The report

Part of team doctor — every finding a run prints, in the order they come.

The order of findings

The findings come in order: the file's own warnings, one warning per seat whose name or label repeats the project or the session (the session already carries it; the warning never refuses the file), the approval — ok with the signing's number, its date and the signing key's fingerprint (ok the file is the one the owner approved (approval #1, 2026-10-04, key fe21ef6293de)) when the record verifies, MISS with the one-line repair when it does not: never approved on this machine, written before records were signed, or refused with the case — the override file when it is not the approved copy or cannot be parsed (a missing line either way: up and add refuse, and the approved copy stays in force — or the shipped profiles, when nothing was approved), each account whose check command is unapproved, or no longer matches the file hashed at approval (a warning either way: that account reads unknown, and up and add still run), the budget checks, then each seat of the approved file whose rules travel as a first message: its file in the project state folder — missing, a symbolic link, not a regular file, wider than 0600, not the owner's, unreadable, or holding something other than the approved rules text — is one warn (codex-scribe: its rules file differs from the approved rules; run \team remove codex-scribe --keep` then `team add codex-scribe` (or `team down` then `team up` for the whole team)— for an orchestrator or operator,team downthenteam up(to restart the whole team) —upskips a ready seat, so only the relaunch writes the file), never a rewrite. herdr, one CLI at a time (its version, its login, then each of its seats' launchers and models), one line per seat whose launch line can't run where the seat starts (theMISSnames the start folder, the program that is missing or not executable, and when the same file resolves from the project root, its path to write instead; a line only said to be unchecked, or a relative path that exists nowhere yet, is a-- note —not checked: the command may create it), one note per seat the state records from a launch that predates the process identity — -- : launched before team recorded its process; run `team remove --keep` then `team add ` (or `team down` then `team up` for the whole team) to launch it again(for an orchestrator or operator,team downthenteam up(to restart the whole team)), the relaunch being what records the identity — one note per live seat whose file still carries the placeholderversion: "0" initwrites, saying what it runs and the one edit that pins it (or a warning when the model family differs, so the one edit covers both) — the watch, and thetrustnote. A seat the file stops is left out of the CLI findings and the launch lines. A CLI outside its tested range keeps itswarnand says what that means: its screens are untested with this version, and a seat that isn't read at launch is left out, never typed into (herdr's version line says just where it sits — herdr has no screens). The last line counts them, and — the same ruleupandadd` refuse on — says how many of the missing ones block those commands, when any do:

team doctor: nothing missing, 1 warning
team doctor: 2 missing, 0 warnings: 2 of them block `up` and `add`

The trust block

The trust note is the one finding that carries a whole block. A file whose trust still holds the relative entries an earlier release wrote — or none at all — is told every absolute entry the next up will require, as a block to paste under trust:: the lobby, the project root, the folder workspace.path places worktrees in, each seat's start folder when it sits outside the project, and every entry the owner added by hand, kept in absolute form. One line after the entries says which key of the file each one comes from and which old entry it replaces, and nothing the block lists widens what the old file trusted. An entry a rule of trust refuses — a folder that would cover the home, or the lobby and the approval store — is never suggested: one line names the key that forces it and leaves the choice of folder to the owner. The note is told only while the file really is legacy; once the absolute entries are written, the approval finding carries the next step.

Waiting at trust

A seat the state records waiting at trust gets one line of its own. A fresh read of its pane must show the recorded trust dialog — the same reading team answer checks, and the reason the line moves to warn when it does not:

--    claude-beacon: waiting for owner at trust
warn  claude-beacon: waiting at trust; its pane can't be read
warn  claude-beacon: waiting at trust; the pane is not the trust dialog
warn  claude-beacon: waiting at trust; this version has no trust answer
warn  claude-beacon: waiting at trust; the folder is not the lobby

Every warn is a warn and never a MISS: it blocks team answer and every key team could send, and leaves the owner's own path through team up open. A seat in trust-sent-recovery is a warn with its repair — warn <seat>: trust sent; recovery required; the owner runs team up — and the line never claims a trust dialog is still on screen. A seat waiting at any other classification prints nothing new here: team status carries it.

The key fingerprint

The key's fingerprint is the first twelve hex digits of the signing key's public half. What it proves is narrow: an owner who noted it sees a replaced key — a process that only reads the key changes nothing team shows. team computes it, and a seat could also replace team.

The watch

A watch that has not run, or whose heartbeat is old, is MISS here but not a reason for up to refuse: up starts the watch itself.

The machine check

The machine's own swap is read for one case only: the check in force — the 2GB default, or the file's own swap_free_min — asks for more free swap than this reading says the machine has in total. One warning names both figures and the repair, the key to write and the approval a change needs, and it speaks of the reading it was made from: on macOS the total moves with pressure, so a later up can meet a different one:

$ team doctor ; echo "exit $?"
warn  the file, line 3: `coordinator:` is now `leads: true` on the lead's seat, and is still read
warn  claude-beacon: its name repeats "beacon"; the session already carries it
ok    the file is the one the owner approved (approval #1, 2026-10-04, key fe21ef6293de)
ok    the check for openai reads weekly 40% used
ok    herdr 0.7.1
--    session beacon is running
ok    claude 2.1.288
ok    claude-code: logged in
ok    the watch is running
ok    the lobby ~/.config/team/lobby: will be created at the first launch
warn  the machine check asks for 2.0 GB free swap; at this reading the machine has 1.0 GB in total, so `team up` would refuse now; set `machine.swap_free_min` to a figure this machine can keep, then run `team approve`
team doctor: nothing missing, 3 warnings
exit 0

A check that merely fails right now — the machine has the swap in total, and not enough of it free at this moment — prints nothing of this: up's refusal names it when the owner runs it, and the watch's swap-free check reports it as its own finding. The line above is only for the case the file can fix, and it describes the reading it came from: on macOS the total moves with pressure, so it promises nothing about a later up. The total is read on macOS from sysctl -n vm.swapusage, and on Linux from /proc/meminfo's SwapTotal; a machine with no swap at all is not this case — up does not refuse a swap check it cannot read, and nothing here guesses one.

The model warnings the order above names are on the models page; the budget checks, on the budget-checks page; the logins, on the sign-in page.