sub-agents: a spawn cannot take the last of a window

The failure this prevents is specific — a sub-agent burns the end of a limit window and the session the
owner is actually sitting in dies mid-turn, because the credits went somewhere nobody was watching. So
it is a condition on spawning rather than a refinement: an endpoint that can start unattended work
without checking is wrong from its first call, and the symptom lands on someone else's conversation.

Wired into POST /command-hq/commanders/new, which — this is the finding — already IS the spawn
mechanism the sub-agents item was asking for. It starts a turn with ws: null, waits only for
session:claude, and returns the transcript id, with command_hq_sessions naming, listing and costing it.
So "commander or something lighter" answers itself: a commander costs nothing extra and a lighter thing
would need its own registry to be visible at all. What is still missing is only the agent-callable
surface.

Refuses rather than queues or downgrades. Queueing means holding work against a window Officer does not
control, and the reset it would wait for is a claim about a shared pool — every claude on the machine
spends these, including terminals and pipelines. A refusal naming the window, the percentage and the
reset is something a caller can act on now.

The floor is 15% and the reasoning is in the file: the interactive failure is not "cannot start a chat",
it is "a turn already in flight is cut off", and a turn costs a fraction of a window.

Fails OPEN, deliberately. The numbers come from an external endpoint with a credential Officer does not
own, so a blip or a signed-out CLI must not stop every spawn on the machine with an error about usage
that has nothing to do with usage. The problem is reported so a caller can say "started, but unchecked".

Seven tests on the pure rule — tightest window decides rather than the average, no limits allowed rather
than blocked, exactly-at-the-ceiling refuses. Verified against the live account, where it correctly
refuses right now at Session 90%.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

todo/shell/a-spotlight-style-launcher-on-ctrl-space.md

@@ -1,8 +1,8 @@
 ---
 id: shell/a-spotlight-style-launcher-on-ctrl-space
-title: "A Spotlight-style launcher, on `ctrl-space`"
+title: "A Spotlight-style launcher, on `shift-space`"
 theme: shell
-status: open
+status: done
 created: 2026-08-20
 date_source: assumed
 order: 1
@@ -15,3 +15,24 @@ and hit enter. Dock settings already exist, so the other half is pruning the doc
 actually used and letting the launcher carry the rest.
 **Trigger to confirm:** `alt-space` is the owner's preferred chord but is already load-bearing for
 him elsewhere, so `ctrl-space` unless that clashes too.
+
+---
+
+**Built 2026-08-21** (`81f32a1f`, retriggered in `a2cca526`). `shift-space` in the end: `ctrl-space`
+focuses the address bar in Brave and never reached the app.
+
+It **indexes the dock** rather than keeping a list of its own — the dock is already the composed,
+permission-filtered answer to "what can this account open here", so a plugin appears in the launcher for
+the reason it appears in the dock, and nothing is edited when one is installed. Settings sections are
+added on top, hand-listed, which is a known cost written into the file.
+
+Matching is subsequence with weighted scoring in its own testable file: `chq` finds Command HQ, `apik`
+finds API keys, `fi` gives Files rather than Profile. Nine tests, all about ORDER rather than matching.
+
+Stands down inside inputs and textareas, because shift-space types a space there. The consequence is
+real and stated: focus is usually in the chat composer, so opening it from there means clicking out
+first — double-tap shift is the escape hatch if that bites.
+
+**Still open, and the other half of this item:** pruning the dock, and dock auto-hide with effects. Those
+live in `shell/dock-effects-and-auto-hide`. Chats, files and actions are not in the index yet — routes
+and settings are known client-side, so this slice needed no API.