@awebai/oats 0.40.1 → 0.41.0

package/lib/schedule.mjs

@@ -117,7 +117,7 @@ export const SCHEDULE_FILE_BUDGET = 1024 * 1024;
  *  O_NOFOLLOW|O_NONBLOCK open → fstat dev/ino identity → whole file only if
  *  within budget (an over-budget file is REFUSED as a typed error, never
  *  truncated into fabricated JSON). Returns { value, source }. */
-function readJsonBounded(path, fallback, label) {
+function readJsonBounded(path, fallback, label, { atomicReplace = false } = {}) {
   let st;
   try { st = lstatSync(path); }
   catch (e) { if (e.code === "ENOENT") return { value: fallback, source: { path: label, status: "absent", bytes: 0 } }; throw scheduleError("E_SCHEDULE_INVALID", `${path} cannot be read: ${e.message}`, { field: "file", source: { path: label, status: "refused", bytes: 0 } }); }
@@ -127,7 +127,10 @@ function readJsonBounded(path, fallback, label) {
   try {
     fd = openSync(path, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0) | (fsConstants.O_NONBLOCK ?? 0));
     const fst = fstatSync(fd);
-    if (!fst.isFile() || fst.dev !== st.dev || fst.ino !== st.ino || fst.size > SCHEDULE_FILE_BUDGET) throw new Error("swapped or grew past budget");
+    // The registry is atomically replaced by concurrent writers. Its opened,
+    // no-follow regular-file descriptor is a coherent old/new snapshot even
+    // when rename changed the inode since lstat. Other readers pin identity.
+    if (!fst.isFile() || (!atomicReplace && (fst.dev !== st.dev || fst.ino !== st.ino)) || fst.size > SCHEDULE_FILE_BUDGET) throw new Error("swapped or grew past budget");
     const buf = Buffer.alloc(fst.size); let got = 0;
     while (got < fst.size) { const n = readSync(fd, buf, got, fst.size - got, got); if (n <= 0) break; got += n; }
     text = buf.toString("utf8"); st = fst;
@@ -208,48 +211,70 @@ export function writeState(ws, st) { recordRecentRuns(st); writeJson(statePath(w
 const DEFAULT_MAX_CONCURRENT = 5;
 const scheduleCap = (reg) => reg.maxConcurrent ?? DEFAULT_MAX_CONCURRENT;
 
-/** Call under registry.lock: persisted caps are explicit operator choices.
- * Pre-v2 registries wrote 1 even when the operator chose nothing. Migrate it
- * once; a subsequent explicit 1 is distinguished by capsVersion: 2. */
-function readRegistryLocked() {
+/** Decode a bounded atomic-file snapshot without locks or filesystem writes. */
+function readRegistryDocument() {
+  const path = join(hostScheduleDir(), "registry.json");
+  const reg = readJsonBounded(path, { version: 1, capsVersion: 2, tickIntervalSec: 60, workspaces: [] }, "registry.json", { atomicReplace: true }).value;
+  if (!reg || typeof reg !== "object" || Array.isArray(reg)) throw scheduleError("E_SCHEDULE_INVALID", `${path} must contain a registry object`, { field: "file" });
+  return reg;
+}
+const validCap = (value) => Number.isSafeInteger(value) && value >= 1;
+/** Project legacy defaults in memory. Only locked mutations persist this. */
+function normalizeRegistry(reg) {
   const path = join(hostScheduleDir(), "registry.json");
-  const reg = readJson(path, { version: 1, capsVersion: 2, tickIntervalSec: 60, workspaces: [] });
   if (!Array.isArray(reg.workspaces)) reg.workspaces = [];
-  if (reg.maxConcurrent !== undefined && (!Number.isSafeInteger(reg.maxConcurrent) || reg.maxConcurrent < 1)) delete reg.maxConcurrent;
+  if (reg.maxConcurrent !== undefined && !validCap(reg.maxConcurrent)) {
+    throw scheduleError("E_SCHEDULE_INVALID", `${path}: maxConcurrent must be a positive safe integer, or absent for the default (got ${JSON.stringify(reg.maxConcurrent)}); correct it with oats schedule host install --max-concurrent <N|default> --dir <deployment>`, { field: "maxConcurrent" });
+  }
   if (!Number.isInteger(reg.tickIntervalSec) || reg.tickIntervalSec < 60) reg.tickIntervalSec = 60;
   // Trigger and schedule caps are independent; absent trigger cap is unbounded.
-  if (reg.triggersMaxConcurrent !== undefined && !(Number.isSafeInteger(reg.triggersMaxConcurrent) && reg.triggersMaxConcurrent >= 1)) {
+  if (reg.triggersMaxConcurrent !== undefined && !validCap(reg.triggersMaxConcurrent)) {
     throw scheduleError("E_SCHEDULE_INVALID", `${path}: triggersMaxConcurrent must be a positive integer, or absent for no host cap (got ${JSON.stringify(reg.triggersMaxConcurrent)})`, { field: "triggersMaxConcurrent" });
   }
   if ((reg.capsVersion ?? 1) < 2) {
     if (reg.maxConcurrent === 1) delete reg.maxConcurrent;
     reg.capsVersion = 2;
-    writeRegistry(reg);
   }
   return reg;
 }
-export function readRegistry() { return withRegistryLock(readRegistryLocked); }
-/** Raw write: callers doing read-modify-write hold registry.lock. */
+export function readRegistry() { return normalizeRegistry(readRegistryDocument()); }
+/** Raw atomic write: no normalization or locking. Read-modify-write callers
+ * must hold registry.lock and reread there; readers never persist migration. */
 export function writeRegistry(reg) { writeJson(join(hostScheduleDir(), "registry.json"), reg); }
-export function registerWorkspace(ws, caps = {}) {
-  for (const [field, reset] of [["maxConcurrent", "default"], ["triggersMaxConcurrent", "none"]]) {
-    const value = caps[field];
-    if (value !== undefined && value !== reset && !(Number.isSafeInteger(value) && value >= 1)) {
-      throw scheduleError("E_BAD_ARGS", `${field} must be a positive safe integer or ${reset}`, { field });
-    }
-  }
+function updateRegistry(change, caps = {}) {
   return withRegistryLock(() => {
-    const reg = readRegistryLocked(), before = JSON.stringify(reg), abs = resolve(ws);
+    const raw = readRegistryDocument(), before = JSON.stringify(raw);
+    const legacyOne = (raw.capsVersion ?? 1) < 2 && raw.maxConcurrent === 1;
+    // A validated explicit replacement can repair an invalid stored schedule
+    // cap; an ordinary read or unrelated write must refuse it, never default.
+    if (caps.maxConcurrent !== undefined && !validCap(raw.maxConcurrent)) delete raw.maxConcurrent;
+    const reg = normalizeRegistry(raw);
     for (const [field, reset] of [["maxConcurrent", "default"], ["triggersMaxConcurrent", "none"]]) {
       if (caps[field] === reset) delete reg[field];
       else if (caps[field] !== undefined) reg[field] = caps[field];
     }
-    if (!reg.workspaces.includes(abs)) reg.workspaces.push(abs);
-    if (JSON.stringify(reg) !== before) writeRegistry(reg);
+    change(reg);
+    // Compare with the raw snapshot so even unchanged membership persists the
+    // migration, without a separate write or a stale pre-lock read.
+    if (JSON.stringify(reg) !== before) {
+      writeRegistry(reg);
+      if (legacyOne && (caps.maxConcurrent === undefined || caps.maxConcurrent === "default")) {
+        process.stderr.write("oats: warning: migrated legacy maxConcurrent: 1 to the default of 5; an old explicit 1 cannot be distinguished from the old implicit default. To restore one slot, run oats schedule host install --max-concurrent 1 --dir <deployment>. Stop older oats binaries from writing this shared registry.\n");
+      }
+    }
     return reg;
   });
 }
-export function unregisterWorkspace(ws) { return withRegistryLock(() => { const reg = readRegistryLocked(); reg.workspaces = reg.workspaces.filter((w) => w !== resolve(ws)); writeRegistry(reg); return reg; }); }
+export function registerWorkspace(ws, caps = {}) {
+  for (const [field, reset] of [["maxConcurrent", "default"], ["triggersMaxConcurrent", "none"]]) {
+    const value = caps[field];
+    if (value !== undefined && value !== reset && !validCap(value)) {
+      throw scheduleError("E_BAD_ARGS", `${field} must be a positive safe integer or ${reset}`, { field });
+    }
+  }
+  return updateRegistry((reg) => { const abs = resolve(ws); if (!reg.workspaces.includes(abs)) reg.workspaces.push(abs); }, caps);
+}
+export function unregisterWorkspace(ws) { return updateRegistry((reg) => { reg.workspaces = reg.workspaces.filter((w) => w !== resolve(ws)); }); }
 export function readHostState() { return readJson(join(hostScheduleDir(), "state.json"), {}); }
 export function writeHostState(st) { writeJson(join(hostScheduleDir(), "state.json"), st); }
 
@@ -573,10 +598,12 @@ function spawnViaCli(ws, root, agent, opts, context, io) {
   let r;
   try { r = runScheduleCommand(process.execPath, [io?.oatsBin || OATS_BIN, ...argv], { cwd: context.dir, timeout: io?.commandTimeoutMs || COMMAND_TIMEOUT_MS, graceMs: io?.commandGraceMs, maxBuffer: 16 * 1024 * 1024, env: childEnv() }); }
   finally { try { rmSync(taskFile, { force: true }); } catch { /* best effort */ } }
-  const timedOut = r.error?.code === "ETIMEDOUT" || (r.status === null && ["SIGTERM", "SIGKILL"].includes(r.signal));
+  const interrupted = r.interrupted === true;
+  const timedOut = r.error?.code === "ETIMEDOUT" || (!interrupted && r.status === null && ["SIGTERM", "SIGKILL"].includes(r.signal));
   const envelope = parseEnvelopeText(r.stdout);
   // The child may have created (and launched) a home before dying: unconfirmed, never a confirmed failure.
   // The thrown message reports RETAINED effects so the tick keeps the attempt and its slot for reconcile.
+  if (interrupted) throw scheduleError("E_SPAWN_UNCONFIRMED", "workspace spawn was interrupted; its effects could not be confirmed (a home may have been created) — run oats schedule reconcile");
   if (timedOut) throw scheduleError("E_SPAWN_UNCONFIRMED", "workspace spawn timed out; its effects could not be confirmed (a home may have been created) — run oats schedule reconcile");
   if (!envelope || typeof envelope !== "object" || typeof envelope.ok !== "boolean") throw scheduleError("E_SPAWN_UNCONFIRMED", `workspace spawn answered no valid envelope (exit ${r.status ?? r.signal}); its effects could not be confirmed — run oats schedule reconcile${r.stderr ? `: ${String(r.stderr).trim().split("\n").pop()}` : ""}`);
   if (!envelope.ok) {
@@ -634,19 +661,20 @@ export function parseEnvelopeText(text) {
  *  and `io.commandGraceMs` are test seams; `io.command` counts as exited. */
 function launchCommand(ws, def, io) {
   const argv = def.argv.includes("--json") ? def.argv.slice(1) : [...def.argv.slice(1), "--json"];
-  let envelope, timedOut = false, raw = "", exit;
+  let envelope, timedOut = false, interrupted = false, raw = "", exit;
   if (io?.command) { envelope = io.command({ cwd: def.cwd, argv }); exit = { status: null, signal: null }; }
   else {
     const r = runScheduleCommand(process.execPath, [io?.oatsBin || OATS_BIN, ...argv], { cwd: def.cwd, timeout: io?.commandTimeoutMs || COMMAND_TIMEOUT_MS, graceMs: io?.commandGraceMs, maxBuffer: 16 * 1024 * 1024, env: childEnv() });
-    timedOut = r.error?.code === "ETIMEDOUT" || (r.status === null && ["SIGTERM", "SIGKILL"].includes(r.signal));
+    interrupted = r.interrupted === true;
+    timedOut = r.error?.code === "ETIMEDOUT" || (!interrupted && r.status === null && ["SIGTERM", "SIGKILL"].includes(r.signal));
     if (r.status !== null || r.signal !== null) exit = { status: r.status, signal: r.signal };
     raw = String(r.stdout || "");
     envelope = parseEnvelopeText(raw);
   }
   const exited = exit ? { exit } : {};
-  // No envelope, a malformed one, or a timeout: the process may still have
+  // No envelope, a malformed one, a timeout, or supervisor interruption: the process may still have
   // created a home. That is unconfirmed, never a confirmed failure.
-  if (timedOut || !envelope || typeof envelope !== "object" || typeof envelope.ok !== "boolean") return { kind: "command", launched: false, unconfirmed: true, ...exited, error: timedOut ? "command timed out; its side effects are unconfirmed" : "command answered no valid envelope; its side effects are unconfirmed" };
+  if (interrupted || timedOut || !envelope || typeof envelope !== "object" || typeof envelope.ok !== "boolean") return { kind: "command", launched: false, unconfirmed: true, ...exited, error: interrupted ? "command was interrupted; its side effects are unconfirmed" : timedOut ? "command timed out; its side effects are unconfirmed" : "command answered no valid envelope; its side effects are unconfirmed" };
   const res = envelope?.result || {};
   const instance = typeof res.instance === "string" ? res.instance : undefined;
   let home = typeof res.home === "string" ? res.home : undefined;
@@ -1091,6 +1119,7 @@ export function testSchedule(ws, qid, io, { now = new Date(), ctx = null } = {})
       if (def.harness) argv.push(`--harness=${def.harness}`);
       if (def.model) argv.push(`--model=${def.model}`);
       const r = runScheduleCommand(process.execPath, [io?.oatsBin || OATS_BIN, ...argv], { cwd: context.dir, timeout: io?.commandTimeoutMs || COMMAND_TIMEOUT_MS, graceMs: io?.commandGraceMs, maxBuffer: 16 * 1024 * 1024, env: childEnv() });
+      if (r.interrupted === true) throw scheduleError("E_SPAWN_FAILED", "the spawn preview was interrupted; its result is unconfirmed");
       const envelope = parseEnvelopeText(r.stdout);
       if (!envelope || typeof envelope.ok !== "boolean") throw scheduleError("E_SPAWN_FAILED", `the spawn preview answered no valid envelope (exit ${r.status ?? r.signal})`);
       if (!envelope.ok) throw scheduleError(envelope.error?.code || "E_SPAWN_FAILED", String(envelope.error?.message || "spawn preview failed"));

package/lib/servers.mjs

@@ -23,7 +23,9 @@ import { homedir } from "node:os";
 import { basename, join, resolve } from "node:path";
 import { parseStrictJson } from "./canonical-json.mjs";
 import { noteRuntimeName } from "./deprecation.mjs";
+import { readWaitingClaim } from "./instance-events.mjs";
 import { withDirLock } from "./dir-lock.mjs";
+import { shellWord } from "./core.mjs";
 
 const OATS_HOME_DIR = () => process.env.OATS_HOME_DIR || join(homedir(), ".oats");
 export const SERVERS_FILE = () => join(OATS_HOME_DIR(), "servers.json");
@@ -784,6 +786,11 @@ function listSnapshotServers() {
  *  derived here. */
 export const REMOTE_ROW_FACTS = ["identity", "identityAddress", "teams", "startedAt", "createdAt", "model", "runtimeState", "parentInstance", "siblingInstance", "relation", "relativeTo", "spawnOrigin"];
 const rowFacts = (i = {}) => Object.fromEntries(REMOTE_ROW_FACTS.map((k) => [k, i[k] ?? null]));
+/** `waitingOnYou` (feature waiting-on-you) is relayed ONLY when the host's row has the
+ *  key, so it is not one of REMOTE_ROW_FACTS: a host whose kernel predates the feature
+ *  omits it, and absent ("not reported") must stay distinct from null ("no claim"). The
+ *  value passes the kernel's own read rule again; anything it refuses is null. */
+const rowWaiting = (i) => (Object.hasOwn(i, "waitingOnYou") ? { waitingOnYou: readWaitingClaim(i.waitingOnYou) } : {});
 
 export function rosterGroups({ server, io = {} } = {}) {
   const started = Date.now();
@@ -841,7 +848,7 @@ export function rosterGroups({ server, io = {} } = {}) {
             harness: i.harness || i.runtime || null, backend: i.tmux ? "tmux" : null,
             ...(i.sessionTarget ? { sessionTarget: i.sessionTarget } : {}), ...(i.tmux ? { tmux: i.tmux } : {}),
             running: typeof i.running === "boolean" ? i.running : null, ...(i.runtimeError ? { runtimeError: i.runtimeError } : {}),
-            ...rowFacts(i),
+            ...rowFacts(i), ...rowWaiting(i),
             // Every row the host reports is addressed by its home, saved
             // route or not; savedRoute says only that it was spawned from here.
             retirePending: !!i.retirePending, rollbackIncomplete: !!i.rollbackIncomplete, savedRoute: !!snap, addressable: true, missingRemotely: false,
@@ -911,22 +918,29 @@ export function instanceOnHost(serverId, name, io = {}) {
 function requireSessionRemote(target, io, home) {
   const remote = checkRemote(target, io);
   if (!remote.remote.includes("session")) {
-    throw serverError("E_REMOTE_INCOMPATIBLE", `remote oats ${remote.version} at ${target.sshHost} does not advertise the \`oats session\` commands (kernels from ${SESSION_REMOTE_VERSION} do); upgrade it there, or attach with ssh -t ${target.sshHost} tmux attach -t ${recordedTmuxTarget(target, io, home)}`);
+    throw serverError("E_REMOTE_INCOMPATIBLE", `remote oats ${remote.version} at ${target.sshHost} does not advertise the \`oats session\` commands (kernels from ${SESSION_REMOTE_VERSION} do); upgrade it there, or attach with ${oldKernelAttachHint(target, io, home)}`);
   }
   return remote;
 }
 
-/** Where a kernel without `oats session` put the instance's window: the tmux
- *  session and window its roster records for that home, else its default
- *  session (pi-agents, the default of every kernel before 0.31). */
+/** How to attach by hand to an instance on a kernel without `oats session`: the tmux session and
+ *  window its roster records for that home, else its default session (pi-agents, the default of every
+ *  kernel before 0.31). When the roster row records the server's socket the hint names it, and the
+ *  remote command is ONE quoted word (ssh joins its words for the remote shell, which would split a
+ *  path with a space); a row without a socket is a kernel that only ever used its default server. */
 const OLD_KERNEL_TMUX_SESSION = "pi-agents";
-function recordedTmuxTarget(target, io, home) {
+function oldKernelAttachHint(target, io, home) {
+  let row;
   try {
     const status = runRemote(target, ["status", "--json", "--dir", target.workspace], { ...io, input: undefined }).envelope;
-    const row = (status.ok ? status.result?.agents || [] : []).flatMap((a) => a.instances || []).find((i) => i.home && home && resolve(i.home) === resolve(home));
-    if (row?.tmux?.session) return row.tmux.window ? `${row.tmux.session}:${row.tmux.window}` : row.tmux.session;
+    row = (status.ok ? status.result?.agents || [] : []).flatMap((a) => a.instances || []).find((i) => i.home && home && resolve(i.home) === resolve(home));
   } catch { /* the hint falls back to the default session */ }
-  return OLD_KERNEL_TMUX_SESSION;
+  const tmux = row?.tmux?.session ? row.tmux : null;
+  const recorded = tmux ? (tmux.window ? `${tmux.session}:${tmux.window}` : tmux.session) : OLD_KERNEL_TMUX_SESSION;
+  // The remote command is ONE word for the local shell, with or without a socket: ssh joins its
+  // arguments and the remote shell reads the result again.
+  const server = typeof tmux?.socket === "string" && tmux.socket ? `-S ${shellWord(tmux.socket)} ` : "";
+  return `ssh -t ${target.sshHost} ${shellWord(`tmux ${server}attach -t ${shellWord(recorded)}`)}`;
 }
 
 export function inspectRemote(serverId, { instance, home } = {}, io = {}) {

package/lib/session-input.mjs

@@ -2,13 +2,14 @@
 import { execFileSync } from "node:child_process";
 import { basename } from "node:path";
 import { randomUUID } from "node:crypto";
+import { performance } from "node:perf_hooks";
 
 const shells = new Set(["sh", "bash", "zsh", "fish", "dash", "ksh", "login"]);
-function tmux(target, args, { exec = execFileSync, input } = {}) {
+function tmux(target, args, { exec = execFileSync, input, timeout = 10000, killSignal } = {}) {
   // launchd does not supply a UTF-8 locale. In that environment tmux replaces
   // the tab delimiters in list-panes output with underscores unless forced.
   return exec("tmux", ["-u", "-S", target.socket, ...args], {
-    encoding: "utf8", input, timeout: 10000, maxBuffer: 1024 * 1024,
+    encoding: "utf8", input, timeout, ...(killSignal ? { killSignal } : {}), maxBuffer: 1024 * 1024,
     stdio: ["pipe", "pipe", "pipe"],
   });
 }
@@ -49,13 +50,11 @@ export function inspectSessionTarget(target, io) {
   }
   return { backend: "tmux", present: dead === "0", state, paneId };
 }
-// Submit verification (#562). A harness can swallow an Enter that lands while
-// it is still handling a large bracketed paste, leaving the text unsent in its
-// input box. So the pane is left to settle before Enter, and Enter is judged by
-// whether it changed the bottom of the screen: a byte comparison only, never a
-// reading of any harness's UI, and the pane's text is never acted on.
+// Settling gives a large bracketed paste time before the single Enter. Screen
+// bytes are observations only: neither change nor silence proves acceptance
+// or authorizes another key. Each phase has one monotonic observation budget.
 const SETTLE_FLOOR_MS = 200, SETTLE_MS_PER_KIB = 3, SETTLE_CAP_MS = 2000, SETTLE_POLL_MS = 100;
-const VERIFY_MS = 300, RESEND_BACKOFF_MS = [300, 600]; // at most 3 Enters in total
+const OBSERVE_CAP_MS = 1000, OBSERVE_WAITS_MS = [300, 600];
 const REGION_LINES = 15, HISTORY_LINES = 200;
 const GEOMETRY = "#{pane_width}x#{pane_height}";
 const realSleep = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
@@ -65,17 +64,22 @@ const realSleep = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),
  *  visible pane with up to 200 lines of history above it; and `size`, the
  *  pane's geometry, read before and after the capture in the same tmux call
  *  (null when it moved in between). */
-function capturePane(target, paneId, io) {
+function capturePane(target, paneId, io, deadline, now) {
+  const timeout = Math.floor(deadline - now());
+  if (timeout <= 0) return null;
   try {
     const lines = tmux(target, ["display-message", "-p", "-t", paneId, GEOMETRY, ";",
       "capture-pane", "-p", "-J", "-t", paneId, "-S", `-${HISTORY_LINES}`, ";",
-      "display-message", "-p", "-t", paneId, GEOMETRY], io).split("\n");
+      // A read-only probe must not outlive its timeout by ignoring TERM.
+      "display-message", "-p", "-t", paneId, GEOMETRY], { ...io, timeout, killSignal: "SIGKILL" }).split("\n");
+    if (now() >= deadline) return null;
     if (lines.at(-1) === "") lines.pop();
     const first = lines.shift(), last = lines.pop();
     if (!/^\d+x\d+$/.test(first) || !/^\d+x\d+$/.test(last)) return null;
     for (let i = 0; i < lines.length; i++) lines[i] = lines[i].trimEnd();
     while (lines.length && !lines.at(-1)) lines.pop();
-    return { size: first === last ? first : null, region: lines.slice(-REGION_LINES).join("\n"), all: lines.join("\n") };
+    const look = { size: first === last ? first : null, region: lines.slice(-REGION_LINES).join("\n"), all: lines.join("\n") };
+    return now() < deadline ? look : null;
   } catch { return null; }
 }
 const sameLook = (a, b) => a.size === b.size && a.region === b.region;
@@ -95,58 +99,49 @@ function unchanged(a, b) {
   if (!x || !y) return x === y;
   return (x.endsWith(y) || y.endsWith(x)) && flat(b.all).includes(x) && flat(a.all).includes(y);
 }
-/** Paste `text` and submit it with Enter. Answers `submitted` (the Enter was
- *  taken, or sent unjudged) and `verified` (whether the screen comparison
- *  judged it); `reason: "enter-not-taken"` only with `submitted: false`. A
- *  failed paste or key send throws; a failed capture never does. */
+/** One literal paste and one Enter. `submitted` means terminal commands
+ * succeeded; `verified` means only that a bounded look changed afterward.
+ * Neither is model acceptance. Terminal failures throw; observation failures
+ * yield unverified, never a refusal or permission to retransmit. */
 export function inputSessionTarget(target, text, io) {
   const state = inspectSessionTarget(target, io);
   if (!state.present || state.state === "shell") throw new Error(`cannot submit input: session is ${state.state}`);
-  const sleep = io?.sleep || realSleep, now = io?.now || Date.now;
+  const sleep = io?.sleep || realSleep, now = io?.now || (() => performance.now());
+  const wait = (ms, deadline) => { const remaining = deadline - now(); if (remaining > 0) sleep(Math.min(ms, remaining)); };
   // Bracketed paste preserves multiline input as one user message. No text
   // is evaluated by a shell or interpreted as tmux key names.
   const buffer = `oats-${randomUUID()}`;
+  let settleDeadline;
   try {
     tmux(target, ["load-buffer", "-b", buffer, "-"], { ...io, input: text });
     tmux(target, ["paste-buffer", "-p", "-b", buffer, "-t", state.paneId], io);
+    settleDeadline = now() + SETTLE_CAP_MS;
   } finally {
     try { tmux(target, ["delete-buffer", "-b", buffer], io); } catch { /* already consumed or disconnected */ }
   }
-  const enter = () => tmux(target, ["send-keys", "-t", state.paneId, "Enter"], io);
-  // Settle: wait a floor scaled by paste size, then until two consecutive
-  // captures are identical, giving up at the cap. The last capture is A.
-  const started = now();
-  sleep(Math.min(SETTLE_CAP_MS, SETTLE_FLOOR_MS + Math.ceil(Buffer.byteLength(text) / 1024) * SETTLE_MS_PER_KIB));
-  let before = capturePane(target, state.paneId, io);
-  while (before !== null && now() - started < SETTLE_CAP_MS) {
-    sleep(SETTLE_POLL_MS);
-    const next = capturePane(target, state.paneId, io);
+  // The budget starts at paste completion, before cleanup. Cleanup/Enter keep
+  // their original command timeouts; only observation probes/sleeps are clipped.
+  wait(SETTLE_FLOOR_MS + Math.ceil(Buffer.byteLength(text) / 1024) * SETTLE_MS_PER_KIB, settleDeadline);
+  let before = capturePane(target, state.paneId, io, settleDeadline, now);
+  while (before !== null && now() < settleDeadline) {
+    wait(SETTLE_POLL_MS, settleDeadline);
+    const next = capturePane(target, state.paneId, io, settleDeadline, now);
     const settled = next !== null && sameLook(next, before);
     before = next;
     if (settled) break;
   }
-  enter();
-  // An unreadable pane gets no further keys: the terminal accepted them, unjudged.
-  if (before === null) return { ...state, submitted: true, verified: false };
-  // Changed content means the Enter was taken (or the pane moved for an
-  // unrelated reason, such as a spinner, a clock or a human typing: read as
-  // taken, no worse than not looking). Unchanged content means it was
-  // swallowed: any reaction, a dialog included, would have changed it, so a
-  // resend is safe. A reflow alone, on a pane seen to change size, is not a
-  // change. The screen is looked at again after each backoff, so an Enter
-  // taken late is not followed by another. A capture that fails stops the
-  // retries: no further Enter is sent.
-  for (let enters = 1; ; enters++) {
-    for (const wait of [VERIFY_MS, RESEND_BACKOFF_MS[enters - 1]]) {
-      if (wait === undefined) break;
-      sleep(wait);
-      const after = capturePane(target, state.paneId, io);
-      if (after === null) return { ...state, submitted: true, verified: false };
-      if (!unchanged(before, after)) return { ...state, submitted: true, verified: true };
+  if (now() >= settleDeadline) before = null;
+  tmux(target, ["send-keys", "-t", state.paneId, "Enter"], io);
+  const observeDeadline = now() + OBSERVE_CAP_MS;
+  if (before !== null) {
+    for (const delay of OBSERVE_WAITS_MS) {
+      wait(delay, observeDeadline);
+      const after = capturePane(target, state.paneId, io, observeDeadline, now);
+      if (after === null) break;
+      const changed = !unchanged(before, after);
+      if (now() >= observeDeadline) break;
+      if (changed) return { ...state, submitted: true, verified: true };
     }
-    if (enters > RESEND_BACKOFF_MS.length) break;
-    enter();
   }
-  // The text stays in the input box; it is never pasted again.
-  return { ...state, submitted: false, verified: true, reason: "enter-not-taken" };
+  return { ...state, submitted: true, verified: false };
 }

package/package-catalog.json

@@ -38,7 +38,7 @@
     },
     "oats.framework": {
       "url": "https://github.com/awebai/oats.git",
-      "ref": "oats-framework/v1.6.0",
+      "ref": "oats-framework/v1.6.1",
       "path": "oats-package"
     }
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awebai/oats",
-  "version": "0.40.1",
+  "version": "0.41.0",
   "description": "OATS (Open Agent Team Specification) — durable souls, disposable instances, targetable capability packages, and the runtime-neutral oats CLI/kernel.",
   "keywords": [
     "agents",

package/skills/oats-getting-started/SKILL.md

@@ -60,7 +60,7 @@ members:
   - git:github.com/acme/agents          # the host is a member too
   - git:github.com/acme/platform
 packages:
-  oats.framework: v1.6.0                # bare versions resolve through the official catalog
+  oats.framework: v1.6.1                # bare versions resolve through the official catalog
   oats.okf: v4.1.1
 defaults:
   capabilities: { oats.core: { from: package } }