The launch

Part of team up — what a run does before it creates anything, and where each seat starts.

A stopped session

A session stopped in herdr that this team's state records is cleared under the run lock, then started from the beginning. A stopped session the state does not record is refused (session <name> is stopped); that line names no herdr command. A recorded session that does not clear is refused too (session <name> is stopped and did not clear).

The lobby gate

Every seat, shared and worktree-mode alike, starts in ~/.config/team/lobby. It is shared by all projects on the machine. Before creating anything, team verifies the lobby gate: ownership by the invoking user, no symbolic links anywhere in the chain, directory mode exactly 0700, nothing but the files the profiles the tool ships declare (claude-code declares .claude/scheduled_tasks.lock), and not inside a git repository or worktree. The set is the same for every team on the machine: the lobby is one folder shared by all of them, so what it may hold cannot depend on this team's seats — a lock another team's claude-code seat wrote must not block a team with no claude-code seat. The launch uses that verified path. The lobby is checked again — the gate's checks, plus that it is still the folder the gate read: the same canonical path, device and inode — directly before every workspace this run creates in it, with nothing between that confirmation and herdr's create call. Every declared file is confirmed with it, by lstat alone — team never opens one — against everything a file created again under the same name cannot keep: the same device and inode, size, inode change time and birth time, at nanosecond resolution, so a replaced file is refused even where the filesystem hands the new file the old inode number. What can still slip through a file's check: a rewrite in place inside one filesystem timestamp tick that changes no size — every number the gate reads would be the same. A failed confirmation creates nothing: the seat is left out with the gate's cause in words — the gate's own line, the folders it resolved, is written under the record on stderr — and the rest of the launch stops, so no further workspace is made, not even the watchdog's. A seat created earlier in the same run is left running: its workspace was created while the path was the verified lobby, and up never closes a workspace it may already have started a CLI in. Another window remains, inside herdr itself: the create call takes a path, not an open folder handle, so herdr resolves that path in its own process after the confirmation.

Where a seat starts

A seat goes to its real folder itself: a worktree seat to the worktree its brief names; a shared seat to its configured cwd before any project work.

The stopped session, started

A session stopped in herdr that this team's state records is cleared under the run lock, then started. This page's earlier examples have already recorded the session, so a stopped herdr session is cleared and the seats come up. A stopped session the state does not record is refused, and that line names no herdr command (session beacon is stopped).

$ team up ; echo "exit $?"
claude-keeper: ready
claude-beacon: ready
  skip gemini-qa: stopped in the file; start it with `team add gemini-qa`
exit 0

The earlier examples that paragraph names are on the team up page.