docs(remediation): D-7 reaper doctrine into RM-50; adopt board-roll for the LIVE board

D-7 resolution recorded. Mos verified attribution independently and reaped ~5.2G of
dead-session scratch as lead coordinator. The finding is the gap it exposed: the
authority to reap exists, the deterministic reaper does not.

Two doctrine points now binding on RM-50: (1) 'agents should tidy up' is
instructions-are-not-enforcement wearing another hat — a reaper must own it;
(2) refusing to unilaterally delete another session's scratch was correct, and the
fix is mechanically-decidable ownership/liveness, not braver deletion. Reaper
requirements specified: mechanical liveness (not mtime alone), age threshold,
dry-run, audit event per reap — never a heuristic sweep, which would reintroduce
the P-WORKFLOW-001 auto-sync failure in a more destructive form.

Board restructured into an explicit BOARD-ROLL zone and rolled with the framework's
own board-roll.sh (8432B -> 8014B, D-1 archived to BOARD-LEDGER.md) rather than
hand-trimmed. The tool exists precisely to stop coordinators hand-trimming; using it
is the dogfood.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

docs/remediation/BOARD.md

@@ -53,37 +53,38 @@
 4. Hygiene + conformance harness
    Cross-cutting retirements: flat-file tracking, 3 MACP islands, silent MOSAIC BYPASS.
 
-## Dogfood evidence captured this session (live failure classes, not hypotheticals)
+## Dogfood evidence — live failure classes, not hypotheticals
 
-- **D-1 / P-ACTIVATION + hygiene — committed `.npmrc` hard-pins `store-dir=/root/.local/share/pnpm/store`.**
-  Correct for the CI container (runs as root), fatal for EVERY non-root local checkout: `EACCES` on
-  `/root/.local/share/pnpm/store/v10/server/server.json`. A committed config that only works on one
-  runtime is exactly the activation-skew class. Fix candidate: make store-dir env-overridable, not hardcoded.
-- **D-2 / hygiene — husky `prepare` fails `EPERM` copying into root-owned `.husky/_/`.** Repo working
-  tree has root-owned dirs (`.husky/`, repo root) under a non-root agent. Worked around with the
-  intended `HUSKY=0` escape hatch (does NOT disable the existing pre-commit/pre-push hooks).
-- **D-3 / P-FLEET-001 — the seats running this mission are UNMANAGED.** `mos-remediation`, `rev-974`,
-  `planner-opus`, `planner-sol` appear in NO roster (`~/.config/mosaic/fleet/roster.yaml`, `agents/`).
-  Planners run on socket `default`; the roster declares `mosaic-fleet`. This is the exact
-  "one roster-owned socket/host + quarantine unmanaged + stale GC" failure P-FLEET-001 indicts —
-  observed on the remediation mission's own fleet. Prerequisite for INBOX identity-addressing.
-- **D-4 / P-LIFECYCLE + hygiene — a dispatched agent silently IGNORED an in-message context reset.**
-  planner-sol was at 64.3%/372k; the brief asked it to reset first; it began work on dirty context anyway.
-  Only an out-of-band `/new` driven by the orchestrator guaranteed clean state. Confirms the postmortem
-  thesis: **instructions are not enforcement.** Reset must be a mechanical pre-dispatch step, not a request.
+> Newest first. Oldest entries roll to `BOARD-LEDGER.md` via `board-roll.sh` when this file
+> exceeds its 8 KB cap. Keystone detail is duplicated in `TASKS.md` §1a, so rolling loses nothing.
 
-- **D-6 / P-QUEUE-001 — the mandated queue guard returned PASS on an UNKNOWN state, live, today.**
-  Running the required `ci-queue-wait.sh --purpose push` before pushing produced
-  `state=unknown ... exit 0` — the exact defect at `ci-queue-wait.sh:282-288` that PR #1023 is parked
-  on. It also evaluated `branch=main` rather than the branch being pushed. The mission's own required
-  pre-push gate passed me on an indeterminate result. Third independent live instance of the class.
-- **D-5 / P-QUEUE-001 + P-CONFORMANCE-001 — KEYSTONE: an inert gate that erased its own evidence.**
-  Merged PR #868 (`b79336a8`) shipped a file that FAILS `pnpm format:check` ⇒ the CI format gate did
-  not block. An unrelated later PR (#872) then reformatted that file via its own `lint-staged`, so
-  `main` went green again and nobody learned the gate had failed to fire. Verified blob-level under the
-  repo's own config. **Detection must be per-merge-commit against that commit's own tree** — a "is main
-  green today" check reports all-clear on this exact defect. Binding on RM-02/RM-55. Full chain in
-  `TASKS.md` §1a. NOT quiet-patched, by Mos's ruling: patching the symptom destroys the signal.
+<!-- BOARD-ROLL:START -->
+
+### **D-7 / P-FLEET-001 — stale-GC-on-disk: shared 30G /tmp hit 100% ENOSPC, degrading two seats.**
+
+~5.2G was session scratch dead 8-9 days (this session's own footprint: 88K). Same missing capability as orphaned-tmux-session GC, applied to disk — not a quota or discipline problem. Resolved manually by Mos (lead coordinator) after independent verification; `/tmp` now 79%. **The gap IS the finding:** the authority to reap exists, the deterministic reaper does not. Folded into RM-50 with explicit requirements (mechanical liveness, age threshold, dry-run, audit event per reap — never a heuristic sweep). Refusing to unilaterally delete another session's scratch was correct doctrine; the fix is a reaper, not braver agents.
+
+### **D-6 / P-QUEUE-001 — the mandated queue guard returned PASS on an UNKNOWN state, live, today.**
+
+Running the required `ci-queue-wait.sh --purpose push` before pushing produced `state=unknown ... exit 0` — the exact defect at `ci-queue-wait.sh:282-288` that PR #1023 is parked on. It also evaluated `branch=main` rather than the branch being pushed. The mission's own required pre-push gate passed me on an indeterminate result. Third independent live instance of the class.
+
+### **D-5 / P-QUEUE-001 + P-CONFORMANCE-001 — KEYSTONE: an inert gate that erased its own evidence.**
+
+Merged PR #868 (`b79336a8`) shipped a file that FAILS `pnpm format:check` ⇒ the CI format gate did not block. An unrelated later PR (#872) then reformatted that file via its own `lint-staged`, so `main` went green again and nobody learned the gate had failed to fire. Verified blob-level under the repo's own config. **Detection must be per-merge-commit against that commit's own tree** — a "is main green today" check reports all-clear on this exact defect. Binding on RM-02/RM-55. Full chain in `TASKS.md` §1a. NOT quiet-patched, by Mos's ruling: patching the symptom destroys the signal.
+
+### **D-4 / P-LIFECYCLE + hygiene — a dispatched agent silently IGNORED an in-message context reset.**
+
+planner-sol was at 64.3%/372k; the brief asked it to reset first; it began work on dirty context anyway. Only an out-of-band `/new` driven by the orchestrator guaranteed clean state. Confirms the postmortem thesis: **instructions are not enforcement.** Reset must be a mechanical pre-dispatch step, not a request.
+
+### **D-3 / P-FLEET-001 — the seats running this mission are UNMANAGED.** `mos-remediation`, `rev-974`,
+
+`planner-opus`, `planner-sol` appear in NO roster (`~/.config/mosaic/fleet/roster.yaml`, `agents/`). Planners run on socket `default`; the roster declares `mosaic-fleet`. This is the exact "one roster-owned socket/host + quarantine unmanaged + stale GC" failure P-FLEET-001 indicts — observed on the remediation mission's own fleet. Prerequisite for INBOX identity-addressing.
+
+### **D-2 / hygiene — husky `prepare` fails `EPERM` copying into root-owned `.husky/_/`.** Repo working
+
+tree has root-owned dirs (`.husky/`, repo root) under a non-root agent. Worked around with the intended `HUSKY=0` escape hatch (does NOT disable the existing pre-commit/pre-push hooks).
+
+<!-- BOARD-ROLL:END -->
 
 ## Decisions log