fix: fail closed on invalid launch inputs

packages/mosaic/README.md

@@ -26,6 +26,15 @@ Set `MOSAIC_ASSUME_YES=1` (or ensure stdin is not a TTY) to skip all interactive
 | `MOSAIC_ANTHROPIC_API_KEY` | _(none)_                | No                 |
 | `MOSAIC_CORS_ORIGIN`       | `http://localhost:3000` | No                 |
 
+`MOSAIC_STORAGE_TIER` is a closed enum: `local`, `standalone`, or `federated`.
+Unset or empty input selects the documented local default. Any other non-empty
+value is a typed startup error and is rejected before a storage adapter is
+selected.
+
+The Gateway process also accepts `CHAT_HARNESS_RUNTIME=legacy|pi-rpc`. Unset or
+empty input retains the transitional `legacy` default. Any other non-empty value
+is a typed startup error and is rejected before either runtime is selected.
+
 ### Admin user bootstrap
 
 | Variable                | Default  | Required       |
@@ -55,6 +64,13 @@ mosaic yolo claude       # …with --dangerously-skip-permissions
 mosaic codex | opencode | pi
 ```
 
+Every runtime launch requires its immutable `session.launch` provenance record
+to be written before spawn. A provenance-write failure exits nonzero, starts no
+runtime, and propagates no `MOSAIC_LAUNCH_ID`. Likewise, a spawn error, signal,
+or missing numeric child status is reported with the fixed
+`runtime_launch_failed` code and exits nonzero rather than being interpreted as
+success.
+
 ### `mosaic claudex` (EXPERIMENTAL)
 
 Runs GPT models **inside the Claude Code harness** by pointing Claude Code at a