team 0.1.2 → 0.2.0

package/README.md

@@ -18,7 +18,7 @@ Node 22 or later runs the built command.
 
 ```sh
 npm install -g team       # or run it without installing: npx team
-team --version            # 0.1.2
+team --version            # 0.2.0
 ```
 
 ## The file is private to each clone
@@ -34,13 +34,14 @@ yourself.
 A documented subset of YAML, read by the library's own parser: maps, lists, one-line `{ }` and
 `[ ]`, plain and quoted values, comments. Anchors, aliases, tags, block scalars, several documents
 in one file and duplicate keys are refused, with the line number. The file starts with `format: 1`.
+The package ships the JSON Schema at `schema/team.schema.json`, and `team init` writes a `# yaml-language-server: $schema=…` line at the top of the file so editors validate it.
 By example:
 
 ```yaml
 format: 1                     # the only format this version reads
 project: hello
-coordinator: claude-coord     # the seat that dispatches work
-operator: claude-coord        # the seat the watch reports to
+coordinator: coordinator      # the seat that dispatches work
+operator: coordinator         # the seat the watch reports to
 
 identity:
   signature:
@@ -59,7 +60,7 @@ workspace:
 
 seats:
   - role: coordinator
-    name: claude-coord
+    name: coordinator
     cli: claude-code          # the launch profile
     vendor: anthropic         # the model's maker
     model: Claude Opus        # the model's name, without its version
@@ -67,7 +68,7 @@ seats:
     launch: claude --model claude-opus-5-5   # no approval flags: the profile adds them
 
   - role: implementer
-    name: codex-hello
+    name: implementer
     cli: codex
     vendor: openai
     account: openai-hello     # the seat's account, when one vendor has two; absent, its vendor
@@ -78,17 +79,17 @@ seats:
     parked: true              # running, and not reported while idle
 
   - role: implementer
-    name: deepseek-hello
+    name: implementer-deepseek
     cli: claude-code          # DeepSeek's model, run by Claude Code
     vendor: deepseek
     model: DeepSeek Flash
     version: "V4.1"
     display: DeepSeek V4.1 Flash
     launch: team-deepseek     # a launcher on the PATH, holding the account's key and endpoint
-    count: 2                  # deepseek-hello and deepseek-hello-2
+    count: 2                  # implementer-deepseek and implementer-deepseek-2
 
   - role: reviewer
-    name: grok-hello
+    name: reviewer
     cli: grok
     vendor: xai
     model: Grok
@@ -98,7 +99,7 @@ seats:
 
 budgets:                      # the owner's: reserve or floor per account, marks, freshness
   accounts:
-    openai-hello:             # the account codex-hello spends
+    openai-hello:             # the account implementer spends
       kind: subscription
       reserve: 10%            # refuse a launch on a figure inside it
       sources: [status_line]  # the figure comes off Codex's status line
@@ -125,6 +126,15 @@ budgets:                      # the owner's: reserve or floor per account, marks
   `trust` and outside every protected checkout — never in the project root; `up` and `add` refuse a
   seat whose folder, lobby included, would be protected or untrusted.
 
+### Naming seats
+
+The herdr session carries the project, so a seat's name is its role: `coordinator`, `implementer`,
+`reviewer`. When a role is used twice, the model is added: `implementer-deepseek`. The label is the
+herdr workspace title. Left out of the file, it is the model and version in lowercase
+(`claude opus 5.5`), taken from that seat's own fields, so a model change retitles the pane. A
+label written in the file is kept. `team doctor` warns, and does not refuse the file, when a name
+or a label repeats the project or the session.
+
 The Codex profile is tested with CLI 0.157.0. Its status line is read for a weekly figure
 (`weekly N% left`) when the pane is wide enough to show the number; a cut line is not a figure.
 It adds `-a never -s danger-full-access`
@@ -147,7 +157,8 @@ under ~/.cursor/projects for that folder; team writes no trust (.workspace-trust
 config.
 
 `budgets` is the owner's: marks (percent used), how long a figure stays fresh, and each
-account's reserve or floor. A seat spends its own `account:` when the file names one, its `vendor`
+account's reserve or floor. An account's `shared` key is informational; `team` does not act
+on it. A seat spends its own `account:` when the file names one, its `vendor`
 when it doesn't, so one vendor's two accounts are two buckets; a pattern names the account it
 measures, not the seat's. A `check` command is resolved to a file and hashed when the
 owner approves. A change to that file leaves that account's check unapproved: it is
@@ -264,7 +275,7 @@ cd team
 bun install
 bun run build
 npm install -g .          # puts `team` on the PATH
-team --version            # 0.1.2
+team --version            # 0.2.0
 ```
 
 Bun builds and tests the sources:

package/dist/approve/approval.js

@@ -1,7 +1,7 @@
 import { homedir } from 'node:os';
 import { defaultBudgets, defaultWatch, validateTeamFile } from "../file/validate.js";
 import { readApproval, storePath, writeApproval } from "../store/store.js";
-import { compare, describe, fingerprints, legacySeatDigests, OWNER_SECTIONS } from "./fingerprint.js";
+import { compare, describe, fingerprints, legacyLabelDigests, legacySeatDigests, OWNER_SECTIONS } from "./fingerprint.js";
 /** The ceilings an approval fixes: `up` and `add` read them from the record, never from the file. */
 export function ceilingsOf(team) {
     return { seats: team.limits.seats, temporary: team.limits.temporary, vendors: { ...team.limits.vendors } };
@@ -31,25 +31,30 @@ export function approvedFingerprints(record) {
     if (!OWNER_SECTIONS.every((name) => stored.sections[name] !== undefined) && checked.ok) {
         sections = { ...fingerprints(checked.team).sections, ...stored.sections };
     }
-    const seats = checked.ok ? adoptFlagDigests(stored.seats, checked.team) : stored.seats;
+    const seats = checked.ok ? adoptLegacyDigests(stored.seats, checked.team) : stored.seats;
     if (sections === stored.sections && seats === stored.seats)
         return stored;
     return { sections, seats };
 }
 /**
- * A record from before `parked` and `stopped` were in the digest still names
- * the seat as it was approved, flags included, read from the stored copy. A
- * digest already in the new shape is left alone, so a later edit of the file
- * is not adopted from a stale copy. A copy that can't be read is left alone.
+ * A record from before `parked` and `stopped` were in the digest, or from when
+ * an omitted label was the seat's name, still names the seat as it was
+ * approved, read from the stored copy. A digest already in the new shape is
+ * left alone, so a later edit of the file is not adopted from a stale copy.
+ * A copy that can't be read is left alone.
  */
-function adoptFlagDigests(stored, team) {
+function adoptLegacyDigests(stored, team) {
     const current = fingerprints(team).seats;
-    const legacy = legacySeatDigests(team);
+    const legacyFlags = legacySeatDigests(team);
+    const legacyLabels = legacyLabelDigests(team);
     let changed = false;
     const next = { ...stored };
     for (const [name, previous] of Object.entries(stored)) {
         const adopted = current[name];
-        if (adopted !== undefined && previous === legacy[name] && previous !== adopted) {
+        const old = previous === legacyFlags[name] ||
+            previous === legacyLabels.named[name] ||
+            previous === legacyLabels.namedWithoutFlags[name];
+        if (adopted !== undefined && old && previous !== adopted) {
             next[name] = adopted;
             changed = true;
         }

package/dist/approve/fingerprint.d.ts

@@ -1,8 +1,10 @@
 /**
  * The sections only the owner changes. An edit to any of them needs a new
- * approval before the file runs.
+ * approval before the file runs. Generated from the section modules, in their
+ * list's order — the order feeds the approval digest, so the list keeps it:
+ * `watch` last with `watch.checks`, the line inside it, after it.
  */
-export declare const OWNER_SECTIONS: readonly ["trust", "limits", "machine", "rules", "identity", "workspace", "coordinator", "operator", "session", "visibility", "tools", "budgets", "watch", "watch.checks"];
+export declare const OWNER_SECTIONS: readonly string[];
 /** A validated team file, as far as an approval reads it. */
 export type Approvable = Record<string, unknown> & {
     seats: readonly (Record<string, unknown> & {
@@ -23,6 +25,16 @@ export declare function fingerprints(team: Approvable): Fingerprints;
  * them. An approval from then still matches a file that has not changed.
  */
 export declare function legacySeatDigests(team: Approvable): Record<string, string>;
+/**
+ * Seat digests as a record written when an omitted label was the seat's name.
+ * `v0.1.2` hashed `parked` and `stopped`; `v0.1.1` left them out. A written
+ * label hashes the same title in every shape, so these equal a stored digest
+ * only where the title was the name.
+ */
+export declare function legacyLabelDigests(team: Approvable): {
+    named: Record<string, string>;
+    namedWithoutFlags: Record<string, string>;
+};
 export type Difference = {
     kind: 'section';
     name: string;

package/dist/approve/fingerprint.js

@@ -1,28 +1,12 @@
 import { createHash } from 'node:crypto';
+import { SECTIONS } from "../file/sections/index.js";
 /**
  * The sections only the owner changes. An edit to any of them needs a new
- * approval before the file runs.
+ * approval before the file runs. Generated from the section modules, in their
+ * list's order — the order feeds the approval digest, so the list keeps it:
+ * `watch` last with `watch.checks`, the line inside it, after it.
  */
-export const OWNER_SECTIONS = [
-    'trust',
-    'limits',
-    'machine',
-    'rules',
-    'identity',
-    'workspace',
-    'coordinator',
-    'operator',
-    'session',
-    'visibility',
-    'tools',
-    'budgets',
-    // The watch's own timings, thresholds included: a seat allowed to stretch `unsent_after` or
-    // `idle_first` could silence the watch itself, so the section is the owner's like the rest.
-    'watch',
-    // And turning a check off is the finer line inside it: the digest above leaves the checks out,
-    // so turning one off reads as `watch.checks` alone, never as a threshold change too.
-    'watch.checks',
-];
+export const OWNER_SECTIONS = SECTIONS.filter((section) => section.owner).map((section) => section.name);
 /** One owner section, read from the file; the two watch sections sit inside `watch`, not at the top. */
 function sectionOf(team, name) {
     if (name === 'watch.checks')
@@ -82,6 +66,22 @@ export function legacySeatDigests(team) {
         seats[seat.name] = seatDigest(seat, LEGACY_SEAT_FREE_FIELDS);
     return seats;
 }
+/**
+ * Seat digests as a record written when an omitted label was the seat's name.
+ * `v0.1.2` hashed `parked` and `stopped`; `v0.1.1` left them out. A written
+ * label hashes the same title in every shape, so these equal a stored digest
+ * only where the title was the name.
+ */
+export function legacyLabelDigests(team) {
+    const named = {};
+    const namedWithoutFlags = {};
+    for (const seat of team.seats) {
+        const titled = { ...seat, label: seat.name };
+        named[seat.name] = seatDigest(titled, SEAT_FREE_FIELDS);
+        namedWithoutFlags[seat.name] = seatDigest(titled, LEGACY_SEAT_FREE_FIELDS);
+    }
+    return { named, namedWithoutFlags };
+}
 function seatDigest(seat, free) {
     const fields = Object.fromEntries(Object.entries(seat).filter(([key]) => !free.has(key)));
     return digest(fields);

package/dist/budgets/gate.js

@@ -125,7 +125,12 @@ function age(ms) {
         return `${hours}h`;
     return `${minutes}m`;
 }
-/** A money figure in a refusal: the cents are shown even when the file wrote none. */
+/**
+ * A money figure in a refusal, as read: up to four decimals — the most a check or a floor may
+ * carry — with the trailing zeros beyond the cents dropped, and never fewer than two decimals.
+ * The figure the words judge is the figure the eyes see.
+ */
 function money(amount) {
-    return amount.toFixed(2);
+    const written = amount.toFixed(4).replace(/0+$/, '');
+    return written.padEnd(written.indexOf('.') + 3, '0');
 }

package/dist/budgets/readings.d.ts

@@ -27,7 +27,7 @@ export type StoredReading = {
     confirmed: boolean;
 };
 export type Verdict = {
-    kind: 'fresh' | 'unconfirmed' | 'stale' | 'refusing';
+    kind: 'fresh' | 'unconfirmed' | 'stale' | 'refusing' | 'last-seen';
     reading: Seen;
 } | {
     kind: 'unknown';
@@ -62,7 +62,9 @@ export declare function checkOf(list: readonly Seen[]): Seen[];
  * Among confirmed live readings, the newest change wins. A first sight counts
  * only when no confirmed reading is still live. Staleness is measured from
  * `changedAt`. A stale reading inside the reserve refuses until its reset;
- * with no reset time it is unknown.
+ * with no reset time it is unknown when it could still matter — inside the
+ * reserve or within the reserve again outside it — and last seen when it sits
+ * further out, room the account may still hold. It never refuses.
  */
 export declare function verdict(list: readonly Seen[], now: number, staleAfterMs: number, reserve: number | null): Verdict;
 export type CountedReading = {
@@ -81,6 +83,8 @@ export type CountedReading = {
  * through when it is unknown, and a bare first sight falls through too, so a fresh check below it
  * still counts (§ 4.3 rule 5). A stale reading inside its reserve with its reset ahead is kept as
  * the fallback, whichever source it came from, so rule 4 still refuses when nothing below counts.
+ * A stale figure with no known reset counts as the room last seen only when it is well outside
+ * the reserve, and it sits below any inside-reserve figure: a last sight never clears a refusal.
  */
 export declare function countedFor(sources: readonly ReadingSource[], screen: readonly Seen[], checks: readonly Seen[], now: number, staleAfterMs: number, reserve: number | null): CountedReading;
 /** Readings whose reset has passed are left out. One with no reset time is kept. */

package/dist/budgets/readings.js

@@ -62,12 +62,22 @@ export function screenOf(list) {
 export function checkOf(list) {
     return list.filter((item) => item.source === 'check');
 }
+/**
+ * The distance rule for a stale figure with no known reset (§ 5), in one place: more than the
+ * reserve again outside it, the figure is the room last seen rather than unknown. `verdict` and
+ * the check branch of `countedFor` both ask this, so the two cannot be edited apart.
+ */
+function pastTheReserveAgain(left, reserve) {
+    return left > reserve * 2;
+}
 /**
  * The reading that counts. A figure from before a known reset is dropped.
  * Among confirmed live readings, the newest change wins. A first sight counts
  * only when no confirmed reading is still live. Staleness is measured from
  * `changedAt`. A stale reading inside the reserve refuses until its reset;
- * with no reset time it is unknown.
+ * with no reset time it is unknown when it could still matter — inside the
+ * reserve or within the reserve again outside it — and last seen when it sits
+ * further out, room the account may still hold. It never refuses.
  */
 export function verdict(list, now, staleAfterMs, reserve) {
     const live = list.filter((item) => item.resetsAt === null || item.resetsAt > now);
@@ -87,8 +97,11 @@ export function verdict(list, now, staleAfterMs, reserve) {
     const inside = reserve !== null && reading.left <= reserve;
     if (inside && reading.resetsAt !== null)
         return { kind: 'refusing', reading };
-    if (reading.resetsAt === null)
+    if (reading.resetsAt === null) {
+        if (reserve !== null && pastTheReserveAgain(reading.left, reserve))
+            return { kind: 'last-seen', reading };
         return { kind: 'unknown' };
+    }
     return { kind: 'stale', reading };
 }
 /**
@@ -98,9 +111,12 @@ export function verdict(list, now, staleAfterMs, reserve) {
  * through when it is unknown, and a bare first sight falls through too, so a fresh check below it
  * still counts (§ 4.3 rule 5). A stale reading inside its reserve with its reset ahead is kept as
  * the fallback, whichever source it came from, so rule 4 still refuses when nothing below counts.
+ * A stale figure with no known reset counts as the room last seen only when it is well outside
+ * the reserve, and it sits below any inside-reserve figure: a last sight never clears a refusal.
  */
 export function countedFor(sources, screen, checks, now, staleAfterMs, reserve) {
     let fallback = null;
+    let lastSeen = null;
     let unconfirmed = null;
     for (const source of sources) {
         if (source === 'check') {
@@ -112,6 +128,10 @@ export function countedFor(sources, screen, checks, now, staleAfterMs, reserve)
             const inside = checks.find((item) => item.resetsAt !== null && item.resetsAt > now && reserve !== null && item.left <= reserve);
             if (inside)
                 fallback ??= inside;
+            // A stale check figure with no reset, past the reserve again, is the room last seen.
+            const sight = checks.find((item) => item.resetsAt === null && reserve !== null && pastTheReserveAgain(item.left, reserve));
+            if (sight)
+                lastSeen ??= sight;
             continue;
         }
         const result = verdict(screen, now, staleAfterMs, reserve);
@@ -123,10 +143,16 @@ export function countedFor(sources, screen, checks, now, staleAfterMs, reserve)
         }
         if (result.kind === 'fresh')
             return { kind: 'counted', reading: result.reading };
+        if (result.kind === 'last-seen') {
+            lastSeen ??= result.reading;
+            continue;
+        }
         fallback ??= result.reading;
     }
     if (fallback)
         return { kind: 'counted', reading: fallback };
+    if (lastSeen)
+        return { kind: 'counted', reading: lastSeen };
     if (unconfirmed)
         return { kind: 'unconfirmed', reading: unconfirmed };
     return { kind: 'unknown' };

package/dist/budgets/run.js

@@ -12,10 +12,16 @@ const SPEND = /^([0-9]+(?:\.[0-9]{1,4})?) ([A-Z]{3})$/;
 // § 5: one to three lines, each a window, each figure whole and at most 100. The
 // printed reset is a duration; the printed measurement time is unix seconds.
 const LINE = /^(session|daily|weekly) (100|[0-9]{1,2})% (used|left)(?: resets ([0-9]+h(?:[0-9]+m)?|[0-9]+m))?(?: at ([0-9]{10}))?$/;
-/** An output's lines: one trailing newline allowed, and nothing else. */
+/**
+ * An output's lines: one trailing newline allowed, and nothing else. A "\r\n" ending reads
+ * as its line — the CR goes with the newline — and a CR anywhere else stays a character of
+ * the line, off the contract.
+ */
 function linesOf(text) {
     const body = text.endsWith('\n') ? text.slice(0, -1) : text;
-    return body === '' ? null : body.split('\n');
+    if (body === '')
+        return null;
+    return body.split('\n').map((line) => (line.endsWith('\r') ? line.slice(0, -1) : line));
 }
 /**
  * A subscription output against § 5. Any line off the contract, a figure over

package/dist/budgets/table.d.ts

@@ -11,6 +11,8 @@ export type BudgetRow = {
     seat: string | null;
     age: string | null;
     source: ReadingSource | null;
+    /** True when the counted figure did not come from the first source the account names (§ 3). */
+    fallback: boolean;
     state: BudgetState;
     /** True when a subscription's left figure is at or inside its reserve. */
     inside: boolean;

package/dist/budgets/table.js

@@ -18,10 +18,11 @@ export function budgetTable(budgets, list, now) {
         named.add(account);
         const reserve = reserveOf(budgets, account);
         // The window's reading from the sources the account names, in order (§ 3, § 5).
-        const result = countedFor(sourcesOf(budgets, account), screenOf(group), checkOf(group), now, staleAfterMs, reserve);
+        const sources = sourcesOf(budgets, account);
+        const result = countedFor(sources, screenOf(group), checkOf(group), now, staleAfterMs, reserve);
         rows.push(result.kind === 'unknown'
             ? { ...blank(account, reserve), window }
-            : rowOf(result, now, staleAfterMs, reserve));
+            : rowOf(result, now, staleAfterMs, reserve, result.reading.source !== sources[0]));
     }
     for (const account of Object.keys(budgets.accounts)) {
         if (!named.has(account))
@@ -40,15 +41,17 @@ export function budgetLine(row) {
     }
     const reset = row.resetsIn === null ? 'resets unknown' : `resets in ${row.resetsIn}`;
     const from = row.source === 'status_line' ? 'status line' : row.source === 'check' ? 'check' : 'unknown source';
-    const when = row.source === 'check' ? 'read' : 'changed';
+    const source = row.fallback ? `${from} (fallback)` : from;
+    // A stale row with no known reset is the room last seen, not a reading aged out.
+    const when = row.state === 'stale' && row.resetsIn === null ? 'last seen' : row.source === 'check' ? 'read' : 'changed';
     const state = row.inside && row.reserve !== null ? `${row.state}, inside reserve ${row.reserve}%` : row.state;
-    return `${row.account}  ${row.window}  left ${row.left}%  used ${row.used}%  ${reset}  ${row.seat ?? '-'}  ${when} ${row.age} ago  ${from}  ${state}`;
+    return `${row.account}  ${row.window}  left ${row.left}%  used ${row.used}%  ${reset}  ${row.seat ?? '-'}  ${when} ${row.age} ago  ${source}  ${state}`;
 }
 /** The sources the account's figures are read from, in order: a status line when the file is silent. */
 function sourcesOf(budgets, account) {
     return budgets.accounts[account]?.sources ?? ['status_line'];
 }
-function rowOf(result, now, staleAfterMs, reserve) {
+function rowOf(result, now, staleAfterMs, reserve, fallback) {
     const reading = result.reading;
     const inside = reserve !== null && reading.left <= reserve;
     const state = result.kind === 'unconfirmed'
@@ -65,6 +68,7 @@ function rowOf(result, now, staleAfterMs, reserve) {
         seat: reading.seat,
         age: span(now - reading.changedAt),
         source: reading.source,
+        fallback,
         state,
         inside,
         reserve,
@@ -80,6 +84,7 @@ function blank(account, reserve) {
         seat: null,
         age: null,
         source: null,
+        fallback: false,
         state: 'unknown',
         inside: false,
         reserve,

package/dist/cli.d.ts

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
 import type { Command, Io } from './io.ts';
+import { version } from './version.ts';
 export declare const commands: Record<string, () => Promise<{
     default: Command;
     USAGE: string;
 }>>;
-export declare function version(): string;
+export { version };
 export declare function main(argv: string[], io: Io): Promise<number>;
 export declare function processIo(): Io;

package/dist/cli.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
-import { readFileSync, realpathSync } from 'node:fs';
+import { realpathSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
+import { version } from "./version.js";
 // Each command is loaded only when it is called. A slice adds its line here. The table is exported
 // so a test can walk it: every command, `--help`, `-h` and a usage line.
 export const commands = {
@@ -29,10 +30,7 @@ Options:
 
 The team is declared in <project>/.agents/team.yaml.
 `;
-export function version() {
-    const text = readFileSync(new URL('../package.json', import.meta.url), 'utf8');
-    return JSON.parse(text).version;
-}
+export { version };
 export async function main(argv, io) {
     const [name, ...rest] = argv;
     const names = Object.keys(commands);
@@ -45,6 +43,11 @@ export async function main(argv, io) {
         io.stdout(`${version()}\n`);
         return 0;
     }
+    // Hidden: a port speaks this protocol. It is not a command in the help text.
+    if (name === 'conformance-adapter') {
+        const { default: run } = await import("./conformance/adapter.js");
+        return run(rest, io);
+    }
     const load = commands[name];
     if (!load) {
         io.stderr(`team: unknown command "${name}"\n\n${usage}`);

package/dist/commands/add.d.ts

@@ -9,7 +9,6 @@ export type AddSources = {
     agents(session: string): HerdrAgent[] | null;
     workspaces(session: string): {
         id: string;
-        label: string;
     }[] | null;
     doctor: DoctorSources;
     machine?: (root: string) => Machine;

package/dist/commands/add.js

@@ -49,7 +49,7 @@ export const realSources = {
     agents: (session) => agentList(aim(session)),
     workspaces(session) {
         const listed = workspaceList(aim(session));
-        return listed === null ? null : listed.map((workspace) => ({ id: workspace.id, label: workspace.label }));
+        return listed === null ? null : listed.map((workspace) => ({ id: workspace.id }));
     },
     doctor: doctorSources,
     machine: readMachine,
@@ -123,6 +123,7 @@ export async function runAdd(argv, io, sources = realSources) {
         return 1;
     }
     const agents = live === 'running' ? sources.agents(session) : [];
+    // Read so a session whose workspace list can't be read is refused. The title is not a key.
     const workspaces = live === 'running' ? sources.workspaces(session) : [];
     if (agents === null || workspaces === null) {
         io.stderr(`team add: session ${session} runs, and its agents can't be read\n`);
@@ -203,7 +204,7 @@ export async function runAdd(argv, io, sources = realSources) {
     // changes no section of its own, and no unapproved reserve may unblock a launch (#50).
     const budgets = budgetsInForce(prepared.team, root, sources.home);
     const decision = seatBudget(budgets, loadReadings(dir), built.seat, sources.now().getTime(), loadSpendReadings(dir));
-    const stray = unnamedIn(built.seat.label, agents, workspaces);
+    const stray = unnamedIn(recorded.seats[built.name]?.workspace, agents);
     const starting = seatPlan(prepared.team, built.seat, start);
     const planned = stray
         ? { ...starting, stage: 'launched', pane: stray.pane, workspace: stray.workspace, agentLive: true }
@@ -354,9 +355,10 @@ function seatPlan(team, seat, start) {
         ...(start.lobby ? { lobby: true } : {}),
     };
 }
-function unnamedIn(label, agents, workspaces) {
-    const ids = new Set(workspaces.filter((workspace) => workspace.label === label).map((workspace) => workspace.id));
-    return agents.find((agent) => !agent.name && ids.has(agent.workspace));
+function unnamedIn(workspace, agents) {
+    if (!workspace)
+        return undefined;
+    return agents.find((agent) => !agent.name && agent.workspace === workspace);
 }
 function runningOf(agents, team, state) {
     const seats = new Map(team.seats.map((seat) => [seat.name, seat]));

package/dist/commands/approve.js

@@ -11,6 +11,7 @@ import { callerOf, describeCaller, isOwner } from "../caller.js";
 import { loadTeamFile, placedProblems } from "../file/load.js";
 import { validateTeamFile } from "../file/validate.js";
 import { logLine } from "../log.js";
+import { OVERRIDE_CHANGED, overrideFile } from "../profiles/overrides.js";
 import { readApproval, storePath, writeApproval } from "../store/store.js";
 export const realSources = {
     async ask(question) {
@@ -86,6 +87,12 @@ export async function runApprove(argv, io, sources) {
     for (const warning of checked.warnings)
         io.stderr(`team approve: warning, line ${warning.line}: ${warning.message}\n`);
     const store = storePath(team.project, root, sources.home);
+    const live = overrideFile(team.project, root, sources.home);
+    if (live.problems.length) {
+        for (const problem of live.problems)
+            io.stderr(`team approve: ${problem}\n`);
+        return 2;
+    }
     const problem = storeProblem(store, root, team);
     if (problem) {
         io.stderr(`team approve: ${problem}\n`);
@@ -119,6 +126,15 @@ export async function runApprove(argv, io, sources) {
             io.stdout(`${path}: against the copy approved on ${previous.approval.approvedAt}:\n\n`);
             io.stdout(`${lines.map((line) => `  ${line}`).join('\n')}\n\n`);
         }
+        const recorded = Object.hasOwn(previous.approval, 'overrides') ? previous.approval.overrides ?? null : null;
+        if (recorded !== live.text) {
+            changes.push(OVERRIDE_CHANGED);
+            const overrideLines = formatDiff(recorded ?? '', live.text ?? '');
+            if (overrideLines.length) {
+                io.stdout(`overrides.yaml: against the copy approved on ${previous.approval.approvedAt}:\n\n`);
+                io.stdout(`${overrideLines.map((line) => `  ${line}`).join('\n')}\n\n`);
+            }
+        }
         io.stdout(changes.length ? `Needs a new approval: ${changes.join('; ')}.\n` : 'Nothing in it needs a new approval.\n');
         if (ceilingsLine(previous.approval.ceilings) !== ceilingsLine(ceilings)) {
             io.stdout(`Ceilings approved: ${ceilingsLine(previous.approval.ceilings)}.\n`);
@@ -139,7 +155,7 @@ export async function runApprove(argv, io, sources) {
         return 1;
     }
     const now = sources.now();
-    writeApproval(store, { approval: approvalOf(team, root, now, resolved.checks), file: text }, team.seats);
+    writeApproval(store, { approval: { ...approvalOf(team, root, now, resolved.checks), overrides: live.text }, file: text }, team.seats);
     logLine(dirname(path), 'approve', describeCaller(caller), `approved ${seats} seats; ceilings: ${ceilingsLine(ceilings)}`, now);
     io.stdout(`Approved. The record is in ${store}; check the rest with \`team doctor\`.\n`);
     return 0;

package/dist/commands/doctor.d.ts

@@ -1,3 +1,4 @@
+import { type Caller } from '../caller.ts';
 import type { TeamFile } from '../file/types.ts';
 import type { Command, Io } from '../io.ts';
 import { type Profile } from '../profiles/profile.ts';
@@ -9,6 +10,7 @@ export type DoctorSources = {
     sessionRunning(session: string): boolean | null;
     now(): Date;
     home: string;
+    runCheck?(path: string): string | null;
 };
 export type CommandRunner = (binary: string, args: string[]) => {
     status: number | null;
@@ -30,11 +32,23 @@ export type Finding = {
 export declare function blocksLaunch(finding: Finding): boolean;
 export declare const doctor: Command;
 export default doctor;
+/**
+ * The budget checks, one line per account, plus the accounts nothing can read. The checks run
+ * the way the watch runs them (RFC 0003 § 5): the approved command's file, hashed again before
+ * it runs, in a clean environment with the watch's timeout. The raw output is parsed and
+ * dropped — never printed, never logged, never written anywhere. Only the owner's `doctor` runs
+ * a check, for the same reason the watch is the owner's: a check reads a vendor home. Any other
+ * caller gets the same report without the readings, and the one line that says so.
+ */
+export declare function budgetCheckFindings(team: TeamFile, root: string, sources: DoctorSources, caller: Caller): Finding[];
+export declare function seatNameFindings(team: TeamFile, session: string): Finding[];
 export declare function doctorFindings(team: TeamFile, root: string, dir: string, session: string, sources: DoctorSources, warnings: {
     line: number;
     message: string;
 }[], 
 /** The file as approved. `add` hands the team about to run, whose `stopped` mark is already cleared. */
-approved?: TeamFile): Finding[];
+approved?: TeamFile, 
+/** The budget-check lines, which only the report runs: `up` and `add` scan, they never run a check. */
+budgetChecks?: Finding[]): Finding[];
 export declare function doctorLoginFindings(team: TeamFile, sources: DoctorSources): Finding[];
 export declare function runDoctor(argv: string[], io: Io, sources: DoctorSources): Promise<number>;