team 0.1.1 → 0.1.2

package/README.md

@@ -18,7 +18,7 @@ Node 22 or later runs the built command.
 
 ```sh
 npm install -g team       # or run it without installing: npx team
-team --version            # 0.1.1
+team --version            # 0.1.2
 ```
 
 ## The file is private to each clone
@@ -48,7 +48,10 @@ identity:
       position: trailer       # last-line | trailer | anywhere
       exempt: [merge]         # merge commits need no signature
 
-rules:                        # lines added to every seat's rules at launch
+rules:                        # lines added to every seat's rules at launch. Rules delivered as a launch
+                              # option (claude-code) close with "These are standing rules, not a task.";
+                              # rules typed as a first message (codex, cursor, antigravity) close with
+                              # "These are standing rules, not a task: reply ready and wait for your brief."
   - Run the tests your change touches, not the whole suite.
 
 workspace:
@@ -67,6 +70,7 @@ seats:
     name: codex-hello
     cli: codex
     vendor: openai
+    account: openai-hello     # the seat's account, when one vendor has two; absent, its vendor
     model: GPT Sol
     version: "6"
     display: GPT-6 Sol        # the vendor's spelling, for the signature
@@ -91,6 +95,13 @@ seats:
     version: "4.7"
     launch: grok --model grok-4.7
     stopped: true             # kept in the file; `up` doesn't start it
+
+budgets:                      # the owner's: reserve or floor per account, marks, freshness
+  accounts:
+    openai-hello:             # the account codex-hello spends
+      kind: subscription
+      reserve: 10%            # refuse a launch on a figure inside it
+      sources: [status_line]  # the figure comes off Codex's status line
 ```
 
 - `session` names the herdr session and defaults to `project`; `--session` overrides it.
@@ -104,6 +115,8 @@ seats:
   and session links are always refused.
 - `seats[*].cli` picks the launch profile; `claude-code`, `codex`, `cursor` and `antigravity` are available, and `team
   doctor` says what the others still need. `vendor`, `model` and `version` spell one seat's model.
+  `account` names the budget account the seat spends when one vendor has two; without it, the seat
+  spends its `vendor`, and changing either is an edit the owner re-approves.
 - `launch` is the plain command, without approval flags: the profile adds them. `count: 2` makes the
   numbered names; `parked` keeps a seat out of idle reports, `stopped` keeps it out of `up`.
 - `workspace.mode` is `shared` (every seat in the project) or `worktree` (each task in its own
@@ -134,7 +147,9 @@ under ~/.cursor/projects for that folder; team writes no trust (.workspace-trust
 config.
 
 `budgets` is the owner's: marks (percent used), how long a figure stays fresh, and each
-account's reserve or floor. A `check` command is resolved to a file and hashed when the
+account's reserve or floor. A seat spends its own `account:` when the file names one, its `vendor`
+when it doesn't, so one vendor's two accounts are two buckets; a pattern names the account it
+measures, not the seat's. A `check` command is resolved to a file and hashed when the
 owner approves. A change to that file leaves that account's check unapproved: it is
 not run, and the account reads unknown, until the owner approves again. The rest of
 the file still runs. `watch.quota_marks` is still read, with a warning, until you move it to
@@ -197,7 +212,7 @@ the commands below read.
 | `team doctor` | checks this machine for what the file needs: herdr, each CLI, login, launcher, model, watch heartbeat; `--login` checks only CLI sign-ins | anyone; read only |
 | `team status` | prints the file's seats against the running session, each difference with its repair; `--json` outputs a stable JSON document (`format: 1`) for scripts; exit 1 when they differ | anyone; read only |
 | `team up` / `team down` | starts / stops the session and its seats | `up`: the owner; `down`: the owner, the coordinator or the operator seat |
-| `team watch` | watches the session, reports idle seats and nudges the operator; `--no-nudge` and `--no-notify` turn those off | anyone, one per session; it types only its fixed nudge, into an empty idle prompt |
+| `team watch` | watches the session, reports idle seats and nudges the operator; `--no-nudge` and `--no-notify` are the owner's and do not silence a report addressed to the owner | anyone, one per session; it types only its fixed nudge, into an empty idle prompt |
 | `team add <name>` | starts one declared seat, or puts one back from the approved copy; `--temporary --like <seat> --until <end>` starts a seat the file does not hold | the owner, the coordinator or the operator |
 | `team remove <name>` | stops one seat, then takes it out of the file; `--keep` leaves it stopped; `--abandon` is the owner's, and types nothing | the owner, the coordinator or the operator; only the owner removes the coordinator or the operator |
 | `team worktree new <task>` / `team worktree remove <task>` | creates a task worktree from an up-to-date base, or removes its folder; a failed setup is kept and recorded; the branch is never deleted; ignored files in the worktree are deleted with it | the owner, the coordinator or the operator |
@@ -249,7 +264,7 @@ cd team
 bun install
 bun run build
 npm install -g .          # puts `team` on the PATH
-team --version            # 0.1.1
+team --version            # 0.1.2
 ```
 
 Bun builds and tests the sources:

package/dist/ansi.d.ts

@@ -0,0 +1,13 @@
+export declare function sgrDim(sequence: string, faint: boolean): boolean;
+/** The text of a styled pane read, without its escape sequences. */
+export declare function stripSgr(text: string): string;
+/** Whether the text carries any SGR styling at all — a colour, faint, bold, anything. */
+export declare function hasSgr(text: string): boolean;
+/**
+ * Whether every visible character after the first `skip` ones is faint, so the line holds a
+ * greyed suggestion rather than text. Whitespace is not read, mirroring the typed text the
+ * caller trims; an empty remainder is dim, as an empty box is. A character without any
+ * styling is plain text, so a plain source answers false and the placeholder list alone
+ * decides — the fallback for an herdr without `--format ansi`.
+ */
+export declare function allDimAfter(styled: string, skip: number): boolean;

package/dist/ansi.js

@@ -0,0 +1,75 @@
+// ANSI styling as herdr's `pane read --format ansi` reads it off a pane: the escape sequences
+// a CLI wrapped around its text. Matching always runs on the plain form; the styling answers
+// one question, the composer's — is the input line's text all dim, a greyed suggestion rather
+// than something typed. Nothing here moves the cursor or writes to a pane.
+//
+// Observed on Claude Code 2.1.289 (test/fixtures/claude-code/2.1.289/README.md): a greyed
+// suggestion is `ESC[0m ESC[2m` … `ESC[0m` — faint — while typed text carries no styling at
+// all. Faint is the only placeholder style: a colour, however grey it renders, is a colour,
+// and reading one as a placeholder was a guess this module no longer makes.
+// A CSI sequence (an SGR ends in `m`), or an OSC title string. Visible output holds little
+// else, and what it does hold is not text.
+const ESCAPES = /\x1b\[[0-9;:]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g;
+// The faint state one SGR sequence leaves the pen in. `0` and `22` lift it; `2` sets it. The
+// extended colours — foreground, background (48), underline (58) — carry their payload in
+// sub-parameters (5;n or 2;r;g;b) whose numbers are never the faint switch.
+export function sgrDim(sequence, faint) {
+    const params = sequence.slice(2, -1).split(';').map((part) => (part === '' ? '0' : part));
+    let faintNow = faint;
+    for (let i = 0; i < params.length; i++) {
+        const n = Number(params[i]);
+        if (!Number.isInteger(n))
+            continue;
+        if (n === 0 || n === 22)
+            faintNow = false;
+        if (n === 2)
+            faintNow = true;
+        if (n === 38 || n === 48 || n === 58) {
+            const mode = Number(params[i + 1]);
+            if (mode === 5)
+                i += 2;
+            else if (mode === 2)
+                i += 4;
+        }
+    }
+    return faintNow;
+}
+/** The text of a styled pane read, without its escape sequences. */
+export function stripSgr(text) {
+    return text.replace(ESCAPES, '');
+}
+/** Whether the text carries any SGR styling at all — a colour, faint, bold, anything. */
+export function hasSgr(text) {
+    return /\x1b\[[0-9;:]*m/.test(text);
+}
+/**
+ * Whether every visible character after the first `skip` ones is faint, so the line holds a
+ * greyed suggestion rather than text. Whitespace is not read, mirroring the typed text the
+ * caller trims; an empty remainder is dim, as an empty box is. A character without any
+ * styling is plain text, so a plain source answers false and the placeholder list alone
+ * decides — the fallback for an herdr without `--format ansi`.
+ */
+export function allDimAfter(styled, skip) {
+    let passed = 0;
+    let faint = false;
+    let cursor = 0;
+    // The characters before an escape, then the escape; then the rest after the last one.
+    const read = (chunk) => {
+        for (const ch of chunk) {
+            if (/\s/.test(ch))
+                continue;
+            passed++;
+            if (passed > skip && !faint)
+                return false;
+        }
+        return true;
+    };
+    for (const match of styled.matchAll(ESCAPES)) {
+        if (!read(styled.slice(cursor, match.index)))
+            return false;
+        if (match[0].endsWith('m'))
+            faint = sgrDim(match[0], faint);
+        cursor = match.index + match[0].length;
+    }
+    return read(styled.slice(cursor));
+}

package/dist/approve/approval.d.ts

@@ -14,6 +14,13 @@ export declare function approvalOf(team: TeamFile, root: string, now?: Date, che
  * it is, and the section reads as a difference.
  */
 export declare function approvedFingerprints(record: ApprovalRecord): Fingerprints;
+/**
+ * `remove --keep` and `add` write `stopped` and nothing else. The new digest is
+ * recorded only when putting `stopped` back to its approved value makes the
+ * seat match the approval. A launch line or a `parked` flag edited beside the
+ * mark stays drift. A stored copy that can't be read records nothing.
+ */
+export declare function recordSeatDigest(team: TeamFile, root: string, name: string, home?: string): void;
 /**
  * What in the file the owner has not approved on this machine, one line per
  * difference. Empty when the file is the approved one; null when nothing was
@@ -25,6 +32,10 @@ export declare function approvalDifferences(team: TeamFile, root: string, home?:
  * only once the owner has approved it: a file never approved runs with the defaults, and a file
  * whose `watch` section differs from the approved one runs with the values of the approved copy.
  * An edit to a threshold changes nothing until `approve`.
+ *
+ * `watch.checks` is the finer line inside that section. Whenever its digest differs, the checks
+ * in force are the approved copy's — or none, when that copy can't be read — even when the
+ * timings themselves are unchanged and the rest of the section is the file's.
  */
 export declare function watchInForce(team: TeamFile, root: string, home?: string): TeamFile['watch'];
 /**

package/dist/approve/approval.js

@@ -1,7 +1,7 @@
 import { homedir } from 'node:os';
 import { defaultBudgets, defaultWatch, validateTeamFile } from "../file/validate.js";
-import { readApproval, storePath } from "../store/store.js";
-import { compare, describe, fingerprints, OWNER_SECTIONS } from "./fingerprint.js";
+import { readApproval, storePath, writeApproval } from "../store/store.js";
+import { compare, describe, fingerprints, legacySeatDigests, OWNER_SECTIONS } from "./fingerprint.js";
 /** The ceilings an approval fixes: `up` and `add` read them from the record, never from the file. */
 export function ceilingsOf(team) {
     return { seats: team.limits.seats, temporary: team.limits.temporary, vendors: { ...team.limits.vendors } };
@@ -26,12 +26,69 @@ export function approvalOf(team, root, now = new Date(), checks = {}) {
  */
 export function approvedFingerprints(record) {
     const stored = record.approval.fingerprints;
-    if (OWNER_SECTIONS.every((name) => stored.sections[name] !== undefined))
-        return stored;
     const checked = validateTeamFile(record.file);
-    if (!checked.ok)
+    let sections = stored.sections;
+    if (!OWNER_SECTIONS.every((name) => stored.sections[name] !== undefined) && checked.ok) {
+        sections = { ...fingerprints(checked.team).sections, ...stored.sections };
+    }
+    const seats = checked.ok ? adoptFlagDigests(stored.seats, checked.team) : stored.seats;
+    if (sections === stored.sections && seats === stored.seats)
         return stored;
-    return { sections: { ...fingerprints(checked.team).sections, ...stored.sections }, seats: stored.seats };
+    return { sections, seats };
+}
+/**
+ * A record from before `parked` and `stopped` were in the digest still names
+ * the seat as it was approved, flags included, read from the stored copy. A
+ * digest already in the new shape is left alone, so a later edit of the file
+ * is not adopted from a stale copy. A copy that can't be read is left alone.
+ */
+function adoptFlagDigests(stored, team) {
+    const current = fingerprints(team).seats;
+    const legacy = legacySeatDigests(team);
+    let changed = false;
+    const next = { ...stored };
+    for (const [name, previous] of Object.entries(stored)) {
+        const adopted = current[name];
+        if (adopted !== undefined && previous === legacy[name] && previous !== adopted) {
+            next[name] = adopted;
+            changed = true;
+        }
+    }
+    return changed ? next : stored;
+}
+/**
+ * `remove --keep` and `add` write `stopped` and nothing else. The new digest is
+ * recorded only when putting `stopped` back to its approved value makes the
+ * seat match the approval. A launch line or a `parked` flag edited beside the
+ * mark stays drift. A stored copy that can't be read records nothing.
+ */
+export function recordSeatDigest(team, root, name, home = homedir()) {
+    const store = storePath(team.project, root, home);
+    const record = readApproval(store);
+    if (record === null)
+        return;
+    if (!validateTeamFile(record.file).ok)
+        return;
+    const approved = approvedFingerprints(record).seats[name];
+    const digest = fingerprints(team).seats[name];
+    if (approved === undefined || digest === undefined || record.approval.fingerprints.seats[name] === digest)
+        return;
+    const withStopped = (stopped) => fingerprints({
+        ...team,
+        seats: team.seats.map((seat) => (seat.name === name ? { ...seat, stopped } : seat)),
+    }).seats[name];
+    if (withStopped(true) !== approved && withStopped(false) !== approved)
+        return;
+    writeApproval(store, {
+        approval: {
+            ...record.approval,
+            fingerprints: {
+                ...record.approval.fingerprints,
+                seats: { ...record.approval.fingerprints.seats, [name]: digest },
+            },
+        },
+        file: record.file,
+    }, []);
 }
 /**
  * What in the file the owner has not approved on this machine, one line per
@@ -49,15 +106,25 @@ export function approvalDifferences(team, root, home = homedir()) {
  * only once the owner has approved it: a file never approved runs with the defaults, and a file
  * whose `watch` section differs from the approved one runs with the values of the approved copy.
  * An edit to a threshold changes nothing until `approve`.
+ *
+ * `watch.checks` is the finer line inside that section. Whenever its digest differs, the checks
+ * in force are the approved copy's — or none, when that copy can't be read — even when the
+ * timings themselves are unchanged and the rest of the section is the file's.
  */
 export function watchInForce(team, root, home = homedir()) {
     const record = readApproval(storePath(team.project, root, home));
     if (record === null)
         return defaultWatch();
-    if (approvedFingerprints(record).sections['watch'] === fingerprints(team).sections['watch'])
+    const differences = compare(approvedFingerprints(record), fingerprints(team));
+    const timingsDiffer = differences.some((difference) => difference.kind === 'section' && difference.name === 'watch');
+    const checksDiffer = differences.some((difference) => difference.kind === 'section' && difference.name === 'watch.checks');
+    if (!timingsDiffer && !checksDiffer)
         return team.watch;
     const copy = validateTeamFile(record.file);
-    return copy.ok ? copy.team.watch : defaultWatch();
+    const approved = copy.ok ? copy.team.watch : defaultWatch();
+    if (!timingsDiffer)
+        return { ...team.watch, checks: approved.checks };
+    return approved;
 }
 /**
  * The budget values in force. The `budgets` section is the owner's like the watch's, so what a

package/dist/approve/fingerprint.d.ts

@@ -18,6 +18,11 @@ export interface Fingerprints {
 export declare function canonical(value: unknown): string;
 /** A fingerprint of each owner-only section and of each seat. */
 export declare function fingerprints(team: Approvable): Fingerprints;
+/**
+ * Seat digests as a record written before `parked` and `stopped` were part of
+ * them. An approval from then still matches a file that has not changed.
+ */
+export declare function legacySeatDigests(team: Approvable): Record<string, string>;
 export type Difference = {
     kind: 'section';
     name: string;
@@ -31,14 +36,20 @@ export type Difference = {
 /**
  * What in the file the owner has not approved. The file passes when every
  * section matches and every seat in it matches an approved seat: a seat taken
- * out, parked or stopped needs no new approval.
+ * out needs no new approval. Parking or stopping one does.
  */
 export declare function compare(approved: Fingerprints, current: Fingerprints): Difference[];
 /**
- * The line `describe` prints when `watch.checks` itself is the difference. `pass` reads it to
- * keep the checks running until the owner approves an edit that would turn one off: nothing is
- * turned off until the owner approves (RFC 0002 § 4.2).
+ * The line `describe` prints when `watch.checks` itself is the difference. `pass` does not read
+ * it. The list in force is what turns checks off: while the edit is unapproved, the approved
+ * list stays in force, so nothing new is turned off and an approved-off check stays off.
  */
 export declare const WATCH_CHECKS_CHANGED = "`watch.checks` changed";
 /** One line per difference, as `status`, `doctor` and the refusals print it. */
 export declare function describe(difference: Difference): string;
+/**
+ * The seat a difference line names, when it names one — the inverse of `describe`, kept beside it
+ * so the two can't drift. `pass` reads it to keep a seat the owner has not approved out of the
+ * readings fold; `null` for a section difference.
+ */
+export declare function seatNamed(line: string): string | null;

package/dist/approve/fingerprint.js

@@ -38,11 +38,15 @@ function sectionOf(team, name) {
     return team[name];
 }
 /**
- * Seat fields that change without a new approval: what `remove --keep` and
- * `add` set, where the seat sits in the file, and how its entry is written
- * (`count: 3` becoming `count: 2`, or explicit seats, when one is taken out).
+ * Seat fields that change without a new approval: where the seat sits in the
+ * file, and how its entry is written (`count: 3` becoming `count: 2`, or
+ * explicit seats, when one is taken out). `parked` and `stopped` stay in the
+ * digest: a seat that can edit the file must not silence itself. `remove --keep`
+ * and `add` record the new digest with the edit.
  */
-const SEAT_FREE_FIELDS = new Set(['parked', 'stopped', 'line', 'declared', 'count', 'instance']);
+const SEAT_FREE_FIELDS = new Set(['line', 'declared', 'count', 'instance']);
+/** The free set from before `parked` and `stopped` joined the digest. */
+const LEGACY_SEAT_FREE_FIELDS = new Set(['parked', 'stopped', 'line', 'declared', 'count', 'instance']);
 /** JSON with every object's keys in order, so equal values give equal text. */
 export function canonical(value) {
     if (Array.isArray(value))
@@ -64,16 +68,28 @@ export function fingerprints(team) {
     for (const section of OWNER_SECTIONS)
         sections[section] = digest(sectionOf(team, section));
     const seats = {};
-    for (const seat of team.seats) {
-        const fields = Object.fromEntries(Object.entries(seat).filter(([key]) => !SEAT_FREE_FIELDS.has(key)));
-        seats[seat.name] = digest(fields);
-    }
+    for (const seat of team.seats)
+        seats[seat.name] = seatDigest(seat, SEAT_FREE_FIELDS);
     return { sections, seats };
 }
+/**
+ * Seat digests as a record written before `parked` and `stopped` were part of
+ * them. An approval from then still matches a file that has not changed.
+ */
+export function legacySeatDigests(team) {
+    const seats = {};
+    for (const seat of team.seats)
+        seats[seat.name] = seatDigest(seat, LEGACY_SEAT_FREE_FIELDS);
+    return seats;
+}
+function seatDigest(seat, free) {
+    const fields = Object.fromEntries(Object.entries(seat).filter(([key]) => !free.has(key)));
+    return digest(fields);
+}
 /**
  * What in the file the owner has not approved. The file passes when every
  * section matches and every seat in it matches an approved seat: a seat taken
- * out, parked or stopped needs no new approval.
+ * out needs no new approval. Parking or stopping one does.
  */
 export function compare(approved, current) {
     const differences = [];
@@ -94,9 +110,9 @@ export function compare(approved, current) {
     return differences;
 }
 /**
- * The line `describe` prints when `watch.checks` itself is the difference. `pass` reads it to
- * keep the checks running until the owner approves an edit that would turn one off: nothing is
- * turned off until the owner approves (RFC 0002 § 4.2).
+ * The line `describe` prints when `watch.checks` itself is the difference. `pass` does not read
+ * it. The list in force is what turns checks off: while the edit is unapproved, the approved
+ * list stays in force, so nothing new is turned off and an approved-off check stays off.
  */
 export const WATCH_CHECKS_CHANGED = '`watch.checks` changed';
 /** One line per difference, as `status`, `doctor` and the refusals print it. */
@@ -107,3 +123,12 @@ export function describe(difference) {
         return `seat ${difference.name} is not in the approved file`;
     return `seat ${difference.name} changed`;
 }
+/**
+ * The seat a difference line names, when it names one — the inverse of `describe`, kept beside it
+ * so the two can't drift. `pass` reads it to keep a seat the owner has not approved out of the
+ * readings fold; `null` for a section difference.
+ */
+export function seatNamed(line) {
+    const match = /^seat (.+) (?:changed|is not in the approved file)$/.exec(line);
+    return match?.[1] ?? null;
+}

package/dist/budgets/gate.d.ts

@@ -11,10 +11,11 @@ export type LaunchDecision = {
     why: string;
 };
 /**
- * The seat's account is its vendor. There is no separate account field on a seat. `budgets` is
- * the section in force: an unapproved edit to a reserve refuses no one until it is approved,
- * and an account only the unapproved edit names is not an account at all. `spend` holds the
- * stored spend check readings; a subscription account never looks at them.
+ * The seat's account is its own `account:` when the file names one — one vendor with two accounts
+ * is two buckets (§ 3b) — and its vendor otherwise. `budgets` is the section in force: an
+ * unapproved edit to a reserve refuses no one until it is approved, and an account only the
+ * unapproved edit names is not an account at all. `spend` holds the stored spend check readings;
+ * a subscription account never looks at them.
  */
 export declare function seatBudget(budgets: TeamFile['budgets'], readings: readonly Seen[], seat: Seat, now: number, spend?: readonly SpendReading[]): LaunchDecision;
 /**

package/dist/budgets/gate.js

@@ -1,13 +1,14 @@
-import { verdict } from "./readings.js";
+import { checkOf, countedFor, screenOf } from "./readings.js";
 const RANK = { session: 0, daily: 1, weekly: 2 };
 /**
- * The seat's account is its vendor. There is no separate account field on a seat. `budgets` is
- * the section in force: an unapproved edit to a reserve refuses no one until it is approved,
- * and an account only the unapproved edit names is not an account at all. `spend` holds the
- * stored spend check readings; a subscription account never looks at them.
+ * The seat's account is its own `account:` when the file names one — one vendor with two accounts
+ * is two buckets (§ 3b) — and its vendor otherwise. `budgets` is the section in force: an
+ * unapproved edit to a reserve refuses no one until it is approved, and an account only the
+ * unapproved edit names is not an account at all. `spend` holds the stored spend check readings;
+ * a subscription account never looks at them.
  */
 export function seatBudget(budgets, readings, seat, now, spend = []) {
-    const name = seat.vendor;
+    const name = seat.account ?? seat.vendor;
     const account = budgets.accounts[name];
     if (!account)
         return { kind: 'clear' };
@@ -35,7 +36,9 @@ export function seatBudget(budgets, readings, seat, now, spend = []) {
     let counted = false;
     let worst = null;
     for (const group of windowsOf(mine)) {
-        const result = verdict(group, now, staleAfterMs, account.reserve);
+        // The window's reading from the sources the account names, in order (§ 3, § 5): a check
+        // reading counts by its own freshness, ahead of a screen reading below it.
+        const result = countedFor(account.sources, screenOf(group), checkOf(group), now, staleAfterMs, account.reserve);
         if (result.kind === 'unknown') {
             unknown = true;
             continue;
@@ -46,8 +49,7 @@ export function seatBudget(budgets, readings, seat, now, spend = []) {
             continue;
         }
         counted = true;
-        const inside = account.reserve !== null && result.reading.left <= account.reserve;
-        if (!inside && result.kind !== 'refusing')
+        if (account.reserve === null || result.reading.left > account.reserve)
             continue;
         if (!worst
             || result.reading.left < worst.left
@@ -57,9 +59,11 @@ export function seatBudget(budgets, readings, seat, now, spend = []) {
     }
     if (worst && account.reserve !== null) {
         const room = accountsWithRoom(budgets, readings, now).filter((accountName) => accountName !== name);
+        // A check reading was measured, not changed on a screen: § 5's word for it.
+        const when = worst.source === 'check' ? 'read' : 'changed';
         return {
             kind: 'refuse',
-            why: `${name} ${worst.window} left ${worst.left}%, inside its ${account.reserve}% reserve, changed ${age(now - worst.changedAt)} ago; accounts with room: ${room.length ? room.join(', ') : 'none'}`,
+            why: `${name} ${worst.window} left ${worst.left}%, inside its ${account.reserve}% reserve, ${when} ${age(now - worst.changedAt)} ago; accounts with room: ${room.length ? room.join(', ') : 'none'}`,
         };
     }
     if (unknown)
@@ -90,11 +94,11 @@ export function accountsWithRoom(budgets, readings, now, spend = []) {
         let counted = 0;
         let inside = false;
         for (const group of groups) {
-            const result = verdict(group, now, staleAfterMs, account.reserve);
+            const result = countedFor(account.sources, screenOf(group), checkOf(group), now, staleAfterMs, account.reserve);
             if (result.kind === 'unknown' || result.kind === 'unconfirmed')
                 continue;
             counted += 1;
-            if (result.kind === 'refusing' || result.reading.left <= account.reserve)
+            if (result.reading.left <= account.reserve)
                 inside = true;
         }
         if (counted > 0 && !inside)

package/dist/budgets/readings.d.ts

@@ -1,4 +1,7 @@
 import type { QuotaFigure, WindowName } from '../profiles/quota.ts';
+import type { CheckWindow } from './run.ts';
+/** Where a reading came from: a pane's own status line, or an approved check command (§ 3). */
+export type ReadingSource = 'status_line' | 'check';
 export type Seen = {
     account: string;
     window: WindowName;
@@ -6,7 +9,9 @@ export type Seen = {
     used: number;
     changedAt: number;
     resetsAt: number | null;
-    seat: string;
+    /** The seat whose screen showed it; null for a check reading, which belongs to no seat. */
+    seat: string | null;
+    source: ReadingSource;
     confirmed: boolean;
 };
 export type StoredReading = {
@@ -16,7 +21,9 @@ export type StoredReading = {
     used: number;
     changedAt: string;
     resetsAt: string | null;
-    seat: string;
+    seat: string | null;
+    /** Absent in state files written before sources were recorded: a screen reading then. */
+    source?: ReadingSource;
     confirmed: boolean;
 };
 export type Verdict = {
@@ -41,6 +48,15 @@ export type StoredSpend = {
 };
 /** Fold one seat's figure into the readings kept for this pass. */
 export declare function observe(list: readonly Seen[], figure: QuotaFigure, seat: string, now: number): Seen[];
+/**
+ * Fold a check command's windows into the readings kept for this pass (§ 5). A check reading is
+ * confirmed at first sight and belongs to no seat; one is kept per account and window, so a new
+ * check replaces the last, and the screen readings of the same window are left alone.
+ */
+export declare function observeCheck(list: readonly Seen[], account: string, windows: readonly CheckWindow[]): Seen[];
+/** The screen readings in a list, and the check readings: the two slots of the same account. */
+export declare function screenOf(list: readonly Seen[]): Seen[];
+export declare function checkOf(list: readonly Seen[]): Seen[];
 /**
  * The reading that counts. A figure from before a known reset is dropped.
  * Among confirmed live readings, the newest change wins. A first sight counts
@@ -49,18 +65,46 @@ export declare function observe(list: readonly Seen[], figure: QuotaFigure, seat
  * with no reset time it is unknown.
  */
 export declare function verdict(list: readonly Seen[], now: number, staleAfterMs: number, reserve: number | null): Verdict;
+export type CountedReading = {
+    kind: 'counted';
+    reading: Seen;
+} | {
+    kind: 'unconfirmed';
+    reading: Seen;
+} | {
+    kind: 'unknown';
+};
+/**
+ * The reading that counts for one window, from the sources the account names in order (§ 3, § 5):
+ * a lower source is used only when every higher one is failed, unknown or stale. A check reading
+ * counts while it is fresh by § 5's own time and its reset has not passed; a screen reading falls
+ * through when it is unknown, and a bare first sight falls through too, so a fresh check below it
+ * still counts (§ 4.3 rule 5). A stale reading inside its reserve with its reset ahead is kept as
+ * the fallback, whichever source it came from, so rule 4 still refuses when nothing below counts.
+ */
+export declare function countedFor(sources: readonly ReadingSource[], screen: readonly Seen[], checks: readonly Seen[], now: number, staleAfterMs: number, reserve: number | null): CountedReading;
 /** Readings whose reset has passed are left out. One with no reset time is kept. */
 export declare function remember(list: readonly Seen[], now: number): Record<string, StoredReading>;
 export declare function recall(stored: Record<string, StoredReading> | undefined): Seen[];
-/** Write the readings that still count. The state file is the per-project cache. */
-export declare function saveReadings(dir: string, session: string, list: readonly Seen[], now?: number): void;
-export declare function loadReadings(dir: string, session: string): Seen[];
+/** Write the readings that still count. The state file is the per-project cache (§ 4.4). */
+export declare function saveReadings(dir: string, list: readonly Seen[], now?: number): void;
+/**
+ * One pass's fold, read and written under the state lock (§ 4.4): `fold` is handed the readings
+ * the state holds and returns the list to keep, so a watch folding while another watch writes
+ * folds onto what was written, never over a list it read before it. Whatever the fold returns as
+ * its `value` is handed back.
+ */
+export declare function updateReadings<T>(dir: string, now: number, fold: (stored: Seen[]) => {
+    readings: Seen[];
+    value: T;
+}): T;
+export declare function loadReadings(dir: string): Seen[];
 /**
  * Write the spend readings a pass's checks read, merging by account: an account whose check did
  * not run this pass keeps the reading the state already holds. Nothing read, nothing written.
  */
-export declare function saveSpendReadings(dir: string, session: string, list: readonly SpendReading[]): void;
-export declare function loadSpendReadings(dir: string, session: string): SpendReading[];
+export declare function saveSpendReadings(dir: string, list: readonly SpendReading[]): void;
+export declare function loadSpendReadings(dir: string): SpendReading[];
 export declare function storeSpend(reading: SpendReading): StoredSpend;
 export declare function recallSpend(stored: Record<string, StoredSpend> | undefined): SpendReading[];
 export declare function store(reading: Seen): StoredReading;