err3) => {
       spawnFailed = true;
       clearInterval(timer);
+      clearTimeout(limitTimer);
       reject(new AgentSpawnError(`cannot run ${plan.bin}: ${err3.message}`));
     });
     child.on("close", async (code) => {
       clearInterval(timer);
+      clearTimeout(limitTimer);
       obs.feed(tail3.poll());
       obs.end();
       await endSink(eventsSink);
       if (spawnFailed) return;
-      const { ms: ms3, handoffPending } = await finishRun(id, obs, emit, startedAt, { code: code ?? 1 }, plan.agentLog?.apiKey, hintMoved);
-      resolve6({ code: code ?? 1, ms: ms3, ...handoffPending ? { handoffPending } : {} });
+      if (limitTimer && !killed && !obs.sawResult && msUntilDeadline(deadline) <= 0) {
+        killed = { limitMinutes: plan.maxRunMinutes ?? 0, elapsedMs: Date.now() - Date.parse(spawnedAt) };
+      }
+      const { ms: ms3, handoffPending } = await finishRun(
+        id,
+        obs,
+        emit,
+        startedAt,
+        { code: code ?? 1, ...killed ? { interrupted: WALL_CLOCK_REASON } : {} },
+        plan.agentLog?.apiKey,
+        hintMoved
+      );
+      resolve6({ code: code ?? 1, ms: ms3, ...handoffPending ? { handoffPending } : {}, ...killed ? { killed } : {} });
     });
     child.stdin?.on("error", (err3) => {
       emit.warn(`agent closed stdin before the prompt was delivered: ${err3.message}`, { step: "agent" });
@@ -9810,18 +10003,23 @@ async function reattachRun(streamPath, sc, emit, o = {}) {
   obs.feed(tail3.poll());
   obs.muted = false;
   const adopted = isAlive(sc);
+  let killed;
   if (adopted) {
     o.onAdopted?.();
     const pollMs = o.pollMs ?? TAIL_POLL_MS;
     while (isAlive(sc)) {
       obs.feed(tail3.poll());
+      if (!killed && (msUntilDeadline(sc.deadline) ?? 1) <= 0) {
+        killed = await killForDeadline(sc.pid, emit, sc.role, obs.liveTicket ?? sc.ticket, sc.spawnedAt, sc.maxRunMinutes);
+        continue;
+      }
       await new Promise((r) => setTimeout(r, pollMs));
     }
   }
   obs.feed(tail3.poll());
   obs.end();
   await endSink(eventsSink);
-  const interrupted = obs.sawResult ? void 0 : adopted ? "no-result" : "daemon-exit";
+  const interrupted = killed ? WALL_CLOCK_REASON : obs.sawResult ? void 0 : adopted ? "no-result" : "daemon-exit";
   const { ms: ms3, ticket } = await finishRun(
     id,
     obs,
@@ -9830,7 +10028,7 @@ async function reattachRun(streamPath, sc, emit, o = {}) {
     { code: null, ...interrupted ? { interrupted } : {} },
     o.agentLogKey
   );
-  return { adopted, ...interrupted ? { interrupted } : {}, ms: ms3, ticket };
+  return { adopted, ...interrupted ? { interrupted } : {}, ...killed ? { killed } : {}, ms: ms3, ticket };
 }
 
 // src/seat-keys.ts
@@ -10335,8 +10533,8 @@ function doctorSelftestLines(stored, toolchains) {
 // src/cli.ts
 import { resolve as resolve5, dirname as dirname22, join as join44, basename as basename13 } from "path";
 import { fileURLToPath } from "url";
-import { hostname as hostname2, homedir as homedir10 } from "os";
-import { spawnSync as spawnSync7 } from "child_process";
+import { hostname as hostname3, homedir as homedir10 } from "os";
+import { spawnSync as spawnSync8 } from "child_process";
 import { parse as parseYaml2 } from "yaml";
 
 // src/argv.ts
@@ -10348,6 +10546,7 @@ var VALUE_FLAGS = /* @__PURE__ */ new Set([
   "clear",
   "dir",
   "extra-path",
+  "forge-host",
   "harness",
   "hook",
   "host",
@@ -12588,134 +12787,719 @@ function flagWizardAnswers(f, env) {
   };
 }
 
-// src/release-run.ts
-import { readFileSync as readFileSync23, writeFileSync as writeFileSync19, existsSync as existsSync25, copyFileSync, mkdirSync as mkdirSync17, mkdtempSync as mkdtempSync2, rmSync as rmSync14 } from "fs";
-import { dirname as dirname13, join as join29 } from "path";
-import { tmpdir as tmpdir3 } from "os";
+// src/provision.ts
+import { spawnSync as spawnSync6 } from "child_process";
+import { existsSync as existsSync25, readFileSync as readFileSync23, writeFileSync as writeFileSync19 } from "fs";
+import { hostname as hostname2 } from "os";
+import { parseDocument as parseDocument3 } from "yaml";
 
-// src/release.ts
-function describeUnplaceable(unplaceable, verifiedStatus) {
-  const stranded = unplaceable.filter((u) => u.ticket.status === verifiedStatus);
-  if (stranded.length === 0) return [];
-  const notes = [];
-  const keysFor = (r) => stranded.filter((u) => u.reason === r).map((u) => u.ticket.issue_id);
-  const noRepo = keysFor("no-repo");
-  if (noRepo.length) {
-    notes.push({
-      level: "warn",
-      message: `${noRepo.length} verified ticket(s) name no repository and cannot be released: ` + noRepo.join(", ")
-    });
+// src/doctor-fix.ts
+import { parseDocument as parseDocument2 } from "yaml";
+
+// src/repos-cmd.ts
+import { homedir as homedir9 } from "os";
+import { basename as basename8, join as join29, resolve as resolve3 } from "path";
+import { isMap, isSeq, parseDocument, stringify as stringify2 } from "yaml";
+var ReposError = class extends Error {
+};
+function normalizeRemote(url) {
+  if (!url) return void 0;
+  let s = url.trim();
+  if (!s) return void 0;
+  const scp = /^[^\s@/]+@[^\s:/]+:(.+)$/.exec(s);
+  if (scp) s = scp[1];
+  else s = s.replace(/^[a-z][a-z0-9+.-]*:\/\/(?:[^/@]+@)?[^/]+\//i, "");
+  s = s.replace(/\/+$/, "").replace(/\.git$/i, "");
+  const parts = s.split("/").filter(Boolean);
+  if (parts.length < 2) return void 0;
+  return parts.slice(-2).join("/").toLowerCase();
+}
+function matchRepoName(origin, resolved) {
+  const want = normalizeRemote(origin);
+  if (!want || !resolved?.repoRemotes) return void 0;
+  for (const [id, remote] of Object.entries(resolved.repoRemotes)) {
+    if (normalizeRemote(remote) === want) return resolved.repoNames?.[id];
   }
-  const unknown = keysFor("unknown-repo");
-  if (unknown.length) {
-    notes.push({
-      level: "warn",
-      message: `${unknown.length} verified ticket(s) name a repository this ship does not recognise \u2014 run \`crew connect\` to refresh its repo list: ${unknown.join(", ")}`
-    });
+  return void 0;
+}
+function routeNamesOf(text) {
+  const routes = parseDocument(text).get("routes", true);
+  if (!isSeq(routes)) return [];
+  return routes.items.flatMap((i) => isMap(i) && typeof i.get("route") === "string" ? [i.get("route")] : []);
+}
+function parseAddArgs(args, routes, isDir) {
+  const rest = [...args];
+  let route2;
+  if (rest.length > 0 && routes.includes(rest[0])) route2 = rest.shift();
+  else if (rest.length > 0 && /^[^/\s]+\/[^/\s]+$/.test(rest[0]) && !isDir(rest[0])) {
+    throw new ReposError(`no route "${rest[0]}" in the config (have: ${routes.join(", ") || "none"})`);
   }
-  const elsewhere = stranded.filter((u) => u.reason === "not-served-here");
-  if (elsewhere.length) {
-    const byRepoName = /* @__PURE__ */ new Map();
-    for (const u of elsewhere) {
-      const name = u.repo ?? "?";
-      byRepoName.set(name, [...byRepoName.get(name) ?? [], u.ticket.issue_id]);
-    }
-    notes.push({
-      level: "info",
-      message: `${elsewhere.length} verified ticket(s) belong to a repository this ship has no checkout for \u2014 another ship releases them: ` + [...byRepoName].map(([n, ids]) => `${n} (${ids.join(", ")})`).join("; ")
-    });
+  if (!route2) {
+    if (routes.length === 1) route2 = routes[0];
+    else throw new ReposError(routes.length === 0 ? "the config has no routes \u2014 run `crew connect` first" : `several routes are configured; name one: ${routes.join(", ")}`);
   }
-  return notes;
+  if (rest.length > 2) throw new ReposError("too many arguments: expected [route] [name] [path]");
+  if (rest.length === 2) return { route: route2, name: rest[0], path: rest[1] };
+  if (rest.length === 1) return isDir(rest[0]) ? { route: route2, path: rest[0] } : { route: route2, name: rest[0], path: "." };
+  return { route: route2, path: "." };
 }
-var unplaceableReported = /* @__PURE__ */ new Set();
-function reportUnplaceable(routeName, unplaceable, verified, emit) {
-  if (unplaceableReported.has(routeName)) return;
-  unplaceableReported.add(routeName);
-  for (const note of describeUnplaceable(unplaceable, verified)) {
-    if (note.level === "warn") emit.warn(note.message, { step: "release" });
-    else emit.emit(note.message, { step: "release" });
+function expandDir(p, base) {
+  const home = p === "~" ? homedir9() : p.startsWith("~/") ? `${homedir9()}/${p.slice(2)}` : p;
+  return resolve3(base, home);
+}
+function routeMapOf(doc, route2) {
+  const routes = doc.get("routes", true);
+  if (isSeq(routes)) {
+    for (const item of routes.items) {
+      if (isMap(item) && item.get("route") === route2) return item;
+    }
   }
+  const have = isSeq(routes) ? routes.items.map((i) => isMap(i) ? String(i.get("route")) : "?").join(", ") : "none";
+  throw new ReposError(`no route "${route2}" in the config (have: ${have})`);
 }
-function checkGuards(cwd, base = "main") {
-  const branch = currentBranch(cwd);
-  if (branch !== base) {
-    return { kind: "branch", detail: `primary checkout is on '${branch}', not ${base}` };
+function configuredRepos(text, route2, base) {
+  const doc = parseDocument(text);
+  const m = routeMapOf(doc, route2);
+  const repos = m.get("repos");
+  if (isMap(repos)) {
+    return repos.items.map((p) => {
+      const name = String(p.key.value ?? p.key);
+      const v = p.value;
+      const dir2 = isMap(v) ? String(v.get("dir") ?? "") : String(v?.value ?? "");
+      return { name, dir: expandDir(dir2, base) };
+    });
   }
-  const changes = status(cwd);
-  if (changes.length === 0) return null;
-  const untracked = changes.filter((c) => c.untracked).length;
-  const names = changes.slice(0, 3).map((c) => c.path).join(", ");
-  const more = changes.length > 3 ? `, +${changes.length - 3} more` : "";
-  const untrackedNote = untracked > 0 ? ` (${untracked} untracked)` : "";
-  return {
-    kind: "dirty",
-    detail: `working tree has ${changes.length} change(s)${untrackedNote}: ${names}${more}`
-  };
+  const dir = m.get("dir");
+  return dir ? [{ name: basename8(String(dir)), dir: expandDir(String(dir), base) }] : [];
 }
-function heldByBlockers(tickets, verifiedStatus, info) {
-  if (!info) return [];
-  return tickets.filter((t) => t.status === verifiedStatus && unresolvedBlockers(t, info, { mergeGated: false }).length > 0).map((ticket) => ({ ticket, blockers: describeUnresolved(ticket, info, { mergeGated: false }) }));
+function cloneBaseOf(text, route2, base, isCheckout) {
+  const m = routeMapOf(parseDocument(text), route2);
+  const repos = m.get("repos", true);
+  if (isMap(repos) && repos.items.length > 0) return null;
+  const dir = m.get("dir");
+  if (!dir) return null;
+  const abs = expandDir(String(dir), base);
+  return isCheckout(abs) ? null : abs;
 }
-var describeHeld = (held) => held.map((h) => `${h.ticket.issue_tag ?? h.ticket.issue_id} held: blocked by ${h.blockers}`);
-var CHANGELOG_LINE = /^Changelog:[ \t]*(.*)$/gm;
-var TICKET_REF_AT_START = /^([A-Z][A-Z0-9]*)-(\d+)\b/;
-function dedupeChangelogEntries(entries, ticket) {
-  const own = (ticket.issue_tag ?? ticket.issue_id).match(/^([A-Z][A-Z0-9]*)-(\d+)$/);
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const raw of entries) {
-    let line = raw.trim();
-    const ref = line.match(TICKET_REF_AT_START);
-    let key = line;
-    if (ref) {
-      const prefix = ref[1];
-      const num = ref[2];
-      const canonical = own && own[2] === num ? own[1] : prefix;
-      line = `${canonical}-${num}${line.slice(ref[0].length)}`;
-      key = `${canonical}-${num}`;
-    }
-    if (seen.has(key)) continue;
-    seen.add(key);
-    out.push(line);
-  }
-  return out;
+function routeSetsHooks(text, route2, name) {
+  const m = routeMapOf(parseDocument(text), route2);
+  const repos = m.get("repos", true);
+  let target = m;
+  if (isMap(repos)) target = repos.get(name, true);
+  if (!isMap(target)) return false;
+  const hooks = target.get("hooks", true);
+  return isMap(hooks) && hooks.items.length > 0;
 }
-var BUMP_LINE = /^Bump:[ \t]*(major|minor|patch)\b/gim;
-function planMerge(cwd, tickets, contract, lastReleased, branchFor = (t) => branchForIssue(cwd, t.issue_id), base = "main", blockerInfo, ref = "HEAD") {
-  const held = new Set(heldByBlockers(tickets, contract.statuses.verified, blockerInfo).map((h) => h.ticket.id));
-  const verified = tickets.filter((t) => t.status === contract.statuses.verified && !held.has(t.id)).sort((a, b) => Number.parseInt(a.issue_id.replace(/^\D+/, ""), 10) - Number.parseInt(b.issue_id.replace(/^\D+/, ""), 10));
-  return verified.map((ticket) => {
-    const branch = branchFor(ticket);
-    if (!branch) {
-      const keys = referenceKeys(ticket);
-      const unreleased = lastReleased ? findKeyInRange(cwd, keys, `${lastReleased}..${ref}`) : null;
-      if (unreleased) {
-        return {
-          ticket,
-          branch: null,
-          entries: [],
-          usedFallback: false,
-          bump: "patch",
-          majorRequested: false,
-          skipReason: "already-merged"
-        };
-      }
-      const anywhere = findKeyInRange(cwd, keys, ref);
-      if (anywhere) {
-        return {
-          ticket,
-          branch: null,
-          entries: [],
-          usedFallback: false,
-          bump: "patch",
-          majorRequested: false,
-          skipReason: lastReleased ? "already-released" : "already-merged",
-          mergedSha: anywhere
-        };
-      }
-      return {
-        ticket,
-        branch: null,
+function listRepoRows(i) {
+  const cloneBase = i.isCheckout ? cloneBaseOf(i.text, i.route, i.base, i.isCheckout) : null;
+  const checkouts = configuredRepos(i.text, i.route, i.base).filter((c) => c.dir !== cloneBase);
+  const claimed = /* @__PURE__ */ new Set();
+  const hooksSourceOf = (c) => i.exists(c.dir) && i.repoHasHooks(c.dir) ? "repo" : routeSetsHooks(i.text, i.route, c.name) ? "route" : "none";
+  const originFor = (c, remote) => {
+    const o = i.originOf(c.dir) ?? null;
+    if (!o) return null;
+    return remote !== null && normalizeRemote(o) === normalizeRemote(remote) ? null : o;
+  };
+  const rows = [];
+  const names = i.resolved?.repoNames ?? {};
+  const remotes = i.resolved?.repoRemotes ?? {};
+  for (const [id, name] of Object.entries(names)) {
+    const remote = remotes[id] ?? null;
+    const want = normalizeRemote(remote);
+    let idx = checkouts.findIndex((c2, n) => !claimed.has(n) && want !== void 0 && normalizeRemote(i.originOf(c2.dir)) === want);
+    if (idx < 0) idx = checkouts.findIndex((c2, n) => !claimed.has(n) && c2.name === name);
+    const c = idx >= 0 ? checkouts[idx] : void 0;
+    if (idx >= 0) claimed.add(idx);
+    rows.push({
+      name,
+      remote,
+      repoRowId: id,
+      attached: c !== void 0,
+      dir: c?.dir ?? null,
+      exists: c ? i.exists(c.dir) : false,
+      origin: c ? originFor(c, remote) : null,
+      matchedRow: c ? name : null,
+      hooksSource: c ? hooksSourceOf(c) : "none"
+    });
+  }
+  checkouts.forEach((c, n) => {
+    if (claimed.has(n)) return;
+    rows.push({
+      name: c.name,
+      remote: null,
+      repoRowId: null,
+      attached: true,
+      dir: c.dir,
+      exists: i.exists(c.dir),
+      origin: originFor(c, null),
+      matchedRow: null,
+      hooksSource: hooksSourceOf(c)
+    });
+  });
+  return rows;
+}
+function planRepoAdd(i) {
+  const doc = parseDocument(i.text);
+  if (doc.errors.length > 0) throw new ReposError(`config is not valid YAML \u2014 ${doc.errors[0].message}`);
+  const m = routeMapOf(doc, i.route);
+  let existing = configuredRepos(i.text, i.route, i.base);
+  const target = expandDir(i.path, i.base);
+  let droppedDir;
+  const placeholder = m.get("dir");
+  const reposNow = m.get("repos", true);
+  if (i.isCheckout && placeholder && !(isMap(reposNow) && reposNow.items.length > 0)) {
+    const placeholderDir = expandDir(String(placeholder), i.base);
+    if (placeholderDir !== target && !i.isCheckout(placeholderDir)) {
+      droppedDir = placeholderDir;
+      m.delete("dir");
+      existing = [];
+    }
+  }
+  if (existing.some((e) => e.dir === target)) {
+    throw new ReposError(`${target} is already configured on route ${i.route}`);
+  }
+  const matched = matchRepoName(i.origin, i.resolved);
+  const name = matched ?? i.name ?? normalizeRemote(i.origin)?.split("/").pop() ?? basename8(target);
+  let warning;
+  if (!matched) {
+    const known = Object.values(i.resolved?.repoNames ?? {});
+    warning = i.origin ? `the tracker has no Repos row for remote ${normalizeRemote(i.origin) ?? i.origin}${known.length ? ` (known: ${known.join(", ")})` : ""} \u2014 added anyway; create the row so ticket routing can find it` : "this checkout has no origin remote, so it cannot be matched to a Repos row \u2014 added anyway";
+  }
+  const repos = m.get("repos", true);
+  let mode;
+  if (isMap(repos)) {
+    if (repos.has(name)) throw new ReposError(`route ${i.route} already has a repo named "${name}" (${String(repos.get(name))})`);
+    repos.set(name, target);
+    mode = "repos";
+  } else if (m.has("dir") && existing.length > 0) {
+    const old = existing[0];
+    const oldName = i.nameForExisting?.(old.dir) ?? old.name;
+    if (oldName === name) throw new ReposError(`route ${i.route} already has a repo named "${name}" (${old.dir})`);
+    const oldDir = String(m.get("dir"));
+    const pair = m.items.find((p) => p.key.value === "dir");
+    pair.key = doc.createNode("repos");
+    pair.value = doc.createNode({ [oldName]: oldDir, [name]: target });
+    mode = "repos";
+  } else if (droppedDir) {
+    m.set("repos", doc.createNode({ [name]: target }));
+    mode = "repos";
+  } else {
+    m.set("dir", target);
+    mode = "dir";
+  }
+  return { text: String(doc), mode, name, block: renderBlock(m), warning, unmatched: !matched, droppedDir };
+}
+function planRepoRemove(text, base, route2, path) {
+  const doc = parseDocument(text);
+  if (doc.errors.length > 0) throw new ReposError(`config is not valid YAML \u2014 ${doc.errors[0].message}`);
+  const m = routeMapOf(doc, route2);
+  const target = expandDir(path, base);
+  const existing = configuredRepos(text, route2, base);
+  const hit = existing.find((e) => e.dir === target);
+  if (!hit) throw new ReposError(`${target} is not configured on route ${route2}`);
+  const repos = m.get("repos", true);
+  if (isMap(repos)) {
+    repos.delete(hit.name);
+    const left = existing.filter((e) => e !== hit);
+    if (left.length === 1) {
+      const pair = m.items.find((p) => p.key.value === "repos");
+      pair.key = doc.createNode("dir");
+      pair.value = doc.createNode(String(repos.get(left[0].name)));
+    } else if (left.length === 0) m.delete("repos");
+  } else {
+    m.delete("dir");
+  }
+  return { text: String(doc), name: hit.name };
+}
+function renderBlock(m) {
+  return stringify2([m.toJSON()]).trimEnd();
+}
+var LOCAL_RELEASE_MODES = /* @__PURE__ */ new Set(["integrate", "external"]);
+function planRepoRow(i) {
+  const remote = normalizeRemote(i.origin);
+  if (!remote) throw new ReposError(`cannot derive an owner/repo from origin "${i.origin}"`);
+  const mode = i.spec?.releaseMode;
+  return {
+    name: i.name,
+    remote,
+    platform: i.spec?.platform ?? "unix",
+    release_mode: mode ? LOCAL_RELEASE_MODES.has(mode) ? "local" : mode : "local",
+    ci_provider: i.spec?.ciProvider ?? "none",
+    enabled: true,
+    project_id: i.projectId
+  };
+}
+function resolveRepoProject(projects, opt, routeAreaId) {
+  if (opt) {
+    const want = opt.toLowerCase();
+    const hit = projects.find((p) => p.id === opt || p.name?.toLowerCase() === want);
+    if (!hit) throw new ReposError(`no Projects row "${opt}" (have: ${projects.map((p) => p.name ?? p.id).join(", ") || "none"})`);
+    return hit.id;
+  }
+  if (routeAreaId) return routeAreaId;
+  if (projects.length === 1) return projects[0].id;
+  throw new ReposError(
+    `cannot tell which project the new Repos row belongs to \u2014 pass --project <name> (have: ${projects.map((p) => p.name ?? p.id).join(", ") || "none"}), or --no-create to skip creating it`
+  );
+}
+function parseCloneArgs(args, routes) {
+  const rest = [...args];
+  let route2;
+  if (rest.length > 1 && routes.includes(rest[0])) route2 = rest.shift();
+  else if (rest.length > 1) throw new ReposError(`no route "${rest[0]}" in the config (have: ${routes.join(", ") || "none"})`);
+  if (!route2) {
+    if (routes.length === 1) route2 = routes[0];
+    else throw new ReposError(routes.length === 0 ? "the config has no routes \u2014 run `crew connect` first" : `several routes are configured; name one: ${routes.join(", ")}`);
+  }
+  if (rest.length !== 1) throw new ReposError("expected [route] <name> \u2014 the Repos row to clone (see `crew repos list`)");
+  return { route: route2, name: rest[0] };
+}
+function planRepoClone(i) {
+  const names = i.resolved?.repoNames ?? {};
+  const id = Object.keys(names).find((k) => names[k].toLowerCase() === i.name.toLowerCase());
+  if (!id) {
+    const known = Object.values(names);
+    throw new ReposError(`the tracker has no Repos row named "${i.name}" for route ${i.route}${known.length ? ` (known: ${known.join(", ")})` : " \u2014 run `crew connect` to refresh them"}`);
+  }
+  const name = names[id];
+  const remote = normalizeRemote(i.resolved?.repoRemotes?.[id]);
+  if (!remote) {
+    throw new ReposError(
+      `the Repos row "${name}" has no remote to clone from \u2014 attach an existing checkout with \`crew repos add ${i.route} ${name} <path>\`, or set the row's remote in the tracker and re-run \`crew connect\``
+    );
+  }
+  const doc = parseDocument(i.text);
+  const m = routeMapOf(doc, i.route);
+  const existing = configuredRepos(i.text, i.route, i.base);
+  if (existing.some((e) => e.name.toLowerCase() === name.toLowerCase())) {
+    throw new ReposError(`route ${i.route} already has a checkout named "${name}" \u2014 nothing to clone`);
+  }
+  const ship = doc.get("ship", true);
+  const basePath = String(m.get("reposBasePath") ?? (isMap(ship) ? ship.get("reposBasePath") : void 0) ?? "~/Crew");
+  const target = i.dir ? expandDir(i.dir, i.base) : join29(expandDir(basePath, i.base), i.route.split("/")[0], name);
+  const add = planRepoAdd({ text: i.text, base: i.base, route: i.route, path: target, origin: remote, resolved: i.resolved, name, isCheckout: i.isCheckout });
+  return { ...add, remote, target };
+}
+
+// src/doctor-fix.ts
+var sound = (r) => r.hasRepos && r.problems.length === 0;
+function planFix(f) {
+  const actions = [];
+  const notes = [];
+  for (const r of f.routes) {
+    if (!r.enabled && sound(r)) {
+      actions.push({ kind: "enable", route: r.route });
+      const gaps = r.readiness ?? [];
+      if (gaps.length) {
+        notes.push(`${r.route}: ${gaps.length} release-readiness gap${gaps.length === 1 ? "" : "s"} (${gaps[0]}${gaps.length > 1 ? ", ..." : ""}) \u2014 the route will run, but releases stop at the first missing hook until it is added`);
+      }
+    } else if (!sound(r) && !r.enabled) {
+      notes.push(`${r.route}: not enabled \u2014 ${r.hasRepos ? r.problems[0] : "no checkout is configured"}`);
+    }
+  }
+  if (f.schedulerAbsent && f.routes.some(sound)) {
+    if (f.host === "windows") notes.push("scheduler support is not built for Windows yet \u2014 nothing to install; run `crew run` by hand");
+    else actions.push({ kind: "install" });
+  }
+  return { actions, notes };
+}
+async function gatherHealth(c, check) {
+  let problems;
+  let readiness = [];
+  try {
+    const r = await check();
+    if (Array.isArray(r)) problems = r;
+    else ({ problems, readiness } = r);
+  } catch (e) {
+    problems = [`checks could not run: ${e instanceof Error ? e.message : String(e)}`];
+  }
+  return { route: c.route, enabled: c.enabled, hasRepos: c.hasRepos, problems, readiness };
+}
+function routesInScope(routes, named) {
+  return named ? routes.filter((r) => r.route === named) : routes;
+}
+function planEnable(text, route2) {
+  const doc = parseDocument2(text);
+  routeMapOf(doc, route2).set("enabled", true);
+  return String(doc);
+}
+function schedulerInstalled(plan, exists, crontab) {
+  if (plan.mechanism === "cron") return plan.cronMarker !== null && crontab.includes(plan.cronMarker);
+  return plan.unitPaths.length > 0 && plan.unitPaths.every(exists);
+}
+
+// src/provision.ts
+var PROVISION_EXIT = { ok: 0, failed: 1, problem: 2, choice: 3 };
+function parseEvents(stdout) {
+  const out = [];
+  for (const line of stdout.split("\n")) {
+    const t = line.trim();
+    if (!t.startsWith("{")) continue;
+    try {
+      out.push(JSON.parse(t));
+    } catch {
+    }
+  }
+  return out;
+}
+async function runProvision(o, deps, write, human) {
+  const summary = { ok: false, state: "failed", changed: false, routes: [], forges: [] };
+  const emit = (event, message, data = {}) => {
+    if (o.json) write(`${JSON.stringify({ ...data, event, message })}
+`);
+    else human(`${message}
+`);
+  };
+  const fail = (code, message, data = {}) => {
+    emit("problem", message, data);
+    return { code, summary: { ...summary, ok: false, state: "failed" } };
+  };
+  if (!o.key) return fail(PROVISION_EXIT.problem, "no connect key: pass --key or set CREW_CONNECT_KEY", { stage: "input" });
+  if (o.routes.length === 0) {
+    return fail(PROVISION_EXIT.problem, "no routes to serve: pass --route WORKSPACE[/PROJECT] (repeatable) or set CREW_PROVISION_ROUTES", { stage: "input" });
+  }
+  for (const host of o.forgeHosts) {
+    if (!o.tokens[host]) return fail(PROVISION_EXIT.problem, `no token for forge ${host}: set CREW_FORGE_TOKEN or CREW_FORGE_TOKEN_${envKey(host)}`, { stage: "input" });
+  }
+  const shipName2 = o.shipName ?? deps.defaultShipName();
+  summary.ship = shipName2;
+  const routeNames = [];
+  for (const route2 of o.routes) {
+    const args = [
+      "connect",
+      route2,
+      "--json",
+      "--no-wizard",
+      "--ship-name",
+      shipName2,
+      ...o.agentBin ? ["--agent-bin", o.agentBin] : [],
+      ...o.extraPath ? ["--extra-path", o.extraPath] : [],
+      ...o.baseUrl ? ["--base-url", o.baseUrl] : [],
+      ...o.dryRun ? ["--dry-run"] : [],
+      ...o.choices.flatMap((c) => ["--choose", c])
+    ];
+    const res = deps.crew(args, { env: { CREW_CONNECT_KEY: o.key } });
+    const events = parseEvents(res.stdout);
+    for (const e of events) if (o.json) write(`${JSON.stringify({ ...e, phase: "connect" })}
+`);
+    if (res.status !== 0) {
+      const problem = events.find((e) => e.event === "problem");
+      const msg = String(problem?.message ?? (res.stderr.trim().split("\n").pop() || `crew connect ${route2} exited ${res.status}`));
+      if (!o.json) human(`crew provision: connect ${route2}: ${msg}
+`);
+      return { code: res.status === PROVISION_EXIT.choice ? PROVISION_EXIT.choice : res.status, summary: { ...summary, ok: false, state: "failed" } };
+    }
+    const done = events.find((e) => e.event === "done");
+    const name = String(done?.route ?? route2);
+    routeNames.push(name);
+    const shipRow = events.find((e) => e.event === "ship_row");
+    if (shipRow?.action === "created") summary.changed = true;
+    if (done?.wroteConfig === true) summary.changed = true;
+    emit("connect", `connected ${name}${shipRow ? ` (ship row ${String(shipRow.action)})` : ""}`, { route: name });
+  }
+  summary.routes = routeNames;
+  if (o.dryRun) {
+    summary.ok = true;
+    summary.state = "dry-run";
+    emit("done", "dry run: connected nothing past discovery; no forge, route, unit or daemon was touched", { summary });
+    return { code: PROVISION_EXIT.ok, summary };
+  }
+  const configPath = deps.configFile();
+  if (!configPath) return fail(PROVISION_EXIT.failed, "connect finished but no crew.yaml exists", { stage: "connect" });
+  summary.configPath = configPath;
+  for (const host of o.forgeHosts) {
+    const token = o.tokens[host];
+    const stored = deps.storedToken(host);
+    if (stored === token) {
+      summary.forges.push({ host, action: "unchanged" });
+      emit("forge", `forge ${host}: token already stored`, { host, action: "unchanged" });
+      continue;
+    }
+    const sub = stored === null ? "set" : "rotate";
+    const res = deps.crew(["forge", sub, host, "--token-stdin"], { input: `${token}
+` });
+    if (res.status !== 0) return fail(PROVISION_EXIT.failed, `forge ${host}: ${res.stderr.trim() || `crew forge ${sub} exited ${res.status}`}`, { stage: "forge", host });
+    const action = sub === "set" ? "stored" : "rotated";
+    summary.forges.push({ host, action });
+    summary.changed = true;
+    emit("forge", `forge ${host}: token ${action}`, { host, action });
+  }
+  for (const route2 of routeNames) {
+    if (deps.enableRoute(route2)) {
+      summary.changed = true;
+      emit("route_enabled", `enabled route ${route2}`, { route: route2 });
+    }
+  }
+  const before = deps.installState();
+  if (before.unitsStale || !before.running || !before.lingering) {
+    const res = deps.crew(["install"]);
+    if (res.status !== 0) {
+      return fail(PROVISION_EXIT.failed, `crew install exited ${res.status}: ${(res.stderr || res.stdout).trim().split("\n").pop() ?? ""}`, { stage: "install" });
+    }
+    summary.changed = true;
+    emit("install", `installed ${before.mechanism} units`, { mechanism: before.mechanism });
+  }
+  const after = deps.installState();
+  summary.daemon = { mechanism: after.mechanism, running: after.running, lingering: after.lingering };
+  if (!after.running) {
+    return fail(PROVISION_EXIT.failed, `the ${after.mechanism} daemon unit is not running after install`, { stage: "daemon" });
+  }
+  emit("daemon", `daemon running (${after.mechanism}${after.lingering ? ", survives logout" : ", will stop at logout: lingering is off"})`, { ...summary.daemon });
+  summary.ok = true;
+  summary.state = summary.changed ? "provisioned" : "already provisioned";
+  emit("done", summary.state, { summary });
+  return { code: PROVISION_EXIT.ok, summary };
+}
+function envKey(host) {
+  return host.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+}
+function tokensFromEnv(hosts, env) {
+  const out = {};
+  for (const h of hosts) {
+    const t = env[`CREW_FORGE_TOKEN_${envKey(h)}`] ?? env.CREW_FORGE_TOKEN;
+    if (t?.trim()) out[h] = t.trim();
+  }
+  return out;
+}
+function repeated(argv2, name) {
+  const out = [];
+  for (let i = 0; i < argv2.length; i++) {
+    const a = argv2[i];
+    if (a === `--${name}`) {
+      const v = argv2[++i];
+      if (v !== void 0) out.push(v);
+    } else if (a.startsWith(`--${name}=`)) out.push(a.slice(name.length + 3));
+  }
+  return out;
+}
+function splitList(v) {
+  return (v ?? "").split(/[\s,]+/).filter(Boolean);
+}
+function provisionOptionsFrom(argv2, env) {
+  const one = (name) => repeated(argv2, name).at(-1);
+  const routes = repeated(argv2, "route");
+  const forgeFlags = repeated(argv2, "forge-host");
+  const tokenAvailable = !!env.CREW_FORGE_TOKEN?.trim() || Object.keys(env).some((k) => k.startsWith("CREW_FORGE_TOKEN_") && env[k]?.trim());
+  const forgeHosts = (forgeFlags.length ? forgeFlags : tokenAvailable ? splitList(env.CREW_FORGE_HOSTS ?? "github.com") : []).map((h) => h.toLowerCase());
+  return {
+    key: one("key") ?? env.CREW_CONNECT_KEY,
+    routes: routes.length ? routes : splitList(env.CREW_PROVISION_ROUTES),
+    shipName: one("ship-name") ?? env.CREW_SHIP_NAME,
+    agentBin: one("agent-bin"),
+    extraPath: one("extra-path"),
+    baseUrl: one("base-url"),
+    forgeHosts,
+    tokens: tokensFromEnv(forgeHosts, env),
+    json: argv2.includes("--json"),
+    dryRun: argv2.includes("--dry-run"),
+    choices: repeated(argv2, "choose")
+  };
+}
+function realProvisionDeps(crewHome) {
+  const spawnCrew = (args, o = {}) => {
+    const [bin, ...pre] = crewInvocation(crewHome);
+    const env = { ...process.env, ...o.env };
+    delete env.CREW_FORGE_TOKEN;
+    const res = spawnSync6(bin, [...pre, ...args], { cwd: crewHome, encoding: "utf8", env, input: o.input, maxBuffer: 64 * 1024 * 1024 });
+    return { status: res.status ?? 1, stdout: res.stdout ?? "", stderr: `${res.stderr ?? ""}${res.error ? String(res.error) : ""}` };
+  };
+  const configFile = () => {
+    const f = findConfigFile(crewHome);
+    return existsSync25(f) ? f : null;
+  };
+  return {
+    crew: spawnCrew,
+    configFile,
+    enableRoute(route2) {
+      const file = configFile();
+      if (!file) return false;
+      const text = readFileSync23(file, "utf8");
+      const doc = parseDocument3(text);
+      const routes = doc.get("routes");
+      const entry = routes?.items?.find((r) => r.get("route") === route2);
+      if (!entry) throw new Error(`route ${route2} is not in ${file}`);
+      if (entry.get("enabled") === true) return false;
+      writeFileSync19(file, planEnable(text, route2));
+      return true;
+    },
+    installState() {
+      const file = configFile();
+      const cfg = loadConfig(crewHome, file ?? void 0, { allowNoRoutes: true });
+      const host = hostPlatform();
+      const ctx = installContext();
+      const systemd = detectSystemd();
+      const jobs = ["run", "release", "passengers"];
+      let unitsStale = false;
+      let mechanism = "none";
+      for (const job of jobs) {
+        const plan = planInstall(cfg.ship, crewHome, host, systemd, job, ctx);
+        mechanism = plan.mechanism;
+        if (plan.mechanism === "cron") {
+          unitsStale = true;
+          continue;
+        }
+        for (const p of plan.unitPaths) {
+          if (!existsSync25(p) || readFileSync23(p, "utf8") !== plan.unitContent[p]) unitsStale = true;
+        }
+      }
+      const label = labelFor(crewHome, "run");
+      let running = false;
+      let lingering = true;
+      if (mechanism === "systemd") {
+        const system = ctx.root || existsSync25(systemUnitPathFor(label));
+        const ctl = system ? ["systemctl"] : ["systemctl", "--user"];
+        running = spawnSync6(ctl[0], [...ctl.slice(1), "is-active", "--quiet", `${label}.service`]).status === 0;
+        if (!system) {
+          const out = spawnSync6("loginctl", ["show-user", ctx.user, "-p", "Linger"], { encoding: "utf8" });
+          lingering = /Linger=yes/.test(out.stdout ?? "");
+        }
+      } else if (mechanism === "cron") {
+        running = true;
+      } else if (mechanism === "launchd") {
+        running = spawnSync6("launchctl", ["list", label]).status === 0;
+      }
+      return { mechanism, unitsStale, running, lingering };
+    },
+    storedToken(host) {
+      const res = spawnCrew(["credential", "get"], { input: `protocol=https
+host=${host}
+
+` });
+      const m = /^password=(.*)$/m.exec(res.stdout);
+      return m ? m[1] : null;
+    },
+    defaultShipName: () => hostname2()
+  };
+}
+
+// src/release-run.ts
+import { readFileSync as readFileSync24, writeFileSync as writeFileSync20, existsSync as existsSync26, copyFileSync, mkdirSync as mkdirSync17, mkdtempSync as mkdtempSync2, rmSync as rmSync14 } from "fs";
+import { dirname as dirname14, join as join30 } from "path";
+import { tmpdir as tmpdir3 } from "os";
+
+// src/release.ts
+function describeUnplaceable(unplaceable, verifiedStatus) {
+  const stranded = unplaceable.filter((u) => u.ticket.status === verifiedStatus);
+  if (stranded.length === 0) return [];
+  const notes = [];
+  const keysFor = (r) => stranded.filter((u) => u.reason === r).map((u) => u.ticket.issue_id);
+  const noRepo = keysFor("no-repo");
+  if (noRepo.length) {
+    notes.push({
+      level: "warn",
+      message: `${noRepo.length} verified ticket(s) name no repository and cannot be released: ` + noRepo.join(", ")
+    });
+  }
+  const unknown = keysFor("unknown-repo");
+  if (unknown.length) {
+    notes.push({
+      level: "warn",
+      message: `${unknown.length} verified ticket(s) name a repository this ship does not recognise \u2014 run \`crew connect\` to refresh its repo list: ${unknown.join(", ")}`
+    });
+  }
+  const elsewhere = stranded.filter((u) => u.reason === "not-served-here");
+  if (elsewhere.length) {
+    const byRepoName = /* @__PURE__ */ new Map();
+    for (const u of elsewhere) {
+      const name = u.repo ?? "?";
+      byRepoName.set(name, [...byRepoName.get(name) ?? [], u.ticket.issue_id]);
+    }
+    notes.push({
+      level: "info",
+      message: `${elsewhere.length} verified ticket(s) belong to a repository this ship has no checkout for \u2014 another ship releases them: ` + [...byRepoName].map(([n, ids]) => `${n} (${ids.join(", ")})`).join("; ")
+    });
+  }
+  return notes;
+}
+var unplaceableReported = /* @__PURE__ */ new Set();
+function reportUnplaceable(routeName, unplaceable, verified, emit) {
+  if (unplaceableReported.has(routeName)) return;
+  unplaceableReported.add(routeName);
+  for (const note of describeUnplaceable(unplaceable, verified)) {
+    if (note.level === "warn") emit.warn(note.message, { step: "release" });
+    else emit.emit(note.message, { step: "release" });
+  }
+}
+function checkGuards(cwd, base = "main") {
+  const branch = currentBranch(cwd);
+  if (branch !== base) {
+    return { kind: "branch", detail: `primary checkout is on '${branch}', not ${base}` };
+  }
+  const changes = status(cwd);
+  if (changes.length === 0) return null;
+  const untracked = changes.filter((c) => c.untracked).length;
+  const names = changes.slice(0, 3).map((c) => c.path).join(", ");
+  const more = changes.length > 3 ? `, +${changes.length - 3} more` : "";
+  const untrackedNote = untracked > 0 ? ` (${untracked} untracked)` : "";
+  return {
+    kind: "dirty",
+    detail: `working tree has ${changes.length} change(s)${untrackedNote}: ${names}${more}`
+  };
+}
+function heldByBlockers(tickets, verifiedStatus, info) {
+  if (!info) return [];
+  return tickets.filter((t) => t.status === verifiedStatus && unresolvedBlockers(t, info, { mergeGated: false }).length > 0).map((ticket) => ({ ticket, blockers: describeUnresolved(ticket, info, { mergeGated: false }) }));
+}
+var describeHeld = (held) => held.map((h) => `${h.ticket.issue_tag ?? h.ticket.issue_id} held: blocked by ${h.blockers}`);
+var CHANGELOG_LINE = /^Changelog:[ \t]*(.*)$/gm;
+var TICKET_REF_AT_START = /^([A-Z][A-Z0-9]*)-(\d+)\b/;
+function dedupeChangelogEntries(entries, ticket) {
+  const own = (ticket.issue_tag ?? ticket.issue_id).match(/^([A-Z][A-Z0-9]*)-(\d+)$/);
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const raw of entries) {
+    let line = raw.trim();
+    const ref = line.match(TICKET_REF_AT_START);
+    let key = line;
+    if (ref) {
+      const prefix = ref[1];
+      const num = ref[2];
+      const canonical = own && own[2] === num ? own[1] : prefix;
+      line = `${canonical}-${num}${line.slice(ref[0].length)}`;
+      key = `${canonical}-${num}`;
+    }
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(line);
+  }
+  return out;
+}
+var BUMP_LINE = /^Bump:[ \t]*(major|minor|patch)\b/gim;
+function planMerge(cwd, tickets, contract, lastReleased, branchFor = (t) => branchForIssue(cwd, t.issue_id), base = "main", blockerInfo, ref = "HEAD") {
+  const held = new Set(heldByBlockers(tickets, contract.statuses.verified, blockerInfo).map((h) => h.ticket.id));
+  const verified = tickets.filter((t) => t.status === contract.statuses.verified && !held.has(t.id)).sort((a, b) => Number.parseInt(a.issue_id.replace(/^\D+/, ""), 10) - Number.parseInt(b.issue_id.replace(/^\D+/, ""), 10));
+  return verified.map((ticket) => {
+    const branch = branchFor(ticket);
+    if (!branch) {
+      const keys = referenceKeys(ticket);
+      const unreleased = lastReleased ? findKeyInRange(cwd, keys, `${lastReleased}..${ref}`) : null;
+      if (unreleased) {
+        return {
+          ticket,
+          branch: null,
+          entries: [],
+          usedFallback: false,
+          bump: "patch",
+          majorRequested: false,
+          skipReason: "already-merged"
+        };
+      }
+      const anywhere = findKeyInRange(cwd, keys, ref);
+      if (anywhere) {
+        return {
+          ticket,
+          branch: null,
+          entries: [],
+          usedFallback: false,
+          bump: "patch",
+          majorRequested: false,
+          skipReason: lastReleased ? "already-released" : "already-merged",
+          mergedSha: anywhere
+        };
+      }
+      return {
+        ticket,
+        branch: null,
         entries: [],
         usedFallback: false,
         bump: "patch",
@@ -13331,13 +14115,13 @@ async function bump(o, size) {
     }
     return printed;
   }
-  const files = o.repo.release.versionFiles.map((f) => join29(o.cwd, f));
+  const files = o.repo.release.versionFiles.map((f) => join30(o.cwd, f));
   const first = files[0];
-  if (!existsSync25(first)) {
+  if (!existsSync26(first)) {
     o.emit.error(`no ${o.repo.release.versionFiles[0]} to read a version from`);
     return null;
   }
-  const current = JSON.parse(readFileSync23(first, "utf8")).version;
+  const current = JSON.parse(readFileSync24(first, "utf8")).version;
   if (!current) {
     o.emit.error(`no version field in ${o.repo.release.versionFiles[0]}`);
     return null;
@@ -13350,27 +14134,27 @@ async function bump(o, size) {
     return version;
   }
   for (const f of files) {
-    const src = readFileSync23(f, "utf8");
+    const src = readFileSync24(f, "utf8");
     const out = src.replace(/("version"\s*:\s*")[^"]*(")/, `$1${version}$2`);
     if (out === src) {
       o.emit.error(`no version field in ${f}`);
       return null;
     }
-    writeFileSync19(f, out);
+    writeFileSync20(f, out);
   }
   return version;
 }
 function writeChangelog(o, version, entries) {
   const file = o.repo.release.changelog;
   if (!file || entries.length === 0) return;
-  const path = join29(o.cwd, file);
+  const path = join30(o.cwd, file);
   const section = renderChangelogSection(version, (/* @__PURE__ */ new Date()).toISOString().slice(0, 10), entries);
   if (o.dryRun) {
     o.emit.emit(`would prepend ${entries.length} entr(ies) to ${file}`);
     return;
   }
-  const existing = existsSync25(path) ? readFileSync23(path, "utf8") : "# Changelog\n";
-  writeFileSync19(path, insertChangelogSection(existing, section));
+  const existing = existsSync26(path) ? readFileSync24(path, "utf8") : "# Changelog\n";
+  writeFileSync20(path, insertChangelogSection(existing, section));
 }
 async function confirm(o, expected) {
   if (!o.repo.hooks.released) return void 0;
@@ -13463,8 +14247,8 @@ function closeReleaseCheckout(cwd, root, dir, branch, run2 = gitOk) {
 function openReleaseCheckout(o) {
   const { remote, base } = o.repo.branch;
   const branch = `crew/release-${Date.now()}`;
-  const root = mkdtempSync2(join29(tmpdir3(), "crew-release-"));
-  const dir = join29(root, "checkout");
+  const root = mkdtempSync2(join30(tmpdir3(), "crew-release-"));
+  const dir = join30(root, "checkout");
   o.emit.emit(`release checkout: ${dir}`, { step: "release" });
   const close = () => closeReleaseCheckout(o.cwd, root, dir, branch);
   try {
@@ -13474,10 +14258,10 @@ function openReleaseCheckout(o) {
     throw e;
   }
   for (const f of o.repo.worktrees.copy) {
-    const src = join29(o.cwd, f);
-    if (!existsSync25(src)) continue;
-    mkdirSync17(dirname13(join29(dir, f)), { recursive: true });
-    copyFileSync(src, join29(dir, f));
+    const src = join30(o.cwd, f);
+    if (!existsSync26(src)) continue;
+    mkdirSync17(dirname14(join30(dir, f)), { recursive: true });
+    copyFileSync(src, join30(dir, f));
   }
   return { dir, branch, close };
 }
@@ -14178,12 +14962,12 @@ Passed: ${passed}.${willClose ? " Closing this alert." : ""}`,
 }
 
 // src/live-runs.ts
-import { existsSync as existsSync27, readdirSync as readdirSync11 } from "fs";
-import { join as join31 } from "path";
+import { existsSync as existsSync28, readdirSync as readdirSync11 } from "fs";
+import { join as join32 } from "path";
 
 // src/interrupted.ts
-import { existsSync as existsSync26, readdirSync as readdirSync10, readFileSync as readFileSync24 } from "fs";
-import { join as join30 } from "path";
+import { existsSync as existsSync27, readdirSync as readdirSync10, readFileSync as readFileSync25 } from "fs";
+import { join as join31 } from "path";
 var INTERRUPTED_MARKER = calloutHeader("NOTE", "Interrupted");
 function interruptedComment(b) {
   const tree = b.dirty === null ? "The worktree could not be checked." : b.dirty ? "The worktree has uncommitted changes \u2014 they are this seat's own, from that run." : "The worktree is clean.";
@@ -14202,21 +14986,21 @@ var pidAlive = (pid) => {
 };
 function runFinished(streamPath) {
   const path = `${streamPath}.meta.json`;
-  if (!existsSync26(path)) return false;
+  if (!existsSync27(path)) return false;
   try {
-    return JSON.parse(readFileSync24(path, "utf8")).running !== true;
+    return JSON.parse(readFileSync25(path, "utf8")).running !== true;
   } catch {
     return true;
   }
 }
 function orphanedStreams(o) {
-  const dir = join30(o.stateDir, "streams");
-  if (!existsSync26(dir)) return [];
+  const dir = join31(o.stateDir, "streams");
+  if (!existsSync27(dir)) return [];
   const ownerAlive = o.isOwnerAlive ?? pidAlive;
   const out = [];
   for (const name of readdirSync10(dir)) {
     if (!name.endsWith(".jsonl") || name.endsWith(".events.jsonl")) continue;
-    const streamPath = join30(dir, name);
+    const streamPath = join31(dir, name);
     if (runFinished(streamPath)) continue;
     const sidecar = readRunSidecar(streamPath);
     if (!sidecar || sidecar.route !== o.routeLabel) continue;
@@ -14270,12 +15054,12 @@ async function reconcileRuns(o) {
 
 // src/live-runs.ts
 function liveRuns(stateDir, isAlive = runIsAlive) {
-  const dir = join31(stateDir, "streams");
-  if (!existsSync27(dir)) return [];
+  const dir = join32(stateDir, "streams");
+  if (!existsSync28(dir)) return [];
   const out = [];
   for (const name of readdirSync11(dir)) {
     if (!name.endsWith(".jsonl") || name.endsWith(".events.jsonl")) continue;
-    const streamPath = join31(dir, name);
+    const streamPath = join32(dir, name);
     if (runFinished(streamPath)) continue;
     const sidecar = readRunSidecar(streamPath);
     if (!sidecar || !isAlive(sidecar)) continue;
@@ -14331,7 +15115,8 @@ function describeRun(run2, route2, seatIds, worktreeOf = (d, n) => {
     worktree: repoDir && num ? worktreeOf(repoDir, num) : null,
     stream: run2.streamPath,
     pid: run2.pid,
-    startedAt: run2.spawnedAt
+    startedAt: run2.spawnedAt,
+    deadline: run2.deadline ?? null
   };
 }
 
@@ -14375,7 +15160,7 @@ function formatProjectsReport(report) {
 }
 
 // src/forge-cmd.ts
-import { parseDocument } from "yaml";
+import { parseDocument as parseDocument4 } from "yaml";
 function runCredential(action, stdin, forges, stateDir, env = process.env) {
   try {
     return { code: 0, out: answerCredential(action ?? "", parseCredentialInput(stdin), forges, stateDir, env), err: "" };
@@ -14416,7 +15201,7 @@ function runForge(a, io) {
   if (!existing) {
     const tok = sourceFromArgs(a);
     if (typeof tok === "string") return fail(tok);
-    const doc = parseDocument(io.readFile(io.configFile));
+    const doc = parseDocument4(io.readFile(io.configFile));
     doc.setIn(["ship", "forges", host, "token"], tok);
     io.writeFile(io.configFile, doc.toString());
     io.forges = { ...io.forges ?? {}, [host]: { username: "x-access-token", token: tok } };
@@ -14609,7 +15394,7 @@ function missingReleaserWarning(repo, release, ships, now = Date.now()) {
 }
 
 // src/watch.ts
-import { watch as watchFile, existsSync as existsSync28, statSync as statSync9, openSync as openSync4, readSync as readSync2, closeSync as closeSync4 } from "fs";
+import { watch as watchFile, existsSync as existsSync29, statSync as statSync9, openSync as openSync4, readSync as readSync2, closeSync as closeSync4 } from "fs";
 var E = "\x1B[";
 var dim = (s) => `${E}2m${s}${E}0m`;
 var bold = (s) => `${E}1m${s}${E}0m`;
@@ -14710,7 +15495,7 @@ function renderHeaders(states, now = Date.now()) {
   return states.map((s) => renderHeader(s, now)).join("");
 }
 function readFrom(file, from) {
-  if (!existsSync28(file)) return { events: [], offset: from };
+  if (!existsSync29(file)) return { events: [], offset: from };
   const size = statSync9(file).size;
   if (size < from) return readFrom(file, 0);
   if (size === from) return { events: [], offset: from };
@@ -14953,17 +15738,17 @@ function nextRoles(decision, ran) {
 }
 
 // src/ship-name.ts
-import { existsSync as existsSync30, mkdirSync as mkdirSync19, readFileSync as readFileSync26, renameSync as renameSync3, writeFileSync as writeFileSync21 } from "fs";
-import { dirname as dirname15 } from "path";
-import { parseDocument as parseDocument2 } from "yaml";
+import { existsSync as existsSync31, mkdirSync as mkdirSync19, readFileSync as readFileSync27, renameSync as renameSync3, writeFileSync as writeFileSync22 } from "fs";
+import { dirname as dirname16 } from "path";
+import { parseDocument as parseDocument5 } from "yaml";
 
 // src/machine-id.ts
 import { execFileSync as execFileSync5 } from "child_process";
 import { createHash as createHash5 } from "crypto";
-import { existsSync as existsSync29, mkdirSync as mkdirSync18, readFileSync as readFileSync25, writeFileSync as writeFileSync20 } from "fs";
-import { dirname as dirname14, join as join32 } from "path";
+import { existsSync as existsSync30, mkdirSync as mkdirSync18, readFileSync as readFileSync26, writeFileSync as writeFileSync21 } from "fs";
+import { dirname as dirname15, join as join33 } from "path";
 function machineIdPathFor(stateDir) {
-  return join32(stateDir, "machine-id");
+  return join33(stateDir, "machine-id");
 }
 var sha256 = (s) => createHash5("sha256").update(s).digest("hex");
 function readRawMachineId(platform2 = process.platform) {
@@ -14976,8 +15761,8 @@ function readRawMachineId(platform2 = process.platform) {
       return /"IOPlatformUUID"\s*=\s*"([^"]+)"/.exec(out)?.[1];
     }
     for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
-      if (existsSync29(p)) {
-        const id = readFileSync25(p, "utf8").trim();
+      if (existsSync30(p)) {
+        const id = readFileSync26(p, "utf8").trim();
         if (id) return id;
       }
     }
@@ -14988,15 +15773,15 @@ function readRawMachineId(platform2 = process.platform) {
 function ensureMachineId(stateDir, opts = {}) {
   if (opts.override?.trim()) return sha256(opts.override.trim());
   const path = machineIdPathFor(stateDir);
-  if (existsSync29(path)) {
-    const cached = readFileSync25(path, "utf8").trim();
+  if (existsSync30(path)) {
+    const cached = readFileSync26(path, "utf8").trim();
     if (/^[0-9a-f]{64}$/.test(cached)) return cached;
   }
   const raw = (opts.read ?? readRawMachineId)();
   if (!raw) return void 0;
   const hashed = sha256(raw);
-  mkdirSync18(dirname14(path), { recursive: true });
-  writeFileSync20(path, `${hashed}
+  mkdirSync18(dirname15(path), { recursive: true });
+  writeFileSync21(path, `${hashed}
 `, { mode: 384 });
   return hashed;
 }
@@ -15025,11 +15810,11 @@ function planNameSync(local, row, lastSynced) {
   return { drift: "local", action: "push" };
 }
 function shipNameOfYaml(text) {
-  const v = parseDocument2(text).getIn(["ship", "name"]);
+  const v = parseDocument5(text).getIn(["ship", "name"]);
   return typeof v === "string" && v.trim() ? v.trim() : void 0;
 }
 function setShipNameInYaml(text, name) {
-  const doc = parseDocument2(text);
+  const doc = parseDocument5(text);
   doc.setIn(["ship", "name"], name);
   return doc.toString();
 }
@@ -15067,34 +15852,34 @@ async function syncRouteName(i) {
   return { status: "ok", ...base, action, name: i.local };
 }
 function readSyncedName(resolvedFile) {
-  if (!existsSync30(resolvedFile)) return void 0;
+  if (!existsSync31(resolvedFile)) return void 0;
   try {
-    const v = JSON.parse(readFileSync26(resolvedFile, "utf8")).shipName;
+    const v = JSON.parse(readFileSync27(resolvedFile, "utf8")).shipName;
     return typeof v === "string" ? v : void 0;
   } catch {
     return void 0;
   }
 }
 function writeSyncedName(resolvedFile, name) {
-  if (!existsSync30(resolvedFile)) return;
+  if (!existsSync31(resolvedFile)) return;
   let raw;
   try {
-    raw = JSON.parse(readFileSync26(resolvedFile, "utf8"));
+    raw = JSON.parse(readFileSync27(resolvedFile, "utf8"));
   } catch {
     return;
   }
   if (raw.shipName === name) return;
   raw.shipName = name;
-  mkdirSync19(dirname15(resolvedFile), { recursive: true });
+  mkdirSync19(dirname16(resolvedFile), { recursive: true });
   const tmp = `${resolvedFile}.tmp${process.pid}`;
-  writeFileSync21(tmp, `${JSON.stringify(raw, null, 2)}
+  writeFileSync22(tmp, `${JSON.stringify(raw, null, 2)}
 `);
   renameSync3(tmp, resolvedFile);
 }
 async function reconcileShipName(i) {
   let local = i.ship.name;
   try {
-    local = shipNameOfYaml(readFileSync26(i.configFile, "utf8")) ?? local;
+    local = shipNameOfYaml(readFileSync27(i.configFile, "utf8")) ?? local;
   } catch {
   }
   const resolvedFile = resolvedPathFor(i.stateDir, i.route);
@@ -15118,8 +15903,8 @@ async function reconcileShipName(i) {
   }
   if (result.status !== "ok") return result;
   if (result.action === "adopt" || result.action === "row-wins") {
-    const text = readFileSync26(i.configFile, "utf8");
-    writeFileSync21(i.configFile, setShipNameInYaml(text, result.name));
+    const text = readFileSync27(i.configFile, "utf8");
+    writeFileSync22(i.configFile, setShipNameInYaml(text, result.name));
     i.ship.name = result.name;
     if (result.action === "row-wins") {
       i.emit?.warn(
@@ -15505,7 +16290,10 @@ async function discover(o) {
         ...hostPeriscopes !== void 0 ? { host_periscopes: hostPeriscopes } : {},
         ...sshPublicKey !== void 0 ? { ssh_public_key: sshPublicKey } : {},
         ...ownerId !== void 0 ? { owner_id: ownerId } : {},
-        ...writeMachineId ? { machine_id: machineId } : {}
+        ...writeMachineId ? { machine_id: machineId } : {},
+        // ISSUE-2791: a ship connecting by hand is a developer machine; the
+        // column arrives with a template update, so only written when present.
+        ...shipColumns.has("kind") ? { kind: "developer_machine" } : {}
       });
       shipRowId = created.id;
       out.shipRow = { id: shipRowId, name: o.ship.name, action: "created", matchedBy };
@@ -15640,659 +16428,372 @@ async function discover(o) {
       const mine = people.find(isMine);
       const byEmail = out.meEmail ? candidates2.filter((r) => emailOf(r).some((e) => eq(e, out.meEmail))) : [];
       const unlinked = people.filter((r) => !r.user_id);
-      const only = candidates2.length === 1 && unlinked.length === 1 ? candidates2[0] : void 0;
-      const pick = mine ?? (byEmail.length === 1 ? byEmail[0] : only);
-      if (pick) {
-        out.operator = pick.id;
-        out.operatorAction = isMine(pick) ? "matched" : "linked";
-        if (!isMine(pick) && o.ship) await linkOperatorRow(o, out, pick);
-      } else {
-        out.operatorCompared = `signed in as ${out.meEmail ?? "unknown email"} (identity ${out.meIdentityId ?? out.meId}); ` + (people.length === 0 ? "no person rows in the Crew table" : people.map((r) => {
-          const m = r.user_id ? members.get(r.user_id) : void 0;
-          return `"${r.name || "unnamed row"}" <${r.email ?? "no email"}>` + (r.user_id ? ` linked to member ${m?.email ?? r.user_id}${m?.identityId ? ` (identity ${m.identityId})` : ""}` : " unlinked");
-        }).join("; "));
-        if (o.ship && (!o.interactive || candidates2.length === 0)) await createOperatorRow(o, out);
-      }
-    }
-  }
-  return out;
-}
-async function linkOperatorRow(o, found, row) {
-  const name = row.name || row.id;
-  if (!found.meId || !found.crewModelId) return;
-  if (o.dryRun) {
-    found.provisioning.push(`would link Crew row "${name}" to your account`);
-    return;
-  }
-  const body = { user_id: found.meId };
-  if (!row.email && found.meEmail) body.email = found.meEmail;
-  try {
-    await patch(o, `/data-models/${found.crewModelId}/records/${row.id}`, body);
-    found.provisioning.push(`linked Crew row "${name}" to your account`);
-  } catch (e) {
-    if (!(e instanceof ConnectHttpError) || e.status !== 403) throw e;
-    found.provisioning.push(
-      `could not link your Crew row (no write access) \u2014 ask a workspace admin to set user_id on "${name}"`
-    );
-  }
-}
-async function createOperatorRow(o, found) {
-  if (!found.meId || !found.crewModelId) return;
-  const name = found.meName || found.meEmail || "Operator";
-  if (o.dryRun) {
-    found.provisioning.push(`would create Crew row "${name}" for you`);
-    found.operatorAction = "would-create";
-    return;
-  }
-  try {
-    const created = await post2(o, `/data-models/${found.crewModelId}/records`, {
-      name,
-      ...found.meEmail ? { email: found.meEmail } : {},
-      user_id: found.meId
-    });
-    found.operator = created.id;
-    found.operatorAction = "created";
-    found.holds.push({ id: created.id, name, email: found.meEmail, user_id: found.meId });
-    found.candidates.push({ id: created.id, name, email: found.meEmail, user_id: found.meId, detail: found.meEmail });
-    found.provisioning.push(`created Crew row "${name}" for you`);
-  } catch (e) {
-    if (!(e instanceof ConnectHttpError) || e.status !== 403) throw e;
-    found.provisioning.push("could not create your Crew row (no write access) \u2014 ask a workspace admin to add one with your user_id");
-  }
-}
-function renderConnection(d, route2, dir, opts = {}) {
-  const apiKeyFileLine = opts.keychainBacked ? "" : opts.apiKeyFile ? `    apiKeyFile: "${opts.apiKeyFile}"` : `    apiKeyFile: "REPLACE \u2014 a file holding this workspace's key"`;
-  const apiKeyVarLine = opts.keychainBacked ? "" : opts.apiKeyVar ? `
-    apiKeyVar: ${opts.apiKeyVar}` : `
-    apiKeyVar: REPLACE_KEY_VAR`;
-  const baseUrlLine = opts.baseUrl ? opts.baseUrl.replace(/\/+$/, "") === DEFAULT_BASE_URL ? "" : `    baseUrl: "${opts.baseUrl}"
-` : '    baseUrl: "REPLACE \u2014 the same baseUrl as your other routes"\n';
-  const keyLines = [apiKeyFileLine, apiKeyVarLine.replace(/^\n/, "")].filter(Boolean).join("\n");
-  return `  - route: ${route2}
-    enabled: false          # set to true once \`crew doctor\` is green
-${opts.area ? `    area: "${opts.area}"
-` : ""}${dir === null ? "" : `    dir: "${dir}"
-`}${baseUrlLine}${opts.hostPassengers ? "    hostPassengers: true\n" : ""}${keyLines ? keyLines + "\n" : ""}`;
-}
-
-// src/cli.ts
-import {
-  hostFromUrl as hostFromUrl4,
-  loginWithDeviceCode,
-  DeviceLoginError
-} from "@tablation/client";
-
-// src/capability-check.ts
-var WRITE_LEVELS = /* @__PURE__ */ new Set(["WRITE", "DELETE"]);
-async function canWriteTable(o, modelId) {
-  try {
-    const { access } = await get(o, `/data-models/${modelId}/access`);
-    return access === void 0 ? void 0 : WRITE_LEVELS.has(access);
-  } catch {
-    return void 0;
-  }
-}
-async function projectCapabilities(o, projectId) {
-  if (!projectId) return void 0;
-  try {
-    return await get(o, `/projects/${projectId}/capabilities`);
-  } catch {
-    return void 0;
-  }
-}
-async function checkCapabilities(o, found) {
-  const admin = isAdminRole(found.role);
-  const table2 = async (key, label, tableName2, modelId, askFor) => {
-    if (!modelId) return { key, label, status: "skipped", note: `no ${tableName2} table in this project` };
-    const ok = await canWriteTable(o, modelId);
-    if (ok === void 0) return { key, label, status: "skipped", note: "could not read access" };
-    return ok ? { key, label, status: "ok" } : { key, label, status: "missing", askFor };
-  };
-  const [crew, ships, repos, caps] = await Promise.all([
-    table2("crew-table", "write the Crew table", "Crew", found.crewModelId ?? found.models.crew, "WRITE access on the Crew table"),
-    table2("ships-table", "write the Ships table", "Ships", found.shipsModelId, "WRITE access on the Ships table"),
-    table2("repos-table", "create Repos rows", "Repos", found.reposModelId, "WRITE access on the Repos table"),
-    projectCapabilities(o, found.projectId)
-  ]);
-  const mint = admin || caps?.MINT_AGENT_KEYS ? { key: "mint-agent-keys", label: "mint agent keys", status: "ok" } : caps ? { key: "mint-agent-keys", label: "mint agent keys", status: "missing", askFor: 'the "Mint agent keys" capability' } : { key: "mint-agent-keys", label: "mint agent keys", status: "skipped", note: "could not read capabilities" };
-  const sync = admin ? { key: "sync-personas", label: "sync personas and skills", status: "ok" } : { key: "sync-personas", label: "sync personas and skills", status: "missing", askFor: "the workspace admin role (personas and skills are workspace-level tables)" };
-  return [crew, ships, repos, mint, sync];
-}
-function missLine(i) {
-  return `${i.label} \u2014 ask a workspace admin for ${i.askFor ?? "access"}`;
-}
-function describeCapability(i) {
-  if (i.status === "ok") return `ok       ${i.label}`;
-  if (i.status === "skipped") return `skipped  ${i.label} (${i.note ?? "not checked"})`;
-  return `missing  ${missLine(i)}`;
-}
-
-// src/agents-sync-run.ts
-import { existsSync as existsSync31, mkdirSync as mkdirSync20, readFileSync as readFileSync27, writeFileSync as writeFileSync22 } from "fs";
-import { dirname as dirname16 } from "path";
-async function runAgentsSync(target, o) {
-  const dryRun = o.dryRun ?? false;
-  const force = o.force ?? false;
-  const keyRole = target.resolved?.role ?? await fetchKeyRole(target, o.userAgent);
-  let readOnly = !isAdminRole(keyRole);
-  const runPersonas = (ro) => syncPersonas(target, { userAgent: o.userAgent, dryRun, force, readOnly: ro });
-  let personaResult;
-  try {
-    personaResult = await runPersonas(readOnly);
-  } catch (e) {
-    if (readOnly || !isForbidden(e)) throw e;
-    readOnly = true;
-    personaResult = await runPersonas(true);
-  }
-  o.say(`route: ${target.route}`);
-  for (const p of personaResult.outcomes) o.say(describeSyncOutcome(p));
-  for (const l of personaResult.crewLinks) o.say(describeCrewLink(l));
-  if (personaResult.releaseNote) o.say(personaResult.releaseNote);
-  const briefs = Object.fromEntries(ROLE_NAMES.map((r) => [r, personaDefaultPrompt(target.promptsDir, r)]));
-  for (const w of skillMarkerWarnings(target.promptsDir, briefs)) o.warn(`warning: ${w}`);
-  let skillResult;
-  if (!readOnly) {
-    try {
-      skillResult = await syncSkills(target, { userAgent: o.userAgent, dryRun, force });
-    } catch (e) {
-      if (isForbidden(e)) readOnly = true;
-      else throw e;
-    }
-  }
-  for (const s of skillResult?.outcomes ?? []) o.say(describeSkillSyncOutcome(s));
-  if (!dryRun) {
-    const resolvedPath = resolvedPathFor(o.stateDir, target.route);
-    const raw = existsSync31(resolvedPath) ? JSON.parse(readFileSync27(resolvedPath, "utf8")) : {};
-    raw.agentPersonas = personaResult.agentPersonas;
-    if (skillResult) raw.agentSkills = skillResult.agentSkills;
-    if (personaResult.releaseAgentId) raw.releaseAgentId = personaResult.releaseAgentId;
-    mkdirSync20(dirname16(resolvedPath), { recursive: true });
-    writeFileSync22(resolvedPath, `${JSON.stringify(raw, null, 2)}
-`);
-    if (target.resolved) {
-      target.resolved.agentPersonas = personaResult.agentPersonas;
-      if (personaResult.releaseAgentId) target.resolved.releaseAgentId = personaResult.releaseAgentId;
-    }
-  }
-  if (readOnly) {
-    o.say("personas and skills: not synced (this key is not a workspace admin; the workspace's rows are used as they are)");
-  }
-  const diverged = personaResult.outcomes.some((p) => p.action === "diverged") || (skillResult?.outcomes.some((s) => s.action === "diverged") ?? false);
-  return { personaResult, skillResult, readOnly, diverged };
-}
-
-// src/logbook.ts
-import { createHash as createHash6 } from "crypto";
-import { TablationClient as TablationClient4 } from "@tablation/client";
-var LogbookError = class extends Error {
-};
-function client(route2, userAgent) {
-  return new TablationClient4({
-    baseUrl: `${route2.baseUrl}/api`,
-    apiKey: resolveApiKey(route2),
-    headers: { "User-Agent": userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
-  });
-}
-function requireWorkspace(route2) {
-  if (!route2.resolved) {
-    throw new LogbookError(`route "${route2.route}" has no resolved ids \u2014 run \`crew connect\` first`);
+      const only = candidates2.length === 1 && unlinked.length === 1 ? candidates2[0] : void 0;
+      const pick = mine ?? (byEmail.length === 1 ? byEmail[0] : only);
+      if (pick) {
+        out.operator = pick.id;
+        out.operatorAction = isMine(pick) ? "matched" : "linked";
+        if (!isMine(pick) && o.ship) await linkOperatorRow(o, out, pick);
+      } else {
+        out.operatorCompared = `signed in as ${out.meEmail ?? "unknown email"} (identity ${out.meIdentityId ?? out.meId}); ` + (people.length === 0 ? "no person rows in the Crew table" : people.map((r) => {
+          const m = r.user_id ? members.get(r.user_id) : void 0;
+          return `"${r.name || "unnamed row"}" <${r.email ?? "no email"}>` + (r.user_id ? ` linked to member ${m?.email ?? r.user_id}${m?.identityId ? ` (identity ${m.identityId})` : ""}` : " unlinked");
+        }).join("; "));
+        if (o.ship && (!o.interactive || candidates2.length === 0)) await createOperatorRow(o, out);
+      }
+    }
   }
+  return out;
 }
-async function listLogEntries(route2, opts = {}) {
-  requireWorkspace(route2);
-  const c = client(route2, opts.userAgent);
-  const agentLogModel = await c.dataModels.get("agent_log", route2.resolved.workspaceId);
-  const filters = [];
-  if (opts.ticket) filters.push({ columnName: "ticket_reference", operator: "EQ", value: opts.ticket });
-  if (opts.role) {
-    const agentsModel = await c.dataModels.get("agents", route2.resolved.workspaceId);
-    const rows = await c.records.list(agentsModel.id, { limit: 200 });
-    const match = rows.find((r) => r.name.toLowerCase() === opts.role.toLowerCase());
-    if (!match) return [];
-    filters.push({ columnName: "agent_id", operator: "EQ", value: match.id });
+async function linkOperatorRow(o, found, row) {
+  const name = row.name || row.id;
+  if (!found.meId || !found.crewModelId) return;
+  if (o.dryRun) {
+    found.provisioning.push(`would link Crew row "${name}" to your account`);
+    return;
   }
-  const entries = await c.records.list(agentLogModel.id, {
-    limit: opts.limit ?? 20,
-    ...filters.length > 0 ? { filters: JSON.stringify(filters) } : {}
-  });
-  return [...entries].sort((a, b) => String(b.started_at ?? "").localeCompare(String(a.started_at ?? "")));
-}
-async function showLogEntry(route2, entryId, opts = {}) {
-  requireWorkspace(route2);
-  const c = client(route2, opts.userAgent);
-  const agentLogModel = await c.dataModels.get("agent_log", route2.resolved.workspaceId);
-  let entry;
+  const body = { user_id: found.meId };
+  if (!row.email && found.meEmail) body.email = found.meEmail;
   try {
-    entry = await c.records.get(agentLogModel.id, entryId);
+    await patch(o, `/data-models/${found.crewModelId}/records/${row.id}`, body);
+    found.provisioning.push(`linked Crew row "${name}" to your account`);
   } catch (e) {
-    throw new LogbookError(`no Agent Log entry ${entryId} in this workspace (${e.message})`);
+    if (!(e instanceof ConnectHttpError) || e.status !== 403) throw e;
+    found.provisioning.push(
+      `could not link your Crew row (no write access) \u2014 ask a workspace admin to set user_id on "${name}"`
+    );
   }
-  if (!opts.withPrompt) return { entry, reconstruction: { status: "not_recorded", reason: "not requested" } };
-  if (!entry.agent_id || !entry.prompt_version) {
-    return {
-      entry,
-      reconstruction: {
-        status: "not_recorded",
-        reason: !entry.agent_id ? "this entry has no linked Agents row (predates crew agents sync being run for its role)" : "this entry predates ISSUE-377/529 \u2014 no prompt_version was recorded"
-      }
-    };
+}
+async function createOperatorRow(o, found) {
+  if (!found.meId || !found.crewModelId) return;
+  const name = found.meName || found.meEmail || "Operator";
+  if (o.dryRun) {
+    found.provisioning.push(`would create Crew row "${name}" for you`);
+    found.operatorAction = "would-create";
+    return;
   }
-  const agentsModel = await c.dataModels.get("agents", route2.resolved.workspaceId);
-  let historyEntries;
   try {
-    historyEntries = await fetchHistoryEntries(route2, agentsModel.id, entry.agent_id, opts.userAgent, 200);
-  } catch (e) {
-    return { entry, reconstruction: { status: "approximate", reason: `history lookup failed: ${e.message}` } };
-  }
-  const match = historyEntries.find((h) => h.history_id === entry.prompt_version);
-  if (!match) {
-    return {
-      entry,
-      reconstruction: {
-        status: "approximate",
-        reason: `history entry ${entry.prompt_version} no longer exists on the Agents row (purged, or the row itself was recreated)`
-      }
-    };
-  }
-  const prompt = appendAdditions(match.prompt ?? "", match.prompt_additions);
-  const actualSha = createHash6("sha256").update(prompt).digest("hex");
-  const exact = !!entry.prompt_sha && actualSha === entry.prompt_sha;
-  return {
-    entry,
-    reconstruction: {
-      status: exact ? "exact" : "approximate",
-      historyId: match.history_id,
-      changedAt: match.changed_at,
-      prompt,
-      ...exact ? {} : { reason: entry.prompt_sha ? "stored prompt_sha does not match this history entry's content" : "this entry recorded no prompt_sha to verify against" }
-    }
-  };
-}
-
-// src/repos-check.ts
-import { spawnSync as spawnSync6 } from "child_process";
-import { readFileSync as readFileSync28 } from "fs";
-import { basename as basename8 } from "path";
-var POSIX_SHELL = /^(?:ba|z|da|k|a|mk)?sh$|^fish$/;
-function checkHookSyntax(script, shell) {
-  const spec = resolveShell(shell);
-  const name = basename8(spec.bin).replace(/\.exe$/i, "").toLowerCase();
-  let run2;
-  if (POSIX_SHELL.test(name)) {
-    run2 = spawnSync6(spec.bin, ["-n"], { input: script, encoding: "utf8" });
-  } else if (/^(pwsh|powershell)$/.test(name)) {
-    const parse3 = "$e=$null;[void][System.Management.Automation.Language.Parser]::ParseInput($env:CREW_CHECK_SCRIPT,[ref]$null,[ref]$e);if($e){$e|ForEach-Object{[Console]::Error.WriteLine($_.Message)};exit 1}";
-    run2 = spawnSync6(spec.bin, ["-NoProfile", "-NonInteractive", "-Command", parse3], {
-      encoding: "utf8",
-      env: { ...process.env, CREW_CHECK_SCRIPT: script }
+    const created = await post2(o, `/data-models/${found.crewModelId}/records`, {
+      name,
+      ...found.meEmail ? { email: found.meEmail } : {},
+      user_id: found.meId
     });
-  } else {
-    return { status: "unchecked", message: `no syntax check for ${spec.bin}` };
+    found.operator = created.id;
+    found.operatorAction = "created";
+    found.holds.push({ id: created.id, name, email: found.meEmail, user_id: found.meId });
+    found.candidates.push({ id: created.id, name, email: found.meEmail, user_id: found.meId, detail: found.meEmail });
+    found.provisioning.push(`created Crew row "${name}" for you`);
+  } catch (e) {
+    if (!(e instanceof ConnectHttpError) || e.status !== 403) throw e;
+    found.provisioning.push("could not create your Crew row (no write access) \u2014 ask a workspace admin to add one with your user_id");
   }
-  if (run2.error) return { status: "unchecked", message: `cannot run ${spec.bin}: ${run2.error.message}` };
-  if (run2.status === 0) return { status: "ok" };
-  const message = `${run2.stderr ?? ""}${run2.stdout ?? ""}`.trim() || `${spec.bin} exited ${run2.status}`;
-  return { status: "error", message };
 }
-function renderSamples(cfg, dir) {
-  const checkout = basename8(dir.replace(/[/\\]+$/, ""));
-  const tagged = { key: "ISSUE-123", title: "Fix the widget", role: "dev", tag: "TABL-123", prefix: "tabl", lowercase: cfg.branch.lowercase };
-  const untagged = { key: "ISSUE-123", title: "Fix the widget", role: "dev", lowercase: cfg.branch.lowercase };
-  return [["with a project tag", tagged], ["without a project tag", untagged]].map(([label, ctx]) => {
-    const branch = renderBranchName(effectiveBranchTemplate(cfg, ctx.prefix), ctx);
-    const worktree = effectiveWorktreeDirName(cfg, dir, branch, "123", (t) => renderWorktreeName(t, { ...ctx, dir: checkout }));
-    return { case: label, branch, worktree };
-  });
+function renderConnection(d, route2, dir, opts = {}) {
+  const apiKeyFileLine = opts.keychainBacked ? "" : opts.apiKeyFile ? `    apiKeyFile: "${opts.apiKeyFile}"` : `    apiKeyFile: "REPLACE \u2014 a file holding this workspace's key"`;
+  const apiKeyVarLine = opts.keychainBacked ? "" : opts.apiKeyVar ? `
+    apiKeyVar: ${opts.apiKeyVar}` : `
+    apiKeyVar: REPLACE_KEY_VAR`;
+  const baseUrlLine = opts.baseUrl ? opts.baseUrl.replace(/\/+$/, "") === DEFAULT_BASE_URL ? "" : `    baseUrl: "${opts.baseUrl}"
+` : '    baseUrl: "REPLACE \u2014 the same baseUrl as your other routes"\n';
+  const keyLines = [apiKeyFileLine, apiKeyVarLine.replace(/^\n/, "")].filter(Boolean).join("\n");
+  return `  - route: ${route2}
+    enabled: false          # set to true once \`crew doctor\` is green
+${opts.area ? `    area: "${opts.area}"
+` : ""}${dir === null ? "" : `    dir: "${dir}"
+`}${baseUrlLine}${opts.hostPassengers ? "    hostPassengers: true\n" : ""}${keyLines ? keyLines + "\n" : ""}`;
 }
-function checkRepoSpec(dir, opts = {}) {
-  const empty = { parsed: null, effective: null, readiness: [], hooks: [], shadowed: [], samples: [] };
-  const file = findRepoConfig(dir);
-  if (!file) {
-    return { ...empty, file: null, error: `no .crew.yaml, .crew.yml or .crew.json in ${dir}`, exitCode: 1 };
-  }
-  let parsed;
+
+// src/cli.ts
+import {
+  hostFromUrl as hostFromUrl4,
+  loginWithDeviceCode,
+  DeviceLoginError
+} from "@tablation/client";
+
+// src/capability-check.ts
+var WRITE_LEVELS = /* @__PURE__ */ new Set(["WRITE", "DELETE"]);
+async function canWriteTable(o, modelId) {
   try {
-    parsed = parseRepoConfig(readFileSync28(file, "utf8"), file);
-  } catch (e) {
-    if (!(e instanceof RepoConfigError)) throw e;
-    return { ...empty, file, error: e.message, exitCode: 1 };
+    const { access } = await get(o, `/data-models/${modelId}/access`);
+    return access === void 0 ? void 0 : WRITE_LEVELS.has(access);
+  } catch {
+    return void 0;
   }
-  const effective = resolveRepoConfig(parsed, opts.ship, dir);
-  const readiness = validateEffective(effective);
-  const hooks = Object.keys(effective.hooks).map((name) => ({
-    name,
-    label: hookLabel(effective, name),
-    syntax: checkHookSyntax(effective.hooks[name], effective.shell)
-  }));
-  const failed = hooks.some((h) => h.syntax.status === "error");
-  return {
-    file,
-    parsed,
-    effective,
-    readiness,
-    hooks,
-    shadowed: effective.shadowed,
-    samples: renderSamples(effective, dir),
-    error: null,
-    exitCode: failed || opts.strict && readiness.length > 0 ? 1 : 0
-  };
 }
-function renderRepoCheck(r) {
-  if (r.error) return `${r.file ?? "crew repos check"}: ${r.error}
-`;
-  const e = r.effective;
-  const lines = [
-    `${r.file}`,
-    `  platform           ${e.platform}`,
-    `  release.mode       ${e.release.mode}`,
-    `  release.versioning ${e.release.versioning}`,
-    `  branch.base        ${e.branch.base}`,
-    `  branch.name        ${e.branch.name}`,
-    `  branch.push        ${e.branch.push}`
-  ];
-  for (const s of r.samples) lines.push(`  ${s.case}: branch ${s.branch}, worktree ../${s.worktree}`);
-  lines.push(r.hooks.length ? "  hooks" : "  hooks              none");
-  for (const h of r.hooks) {
-    const named = h.label !== e.hooks[h.name] ? ` (${h.label})` : "";
-    const syntax = h.syntax.status === "ok" ? "syntax ok" : h.syntax.status === "unchecked" ? `syntax not checked: ${h.syntax.message}` : "syntax ERROR";
-    lines.push(`    ${h.name}${named}: ${syntax}`);
-    if (h.syntax.status === "error") lines.push(...(h.syntax.message ?? "").split("\n").map((l) => `      ${l}`));
+async function projectCapabilities(o, projectId) {
+  if (!projectId) return void 0;
+  try {
+    return await get(o, `/projects/${projectId}/capabilities`);
+  } catch {
+    return void 0;
   }
-  if (r.shadowed.length) lines.push(`  this ship declares ${r.shadowed.join(", ")}, and the file overrides it \u2014 the file wins`);
-  for (const p of r.readiness) lines.push(`  - release readiness: ${p}`);
-  return `${lines.join("\n")}
-`;
 }
-
-// src/repos-hooks.ts
-import { isMap as isMap2, parseDocument as parseDocument4, YAMLMap } from "yaml";
-
-// src/repos-cmd.ts
-import { homedir as homedir9 } from "os";
-import { basename as basename9, join as join33, resolve as resolve3 } from "path";
-import { isMap, isSeq, parseDocument as parseDocument3, stringify as stringify2 } from "yaml";
-var ReposError = class extends Error {
-};
-function normalizeRemote(url) {
-  if (!url) return void 0;
-  let s = url.trim();
-  if (!s) return void 0;
-  const scp = /^[^\s@/]+@[^\s:/]+:(.+)$/.exec(s);
-  if (scp) s = scp[1];
-  else s = s.replace(/^[a-z][a-z0-9+.-]*:\/\/(?:[^/@]+@)?[^/]+\//i, "");
-  s = s.replace(/\/+$/, "").replace(/\.git$/i, "");
-  const parts = s.split("/").filter(Boolean);
-  if (parts.length < 2) return void 0;
-  return parts.slice(-2).join("/").toLowerCase();
+async function checkCapabilities(o, found) {
+  const admin = isAdminRole(found.role);
+  const table2 = async (key, label, tableName2, modelId, askFor) => {
+    if (!modelId) return { key, label, status: "skipped", note: `no ${tableName2} table in this project` };
+    const ok = await canWriteTable(o, modelId);
+    if (ok === void 0) return { key, label, status: "skipped", note: "could not read access" };
+    return ok ? { key, label, status: "ok" } : { key, label, status: "missing", askFor };
+  };
+  const [crew, ships, repos, caps] = await Promise.all([
+    table2("crew-table", "write the Crew table", "Crew", found.crewModelId ?? found.models.crew, "WRITE access on the Crew table"),
+    table2("ships-table", "write the Ships table", "Ships", found.shipsModelId, "WRITE access on the Ships table"),
+    table2("repos-table", "create Repos rows", "Repos", found.reposModelId, "WRITE access on the Repos table"),
+    projectCapabilities(o, found.projectId)
+  ]);
+  const mint = admin || caps?.MINT_AGENT_KEYS ? { key: "mint-agent-keys", label: "mint agent keys", status: "ok" } : caps ? { key: "mint-agent-keys", label: "mint agent keys", status: "missing", askFor: 'the "Mint agent keys" capability' } : { key: "mint-agent-keys", label: "mint agent keys", status: "skipped", note: "could not read capabilities" };
+  const sync = admin ? { key: "sync-personas", label: "sync personas and skills", status: "ok" } : { key: "sync-personas", label: "sync personas and skills", status: "missing", askFor: "the workspace admin role (personas and skills are workspace-level tables)" };
+  return [crew, ships, repos, mint, sync];
 }
-function matchRepoName(origin, resolved) {
-  const want = normalizeRemote(origin);
-  if (!want || !resolved?.repoRemotes) return void 0;
-  for (const [id, remote] of Object.entries(resolved.repoRemotes)) {
-    if (normalizeRemote(remote) === want) return resolved.repoNames?.[id];
-  }
-  return void 0;
+function missLine(i) {
+  return `${i.label} \u2014 ask a workspace admin for ${i.askFor ?? "access"}`;
 }
-function routeNamesOf(text) {
-  const routes = parseDocument3(text).get("routes", true);
-  if (!isSeq(routes)) return [];
-  return routes.items.flatMap((i) => isMap(i) && typeof i.get("route") === "string" ? [i.get("route")] : []);
+function describeCapability(i) {
+  if (i.status === "ok") return `ok       ${i.label}`;
+  if (i.status === "skipped") return `skipped  ${i.label} (${i.note ?? "not checked"})`;
+  return `missing  ${missLine(i)}`;
 }
-function parseAddArgs(args, routes, isDir) {
-  const rest = [...args];
-  let route2;
-  if (rest.length > 0 && routes.includes(rest[0])) route2 = rest.shift();
-  else if (rest.length > 0 && /^[^/\s]+\/[^/\s]+$/.test(rest[0]) && !isDir(rest[0])) {
-    throw new ReposError(`no route "${rest[0]}" in the config (have: ${routes.join(", ") || "none"})`);
+
+// src/agents-sync-run.ts
+import { existsSync as existsSync32, mkdirSync as mkdirSync20, readFileSync as readFileSync28, writeFileSync as writeFileSync23 } from "fs";
+import { dirname as dirname17 } from "path";
+async function runAgentsSync(target, o) {
+  const dryRun = o.dryRun ?? false;
+  const force = o.force ?? false;
+  const keyRole = target.resolved?.role ?? await fetchKeyRole(target, o.userAgent);
+  let readOnly = !isAdminRole(keyRole);
+  const runPersonas = (ro) => syncPersonas(target, { userAgent: o.userAgent, dryRun, force, readOnly: ro });
+  let personaResult;
+  try {
+    personaResult = await runPersonas(readOnly);
+  } catch (e) {
+    if (readOnly || !isForbidden(e)) throw e;
+    readOnly = true;
+    personaResult = await runPersonas(true);
   }
-  if (!route2) {
-    if (routes.length === 1) route2 = routes[0];
-    else throw new ReposError(routes.length === 0 ? "the config has no routes \u2014 run `crew connect` first" : `several routes are configured; name one: ${routes.join(", ")}`);
+  o.say(`route: ${target.route}`);
+  for (const p of personaResult.outcomes) o.say(describeSyncOutcome(p));
+  for (const l of personaResult.crewLinks) o.say(describeCrewLink(l));
+  if (personaResult.releaseNote) o.say(personaResult.releaseNote);
+  const briefs = Object.fromEntries(ROLE_NAMES.map((r) => [r, personaDefaultPrompt(target.promptsDir, r)]));
+  for (const w of skillMarkerWarnings(target.promptsDir, briefs)) o.warn(`warning: ${w}`);
+  let skillResult;
+  if (!readOnly) {
+    try {
+      skillResult = await syncSkills(target, { userAgent: o.userAgent, dryRun, force });
+    } catch (e) {
+      if (isForbidden(e)) readOnly = true;
+      else throw e;
+    }
   }
-  if (rest.length > 2) throw new ReposError("too many arguments: expected [route] [name] [path]");
-  if (rest.length === 2) return { route: route2, name: rest[0], path: rest[1] };
-  if (rest.length === 1) return isDir(rest[0]) ? { route: route2, path: rest[0] } : { route: route2, name: rest[0], path: "." };
-  return { route: route2, path: "." };
-}
-function expandDir(p, base) {
-  const home = p === "~" ? homedir9() : p.startsWith("~/") ? `${homedir9()}/${p.slice(2)}` : p;
-  return resolve3(base, home);
-}
-function routeMapOf(doc, route2) {
-  const routes = doc.get("routes", true);
-  if (isSeq(routes)) {
-    for (const item of routes.items) {
-      if (isMap(item) && item.get("route") === route2) return item;
+  for (const s of skillResult?.outcomes ?? []) o.say(describeSkillSyncOutcome(s));
+  if (!dryRun) {
+    const resolvedPath = resolvedPathFor(o.stateDir, target.route);
+    const raw = existsSync32(resolvedPath) ? JSON.parse(readFileSync28(resolvedPath, "utf8")) : {};
+    raw.agentPersonas = personaResult.agentPersonas;
+    if (skillResult) raw.agentSkills = skillResult.agentSkills;
+    if (personaResult.releaseAgentId) raw.releaseAgentId = personaResult.releaseAgentId;
+    mkdirSync20(dirname17(resolvedPath), { recursive: true });
+    writeFileSync23(resolvedPath, `${JSON.stringify(raw, null, 2)}
+`);
+    if (target.resolved) {
+      target.resolved.agentPersonas = personaResult.agentPersonas;
+      if (personaResult.releaseAgentId) target.resolved.releaseAgentId = personaResult.releaseAgentId;
     }
   }
-  const have = isSeq(routes) ? routes.items.map((i) => isMap(i) ? String(i.get("route")) : "?").join(", ") : "none";
-  throw new ReposError(`no route "${route2}" in the config (have: ${have})`);
-}
-function configuredRepos(text, route2, base) {
-  const doc = parseDocument3(text);
-  const m = routeMapOf(doc, route2);
-  const repos = m.get("repos");
-  if (isMap(repos)) {
-    return repos.items.map((p) => {
-      const name = String(p.key.value ?? p.key);
-      const v = p.value;
-      const dir2 = isMap(v) ? String(v.get("dir") ?? "") : String(v?.value ?? "");
-      return { name, dir: expandDir(dir2, base) };
-    });
+  if (readOnly) {
+    o.say("personas and skills: not synced (this key is not a workspace admin; the workspace's rows are used as they are)");
   }
-  const dir = m.get("dir");
-  return dir ? [{ name: basename9(String(dir)), dir: expandDir(String(dir), base) }] : [];
+  const diverged = personaResult.outcomes.some((p) => p.action === "diverged") || (skillResult?.outcomes.some((s) => s.action === "diverged") ?? false);
+  return { personaResult, skillResult, readOnly, diverged };
 }
-function cloneBaseOf(text, route2, base, isCheckout) {
-  const m = routeMapOf(parseDocument3(text), route2);
-  const repos = m.get("repos", true);
-  if (isMap(repos) && repos.items.length > 0) return null;
-  const dir = m.get("dir");
-  if (!dir) return null;
-  const abs = expandDir(String(dir), base);
-  return isCheckout(abs) ? null : abs;
+
+// src/logbook.ts
+import { createHash as createHash6 } from "crypto";
+import { TablationClient as TablationClient4 } from "@tablation/client";
+var LogbookError = class extends Error {
+};
+function client(route2, userAgent) {
+  return new TablationClient4({
+    baseUrl: `${route2.baseUrl}/api`,
+    apiKey: resolveApiKey(route2),
+    headers: { "User-Agent": userAgent ?? "Mozilla/5.0 TablationCrewAgent/1.0" }
+  });
 }
-function routeSetsHooks(text, route2, name) {
-  const m = routeMapOf(parseDocument3(text), route2);
-  const repos = m.get("repos", true);
-  let target = m;
-  if (isMap(repos)) target = repos.get(name, true);
-  if (!isMap(target)) return false;
-  const hooks = target.get("hooks", true);
-  return isMap(hooks) && hooks.items.length > 0;
+function requireWorkspace(route2) {
+  if (!route2.resolved) {
+    throw new LogbookError(`route "${route2.route}" has no resolved ids \u2014 run \`crew connect\` first`);
+  }
 }
-function listRepoRows(i) {
-  const cloneBase = i.isCheckout ? cloneBaseOf(i.text, i.route, i.base, i.isCheckout) : null;
-  const checkouts = configuredRepos(i.text, i.route, i.base).filter((c) => c.dir !== cloneBase);
-  const claimed = /* @__PURE__ */ new Set();
-  const hooksSourceOf = (c) => i.exists(c.dir) && i.repoHasHooks(c.dir) ? "repo" : routeSetsHooks(i.text, i.route, c.name) ? "route" : "none";
-  const originFor = (c, remote) => {
-    const o = i.originOf(c.dir) ?? null;
-    if (!o) return null;
-    return remote !== null && normalizeRemote(o) === normalizeRemote(remote) ? null : o;
-  };
-  const rows = [];
-  const names = i.resolved?.repoNames ?? {};
-  const remotes = i.resolved?.repoRemotes ?? {};
-  for (const [id, name] of Object.entries(names)) {
-    const remote = remotes[id] ?? null;
-    const want = normalizeRemote(remote);
-    let idx = checkouts.findIndex((c2, n) => !claimed.has(n) && want !== void 0 && normalizeRemote(i.originOf(c2.dir)) === want);
-    if (idx < 0) idx = checkouts.findIndex((c2, n) => !claimed.has(n) && c2.name === name);
-    const c = idx >= 0 ? checkouts[idx] : void 0;
-    if (idx >= 0) claimed.add(idx);
-    rows.push({
-      name,
-      remote,
-      repoRowId: id,
-      attached: c !== void 0,
-      dir: c?.dir ?? null,
-      exists: c ? i.exists(c.dir) : false,
-      origin: c ? originFor(c, remote) : null,
-      matchedRow: c ? name : null,
-      hooksSource: c ? hooksSourceOf(c) : "none"
-    });
+async function listLogEntries(route2, opts = {}) {
+  requireWorkspace(route2);
+  const c = client(route2, opts.userAgent);
+  const agentLogModel = await c.dataModels.get("agent_log", route2.resolved.workspaceId);
+  const filters = [];
+  if (opts.ticket) filters.push({ columnName: "ticket_reference", operator: "EQ", value: opts.ticket });
+  if (opts.role) {
+    const agentsModel = await c.dataModels.get("agents", route2.resolved.workspaceId);
+    const rows = await c.records.list(agentsModel.id, { limit: 200 });
+    const match = rows.find((r) => r.name.toLowerCase() === opts.role.toLowerCase());
+    if (!match) return [];
+    filters.push({ columnName: "agent_id", operator: "EQ", value: match.id });
   }
-  checkouts.forEach((c, n) => {
-    if (claimed.has(n)) return;
-    rows.push({
-      name: c.name,
-      remote: null,
-      repoRowId: null,
-      attached: true,
-      dir: c.dir,
-      exists: i.exists(c.dir),
-      origin: originFor(c, null),
-      matchedRow: null,
-      hooksSource: hooksSourceOf(c)
-    });
+  const entries = await c.records.list(agentLogModel.id, {
+    limit: opts.limit ?? 20,
+    ...filters.length > 0 ? { filters: JSON.stringify(filters) } : {}
   });
-  return rows;
+  return [...entries].sort((a, b) => String(b.started_at ?? "").localeCompare(String(a.started_at ?? "")));
 }
-function planRepoAdd(i) {
-  const doc = parseDocument3(i.text);
-  if (doc.errors.length > 0) throw new ReposError(`config is not valid YAML \u2014 ${doc.errors[0].message}`);
-  const m = routeMapOf(doc, i.route);
-  let existing = configuredRepos(i.text, i.route, i.base);
-  const target = expandDir(i.path, i.base);
-  let droppedDir;
-  const placeholder = m.get("dir");
-  const reposNow = m.get("repos", true);
-  if (i.isCheckout && placeholder && !(isMap(reposNow) && reposNow.items.length > 0)) {
-    const placeholderDir = expandDir(String(placeholder), i.base);
-    if (placeholderDir !== target && !i.isCheckout(placeholderDir)) {
-      droppedDir = placeholderDir;
-      m.delete("dir");
-      existing = [];
-    }
-  }
-  if (existing.some((e) => e.dir === target)) {
-    throw new ReposError(`${target} is already configured on route ${i.route}`);
+async function showLogEntry(route2, entryId, opts = {}) {
+  requireWorkspace(route2);
+  const c = client(route2, opts.userAgent);
+  const agentLogModel = await c.dataModels.get("agent_log", route2.resolved.workspaceId);
+  let entry;
+  try {
+    entry = await c.records.get(agentLogModel.id, entryId);
+  } catch (e) {
+    throw new LogbookError(`no Agent Log entry ${entryId} in this workspace (${e.message})`);
   }
-  const matched = matchRepoName(i.origin, i.resolved);
-  const name = matched ?? i.name ?? normalizeRemote(i.origin)?.split("/").pop() ?? basename9(target);
-  let warning;
-  if (!matched) {
-    const known = Object.values(i.resolved?.repoNames ?? {});
-    warning = i.origin ? `the tracker has no Repos row for remote ${normalizeRemote(i.origin) ?? i.origin}${known.length ? ` (known: ${known.join(", ")})` : ""} \u2014 added anyway; create the row so ticket routing can find it` : "this checkout has no origin remote, so it cannot be matched to a Repos row \u2014 added anyway";
+  if (!opts.withPrompt) return { entry, reconstruction: { status: "not_recorded", reason: "not requested" } };
+  if (!entry.agent_id || !entry.prompt_version) {
+    return {
+      entry,
+      reconstruction: {
+        status: "not_recorded",
+        reason: !entry.agent_id ? "this entry has no linked Agents row (predates crew agents sync being run for its role)" : "this entry predates ISSUE-377/529 \u2014 no prompt_version was recorded"
+      }
+    };
   }
-  const repos = m.get("repos", true);
-  let mode;
-  if (isMap(repos)) {
-    if (repos.has(name)) throw new ReposError(`route ${i.route} already has a repo named "${name}" (${String(repos.get(name))})`);
-    repos.set(name, target);
-    mode = "repos";
-  } else if (m.has("dir") && existing.length > 0) {
-    const old = existing[0];
-    const oldName = i.nameForExisting?.(old.dir) ?? old.name;
-    if (oldName === name) throw new ReposError(`route ${i.route} already has a repo named "${name}" (${old.dir})`);
-    const oldDir = String(m.get("dir"));
-    const pair = m.items.find((p) => p.key.value === "dir");
-    pair.key = doc.createNode("repos");
-    pair.value = doc.createNode({ [oldName]: oldDir, [name]: target });
-    mode = "repos";
-  } else if (droppedDir) {
-    m.set("repos", doc.createNode({ [name]: target }));
-    mode = "repos";
-  } else {
-    m.set("dir", target);
-    mode = "dir";
+  const agentsModel = await c.dataModels.get("agents", route2.resolved.workspaceId);
+  let historyEntries;
+  try {
+    historyEntries = await fetchHistoryEntries(route2, agentsModel.id, entry.agent_id, opts.userAgent, 200);
+  } catch (e) {
+    return { entry, reconstruction: { status: "approximate", reason: `history lookup failed: ${e.message}` } };
   }
-  return { text: String(doc), mode, name, block: renderBlock(m), warning, unmatched: !matched, droppedDir };
-}
-function planRepoRemove(text, base, route2, path) {
-  const doc = parseDocument3(text);
-  if (doc.errors.length > 0) throw new ReposError(`config is not valid YAML \u2014 ${doc.errors[0].message}`);
-  const m = routeMapOf(doc, route2);
-  const target = expandDir(path, base);
-  const existing = configuredRepos(text, route2, base);
-  const hit = existing.find((e) => e.dir === target);
-  if (!hit) throw new ReposError(`${target} is not configured on route ${route2}`);
-  const repos = m.get("repos", true);
-  if (isMap(repos)) {
-    repos.delete(hit.name);
-    const left = existing.filter((e) => e !== hit);
-    if (left.length === 1) {
-      const pair = m.items.find((p) => p.key.value === "repos");
-      pair.key = doc.createNode("dir");
-      pair.value = doc.createNode(String(repos.get(left[0].name)));
-    } else if (left.length === 0) m.delete("repos");
-  } else {
-    m.delete("dir");
+  const match = historyEntries.find((h) => h.history_id === entry.prompt_version);
+  if (!match) {
+    return {
+      entry,
+      reconstruction: {
+        status: "approximate",
+        reason: `history entry ${entry.prompt_version} no longer exists on the Agents row (purged, or the row itself was recreated)`
+      }
+    };
   }
-  return { text: String(doc), name: hit.name };
-}
-function renderBlock(m) {
-  return stringify2([m.toJSON()]).trimEnd();
-}
-var LOCAL_RELEASE_MODES = /* @__PURE__ */ new Set(["integrate", "external"]);
-function planRepoRow(i) {
-  const remote = normalizeRemote(i.origin);
-  if (!remote) throw new ReposError(`cannot derive an owner/repo from origin "${i.origin}"`);
-  const mode = i.spec?.releaseMode;
+  const prompt = appendAdditions(match.prompt ?? "", match.prompt_additions);
+  const actualSha = createHash6("sha256").update(prompt).digest("hex");
+  const exact = !!entry.prompt_sha && actualSha === entry.prompt_sha;
   return {
-    name: i.name,
-    remote,
-    platform: i.spec?.platform ?? "unix",
-    release_mode: mode ? LOCAL_RELEASE_MODES.has(mode) ? "local" : mode : "local",
-    ci_provider: i.spec?.ciProvider ?? "none",
-    enabled: true,
-    project_id: i.projectId
+    entry,
+    reconstruction: {
+      status: exact ? "exact" : "approximate",
+      historyId: match.history_id,
+      changedAt: match.changed_at,
+      prompt,
+      ...exact ? {} : { reason: entry.prompt_sha ? "stored prompt_sha does not match this history entry's content" : "this entry recorded no prompt_sha to verify against" }
+    }
   };
 }
-function resolveRepoProject(projects, opt, routeAreaId) {
-  if (opt) {
-    const want = opt.toLowerCase();
-    const hit = projects.find((p) => p.id === opt || p.name?.toLowerCase() === want);
-    if (!hit) throw new ReposError(`no Projects row "${opt}" (have: ${projects.map((p) => p.name ?? p.id).join(", ") || "none"})`);
-    return hit.id;
+
+// src/repos-check.ts
+import { spawnSync as spawnSync7 } from "child_process";
+import { readFileSync as readFileSync29 } from "fs";
+import { basename as basename9 } from "path";
+var POSIX_SHELL = /^(?:ba|z|da|k|a|mk)?sh$|^fish$/;
+function checkHookSyntax(script, shell) {
+  const spec = resolveShell(shell);
+  const name = basename9(spec.bin).replace(/\.exe$/i, "").toLowerCase();
+  let run2;
+  if (POSIX_SHELL.test(name)) {
+    run2 = spawnSync7(spec.bin, ["-n"], { input: script, encoding: "utf8" });
+  } else if (/^(pwsh|powershell)$/.test(name)) {
+    const parse3 = "$e=$null;[void][System.Management.Automation.Language.Parser]::ParseInput($env:CREW_CHECK_SCRIPT,[ref]$null,[ref]$e);if($e){$e|ForEach-Object{[Console]::Error.WriteLine($_.Message)};exit 1}";
+    run2 = spawnSync7(spec.bin, ["-NoProfile", "-NonInteractive", "-Command", parse3], {
+      encoding: "utf8",
+      env: { ...process.env, CREW_CHECK_SCRIPT: script }
+    });
+  } else {
+    return { status: "unchecked", message: `no syntax check for ${spec.bin}` };
   }
-  if (routeAreaId) return routeAreaId;
-  if (projects.length === 1) return projects[0].id;
-  throw new ReposError(
-    `cannot tell which project the new Repos row belongs to \u2014 pass --project <name> (have: ${projects.map((p) => p.name ?? p.id).join(", ") || "none"}), or --no-create to skip creating it`
-  );
+  if (run2.error) return { status: "unchecked", message: `cannot run ${spec.bin}: ${run2.error.message}` };
+  if (run2.status === 0) return { status: "ok" };
+  const message = `${run2.stderr ?? ""}${run2.stdout ?? ""}`.trim() || `${spec.bin} exited ${run2.status}`;
+  return { status: "error", message };
 }
-function parseCloneArgs(args, routes) {
-  const rest = [...args];
-  let route2;
-  if (rest.length > 1 && routes.includes(rest[0])) route2 = rest.shift();
-  else if (rest.length > 1) throw new ReposError(`no route "${rest[0]}" in the config (have: ${routes.join(", ") || "none"})`);
-  if (!route2) {
-    if (routes.length === 1) route2 = routes[0];
-    else throw new ReposError(routes.length === 0 ? "the config has no routes \u2014 run `crew connect` first" : `several routes are configured; name one: ${routes.join(", ")}`);
-  }
-  if (rest.length !== 1) throw new ReposError("expected [route] <name> \u2014 the Repos row to clone (see `crew repos list`)");
-  return { route: route2, name: rest[0] };
+function renderSamples(cfg, dir) {
+  const checkout = basename9(dir.replace(/[/\\]+$/, ""));
+  const tagged = { key: "ISSUE-123", title: "Fix the widget", role: "dev", tag: "TABL-123", prefix: "tabl", lowercase: cfg.branch.lowercase };
+  const untagged = { key: "ISSUE-123", title: "Fix the widget", role: "dev", lowercase: cfg.branch.lowercase };
+  return [["with a project tag", tagged], ["without a project tag", untagged]].map(([label, ctx]) => {
+    const branch = renderBranchName(effectiveBranchTemplate(cfg, ctx.prefix), ctx);
+    const worktree = effectiveWorktreeDirName(cfg, dir, branch, "123", (t) => renderWorktreeName(t, { ...ctx, dir: checkout }));
+    return { case: label, branch, worktree };
+  });
 }
-function planRepoClone(i) {
-  const names = i.resolved?.repoNames ?? {};
-  const id = Object.keys(names).find((k) => names[k].toLowerCase() === i.name.toLowerCase());
-  if (!id) {
-    const known = Object.values(names);
-    throw new ReposError(`the tracker has no Repos row named "${i.name}" for route ${i.route}${known.length ? ` (known: ${known.join(", ")})` : " \u2014 run `crew connect` to refresh them"}`);
+function checkRepoSpec(dir, opts = {}) {
+  const empty = { parsed: null, effective: null, readiness: [], hooks: [], shadowed: [], samples: [] };
+  const file = findRepoConfig(dir);
+  if (!file) {
+    return { ...empty, file: null, error: `no .crew.yaml, .crew.yml or .crew.json in ${dir}`, exitCode: 1 };
   }
-  const name = names[id];
-  const remote = normalizeRemote(i.resolved?.repoRemotes?.[id]);
-  if (!remote) {
-    throw new ReposError(
-      `the Repos row "${name}" has no remote to clone from \u2014 attach an existing checkout with \`crew repos add ${i.route} ${name} <path>\`, or set the row's remote in the tracker and re-run \`crew connect\``
-    );
+  let parsed;
+  try {
+    parsed = parseRepoConfig(readFileSync29(file, "utf8"), file);
+  } catch (e) {
+    if (!(e instanceof RepoConfigError)) throw e;
+    return { ...empty, file, error: e.message, exitCode: 1 };
   }
-  const doc = parseDocument3(i.text);
-  const m = routeMapOf(doc, i.route);
-  const existing = configuredRepos(i.text, i.route, i.base);
-  if (existing.some((e) => e.name.toLowerCase() === name.toLowerCase())) {
-    throw new ReposError(`route ${i.route} already has a checkout named "${name}" \u2014 nothing to clone`);
+  const effective = resolveRepoConfig(parsed, opts.ship, dir);
+  const readiness = validateEffective(effective);
+  const hooks = Object.keys(effective.hooks).map((name) => ({
+    name,
+    label: hookLabel(effective, name),
+    syntax: checkHookSyntax(effective.hooks[name], effective.shell)
+  }));
+  const failed = hooks.some((h) => h.syntax.status === "error");
+  return {
+    file,
+    parsed,
+    effective,
+    readiness,
+    hooks,
+    shadowed: effective.shadowed,
+    samples: renderSamples(effective, dir),
+    error: null,
+    exitCode: failed || opts.strict && readiness.length > 0 ? 1 : 0
+  };
+}
+function renderRepoCheck(r) {
+  if (r.error) return `${r.file ?? "crew repos check"}: ${r.error}
+`;
+  const e = r.effective;
+  const lines = [
+    `${r.file}`,
+    `  platform           ${e.platform}`,
+    `  release.mode       ${e.release.mode}`,
+    `  release.versioning ${e.release.versioning}`,
+    `  branch.base        ${e.branch.base}`,
+    `  branch.name        ${e.branch.name}`,
+    `  branch.push        ${e.branch.push}`
+  ];
+  for (const s of r.samples) lines.push(`  ${s.case}: branch ${s.branch}, worktree ../${s.worktree}`);
+  lines.push(r.hooks.length ? "  hooks" : "  hooks              none");
+  for (const h of r.hooks) {
+    const named = h.label !== e.hooks[h.name] ? ` (${h.label})` : "";
+    const syntax = h.syntax.status === "ok" ? "syntax ok" : h.syntax.status === "unchecked" ? `syntax not checked: ${h.syntax.message}` : "syntax ERROR";
+    lines.push(`    ${h.name}${named}: ${syntax}`);
+    if (h.syntax.status === "error") lines.push(...(h.syntax.message ?? "").split("\n").map((l) => `      ${l}`));
   }
-  const ship = doc.get("ship", true);
-  const basePath = String(m.get("reposBasePath") ?? (isMap(ship) ? ship.get("reposBasePath") : void 0) ?? "~/Crew");
-  const target = i.dir ? expandDir(i.dir, i.base) : join33(expandDir(basePath, i.base), i.route.split("/")[0], name);
-  const add = planRepoAdd({ text: i.text, base: i.base, route: i.route, path: target, origin: remote, resolved: i.resolved, name, isCheckout: i.isCheckout });
-  return { ...add, remote, target };
+  if (r.shadowed.length) lines.push(`  this ship declares ${r.shadowed.join(", ")}, and the file overrides it \u2014 the file wins`);
+  for (const p of r.readiness) lines.push(`  - release readiness: ${p}`);
+  return `${lines.join("\n")}
+`;
 }
 
 // src/repos-hooks.ts
+import { isMap as isMap2, parseDocument as parseDocument6, YAMLMap } from "yaml";
 function packageManager(f) {
   if (f.exists("pnpm-lock.yaml")) return "pnpm";
   if (f.exists("yarn.lock")) return "yarn";
@@ -16433,7 +16934,7 @@ function repoDirOf(text, base, route2, name) {
   return hit.dir;
 }
 function planRouteHooks(text, route2, name, hooks, opts = {}) {
-  const doc = parseDocument4(text);
+  const doc = parseDocument6(text);
   if (doc.errors.length > 0) throw new ReposError(`config is not valid YAML \u2014 ${doc.errors[0].message}`);
   const m = routeMapOf(doc, route2);
   const repos = m.get("repos", true);
@@ -16470,7 +16971,7 @@ function planRouteHooks(text, route2, name, hooks, opts = {}) {
   return { text: String(doc), written, kept, replaced };
 }
 function clearRouteHooks(text, route2, name) {
-  const doc = parseDocument4(text);
+  const doc = parseDocument6(text);
   if (doc.errors.length > 0) throw new ReposError(`config is not valid YAML \u2014 ${doc.errors[0].message}`);
   const m = routeMapOf(doc, route2);
   const repos = m.get("repos", true);
@@ -16753,56 +17254,8 @@ function planSampleTicket(i) {
   };
 }
 
-// src/doctor-fix.ts
-import { parseDocument as parseDocument5 } from "yaml";
-var sound = (r) => r.hasRepos && r.problems.length === 0;
-function planFix(f) {
-  const actions = [];
-  const notes = [];
-  for (const r of f.routes) {
-    if (!r.enabled && sound(r)) {
-      actions.push({ kind: "enable", route: r.route });
-      const gaps = r.readiness ?? [];
-      if (gaps.length) {
-        notes.push(`${r.route}: ${gaps.length} release-readiness gap${gaps.length === 1 ? "" : "s"} (${gaps[0]}${gaps.length > 1 ? ", ..." : ""}) \u2014 the route will run, but releases stop at the first missing hook until it is added`);
-      }
-    } else if (!sound(r) && !r.enabled) {
-      notes.push(`${r.route}: not enabled \u2014 ${r.hasRepos ? r.problems[0] : "no checkout is configured"}`);
-    }
-  }
-  if (f.schedulerAbsent && f.routes.some(sound)) {
-    if (f.host === "windows") notes.push("scheduler support is not built for Windows yet \u2014 nothing to install; run `crew run` by hand");
-    else actions.push({ kind: "install" });
-  }
-  return { actions, notes };
-}
-async function gatherHealth(c, check) {
-  let problems;
-  let readiness = [];
-  try {
-    const r = await check();
-    if (Array.isArray(r)) problems = r;
-    else ({ problems, readiness } = r);
-  } catch (e) {
-    problems = [`checks could not run: ${e instanceof Error ? e.message : String(e)}`];
-  }
-  return { route: c.route, enabled: c.enabled, hasRepos: c.hasRepos, problems, readiness };
-}
-function routesInScope(routes, named) {
-  return named ? routes.filter((r) => r.route === named) : routes;
-}
-function planEnable(text, route2) {
-  const doc = parseDocument5(text);
-  routeMapOf(doc, route2).set("enabled", true);
-  return String(doc);
-}
-function schedulerInstalled(plan, exists, crontab) {
-  if (plan.mechanism === "cron") return plan.cronMarker !== null && crontab.includes(plan.cronMarker);
-  return plan.unitPaths.length > 0 && plan.unitPaths.every(exists);
-}
-
 // src/worktree-sweep.ts
-import { existsSync as existsSync32, readFileSync as readFileSync29, readdirSync as readdirSync12 } from "fs";
+import { existsSync as existsSync33, readFileSync as readFileSync30, readdirSync as readdirSync12 } from "fs";
 import { basename as basename11, dirname as dirname19, join as join35, resolve as resolve4 } from "path";
 function planWorktreeSweep(target, tickets, contract) {
   const terminal = new Set(contract.statuses.resolved.filter((s) => s !== contract.statuses.verified));
@@ -16915,7 +17368,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
   let removed = 0;
   let keptBranches = 0;
   for (const a of actions) {
-    if (!dryRun && base && !a.keepBranch && existsSync32(a.path) && isHandBackMerge(a.path, base)) {
+    if (!dryRun && base && !a.keepBranch && existsSync33(a.path) && isHandBackMerge(a.path, base)) {
       if (gitOk(a.path, ["merge", "--abort"]) !== null) {
         log.emit(
           `abandoned the hand-back merge of ${base} in ${a.path}: ${a.ticket.issue_id} deployed without it`,
@@ -16923,7 +17376,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
         );
       }
     }
-    if (!dryRun && existsSync32(a.path)) {
+    if (!dryRun && existsSync33(a.path)) {
       let dirty = false;
       try {
         dirty = status(a.path).length > 0;
@@ -16934,7 +17387,7 @@ async function applyWorktreeSweep(cwd, actions, dryRun, log, remote = "origin",
         continue;
       }
     }
-    if (!dryRun && a.requirePushed && a.branch && existsSync32(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
+    if (!dryRun && a.requirePushed && a.branch && existsSync33(a.path) && remoteConfigured(cwd, remote) && worktreeHoldsUnpushed(a.path, remote)) {
       refuse(a, "unpushed commits", `${a.branch} has commits that are not on ${remote}`);
       continue;
     }
@@ -16983,7 +17436,7 @@ function isHandBackMerge(path, base) {
   if (!msgPath) return false;
   let first;
   try {
-    first = readFileSync29(resolve4(path, msgPath), "utf8").split("\n")[0] ?? "";
+    first = readFileSync30(resolve4(path, msgPath), "utf8").split("\n")[0] ?? "";
   } catch {
     return false;
   }
@@ -17088,12 +17541,12 @@ function applyRemoteBranchCleanup(cwd, remote, branches2, dryRun, log) {
 }
 
 // src/stream-sweep.ts
-import { existsSync as existsSync33, readdirSync as readdirSync13, rmSync as rmSync15, statSync as statSync10 } from "fs";
+import { existsSync as existsSync34, readdirSync as readdirSync13, rmSync as rmSync15, statSync as statSync10 } from "fs";
 import { join as join36 } from "path";
 var DAY_MS2 = 24 * 60 * 60 * 1e3;
 function planStreamSweep(stateDir, retentionDays, now = Date.now()) {
   const dir = join36(stateDir, "streams");
-  if (!existsSync33(dir)) return [];
+  if (!existsSync34(dir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
   return readdirSync13(dir).map((name) => join36(dir, name)).filter((path) => {
     try {
@@ -17121,7 +17574,7 @@ function applyStreamSweep(paths, dryRun, log) {
   return removed;
 }
 function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
-  if (!existsSync33(stateDir)) return [];
+  if (!existsSync34(stateDir)) return [];
   const cutoff = now - retentionDays * DAY_MS2;
   return readdirSync13(stateDir).filter((name) => ROTATED_EVENTS_RE.test(name)).map((name) => join36(stateDir, name)).filter((path) => {
     try {
@@ -17133,11 +17586,11 @@ function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
 }
 
 // src/cli.ts
-import { realpathSync as realpathSync3, readFileSync as readFileSync35, existsSync as existsSync40, mkdirSync as mkdirSync26, writeFileSync as writeFileSync27, rmSync as rmSync19, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync4, statSync as statSync14, readdirSync as readdirSync18 } from "fs";
+import { realpathSync as realpathSync3, readFileSync as readFileSync36, existsSync as existsSync41, mkdirSync as mkdirSync26, writeFileSync as writeFileSync28, rmSync as rmSync19, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync4, statSync as statSync14, readdirSync as readdirSync18 } from "fs";
 import { createInterface } from "readline/promises";
 
 // src/periscope-cmd.ts
-import { existsSync as existsSync34, mkdirSync as mkdirSync21, readFileSync as readFileSync30, rmSync as rmSync16, writeFileSync as writeFileSync23 } from "fs";
+import { existsSync as existsSync35, mkdirSync as mkdirSync21, readFileSync as readFileSync31, rmSync as rmSync16, writeFileSync as writeFileSync24 } from "fs";
 import { join as join37 } from "path";
 var PeriscopeError = class extends Error {
 };
@@ -17149,14 +17602,14 @@ function removePeriscopePrior(stateDir, ticketRecordId) {
 function writePeriscopePrior(stateDir, ticketRecordId, prior) {
   try {
     mkdirSync21(priorDir(stateDir), { recursive: true });
-    writeFileSync23(priorPath(stateDir, ticketRecordId), JSON.stringify(prior));
+    writeFileSync24(priorPath(stateDir, ticketRecordId), JSON.stringify(prior));
   } catch {
   }
 }
 function readPeriscopePrior(stateDir, ticketRecordId) {
   try {
     const p = priorPath(stateDir, ticketRecordId);
-    return existsSync34(p) ? JSON.parse(readFileSync30(p, "utf8")) : void 0;
+    return existsSync35(p) ? JSON.parse(readFileSync31(p, "utf8")) : void 0;
   } catch {
     return void 0;
   }
@@ -17646,7 +18099,7 @@ import { dirname as dirOf2, resolve as resolvePath } from "path";
 
 // src/ssh-keys.ts
 import { execFileSync as execFileSync8 } from "child_process";
-import { existsSync as existsSync35, mkdirSync as mkdirSync22, readFileSync as readFileSync31, chmodSync as chmodSync3 } from "fs";
+import { existsSync as existsSync36, mkdirSync as mkdirSync22, readFileSync as readFileSync32, chmodSync as chmodSync3 } from "fs";
 import { dirname as dirname20, join as join39 } from "path";
 var SshKeyError = class extends Error {
 };
@@ -17656,7 +18109,7 @@ function shipSshKeyPathFor(stateDir) {
 function ensureShipSshKeypair(stateDir) {
   const privateKeyPath = shipSshKeyPathFor(stateDir);
   const publicKeyPath = `${privateKeyPath}.pub`;
-  if (!existsSync35(privateKeyPath)) {
+  if (!existsSync36(privateKeyPath)) {
     mkdirSync22(dirname20(privateKeyPath), { recursive: true });
     try {
       execFileSync8("ssh-keygen", [
@@ -17677,10 +18130,10 @@ function ensureShipSshKeypair(stateDir) {
     }
     chmodSync3(privateKeyPath, 384);
   }
-  if (!existsSync35(publicKeyPath)) {
+  if (!existsSync36(publicKeyPath)) {
     throw new SshKeyError(`${privateKeyPath} exists but ${publicKeyPath} does not \u2014 regenerate or restore it`);
   }
-  const publicKey = readFileSync31(publicKeyPath, "utf8").trim();
+  const publicKey = readFileSync32(publicKeyPath, "utf8").trim();
   return { privateKeyPath, publicKeyPath, publicKey };
 }
 function sshKeygenAvailable() {
@@ -17897,7 +18350,7 @@ function syncAllPassengerCheckouts(cfg) {
 
 // src/tunnel.ts
 import { spawn as spawn5 } from "child_process";
-import { existsSync as existsSync36, mkdirSync as mkdirSync23, readFileSync as readFileSync32, writeFileSync as writeFileSync24, unlinkSync as unlinkSync3, readdirSync as readdirSync14 } from "fs";
+import { existsSync as existsSync37, mkdirSync as mkdirSync23, readFileSync as readFileSync33, writeFileSync as writeFileSync25, unlinkSync as unlinkSync3, readdirSync as readdirSync14 } from "fs";
 import { randomInt } from "crypto";
 import { join as join40 } from "path";
 var DEFAULT_SPAWN_OPTIONS = { stdio: "ignore", detached: true };
@@ -17970,9 +18423,9 @@ function tunnelStatePath(stateDir, workspaceId) {
 }
 function readPersistedTunnel(stateDir, workspaceId) {
   const path = tunnelStatePath(stateDir, workspaceId);
-  if (!existsSync36(path)) return void 0;
+  if (!existsSync37(path)) return void 0;
   try {
-    return JSON.parse(readFileSync32(path, "utf8"));
+    return JSON.parse(readFileSync33(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -17980,7 +18433,7 @@ function readPersistedTunnel(stateDir, workspaceId) {
 function writePersistedTunnel(stateDir, state) {
   const path = tunnelStatePath(stateDir, state.workspaceId);
   mkdirSync23(join40(stateDir, "passengers"), { recursive: true });
-  writeFileSync24(path, `${JSON.stringify(state, null, 2)}
+  writeFileSync25(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function updatePersistedTunnel(stateDir, workspaceId, patch2) {
@@ -18078,7 +18531,7 @@ function syncPassengerTunnels(plans, relayHost, relayPort, privateKeyPath, state
 }
 function readAllPersistedWorkspaceIds(stateDir) {
   const dir = join40(stateDir, "passengers");
-  if (!existsSync36(dir)) return [];
+  if (!existsSync37(dir)) return [];
   return readdirSync14(dir).filter((f) => f.endsWith(".json") && !f.endsWith("-sync.json")).map((f) => f.slice(0, -".json".length));
 }
 
@@ -18199,7 +18652,7 @@ async function unregisterEndpoint(workspaceId, info, d) {
 import { createServer as createHttpServer } from "http";
 import { spawn as spawn6 } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync37, mkdirSync as mkdirSync24, readFileSync as readFileSync33, writeFileSync as writeFileSync25, unlinkSync as unlinkSync4, readdirSync as readdirSync15 } from "fs";
+import { existsSync as existsSync38, mkdirSync as mkdirSync24, readFileSync as readFileSync34, writeFileSync as writeFileSync26, unlinkSync as unlinkSync4, readdirSync as readdirSync15 } from "fs";
 import { join as join41 } from "path";
 
 // src/secret-compare.ts
@@ -18293,9 +18746,9 @@ function syncDaemonStatePath(stateDir, workspaceId) {
 }
 function readPersistedSyncDaemon(stateDir, workspaceId) {
   const path = syncDaemonStatePath(stateDir, workspaceId);
-  if (!existsSync37(path)) return void 0;
+  if (!existsSync38(path)) return void 0;
   try {
-    return JSON.parse(readFileSync33(path, "utf8"));
+    return JSON.parse(readFileSync34(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -18303,7 +18756,7 @@ function readPersistedSyncDaemon(stateDir, workspaceId) {
 function writePersistedSyncDaemon(stateDir, state) {
   const path = syncDaemonStatePath(stateDir, state.workspaceId);
   mkdirSync24(join41(stateDir, "passengers"), { recursive: true });
-  writeFileSync25(path, `${JSON.stringify(state, null, 2)}
+  writeFileSync26(path, `${JSON.stringify(state, null, 2)}
 `);
 }
 function removePersistedSyncDaemon(stateDir, workspaceId) {
@@ -18324,7 +18777,7 @@ function waitForExit(pid, alive, timeoutMs = 5e3) {
 }
 function readAllPersistedSyncWorkspaceIds(stateDir) {
   const dir = join41(stateDir, "passengers");
-  if (!existsSync37(dir)) return [];
+  if (!existsSync38(dir)) return [];
   const suffix = "-sync.json";
   return readdirSync15(dir).filter((f) => f.endsWith(suffix)).map((f) => f.slice(0, -suffix.length));
 }
@@ -18412,7 +18865,7 @@ function describeCause(err3) {
 }
 
 // src/daemon.ts
-import { existsSync as existsSync38, mkdirSync as mkdirSync25, readFileSync as readFileSync34, readdirSync as readdirSync16, rmSync as rmSync17, statSync as statSync12, writeFileSync as writeFileSync26 } from "fs";
+import { existsSync as existsSync39, mkdirSync as mkdirSync25, readFileSync as readFileSync35, readdirSync as readdirSync16, rmSync as rmSync17, statSync as statSync12, writeFileSync as writeFileSync27 } from "fs";
 import { join as join42 } from "path";
 import { randomBytes as randomBytes2 } from "crypto";
 var DEFAULT_FLOOR_MS = 5e3;
@@ -18493,7 +18946,7 @@ function computeTreeSignature(paths) {
 }
 function makeStaleChecker(paths, opts = {}) {
   const initial = computeTreeSignature(paths);
-  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync38(opts.reloadSentinel);
+  return () => computeTreeSignature(paths) !== initial || opts.reloadSentinel !== void 0 && existsSync39(opts.reloadSentinel);
 }
 function reloadSentinelFor(stateDir) {
   return join42(stateDir, "reload-requested");
@@ -18504,12 +18957,12 @@ function daemonStampFor(stateDir) {
 function noteDaemonStarted(stateDir, now = Date.now()) {
   mkdirSync25(stateDir, { recursive: true });
   rmSync17(reloadSentinelFor(stateDir), { force: true });
-  writeFileSync26(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
+  writeFileSync27(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
 `);
 }
 function readDaemonStarted(stateDir) {
   try {
-    const v = JSON.parse(readFileSync34(daemonStampFor(stateDir), "utf8")).startedAt;
+    const v = JSON.parse(readFileSync35(daemonStampFor(stateDir), "utf8")).startedAt;
     return typeof v === "number" ? v : null;
   } catch {
     return null;
@@ -18782,7 +19235,7 @@ async function reconcileForRoute(ctx, o) {
             if (wt) dirty = status(wt.path).length > 0;
           } catch {
           }
-          await tracker.postEvent(sc.ticketRecordId, interruptedComment({
+          await tracker.postEvent(sc.ticketRecordId, result.killed ? runKilledComment({ limitMinutes: result.killed.limitMinutes, branch: wt?.branch ?? null, dirty }) : interruptedComment({
             branch: wt?.branch ?? null,
             dirty,
             reason: result.interrupted === "daemon-exit" ? "the crew daemon exited" : "it exited without a result"
@@ -18805,6 +19258,23 @@ async function reconcileForRoute(ctx, o) {
     }
   });
 }
+async function postRunKilled(route2, tracker, ticketId, memberId, limitMinutes, emit) {
+  if (!ticketId || !memberId) return;
+  try {
+    const t = await tracker.ticket(ticketId);
+    const target = repoTargetFor(route2, t.repo_id);
+    const num = String(t[tracker.contract.columns.key] ?? "").replace(/^\D+/, "");
+    const wt = target && num ? worktreeForNumber(target.dir, num) : null;
+    let dirty = null;
+    try {
+      if (wt) dirty = status(wt.path).length > 0;
+    } catch {
+    }
+    await tracker.postEvent(ticketId, runKilledComment({ limitMinutes, branch: wt?.branch ?? null, dirty }), memberId, "interrupted");
+  } catch (e) {
+    emit.warn(`could not post the wall-clock limit comment: ${e.message}`, { step: "agent" });
+  }
+}
 async function runRoleAgent(role, decision, ctx, hooks) {
   const held = {};
   try {
@@ -18909,7 +19379,7 @@ async function runRoleAgentLocked(role, decision, ctx, hooks, held) {
       const target = repoTargetFor(route2, result.ticket.repo_id);
       ticketRepo = target?.name;
       try {
-        if (target && ensureRepoCheckout(target.dir, target.remote)) {
+        if (target && ensureRepoCheckout(target.dir, target.remote, { scheme: ship.cloneScheme })) {
           emit.emit(`cloned ${target.name} into ${target.dir}`, { step: "select", role });
         }
       } catch (e) {
@@ -18967,8 +19437,12 @@ async function runRoleAgentLocked(role, decision, ctx, hooks, held) {
       } catch {
       }
     }
-    await spawnAgent(plan, emit, hintMoved);
-    await guardRunHandoff(route2, ship, tracker, role, workingId, emit, runStart);
+    const result = await spawnAgent(plan, emit, hintMoved);
+    if (result.killed) {
+      await postRunKilled(route2, tracker, workingId, memberId, result.killed.limitMinutes, emit);
+    } else {
+      await guardRunHandoff(route2, ship, tracker, role, workingId, emit, runStart);
+    }
   } finally {
     await settleRunEnd({
       tracker,
@@ -19010,7 +19484,7 @@ import { createHash as createHash9 } from "crypto";
 import {
   chmodSync as chmodSync4,
   closeSync as closeSync5,
-  existsSync as existsSync39,
+  existsSync as existsSync40,
   fstatSync,
   openSync as openSync5,
   readSync as readSync3,
@@ -19361,7 +19835,7 @@ function lastLines2(path, n) {
 }
 function readTail(live, opts) {
   const max = opts.maxBytes ?? MAX_TAIL_BYTES;
-  if (!existsSync39(live)) {
+  if (!existsSync40(live)) {
     return { lines: [], cursor: opts.after ?? encodeCursor({ dev: 0, ino: 0, off: 0 }), reset: false };
   }
   const cur = opts.after ? decodeCursor(opts.after) : null;
@@ -19518,7 +19992,7 @@ async function route(deps, method, url, req, abort) {
     const run2 = decodeURIComponent(p.slice("/streams/".length));
     if (!RUN_NAME_RE.test(run2) || run2.includes("..") || /\.(pid|meta\.json|events\.jsonl)$/.test(run2)) return err2(400, "not a run name");
     const file = join43(deps.stateDir, "streams", run2.endsWith(".jsonl") ? run2 : `${run2}.jsonl`);
-    if (!existsSync39(file)) return err2(404, "no such run");
+    if (!existsSync40(file)) return err2(404, "no such run");
     return tailReply(file, url.searchParams, false, abort);
   }
   if ((p === "/pause" || p === "/resume") && post3) {
@@ -19562,7 +20036,7 @@ function send(res, r) {
   res.end(body);
 }
 async function socketIsStale(path) {
-  if (!existsSync39(path)) return false;
+  if (!existsSync40(path)) return false;
   return new Promise((resolve6) => {
     const c = createConnection(path);
     c.once("connect", () => {
@@ -19581,7 +20055,7 @@ async function startControlServer(deps) {
     return null;
   }
   if (await socketIsStale(path)) rmSync18(path, { force: true });
-  else if (existsSync39(path)) {
+  else if (existsSync40(path)) {
     log(`control API not started: ${path} is in use by another process`);
     return null;
   }
@@ -19790,6 +20264,9 @@ function usage(problem, requested = false) {
   crew --version [--json]        print the crew version on one line (also: crew version); --json adds home and compiled
   crew status [route] [--json]   paused/running state; --json for a machine reader
   crew projects [--route R] [--json]   the Projects rows each route can read (id, name, prefix, work mode)
+  crew provision --key K --route WS[/PROJECT] [--forge-host H] [--ship-name N] [--json]   one non-interactive run: connect, forge tokens,
+                                 enable routes, install units with lingering, start the daemon; safe to re-run (CREW_CONNECT_KEY,
+                                 CREW_PROVISION_ROUTES, CREW_SHIP_NAME, CREW_FORGE_TOKEN[_<HOST>] also read)
   crew forge [set|rotate <host>] [--token T | --token-stdin] [--source file|keychain|env]   this ship's git-forge tokens (ship.forges)
   crew credential get|store|erase   git credential helper answering from ship.forges (git runs it; not for hand use)
   crew whoami [route] [--json]   the signed-in identity, key role, operator Crew row and credential source per route
@@ -19890,6 +20367,7 @@ var KNOWN_COMMANDS = /* @__PURE__ */ new Set([
   "agents",
   "connect",
   "credential",
+  "provision",
   "forge",
   "daemon",
   "deploy",
@@ -19965,7 +20443,7 @@ function daemonConfigPaths(c) {
   for (const r of c.routes) if (r.apiKeyFile && !files.includes(r.apiKeyFile)) files.push(r.apiKeyFile);
   return files;
 }
-var STATE_WRITING_COMMANDS = /* @__PURE__ */ new Set(["connect", "disconnect", "install", "uninstall", "reload", "release", "merge", "deploy"]);
+var STATE_WRITING_COMMANDS = /* @__PURE__ */ new Set(["connect", "provision", "disconnect", "install", "uninstall", "reload", "release", "merge", "deploy"]);
 var STATE_WRITING_SUBCOMMANDS = {
   agents: /* @__PURE__ */ new Set(["sync"]),
   skills: /* @__PURE__ */ new Set(["sync"])
@@ -19979,6 +20457,19 @@ if (sessionRole && (STATE_WRITING_COMMANDS.has(command) || STATE_WRITING_SUBCOMM
   );
   process.exit(2);
 }
+if (command === "provision") {
+  const outcome = await runProvision(
+    provisionOptionsFrom(argv, process.env),
+    realProvisionDeps(CREW_HOME),
+    (l) => {
+      process.stdout.write(l);
+    },
+    (l) => {
+      process.stderr.write(l);
+    }
+  );
+  process.exit(outcome.code);
+}
 if (command === "passenger-sync-daemon") {
   runSyncDaemonFromEnv();
 } else {
@@ -20056,7 +20547,7 @@ if (command === "passenger-sync-daemon") {
     };
     if (command === "connect" && !flag("sign-out") && usesFlagAnswers(wizardFlags, connectIsTTY) && shouldRunWizard({ isTTY: true, crewHome: CREW_HOME })) {
       const flagged = flagWizardAnswers(wizardFlags, {
-        hostname: hostname2(),
+        hostname: hostname3(),
         platform: hostPlatform(),
         pathEnv: process.env.PATH ?? "",
         nodePath: process.execPath,
@@ -20081,7 +20572,7 @@ if (command === "passenger-sync-daemon") {
       let answers;
       try {
         answers = await runWizard(prompter, {
-          hostname: hostname2(),
+          hostname: hostname3(),
           platform: hostPlatform(),
           pathEnv: process.env.PATH ?? "",
           nodePath: process.execPath,
@@ -20096,7 +20587,7 @@ if (command === "passenger-sync-daemon") {
     } else {
       const toleratesNoRoutes = command === "credential" || command === "forge" || command === "repos" || command === "ship" || command === "disconnect" && flag("reset") || command === "connect" && flag("sign-out");
       const configless = command === "connect" && flag("sign-out") || command === "disconnect" && flag("reset");
-      if (configless && !existsSync40(findConfigFile(CREW_HOME))) {
+      if (configless && !existsSync41(findConfigFile(CREW_HOME))) {
         cfg = loadConfig(CREW_HOME, firstRunConfigPath(), { text: "ship: {}\n", allowNoRoutes: true });
       } else {
         cfg = loadConfig(CREW_HOME, void 0, toleratesNoRoutes ? { allowNoRoutes: true } : {});
@@ -20111,7 +20602,7 @@ if (command === "passenger-sync-daemon") {
     throw e;
   }
   if (command === "credential") {
-    const r = runCredential(positional[1], readFileSync35(0, "utf8"), cfg.ship.forges, cfg.ship.stateDir);
+    const r = runCredential(positional[1], readFileSync36(0, "utf8"), cfg.ship.forges, cfg.ship.stateDir);
     process.stdout.write(r.out);
     process.stderr.write(r.err);
     process.exit(r.code);
@@ -20123,9 +20614,9 @@ if (command === "passenger-sync-daemon") {
         forges: cfg.ship.forges,
         stateDir: cfg.ship.stateDir,
         configFile: cfg.configFile,
-        readFile: (p) => readFileSync35(p, "utf8"),
-        writeFile: (p, t) => writeFileSync27(p, t),
-        stdin: () => readFileSync35(0, "utf8"),
+        readFile: (p) => readFileSync36(p, "utf8"),
+        writeFile: (p, t) => writeFileSync28(p, t),
+        stdin: () => readFileSync36(0, "utf8"),
         env: process.env
       }
     );
@@ -20349,7 +20840,7 @@ if (command === "passenger-sync-daemon") {
     }
     const hasSystemd = detectSystemd();
     for (const job of ["run", "release", "passengers"]) {
-      const plan = planInstall(cfg.ship, CREW_HOME, host, hasSystemd, job);
+      const plan = planInstall(cfg.ship, CREW_HOME, host, hasSystemd, job, installContext());
       process.stdout.write(`installing ${job} via ${plan.mechanism} for ${host}${dryRun ? " (dry run)" : ""}
 `);
       await applyInstall(plan, CREW_HOME, dryRun, {
@@ -20362,13 +20853,13 @@ if (command === "passenger-sync-daemon") {
     if (host === "linux" && hasSystemd) {
       const label = labelFor(CREW_HOME, "run");
       const staleTimer = join44(homedir10(), ".config", "systemd", "user", `${label}.timer`);
-      if (existsSync40(staleTimer)) {
+      if (existsSync41(staleTimer)) {
         process.stdout.write(
           `removing stale run timer from before the persistent-service cutover: ${staleTimer}${dryRun ? " (dry run)" : ""}
 `
         );
         if (!dryRun) {
-          spawnSync7("systemctl", ["--user", "disable", "--now", `${label}.timer`], { cwd: CREW_HOME });
+          spawnSync8("systemctl", ["--user", "disable", "--now", `${label}.timer`], { cwd: CREW_HOME });
           try {
             unlinkSync5(staleTimer);
           } catch {
@@ -20389,7 +20880,7 @@ if (command === "passenger-sync-daemon") {
     const tracker = new Tracker(c, cfg.ship);
     problems.push(...validateContract(tracker.contract).map((p) => `contract: ${p}`));
     for (const r of await resolvedRepos(c)) {
-      if (!existsSync40(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
+      if (!existsSync41(r.dir)) problems.push(`repo ${r.name}: ${r.dir} is missing on disk`);
       if (!satisfies(host, r.config.platform)) problems.push(`repo ${r.name}: requires ${r.config.platform}, this host is ${host}`);
       readiness.push(...validateEffective(r.config).map((p) => `repo ${r.name}: ${p}`));
     }
@@ -20407,9 +20898,9 @@ if (command === "passenger-sync-daemon") {
   }
   async function doctorFix(o) {
     const routes = await Promise.all(routesInScope(cfg.routes, named).map((c) => gatherHealth({ route: c.route, enabled: c.enabled, hasRepos: reposOf(c).length > 0 }, () => routeProblems(c))));
-    const unitExists = (p) => existsSync40(p);
-    const crontab = o.host === "linux" ? spawnSync7("crontab", ["-l"], { encoding: "utf8" }).stdout ?? "" : "";
-    const schedulerAbsent = o.host !== "windows" ? !schedulerInstalled(planInstall(cfg.ship, CREW_HOME, o.host, detectSystemd(), "run"), unitExists, crontab) : true;
+    const unitExists = (p) => existsSync41(p);
+    const crontab = o.host === "linux" ? spawnSync8("crontab", ["-l"], { encoding: "utf8" }).stdout ?? "" : "";
+    const schedulerAbsent = o.host !== "windows" ? !schedulerInstalled(planInstall(cfg.ship, CREW_HOME, o.host, detectSystemd(), "run", installContext()), unitExists, crontab) : true;
     const plan = planFix({ routes, schedulerAbsent, host: o.host });
     for (const n of plan.notes) process.stdout.write(`fix: ${n}
 `);
@@ -20424,7 +20915,7 @@ if (command === "passenger-sync-daemon") {
       for (const a of plan.actions) {
         if (a.kind === "enable") {
           if (prompter && !await prompter.confirm(`Route ${a.route} passes every check \u2014 set enabled: true in ${cfg.configFile}?`, false)) continue;
-          writeFileSync27(cfg.configFile, planEnable(readFileSync35(cfg.configFile, "utf8"), a.route));
+          writeFileSync28(cfg.configFile, planEnable(readFileSync36(cfg.configFile, "utf8"), a.route));
           enabledSound.add(a.route);
           changed2.push(`enabled route ${a.route} in ${cfg.configFile}`);
         } else {
@@ -21166,7 +21657,7 @@ ${cu.tail.trimEnd()}
             const target = repoTargetFor(w.route, result.ticket.repo_id);
             fleetTicketRepo = target?.name;
             try {
-              if (target && ensureRepoCheckout(target.dir, target.remote)) {
+              if (target && ensureRepoCheckout(target.dir, target.remote, { scheme: cfg.ship.cloneScheme })) {
                 wemit.emit(`cloned ${target.name} into ${target.dir}`, { step: "select", role: w.role });
               }
             } catch (e) {
@@ -21383,7 +21874,7 @@ ${cu.tail.trimEnd()}
             const target = repoTargetFor(route2, result.ticket.repo_id);
             ticketRepo = target?.name;
             try {
-              if (target && ensureRepoCheckout(target.dir, target.remote)) {
+              if (target && ensureRepoCheckout(target.dir, target.remote, { scheme: cfg.ship.cloneScheme })) {
                 emit.emit(`cloned ${target.name} into ${target.dir}`, { step: "select", role: current });
               }
             } catch (e) {
@@ -21504,7 +21995,7 @@ ${cu.tail.trimEnd()}
           }
           let failed = false;
           for (const cmd2 of commands) {
-            const res2 = spawnSync7(cmd2[0], cmd2.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
+            const res2 = spawnSync8(cmd2[0], cmd2.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
             if (res2.stdout) process.stdout.write(res2.stdout);
             if (res2.stderr) process.stderr.write(res2.stderr);
             if (cmd2 === control.startCommand && (res2.error || res2.status !== 0)) {
@@ -21522,7 +22013,7 @@ ${cu.tail.trimEnd()}
 `);
           break;
         }
-        const res = spawnSync7(cmd[0], cmd.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
+        const res = spawnSync8(cmd[0], cmd.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
         if (res.stdout) process.stdout.write(res.stdout);
         if (res.stderr) process.stderr.write(res.stderr);
         if (daemonSub !== "status" && (res.error || res.status !== 0)) {
@@ -21806,10 +22297,10 @@ ${cu.tail.trimEnd()}
 `);
       if (!dryRun) {
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
-        const raw = existsSync40(resolvedPath) ? JSON.parse(readFileSync35(resolvedPath, "utf8")) : {};
+        const raw = existsSync41(resolvedPath) ? JSON.parse(readFileSync36(resolvedPath, "utf8")) : {};
         raw.agentSkills = result.agentSkills;
         mkdirSync26(dirOf2(resolvedPath), { recursive: true });
-        writeFileSync27(resolvedPath, `${JSON.stringify(raw, null, 2)}
+        writeFileSync28(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
       }
       if (result.outcomes.some((o) => o.action === "diverged")) process.exitCode = 1;
@@ -21832,7 +22323,7 @@ ${cu.tail.trimEnd()}
         throw e;
       }
       const oldName = cfg.ship.name;
-      writeFileSync27(cfg.configFile, setShipNameInYaml(readFileSync35(cfg.configFile, "utf8"), newName));
+      writeFileSync28(cfg.configFile, setShipNameInYaml(readFileSync36(cfg.configFile, "utf8"), newName));
       cfg.ship.name = newName;
       let renameMachineId;
       try {
@@ -21879,7 +22370,7 @@ ${cu.tail.trimEnd()}
         process.exit(2);
       };
       if (sub !== "add" && sub !== "list" && sub !== "clone" && sub !== "hooks" && sub !== "check") usage2();
-      const configText = readFileSync35(cfg.configFile, "utf8");
+      const configText = readFileSync36(cfg.configFile, "utf8");
       if (sub === "check") {
         try {
           const routeArg = value("route") ?? positional[2];
@@ -21910,8 +22401,8 @@ ${cu.tail.trimEnd()}
         try {
           const a = parseHooksArgs(positional.slice(2), routeNamesOf(configText));
           const dir = repoDirOf(configText, dirname22(cfg.configFile), a.route, a.name);
-          if (!existsSync40(dir)) throw new ReposError(`${dir} does not exist on disk`);
-          const files = { exists: (r) => existsSync40(resolvePath(dir, r)), list: (r) => {
+          if (!existsSync41(dir)) throw new ReposError(`${dir} does not exist on disk`);
+          const files = { exists: (r) => existsSync41(resolvePath(dir, r)), list: (r) => {
             try {
               return readdirSync18(resolvePath(dir, r));
             } catch {
@@ -21919,7 +22410,7 @@ ${cu.tail.trimEnd()}
             }
           }, read: (r) => {
             try {
-              return readFileSync35(resolvePath(dir, r), "utf8");
+              return readFileSync36(resolvePath(dir, r), "utf8");
             } catch {
               return void 0;
             }
@@ -21961,19 +22452,19 @@ ${cu.tail.trimEnd()}
           let cleared;
           if (clear2) {
             const plan = clearRouteHooks(configText, a.route, a.name);
-            if (plan.removed.length > 0) writeFileSync27(cfg.configFile, plan.text);
+            if (plan.removed.length > 0) writeFileSync28(cfg.configFile, plan.text);
             cleared = { file: cfg.configFile, removed: plan.removed };
           }
           if (write && suggestion.source === null && recipeIds.length === 0 && hookSpecs.length === 0) throw new ReposError(`nothing to write: ${suggestion.notes[0]}`);
           if (write === "route") {
             const plan = planRouteHooks(configText, a.route, a.name, picked.hooks, { replace: flag("replace") });
-            writeFileSync27(cfg.configFile, plan.text);
+            writeFileSync28(cfg.configFile, plan.text);
             written = { target: "route", file: cfg.configFile, hooks: plan.written, kept: plan.kept, replaced: plan.replaced };
           } else if (write === "repo") {
             const have = existingRepoConfig(files);
             if (have) throw new ReposError(`${resolvePath(dir, have)} already exists; not overwriting it`);
             const file = resolvePath(dir, ".crew.yaml");
-            writeFileSync27(file, starterRepoConfig(picked.hooks, picked.release), { flag: "wx" });
+            writeFileSync28(file, starterRepoConfig(picked.hooks, picked.release), { flag: "wx" });
             written = { target: "repo", file, hooks: Object.keys(picked.hooks), kept: [], replaced: [] };
           }
           if (flag("json")) {
@@ -22029,7 +22520,7 @@ ${cu.tail.trimEnd()}
       if (sub === "list" && !routeName) usage2();
       if (sub === "add") {
         try {
-          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync40(resolvePath(p.replace(/^~(?=\/|$)/, homedir10()))));
+          const a = parseAddArgs(positional.slice(2), routeNamesOf(configText), (p) => existsSync41(resolvePath(p.replace(/^~(?=\/|$)/, homedir10()))));
           routeName = a.route;
           addPath = a.path;
           addName = a.name;
@@ -22058,16 +22549,16 @@ ${cu.tail.trimEnd()}
       }
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, routeName);
       let resolvedRemotes;
-      if (existsSync40(resolvedFile)) {
+      if (existsSync41(resolvedFile)) {
         try {
-          resolvedRemotes = JSON.parse(readFileSync35(resolvedFile, "utf8"));
+          resolvedRemotes = JSON.parse(readFileSync36(resolvedFile, "utf8"));
         } catch {
         }
       }
       const originOf = (dir) => gitOk(dir, ["remote", "get-url", "origin"]) ?? void 0;
       const text = configText;
       const base = dirname22(cfg.configFile);
-      const isCheckout = (d) => existsSync40(`${d}/.git`);
+      const isCheckout = (d) => existsSync41(`${d}/.git`);
       try {
         if (sub === "list") {
           if (flag("json")) {
@@ -22077,11 +22568,11 @@ ${cu.tail.trimEnd()}
               base,
               resolved: resolvedRemotes,
               originOf,
-              exists: (d) => existsSync40(d),
+              exists: (d) => existsSync41(d),
               isCheckout,
               repoHasHooks: (d) => REPO_CONFIG_FILENAMES.some((f) => {
                 try {
-                  return Object.keys(parseRepoConfig(readFileSync35(resolvePath(d, f), "utf8"), f).hooks).length > 0;
+                  return Object.keys(parseRepoConfig(readFileSync36(resolvePath(d, f), "utf8"), f).hooks).length > 0;
                 } catch {
                   return false;
                 }
@@ -22098,7 +22589,7 @@ ${cu.tail.trimEnd()}
           for (const r of repos) {
             const origin2 = originOf(r.dir);
             const row = matchRepoName(origin2, resolvedRemotes);
-            const note = !existsSync40(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
+            const note = !existsSync41(r.dir) ? "missing on disk" : row ? `Repos row: ${row}` : `no Repos row matches ${normalizeRemote(origin2) ?? "this checkout (no origin remote)"}`;
             process.stdout.write(`${r.name}	${r.dir}	${note}
 `);
           }
@@ -22110,9 +22601,9 @@ ${cu.tail.trimEnd()}
 ` : `${human}
 `);
           const plan2 = planRepoClone({ text, base, route: routeName, name: addName, resolved: resolvedRemotes, dir: value("dir"), isCheckout });
-          if (existsSync40(plan2.target) && (existsSync40(`${plan2.target}/.git`) || readdirSync18(plan2.target).length > 0)) {
+          if (existsSync41(plan2.target) && (existsSync41(`${plan2.target}/.git`) || readdirSync18(plan2.target).length > 0)) {
             throw new ReposError(
-              existsSync40(`${plan2.target}/.git`) ? `${plan2.target} is already a checkout \u2014 attach it with \`crew repos add ${routeName} ${plan2.name} ${plan2.target}\`` : `${plan2.target} exists and is not empty \u2014 pass --dir to clone somewhere else`
+              existsSync41(`${plan2.target}/.git`) ? `${plan2.target} is already a checkout \u2014 attach it with \`crew repos add ${routeName} ${plan2.name} ${plan2.target}\`` : `${plan2.target} exists and is not empty \u2014 pass --dir to clone somewhere else`
             );
           }
           if (dryRun) {
@@ -22130,14 +22621,14 @@ ${cu.tail.trimEnd()}
             throw new ReposError(`${e.message}${authHint}
   crew.yaml was not changed`);
           }
-          writeFileSync27(cfg.configFile, plan2.text);
+          writeFileSync28(cfg.configFile, plan2.text);
           if (plan2.droppedDir) process.stderr.write(`crew repos: dropped dir: ${plan2.droppedDir} from route ${routeName} \u2014 it is not a checkout (the clone base); checkouts now live under repos:
 `);
           say("attached", { route: routeName, name: plan2.name, dir: plan2.target, mode: plan2.mode }, `cloned and attached ${plan2.target} to ${routeName} as ${plan2.mode === "dir" ? "dir" : `repos.${plan2.name}`} in ${cfg.configFile}`);
           break;
         }
         const target = resolvePath(addPath.replace(/^~(?=\/|$)/, homedir10()));
-        const top = existsSync40(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
+        const top = existsSync41(target) ? gitOk(target, ["rev-parse", "--show-toplevel"]) : null;
         if (!top) throw new ReposError(`${target} is not a git checkout`);
         const origin = originOf(top);
         const plan = planRepoAdd({
@@ -22189,15 +22680,15 @@ ${cu.tail.trimEnd()}
           const created = await rowTracker.createRepoRow(rowPayload);
           process.stdout.write(`created Repos row ${String(rowPayload.name)} (${String(rowPayload.remote)}) ${created.id}
 `);
-          if (existsSync40(resolvedFile)) {
-            const raw = JSON.parse(readFileSync35(resolvedFile, "utf8"));
+          if (existsSync41(resolvedFile)) {
+            const raw = JSON.parse(readFileSync36(resolvedFile, "utf8"));
             raw.repoNames = { ...raw.repoNames, [created.id]: String(rowPayload.name) };
             raw.repoRemotes = { ...raw.repoRemotes, [created.id]: String(rowPayload.remote) };
-            writeFileSync27(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync28(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        writeFileSync27(cfg.configFile, plan.text);
+        writeFileSync28(cfg.configFile, plan.text);
         process.stdout.write(`added ${top} to ${routeName} as ${plan.mode === "dir" ? "dir" : `repos.${plan.name}`} in ${cfg.configFile}
 `);
       } catch (e) {
@@ -22408,7 +22899,7 @@ ${reconstruction.prompt}
         let result;
         try {
           result = await loginWithDeviceCode(`${baseUrl}/api`, {
-            deviceName: `crew on ${hostname2()}`,
+            deviceName: `crew on ${hostname3()}`,
             // Lets the approval page preselect the workspace this connect is for.
             // A bare `crew connect` has none and passes nothing.
             ...workspace ? { workspaceSlug: workspace } : {},
@@ -22564,7 +23055,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           process.exit(2);
         }
         if (found.shipNameAdopted && !dryRun) {
-          writeFileSync27(cfg.configFile, setShipNameInYaml(readFileSync35(cfg.configFile, "utf8"), found.shipNameAdopted));
+          writeFileSync28(cfg.configFile, setShipNameInYaml(readFileSync36(cfg.configFile, "utf8"), found.shipNameAdopted));
           cfg.ship.name = found.shipNameAdopted;
         }
         if (found.shipRow) {
@@ -22607,10 +23098,10 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           }
         }
         let previous;
-        const hadPreviousFile = existsSync40(resolvedPath);
+        const hadPreviousFile = existsSync41(resolvedPath);
         if (hadPreviousFile) {
           try {
-            previous = JSON.parse(readFileSync35(resolvedPath, "utf8"));
+            previous = JSON.parse(readFileSync36(resolvedPath, "utf8"));
           } catch {
           }
         }
@@ -22742,7 +23233,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           mkdirSync26(dirname22(resolvedPath), { recursive: true });
           if (hadPreviousFile) copyFileSync2(resolvedPath, `${resolvedPath}.bak`);
           const tmpPath = `${resolvedPath}.tmp${process.pid}`;
-          writeFileSync27(tmpPath, `${JSON.stringify(resolved, null, 2)}
+          writeFileSync28(tmpPath, `${JSON.stringify(resolved, null, 2)}
 `);
           renameSync4(tmpPath, resolvedPath);
           process.stderr.write(`Resolved ids written to ${resolvedPath}
@@ -22789,7 +23280,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
 `);
           } else {
             mkdirSync26(dirname22(apiKeyFile), { recursive: true });
-            writeFileSync27(apiKeyFile, `${apiKeyVar}=${apiKey}
+            writeFileSync28(apiKeyFile, `${apiKeyVar}=${apiKey}
 `, { mode: 384 });
             process.stderr.write(`API key written to ${apiKeyFile}
 `);
@@ -23523,7 +24014,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           const shellR = hit && resolveShell(hit.repo.config.shell ?? cfg.ship.shell);
           const resumed = await runPeriscopeResume({
             find: async () => hit && { row: hit.row, tag: hit.tag },
-            worktreeExists: (p) => existsSync40(p),
+            worktreeExists: (p) => existsSync41(p),
             caps: periscopeCaps(cfg.ship),
             runHook: async (name, cwd, env) => {
               const script = hit?.repo.config.hooks[name];
@@ -23618,7 +24109,7 @@ ${where.join("\n")}`);
           prepare: async (path) => {
             for (const f of repoP.config.worktrees.copy) {
               const src = join44(repoP.dir, f);
-              if (!existsSync40(src)) continue;
+              if (!existsSync41(src)) continue;
               mkdirSync26(dirOf2(join44(path, f)), { recursive: true });
               copyFileSync2(src, join44(path, f));
             }
@@ -23706,7 +24197,7 @@ ${where.join("\n")}`);
           process.stdout.write(upOutput(res, terminal));
           const opener = openerFor(process.platform);
           if (opener && shouldOpen({ open: flag("open"), noOpen: flag("no-open"), json: jsonP, terminal })) {
-            const r = spawnSync7(opener, [res.url], { stdio: "ignore" });
+            const r = spawnSync8(opener, [res.url], { stdio: "ignore" });
             if (r.error || r.status !== 0) process.stderr.write(`crew periscope: could not open ${res.url} with ${opener}
 `);
           }
@@ -23895,7 +24386,7 @@ ${where.join("\n")}`);
       };
       const droppedRoutes = [];
       try {
-        const rawCfg = parseYaml2(readFileSync35(cfg.configFile, "utf8"));
+        const rawCfg = parseYaml2(readFileSync36(cfg.configFile, "utf8"));
         for (const r of rawCfg?.routes ?? []) {
           if (typeof r?.route !== "string" || cfg.routes.some((x) => x.route === r.route)) continue;
           try {
@@ -23931,19 +24422,19 @@ ${where.join("\n")}`);
       }
       const host = hostPlatform();
       const control = host === "windows" ? null : planDaemonControl(CREW_HOME, host, detectSystemd());
-      const unitStatus = control?.statusCommand ? spawnSync7(control.statusCommand[0], control.statusCommand.slice(1), { cwd: CREW_HOME, encoding: "utf8" }) : null;
+      const unitStatus = control?.statusCommand ? spawnSync8(control.statusCommand[0], control.statusCommand.slice(1), { cwd: CREW_HOME, encoding: "utf8" }) : null;
       const unitRunning = unitStatus !== null && !unitStatus.error && unitStatus.status === 0;
       if (!unitRunning) {
         process.stdout.write("crew reload: no daemon unit is running \u2014 nothing to reload (the next run reads crew.yaml fresh)\n");
         break;
       }
       mkdirSync26(cfg.ship.stateDir, { recursive: true });
-      writeFileSync27(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
+      writeFileSync28(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
 `);
       process.stdout.write("crew reload: requested \u2014 the daemon finishes its in-flight pass, then relaunches with the new config\n");
       if (flag("now") && control?.stopCommand && control.startCommand) {
         for (const cmd of [control.stopCommand, control.startCommand]) {
-          const res = spawnSync7(cmd[0], cmd.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
+          const res = spawnSync8(cmd[0], cmd.slice(1), { cwd: CREW_HOME, encoding: "utf8" });
           if (cmd === control.startCommand && (res.error || res.status !== 0)) {
             process.stderr.write(`crew reload: ${cmd.join(" ")} exited ${res.status ?? "error"}
 `);
@@ -23989,7 +24480,7 @@ ${where.join("\n")}`);
     }
     case "log": {
       try {
-        const text = readFileSync35(cfg.ship.logFile, "utf8").split("\n");
+        const text = readFileSync36(cfg.ship.logFile, "utf8").split("\n");
         process.stdout.write(`${text.slice(-(Number(value("tail")) || 40)).join("\n")}
 `);
       } catch {
@@ -24012,7 +24503,7 @@ ${where.join("\n")}`);
       };
       if (!route2.resolved) fail(`route ${route2.route} is not connected \u2014 run \`crew connect\` first`);
       const tracker = new Tracker(route2, cfg.ship);
-      const configText = readFileSync35(cfg.configFile, "utf8");
+      const configText = readFileSync36(cfg.configFile, "utf8");
       const cfgBase = dirname22(cfg.configFile);
       const configured2 = configuredRepos(configText, route2.route, cfgBase);
       const dir = configured2.find((r) => r.name === SAMPLE_REPO)?.dir ?? sampleDir(configured2.map((r) => r.dir), route2.reposBasePath, route2.route.split("/")[0]);
@@ -24041,7 +24532,7 @@ ${where.join("\n")}`);
         }
         if (configured2.some((r) => r.dir === dir)) {
           try {
-            writeFileSync27(cfg.configFile, planRepoRemove(configText, cfgBase, route2.route, dir).text);
+            writeFileSync28(cfg.configFile, planRepoRemove(configText, cfgBase, route2.route, dir).text);
           } catch (e) {
             if (e instanceof ReposError) fail(e.message);
             throw e;
@@ -24049,31 +24540,31 @@ ${where.join("\n")}`);
         }
         if (row) {
           await tracker.deleteRepoRow(row.id);
-          if (existsSync40(resolvedFile)) {
-            const raw = JSON.parse(readFileSync35(resolvedFile, "utf8"));
+          if (existsSync41(resolvedFile)) {
+            const raw = JSON.parse(readFileSync36(resolvedFile, "utf8"));
             if (raw.repoNames) delete raw.repoNames[row.id];
             if (raw.repoRemotes) delete raw.repoRemotes[row.id];
-            writeFileSync27(resolvedFile, `${JSON.stringify(raw, null, 2)}
+            writeFileSync28(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
           }
         }
-        if (existsSync40(join44(dir, ".git")) && basename13(dir) === SAMPLE_REPO) rmSync19(dir, { recursive: true, force: true });
+        if (existsSync41(join44(dir, ".git")) && basename13(dir) === SAMPLE_REPO) rmSync19(dir, { recursive: true, force: true });
         say("removed", { dir, closed }, `removed the sample repo${closed.length ? `, closed ${closed.join(", ")}` : ""}`);
         break;
       }
       const projectId = route2.resolved.areaId ?? resolveRepoProject(await tracker.projectRows(), value("project"));
-      const fresh = !existsSync40(join44(dir, ".git"));
-      if (existsSync40(dir) && fresh && readdirSync18(dir).length > 0) fail(`${dir} exists and is not a git checkout \u2014 move it aside`);
+      const fresh = !existsSync41(join44(dir, ".git"));
+      if (existsSync41(dir) && fresh && readdirSync18(dir).length > 0) fail(`${dir} exists and is not a git checkout \u2014 move it aside`);
       if (dryRun) {
         say("dry-run", { dir, newCheckout: fresh, repoRow: row?.id ?? null }, `would ${fresh ? "create" : "reuse"} ${dir}${row ? "" : ", create the Repos row"}, and file one ${tracker.contract.statuses.approved} ticket`);
         break;
       }
       if (fresh) {
         mkdirSync26(dir, { recursive: true });
-        writeFileSync27(join44(dir, "README.md"), SAMPLE_README);
-        writeFileSync27(join44(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
+        writeFileSync28(join44(dir, "README.md"), SAMPLE_README);
+        writeFileSync28(join44(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
         const g = (...a) => {
-          const r = spawnSync7("git", a, { cwd: dir, encoding: "utf8" });
+          const r = spawnSync8("git", a, { cwd: dir, encoding: "utf8" });
           if (r.status !== 0) fail(`git ${a[0]} failed in ${dir}: ${(r.stderr || r.stdout).trim()}`);
         };
         g("init", "-b", "main");
@@ -24089,17 +24580,17 @@ ${where.join("\n")}`);
           spec: { platform: "unix", releaseMode: "integrate", ciProvider: "none" }
         });
         repoId = (await tracker.createRepoRow(payload)).id;
-        if (existsSync40(resolvedFile)) {
-          const raw = JSON.parse(readFileSync35(resolvedFile, "utf8"));
+        if (existsSync41(resolvedFile)) {
+          const raw = JSON.parse(readFileSync36(resolvedFile, "utf8"));
           raw.repoNames = { ...raw.repoNames, [repoId]: SAMPLE_REPO };
           raw.repoRemotes = { ...raw.repoRemotes, [repoId]: SAMPLE_REMOTE };
-          writeFileSync27(resolvedFile, `${JSON.stringify(raw, null, 2)}
+          writeFileSync28(resolvedFile, `${JSON.stringify(raw, null, 2)}
 `);
         }
       }
       if (!configured2.some((r) => r.dir === dir)) {
         try {
-          writeFileSync27(cfg.configFile, planRepoAdd({ text: configText, base: cfgBase, route: route2.route, path: dir, name: SAMPLE_REPO }).text);
+          writeFileSync28(cfg.configFile, planRepoAdd({ text: configText, base: cfgBase, route: route2.route, path: dir, name: SAMPLE_REPO }).text);
         } catch (e) {
           if (e instanceof ReposError) fail(e.message);
           throw e;
@@ -24403,7 +24894,7 @@ watermark:  ${state.watermark()}
         );
       }
       for (const x of runs) {
-        process.stdout.write(`running:    ${x.role} \u2014 ${x.ticket ?? "(no ticket)"}${x.repo ? ` in ${x.repo}` : ""} (pid ${x.pid}, since ${x.spawnedAt})
+        process.stdout.write(`running:    ${x.role} \u2014 ${x.ticket ?? "(no ticket)"}${x.repo ? ` in ${x.repo}` : ""} (pid ${x.pid}, since ${x.spawnedAt}${x.deadline ? `, deadline ${x.deadline}` : ""})
 `);
       }
       if (shipRows.length) {
@@ -24434,7 +24925,7 @@ watermark:  ${state.watermark()}
           }
           for (const r of repos) {
             const remote = r.config.branch.remote;
-            if (existsSync40(r.dir)) {
+            if (existsSync41(r.dir)) {
               pushAuth.push({
                 route: c.route,
                 repo: r.name,
@@ -24519,7 +25010,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       }
       try {
         const evFile = eventFileFor(cfg.ship.stateDir);
-        const evSize = existsSync40(evFile) ? statSync14(evFile).size : 0;
+        const evSize = existsSync41(evFile) ? statSync14(evFile).size : 0;
         process.stdout.write(
           evSize > cfg.ship.eventsRotateBytes * 4 ? `events log:        WARN ${evFile} is ${Math.round(evSize / 1048576)} MB (> 4x eventsRotateBytes); run \`crew reap\` to rotate it
 ` : "events log:        ok\n"
@@ -24527,10 +25018,10 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       } catch {
       }
       if (host !== "windows") {
-        const unitPlan = planInstall(cfg.ship, CREW_HOME, host, detectSystemd(), "run");
+        const unitPlan = planInstall(cfg.ship, CREW_HOME, host, detectSystemd(), "run", installContext());
         const abandons = unitAbandonsAgents(unitPlan, (p) => {
           try {
-            return readFileSync35(p, "utf8");
+            return readFileSync36(p, "utf8");
           } catch {
             return null;
           }
@@ -24613,6 +25104,11 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       const missingAuthorship = await tracker.missingAuthorshipColumns();
       process.stdout.write(
         missingAuthorship.length === 0 ? "authorship:       filed_by_id, ship_id present\n" : `authorship:       missing ${missingAuthorship.join(", ")} \u2014 update the Issues template
+`
+      );
+      const missingRuntime = await tracker.missingRuntimeColumns();
+      process.stdout.write(
+        missingRuntime.length === 0 ? "runtime columns: forge_host, kind, instance_class, relay_url present\n" : `runtime columns: missing ${missingRuntime.join(", ")} \u2014 read as their defaults; update the Issues template
 `
       );
       process.stdout.write(