team 0.1.1 → 0.2.0

package/README.md

@@ -18,7 +18,7 @@ Node 22 or later runs the built command.
 
 ```sh
 npm install -g team       # or run it without installing: npx team
-team --version            # 0.1.1
+team --version            # 0.2.0
 ```
 
 ## The file is private to each clone
@@ -34,13 +34,14 @@ yourself.
 A documented subset of YAML, read by the library's own parser: maps, lists, one-line `{ }` and
 `[ ]`, plain and quoted values, comments. Anchors, aliases, tags, block scalars, several documents
 in one file and duplicate keys are refused, with the line number. The file starts with `format: 1`.
+The package ships the JSON Schema at `schema/team.schema.json`, and `team init` writes a `# yaml-language-server: $schema=…` line at the top of the file so editors validate it.
 By example:
 
 ```yaml
 format: 1                     # the only format this version reads
 project: hello
-coordinator: claude-coord     # the seat that dispatches work
-operator: claude-coord        # the seat the watch reports to
+coordinator: coordinator      # the seat that dispatches work
+operator: coordinator         # the seat the watch reports to
 
 identity:
   signature:
@@ -48,7 +49,10 @@ identity:
       position: trailer       # last-line | trailer | anywhere
       exempt: [merge]         # merge commits need no signature
 
-rules:                        # lines added to every seat's rules at launch
+rules:                        # lines added to every seat's rules at launch. Rules delivered as a launch
+                              # option (claude-code) close with "These are standing rules, not a task.";
+                              # rules typed as a first message (codex, cursor, antigravity) close with
+                              # "These are standing rules, not a task: reply ready and wait for your brief."
   - Run the tests your change touches, not the whole suite.
 
 workspace:
@@ -56,7 +60,7 @@ workspace:
 
 seats:
   - role: coordinator
-    name: claude-coord
+    name: coordinator
     cli: claude-code          # the launch profile
     vendor: anthropic         # the model's maker
     model: Claude Opus        # the model's name, without its version
@@ -64,9 +68,10 @@ seats:
     launch: claude --model claude-opus-5-5   # no approval flags: the profile adds them
 
   - role: implementer
-    name: codex-hello
+    name: implementer
     cli: codex
     vendor: openai
+    account: openai-hello     # the seat's account, when one vendor has two; absent, its vendor
     model: GPT Sol
     version: "6"
     display: GPT-6 Sol        # the vendor's spelling, for the signature
@@ -74,23 +79,30 @@ seats:
     parked: true              # running, and not reported while idle
 
   - role: implementer
-    name: deepseek-hello
+    name: implementer-deepseek
     cli: claude-code          # DeepSeek's model, run by Claude Code
     vendor: deepseek
     model: DeepSeek Flash
     version: "V4.1"
     display: DeepSeek V4.1 Flash
     launch: team-deepseek     # a launcher on the PATH, holding the account's key and endpoint
-    count: 2                  # deepseek-hello and deepseek-hello-2
+    count: 2                  # implementer-deepseek and implementer-deepseek-2
 
   - role: reviewer
-    name: grok-hello
+    name: reviewer
     cli: grok
     vendor: xai
     model: Grok
     version: "4.7"
     launch: grok --model grok-4.7
     stopped: true             # kept in the file; `up` doesn't start it
+
+budgets:                      # the owner's: reserve or floor per account, marks, freshness
+  accounts:
+    openai-hello:             # the account implementer spends
+      kind: subscription
+      reserve: 10%            # refuse a launch on a figure inside it
+      sources: [status_line]  # the figure comes off Codex's status line
 ```
 
 - `session` names the herdr session and defaults to `project`; `--session` overrides it.
@@ -104,6 +116,8 @@ seats:
   and session links are always refused.
 - `seats[*].cli` picks the launch profile; `claude-code`, `codex`, `cursor` and `antigravity` are available, and `team
   doctor` says what the others still need. `vendor`, `model` and `version` spell one seat's model.
+  `account` names the budget account the seat spends when one vendor has two; without it, the seat
+  spends its `vendor`, and changing either is an edit the owner re-approves.
 - `launch` is the plain command, without approval flags: the profile adds them. `count: 2` makes the
   numbered names; `parked` keeps a seat out of idle reports, `stopped` keeps it out of `up`.
 - `workspace.mode` is `shared` (every seat in the project) or `worktree` (each task in its own
@@ -112,6 +126,15 @@ seats:
   `trust` and outside every protected checkout — never in the project root; `up` and `add` refuse a
   seat whose folder, lobby included, would be protected or untrusted.
 
+### Naming seats
+
+The herdr session carries the project, so a seat's name is its role: `coordinator`, `implementer`,
+`reviewer`. When a role is used twice, the model is added: `implementer-deepseek`. The label is the
+herdr workspace title. Left out of the file, it is the model and version in lowercase
+(`claude opus 5.5`), taken from that seat's own fields, so a model change retitles the pane. A
+label written in the file is kept. `team doctor` warns, and does not refuse the file, when a name
+or a label repeats the project or the session.
+
 The Codex profile is tested with CLI 0.157.0. Its status line is read for a weekly figure
 (`weekly N% left`) when the pane is wide enough to show the number; a cut line is not a figure.
 It adds `-a never -s danger-full-access`
@@ -134,7 +157,10 @@ under ~/.cursor/projects for that folder; team writes no trust (.workspace-trust
 config.
 
 `budgets` is the owner's: marks (percent used), how long a figure stays fresh, and each
-account's reserve or floor. A `check` command is resolved to a file and hashed when the
+account's reserve or floor. An account's `shared` key is informational; `team` does not act
+on it. A seat spends its own `account:` when the file names one, its `vendor`
+when it doesn't, so one vendor's two accounts are two buckets; a pattern names the account it
+measures, not the seat's. A `check` command is resolved to a file and hashed when the
 owner approves. A change to that file leaves that account's check unapproved: it is
 not run, and the account reads unknown, until the owner approves again. The rest of
 the file still runs. `watch.quota_marks` is still read, with a warning, until you move it to
@@ -197,7 +223,7 @@ the commands below read.
 | `team doctor` | checks this machine for what the file needs: herdr, each CLI, login, launcher, model, watch heartbeat; `--login` checks only CLI sign-ins | anyone; read only |
 | `team status` | prints the file's seats against the running session, each difference with its repair; `--json` outputs a stable JSON document (`format: 1`) for scripts; exit 1 when they differ | anyone; read only |
 | `team up` / `team down` | starts / stops the session and its seats | `up`: the owner; `down`: the owner, the coordinator or the operator seat |
-| `team watch` | watches the session, reports idle seats and nudges the operator; `--no-nudge` and `--no-notify` turn those off | anyone, one per session; it types only its fixed nudge, into an empty idle prompt |
+| `team watch` | watches the session, reports idle seats and nudges the operator; `--no-nudge` and `--no-notify` are the owner's and do not silence a report addressed to the owner | anyone, one per session; it types only its fixed nudge, into an empty idle prompt |
 | `team add <name>` | starts one declared seat, or puts one back from the approved copy; `--temporary --like <seat> --until <end>` starts a seat the file does not hold | the owner, the coordinator or the operator |
 | `team remove <name>` | stops one seat, then takes it out of the file; `--keep` leaves it stopped; `--abandon` is the owner's, and types nothing | the owner, the coordinator or the operator; only the owner removes the coordinator or the operator |
 | `team worktree new <task>` / `team worktree remove <task>` | creates a task worktree from an up-to-date base, or removes its folder; a failed setup is kept and recorded; the branch is never deleted; ignored files in the worktree are deleted with it | the owner, the coordinator or the operator |
@@ -249,7 +275,7 @@ cd team
 bun install
 bun run build
 npm install -g .          # puts `team` on the PATH
-team --version            # 0.1.1
+team --version            # 0.2.0
 ```
 
 Bun builds and tests the sources:

package/dist/ansi.d.ts

@@ -0,0 +1,13 @@
+export declare function sgrDim(sequence: string, faint: boolean): boolean;
+/** The text of a styled pane read, without its escape sequences. */
+export declare function stripSgr(text: string): string;
+/** Whether the text carries any SGR styling at all — a colour, faint, bold, anything. */
+export declare function hasSgr(text: string): boolean;
+/**
+ * Whether every visible character after the first `skip` ones is faint, so the line holds a
+ * greyed suggestion rather than text. Whitespace is not read, mirroring the typed text the
+ * caller trims; an empty remainder is dim, as an empty box is. A character without any
+ * styling is plain text, so a plain source answers false and the placeholder list alone
+ * decides — the fallback for an herdr without `--format ansi`.
+ */
+export declare function allDimAfter(styled: string, skip: number): boolean;

package/dist/ansi.js

@@ -0,0 +1,75 @@
+// ANSI styling as herdr's `pane read --format ansi` reads it off a pane: the escape sequences
+// a CLI wrapped around its text. Matching always runs on the plain form; the styling answers
+// one question, the composer's — is the input line's text all dim, a greyed suggestion rather
+// than something typed. Nothing here moves the cursor or writes to a pane.
+//
+// Observed on Claude Code 2.1.289 (test/fixtures/claude-code/2.1.289/README.md): a greyed
+// suggestion is `ESC[0m ESC[2m` … `ESC[0m` — faint — while typed text carries no styling at
+// all. Faint is the only placeholder style: a colour, however grey it renders, is a colour,
+// and reading one as a placeholder was a guess this module no longer makes.
+// A CSI sequence (an SGR ends in `m`), or an OSC title string. Visible output holds little
+// else, and what it does hold is not text.
+const ESCAPES = /\x1b\[[0-9;:]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g;
+// The faint state one SGR sequence leaves the pen in. `0` and `22` lift it; `2` sets it. The
+// extended colours — foreground, background (48), underline (58) — carry their payload in
+// sub-parameters (5;n or 2;r;g;b) whose numbers are never the faint switch.
+export function sgrDim(sequence, faint) {
+    const params = sequence.slice(2, -1).split(';').map((part) => (part === '' ? '0' : part));
+    let faintNow = faint;
+    for (let i = 0; i < params.length; i++) {
+        const n = Number(params[i]);
+        if (!Number.isInteger(n))
+            continue;
+        if (n === 0 || n === 22)
+            faintNow = false;
+        if (n === 2)
+            faintNow = true;
+        if (n === 38 || n === 48 || n === 58) {
+            const mode = Number(params[i + 1]);
+            if (mode === 5)
+                i += 2;
+            else if (mode === 2)
+                i += 4;
+        }
+    }
+    return faintNow;
+}
+/** The text of a styled pane read, without its escape sequences. */
+export function stripSgr(text) {
+    return text.replace(ESCAPES, '');
+}
+/** Whether the text carries any SGR styling at all — a colour, faint, bold, anything. */
+export function hasSgr(text) {
+    return /\x1b\[[0-9;:]*m/.test(text);
+}
+/**
+ * Whether every visible character after the first `skip` ones is faint, so the line holds a
+ * greyed suggestion rather than text. Whitespace is not read, mirroring the typed text the
+ * caller trims; an empty remainder is dim, as an empty box is. A character without any
+ * styling is plain text, so a plain source answers false and the placeholder list alone
+ * decides — the fallback for an herdr without `--format ansi`.
+ */
+export function allDimAfter(styled, skip) {
+    let passed = 0;
+    let faint = false;
+    let cursor = 0;
+    // The characters before an escape, then the escape; then the rest after the last one.
+    const read = (chunk) => {
+        for (const ch of chunk) {
+            if (/\s/.test(ch))
+                continue;
+            passed++;
+            if (passed > skip && !faint)
+                return false;
+        }
+        return true;
+    };
+    for (const match of styled.matchAll(ESCAPES)) {
+        if (!read(styled.slice(cursor, match.index)))
+            return false;
+        if (match[0].endsWith('m'))
+            faint = sgrDim(match[0], faint);
+        cursor = match.index + match[0].length;
+    }
+    return read(styled.slice(cursor));
+}

package/dist/approve/approval.d.ts

@@ -14,6 +14,13 @@ export declare function approvalOf(team: TeamFile, root: string, now?: Date, che
  * it is, and the section reads as a difference.
  */
 export declare function approvedFingerprints(record: ApprovalRecord): Fingerprints;
+/**
+ * `remove --keep` and `add` write `stopped` and nothing else. The new digest is
+ * recorded only when putting `stopped` back to its approved value makes the
+ * seat match the approval. A launch line or a `parked` flag edited beside the
+ * mark stays drift. A stored copy that can't be read records nothing.
+ */
+export declare function recordSeatDigest(team: TeamFile, root: string, name: string, home?: string): void;
 /**
  * What in the file the owner has not approved on this machine, one line per
  * difference. Empty when the file is the approved one; null when nothing was
@@ -25,6 +32,10 @@ export declare function approvalDifferences(team: TeamFile, root: string, home?:
  * only once the owner has approved it: a file never approved runs with the defaults, and a file
  * whose `watch` section differs from the approved one runs with the values of the approved copy.
  * An edit to a threshold changes nothing until `approve`.
+ *
+ * `watch.checks` is the finer line inside that section. Whenever its digest differs, the checks
+ * in force are the approved copy's — or none, when that copy can't be read — even when the
+ * timings themselves are unchanged and the rest of the section is the file's.
  */
 export declare function watchInForce(team: TeamFile, root: string, home?: string): TeamFile['watch'];
 /**

package/dist/approve/approval.js

@@ -1,7 +1,7 @@
 import { homedir } from 'node:os';
 import { defaultBudgets, defaultWatch, validateTeamFile } from "../file/validate.js";
-import { readApproval, storePath } from "../store/store.js";
-import { compare, describe, fingerprints, OWNER_SECTIONS } from "./fingerprint.js";
+import { readApproval, storePath, writeApproval } from "../store/store.js";
+import { compare, describe, fingerprints, legacyLabelDigests, legacySeatDigests, OWNER_SECTIONS } from "./fingerprint.js";
 /** The ceilings an approval fixes: `up` and `add` read them from the record, never from the file. */
 export function ceilingsOf(team) {
     return { seats: team.limits.seats, temporary: team.limits.temporary, vendors: { ...team.limits.vendors } };
@@ -26,12 +26,74 @@ export function approvalOf(team, root, now = new Date(), checks = {}) {
  */
 export function approvedFingerprints(record) {
     const stored = record.approval.fingerprints;
-    if (OWNER_SECTIONS.every((name) => stored.sections[name] !== undefined))
-        return stored;
     const checked = validateTeamFile(record.file);
-    if (!checked.ok)
+    let sections = stored.sections;
+    if (!OWNER_SECTIONS.every((name) => stored.sections[name] !== undefined) && checked.ok) {
+        sections = { ...fingerprints(checked.team).sections, ...stored.sections };
+    }
+    const seats = checked.ok ? adoptLegacyDigests(stored.seats, checked.team) : stored.seats;
+    if (sections === stored.sections && seats === stored.seats)
         return stored;
-    return { sections: { ...fingerprints(checked.team).sections, ...stored.sections }, seats: stored.seats };
+    return { sections, seats };
+}
+/**
+ * A record from before `parked` and `stopped` were in the digest, or from when
+ * an omitted label was the seat's name, still names the seat as it was
+ * approved, read from the stored copy. A digest already in the new shape is
+ * left alone, so a later edit of the file is not adopted from a stale copy.
+ * A copy that can't be read is left alone.
+ */
+function adoptLegacyDigests(stored, team) {
+    const current = fingerprints(team).seats;
+    const legacyFlags = legacySeatDigests(team);
+    const legacyLabels = legacyLabelDigests(team);
+    let changed = false;
+    const next = { ...stored };
+    for (const [name, previous] of Object.entries(stored)) {
+        const adopted = current[name];
+        const old = previous === legacyFlags[name] ||
+            previous === legacyLabels.named[name] ||
+            previous === legacyLabels.namedWithoutFlags[name];
+        if (adopted !== undefined && old && previous !== adopted) {
+            next[name] = adopted;
+            changed = true;
+        }
+    }
+    return changed ? next : stored;
+}
+/**
+ * `remove --keep` and `add` write `stopped` and nothing else. The new digest is
+ * recorded only when putting `stopped` back to its approved value makes the
+ * seat match the approval. A launch line or a `parked` flag edited beside the
+ * mark stays drift. A stored copy that can't be read records nothing.
+ */
+export function recordSeatDigest(team, root, name, home = homedir()) {
+    const store = storePath(team.project, root, home);
+    const record = readApproval(store);
+    if (record === null)
+        return;
+    if (!validateTeamFile(record.file).ok)
+        return;
+    const approved = approvedFingerprints(record).seats[name];
+    const digest = fingerprints(team).seats[name];
+    if (approved === undefined || digest === undefined || record.approval.fingerprints.seats[name] === digest)
+        return;
+    const withStopped = (stopped) => fingerprints({
+        ...team,
+        seats: team.seats.map((seat) => (seat.name === name ? { ...seat, stopped } : seat)),
+    }).seats[name];
+    if (withStopped(true) !== approved && withStopped(false) !== approved)
+        return;
+    writeApproval(store, {
+        approval: {
+            ...record.approval,
+            fingerprints: {
+                ...record.approval.fingerprints,
+                seats: { ...record.approval.fingerprints.seats, [name]: digest },
+            },
+        },
+        file: record.file,
+    }, []);
 }
 /**
  * What in the file the owner has not approved on this machine, one line per
@@ -49,15 +111,25 @@ export function approvalDifferences(team, root, home = homedir()) {
  * only once the owner has approved it: a file never approved runs with the defaults, and a file
  * whose `watch` section differs from the approved one runs with the values of the approved copy.
  * An edit to a threshold changes nothing until `approve`.
+ *
+ * `watch.checks` is the finer line inside that section. Whenever its digest differs, the checks
+ * in force are the approved copy's — or none, when that copy can't be read — even when the
+ * timings themselves are unchanged and the rest of the section is the file's.
  */
 export function watchInForce(team, root, home = homedir()) {
     const record = readApproval(storePath(team.project, root, home));
     if (record === null)
         return defaultWatch();
-    if (approvedFingerprints(record).sections['watch'] === fingerprints(team).sections['watch'])
+    const differences = compare(approvedFingerprints(record), fingerprints(team));
+    const timingsDiffer = differences.some((difference) => difference.kind === 'section' && difference.name === 'watch');
+    const checksDiffer = differences.some((difference) => difference.kind === 'section' && difference.name === 'watch.checks');
+    if (!timingsDiffer && !checksDiffer)
         return team.watch;
     const copy = validateTeamFile(record.file);
-    return copy.ok ? copy.team.watch : defaultWatch();
+    const approved = copy.ok ? copy.team.watch : defaultWatch();
+    if (!timingsDiffer)
+        return { ...team.watch, checks: approved.checks };
+    return approved;
 }
 /**
  * The budget values in force. The `budgets` section is the owner's like the watch's, so what a

package/dist/approve/fingerprint.d.ts

@@ -1,8 +1,10 @@
 /**
  * The sections only the owner changes. An edit to any of them needs a new
- * approval before the file runs.
+ * approval before the file runs. Generated from the section modules, in their
+ * list's order — the order feeds the approval digest, so the list keeps it:
+ * `watch` last with `watch.checks`, the line inside it, after it.
  */
-export declare const OWNER_SECTIONS: readonly ["trust", "limits", "machine", "rules", "identity", "workspace", "coordinator", "operator", "session", "visibility", "tools", "budgets", "watch", "watch.checks"];
+export declare const OWNER_SECTIONS: readonly string[];
 /** A validated team file, as far as an approval reads it. */
 export type Approvable = Record<string, unknown> & {
     seats: readonly (Record<string, unknown> & {
@@ -18,6 +20,21 @@ export interface Fingerprints {
 export declare function canonical(value: unknown): string;
 /** A fingerprint of each owner-only section and of each seat. */
 export declare function fingerprints(team: Approvable): Fingerprints;
+/**
+ * Seat digests as a record written before `parked` and `stopped` were part of
+ * them. An approval from then still matches a file that has not changed.
+ */
+export declare function legacySeatDigests(team: Approvable): Record<string, string>;
+/**
+ * Seat digests as a record written when an omitted label was the seat's name.
+ * `v0.1.2` hashed `parked` and `stopped`; `v0.1.1` left them out. A written
+ * label hashes the same title in every shape, so these equal a stored digest
+ * only where the title was the name.
+ */
+export declare function legacyLabelDigests(team: Approvable): {
+    named: Record<string, string>;
+    namedWithoutFlags: Record<string, string>;
+};
 export type Difference = {
     kind: 'section';
     name: string;
@@ -31,14 +48,20 @@ export type Difference = {
 /**
  * What in the file the owner has not approved. The file passes when every
  * section matches and every seat in it matches an approved seat: a seat taken
- * out, parked or stopped needs no new approval.
+ * out needs no new approval. Parking or stopping one does.
  */
 export declare function compare(approved: Fingerprints, current: Fingerprints): Difference[];
 /**
- * The line `describe` prints when `watch.checks` itself is the difference. `pass` reads it to
- * keep the checks running until the owner approves an edit that would turn one off: nothing is
- * turned off until the owner approves (RFC 0002 § 4.2).
+ * The line `describe` prints when `watch.checks` itself is the difference. `pass` does not read
+ * it. The list in force is what turns checks off: while the edit is unapproved, the approved
+ * list stays in force, so nothing new is turned off and an approved-off check stays off.
  */
 export declare const WATCH_CHECKS_CHANGED = "`watch.checks` changed";
 /** One line per difference, as `status`, `doctor` and the refusals print it. */
 export declare function describe(difference: Difference): string;
+/**
+ * The seat a difference line names, when it names one — the inverse of `describe`, kept beside it
+ * so the two can't drift. `pass` reads it to keep a seat the owner has not approved out of the
+ * readings fold; `null` for a section difference.
+ */
+export declare function seatNamed(line: string): string | null;

package/dist/approve/fingerprint.js

@@ -1,28 +1,12 @@
 import { createHash } from 'node:crypto';
+import { SECTIONS } from "../file/sections/index.js";
 /**
  * The sections only the owner changes. An edit to any of them needs a new
- * approval before the file runs.
+ * approval before the file runs. Generated from the section modules, in their
+ * list's order — the order feeds the approval digest, so the list keeps it:
+ * `watch` last with `watch.checks`, the line inside it, after it.
  */
-export const OWNER_SECTIONS = [
-    'trust',
-    'limits',
-    'machine',
-    'rules',
-    'identity',
-    'workspace',
-    'coordinator',
-    'operator',
-    'session',
-    'visibility',
-    'tools',
-    'budgets',
-    // The watch's own timings, thresholds included: a seat allowed to stretch `unsent_after` or
-    // `idle_first` could silence the watch itself, so the section is the owner's like the rest.
-    'watch',
-    // And turning a check off is the finer line inside it: the digest above leaves the checks out,
-    // so turning one off reads as `watch.checks` alone, never as a threshold change too.
-    'watch.checks',
-];
+export const OWNER_SECTIONS = SECTIONS.filter((section) => section.owner).map((section) => section.name);
 /** One owner section, read from the file; the two watch sections sit inside `watch`, not at the top. */
 function sectionOf(team, name) {
     if (name === 'watch.checks')
@@ -38,11 +22,15 @@ function sectionOf(team, name) {
     return team[name];
 }
 /**
- * Seat fields that change without a new approval: what `remove --keep` and
- * `add` set, where the seat sits in the file, and how its entry is written
- * (`count: 3` becoming `count: 2`, or explicit seats, when one is taken out).
+ * Seat fields that change without a new approval: where the seat sits in the
+ * file, and how its entry is written (`count: 3` becoming `count: 2`, or
+ * explicit seats, when one is taken out). `parked` and `stopped` stay in the
+ * digest: a seat that can edit the file must not silence itself. `remove --keep`
+ * and `add` record the new digest with the edit.
  */
-const SEAT_FREE_FIELDS = new Set(['parked', 'stopped', 'line', 'declared', 'count', 'instance']);
+const SEAT_FREE_FIELDS = new Set(['line', 'declared', 'count', 'instance']);
+/** The free set from before `parked` and `stopped` joined the digest. */
+const LEGACY_SEAT_FREE_FIELDS = new Set(['parked', 'stopped', 'line', 'declared', 'count', 'instance']);
 /** JSON with every object's keys in order, so equal values give equal text. */
 export function canonical(value) {
     if (Array.isArray(value))
@@ -64,16 +52,44 @@ export function fingerprints(team) {
     for (const section of OWNER_SECTIONS)
         sections[section] = digest(sectionOf(team, section));
     const seats = {};
+    for (const seat of team.seats)
+        seats[seat.name] = seatDigest(seat, SEAT_FREE_FIELDS);
+    return { sections, seats };
+}
+/**
+ * Seat digests as a record written before `parked` and `stopped` were part of
+ * them. An approval from then still matches a file that has not changed.
+ */
+export function legacySeatDigests(team) {
+    const seats = {};
+    for (const seat of team.seats)
+        seats[seat.name] = seatDigest(seat, LEGACY_SEAT_FREE_FIELDS);
+    return seats;
+}
+/**
+ * Seat digests as a record written when an omitted label was the seat's name.
+ * `v0.1.2` hashed `parked` and `stopped`; `v0.1.1` left them out. A written
+ * label hashes the same title in every shape, so these equal a stored digest
+ * only where the title was the name.
+ */
+export function legacyLabelDigests(team) {
+    const named = {};
+    const namedWithoutFlags = {};
     for (const seat of team.seats) {
-        const fields = Object.fromEntries(Object.entries(seat).filter(([key]) => !SEAT_FREE_FIELDS.has(key)));
-        seats[seat.name] = digest(fields);
+        const titled = { ...seat, label: seat.name };
+        named[seat.name] = seatDigest(titled, SEAT_FREE_FIELDS);
+        namedWithoutFlags[seat.name] = seatDigest(titled, LEGACY_SEAT_FREE_FIELDS);
     }
-    return { sections, seats };
+    return { named, namedWithoutFlags };
+}
+function seatDigest(seat, free) {
+    const fields = Object.fromEntries(Object.entries(seat).filter(([key]) => !free.has(key)));
+    return digest(fields);
 }
 /**
  * What in the file the owner has not approved. The file passes when every
  * section matches and every seat in it matches an approved seat: a seat taken
- * out, parked or stopped needs no new approval.
+ * out needs no new approval. Parking or stopping one does.
  */
 export function compare(approved, current) {
     const differences = [];
@@ -94,9 +110,9 @@ export function compare(approved, current) {
     return differences;
 }
 /**
- * The line `describe` prints when `watch.checks` itself is the difference. `pass` reads it to
- * keep the checks running until the owner approves an edit that would turn one off: nothing is
- * turned off until the owner approves (RFC 0002 § 4.2).
+ * The line `describe` prints when `watch.checks` itself is the difference. `pass` does not read
+ * it. The list in force is what turns checks off: while the edit is unapproved, the approved
+ * list stays in force, so nothing new is turned off and an approved-off check stays off.
  */
 export const WATCH_CHECKS_CHANGED = '`watch.checks` changed';
 /** One line per difference, as `status`, `doctor` and the refusals print it. */
@@ -107,3 +123,12 @@ export function describe(difference) {
         return `seat ${difference.name} is not in the approved file`;
     return `seat ${difference.name} changed`;
 }
+/**
+ * The seat a difference line names, when it names one — the inverse of `describe`, kept beside it
+ * so the two can't drift. `pass` reads it to keep a seat the owner has not approved out of the
+ * readings fold; `null` for a section difference.
+ */
+export function seatNamed(line) {
+    const match = /^seat (.+) (?:changed|is not in the approved file)$/.exec(line);
+    return match?.[1] ?? null;
+}

package/dist/budgets/gate.d.ts

@@ -11,10 +11,11 @@ export type LaunchDecision = {
     why: string;
 };
 /**
- * The seat's account is its vendor. There is no separate account field on a seat. `budgets` is
- * the section in force: an unapproved edit to a reserve refuses no one until it is approved,
- * and an account only the unapproved edit names is not an account at all. `spend` holds the
- * stored spend check readings; a subscription account never looks at them.
+ * The seat's account is its own `account:` when the file names one — one vendor with two accounts
+ * is two buckets (§ 3b) — and its vendor otherwise. `budgets` is the section in force: an
+ * unapproved edit to a reserve refuses no one until it is approved, and an account only the
+ * unapproved edit names is not an account at all. `spend` holds the stored spend check readings;
+ * a subscription account never looks at them.
  */
 export declare function seatBudget(budgets: TeamFile['budgets'], readings: readonly Seen[], seat: Seat, now: number, spend?: readonly SpendReading[]): LaunchDecision;
 /**