The records

Part of team up — every line a run prints, and what each line means.

A seat already ready

A seat already ready is left as it is, and the words it was left with are the detail under its record. A ready seat the state records without its process identity, or with a start outside the machine lobby, is left as it is too — only a relaunch repairs either — and its detail says so: already ready; left as it is; a relaunch records its process: team remove <seat> --keep, then team add <seat> (or team down, then team up, for the whole team), or the same words saying a relaunch moves it into the lobby. For a seat the file names as orchestrator or operator, the detail offers only team down, then team up (to restart the whole team).

The file it reads, and the watch

A command run in a folder that is not a git repository reads .agents/team.yaml in that folder, and nowhere above it. A link at .agents or at team.yaml is not followed. When --file names a file a watch started in the project folder would not read, up starts no watch and prints this instead of watch: started, and exits 1 even when every seat is ready:

watch: not started: a watch started there could not read this file, or would read another one under this session's name. Move the file to .agents/team.yaml in the folder the watch starts in. A fuller repair is planned.

A stale pane

A seat is its pane only while the process team launched is still in it. A seat the state records whose pane no longer holds that process is not "already ready": its workspace is closed without a key and without input — its pane runs no CLI, or one team did not launch, and nothing in it is the seat — and the seat is launched fresh with its rules. Its record is <seat>: ready, and the detail under it says both: its pane held no CLI; closed without input and launched again when the pane was back at its shell, its pane held a process team did not launch; closed without input and launched again when another process held it.

The close, and its proof

The reading that decides the repair is taken while the plan is built, and the close can be minutes later, after every seat before this one was created, waited for and delivered to. up reads herdr again immediately before it, with nothing between those reads and the close, and closes only a pane that is provably still the seat's stale one: the agent list must name this seat on the recorded pane, that pane's workspace as herdr reports it now must be the recorded workspace, that workspace must hold no other panes (named or not), the process reading must still say the pane runs no CLI or another process, and a pane held by another process must not read working or unsent — a process that is working or holds unsent text is never closed by up, whoever started it. When any of that does not hold, nothing is closed, nothing is launched for that seat, its state is left as it is, the seat is out of the run, and up exits 1 with one record:

Wrong in the safe direction

This comparison is wrong in the safe direction, but it is wrong: a CLI that replaces its own process — an updater that re-executes, a wrapper that hands over — changes the foreground pids, and the seat then reads restored, not launched by team although nothing was restored. up closes that pane without input and launches the seat fresh, and the conversation in it is lost. The record holds every pid the launch left in front, and accepts the seat while any recorded pid is still there; no reading of a CLI after its first message was taken when this record was made, though a review's runs of a CLI with a helper beside it and of one behind a pipeline kept every pid. Before running up, the owner looks: team status names such a seat, and the pane itself says whether the CLI there is the one team launched.

A workspace that does not close

When the workspace does not close, nothing is launched in its place and the seat is left as it is: <seat>: left out: its workspace did not close; left as it is, with up exiting 1. A seat with no launched record in state (one launched before this version recorded process identity, or one whose process herdr could not read when it stopped: the reading is taken once, after the idle prompt and after the launch model check) keeps today's behaviour: nothing checks its pane.

A screen that names no model

When the idle screen names no model this version can read, up writes <seat>: its screen doesn't show a model this version knows; not checked to stderr, after the seat's record, and continues. It is detail, not a record: the log keeps the seat's one line, the record ready. Nothing is assumed about which model is running.

Rules as a first message

A seat whose rules travel as a first message (codex, cursor, antigravity) gets them from a file: up writes the approved rules text to <project state folder>/rules/<seat>.md — owner-only, mode 0600, beside the approval store, never inside a worktree, the lobby or the project — and types one line into the pane at an empty idle prompt:

Read /home/owner/.config/team/demo-3f9c2a8e1d7b/rules/implementer.md (sha256 5e1d0a9c4b2f): your standing rules for this session; reply ready and wait for your brief.

The state folder is resolved from the approved copy's project name, through the one resolver the writer, the line, the hash check before Enter, status, doctor and remove all use: a project rename is not approval drift, and the line a seat is told to obey must name the file the checks look at, not one resolved from the live file's new name.

The line carries the file's absolute path and the first 12 hex digits of its SHA-256, so the seat — and the read-back — can tell exactly which text is meant. A path that holds whitespace or a character outside letters, digits and . _ / @ + - is never typed: nothing is quoted or escaped, and the report says the path can't be typed safely. The line is read back row by row — every visible character in order, a row break allowed to stand for at most one space or nothing — and only then is Enter pressed, once. A box that already holds exactly today's line (a run that stopped after typing it) is verified and sent, never typed onto again. up never clears a box it could not verify: a stop leaves the text where it is.

A seat that does not get there

A seat that doesn't get there prints its one record with what stopped it, and up exits 1. For a seat whose wait ended without a prompt, the record is <seat>: left out: timeout (or the ended-at-its-shell reason below), and the detail under the record, on stderr, carries the last non-empty lines the pane showed — the launch line's own echo first when it is within reach, six at most, every escape sequence and every control character but the line breaks removed, each line cut to 200 characters with … — each on |; run \team up` again to resume itnames how the seat is finished. A wait that runs out with the owner at a terminal is not left there: it meets the pause astimeoutand is the owner's to open, skip or stop (above); the recorded timeout and the detail above are what a run without a terminal keeps. Those lines go to the terminal only: the log file gets the record, never the screen's text. The same holds for every folder the run resolves: a refusal's record holds the finding in words — the start folder a launch line was looked for in, the lobby a failed confirmation names — and the sentence with the folder is written under the record, on stderr, for this terminal alone. One line per final record, in file order, plus the watch's own line —watch: started, or watch:` and its reason in words when it did not — is the whole of what the log gets: a defect in the seat's file, or a note like the unread-model one below, is stderr detail and never a log line.

The pause that paragraph's above names is on the waiting page.

Every line, and its meaning

Rows that name the pause, above, the same proof as every close above, or an agent team cannot name (above) mean the waiting page's own: the pause, the close it proves, and the owner's by-hand answer.

The records are what stdout gets; a line below that is not a record is written to stderr, after the record it belongs to, as its meaning says.

The version placeholder

A version: "0" — exactly that literal, the placeholder a fresh init writes before the owner fills the release number — is read as no version declared: the seat's first launch is not stopped by it, and the model family is still compared, so a file whose model names a family the CLI does not run stops as above. No other spelling is read that way: version: "0.0" stops the launch as any mismatch would. team doctor says the placeholder as a note — what the seat really runs, and the one edit that pins it.

The account in a line

<account> in these lines is the seat's own account: its account: when the file names one, its vendor when it doesn't.

Notes on a launch line

A launch line the check can't be sure of is never refused: it is printed as note <seat>: <why> and the seat starts. A note says the line was not checked — a word of it quotes or substitutes text this version does not read, or its first word names no command — or that a relative path is not there yet, not checked: the command may create it; that is every relative argument but the shell's script path above — option text, an output path, a path the command creates, one a launcher changes directory for — and a ~/… that is not there now is said the same way. A seat resumed into an existing pane is checked where that pane runs when the state records the folder it was started in; without that record its launch line is not checked at all and the note says so — the file's folder is not where that pane is. The notes are said once: on stderr on a real run, on stdout with the plan on a dry one, as team doctor says them. A miss is not a note: on a dry run it leaves the seat out as skip <seat>: would refuse: ….

The dry-run plan

The plan a --dry-run prints is also what team down --dry-run prints: + <command> for a command that would run, a (<note>) line under one that carries a note, wait <text> for a wait, skip <text> for a seat left out, and dry run: nothing was run at the end. A seat a stored reading would refuse, and that this run would launch, is skip <seat>: would refuse: … and is not in the commands — the same line a seat whose launch line can't run where it starts is left out with, before its workspace is made. The words after would refuse: are the same as the words after refused:. A seat already running keeps its setup, with that reading in a note. A seat whose account is unknown carries (<account> is unknown; would launch) under its first command. A first sight carries (<account>: first sight only, not yet counted; would launch). A launch carries the seat's rules when they travel as a launch option (claude-code), so its line is long; a first-message seat's launch is the plain CLI command, and the plan shows the one line it types at the seat's idle prompt, with the note that the rules go to a per-seat file in the project state folder first.