@awebai/oats 0.25.9 → 0.27.0

package/lib/schedule.mjs

@@ -1,9 +1,10 @@
-/** OATS schedules: legacy v1 plus explicit captured-execution v2,
- * workspace-scoped definitions and host-owned execution.
+/** OATS schedules: workspace-scoped definitions and host-owned execution.
+ *  (The captured-execution definitions of 0.24–0.25 were removed in 0.26: a
+ *  stored one is reported invalid on its job and never runs.)
  *
  *  A definition lives in <scope>/oats-schedules.json, where the scope is the
- *  team workspace (the config level declaring the team, else the outermost
- *  oats-config.yaml level), and is evaluated by the host that holds that
+ *  deployment directory (the one holding oats-local.yaml, found walking up;
+ *  see scheduleScopeOf), and is evaluated by the host that holds that
  *  scope: one host registry, one host lock, one host timer that runs
  *  `oats schedule tick --host` once a minute. The tick is a short-lived
  *  process; there is no daemon, no queue and no retry. Only the current
@@ -19,50 +20,49 @@
  *  delivered, started, skipped for wake) and never claim that a task
  *  succeeded. A launch whose side effects cannot be confirmed stays
  *  `unknown` with its slot held until `reconcile` proves what happened. */
-import { execFileSync, spawnSync } from "node:child_process";
+import { spawnSync } from "node:child_process";
 import { closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { Cron } from "croner";
-import { portableScope } from "./portable-state.mjs";
 import { loadLocal } from "./workspace.mjs";
-import { RESERVED_LAUNCH_ENV, ensureRoot, findAgent, findCapabilityAgent, findInstanceHomes, teamAgentRoots, configChain, spawnInstance, inspectInstanceSession, inputInstanceSession, startInstanceSession, retirePendingMarkerPath, loadCapturedDispatch, prepareCapturedComposition } from "./core.mjs";
-import { RECURRENCE_POLICIES, SCHEDULE_ATTEMPT_VERSION, SCHEDULE_DEFINITION_VERSION, admitExecutionTemplate, buildCommandExecutionTemplate, buildWakeExecutionTemplate, capturedDispatchAction, commandArgvWithExecutionBinding, executionContentIntegrity, validateExecutionBinding, validateExecutionCapsule, validateExecutionTemplate, validatePreparationInput } from "./schedule-capsule.mjs";
+import { noteRuntimeName } from "./deprecation.mjs";
+import { RESERVED_LAUNCH_ENV, MAX_INSTANCE_NAME, findAgent, findInstanceHomes, inspectInstanceSession, inputInstanceSession, startInstanceSession, retirePendingMarkerPath } from "./core.mjs";
 
 export const SCHEDULE_FILE = "oats-schedules.json";
 export const SCHEDULE_API = 2;
 const ID_RE = /^[a-z0-9-]{1,40}$/;
-const RUNTIMES = new Set(["pi", "claude", "codex"]);
+const HARNESSES = new Set(["pi", "claude", "codex"]);
 const BACKENDS = new Set(["tmux", "herdr"]);
 const MESSAGE_MAX = 256 * 1024;
 const OATS_BIN = join(dirname(fileURLToPath(import.meta.url)), "..", "bin", "oats.mjs");
 const COMMAND_TIMEOUT_MS = 5 * 60 * 1000;
 
 export function scheduleError(code, message, extra) { return Object.assign(new Error(message), { code, ...(extra || {}) }); }
-/** A stored definition that is not even shaped like one (a hand edit): it
- *  is never observed or executed, and is reported invalid on that job only. */
+/** describe's `executionStatus` (a released wire, kept as it was): a definition is
+ *  `legacy` — the only kind that runs — or `invalid` (a captured one included,
+ *  since 0.26), and so is its unresolved attempt. */
 export function scheduleExecutionStatus(def, intent, lock) {
-  const versioned = def?.definitionVersion !== undefined || def?.recurrencePolicy !== undefined || def?.execution !== undefined || def?.preparation !== undefined;
-  let result;
-  if (!versioned) result = { kind: "legacy", capture: "unknown", migrationRequired: true };
-  else {
-    const invalid = shapeError(def);
-    if (invalid) result = { kind: "invalid", capture: "unknown", migrationRequired: true, reason: invalid };
-    else if (def.recurrencePolicy === "prepare-on-tick") result = { kind: "prepare-on-tick", capture: "not-captured", migrationRequired: false, reason: "explicit preparation runs at admission" };
-    else result = { kind: "captured", capture: "recorded", migrationRequired: false, schemaVersion: def.execution.schemaVersion, contentIntegrity: executionContentIntegrity(def.execution), resolution: def.execution.resolution };
-  }
+  const versioned = CAPTURED_SCHEDULE_KEYS.some((key) => def?.[key] !== undefined);
+  const result = versioned ? { kind: "invalid", capture: "unknown", migrationRequired: true, reason: shapeError(def) } : { kind: "legacy", capture: "unknown", migrationRequired: true };
   if (!intent) return result;
   try {
-    const execution = validateAttemptExecution(intent, lock);
-    return { ...result, intent: execution ? { kind: "captured", capture: "recorded", migrationRequired: false, schemaVersion: intent.schemaVersion, executionId: execution.executionId, resolution: execution.resolution }
-      : { kind: "legacy", capture: "unknown", migrationRequired: true } };
+    validateAttemptExecution(intent, lock);
+    return { ...result, intent: { kind: "legacy", capture: "unknown", migrationRequired: true } };
   } catch (error) {
     return { ...result, intent: { kind: "invalid", capture: "unknown", migrationRequired: true, reason: error.message, errorCode: error.code } };
   }
 }
 
+/** The definition keys of a captured (versioned) schedule. That path was removed in 0.26. */
+export const CAPTURED_SCHEDULE_KEYS = Object.freeze(["definitionVersion", "recurrencePolicy", "execution", "preparation"]);
+const CAPTURED_SCHEDULE_REMOVED = "captured schedules are refused (the captured/portable path was removed in 0.26); remove this job, or re-add it without definitionVersion, recurrencePolicy, execution and preparation";
+/** runtime → harness (0.27.0, lead call 6: read either, write new): a definition's
+ *  `runtime` is its `harness`. Stored jobs are read with the new name (readDefinitions)
+ *  and the next write stores it; a job naming both, differently, is invalid on its own. */
+export const HARNESS_CONFLICT = "harness and runtime (its pre-0.27 name) disagree: keep harness: and remove runtime:";
 export function shapeError(def) {
   if (!def || typeof def !== "object" || Array.isArray(def)) return "definition is not an object";
   if (!["spawn", "command", "wake", "operation"].includes(def.kind)) return `kind ${JSON.stringify(def.kind)} is not spawn, command, wake or operation`;
@@ -71,54 +71,30 @@ export function shapeError(def) {
   if (def.kind === "command" && (typeof def.cwd !== "string" || !Array.isArray(def.argv))) return "cwd and argv are required";
   if (def.kind === "wake" && (typeof def.home !== "string" || typeof def.message !== "string")) return "home and message are required";
   if (def.kind === "operation" && (typeof def.operation !== "string" || typeof def.home !== "string")) return "operation and home are required";
-  if (def.definitionVersion !== undefined || def.recurrencePolicy !== undefined || def.execution !== undefined || def.preparation !== undefined) {
-    if (def.definitionVersion !== SCHEDULE_DEFINITION_VERSION) return `definitionVersion must be ${SCHEDULE_DEFINITION_VERSION}`;
-    if (!RECURRENCE_POLICIES.includes(def.recurrencePolicy)) return "recurrencePolicy must be capture or prepare-on-tick";
-    if (!["command", "wake"].includes(def.kind)) return "versioned execution currently supports command and captured wake definitions only";
-    if (def.kind === "wake" && def.recurrencePolicy !== "capture") return "wake definitions require capture policy";
-    if (def.recurrencePolicy === "capture") {
-      if (def.preparation !== undefined) return "capture policy cannot carry prepare-on-tick input";
-      try {
-        validateExecutionTemplate(def.execution);
-        const expected = def.kind === "command"
-          ? buildCommandExecutionTemplate({ cwd: def.cwd, argv: def.argv, inputRefs: def.execution.inputRefs, responsibleHuman: def.execution.responsibleHuman })
-          : buildWakeExecutionTemplate({ home: def.home, message: def.message,
-            executionBinding: { schemaVersion: 1, deployment: def.execution.deployment, resolution: def.execution.resolution },
-            inputRefs: def.execution.inputRefs, responsibleHuman: def.execution.responsibleHuman });
-        if (executionContentIntegrity(expected).value !== executionContentIntegrity(def.execution).value) return "execution template differs from the saved target";
-      } catch (error) { return `execution template is invalid: ${error.message}`; }
-    } else {
-      if (def.execution !== undefined) return "prepare-on-tick cannot carry a pinned execution template";
-      try { validatePreparationInput(def.preparation); } catch (error) { return `preparation input is invalid: ${error.message}`; }
-      try { commandArgvWithExecutionBinding(def.argv, { schemaVersion: 1, deployment: def.preparation.deployment, resolution: { schemaVersion: 1, id: `sha256-${"0".repeat(64)}` } }); }
-      catch (error) { return `prepare-on-tick command is invalid: ${error.message}`; }
-    }
-  }
+  // A stored captured (versioned) definition is never evaluated or run (removed in 0.26): it reads
+  // as invalid, migration required, on that job only.
+  if (CAPTURED_SCHEDULE_KEYS.some((key) => def[key] !== undefined)) return CAPTURED_SCHEDULE_REMOVED;
+  if (def.runtime !== undefined && def.harness !== undefined && def.runtime !== def.harness) return HARNESS_CONFLICT;
   return null;
 }
 
 // ---------------------------------------------------------------- scope
 
-/** The one schedule-owning scope for a directory: the config level that
- *  declares the team (the deployment boundary), else the outermost level
- *  carrying oats-config.yaml, else the workspace above the agents root. */
+/** The one schedule-owning scope for a directory: the deployment, i.e. the
+ *  directory holding the oats-local.yaml found walking up. No deployment in
+ *  reach is E_LOCAL_MISSING; an ambient OATS_ROOT / PI_AGENTS_ROOT never
+ *  chooses the scope (lead decision c3-5). */
 export function scheduleScopeOf(dir) {
-  const start = resolve(dir);
-  let chain = [];
-  try { chain = configChain(start); } catch { chain = []; }
-  const team = chain.find((c) => c.team);
-  if (team?._level) return resolve(team._level);
-  if (chain.length) return resolve(chain[chain.length - 1]._level);
-  try { return dirname(ensureRoot(start)); } catch { return start; }
-}
-/** Every agents root the scope knows: its own, member repositories', and any
- *  root that holds instance homes. */
-export function scopeRoots(scope) {
-  const roots = new Set();
-  try { roots.add(resolve(ensureRoot(scope))); } catch { /* a scope with no agents dir */ }
-  try { for (const r of teamAgentRoots(scope)) roots.add(resolve(r)); } catch { /* not a team scope */ }
-  return [...roots];
+  let found;
+  try { found = loadLocal(dir); }
+  catch (e) {
+    if (e?.code === "E_LOCAL_MISSING") throw scheduleError("E_LOCAL_MISSING", `schedules belong to a workspace deployment, and none is in reach of ${resolve(dir)} (no oats-local.yaml walking up; \`oats onboard\` creates one)`, { details: { dir: resolve(dir) } });
+    throw e;
+  }
+  return dirname(found.path);
 }
+/** The scope's one agents root: <deployment>/agents. */
+export function scopeRoots(scope) { return [resolve(scope, "agents")]; }
 
 // ------------------------------------------------------------- files
 
@@ -163,6 +139,14 @@ function writeJson(path, value) {
 }
 export function readDefinitions(ws) {
   const doc = readJsonBounded(definitionsPath(ws), { version: 1, jobs: {} }, "definitions").value;
+  if (doc.jobs && typeof doc.jobs === "object" && !Array.isArray(doc.jobs)) {
+    for (const [id, def] of Object.entries(doc.jobs)) {
+      if (!def || typeof def !== "object" || Array.isArray(def) || def.runtime === undefined) continue;
+      noteRuntimeName(`schedule ${id} in ${definitionsPath(ws)} (its next save records harness)`);
+      if (def.harness === undefined) { const { runtime, ...rest } = def; doc.jobs[id] = { ...rest, harness: runtime }; }
+      else if (def.harness === def.runtime) { const { runtime, ...rest } = def; void runtime; doc.jobs[id] = rest; }
+    }
+  }
   if (![1, 2].includes(doc.version) || typeof doc.jobs !== "object" || doc.jobs === null || Array.isArray(doc.jobs)) throw scheduleError("E_SCHEDULE_INVALID", `${definitionsPath(ws)} must be {version: 1|2, jobs: {}}`, { field: "file" });
   return doc;
 }
@@ -321,9 +305,18 @@ export function validateDefinition(ws, def, { checkAgent = true } = {}) {
     if (def.repo !== undefined) { if (typeof def.repo !== "string" || !def.repo.trim()) throw scheduleError("E_SCHEDULE_INVALID", "repo: the work repository path, as oats spawn --repo", { field: "repo" }); out.repo = def.repo; }
     if (def.backend !== undefined) { if (!BACKENDS.has(def.backend)) throw scheduleError("E_SCHEDULE_INVALID", "backend: tmux or herdr", { field: "backend" }); out.backend = def.backend; }
     if (def.purpose !== undefined) { if (typeof def.purpose !== "string" || !/^[a-z0-9-]{1,40}$/.test(def.purpose)) throw scheduleError("E_SCHEDULE_INVALID", "purpose: lowercase letters, digits and dashes", { field: "purpose" }); out.purpose = def.purpose; }
+    // A run spawns <agent>-<purpose|id>-<YYYYMMDDHHMM>; instance names are at most
+    // MAX_INSTANCE_NAME characters, so refuse here what would fail at every firing.
+    { const stem = out.purpose ?? id, derived = `${out.agent}-${stem}-${"0".repeat(12)}`;
+      if (derived.length > MAX_INSTANCE_NAME) throw scheduleError("E_SCHEDULE_INVALID", `${out.purpose !== undefined ? "purpose" : "id"}: runs would be named ${out.agent}-${stem}-<YYYYMMDDHHMM> (${derived.length} characters); instance names are at most ${MAX_INSTANCE_NAME} characters — shorten the ${out.purpose !== undefined ? "purpose" : "schedule id (or set a shorter purpose)"}`, { field: out.purpose !== undefined ? "purpose" : "id" }); }
     if (typeof def.task !== "string" || !def.task.trim()) throw scheduleError("E_SCHEDULE_INVALID", "task: non-empty text", { field: "task" });
     out.task = def.task;
-    if (def.runtime !== undefined) { if (!RUNTIMES.has(def.runtime)) throw scheduleError("E_SCHEDULE_INVALID", "runtime: pi, claude or codex", { field: "runtime" }); out.runtime = def.runtime; }
+    if (def.runtime !== undefined) {
+      if (def.harness !== undefined && def.harness !== def.runtime) throw scheduleError("E_SCHEDULE_INVALID", HARNESS_CONFLICT, { field: "runtime" });
+      noteRuntimeName(`schedule ${id}: runtime (written as harness)`);
+      def = { ...def, harness: def.runtime };
+    }
+    if (def.harness !== undefined) { if (!HARNESSES.has(def.harness)) throw scheduleError("E_SCHEDULE_INVALID", "harness: pi, claude or codex", { field: "harness" }); out.harness = def.harness; }
     if (def.model !== undefined) { if (typeof def.model !== "string") throw scheduleError("E_SCHEDULE_INVALID", "model: string", { field: "model" }); out.model = def.model; }
     if (def.yolo !== undefined) { if (typeof def.yolo !== "boolean") throw scheduleError("E_SCHEDULE_INVALID", "yolo: boolean", { field: "yolo" }); out.yolo = def.yolo; }
     if (def.wake !== undefined) {
@@ -337,6 +330,8 @@ export function validateDefinition(ws, def, { checkAgent = true } = {}) {
     if (typeof def.cwd !== "string" || !isAbsolute(def.cwd) || !inside(ws, def.cwd) || !existsSync(def.cwd)) throw scheduleError("E_SCHEDULE_INVALID", "cwd: an existing absolute directory inside the scope", { field: "cwd" });
     if (!Array.isArray(def.argv) || !def.argv.length || def.argv.some((a) => typeof a !== "string" || a.includes("\0")) || def.argv[0] !== "oats") throw scheduleError("E_SCHEDULE_INVALID", "argv: oats-only argument list starting with \"oats\"", { field: "argv" });
     if (def.argv[1] === "schedule") throw scheduleError("E_SCHEDULE_INVALID", "argv: a command job may not run oats schedule (it would wait on the host lock the tick holds)", { field: "argv" });
+    const selector = def.argv.slice(1, def.argv.includes("--") ? def.argv.indexOf("--") : undefined).find((a) => /^--(deployment|resolution|artifact-set)(=|$)/.test(a));
+    if (selector) throw scheduleError("E_SCHEDULE_INVALID", `argv: ${selector.split("=")[0]} is a captured selector (the captured/portable path was removed in 0.26) — the job would be refused at every firing`, { field: "argv" });
     out.cwd = resolve(def.cwd); out.argv = [...def.argv];
   } else if (def.kind === "wake") {
     if (typeof def.home !== "string" || !isAbsolute(def.home) || !inside(ws, def.home) || !existsSync(join(def.home, "instance.json"))) throw scheduleError("E_SCHEDULE_INVALID", "home: an existing instance home inside the scope", { field: "home" });
@@ -350,61 +345,19 @@ export function validateDefinition(ws, def, { checkAgent = true } = {}) {
     if (typeof def.home !== "string" || !isAbsolute(def.home) || !inside(ws, def.home) || !existsSync(join(def.home, "instance.json"))) throw scheduleError("E_SCHEDULE_INVALID", "home: an existing instance home inside the scope", { field: "home" });
     out.operation = def.operation; out.home = resolve(def.home);
   } else throw scheduleError("E_SCHEDULE_INVALID", "kind: spawn, command, wake or operation", { field: "kind" });
-  const versioned = def.definitionVersion !== undefined || def.recurrencePolicy !== undefined || def.execution !== undefined || def.preparation !== undefined;
-  if (versioned) {
-    if (def.definitionVersion !== SCHEDULE_DEFINITION_VERSION) throw scheduleError("E_SCHEDULE_INVALID", `definitionVersion: ${SCHEDULE_DEFINITION_VERSION} required for captured schedules`, { field: "definitionVersion" });
-    if (!RECURRENCE_POLICIES.includes(def.recurrencePolicy)) throw scheduleError("E_SCHEDULE_INVALID", "recurrencePolicy: capture or prepare-on-tick", { field: "recurrencePolicy" });
-    if (!["command", "wake"].includes(def.kind)) throw scheduleError("E_SCHEDULE_INVALID", "versioned execution currently supports command and captured wake jobs; spawn and operation await their captured consumer adapters", { field: "recurrencePolicy" });
-    if (def.kind === "wake" && def.recurrencePolicy !== "capture") throw scheduleError("E_SCHEDULE_INVALID", "versioned wake jobs require capture policy", { field: "recurrencePolicy" });
-    out.definitionVersion = SCHEDULE_DEFINITION_VERSION;
-    out.recurrencePolicy = def.recurrencePolicy;
-    if (def.recurrencePolicy === "capture") {
-      if (def.preparation !== undefined) throw scheduleError("E_SCHEDULE_INVALID", "preparation belongs only to prepare-on-tick", { field: "preparation" });
-      let execution;
-      try {
-        const responsibleHuman = Object.hasOwn(def, "responsibleHuman") ? def.responsibleHuman : def.execution?.responsibleHuman;
-        if (responsibleHuman === undefined) throw new Error("responsibleHuman must be explicit for captured execution (null means messaging disabled)");
-        if (def.kind === "command") execution = buildCommandExecutionTemplate({ cwd: out.cwd, argv: out.argv,
-          inputRefs: def.inputRefs ?? def.execution?.inputRefs ?? {}, responsibleHuman });
-        else {
-          const meta = readJson(join(out.home, "instance.json"), null);
-          if (!meta?.executionBinding) throw scheduleError("migration-required", "wake target has no captured executionBinding", { field: "executionBinding" });
-          validateExecutionBinding(meta.executionBinding);
-          execution = buildWakeExecutionTemplate({ home: out.home, message: out.message, executionBinding: meta.executionBinding,
-            inputRefs: def.inputRefs ?? def.execution?.inputRefs ?? {}, responsibleHuman });
-        }
-        if (def.execution !== undefined) {
-          validateExecutionTemplate(def.execution);
-          if (executionContentIntegrity(def.execution).value !== executionContentIntegrity(execution).value) throw new Error("template differs from target, binding, inputs or responsible human");
-        }
-      } catch (error) {
-        if (error.code === "migration-required") throw error;
-        throw scheduleError("E_SCHEDULE_INVALID", `execution: ${error.message}`, { field: "execution" });
-      }
-      out.execution = execution;
-    } else {
-      if (def.execution !== undefined) throw scheduleError("E_SCHEDULE_INVALID", "execution: prepare-on-tick captures only when a future tick is admitted", { field: "execution" });
-      try {
-        out.preparation = validatePreparationInput(def.preparation);
-        commandArgvWithExecutionBinding(out.argv, { schemaVersion: 1, deployment: out.preparation.deployment, resolution: { schemaVersion: 1, id: `sha256-${"0".repeat(64)}` } });
-      } catch (error) { throw scheduleError("E_SCHEDULE_INVALID", `preparation: ${error.message}`, { field: "preparation" }); }
-    }
-  }
+  // Captured (versioned) schedules were removed in 0.26 (lead decisions on (e), D4).
+  const captured = CAPTURED_SCHEDULE_KEYS.filter((key) => def[key] !== undefined);
+  if (captured.length) throw scheduleError("E_SCHEDULE_INVALID", `${captured.join(", ")}: ${CAPTURED_SCHEDULE_REMOVED}`, { field: captured[0] });
   return out;
 }
 
-/** The soul a spawn job launches: the exact agents root the definition
- *  names (agentsRoot, what tells same-named souls in different member
- *  repositories apart), else the scope's own root; the same lookups `oats
- *  spawn` uses (local and persistent souls, then capability-declared
- *  agents). `repo` is the work repository and never selects a soul. */
+/** The soul a spawn job launches, under the deployment's one agents root
+ *  (a definition's agentsRoot, when given, must be that root). `repo` is the
+ *  work repository and never selects a soul. */
 export function resolveScheduledAgent(ws, def) {
-  let root;
-  try { root = def.agentsRoot ? ensureRoot(def.agentsRoot) : ensureRoot(ws); }
-  catch (e) { throw scheduleError("E_SCHEDULE_INVALID", `agentsRoot: ${e.message}`, { field: def.agentsRoot ? "agentsRoot" : "agent" }); }
-  if (def.agentsRoot && resolve(root) !== resolve(def.agentsRoot)) throw scheduleError("E_SCHEDULE_INVALID", `agentsRoot: ${def.agentsRoot} is not an agents root (resolved to ${root})`, { field: "agentsRoot" });
-  let agent = findAgent(root, def.agent);
-  if (!agent) { try { agent = findCapabilityAgent(dirname(root), root, def.agent); } catch { agent = undefined; } }
+  const [root] = scopeRoots(ws);
+  if (def.agentsRoot && resolve(def.agentsRoot) !== root) throw scheduleError("E_SCHEDULE_INVALID", `agentsRoot: ${def.agentsRoot} is not this deployment's agents root (${root})`, { field: "agentsRoot" });
+  const agent = findAgent(root, def.agent);
   if (!agent) throw scheduleError("E_SCHEDULE_INVALID", `agent: no soul named ${JSON.stringify(def.agent)} under ${root}`, { field: "agent" });
   return { root, agent };
 }
@@ -418,13 +371,13 @@ export function nextRunAfter(def, from) { const n = cronOf(def).nextRun(from); r
 /** Due exactly at this minute: the first run after (minute - 1 s) is this minute. */
 export function dueAt(def, minute) { const n = cronOf(def).nextRun(new Date(minute.getTime() - 1000)); return !!n && n.getTime() === minute.getTime(); }
 export function purposeSuffix(minute) { return minute.toISOString().slice(0, 16).replace(/[-T:]/g, ""); }
-/** Ordering key for admission: when this job last launched a runtime. */
+/** Ordering key for admission: when this job last launched a harness. */
 export function launchOrderKey(js) { return String(js?.lastLaunchedAt || ""); }
 
 // ---------------------------------------------------------- observation
 
 /** What a run's instance looks like now. Home gone = ended; a home that is
- *  retiring is still there (its runtime may be alive pending teardown) and
+ *  retiring is still there (its harness may be alive pending teardown) and
  *  keeps its slot; present but no running harness = stopped (needs
  *  attention, never removed); running = active; not inspectable = unknown. */
 export function observeHome(home, io) {
@@ -437,7 +390,7 @@ export function observeHome(home, io) {
     if (retiring) return { outcome: "active", note: "retiring: home present, teardown pending" };
     // A shell right after `session start` is that launch's startup phase
     // until its wrapper writes the exit marker for the launch id; only then
-    // (or with no start receipt at all) is a shell a finished runtime.
+    // (or with no start receipt at all) is a shell a finished harness.
     if (s.present && s.state === "shell" && startupInProgress(home)) return { outcome: "starting" };
     return { outcome: "stopped" };
   } catch (e) { return { outcome: "unknown", error: e.message }; }
@@ -452,7 +405,7 @@ function startupInProgress(home) {
 }
 
 /** All homes for an instance name across the scope's roster (every known
- *  agents root and its local-agents sibling). */
+ *  agents root). */
 export function findHomesInScope(ws, instance) {
   const homes = new Set();
   for (const root of scopeRoots(ws)) {
@@ -465,8 +418,6 @@ export function findHomesInScope(ws, instance) {
       const h = join(root, e.name, "instances", instance);
       if (existsSync(join(h, "instance.json"))) homes.add(resolve(h));
     }
-    const local = join(dirname(root), "local-agents");
-    if (existsSync(local)) for (const e of readdirSync(local, { withFileTypes: true })) { if (!e.isDirectory()) continue; const h = join(local, e.name, "instances", instance); if (existsSync(join(h, "instance.json"))) homes.add(resolve(h)); }
   }
   return [...homes];
 }
@@ -485,27 +436,17 @@ function childEnv() {
   for (const key of [...RESERVED_LAUNCH_ENV,
     "OATS_DEPLOYMENT", "OATS_RESOLUTION", "OATS_CAPABILITY", "OATS_LAYER", "OATS_LEVEL", "OATS_META", "OATS_OPERATION",
     "OATS_REPO", "OATS_BRANCH", "OATS_WORK", "OATS_KIND", "OATS_TASK",
-    "OATS_RUNTIME", "OATS_PREVIOUS_RUNTIME", "OATS_RETIRE_INTENT",
+    "OATS_HARNESS", "OATS_PREVIOUS_HARNESS", "OATS_RUNTIME", "OATS_PREVIOUS_RUNTIME", "OATS_RETIRE_INTENT",
     "OATS_TEAM_NAME", "OATS_TEAM_ID", "OATS_TEAM_SCOPE",
   ]) delete env[key];
   return env;
 }
-/** Is this spawn a WORKSPACE-model spawn (module contract §5, decision 7)?
- *  Two marks, either suffices: the deployment realizes a workspace
- *  (`oats-local.yaml` walking up from the agents root or the scope — the same
- *  detection `oats spawn` uses), or the soul under the agents root was copied
- *  from a member repo by ensureWorkspaceSoul (`.oats-soul-source.json` beside
- *  it). An unreadable oats-local.yaml is still a workspace deployment: the
- *  spawn must go the workspace way and report E_WORKSPACE_SCHEMA, never fall
- *  back to a classic home. Returns null for a classic (bare agents root) spawn. */
-export function workspaceSpawnContext(ws, root, agent) {
-  for (const dir of [dirname(root), ws]) {
-    try { const found = loadLocal(dir); return { kind: "local", local: found.path, dir: dirname(found.path) }; }
-    catch (e) { if (e?.code !== "E_LOCAL_MISSING") return { kind: "local", local: null, dir, error: { code: e.code || "E_WORKSPACE_SCHEMA", message: e.message } }; }
-  }
-  const stamp = agent?._dir ? join(agent._dir, ".oats-soul-source.json") : join(root, agent?.name || "", ".oats-soul-source.json");
-  if (agent?.name && existsSync(stamp)) return { kind: "soul-source", local: null, dir: dirname(root), stamp };
-  return null;
+/** The deployment a spawn job runs in (module contract §5, decision 7): the
+ *  scope's oats-local.yaml. An unreadable one is reported (E_WORKSPACE_SCHEMA)
+ *  by the spawn, never answered some other way. */
+export function workspaceSpawnContext(ws) {
+  try { const found = loadLocal(ws); return { kind: "local", local: found.path, dir: dirname(found.path) }; }
+  catch (e) { return { kind: "local", local: null, dir: ws, error: { code: e.code || "E_WORKSPACE_SCHEMA", message: e.message } }; }
 }
 /** A workspace spawn materializes EXACTLY like `oats spawn` — prepareInstance →
  *  ensureWorkspaceSoul → spawnInstanceAsync (resolve over the remotes, copy every
@@ -521,7 +462,7 @@ export function workspaceSpawnContext(ws, root, agent) {
 function spawnViaCli(ws, root, agent, opts, context, io) {
   if (context.error) throw scheduleError(context.error.code, `this deployment realizes a workspace (${context.dir}) but its oats-local.yaml cannot be read: ${context.error.message}`);
   const argv = ["spawn", agent.name, "--dir", context.dir, "--agents-root", root, "--purpose", opts.purpose, "--json"];
-  if (opts.runtime) argv.push("--runtime", opts.runtime);
+  if (opts.harness) argv.push("--harness", opts.harness);
   if (opts.model) argv.push("--model", opts.model);
   if (opts.backend) argv.push("--backend", opts.backend);
   if (opts.repo) argv.push("--repo", opts.repo);
@@ -551,20 +492,16 @@ function spawnViaCli(ws, root, agent, opts, context, io) {
   return { instance: res.instance, home: res.home, launched: res.launched, materialized: "workspace" };
 }
 /** Launch one spawn job. `io.spawn(root, agent, opts)` overrides the whole
- *  launcher for tests. Otherwise a workspace deployment goes through the
- *  kernel's own `oats spawn` (workspace materialization: `.oats/modules`,
- *  module skills and injects — never a classic home); a bare agents root goes
- *  through the synchronous classic spawnInstance, whose failures throw here. */
+ *  launcher for tests. Otherwise the kernel's own `oats spawn` runs in the
+ *  deployment (workspace materialization: `.oats/modules`, module skills and
+ *  injects). */
 function launchSpawn(ws, def, minute, io) {
   const { root, agent } = resolveScheduledAgent(ws, def);
   const purpose = `${def.purpose || def.id}-${purposeSuffix(minute)}`;
-  const opts = { task: def.task.trimEnd() + scheduleBlock(def, minute), purpose, runtime: def.runtime, model: def.model, yolo: def.yolo, backend: def.backend, repo: def.repo, launch: io?.noLaunch === true ? false : true };
+  const opts = { task: def.task.trimEnd() + scheduleBlock(def, minute), purpose, harness: def.harness, model: def.model, yolo: def.yolo, backend: def.backend, repo: def.repo, launch: io?.noLaunch === true ? false : true };
   let r;
   if (io?.spawn) r = io.spawn(root, agent, opts);
-  else {
-    const context = workspaceSpawnContext(ws, root, agent);
-    r = context ? spawnViaCli(ws, root, agent, opts, context, io) : spawnInstance(root, agent, opts);
-  }
+  else r = spawnViaCli(ws, root, agent, opts, workspaceSpawnContext(ws), io);
   const run = { instance: r.instance, home: r.home, launched: !!r.instance, kind: "spawn", ...(r.materialized ? { materialized: r.materialized } : {}) };
   if (def.wake && r.home) {
     try { run.wakeSchedule = saveWakeForHome(ws, { instance: r.instance, home: r.home, wake: def.wake }); }
@@ -629,74 +566,21 @@ function launchCommand(ws, def, io) {
   return { kind: "command", launched: envelope.ok === true, ...(instance ? { instance } : {}), ...(home ? { home, incarnation: incarnationOfHome(home) } : {}), ...(server ? { server } : {}), ...(envelope.ok ? {} : { error: envelope.error?.message || "command failed", errorCode: envelope.error?.code }) };
 }
 
-/** Verify an immutable capsule and its current exact-artifact authorization
- * before the scheduler acquires a slot or invokes a child. Legacy definitions
- * retain their old release boundary; prepare-on-tick remains fail-closed until
- * the preparation owner supplies its transaction API. */
-function homeExecutionBinding(home) {
-  const meta = readJson(join(home, "instance.json"), null);
-  if (!meta?.executionBinding) throw scheduleError("migration-required", "wake target has no captured executionBinding");
-  try { return validateExecutionBinding(meta.executionBinding); }
-  catch (error) { throw scheduleError("E_SCHEDULE_INVALID", `wake target executionBinding is invalid: ${error.message}`); }
-}
+/** A captured attempt or job lock left by 0.24–0.25 (the captured path, removed in
+ *  0.26) is never run, adopted or released here: only removing its job clears it. */
+const CAPTURED_ATTEMPT_REMOVED = "this job holds a captured schedule attempt (the captured/portable path was removed in 0.26); remove the job (oats schedule remove --force <id>)";
 function validateAttemptExecution(attempt, lock) {
-  if (attempt?.execution === undefined) {
-    if (attempt?.schemaVersion !== undefined) throw scheduleError("migration-required", "versioned scheduled attempt has no captured execution");
-    if (lock?.executionId !== undefined) throw scheduleError("E_SCHEDULE_INVALID", "captured job lock has no matching admitted capsule");
-    return undefined;
-  }
-  if (attempt.schemaVersion !== SCHEDULE_ATTEMPT_VERSION) throw scheduleError("migration-required", "scheduled attempt uses an unsupported version");
-  const execution = validateExecutionCapsule(attempt.execution);
-  if (lock && lock.executionId !== execution.executionId) throw scheduleError("E_SCHEDULE_INVALID", "job lock does not name the admitted execution intent");
-  return execution;
+  if (attempt?.execution !== undefined || attempt?.schemaVersion !== undefined) throw scheduleError("migration-required", CAPTURED_ATTEMPT_REMOVED);
+  if (lock?.executionId !== undefined) throw scheduleError("E_SCHEDULE_INVALID", `captured job lock: ${CAPTURED_ATTEMPT_REMOVED}`);
 }
 function validateActiveExecution(js, lock) {
   if (lock?.unreadable) throw scheduleError("E_SCHEDULE_INVALID", "job lock custody is unreadable");
   if (js.attempt) return validateAttemptExecution(js.attempt, lock);
-  if (lock && (js.lastRun?.execution || lock.executionId !== undefined)) {
-    return validateAttemptExecution(js.lastRun?.execution ? { schemaVersion: SCHEDULE_ATTEMPT_VERSION, execution: js.lastRun.execution } : {}, lock);
-  }
-}
-function receiptMatchesExecution(receipt, execution) {
-  return !!receipt?.execution && receipt.execution.executionId === execution.executionId
-    && executionContentIntegrity(validateExecutionCapsule(receipt.execution)).value === executionContentIntegrity(execution).value;
-}
-function admitExecution(def, io, { createIntent = true } = {}) {
-  if (def.definitionVersion === undefined) return undefined;
-  if (def.definitionVersion !== SCHEDULE_DEFINITION_VERSION) throw scheduleError("migration-required", "scheduled definition uses an unsupported execution version");
-  let execution;
-  if (def.recurrencePolicy === "prepare-on-tick") {
-    if (!createIntent) return undefined; // dry-run never prepares or publishes
-    const prepare = io && Object.hasOwn(io, "prepare") ? io.prepare : prepareCapturedComposition;
-    if (typeof prepare !== "function") throw scheduleError("migration-required", "prepare-on-tick needs the preparation transaction adapter before this tick can be admitted");
-    const request = validatePreparationInput(def.preparation);
-    const requestedDeployment = portableScope(request.deployment); // Freeze identity before preparation, including platform path aliases.
-    const prepared = prepare(request);
-    if (!prepared || typeof prepared !== "object" || !prepared.executionBinding || !Object.hasOwn(prepared, "responsibleHuman")) {
-      throw scheduleError("needs-configuration", "preparation did not produce a complete executionBinding and responsibleHuman", { problems: prepared?.problems || [] });
-    }
-    const binding = validateExecutionBinding(prepared.executionBinding);
-    let sameDeployment = false;
-    try { sameDeployment = portableScope(binding.deployment) === requestedDeployment && portableScope(request.deployment) === requestedDeployment; } catch { /* absent/changed scope is not the admitted deployment */ }
-    if (!sameDeployment) throw scheduleError("E_SCHEDULE_INVALID", "prepared executionBinding changed the requested deployment");
-    binding.deployment = requestedDeployment; // Persist canonical authority, not a retargetable spelling.
-    if (prepared.resolution && prepared.resolution.id !== binding.resolution.id) throw scheduleError("E_SCHEDULE_INVALID", "prepared resolution differs from executionBinding");
-    const argv = commandArgvWithExecutionBinding(def.argv, binding);
-    execution = buildCommandExecutionTemplate({ cwd: def.cwd, argv, inputRefs: prepared.inputRefs ?? {}, responsibleHuman: prepared.responsibleHuman });
-  } else execution = validateExecutionTemplate(def.execution);
-  const action = capturedDispatchAction(execution);
-  if (action.kind === "wake") {
-    const binding = homeExecutionBinding(execution.target.home);
-    if (binding.deployment !== execution.deployment || binding.resolution.id !== execution.resolution.id) throw scheduleError("E_SCHEDULE_INVALID", "wake target executionBinding differs from its captured template");
-  }
-  const request = { deployment: execution.deployment, resolution: execution.resolution, action };
-  (io?.admit || loadCapturedDispatch)(request);
-  if (action.kind === "wake") throw scheduleError("migration-required", "captured wake lifecycle dispatch is not integrated yet");
-  return createIntent ? admitExecutionTemplate(execution) : undefined;
+  if (lock && (js.lastRun?.execution !== undefined || lock.executionId !== undefined)) validateAttemptExecution({ execution: js.lastRun?.execution }, lock);
 }
 /** One wake. `startIfStopped` false between due minutes (a harness that
  *  keeps exiting is not restarted every minute); `canStart` false when the
- *  host bound is reached (a new runtime takes a slot; a delivery does not). */
+ *  host bound is reached (a new harness takes a slot; a delivery does not). */
 /** A failure message that reports effects the kernel could not undo or
  *  confirm (spawn compensation's "rollback INCOMPLETE", a quarantined or
  *  retained home): the launch's effects are unconfirmed, never a confirmed
@@ -715,14 +599,14 @@ function performWake(def, io, { startIfStopped = true, canStart = true, reserve
     // The slot is persisted BEFORE the start call and kept on ANY start
     // exception: an error code does not prove nothing was allocated (core
     // can refuse while recording, after the session exists). The next
-    // observation releases it once the runtime is proven stopped or absent;
+    // observation releases it once the harness is proven stopped or absent;
     // at worst a refused start occupies a slot for one tick.
     if (reserve && !reserve()) return { kind: "wake", action: "skipped", reason: "the job's slot is held by another process; delivery pending", pending: true };
     try {
       const r = (io?.start || startInstanceSession)(def.home);
-      return { kind: "wake", action: "started", instance: r.instance, target: r.target, home: def.home, incarnation: incarnationOfHome(def.home), reason: "session was stopped; the message is pending until the session is active", pending: true, startedRuntime: true };
+      return { kind: "wake", action: "started", instance: r.instance, target: r.target, home: def.home, incarnation: incarnationOfHome(def.home), reason: "session was stopped; the message is pending until the session is active", pending: true, startedHarness: true };
     } catch (e) {
-      return { kind: "wake", action: "skipped", reason: `start did not complete (${e.code || "error"}): ${e.message}; the slot is kept until the session is observed stopped or absent`, error: e.message, errorCode: e.code, pending: true, startedRuntime: "unconfirmed" };
+      return { kind: "wake", action: "skipped", reason: `start did not complete (${e.code || "error"}): ${e.message}; the slot is kept until the session is observed stopped or absent`, error: e.message, errorCode: e.code, pending: true, startedHarness: "unconfirmed" };
     }
   }
   try {
@@ -737,15 +621,18 @@ function performWake(def, io, { startIfStopped = true, canStart = true, reserve
 
 /** Observe the previous run of one job. The tracked identity is what was
  *  launched (the lock's or lastRun's home), never the current definition,
- *  so an edit cannot make a slot forget its runtime. A wake slot is held
- *  while its started runtime is active, starting, unknown or retiring and
- *  released when that runtime is proven stopped (the start receipt's exit
+ *  so an edit cannot make a slot forget its harness. A wake slot is held
+ *  while its started harness is active, starting, unknown or retiring and
+ *  released when that harness is proven stopped (the start receipt's exit
  *  marker) or its home is gone: a persistent home outliving its process
  *  does not keep a slot. */
 function observePrevious(ws, id, def, js, io, now, { mutate }) {
+  // An invalid definition (a stored captured one included) is reported on its
+  // job by the tick and never observed.
+  if (shapeError(def)) return;
   const lock = jobLockInfo(ws, id);
   validateActiveExecution(js, lock); // No observation may erase invalid custody.
-  if (js.attempt || shapeError(def)) return; // Unconfirmed effects need reconcile.
+  if (js.attempt) return; // Unconfirmed effects need reconcile.
   const lr = js.lastRun;
   const home = def.kind === "wake" ? (lock?.home || lr?.home || def.home) : (lock?.home || lr?.home);
   const tracked = def.kind === "wake" ? !!lock : !!home && ["launched", "active", "starting", "stopped", "unknown"].includes(lr?.outcome);
@@ -756,7 +643,7 @@ function observePrevious(ws, id, def, js, io, now, { mutate }) {
     if (seen.outcome === "ended" || seen.outcome === "stopped") {
       releaseJobLock(ws, id);
       if (seen.outcome === "ended") delete js.pendingWake;
-      if (lr) js.lastRun = { ...lr, ...(seen.outcome === "ended" ? { endedAt: now.toISOString() } : { stoppedAt: now.toISOString() }), note: seen.outcome === "ended" ? "started runtime ended" : "started runtime stopped; slot released" };
+      if (lr) js.lastRun = { ...lr, ...(seen.outcome === "ended" ? { endedAt: now.toISOString() } : { stoppedAt: now.toISOString() }), note: seen.outcome === "ended" ? "started harness ended" : "started harness stopped; slot released" };
     }
     return;
   }
@@ -786,41 +673,24 @@ export function tickWorkspace(ws, { now = new Date(), io, reg, wsList, dryRun =
   // `candidates` (the host tick) means the host already observed every scope.
   if (!candidates) for (const [id, def] of Object.entries(defs.jobs)) observePrevious(ws, id, def, stateOf(id), io, now, { mutate: !dryRun });
   if (observeOnly) { if (!dryRun) writeState(ws, st); return considered; }
-  // Least recently LAUNCHED first: only an actual runtime launch counts, a
+  // Least recently LAUNCHED first: only an actual harness launch counts, a
   // skipped or pending job keeps its place at the front of the line.
   const order = (candidates || Object.keys(defs.jobs)).filter((id) => Object.prototype.hasOwnProperty.call(defs.jobs, id) && (!only || id === only)).sort((a, b) => launchOrderKey(st.jobs[a]).localeCompare(launchOrderKey(st.jobs[b])) || a.localeCompare(b));
   for (const id of order) {
     const def = defs.jobs[id];
     const js = stateOf(id);
-    validateActiveExecution(js, jobLockInfo(ws, id)); // Also covers host pre-observed candidates.
     let due, cronError;
     const shape = shapeError(def);
+    if (!shape) validateActiveExecution(js, jobLockInfo(ws, id)); // Also covers host pre-observed candidates.
     if (shape) { cronError = shape; due = false; }
     else { try { due = only ? true : dueAt(def, minute); } catch (e) { cronError = e.message; due = false; } }
     if (cronError) { if (!dryRun) js.lastRun = { ...(js.lastRun || {}), outcome: "invalid", error: `definition cannot be evaluated: ${cronError}` }; record(id, "invalid", { error: cronError }); continue; }
-    // A captured wake is bound to the target home's exact executionBinding,
-    // but remains gated until lifecycle exposes captured wake dispatch. Keep
-    // this before both pending delivery and due-start branches so neither can
-    // fall through to the legacy home path.
-    const versionedWakeDue = def.kind === "wake" && def.definitionVersion !== undefined && !dryRun
-      && (def.enabled || only) && ((js.pendingWake && !only) || only || (due && js.lastAttemptedMinute !== key));
-    if (versionedWakeDue) {
-      let error;
-      try { admitExecution(def, io, { createIntent: false }); } catch (caught) { error = caught; }
-      if (error) {
-        if (only || due) js.lastAttemptedMinute = key;
-        js.lastRun = { scheduledFor: minute.toISOString(), startedAt: now.toISOString(), kind: "wake", launched: false, outcome: "blocked", error: error.message, errorCode: error.code || "E_SCHEDULE_ADMISSION" };
-        record(id, "blocked", { error: error.message, errorCode: error.code || "E_SCHEDULE_ADMISSION" });
-        continue;
-      }
-      throw scheduleError("migration-required", "captured wake unexpectedly passed its lifecycle integration gate");
-    }
     if (def.kind === "wake" && js.pendingWake && def.enabled && !dryRun && !only) {
       const dueNow = due && js.lastAttemptedMinute !== key;
       const held = !!jobLockInfo(ws, id);
       const canStart = held || liveLocks(wsAll) < bound;
       const run = performWake(def, io, { startIfStopped: dueNow, canStart, reserve: () => held || acquireJobLock(ws, id, { scheduledFor: js.pendingWake.scheduledFor, wake: true, home: def.home }) });
-      if (run.startedRuntime) js.lastLaunchedAt = now.toISOString();
+      if (run.startedHarness) js.lastLaunchedAt = now.toISOString();
       if (!existsSync(def.home)) releaseJobLock(ws, id);
       js.lastRun = { ...(js.lastRun || {}), ...run, outcome: run.action, completedPending: run.action === "delivered", pendingSince: js.pendingWake.scheduledFor, startedAt: js.lastRun?.startedAt || now.toISOString() };
       if (!run.pending) delete js.pendingWake;
@@ -832,12 +702,8 @@ export function tickWorkspace(ws, { now = new Date(), io, reg, wsList, dryRun =
     if (js.lastAttemptedMinute === key && !only) continue;
     if (!due) continue;
     if (dryRun) {
-      let admission;
-      if (!js.attempt && !jobLockInfo(ws, id) && (def.kind === "wake" || liveLocks(wsAll) < bound)) {
-        try { admitExecution(def, io, { createIntent: false }); } catch (error) { admission = error; }
-      }
-      const reason = js.attempt ? "an earlier launch has no recorded result; run oats schedule reconcile" : jobLockInfo(ws, id) && def.kind !== "wake" ? "still running" : liveLocks(wsAll) >= bound && def.kind !== "wake" ? "host busy" : admission ? `admission blocked (${admission.code || "error"}): ${admission.message}` : undefined;
-      record(id, reason ? (admission ? "blocked" : "skipped") : "due", reason ? { reason, ...(admission ? { errorCode: admission.code } : {}) } : {});
+      const reason = js.attempt ? "an earlier launch has no recorded result; run oats schedule reconcile" : jobLockInfo(ws, id) && def.kind !== "wake" ? "still running" : liveLocks(wsAll) >= bound && def.kind !== "wake" ? "host busy" : undefined;
+      record(id, reason ? "skipped" : "due", reason ? { reason } : {});
       continue;
     }
     js.lastAttemptedMinute = key;
@@ -845,9 +711,7 @@ export function tickWorkspace(ws, { now = new Date(), io, reg, wsList, dryRun =
       let invalid;
       try { validateAttemptExecution(js.attempt, jobLockInfo(ws, id)); } catch (error) { invalid = error; }
       record(id, invalid ? "invalid" : "skipped", { reason: invalid ? `admitted attempt is invalid (${invalid.code || "error"}): ${invalid.message}` : "an earlier launch has no recorded result; run oats schedule reconcile", ...(invalid ? { errorCode: invalid.code } : {}) });
-      if (!js.attempt.execution || receiptMatchesExecution(js.lastRun, js.attempt.execution)) {
-        js.lastRun = { ...(js.lastRun || {}), outcome: "unknown", error: invalid ? `invalid admitted attempt: ${invalid.message}` : "launch attempt without a recorded result", ...(invalid ? { errorCode: invalid.code } : {}), scheduledFor: js.attempt.scheduledFor };
-      }
+      js.lastRun = { ...(js.lastRun || {}), outcome: "unknown", error: invalid ? `invalid admitted attempt: ${invalid.message}` : "launch attempt without a recorded result", ...(invalid ? { errorCode: invalid.code } : {}), scheduledFor: js.attempt.scheduledFor };
       continue;
     }
     if (def.kind === "wake") {
@@ -855,7 +719,7 @@ export function tickWorkspace(ws, { now = new Date(), io, reg, wsList, dryRun =
       // one does, and the slot is held (the job lock) until that home ends.
       const holdsSlot = !!jobLockInfo(ws, id);
       const run = performWake(def, io, { startIfStopped: true, canStart: holdsSlot || liveLocks(wsAll) < bound, reserve: () => holdsSlot || acquireJobLock(ws, id, { scheduledFor: minute.toISOString(), wake: true, home: def.home }) });
-      if (run.startedRuntime) js.lastLaunchedAt = now.toISOString();
+      if (run.startedHarness) js.lastLaunchedAt = now.toISOString();
       if (!existsSync(def.home)) releaseJobLock(ws, id);
       if (run.pending) js.pendingWake = { scheduledFor: minute.toISOString() }; else delete js.pendingWake;
       js.lastRun = { scheduledFor: minute.toISOString(), startedAt: now.toISOString(), home: def.home, ...run, outcome: run.action, ...(run.instance ? { instance: run.instance } : {}) };
@@ -864,26 +728,18 @@ export function tickWorkspace(ws, { now = new Date(), io, reg, wsList, dryRun =
     }
     if (jobLockInfo(ws, id)) { record(id, "skipped", { reason: "still running" }); continue; }
     if (liveLocks(wsAll) >= bound) { record(id, "skipped", { reason: "host busy" }); continue; }
-    let execution;
-    try { execution = admitExecution(def, io); }
-    catch (error) {
-      js.lastRun = { scheduledFor: minute.toISOString(), startedAt: now.toISOString(), kind: def.kind, launched: false, outcome: "blocked", error: error.message, errorCode: error.code || "E_SCHEDULE_ADMISSION" };
-      record(id, "blocked", { error: error.message, errorCode: error.code || "E_SCHEDULE_ADMISSION" });
-      continue;
-    }
-    // Persist the admitted authority before even reserving the launch slot.
-    // A crash in the following gap leaves an inspectable unresolved attempt,
-    // never an ownerless lock whose intended software cannot be recovered.
-    js.attempt = { ...(execution ? { schemaVersion: SCHEDULE_ATTEMPT_VERSION } : {}), scheduledFor: minute.toISOString(), startedAt: now.toISOString(), wallClock: new Date().toISOString(), ...(execution ? { execution } : {}) };
+    // Persist the attempt before even reserving the launch slot. A crash in
+    // the following gap leaves an inspectable unresolved attempt, never an
+    // ownerless lock.
+    js.attempt = { scheduledFor: minute.toISOString(), startedAt: now.toISOString(), wallClock: new Date().toISOString() };
     writeState(ws, st);
-    if (!acquireJobLock(ws, id, { scheduledFor: minute.toISOString(), ...(execution ? { executionId: execution.executionId } : {}) })) {
+    if (!acquireJobLock(ws, id, { scheduledFor: minute.toISOString() })) {
       delete js.attempt; writeState(ws, st); record(id, "skipped", { reason: "still running" }); continue;
     }
     js.lastLaunchedAt = now.toISOString();
     writeState(ws, st);
     let run;
-    const admitted = execution ? { ...def, cwd: execution.target.cwd, argv: execution.target.argv } : def;
-    try { run = def.kind === "spawn" ? launchSpawn(ws, def, minute, io) : launchCommand(ws, def.kind === "operation" ? operationAsCommand(def) : admitted, io); }
+    try { run = def.kind === "spawn" ? launchSpawn(ws, def, minute, io) : launchCommand(ws, def.kind === "operation" ? operationAsCommand(def) : def, io); }
     catch (e) {
       // spawnInstance compensates its own failures, but its rollback can be
       // INCOMPLETE (a pane it could not stop, a quarantined home it kept):
@@ -893,13 +749,13 @@ export function tickWorkspace(ws, { now = new Date(), io, reg, wsList, dryRun =
     }
     if (run.unconfirmed) {
       // Side effects unconfirmed: keep the attempt and the slot; reconcile decides.
-      js.lastRun = { scheduledFor: minute.toISOString(), startedAt: now.toISOString(), ...(execution ? { execution } : {}), ...run, outcome: "unknown" };
+      js.lastRun = { scheduledFor: minute.toISOString(), startedAt: now.toISOString(), ...run, outcome: "unknown" };
       record(id, "unknown", { error: run.error });
       continue;
     }
     delete js.attempt;
     const outcome = run.launched ? "launched" : "launch-failed";
-    js.lastRun = { scheduledFor: minute.toISOString(), startedAt: now.toISOString(), ...(execution ? { execution } : {}), ...run, outcome };
+    js.lastRun = { scheduledFor: minute.toISOString(), startedAt: now.toISOString(), ...run, outcome };
     if (!run.launched || !run.home) releaseJobLock(ws, id);
     record(id, outcome, { ...(run.error ? { error: run.error } : {}), ...(run.instance ? { instance: run.instance } : {}) });
   }
@@ -972,27 +828,25 @@ export function reconcile(ws, id, { io, now = new Date(), clear = false } = {})
   return withHostLock(() => {
     const st = readState(ws);
     const js = st.jobs[id] || (st.jobs[id] = {});
-    const attempt = js.attempt || (js.lastRun?.outcome === "unknown" ? { ...(js.lastRun.execution ? { schemaVersion: SCHEDULE_ATTEMPT_VERSION } : {}), scheduledFor: js.lastRun.scheduledFor, startedAt: js.lastRun.startedAt, ...(js.lastRun.execution ? { execution: js.lastRun.execution } : {}) } : undefined);
+    const attempt = js.attempt || (js.lastRun?.outcome === "unknown" ? { scheduledFor: js.lastRun.scheduledFor, startedAt: js.lastRun.startedAt, ...(js.lastRun.execution !== undefined ? { execution: js.lastRun.execution } : {}) } : undefined);
     if (!attempt) return { schedule: describe(ws, id, io), reconciled: "nothing to reconcile" };
     try { validateAttemptExecution(attempt, jobLockInfo(ws, id)); }
-    catch (error) { throw scheduleError("E_SCHEDULE_INVALID", `admitted execution capsule is invalid: ${error.message}`); }
-    const attemptKind = attempt.execution?.action.kind || def.kind;
+    catch (error) { throw scheduleError("E_SCHEDULE_INVALID", error.message); }
+    const attemptKind = def.kind;
     let adopted, ambiguous;
     if (attemptKind === "spawn" && attempt.scheduledFor) {
       const purpose = `${def.purpose || def.id}-${purposeSuffix(new Date(attempt.scheduledFor))}`;
-      const homes = findHomesInScope(ws, `${def.agent}-${purpose}`);
+      // Only a home of THIS schedule's soul: instance names are deployment-wide
+      // (0.26.0), so another soul's instance can never be this run's — a name it
+      // holds made this run's spawn derive a suffixed name instead.
+      const homes = findHomesInScope(ws, `${def.agent}-${purpose}`).filter((h) => {
+        try { const agent = JSON.parse(readFileSync(join(h, "instance.json"), "utf8")).agent; return typeof agent !== "string" || agent === def.agent; } catch { return true; }
+      });
       if (homes.length === 1) adopted = { instance: `${def.agent}-${purpose}`, home: homes[0] };
       else if (homes.length > 1) ambiguous = `${homes.length} homes named ${def.agent}-${purpose}: ${homes.join(", ")}`;
     } else if (attemptKind === "command" || attemptKind === "operation") {
       let named = [];
-      if (attempt.execution) {
-        // Only this admission's receipt may establish effects. Never borrow the
-        // previous run's name or consult current-config roster discovery.
-        if (receiptMatchesExecution(js.lastRun, attempt.execution) && typeof js.lastRun.home === "string" && isAbsolute(js.lastRun.home)) {
-          const home = resolve(js.lastRun.home), meta = readJson(join(home, "instance.json"), null);
-          if (meta?.instance === js.lastRun.instance && typeof meta.home === "string" && resolve(meta.home) === home) named = [{ instance: meta.instance, home }];
-        }
-      } else if (js.lastRun?.instance) named = findHomesInScope(ws, js.lastRun.instance).map((home) => ({ instance: js.lastRun.instance, home }));
+      if (js.lastRun?.instance) named = findHomesInScope(ws, js.lastRun.instance).map((home) => ({ instance: js.lastRun.instance, home }));
       if (named.length === 1) adopted = named[0];
       else if (named.length > 1) ambiguous = `${named.length} homes named ${js.lastRun.instance}: ${named.map((c) => c.home).join(", ")}`;
       else if (!clear) return { schedule: describe(ws, id, io), reconciled: "unknown", remedy: `the command's effects cannot be proven from a matching admitted receipt; check the roster and the host by hand, then run oats schedule reconcile ${id} --clear to record launch-failed and free the slot, or oats schedule remove --force ${id}` };
@@ -1002,10 +856,10 @@ export function reconcile(ws, id, { io, now = new Date(), clear = false } = {})
     delete js.attempt;
     if (adopted) {
       const seen = observeHome(adopted.home, io);
-      js.lastRun = { scheduledFor: attempt.scheduledFor, startedAt: js.lastRun?.startedAt || attempt.startedAt, kind: attemptKind, ...(attempt.execution ? { execution: attempt.execution } : {}), launched: true, ...adopted, outcome: seen.outcome, ...(seen.error ? { error: seen.error } : {}) };
-      if (seen.outcome !== "ended") { if (!jobLockInfo(ws, id)) acquireJobLock(ws, id, { scheduledFor: attempt.scheduledFor, reconciled: true, ...(attempt.execution ? { executionId: attempt.execution.executionId } : {}) }); } else releaseJobLock(ws, id);
+      js.lastRun = { scheduledFor: attempt.scheduledFor, startedAt: js.lastRun?.startedAt || attempt.startedAt, kind: attemptKind, launched: true, ...adopted, outcome: seen.outcome, ...(seen.error ? { error: seen.error } : {}) };
+      if (seen.outcome !== "ended") { if (!jobLockInfo(ws, id)) acquireJobLock(ws, id, { scheduledFor: attempt.scheduledFor, reconciled: true }); } else releaseJobLock(ws, id);
     } else {
-      js.lastRun = { scheduledFor: attempt.scheduledFor, startedAt: js.lastRun?.startedAt || attempt.startedAt, kind: attemptKind, ...(attempt.execution ? { execution: attempt.execution } : {}), launched: false, outcome: "launch-failed", error: clear ? "cleared by the operator after checking by hand" : "no instance found in the scope's roster for the unrecorded attempt" };
+      js.lastRun = { scheduledFor: attempt.scheduledFor, startedAt: js.lastRun?.startedAt || attempt.startedAt, kind: attemptKind, launched: false, outcome: "launch-failed", error: clear ? "cleared by the operator after checking by hand" : "no instance found in the scope's roster for the unrecorded attempt" };
       releaseJobLock(ws, id);
     }
     writeState(ws, st);
@@ -1021,7 +875,7 @@ function incarnationOfHome(home) { try { const m = JSON.parse(readFileSync(join(
  *  transcript: there is no reader behind this block. */
 function sessionProvenanceOf(r) {
   if (!r || typeof r !== "object") return null;
-  const delivery = r.startedRuntime ? "launched" : r.action === "delivered" || r.outcome === "delivered" || r.completedPending ? "delivered-active" : r.launched === true || r.instance ? "launched" : "none";
+  const delivery = r.startedHarness || r.startedRuntime ? "launched" : r.action === "delivered" || r.outcome === "delivered" || r.completedPending ? "delivered-active" : r.launched === true || r.instance ? "launched" : "none";
   return { instance: typeof r.instance === "string" ? r.instance : null, home: typeof r.home === "string" ? r.home : null, incarnation: typeof r.incarnation === "string" ? r.incarnation : null, server: typeof r.server === "string" ? r.server : null, delivery };
 }
 /** Read-time projection of one job's stored history: bounded to
@@ -1049,7 +903,7 @@ export function describe(ws, id, io, { defs, st, now = new Date() } = {}) {
   const js = st.jobs[id] || {};
   let nextRun = null; try { nextRun = def.enabled ? nextRunAfter(def, now) : null; } catch { nextRun = null; }
   const lock = jobLockInfo(ws, id);
-  const intent = js.attempt || (lock ? (js.lastRun?.execution ? { schemaVersion: SCHEDULE_ATTEMPT_VERSION, execution: js.lastRun.execution } : {}) : undefined);
+  const intent = js.attempt || (lock ? (js.lastRun?.execution !== undefined ? { execution: js.lastRun.execution } : {}) : undefined);
   const { history, recentRuns } = projectHistory(js);
   return { ...def, id, scope: ws, scheduleApi: 2, scheduleHistoryApi: SCHEDULE_HISTORY_API, executionStatus: scheduleExecutionStatus(def, intent, lock), nextRun, lastRun: js.lastRun ? { ...js.lastRun, runId: runIdOf(js.lastRun), session: sessionProvenanceOf(js.lastRun) } : null, history, recentRuns, running: !!lock, ...(js.attempt ? { attempt: js.attempt } : {}), ...(js.pendingWake ? { pendingWake: js.pendingWake } : {}) };
 }
@@ -1067,8 +921,6 @@ export function addSchedule(ws, spec, io) {
   return withScopeLock(ws, () => {
     const defs = readDefinitions(ws);
     if (defs.jobs[def.id]) throw scheduleError("E_SCHEDULE_EXISTS", `schedule ${def.id} already exists in ${ws}`);
-    if (defs.version === 2 && def.definitionVersion === undefined) throw scheduleError("migration-required", "version 2 schedule files require an explicit recurrence policy for new definitions");
-    if (def.definitionVersion === SCHEDULE_DEFINITION_VERSION) defs.version = 2;
     const now = new Date().toISOString();
     defs.jobs[def.id] = { ...def, createdAt: now, updatedAt: now };
     writeDefinitions(ws, defs);
@@ -1084,8 +936,6 @@ export function updateSchedule(ws, id, spec, io) {
   return withHostLock(() => withScopeLock(ws, () => {
     const defs = readDefinitions(ws);
     if (!defs.jobs[id]) throw scheduleError("E_SCHEDULE_UNKNOWN", `no schedule ${JSON.stringify(id)} in ${ws}`);
-    if (defs.jobs[id].definitionVersion !== undefined && def.definitionVersion === undefined) throw scheduleError("migration-required", "a versioned schedule definition cannot be downgraded to legacy execution");
-    if (def.definitionVersion === SCHEDULE_DEFINITION_VERSION) defs.version = 2;
     const identity = (d) => JSON.stringify([d.kind, d.agent, d.agentsRoot, d.repo, d.purpose, d.home, d.cwd, d.argv, d.operation, d.definitionVersion, d.recurrencePolicy, d.execution, d.preparation]);
     const busy = !!jobLockInfo(ws, id) || !!readState(ws).jobs[id]?.attempt;
     if (busy && identity(defs.jobs[id]) !== identity(def)) throw scheduleError("E_SCHEDULE_RUNNING", `schedule ${id} is running or has an unresolved attempt; its execution identity, kind, target and captured policy cannot change until it ends (cron, tz and enabled can)`);
@@ -1119,16 +969,10 @@ export function removeSchedule(ws, id, { force = false } = {}) {
   }));
 }
 /** Save the wake job for a freshly spawned instance (id wake-<instance>). */
-export function saveWakeForHome(ws, { instance, home, wake, executionBinding, responsibleHuman }) {
+export function saveWakeForHome(ws, { instance, home, wake }) {
   const id = `wake-${instance}`.slice(0, 40).replace(/-+$/, "");
   const spec = { id, enabled: wake.enabled === undefined ? true : wake.enabled, cron: wake.cron, tz: wake.tz, kind: "wake", home, message: wake.message };
-  if (executionBinding !== undefined || responsibleHuman !== undefined) {
-    if (executionBinding === undefined || responsibleHuman === undefined) throw scheduleError("needs-configuration", "captured wake creation needs both executionBinding and responsibleHuman");
-    const binding = validateExecutionBinding(executionBinding), actual = homeExecutionBinding(home);
-    if (binding.deployment !== actual.deployment || binding.resolution.id !== actual.resolution.id) throw scheduleError("E_SCHEDULE_INVALID", "spawn result executionBinding differs from the new home");
-    Object.assign(spec, { definitionVersion: SCHEDULE_DEFINITION_VERSION, recurrencePolicy: "capture", responsibleHuman });
-  }
-  return addSchedule(ws, spec); // Same whole-file version/policy gate as manual add.
+  return addSchedule(ws, spec);
 }
 /** Retirement hook: wake definitions bound to this home are removed (nothing is stopped). */
 export function removeWakeForHome(ws, home) {