@awebai/oats 0.39.4 → 0.40.2

package/lib/schedule.mjs

@@ -19,8 +19,9 @@
  *  observed (launched, active, ended, stopped, launch-failed, unknown;
  *  delivered, started, skipped for wake) and never claim that a task
  *  succeeded. A launch whose side effects cannot be confirmed stays
- *  `unknown` with its slot held until `reconcile` proves what happened. */
-import { spawnSync } from "node:child_process";
+ *  `unknown`, its job blocked until `reconcile` proves what happened; it keeps
+ *  its host slot too, unless it is a command whose process exit was observed. */
+import { runScheduleCommand } from "./schedule-command.mjs";
 import { closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { homedir } from "node:os";
@@ -33,12 +34,12 @@ import { herdrSettingRemoved } from "./errors.mjs";
 import { withDirLock as withSharedDirLock } from "./dir-lock.mjs";
 import { tickTriggers } from "./triggers.mjs";
 import { resolveMemberClone } from "./instance-resolution.mjs";
-import { AUTOMATION_ID_RE, MODEL_RE, automationContext, automationError, baseRow, localEntry, localId, soulOriginOf, splitId } from "./automations.mjs";
-import { RESERVED_LAUNCH_ENV, MAX_INSTANCE_NAME, findAgent, findInstanceHomes, inspectInstanceSession, inputInstanceSession, startInstanceSession, retirePendingMarkerPath } from "./core.mjs";
+import { SCHEDULE_NAME_RE, readSnapshot, MODEL_RE, automationContext, automationError, baseRow, localEntry, localId, soulOriginOf, splitId } from "./automations.mjs";
+import { RESERVED_LAUNCH_ENV, MAX_INSTANCE_NAME, shq, findAgent, findInstanceHomes, inspectInstanceSession, inputInstanceSession, startInstanceSession, retirePendingMarkerPath } from "./core.mjs";
 
 export const SCHEDULE_FILE = "oats-schedules.json";
 export const SCHEDULE_API = 2;
-const ID_RE = /^[a-z0-9-]{1,40}$/;
+const ID_RE = SCHEDULE_NAME_RE;
 const HARNESSES = new Set(["pi", "claude", "codex"]);
 const MESSAGE_MAX = 256 * 1024;
 const OATS_BIN = join(dirname(fileURLToPath(import.meta.url)), "..", "bin", "oats.mjs");
@@ -116,7 +117,7 @@ export const SCHEDULE_FILE_BUDGET = 1024 * 1024;
  *  O_NOFOLLOW|O_NONBLOCK open → fstat dev/ino identity → whole file only if
  *  within budget (an over-budget file is REFUSED as a typed error, never
  *  truncated into fabricated JSON). Returns { value, source }. */
-function readJsonBounded(path, fallback, label) {
+function readJsonBounded(path, fallback, label, { atomicReplace = false } = {}) {
   let st;
   try { st = lstatSync(path); }
   catch (e) { if (e.code === "ENOENT") return { value: fallback, source: { path: label, status: "absent", bytes: 0 } }; throw scheduleError("E_SCHEDULE_INVALID", `${path} cannot be read: ${e.message}`, { field: "file", source: { path: label, status: "refused", bytes: 0 } }); }
@@ -126,7 +127,10 @@ function readJsonBounded(path, fallback, label) {
   try {
     fd = openSync(path, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0) | (fsConstants.O_NONBLOCK ?? 0));
     const fst = fstatSync(fd);
-    if (!fst.isFile() || fst.dev !== st.dev || fst.ino !== st.ino || fst.size > SCHEDULE_FILE_BUDGET) throw new Error("swapped or grew past budget");
+    // The registry is atomically replaced by concurrent writers. Its opened,
+    // no-follow regular-file descriptor is a coherent old/new snapshot even
+    // when rename changed the inode since lstat. Other readers pin identity.
+    if (!fst.isFile() || (!atomicReplace && (fst.dev !== st.dev || fst.ino !== st.ino)) || fst.size > SCHEDULE_FILE_BUDGET) throw new Error("swapped or grew past budget");
     const buf = Buffer.alloc(fst.size); let got = 0;
     while (got < fst.size) { const n = readSync(fd, buf, got, fst.size - got, got); if (n <= 0) break; got += n; }
     text = buf.toString("utf8"); st = fst;
@@ -204,22 +208,73 @@ export function writeState(ws, st) { recordRecentRuns(st); writeJson(statePath(w
 
 // ------------------------------------------------------- host registry
 
-export function readRegistry() {
-  const reg = readJson(join(hostScheduleDir(), "registry.json"), { version: 1, maxConcurrent: 1, tickIntervalSec: 60, workspaces: [] });
+const DEFAULT_MAX_CONCURRENT = 5;
+const scheduleCap = (reg) => reg.maxConcurrent ?? DEFAULT_MAX_CONCURRENT;
+
+/** Decode a bounded atomic-file snapshot without locks or filesystem writes. */
+function readRegistryDocument() {
+  const path = join(hostScheduleDir(), "registry.json");
+  const reg = readJsonBounded(path, { version: 1, capsVersion: 2, tickIntervalSec: 60, workspaces: [] }, "registry.json", { atomicReplace: true }).value;
+  if (!reg || typeof reg !== "object" || Array.isArray(reg)) throw scheduleError("E_SCHEDULE_INVALID", `${path} must contain a registry object`, { field: "file" });
+  return reg;
+}
+const validCap = (value) => Number.isSafeInteger(value) && value >= 1;
+/** Project legacy defaults in memory. Only locked mutations persist this. */
+function normalizeRegistry(reg) {
+  const path = join(hostScheduleDir(), "registry.json");
   if (!Array.isArray(reg.workspaces)) reg.workspaces = [];
-  if (!Number.isInteger(reg.maxConcurrent) || reg.maxConcurrent < 1) reg.maxConcurrent = 1;
+  if (reg.maxConcurrent !== undefined && !validCap(reg.maxConcurrent)) {
+    throw scheduleError("E_SCHEDULE_INVALID", `${path}: maxConcurrent must be a positive safe integer, or absent for the default (got ${JSON.stringify(reg.maxConcurrent)}); correct it with oats schedule host install --max-concurrent <N|default> --dir <deployment>`, { field: "maxConcurrent" });
+  }
   if (!Number.isInteger(reg.tickIntervalSec) || reg.tickIntervalSec < 60) reg.tickIntervalSec = 60;
-  // The host cap on trigger-spawned live instances (re-review B #5): absent = unbounded (each
-  // trigger's own concurrency.max still applies). Separate from maxConcurrent: a running scheduled
-  // job never holds a trigger, and trigger homes never hold a schedule. Hand-edited, so refused loudly.
-  if (reg.triggersMaxConcurrent !== undefined && !(Number.isSafeInteger(reg.triggersMaxConcurrent) && reg.triggersMaxConcurrent >= 1)) {
-    throw scheduleError("E_SCHEDULE_INVALID", `${join(hostScheduleDir(), "registry.json")}: triggersMaxConcurrent must be a positive integer, or absent for no host cap (got ${JSON.stringify(reg.triggersMaxConcurrent)})`, { field: "triggersMaxConcurrent" });
+  // Trigger and schedule caps are independent; absent trigger cap is unbounded.
+  if (reg.triggersMaxConcurrent !== undefined && !validCap(reg.triggersMaxConcurrent)) {
+    throw scheduleError("E_SCHEDULE_INVALID", `${path}: triggersMaxConcurrent must be a positive integer, or absent for no host cap (got ${JSON.stringify(reg.triggersMaxConcurrent)})`, { field: "triggersMaxConcurrent" });
+  }
+  if ((reg.capsVersion ?? 1) < 2) {
+    if (reg.maxConcurrent === 1) delete reg.maxConcurrent;
+    reg.capsVersion = 2;
   }
   return reg;
 }
+export function readRegistry() { return normalizeRegistry(readRegistryDocument()); }
+/** Raw atomic write: no normalization or locking. Read-modify-write callers
+ * must hold registry.lock and reread there; readers never persist migration. */
 export function writeRegistry(reg) { writeJson(join(hostScheduleDir(), "registry.json"), reg); }
-export function registerWorkspace(ws) { return withRegistryLock(() => { const reg = readRegistry(); const abs = resolve(ws); if (!reg.workspaces.includes(abs)) { reg.workspaces.push(abs); writeRegistry(reg); } return reg; }); }
-export function unregisterWorkspace(ws) { return withRegistryLock(() => { const reg = readRegistry(); reg.workspaces = reg.workspaces.filter((w) => w !== resolve(ws)); writeRegistry(reg); return reg; }); }
+function updateRegistry(change, caps = {}) {
+  return withRegistryLock(() => {
+    const raw = readRegistryDocument(), before = JSON.stringify(raw);
+    const legacyOne = (raw.capsVersion ?? 1) < 2 && raw.maxConcurrent === 1;
+    // A validated explicit replacement can repair an invalid stored schedule
+    // cap; an ordinary read or unrelated write must refuse it, never default.
+    if (caps.maxConcurrent !== undefined && !validCap(raw.maxConcurrent)) delete raw.maxConcurrent;
+    const reg = normalizeRegistry(raw);
+    for (const [field, reset] of [["maxConcurrent", "default"], ["triggersMaxConcurrent", "none"]]) {
+      if (caps[field] === reset) delete reg[field];
+      else if (caps[field] !== undefined) reg[field] = caps[field];
+    }
+    change(reg);
+    // Compare with the raw snapshot so even unchanged membership persists the
+    // migration, without a separate write or a stale pre-lock read.
+    if (JSON.stringify(reg) !== before) {
+      writeRegistry(reg);
+      if (legacyOne && (caps.maxConcurrent === undefined || caps.maxConcurrent === "default")) {
+        process.stderr.write("oats: warning: migrated legacy maxConcurrent: 1 to the default of 5; an old explicit 1 cannot be distinguished from the old implicit default. To restore one slot, run oats schedule host install --max-concurrent 1 --dir <deployment>. Stop older oats binaries from writing this shared registry.\n");
+      }
+    }
+    return reg;
+  });
+}
+export function registerWorkspace(ws, caps = {}) {
+  for (const [field, reset] of [["maxConcurrent", "default"], ["triggersMaxConcurrent", "none"]]) {
+    const value = caps[field];
+    if (value !== undefined && value !== reset && !validCap(value)) {
+      throw scheduleError("E_BAD_ARGS", `${field} must be a positive safe integer or ${reset}`, { field });
+    }
+  }
+  return updateRegistry((reg) => { const abs = resolve(ws); if (!reg.workspaces.includes(abs)) reg.workspaces.push(abs); }, caps);
+}
+export function unregisterWorkspace(ws) { return updateRegistry((reg) => { reg.workspaces = reg.workspaces.filter((w) => w !== resolve(ws)); }); }
 export function readHostState() { return readJson(join(hostScheduleDir(), "state.json"), {}); }
 export function writeHostState(st) { writeJson(join(hostScheduleDir(), "state.json"), st); }
 
@@ -268,6 +323,11 @@ export function validateCron(cron, tz, field = "cron") {
   try { return new Cron(cron.trim(), { timezone: tz, paused: true }); }
   catch (e) { throw scheduleError("E_SCHEDULE_INVALID", `${field}: ${e.message}`, { field }); }
 }
+/** A definition's `description`: a label for people (list, show, the Desktop), never read by a run. */
+const DESCRIPTION_MAX = 200;
+function validateDescription(description) {
+  if (typeof description !== "string" || !description.length || [...description].length > DESCRIPTION_MAX || /[\p{Cc}\u2028\u2029]/u.test(description)) throw scheduleError("E_SCHEDULE_INVALID", `description: one line of 1 to ${DESCRIPTION_MAX} characters, without control characters`, { field: "description" });
+}
 function validateMessage(message, field) {
   if (typeof message !== "string" || !message.trim() || message.includes("\0") || Buffer.byteLength(message) > MESSAGE_MAX) throw scheduleError("E_SCHEDULE_INVALID", `${field}: non-empty text without NUL, at most 256 KiB`, { field });
 }
@@ -286,11 +346,12 @@ export function validateDefinition(ws, def, { checkAgent = true, backendSource }
   if (!def || typeof def !== "object" || Array.isArray(def)) throw scheduleError("E_SCHEDULE_INVALID", "definition must be an object", { field: "definition" });
   if (def.kind === "trigger") throw scheduleError("E_SCHEDULE_INVALID", "kind: a trigger is added with `oats trigger add`, not `oats schedule add`", { field: "kind" });
   const id = def.id;
-  if (typeof id !== "string" || !ID_RE.test(id)) throw scheduleError("E_SCHEDULE_INVALID", "id: lowercase letters, digits and dashes, 1 to 40 characters", { field: "id" });
+  if (typeof id !== "string" || !ID_RE.test(id)) throw scheduleError("E_SCHEDULE_INVALID", "id: lowercase letters, digits and dashes, 1 to 100 characters", { field: "id" });
   const enabled = def.enabled === undefined ? true : def.enabled;
   if (typeof enabled !== "boolean") throw scheduleError("E_SCHEDULE_INVALID", "enabled: boolean", { field: "enabled" });
   validateCron(def.cron, def.tz);
   const out = { id, enabled, cron: def.cron.trim(), tz: def.tz.trim(), kind: def.kind };
+  if (def.description !== undefined) { validateDescription(def.description); out.description = def.description; }
   if (def.kind === "spawn") {
     if (typeof def.agent !== "string" || !def.agent.trim() || def.agent.trim().startsWith("-")) throw scheduleError("E_SCHEDULE_INVALID", "agent: soul name required (not an option)", { field: "agent" });
     out.agent = def.agent.trim();
@@ -535,12 +596,14 @@ function spawnViaCli(ws, root, agent, opts, context, io) {
   writeFileSync(taskFile, opts.task, { mode: 0o600 });
   argv.push(`--task-file=${taskFile}`);
   let r;
-  try { r = spawnSync(process.execPath, [io?.oatsBin || OATS_BIN, ...argv], { cwd: context.dir, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: io?.commandTimeoutMs || COMMAND_TIMEOUT_MS, killSignal: "SIGTERM", maxBuffer: 16 * 1024 * 1024, env: childEnv() }); }
+  try { r = runScheduleCommand(process.execPath, [io?.oatsBin || OATS_BIN, ...argv], { cwd: context.dir, timeout: io?.commandTimeoutMs || COMMAND_TIMEOUT_MS, graceMs: io?.commandGraceMs, maxBuffer: 16 * 1024 * 1024, env: childEnv() }); }
   finally { try { rmSync(taskFile, { force: true }); } catch { /* best effort */ } }
-  const timedOut = r.error?.code === "ETIMEDOUT" || (r.status === null && r.signal === "SIGTERM");
+  const interrupted = r.interrupted === true;
+  const timedOut = r.error?.code === "ETIMEDOUT" || (!interrupted && r.status === null && ["SIGTERM", "SIGKILL"].includes(r.signal));
   const envelope = parseEnvelopeText(r.stdout);
   // The child may have created (and launched) a home before dying: unconfirmed, never a confirmed failure.
   // The thrown message reports RETAINED effects so the tick keeps the attempt and its slot for reconcile.
+  if (interrupted) throw scheduleError("E_SPAWN_UNCONFIRMED", "workspace spawn was interrupted; its effects could not be confirmed (a home may have been created) — run oats schedule reconcile");
   if (timedOut) throw scheduleError("E_SPAWN_UNCONFIRMED", "workspace spawn timed out; its effects could not be confirmed (a home may have been created) — run oats schedule reconcile");
   if (!envelope || typeof envelope !== "object" || typeof envelope.ok !== "boolean") throw scheduleError("E_SPAWN_UNCONFIRMED", `workspace spawn answered no valid envelope (exit ${r.status ?? r.signal}); its effects could not be confirmed — run oats schedule reconcile${r.stderr ? `: ${String(r.stderr).trim().split("\n").pop()}` : ""}`);
   if (!envelope.ok) {
@@ -591,25 +654,32 @@ export function parseEnvelopeText(text) {
 }
 /** Run one command job: oats-only argv in the job's cwd. A timeout or an
  *  unparseable answer means the side effects are unconfirmed: `unknown`,
- *  never `launch-failed`. `io.oatsBin` and `io.commandTimeoutMs` are test seams. */
+ *  never `launch-failed`. An unconfirmed answer carries `exit` ({status,
+ *  signal}) when the process's exit was observed. The supervisor sends SIGTERM
+ *  at the timeout and SIGKILL after the grace, and observes the direct child's
+ *  exit before returning. `io.command`, `io.oatsBin`, `io.commandTimeoutMs`
+ *  and `io.commandGraceMs` are test seams; `io.command` counts as exited. */
 function launchCommand(ws, def, io) {
   const argv = def.argv.includes("--json") ? def.argv.slice(1) : [...def.argv.slice(1), "--json"];
-  let envelope, timedOut = false, raw = "";
-  if (io?.command) envelope = io.command({ cwd: def.cwd, argv });
+  let envelope, timedOut = false, interrupted = false, raw = "", exit;
+  if (io?.command) { envelope = io.command({ cwd: def.cwd, argv }); exit = { status: null, signal: null }; }
   else {
-    const r = spawnSync(process.execPath, [io?.oatsBin || OATS_BIN, ...argv], { cwd: def.cwd, encoding: "utf8", timeout: io?.commandTimeoutMs || COMMAND_TIMEOUT_MS, killSignal: "SIGTERM", maxBuffer: 16 * 1024 * 1024, env: childEnv() });
-    timedOut = r.error?.code === "ETIMEDOUT" || (r.status === null && r.signal === "SIGTERM");
+    const r = runScheduleCommand(process.execPath, [io?.oatsBin || OATS_BIN, ...argv], { cwd: def.cwd, timeout: io?.commandTimeoutMs || COMMAND_TIMEOUT_MS, graceMs: io?.commandGraceMs, maxBuffer: 16 * 1024 * 1024, env: childEnv() });
+    interrupted = r.interrupted === true;
+    timedOut = r.error?.code === "ETIMEDOUT" || (!interrupted && r.status === null && ["SIGTERM", "SIGKILL"].includes(r.signal));
+    if (r.status !== null || r.signal !== null) exit = { status: r.status, signal: r.signal };
     raw = String(r.stdout || "");
     envelope = parseEnvelopeText(raw);
   }
-  // No envelope, a malformed one, or a timeout: the process may still have
+  const exited = exit ? { exit } : {};
+  // No envelope, a malformed one, a timeout, or supervisor interruption: the process may still have
   // created a home. That is unconfirmed, never a confirmed failure.
-  if (timedOut || !envelope || typeof envelope !== "object" || typeof envelope.ok !== "boolean") return { kind: "command", launched: false, unconfirmed: true, error: timedOut ? "command timed out; its side effects are unconfirmed" : "command answered no valid envelope; its side effects are unconfirmed" };
+  if (interrupted || timedOut || !envelope || typeof envelope !== "object" || typeof envelope.ok !== "boolean") return { kind: "command", launched: false, unconfirmed: true, ...exited, error: interrupted ? "command was interrupted; its side effects are unconfirmed" : timedOut ? "command timed out; its side effects are unconfirmed" : "command answered no valid envelope; its side effects are unconfirmed" };
   const res = envelope?.result || {};
   const instance = typeof res.instance === "string" ? res.instance : undefined;
   let home = typeof res.home === "string" ? res.home : undefined;
   if (instance && !home) { const found = findHomesInScope(ws, instance); if (found.length === 1) home = found[0]; }
-  if (envelope.ok && instance && !home) return { kind: "command", launched: true, instance, unconfirmed: true, error: `the envelope names instance ${instance} but no home for it is in this scope's roster; run oats schedule reconcile once it appears` };
+  if (envelope.ok && instance && !home) return { kind: "command", launched: true, instance, unconfirmed: true, ...exited, error: `the envelope names instance ${instance} but no home for it is in this scope's roster; run oats schedule reconcile once it appears` };
   // A valid ok:false answer that reports an incomplete rollback (a harvest
   // spawn whose compensation could not stop or remove everything), or an
   // operation runner's unconfirmed outcome (timeout, no valid receipt, a
@@ -619,7 +689,7 @@ function launchCommand(ws, def, io) {
   if (!envelope.ok && (UNCONFIRMED_ERROR_CODES.has(envelope.error?.code) || envelope.error?.details?.unconfirmed === true || reportsRetainedEffects(envelope.error?.message))) {
     const partial = envelope.error?.details?.envelope?.result;
     const named = instance || (partial && typeof partial.instance === "string" ? partial.instance : undefined);
-    return { kind: "command", launched: false, unconfirmed: true, ...(named ? { instance: named } : {}), error: `command outcome unconfirmed: ${envelope.error?.message}`, errorCode: envelope.error?.code };
+    return { kind: "command", launched: false, unconfirmed: true, ...exited, ...(named ? { instance: named } : {}), error: `command outcome unconfirmed: ${envelope.error?.message}`, errorCode: envelope.error?.code };
   }
   // Provenance the recorder has at write time: the answering server (remote
   // spawn) and the launched home's incarnation. Never a transcript.
@@ -721,7 +791,7 @@ export function tickWorkspace(ws, { now = new Date(), io, reg, wsList, dryRun =
   const minute = minuteStart(now);
   const key = minuteKey(minute);
   const registry = reg || readRegistry();
-  const bound = registry.maxConcurrent || 1;
+  const bound = scheduleCap(registry);
   const wsAll = wsList || [ws];
   const defs = effectiveDefinitions(ws, ctx);
   const st = readState(ws);
@@ -776,7 +846,11 @@ export function tickWorkspace(ws, { now = new Date(), io, reg, wsList, dryRun =
       let invalid;
       try { validateAttemptExecution(js.attempt, jobLockInfo(ws, id)); } catch (error) { invalid = error; }
       record(id, invalid ? "invalid" : "skipped", { reason: invalid ? `admitted attempt is invalid (${invalid.code || "error"}): ${invalid.message}` : "an earlier launch has no recorded result; run oats schedule reconcile", ...(invalid ? { errorCode: invalid.code } : {}) });
-      js.lastRun = { ...(js.lastRun || {}), outcome: "unknown", error: invalid ? `invalid admitted attempt: ${invalid.message}` : "launch attempt without a recorded result", ...(invalid ? { errorCode: invalid.code } : {}), scheduledFor: js.attempt.scheduledFor };
+      // Older kernels kept the cause only on lastRun. Adopt it only for this
+      // attempt: a crash before recording the result can leave a prior run there.
+      const sameRun = js.lastRun?.outcome === "unknown" && js.lastRun.scheduledFor === js.attempt.scheduledFor && js.lastRun.startedAt === js.attempt.startedAt;
+      js.attempt.error ??= (sameRun ? js.lastRun.error : null) ?? "launch attempt without a recorded result";
+      js.lastRun = { ...(sameRun ? js.lastRun : { kind: def.kind }), outcome: "unknown", error: invalid ? `invalid admitted attempt: ${invalid.message}` : js.attempt.error, ...(invalid ? { errorCode: invalid.code } : {}), scheduledFor: js.attempt.scheduledFor, startedAt: js.attempt.startedAt };
       continue;
     }
     if (def.kind === "wake") {
@@ -813,8 +887,14 @@ export function tickWorkspace(ws, { now = new Date(), io, reg, wsList, dryRun =
       run = { kind: def.kind, launched: false, error: e.message, errorCode: e.code, unconfirmed: def.kind !== "spawn" || reportsRetainedEffects(e.message) };
     }
     if (run.unconfirmed) {
-      // Side effects unconfirmed: keep the attempt and the slot; reconcile decides.
-      js.lastRun = { scheduledFor: minute.toISOString(), startedAt: now.toISOString(), ...run, outcome: "unknown" };
+      // Side effects unconfirmed: keep the attempt, with its first error; reconcile decides.
+      // A command (or operation) whose process exit was observed runs nothing any more,
+      // so it frees its host slot; its attempt still blocks the job itself. Anything else
+      // (a spawn, a command that threw) keeps the slot.
+      const { exit, ...facts } = run;
+      js.attempt = { ...js.attempt, error: run.error, ...(exit ? { exited: true, exitStatus: exit.status, exitSignal: exit.signal } : {}) };
+      js.lastRun = { scheduledFor: minute.toISOString(), startedAt: now.toISOString(), ...facts, outcome: "unknown" };
+      if (exit) releaseJobLock(ws, id);
       record(id, "unknown", { error: run.error });
       continue;
     }
@@ -894,7 +974,7 @@ export function runNow(ws, qid, { now = new Date(), io, force = false, ctx = nul
     writeState(ws, st);
     if (js.attempt) throw scheduleError("E_SCHEDULE_UNRESOLVED", `schedule ${id} has a launch attempt without a recorded result; run oats schedule reconcile ${id} first`);
     if (def.kind !== "wake" && jobLockInfo(ws, id)) throw scheduleError("E_SCHEDULE_RUNNING", `schedule ${id} is still running`);
-    if (def.kind !== "wake" && liveLocks(wsList) >= reg.maxConcurrent) throw scheduleError("E_SCHEDULER_BUSY", `host concurrency ${reg.maxConcurrent} reached`);
+    if (def.kind !== "wake" && liveLocks(wsList) >= scheduleCap(reg)) throw scheduleError("E_SCHEDULER_BUSY", `host concurrency ${scheduleCap(reg)} reached`);
     const considered = tickWorkspace(ws, { now, io, reg, wsList, only: id, ctx });
     const after = readState(ws);
     if (after.jobs[id]) { after.jobs[id].lastAttemptedMinute = minuteKey(minuteStart(now)); writeState(ws, after); }
@@ -933,8 +1013,7 @@ export function reconcile(ws, qid, { io, now = new Date(), clear = false, ctx =
       if (homes.length === 1) adopted = { instance: `${def.agent}-${purpose}`, home: homes[0] };
       else if (homes.length > 1) ambiguous = `${homes.length} homes named ${def.agent}-${purpose}: ${homes.join(", ")}`;
     } else if (attemptKind === "command" || attemptKind === "operation") {
-      let named = [];
-      if (js.lastRun?.instance) named = findHomesInScope(ws, js.lastRun.instance).map((home) => ({ instance: js.lastRun.instance, home }));
+      const named = namedHomes(ws, js);
       if (named.length === 1) adopted = named[0];
       else if (named.length > 1) ambiguous = `${named.length} homes named ${js.lastRun.instance}: ${named.map((c) => c.home).join(", ")}`;
       else if (!clear) return { schedule: describeHere(), reconciled: "unknown", remedy: `the command's effects cannot be proven from a matching admitted receipt; check the roster and the host by hand, then run oats schedule reconcile ${id} --clear to record launch-failed and free the slot, or oats schedule remove --force ${id}` };
@@ -955,6 +1034,60 @@ export function reconcile(ws, qid, { io, now = new Date(), clear = false, ctx =
   });
 }
 
+/** The homes in the scope of the instance a command attempt's answer named: its only adoptable
+ *  receipt. Exactly one is adoptable; none or several leave its effects unproven. */
+function namedHomes(ws, js) {
+  const instance = js.lastRun?.instance;
+  return instance ? findHomesInScope(ws, instance).map((home) => ({ instance, home })) : [];
+}
+
+/** `oats doctor`: every launch attempt without a recorded result (what reconcile acts on: an
+ *  attempt, or a lastRun left `unknown`) in the deployment `dep` and in the other scopes this host
+ *  ticks, which share its slots. Each is a warning with its age, whether it holds a host slot and
+ *  the reconcile command; `--clear` when it is a command whose effects no named home proves.
+ *  Reads state only. → { problems, information } */
+export function unresolvedScheduleAttempts(dep, { now = new Date() } = {}) {
+  const problems = [], information = [];
+  const here = resolve(dep);
+  let scopes = [here];
+  try { scopes = [here, ...readRegistry().workspaces.filter((w) => resolve(w) !== here && existsSync(w))]; }
+  catch (e) { information.push(`the host schedule registry could not be read, so only this deployment's schedules were checked: ${e.message}`); }
+  for (const ws of scopes) {
+    let defs, st;
+    try { defs = readDefinitions(ws); st = readState(ws); }
+    catch (e) { information.push(`the schedules of ${ws} could not be read: ${e.message}`); continue; }
+    // Read the last discovery snapshot directly: placement and refresh would
+    // require credentials/network, and unresolved work matters even when offline.
+    const workspaceKinds = new Map((readSnapshot(ws)?.schedules || []).map((entry) => [entry.id, entry.definition?.kind]));
+    for (const [key, js] of Object.entries(st.jobs)) {
+      if (!js?.attempt && js?.lastRun?.outcome !== "unknown") continue;
+      // A workspace schedule's state key is <member>~<id> (scheduleStateKey); a local one is its id.
+      const workspace = key.includes("~");
+      if (!workspace && !defs.jobs[key]) continue;
+      const id = workspace ? key.replace("~", "/") : key;
+      const kind = (workspace ? workspaceKinds.get(id) : defs.jobs[key]?.kind) ?? js.lastRun?.kind ?? null;
+      const scheduledFor = js.attempt?.scheduledFor ?? js.lastRun?.scheduledFor ?? null;
+      const startedAt = js.attempt?.startedAt ?? js.lastRun?.startedAt ?? null;
+      const started = Date.parse(startedAt);
+      const ageSeconds = Number.isNaN(started) ? null : Math.max(0, Math.floor((now.getTime() - started) / 1000));
+      const holdsSlot = !!jobLockInfo(ws, key);
+      const error = js.attempt?.error ?? js.lastRun?.error ?? null;
+      const unproven = (kind === "command" || kind === "operation") && namedHomes(ws, js).length !== 1;
+      const dir = ws === here ? "" : ` --dir ${/^[\w./@%+=:,-]+$/.test(ws) ? ws : shq(ws)}`;
+      const remedy = `oats schedule reconcile ${id}${unproven ? " --clear" : ""}${dir}`;
+      const message = `schedule ${id}${ws === here ? "" : ` (in ${ws})`}: ${kind ? `a ${kind}` : "a"} launch attempt for ${scheduledFor} has no recorded result (started ${startedAt}${ageSeconds === null ? "" : `, ${formatAge(ageSeconds)} ago`})${error ? `: ${error}` : ""}. The job does not run again until it is reconciled, and ${holdsSlot ? "it holds a host slot (counted against maxConcurrent)" : "it holds no host slot"}. ${unproven ? `Its effects can't be proven: check the roster and the host by hand, then run ${remedy}` : `Run ${remedy}`}`;
+      problems.push({ code: "schedule-unresolved", severity: "warning", scope: ws, id, kind, scheduledFor, startedAt, ageSeconds, holdsSlot, exited: js.attempt?.exited === true, error, remedy, message });
+    }
+  }
+  return { problems, information };
+}
+function formatAge(s) {
+  if (s < 60) return `${s}s`;
+  if (s < 3600) return `${Math.floor(s / 60)}m`;
+  if (s < 86400) return `${Math.floor(s / 3600)}h ${Math.floor((s % 3600) / 60)}m`;
+  return `${Math.floor(s / 86400)}d ${Math.floor((s % 86400) / 3600)}h`;
+}
+
 // -------------------------------------------------------- definitions CRUD
 
 export const SCHEDULE_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
@@ -985,7 +1118,8 @@ export function testSchedule(ws, qid, io, { now = new Date(), ctx = null } = {})
       if (def.launchConfig) argv.push(`--launch-config=${def.launchConfig}`);
       if (def.harness) argv.push(`--harness=${def.harness}`);
       if (def.model) argv.push(`--model=${def.model}`);
-      const r = spawnSync(process.execPath, [io?.oatsBin || OATS_BIN, ...argv], { cwd: context.dir, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: io?.commandTimeoutMs || COMMAND_TIMEOUT_MS, killSignal: "SIGTERM", maxBuffer: 16 * 1024 * 1024, env: childEnv() });
+      const r = runScheduleCommand(process.execPath, [io?.oatsBin || OATS_BIN, ...argv], { cwd: context.dir, timeout: io?.commandTimeoutMs || COMMAND_TIMEOUT_MS, graceMs: io?.commandGraceMs, maxBuffer: 16 * 1024 * 1024, env: childEnv() });
+      if (r.interrupted === true) throw scheduleError("E_SPAWN_FAILED", "the spawn preview was interrupted; its result is unconfirmed");
       const envelope = parseEnvelopeText(r.stdout);
       if (!envelope || typeof envelope.ok !== "boolean") throw scheduleError("E_SPAWN_FAILED", `the spawn preview answered no valid envelope (exit ${r.status ?? r.signal})`);
       if (!envelope.ok) throw scheduleError(envelope.error?.code || "E_SPAWN_FAILED", String(envelope.error?.message || "spawn preview failed"));
@@ -1036,7 +1170,7 @@ function projectHistory(js) {
 export function describe(ws, qid, io, { defs, st, now = new Date(), ctx = null } = {}) {
   if (typeof qid !== "string" || !qid) throw scheduleError("E_BAD_ARGS", `oats schedule show <id> (local/<id> or <member>/<id>)`);
   const { scope, name } = splitId(qid);
-  if (scope !== "local" && (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(scope) || !AUTOMATION_ID_RE.test(name))) throw scheduleError("E_BAD_ARGS", `a workspace schedule id is <member>/<id> (got ${JSON.stringify(qid)})`);
+  if (scope !== "local" && (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(scope) || !SCHEDULE_NAME_RE.test(name))) throw scheduleError("E_BAD_ARGS", `a workspace schedule id is <member>/<id> (got ${JSON.stringify(qid)})`);
   const entry = scope === "local" ? null : (ctx?.schedules || []).find((x) => x.id === `${scope}/${name}`);
   if (scope !== "local" && !entry) throw notHere(ws, `${scope}/${name}`, ctx);
   if (entry && !entry.placement.runsHere) return scheduleRow(ws, entry, { ...(entry.definition || {}), scope: ws, scheduleApi: 2, scheduleHistoryApi: SCHEDULE_HISTORY_API, nextRun: null, lastRun: null, running: false }, ctx);
@@ -1056,7 +1190,7 @@ export function describe(ws, qid, io, { defs, st, now = new Date(), ctx = null }
   const { workspace: _w, ...stored } = def; void _w;
   const base = { ...stored, id, scope: ws, scheduleApi: 2, scheduleHistoryApi: SCHEDULE_HISTORY_API, executionStatus: scheduleExecutionStatus(def, intent, lock), nextRun, lastRun: js.lastRun ? { ...js.lastRun, runId: runIdOf(js.lastRun), session: sessionProvenanceOf(js.lastRun) } : null, history, recentRuns, running: !!lock, ...(js.attempt ? { attempt: js.attempt } : {}), ...(js.pendingWake ? { pendingWake: js.pendingWake } : {}) };
   const herdr = entry ? null : storedHerdrBackend(ws, id, def);
-  return scheduleRow(ws, entry ?? localEntry("schedule", { ...def, id: name }, { dep: ws, ...(herdr ? { invalid: { code: herdr.code, message: herdr.message, field: herdr.field } } : {}) }), base, ctx);
+  return scheduleRow(ws, entry ?? { ...localEntry("schedule", { ...def, id: name }, { dep: ws, ...(herdr ? { invalid: { code: herdr.code, message: herdr.message, field: herdr.field } } : {}) }), description: def.description ?? null }, base, ctx);
 }
 /** A schedule's list row: its stored facts, the fields every trigger and schedule row share
  *  (lib/automations.mjs baseRow) and the schedule's own: `kind` is its run (spawn, command, wake,
@@ -1157,7 +1291,7 @@ function localScheduleId(qid, verb) {
 }
 /** Save the wake job for a freshly spawned instance (id wake-<instance>). */
 export function saveWakeForHome(ws, { instance, home, wake }) {
-  const id = `wake-${instance}`.slice(0, 40).replace(/-+$/, "");
+  const id = `wake-${instance}`.slice(0, 100).replace(/-+$/, "");
   const spec = { id, enabled: wake.enabled === undefined ? true : wake.enabled, cron: wake.cron, tz: wake.tz, kind: "wake", home, message: wake.message };
   return addSchedule(ws, spec);
 }
@@ -1192,5 +1326,5 @@ export function schedulerStatus(ws, io) {
   const host = readHostState();
   let unit = { installed: false, active: false };
   try { unit = (io?.hostStatus || (() => ({ installed: false, active: false, unavailable: true })))(); } catch (e) { unit = { installed: false, active: false, error: e.message }; }
-  return { installed: !!unit.installed, active: !!unit.active, ...(unit.unit ? { unit: unit.unit } : {}), ...(unit.error ? { error: unit.error } : {}), lastTick: host.lastTick || null, maxConcurrent: reg.maxConcurrent, tickIntervalSec: reg.tickIntervalSec, ...(ws ? { workspace: resolve(ws), registered: reg.workspaces.includes(resolve(ws)) } : {}), workspaces: reg.workspaces, live: liveLocks(reg.workspaces.filter((w) => existsSync(w))) };
+  return { installed: !!unit.installed, active: !!unit.active, ...(unit.unit ? { unit: unit.unit } : {}), ...(unit.error ? { error: unit.error } : {}), lastTick: host.lastTick || null, maxConcurrent: scheduleCap(reg), triggersMaxConcurrent: reg.triggersMaxConcurrent ?? null, tickIntervalSec: reg.tickIntervalSec, ...(ws ? { workspace: resolve(ws), registered: reg.workspaces.includes(resolve(ws)) } : {}), workspaces: reg.workspaces, live: liveLocks(reg.workspaces.filter((w) => existsSync(w))) };
 }

package/lib/servers.mjs

@@ -23,6 +23,7 @@ import { homedir } from "node:os";
 import { basename, join, resolve } from "node:path";
 import { parseStrictJson } from "./canonical-json.mjs";
 import { noteRuntimeName } from "./deprecation.mjs";
+import { readWaitingClaim } from "./instance-events.mjs";
 import { withDirLock } from "./dir-lock.mjs";
 
 const OATS_HOME_DIR = () => process.env.OATS_HOME_DIR || join(homedir(), ".oats");
@@ -784,6 +785,11 @@ function listSnapshotServers() {
  *  derived here. */
 export const REMOTE_ROW_FACTS = ["identity", "identityAddress", "teams", "startedAt", "createdAt", "model", "runtimeState", "parentInstance", "siblingInstance", "relation", "relativeTo", "spawnOrigin"];
 const rowFacts = (i = {}) => Object.fromEntries(REMOTE_ROW_FACTS.map((k) => [k, i[k] ?? null]));
+/** `waitingOnYou` (feature waiting-on-you) is relayed ONLY when the host's row has the
+ *  key, so it is not one of REMOTE_ROW_FACTS: a host whose kernel predates the feature
+ *  omits it, and absent ("not reported") must stay distinct from null ("no claim"). The
+ *  value passes the kernel's own read rule again; anything it refuses is null. */
+const rowWaiting = (i) => (Object.hasOwn(i, "waitingOnYou") ? { waitingOnYou: readWaitingClaim(i.waitingOnYou) } : {});
 
 export function rosterGroups({ server, io = {} } = {}) {
   const started = Date.now();
@@ -841,7 +847,7 @@ export function rosterGroups({ server, io = {} } = {}) {
             harness: i.harness || i.runtime || null, backend: i.tmux ? "tmux" : null,
             ...(i.sessionTarget ? { sessionTarget: i.sessionTarget } : {}), ...(i.tmux ? { tmux: i.tmux } : {}),
             running: typeof i.running === "boolean" ? i.running : null, ...(i.runtimeError ? { runtimeError: i.runtimeError } : {}),
-            ...rowFacts(i),
+            ...rowFacts(i), ...rowWaiting(i),
             // Every row the host reports is addressed by its home, saved
             // route or not; savedRoute says only that it was spawned from here.
             retirePending: !!i.retirePending, rollbackIncomplete: !!i.rollbackIncomplete, savedRoute: !!snap, addressable: true, missingRemotely: false,
@@ -1072,8 +1078,20 @@ export function scheduleRemote(serverId, oatsArgs, io = {}) {
   io = { ...io, serverId };
   const server = io.server || getServer(serverId);
   const target = targetOf(server);
-  const remote = checkRemote(target, io);
-  if (!remote.features.includes("schedule")) throw serverError("E_REMOTE_INCOMPATIBLE", `remote oats ${remote.version} at ${target.sshHost} does not advertise schedules; upgrade it there`);
+  const setsHostCaps = oatsArgs[0] === "host" && oatsArgs[1] === "install" && oatsArgs.some((arg) =>
+    ["--max-concurrent", "--triggers-max-concurrent"].some((name) => arg === name || arg.startsWith(`${name}=`)));
+  const capsUnsupported = () => serverError("E_REMOTE_INCOMPATIBLE", `remote oats at ${target.sshHost} (${serverId}) does not confirm required features schedule and schedule-host-caps; upgrade oats on that destination before setting or resetting host caps`);
+  let remote;
+  try {
+    remote = checkRemote(target, io);
+    if (!remote.features.includes("schedule")) throw serverError("E_REMOTE_INCOMPATIBLE", `remote oats ${remote.version} at ${target.sshHost} does not advertise schedules; upgrade it there`);
+  } catch (e) {
+    // Unknown probe formats cannot establish cap support. Keep transport
+    // failures distinct, and preserve the existing contract for no-cap calls.
+    if (setsHostCaps && ["E_REMOTE_ENVELOPE", "E_REMOTE_INCOMPATIBLE"].includes(e.code)) throw capsUnsupported();
+    throw e;
+  }
+  if (setsHostCaps && !remote.features.includes("schedule-host-caps")) throw capsUnsupported();
   if (["add", "update"].includes(oatsArgs[0])) {
     const indexes = oatsArgs.flatMap((arg, index) => arg === "--spec-json" ? [index] : []);
     if (indexes.length > 1) throw serverError("E_BAD_ARGS", "remote schedule spec must be unambiguous");

package/lib/session-input.mjs

@@ -2,13 +2,14 @@
 import { execFileSync } from "node:child_process";
 import { basename } from "node:path";
 import { randomUUID } from "node:crypto";
+import { performance } from "node:perf_hooks";
 
 const shells = new Set(["sh", "bash", "zsh", "fish", "dash", "ksh", "login"]);
-function tmux(target, args, { exec = execFileSync, input } = {}) {
+function tmux(target, args, { exec = execFileSync, input, timeout = 10000, killSignal } = {}) {
   // launchd does not supply a UTF-8 locale. In that environment tmux replaces
   // the tab delimiters in list-panes output with underscores unless forced.
   return exec("tmux", ["-u", "-S", target.socket, ...args], {
-    encoding: "utf8", input, timeout: 10000, maxBuffer: 1024 * 1024,
+    encoding: "utf8", input, timeout, ...(killSignal ? { killSignal } : {}), maxBuffer: 1024 * 1024,
     stdio: ["pipe", "pipe", "pipe"],
   });
 }
@@ -49,13 +50,11 @@ export function inspectSessionTarget(target, io) {
   }
   return { backend: "tmux", present: dead === "0", state, paneId };
 }
-// Submit verification (#562). A harness can swallow an Enter that lands while
-// it is still handling a large bracketed paste, leaving the text unsent in its
-// input box. So the pane is left to settle before Enter, and Enter is judged by
-// whether it changed the bottom of the screen: a byte comparison only, never a
-// reading of any harness's UI, and the pane's text is never acted on.
+// Settling gives a large bracketed paste time before the single Enter. Screen
+// bytes are observations only: neither change nor silence proves acceptance
+// or authorizes another key. Each phase has one monotonic observation budget.
 const SETTLE_FLOOR_MS = 200, SETTLE_MS_PER_KIB = 3, SETTLE_CAP_MS = 2000, SETTLE_POLL_MS = 100;
-const VERIFY_MS = 300, RESEND_BACKOFF_MS = [300, 600]; // at most 3 Enters in total
+const OBSERVE_CAP_MS = 1000, OBSERVE_WAITS_MS = [300, 600];
 const REGION_LINES = 15, HISTORY_LINES = 200;
 const GEOMETRY = "#{pane_width}x#{pane_height}";
 const realSleep = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
@@ -65,17 +64,22 @@ const realSleep = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),
  *  visible pane with up to 200 lines of history above it; and `size`, the
  *  pane's geometry, read before and after the capture in the same tmux call
  *  (null when it moved in between). */
-function capturePane(target, paneId, io) {
+function capturePane(target, paneId, io, deadline, now) {
+  const timeout = Math.floor(deadline - now());
+  if (timeout <= 0) return null;
   try {
     const lines = tmux(target, ["display-message", "-p", "-t", paneId, GEOMETRY, ";",
       "capture-pane", "-p", "-J", "-t", paneId, "-S", `-${HISTORY_LINES}`, ";",
-      "display-message", "-p", "-t", paneId, GEOMETRY], io).split("\n");
+      // A read-only probe must not outlive its timeout by ignoring TERM.
+      "display-message", "-p", "-t", paneId, GEOMETRY], { ...io, timeout, killSignal: "SIGKILL" }).split("\n");
+    if (now() >= deadline) return null;
     if (lines.at(-1) === "") lines.pop();
     const first = lines.shift(), last = lines.pop();
     if (!/^\d+x\d+$/.test(first) || !/^\d+x\d+$/.test(last)) return null;
     for (let i = 0; i < lines.length; i++) lines[i] = lines[i].trimEnd();
     while (lines.length && !lines.at(-1)) lines.pop();
-    return { size: first === last ? first : null, region: lines.slice(-REGION_LINES).join("\n"), all: lines.join("\n") };
+    const look = { size: first === last ? first : null, region: lines.slice(-REGION_LINES).join("\n"), all: lines.join("\n") };
+    return now() < deadline ? look : null;
   } catch { return null; }
 }
 const sameLook = (a, b) => a.size === b.size && a.region === b.region;
@@ -95,58 +99,49 @@ function unchanged(a, b) {
   if (!x || !y) return x === y;
   return (x.endsWith(y) || y.endsWith(x)) && flat(b.all).includes(x) && flat(a.all).includes(y);
 }
-/** Paste `text` and submit it with Enter. Answers `submitted` (the Enter was
- *  taken, or sent unjudged) and `verified` (whether the screen comparison
- *  judged it); `reason: "enter-not-taken"` only with `submitted: false`. A
- *  failed paste or key send throws; a failed capture never does. */
+/** One literal paste and one Enter. `submitted` means terminal commands
+ * succeeded; `verified` means only that a bounded look changed afterward.
+ * Neither is model acceptance. Terminal failures throw; observation failures
+ * yield unverified, never a refusal or permission to retransmit. */
 export function inputSessionTarget(target, text, io) {
   const state = inspectSessionTarget(target, io);
   if (!state.present || state.state === "shell") throw new Error(`cannot submit input: session is ${state.state}`);
-  const sleep = io?.sleep || realSleep, now = io?.now || Date.now;
+  const sleep = io?.sleep || realSleep, now = io?.now || (() => performance.now());
+  const wait = (ms, deadline) => { const remaining = deadline - now(); if (remaining > 0) sleep(Math.min(ms, remaining)); };
   // Bracketed paste preserves multiline input as one user message. No text
   // is evaluated by a shell or interpreted as tmux key names.
   const buffer = `oats-${randomUUID()}`;
+  let settleDeadline;
   try {
     tmux(target, ["load-buffer", "-b", buffer, "-"], { ...io, input: text });
     tmux(target, ["paste-buffer", "-p", "-b", buffer, "-t", state.paneId], io);
+    settleDeadline = now() + SETTLE_CAP_MS;
   } finally {
     try { tmux(target, ["delete-buffer", "-b", buffer], io); } catch { /* already consumed or disconnected */ }
   }
-  const enter = () => tmux(target, ["send-keys", "-t", state.paneId, "Enter"], io);
-  // Settle: wait a floor scaled by paste size, then until two consecutive
-  // captures are identical, giving up at the cap. The last capture is A.
-  const started = now();
-  sleep(Math.min(SETTLE_CAP_MS, SETTLE_FLOOR_MS + Math.ceil(Buffer.byteLength(text) / 1024) * SETTLE_MS_PER_KIB));
-  let before = capturePane(target, state.paneId, io);
-  while (before !== null && now() - started < SETTLE_CAP_MS) {
-    sleep(SETTLE_POLL_MS);
-    const next = capturePane(target, state.paneId, io);
+  // The budget starts at paste completion, before cleanup. Cleanup/Enter keep
+  // their original command timeouts; only observation probes/sleeps are clipped.
+  wait(SETTLE_FLOOR_MS + Math.ceil(Buffer.byteLength(text) / 1024) * SETTLE_MS_PER_KIB, settleDeadline);
+  let before = capturePane(target, state.paneId, io, settleDeadline, now);
+  while (before !== null && now() < settleDeadline) {
+    wait(SETTLE_POLL_MS, settleDeadline);
+    const next = capturePane(target, state.paneId, io, settleDeadline, now);
     const settled = next !== null && sameLook(next, before);
     before = next;
     if (settled) break;
   }
-  enter();
-  // An unreadable pane gets no further keys: the terminal accepted them, unjudged.
-  if (before === null) return { ...state, submitted: true, verified: false };
-  // Changed content means the Enter was taken (or the pane moved for an
-  // unrelated reason, such as a spinner, a clock or a human typing: read as
-  // taken, no worse than not looking). Unchanged content means it was
-  // swallowed: any reaction, a dialog included, would have changed it, so a
-  // resend is safe. A reflow alone, on a pane seen to change size, is not a
-  // change. The screen is looked at again after each backoff, so an Enter
-  // taken late is not followed by another. A capture that fails stops the
-  // retries: no further Enter is sent.
-  for (let enters = 1; ; enters++) {
-    for (const wait of [VERIFY_MS, RESEND_BACKOFF_MS[enters - 1]]) {
-      if (wait === undefined) break;
-      sleep(wait);
-      const after = capturePane(target, state.paneId, io);
-      if (after === null) return { ...state, submitted: true, verified: false };
-      if (!unchanged(before, after)) return { ...state, submitted: true, verified: true };
+  if (now() >= settleDeadline) before = null;
+  tmux(target, ["send-keys", "-t", state.paneId, "Enter"], io);
+  const observeDeadline = now() + OBSERVE_CAP_MS;
+  if (before !== null) {
+    for (const delay of OBSERVE_WAITS_MS) {
+      wait(delay, observeDeadline);
+      const after = capturePane(target, state.paneId, io, observeDeadline, now);
+      if (after === null) break;
+      const changed = !unchanged(before, after);
+      if (now() >= observeDeadline) break;
+      if (changed) return { ...state, submitted: true, verified: true };
     }
-    if (enters > RESEND_BACKOFF_MS.length) break;
-    enter();
   }
-  // The text stays in the input box; it is never pasted again.
-  return { ...state, submitted: false, verified: true, reason: "enter-not-taken" };
+  return { ...state, submitted: true, verified: false };
 }