fix(installer): avoid pipefail marker race

fix(installer): support BusyBox coverage inventory
test(installer): bind execution coverage callers
2026-08-06 12:13:42 -05:00 · 2026-08-06 11:53:56 -05:00 · 2026-08-06 03:48:03 -05:00 · 2026-08-06 03:14:19 -05:00 · 2026-08-06 02:52:14 -05:00 · 2026-08-06 01:38:23 -05:00
119 changed files with 5899 additions and 5320 deletions
@@ -46,10 +46,6 @@ steps:
      # [0] of the pnpm chain, so severing that chain would silence it together
      # with everything it guards; this direct line keeps one instrument running.
      - bash packages/mosaic/framework/tools/quality/scripts/check-test-enumeration.sh
      # Hermetic regression for issue-close.sh (#1081): mocks tea/curl onto PATH
      # and sandboxes a throwaway git repo, so it resolves no real credentials and
      # joins CI directly rather than the exclusions file.
      - bash packages/mosaic/framework/tools/git/test-issue-close-fail-closed.sh
  # Blocking gate (#791): a framework upgrade must never write or delete an
  # operator-owned path. The HARD GATE proves an unanticipated operator sentinel
@@ -0,0 +1,139 @@
 # C1 detector gate. The fixture itself is intentionally RED; CI is green only
 # when its exact phase verdicts/reasons match the versioned expected-RED manifest.
 when:
  - event: [pull_request, manual]
  - event: push
    branch: [next, main]
 steps:
  greenfield-case-denominator-init:
    image: node:22-bookworm-slim
    commands:
      - |
        coverage_run="${CI_PIPELINE_NUMBER}-${CI_WORKFLOW_NUMBER}"
        coverage_root=.mosaic-test-work/greenfield-execution-coverage
        bash tools/verify-greenfield-execution-coverage.sh init cases \
          tools/fixtures/greenfield-expected-red.tsv "$coverage_root" \
          "$coverage_run"
        bash tools/verify-greenfield-execution-coverage.sh init arms \
          tools/fixtures/greenfield-expected-arms.txt "$coverage_root" \
          "$coverage_run"
  greenfield-git-present:
    image: node:22-bookworm-slim
    depends_on:
      - greenfield-case-denominator-init
    commands:
      - |
        set +e
        MOSAIC_GREENFIELD_CONTAINER=1 \
          bash tools/e2e-install-test.sh --lane next --source checkout --git present \
          > /tmp/greenfield-git-present.log 2>&1
        fixture_status=$?
        set -e
        cat /tmp/greenfield-git-present.log
        bash tools/verify-greenfield-expected-red.sh \
          next-git-present /tmp/greenfield-git-present.log "$fixture_status"
        coverage_run="${CI_PIPELINE_NUMBER}-${CI_WORKFLOW_NUMBER}"
        coverage_root=.mosaic-test-work/greenfield-execution-coverage
        bash tools/verify-greenfield-execution-coverage.sh mark cases \
          tools/fixtures/greenfield-expected-red.tsv "$coverage_root" \
          "$coverage_run" next-git-present
        bash tools/verify-greenfield-execution-coverage.sh mark arms \
          tools/fixtures/greenfield-expected-arms.txt "$coverage_root" \
          "$coverage_run" greenfield-git-present
  greenfield-main-git-present:
    image: node:22-bookworm-slim
    depends_on:
      - greenfield-case-denominator-init
    commands:
      - |
        set +e
        MOSAIC_GREENFIELD_CONTAINER=1 \
          bash tools/e2e-install-test.sh --lane main --source checkout --git present \
          > /tmp/greenfield-main-git-present.log 2>&1
        fixture_status=$?
        set -e
        cat /tmp/greenfield-main-git-present.log
        bash tools/verify-greenfield-expected-red.sh \
          main-git-present /tmp/greenfield-main-git-present.log "$fixture_status"
        coverage_run="${CI_PIPELINE_NUMBER}-${CI_WORKFLOW_NUMBER}"
        coverage_root=.mosaic-test-work/greenfield-execution-coverage
        bash tools/verify-greenfield-execution-coverage.sh mark cases \
          tools/fixtures/greenfield-expected-red.tsv "$coverage_root" \
          "$coverage_run" main-git-present
        bash tools/verify-greenfield-execution-coverage.sh mark arms \
          tools/fixtures/greenfield-expected-arms.txt "$coverage_root" \
          "$coverage_run" greenfield-main-git-present
  greenfield-remote-installer-contract:
    image: node:22-bookworm-slim
    depends_on:
      - greenfield-case-denominator-init
    commands:
      - |
        expected="$(awk 'NF {print $1; exit}' tools/install.sh.sha256)"
        actual="$(sha256sum tools/install.sh | awk '{print $1}')"
        test "$actual" = "$expected"
        set +e
        MOSAIC_GREENFIELD_CONTAINER=1 \
          MOSAIC_FIXTURE_INSTALLER_URL="https://git.mosaicstack.dev/mosaicstack/stack/raw/commit/${CI_COMMIT_SHA}/tools/install.sh" \
          MOSAIC_FIXTURE_INSTALLER_SHA256="$expected" \
          MOSAIC_FIXTURE_SOURCE_COMMIT="${CI_COMMIT_SHA}" \
          bash tools/e2e-install-test.sh --lane next --source remote --git present \
          > /tmp/greenfield-remote.log 2>&1
        fixture_status=$?
        set -e
        cat /tmp/greenfield-remote.log
        bash tools/verify-greenfield-expected-red.sh \
          next-git-present /tmp/greenfield-remote.log "$fixture_status"
        coverage_run="${CI_PIPELINE_NUMBER}-${CI_WORKFLOW_NUMBER}"
        coverage_root=.mosaic-test-work/greenfield-execution-coverage
        bash tools/verify-greenfield-execution-coverage.sh mark arms \
          tools/fixtures/greenfield-expected-arms.txt "$coverage_root" \
          "$coverage_run" greenfield-remote-installer-contract
  greenfield-git-absent:
    image: node:22-bookworm-slim
    depends_on:
      - greenfield-case-denominator-init
    commands:
      - |
        set +e
        MOSAIC_GREENFIELD_CONTAINER=1 \
          bash tools/e2e-install-test.sh --lane next --source checkout --git absent \
          > /tmp/greenfield-git-absent.log 2>&1
        fixture_status=$?
        set -e
        cat /tmp/greenfield-git-absent.log
        bash tools/verify-greenfield-expected-red.sh \
          next-git-absent /tmp/greenfield-git-absent.log "$fixture_status"
        coverage_run="${CI_PIPELINE_NUMBER}-${CI_WORKFLOW_NUMBER}"
        coverage_root=.mosaic-test-work/greenfield-execution-coverage
        bash tools/verify-greenfield-execution-coverage.sh mark cases \
          tools/fixtures/greenfield-expected-red.tsv "$coverage_root" \
          "$coverage_run" next-git-absent
        bash tools/verify-greenfield-execution-coverage.sh mark arms \
          tools/fixtures/greenfield-expected-arms.txt "$coverage_root" \
          "$coverage_run" greenfield-git-absent
  greenfield-case-denominator:
    image: node:22-bookworm-slim
    # Publish exact execution coverage after the full matrix, even if a case failed.
    depends_on:
      - greenfield-git-present
      - greenfield-main-git-present
      - greenfield-remote-installer-contract
      - greenfield-git-absent
    when:
      - status: [success, failure]
    commands:
      - |
        coverage_run="${CI_PIPELINE_NUMBER}-${CI_WORKFLOW_NUMBER}"
        coverage_root=.mosaic-test-work/greenfield-execution-coverage
        bash tools/verify-greenfield-execution-coverage-gate.sh \
          tools/verify-greenfield-execution-coverage.sh \
          tools/fixtures/greenfield-expected-red.tsv \
          tools/fixtures/greenfield-expected-arms.txt \
          "$coverage_root" "$coverage_run"
@@ -7,20 +7,21 @@ Mosaic gives you a unified launcher for Claude Code, Codex, OpenCode, and Pi —
 ## Quick Install
 ```bash
-curl -fsSL https://mosaicstack.dev/install.sh | bash
+d="$(mktemp -d)" && trap 'rm -rf "$d"' EXIT && curl -fsSL -o "$d/install.sh" https://git.mosaicstack.dev/mosaicstack/stack/raw/branch/main/tools/install.sh -o "$d/install.sh.sha256" https://git.mosaicstack.dev/mosaicstack/stack/raw/branch/main/tools/install.sh.sha256 && (cd "$d" && test -s install.sh && sha256sum -c install.sh.sha256 && bash install.sh)
 ```
-Or use the direct URL:
+The published installer body must be non-empty and match its versioned SHA-256
-
+sidecar before it executes. A failed fetch, HTTP-200 empty body, or digest
-```bash
+mismatch is fatal. Because both files come from the same repository and trust
-bash <(curl -fsSL https://git.mosaicstack.dev/mosaicstack/stack/raw/branch/main/tools/install.sh)
+domain, this detects corruption or inconsistent publication—not repository or
-```
+server compromise. Independently signed release provenance is explicitly
 deferred by the greenfield-install PRD.
 The installer auto-launches the setup wizard, which walks you through gateway install and verification. Flags for non-interactive use:
 ```bash
-bash <(curl -fsSL …) --yes               # Accept all defaults
+(cd "$d" && bash install.sh --yes)                   # Accept all defaults
-bash <(curl -fsSL …) --yes --no-auto-launch  # Install only, skip wizard
+(cd "$d" && bash install.sh --yes --no-auto-launch)  # Install only, skip wizard
 ```
 This installs both components:
@@ -30,6 +31,16 @@ This installs both components:
 | **Framework**           | Bash launcher, guides, runtime configs, tools, skills            | `~/.config/mosaic/`  |
 | **@mosaicstack/mosaic** | Unified `mosaic` CLI — TUI, gateway client, wizard, auto-updater | `~/.npm-global/bin/` |
 ### Install lanes
 | Lane                     | Command                               | Use when                                              | Source                                                                                      |
 | ------------------------ | ------------------------------------- | ----------------------------------------------------- | ------------------------------------------------------------------------------------------- |
 | Stable                   | `bash tools/install.sh`               | You want the released Mosaic CLI/framework            | npm registry `@mosaicstack/mosaic@latest` + framework archive at `main`                     |
 | Prerelease integration   | `bash tools/install.sh --next`        | You want the current `next` integration branch        | Exact `@next` CLI/gateway versions + pinned `next` framework commit; pinned-source fallback |
 | Contributor/source build | `bash tools/install.sh --dev --ref X` | You are testing a branch before release; `--ref` wins | Build-from-source at the requested ref                                                      |
 `--next` selects the prerelease integration lane. It installs the exact CLI/gateway versions resolved from the aligned `@next` tags, and pins the framework archive to the resolved `next` commit. If the registry path fails, it builds from that pinned source. An explicit `--ref` or `MOSAIC_REF` wins and selects source mode.
 After install, the wizard runs automatically or you can invoke it manually:
 ```bash
@@ -38,10 +49,14 @@ mosaic wizard        # Full guided setup (gateway install → verify)
 ### Requirements
- Node.js ≥ 20
+- Linux x86_64 with glibc (Debian is the greenfield CI platform; musl/Alpine, macOS, and ARM64 currently fail as unsupported)
- npm (for global @mosaicstack/mosaic install)
+- Node.js ≥ 20 and npm ≥ 9
 - `bash`, `curl`, `git`, `python3`, `tar`, and standard core utilities (`awk`, `df`, `find`, `flock`, `grep`, `install`, `realpath`, `sed`, `sha256sum`, `stat`, `sync`)
 - At least 256 MiB free disk and 1,000 free inodes at the npm prefix
 - One or more runtimes: [Claude Code](https://docs.anthropic.com/en/docs/claude-code), [Codex](https://github.com/openai/codex), [OpenCode](https://opencode.ai), or [Pi](https://github.com/mariozechner/pi-coding-agent)
 The installer evaluates canonical phases P0–P9 and does not print `Done.` unless every committed postcondition passes. A failed phase exits non-zero, names the phase, and points to its durable journal under `${XDG_STATE_HOME:-~/.local/state}/mosaic/install/`. See [Installer state machine and recovery](docs/guides/installer-state-machine.md).
 ## Usage
 ### Launching Agent Sessions
@@ -60,14 +75,6 @@ The launcher verifies your config, checks for `SOUL.md`, injects your `AGENTS.md
 Pi launches default to a token-lean skill posture: `mosaic pi` passes `--no-skills` so Pi does not preload every global skill description into the system prompt. Use `MOSAIC_PI_SKILL_MODE=all mosaic pi` for the legacy all-skills catalog, or `MOSAIC_PI_SKILL_MODE=discover mosaic pi` to let Pi use its native settings/project skill discovery.
 Mosaic also loads its Pi extensions from `~/.config/mosaic/runtime/pi/`. Inside Pi,
 `/goal set <statement>` starts a bounded persistent loop that checks every turn and successful
 compaction, requires two evidence-bearing completion reports, and can be inspected or stopped with
 `/goal status`, `/goal pause`, `/goal resume`, and `/goal cancel`. Controller-owned goal-state
 entries redact common credential shapes, but Pi's model/tool-call history is separate, so goals and
 evidence must never contain secrets or raw sensitive output. Mosaic does not install this extension
 into `~/.pi/agent/extensions/`.
 ### TUI & Gateway
 ```bash
@@ -342,16 +349,10 @@ Each stage has a dispatch mode (`exec` for research/review, `yolo` for coding),
 ## Upgrading
-Run the installer again — it handles upgrades automatically:
+Run the same verified installer flow again — it handles upgrades automatically:
 ```bash
-curl -fsSL https://mosaicstack.dev/install.sh | bash
+d="$(mktemp -d)" && trap 'rm -rf "$d"' EXIT && curl -fsSL -o "$d/install.sh" https://git.mosaicstack.dev/mosaicstack/stack/raw/branch/main/tools/install.sh -o "$d/install.sh.sha256" https://git.mosaicstack.dev/mosaicstack/stack/raw/branch/main/tools/install.sh.sha256 && (cd "$d" && test -s install.sh && sha256sum -c install.sh.sha256 && bash install.sh)
 ```
 Or use the direct URL:
 ```bash
 bash <(curl -fsSL https://git.mosaicstack.dev/mosaicstack/stack/raw/branch/main/tools/install.sh)
 ```
 Or use the CLI:
@@ -366,15 +367,17 @@ The CLI also performs a background update check on every invocation (cached for
 ### Installer Flags
 ```bash
-bash tools/install.sh --check           # Version check only
+bash tools/install.sh --check           # Side-effect-free P0-P8 postcondition check
 bash tools/install.sh --framework       # Framework only (skip npm CLI)
 bash tools/install.sh --cli             # npm CLI only (skip framework)
-bash tools/install.sh --ref v1.0        # Install from a specific git ref
+bash tools/install.sh --next            # Prerelease lane: exact @next versions + pinned-source fallback
 bash tools/install.sh --dev             # Contributor lane: source build at --ref/main
 bash tools/install.sh --ref v1.0        # Install from a specific git ref (--ref wins over --next)
 bash tools/install.sh --yes             # Non-interactive, accept all defaults
 bash tools/install.sh --no-auto-launch  # Skip auto-launch of wizard
 ```
-The installer rejects unrecognized flags or positional arguments before making changes and prints the supported-option usage.
+The installer rejects unrecognized flags or positional arguments before making changes and prints the supported-option usage. `--check` reports one PASS/FAIL row for each P0–P8 predicate and exits non-zero if any row fails; it does not create the npm prefix, lock, journal, manifest, or runtime files.
 ## Contributing
@@ -245,21 +245,9 @@ describe('EnrollmentService.createToken', () => {
    const after = Date.now();
    const expiresMs = new Date(result.expiresAt).getTime();
-
+    // Should be at most 900s from now
-    // The property under test is CLAMPING: a 9999s request must come back as 900s.
+    expect(expiresMs - before).toBeLessThanOrEqual(900_000 + 100);
    // The gap between clamped and unclamped is 9_099_000 ms, so the tolerance below
    // only has to exceed CI scheduling jitter — it does not need to be tight to keep
    // the assertion discriminating. A 5s allowance consumes 0.05% of that margin and
    // an unclamped result still misses by three orders of magnitude.
    //
    // It was 100ms and failed on a loaded agent at 900_106 — 6ms over (#1090). A
    // wall-clock budget sized to a fast machine is a flake, not a tighter test.
    const CI_JITTER_MS = 5_000;
    expect(expiresMs - before).toBeLessThanOrEqual(900_000 + CI_JITTER_MS);
    expect(expiresMs - after).toBeGreaterThanOrEqual(0);
    // Explicitly pin the clamp itself, independent of any timing allowance:
    // unclamped (9999s) would exceed this by ~9_099_000 ms.
    expect(expiresMs - before).toBeLessThan(1_000_000);
  });
 });
@@ -102,128 +102,6 @@ Context compaction, session replacement, and same-PID runtime reloads can leave
 ---
 ## Pi Persistent Goal Loop (#1150)
 ### Problem and objective
 A Pi agent can stop after a plausible-looking answer even when the operator's broader objective is
 not complete, and ordinary compaction can weaken or omit the original objective. Mosaic needs an
 optional, operator-controlled goal loop that keeps a Pi session oriented, checks progress at native
 lifecycle boundaries, and resumes work until completion is verified or a bounded safety state is
 reached.
 The objective is a Mosaic-owned Pi extension deployed from the framework into
 `~/.config/mosaic/runtime/pi/`. It must not install into or depend on `~/.pi/agent/extensions/`.
 ### Scope
 #### In scope
 1. `PGL-REQ-01`: The framework SHALL ship a dedicated Pi goal extension under
   `packages/mosaic/framework/runtime/pi/`, seed it under `$MOSAIC_HOME/runtime/pi/`, and make
   `mosaic pi` load it alongside the core Mosaic extension when present.
 2. `PGL-REQ-02`: `/goal` SHALL support setting a goal plus status, pause, resume, cancel, and help
   operations without silently replacing an active goal.
 3. `PGL-REQ-03`: Active branch-specific goal state SHALL be persisted in Pi custom session entries,
   restored on session start and tree navigation, and never rely on a compaction summary as its
   source of truth.
 4. `PGL-REQ-04`: A hidden goal contract SHALL be injected through Pi's `context` event before every
   model request so it remains effective across tool turns, retries, and post-compaction requests.
 5. `PGL-REQ-05`: The harness SHALL inspect every `turn_end` and successful `session_compact` event.
   A structured terminating goal-report tool SHALL capture `continue`, evidence-bearing `achieved`,
   or `blocked` status without requiring a redundant model turn.
 6. `PGL-REQ-06`: An achievement claim SHALL remain provisional until a second consecutive
   evidence-bearing verification report. Any continuation report or successful compaction during
   verification SHALL reset the verification sequence.
 7. `PGL-REQ-07`: Continuation SHALL be initiated at safe lifecycle boundaries, primarily
   `agent_settled`; manual compaction and restored active sessions may schedule a deferred idle
   continuation without re-entering compaction handlers.
 8. `PGL-REQ-08`: The loop SHALL have operator cancellation plus bounded turn and repeated-no-progress
   limits. Exhausted or blocked goals pause rather than continuing indefinitely.
 9. `PGL-REQ-09`: Framework installation and update SHALL preserve normal manifest ownership: the
   goal extension is framework-owned under `runtime/**`, while no goal extension or configuration
   asset is created or modified under the operator's main Pi configuration. Pi remains the owner of
   its native session files used by `appendEntry()`.
 #### Out of scope
 1. A mathematical guarantee that an arbitrary natural-language goal is semantically complete.
 2. Automatically executing user-supplied shell predicates or accepting executable validation code in
   `/goal` arguments.
 3. Restarting Pi after process, host, or supervisor failure; the existing Mosaic fleet/runtime
   supervisor owns process durability.
 4. Gateway, database, web UI, Discord, or cross-harness goal orchestration in this slice.
 ### User and stakeholder requirements
 - An operator can start a goal from Pi and see its current phase, evidence, limits, and latest report.
 - The agent remains oriented after each turn and compaction until verified, paused, blocked,
  exhausted, or cancelled.
 - Local testing uses a file under `~/.config/mosaic/runtime/pi/`; the feature never writes an
  extension asset to `~/.pi/agent/extensions/`.
 - Framework updates deploy the same reviewed extension source through Mosaic's existing manifest
  sync path.
 ### Non-functional requirements
 1. **Safety:** bounded continuation, explicit cancellation, no arbitrary command execution, and no
   completion without non-empty reported evidence.
 2. **Reliability:** serialized continuation scheduling, branch-aware restoration, compaction-safe
   context injection, and stale-timer cancellation on session shutdown.
 3. **Performance:** no extra nested judge-model request on every turn; structured reporting uses the
   active agent's final terminating tool call.
 4. **Observability:** Pi status/notifications expose phase and bounded counters without recording
   credentials or hidden model reasoning.
 5. **Maintainability:** the state machine is deterministic and behavior-tested independently from Pi
   provider/network access.
 ### Acceptance criteria
 1. `AC-PGL-01`: A framework-sync fixture installs the extension at
   `$MOSAIC_HOME/runtime/pi/goal-extension.ts`, and launcher tests prove both Mosaic Pi extensions are
   emitted in deterministic order while absent optional files remain backward-compatible.
 2. `AC-PGL-02`: Command tests prove set/status/pause/resume/cancel behavior, active-goal replacement
   refusal, and bounded input handling.
 3. `AC-PGL-03`: Lifecycle tests prove every turn is recorded, active context is injected on every
   request, two evidence-bearing achievement reports are required, and `agent_settled` continues an
   unmet goal without duplicate scheduling.
 4. `AC-PGL-04`: Compaction and restoration tests prove goal state survives, verification is reset and
   rechecked after compaction, manual compaction continuation is deferred until idle, and tree/session
   branch state is reconstructed correctly.
 5. `AC-PGL-05`: Limit tests prove max-turn and repeated-no-progress exhaustion stop autonomous
   continuation, while pause/cancel/blocked states do not restart.
 6. `AC-PGL-06`: Focused tests, package typecheck/lint/test, repository quality gates, a local Pi load
   smoke test from `~/.config/mosaic/runtime/pi/`, independent review, and terminal-green CI pass before
   issue #1150 closes.
 ### Constraints, risks, and assumptions
 - Dependency: Pi's extension API must continue to provide `registerCommand`, `registerTool`,
  `context`, `turn_end`, `agent_settled`, `session_compact`, session custom entries, and terminating
  tool results.
 - Risk: the working agent can overstate completion. Mitigation: structured evidence, a mandatory
  second verification pass, explicit semantic limitations, and operator-visible reports.
 - Risk: an impossible goal can consume unbounded resources. Mitigation: hard turn/no-progress bounds
  and paused terminal states.
 - Risk: automatic continuation can race compaction or session replacement. Mitigation: drive from
  `agent_settled`, defer idle restarts, generation-check timers, and clear timers on shutdown.
 - `ASSUMPTION:` Two consecutive evidence-bearing reports are the initial local verification policy;
  rationale: it provides a real recheck without doubling every turn's model cost. Future policy may
  add independent or deterministic validators.
 - `ASSUMPTION:` Default limits are 40 turns and 6 repeated no-progress reports, configurable only by
  bounded Mosaic environment settings; rationale: useful persistence with a finite autonomous budget.
 - `ASSUMPTION:` Documentation remains canonical in-repo for this slice; no external docs publication
  is requested.
 ### Testing and delivery intent
 Use TDD for the deterministic controller and lifecycle invariants. Test with fake Pi lifecycle
 objects first, then run a local load/smoke test from the deployed Mosaic path. Deliver source, tests,
 launcher wiring, framework/runtime documentation, user/developer guides, and sitemap updates in one
 reviewed squash PR to `main` with terminal-green CI.
 ---
 ## Fleet Declarative Configuration Management Workstream (FCM, #758)
 ### Problem and objective
@@ -268,68 +146,6 @@ lands. M0 consists only of these normative requirements, the complete task DAG,
 documentation IA checklist, and the legacy example/profile disposition inventory. Subsequent cards
 are defined in [docs/TASKS.md](./TASKS.md) and must remain one card/one PR.
 ### Fleet git identity launch propagation (#1043)
 #### Problem and objective
 A fleet seat can have a registered per-agent Git credential while its launched runtime process lacks
 `MOSAIC_GIT_IDENTITY`. The credential resolver then cannot select the seat identity reliably, which
 blocks repository operations on fail-closed estates and can fall through to an unrelated identity on
 estates where that refusal is not active. The objective is to make Git identity a deterministic,
 roster-derived part of the generated launch projection and prove it reaches the launched process.
 #### Normative requirements
 1. `FGI-REQ-01`: Every generated fleet agent projection SHALL declare
   `MOSAIC_GIT_IDENTITY=<MOSAIC_AGENT_NAME>`; a differing or unsafe identity SHALL fail closed before
   tmux launch.
 2. `FGI-REQ-02`: The clean `/usr/bin/env -i` pane boundary SHALL pass every variable declared by the
   generated projection, including `MOSAIC_GIT_IDENTITY`, to the launched runtime process.
 3. `FGI-REQ-03`: A behavioral integration test SHALL set-compare the complete generated projection
   against the launched process environment. Source-text/string-presence assertions are insufficient.
 4. `FGI-REQ-04`: Verification SHALL include RED-first evidence and a delete-the-subject mutation that
   removes Git-identity pane propagation and makes the behavioral test fail.
 #### Acceptance criteria
 1. `AC-FGI-01`: A launched seat process contains every key/value pair declared by its generated
   environment projection, including the roster-derived Git identity.
 2. `AC-FGI-02`: Missing, unsafe, or split Git identity is rejected before a tmux session is created.
 3. `AC-FGI-03`: Focused launcher and generated-environment tests, repository quality gates,
   independent review, and the required RED/green/R7 evidence are recorded before push.
 ### Framework shell assertion portability (#1098)
 #### Problem and objective
 The blocking framework-shell chain can report that a pane command omitted `/usr/bin/env -i` even when
 `-i` matched successfully. A short-circuiting `grep -q` under `set -o pipefail` may close its pipe after
 the match and cause an upstream producer to exit with SIGPIPE, turning a valid semantic result into a
 nonzero aggregate pipeline. The objective is to inspect the captured NUL-delimited argv directly and
 make failures carry the observed records needed for diagnosis.
 #### Normative requirements
 1. `FSP-REQ-01`: The pane-boundary test SHALL validate an adjacent `/usr/bin/env`, `-i` argv pair from
   the authoritative NUL-delimited tmux capture without a short-circuit pipeline whose upstream status
   can override a successful match.
 2. `FSP-REQ-02`: Missing, reversed, or non-adjacent boundary tokens SHALL fail, while valid boundaries
   SHALL remain valid regardless of trailing argv size, pipe capacity, process scheduling, or host/CI
   utility implementation.
 3. `FSP-REQ-03`: A failed boundary check SHALL print stable indexed, shell-escaped observed argv records
   before exiting nonzero; the fixture SHALL continue to contain generated non-secret launch data only.
 4. `FSP-REQ-04`: Verification SHALL include RED-first large-payload evidence, negative token-order
   controls, the complete focused launcher suite, canonical Woodpecker CI, and independent review.
 #### Acceptance criteria
 1. `AC-FSP-01`: A large captured argv with adjacent `/usr/bin/env`, `-i` passes even when the former
   `grep -q` pipeline returns nonzero from an upstream SIGPIPE.
 2. `AC-FSP-02`: Missing executable, missing flag, and detached/reversed flag fixtures return nonzero and
   emit the indexed observed argv.
 3. `AC-FSP-03`: The focused suite passes on the development host and CI image, and the merged-main
   Woodpecker pipeline is terminal green before #1098 closes.
 ---
 ## Exact Cross-Harness Fleet Communications Contract (#766)
@@ -1552,3 +1368,43 @@ All work is **alpha** (< 0.1.0) until Jason approves 0.1.0 beta release.
 10. ASSUMPTION: **Conversations and messages get their own PG tables** (not stored in brain's entity model). They follow a chat-specific schema with proper foreign keys to users and projects. Rationale: Chat has different access patterns (streaming, pagination, search) than brain entities.
 11. RESOLVED: **Pi handles all target LLM providers natively.** Anthropic, OpenAI/Codex, Z.ai, Ollama, LM Studio, and llama.cpp are all supported via Pi's built-in providers or `models.json` configuration with `openai-completions` API type. No custom provider adapters needed in @mosaicstack/agent — only configuration management.
 ---
 ## Greenfield install correctness — C1 (#1050)
 ### Problem and objective
 A from-zero install can report success while leaving the target host unusable because the installer has no transactional state machine capable of certifying its own postconditions. C1 supplies the structural spine and red-first fixture; later cards repair the individual failed postconditions.
 ### Normative requirements
 1. The installer SHALL implement the canonical P0–P9 numbering from the greenfield-install PRD v2: P0 Resolve context; P1 Preflight; P2 Acquire artifacts; P3 Install CLI; P4 Install framework + skills; P5 Identity; P6 Runtime linking / activation; P7 Services; P8 Shell discoverability; P9 Verify + commit. P2 is scoped to installer-distribution artifacts and SHALL NOT foreclose credentialed downstream acquisition. P5 owns validating any credential capability required by requested downstream work; P7 may provision credential-dependent resources only after that P5 postcondition commits.
 2. Every phase SHALL declare preconditions, action, committed postconditions, and rollback. An unverifiable postcondition SHALL fail the install non-zero with the named phase and a remediation line; no best-effort failure may still certify success. P1's required-tool closure includes tools invoked by later phases, including `git`; a downstream prerequisite may not remain undeclared and degrade silently.
 3. A durable mutation journal SHALL open before the first mutation and commit at P9. Fallible command output needed to diagnose a phase SHALL be journaled and surfaced, never discarded.
 4. `--check` SHALL run exactly the P0–P8 postcondition predicates without mutation, report each phase PASS/FAIL, and exit non-zero if any predicate fails.
 5. P4 SHALL consume a checkout-free, lane/versioned shipped-set declaration published by the installer. C1 SHALL NOT select among the currently disagreeing framework-payload, repository-root, sync-source, and W-jarvis populations; while no declaration exists, P4 reports `NOT-MEASURED / UNDECLARED` and remains blocking rather than fabricating a count. C5 owns the declaration's contents and containment/loadability fulfillment.
 6. The from-zero fixture SHALL be lane-parametric, use Debian/glibc, run the documented install command as a non-root target user with an isolated HOME, and inherit no host credentials, npm cache, home directory, or runtime configuration.
 7. The fixture SHALL select `next` with `--next` or `MOSAIC_NEXT=1` and assert the resolved lane version. Internal predicates use P3's absolute CLI path; shell discoverability is tested only at P8.
 8. Fault injection after each P2–P8 phase SHALL prove either clean rollback or a durable, honestly reported resumable partial state, with no journal incorrectly left in progress.
 9. Unsupported musl/Alpine and unavailable Docker SHALL fail loudly rather than skip as pass. The repository's installer tests SHALL nevertheless run in the canonical Alpine CI image by explicitly modeling a supported non-root/glibc target and using portable filesystem enumeration.
 10. P0 SHALL bind the effective uid and username to the authoritative passwd HOME and shell and state/reject unsafe root or sudo-with-inherited-HOME privilege contexts.
 11. Created paths SHALL satisfy phase-specific target owner/group and mode policy: P3 executables are not group/world writable, framework/runtime trees are not group/world writable, and identity/credential material is private.
 12. The expected-RED comparator SHALL validate the complete manifest before selecting a case: exact case population, one exit and P0–P9 disposition per case, pinned require/forbid classes, and no malformed, duplicate, or unknown rows.
 13. The published installer contract SHALL reject failed fetches, HTTP-success empty bodies, and digest mismatch, then execute the exact digest-verified body. The remote CI arm SHALL enumerate every payload-acquisition path and report a bound/found denominator. It SHALL bind both the installer body and the downstream stack framework/source it consumes to the same immutable CI commit, while retaining `--next` as the lane selector. Source resolution/acquisition SHALL fail closed, and the arm SHALL verify the realised source commit and archive digest after installation. Any out-of-scope unpinned sibling SHALL be named and counted rather than silently included in a broader pinning claim. `ASSUMPTION:` the configured repository's authenticated exact-commit endpoint is trusted to map that commit ID to the returned archive bytes; independent signed provenance/authenticity against repository or TLS trust-root compromise remains excluded by canonical greenfield-install PRD v2 §3.
 14. Phase diagnostics SHALL be redacted before terminal or durable-log output. A seeded positive-control canary SHALL remain absent from observed argv, output, command logs, npm configuration, generated files, and shell history.
 15. The CI fixture SHALL publish pipeline-level execution coverage for both the unconditional case set derived from the expected-RED manifest and the explicitly declared required pipeline-arm set, including the immutable remote-installer contract. Per-case and per-arm success markers SHALL be run-scoped, stored beneath an existing checkout-archive exclusion, and written only after that arm's verifier passes. A final step SHALL depend on the complete fixture matrix, run after prior success or failure, emit both `cases_defined=N cases_executed=M` and `arms_defined=N arms_executed=M`, and invoke the same testable aggregation helper whose complete case/arm PASS/FAIL truth table is covered. It SHALL fail unless both expected/executed name sets are exactly equal; missing, unexpected, stale, newly added unexecuted, or checkout-contaminating state SHALL fail closed. The archive-purity control SHALL bind to the production checkout-archive selector so deleting the production exclusion makes the control RED. Coverage tooling SHALL execute under both the canonical Alpine/BusyBox CI image and the Debian greenfield image; a green result from either runtime alone is insufficient portability evidence. Expected-set membership SHALL consume a fully materialized producer result so an early-closing consumer cannot turn a valid marker into a `pipefail` rejection.
 ### C1 acceptance criteria
 1. The pre-C1 from-zero matrix records both discriminating controls: with `git` absent, the legacy installer still exits zero while P1 fails and skill sync degrades; with `git` present, P1 passes and the observed sync store/runtime links are 101/101. The C1 installer must fail at P1 before mutation when `git` is absent.
 2. The discriminating P3 row passes: the binary exists at the expected absolute path and reports exactly the resolved `next` lane version, while P4, P5, and P8 fail.
 3. The `--check` mutation negative control proves host fingerprints are byte-identical before and after observation.
 4. Woodpecker executes and validates the expected RED fixture plus the immutable remote-installer contract; its pipeline-level coverage gate reports exact equality for the manifest-derived case set and the declared arm set, while skipped-case and skipped-remote-arm controls prove non-execution is red. C1 does not repair P4/P5/P8 or activate #869.
 5. Negative controls prove manifest shrink/duplicates/unknown rows fail, unsafe P0/P3/P4/P5 contexts fail, the P2–P8 fault seam enters real actions rather than synthetic writes, empty/mismatched fetched bodies fail, and a deliberately emitted secret canary is redacted from every persisted/output population.
 ### Explicit exclusions and dependencies
 - C2 owns P8/PATH, C3 owns P5/headless identity, C4 owns P6 activation policy, and C5 owns P4/skills.
 - Main-lane execution is a promotion precondition owned by #1037; C1 only makes the fixture lane-parametric.
 - RM-02 and #869 activation are out of scope.
@@ -9,18 +9,16 @@
 - [Whole mutator-class gate](architecture/mutator-class-gate.md) — default-deny policy, revoke-first/promote-last state machine, TTL, runtime adapters, and T-B/T-C assurance boundary.
 - [Compaction revocation lifecycle](architecture/compaction-revocation.md) — Claude/Pi observer matrix, same-PID generation rollover, failure fencing, and the named bounded residual stale window.
 ## Installation and upgrades
 - [Installer state machine and recovery](guides/installer-state-machine.md) — canonical P0–P9 phases, side-effect-free checks, durable journal states, rollback/remediation, and the Debian greenfield CI gate.
 - [Upgrade safety and recovery](guides/upgrade-safety-and-recovery.md) — framework ownership, durable operator snapshots, verify net, and projection regeneration.
 ## CLI and skill management
 - [Skill registration user guide](guides/user-guide.md#claude-code-skill-registration) — register, unregister, list statuses, automatic install/update reconciliation, and Claude reload behavior.
 - [Skill bridge developer guide](guides/dev-guide.md#claude-code-skill-bridge) — path-validation, ownership, clobber-protection, install/update wiring, tests, and Pi/Codex scope notes.
 ## Pi persistent goals
 - [Persistent goal user guide](guides/user-guide.md#pi-persistent-goals) — `/goal` commands, verification behavior, limits, compaction/resume semantics, and limitations.
 - [Goal extension developer guide](guides/dev-guide.md#pi-persistent-goal-extension) — framework ownership, launcher ordering, lifecycle design, tests, and local Mosaic-path smoke workflow.
 - [Goal loop operations](guides/admin-guide.md#pi-goal-loop-operations) — deployment ownership, bounded settings, pause/resume procedures, and supervisor boundary.
 - [Pi runtime reference](../packages/mosaic/framework/runtime/pi/RUNTIME.md#extensions) — deployed paths, command summary, and bounded environment settings.
 ## Fleet configuration management
 - [Fleet configuration entry point](fleet/README.md) — desired-versus-observed decision tree and complete operator link map.
@@ -5,14 +5,14 @@ Generated environment files are rebuildable projections, not an operator-editabl
 ## Launch chain
-| Layer               | Responsibility                                                                                                                                                                     |
+| Layer               | Responsibility                                                                                                                  |
-| ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| ------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
-| Roster              | `fleet/roster.yaml` supplies the agent name, class, supported runtime, model, reasoning, tool policy, workdir, and tmux socket; Git identity is derived from the exact agent name. |
+| Roster              | `fleet/roster.yaml` supplies the agent name, class, supported runtime, model, reasoning, tool policy, workdir, and tmux socket. |
-| Projection writer   | Renders deterministic fleet/agents/<name>.env.generated from the roster.                                                                                                           |
+| Projection writer   | Renders deterministic fleet/agents/<name>.env.generated from the roster.                                                        |
-| Optional local data | Reads a strict, data-only fleet/agents/<name>.env.local; it cannot shadow generated keys.                                                                                          |
+| Optional local data | Reads a strict, data-only fleet/agents/<name>.env.local; it cannot shadow generated keys.                                       |
-| systemd             | Starts the launcher with env -i and fixed bootstrap data. It does not preload either environment file.                                                                             |
+| systemd             | Starts the launcher with env -i and fixed bootstrap data. It does not preload either environment file.                          |
-| session launcher    | Validates generated and local data before it queries, creates, or stops an exact tmux session.                                                                                     |
+| session launcher    | Validates generated and local data before it queries, creates, or stops an exact tmux session.                                  |
-| runtime launch      | Derives the fixed mosaic yolo <runtime> argument array from validated roster data, then seeds the runtime contract.                                                                |
+| runtime launch      | Derives the fixed mosaic yolo <runtime> argument array from validated roster data, then seeds the runtime contract.             |
 The launcher never `source`s or `eval`s an environment file and never accepts an environment-supplied
 command. `MOSAIC_AGENT_COMMAND`, command/channel overrides, unknown keys, generated-key shadowing,
@@ -24,7 +24,6 @@ secret-like key names, duplicate keys, comments, quoted/export syntax, and unsaf
 ```dotenv
 MOSAIC_AGENT_NAME=<roster name>
 MOSAIC_GIT_IDENTITY=<roster name>
 MOSAIC_AGENT_CLASS=<roster class>
 MOSAIC_AGENT_RUNTIME=<roster runtime>
 MOSAIC_AGENT_MODEL=<roster model hint>
@@ -34,10 +33,8 @@ MOSAIC_AGENT_WORKDIR=<absolute roster work directory>
 MOSAIC_TMUX_SOCKET=<roster socket or empty>
 ```
-`MOSAIC_GIT_IDENTITY` is not independently configurable: it must equal `MOSAIC_AGENT_NAME`, preventing
+The generated launch contract supports `claude`, `codex`, `opencode`, and `pi`. mosaic fleet add
-split runtime and repository identity authority. The generated launch contract supports `claude`,
+rejects another runtime before it writes the roster or modifies generated, local, or quarantine state.
 `codex`, `opencode`, and `pi`. mosaic fleet add rejects another runtime before it writes the roster or
 modifies generated, local, or quarantine state.
 The legacy dogfood stub remains an observability-only canary on its separate `mosaic-factory` socket;
 it has no generated-launch adapter and cannot be added through this path.
@@ -3,12 +3,11 @@
 The launcher consumes validated data, not shell configuration.
 1. Read and validate the canonical roster.
-2. Render deterministic <name>.env.generated data from that roster, including `MOSAIC_GIT_IDENTITY` derived exactly from the roster agent name.
+2. Render deterministic <name>.env.generated data from that roster.
 3. Parse optional <name>.env.local through a strict allowlist.
 4. Reject generated-key shadowing, unknown or sensitive-looking keys, unsafe paths/values, duplicates, malformed lines, shell syntax, and command overrides.
-5. Reject a Git identity that is unsafe or differs from the generated agent name.
+5. Derive the runtime command from validated runtime/model/reasoning data.
-6. Derive the runtime command from validated runtime/model/reasoning data and pass every generated projection entry through the clean process environment boundary.
+6. Target only the exact configured tmux socket and roster session after ownership checks.
 7. Target only the exact configured tmux socket and roster session after ownership checks.
 ## File precedence and ownership
@@ -35,7 +35,6 @@ values, credential material, or command text.
 ```dotenv
 MOSAIC_AGENT_NAME=<roster name>
 MOSAIC_GIT_IDENTITY=<roster name>
 MOSAIC_AGENT_CLASS=<roster class>
 MOSAIC_AGENT_RUNTIME=<roster runtime>
 MOSAIC_AGENT_MODEL=<roster model hint>
@@ -45,9 +44,8 @@ MOSAIC_AGENT_WORKDIR=<absolute roster work directory>
 MOSAIC_TMUX_SOCKET=<roster socket or empty>
 ```
-`MOSAIC_GIT_IDENTITY` is derived from and must equal `MOSAIC_AGENT_NAME`; it is not a separate
+The generated launch contract supports only `claude`, `codex`, `opencode`, and `pi`. fleet add
-operator-controlled identity authority. The generated launch contract supports only `claude`, `codex`,
+uses that same runtime authority and rejects any other runtime before it writes the roster or changes
 `opencode`, and `pi`. fleet add uses that same runtime authority and rejects any other runtime before it writes the roster or changes
 projection, local, or quarantine files. The legacy dogfood stub on its separate `mosaic-factory`
 socket remains an observability canary; it has no generated-launch adapter and cannot be added through
 this projection path.
@@ -7,8 +7,7 @@
 3. [Provider Configuration](#provider-configuration)
 4. [MCP Server Configuration](#mcp-server-configuration)
 5. [Environment Variables Reference](#environment-variables-reference)
-6. [Pi Goal Loop Operations](#pi-goal-loop-operations)
+6. [Local Fleet Canary](./fleet-local-canary.md)
 7. [Local Fleet Canary](./fleet-local-canary.md)
 ---
@@ -265,16 +264,6 @@ Each OIDC provider requires its client ID, client secret, and issuer URL togethe
 | `AGENT_SYSTEM_PROMPT`    | —               | Platform-level system prompt injected into all sessions |
 | `AGENT_USER_TOOLS`       | all tools       | Comma-separated allowlist of tools for non-admin users  |
 ### Mosaic Pi goal loop
 | Variable                      | Default | Description                                                          |
 | ----------------------------- | ------- | -------------------------------------------------------------------- |
 | `MOSAIC_GOAL_MAX_TURNS`       | `40`    | Per-goal autonomous turn limit; accepted range `1..500`              |
 | `MOSAIC_GOAL_MAX_NO_PROGRESS` | `6`     | Consecutive identical progress-report limit; accepted range `1..100` |
 These variables are consumed by the framework-owned Pi goal extension at goal creation. Invalid or
 out-of-range values fall back to the defaults; they do not disable the bounds.
 ### Providers
 | Variable                  | Default                      | Description                                      |
@@ -385,29 +374,3 @@ Session cleanup is scoped to one session identifier and only removes that sessio
 | Variable                | Default                       | Description                                |
 | ----------------------- | ----------------------------- | ------------------------------------------ |
 | `MOSAIC_WORKSPACE_ROOT` | monorepo root (auto-detected) | Root path for mission workspace operations |
 ---
 ## Pi Goal Loop Operations
 The reviewed runtime asset is deployed at
 `~/.config/mosaic/runtime/pi/goal-extension.ts` by framework install/update. Do not install another
 copy under `~/.pi/agent/extensions/`; duplicate registration can create suffixed commands and two
 competing lifecycle controllers.
 Operational checks:
 1. Run `mosaic pi` and verify `/goal help` is available.
 2. Use `/goal status` to inspect phase, turn/no-progress limits, compaction checks, and evidence.
   Reports persist in Pi session data; controller-owned state redacts common credential shapes, but
   Pi's model/tool-call history is separate. Operators must not place secrets or raw sensitive output
   in goals, pause reasons, or evidence.
 3. Use `/goal pause <reason>` before planned maintenance or manual investigation. Pause and cancel
   abort the current goal-driven run when Pi is busy.
 4. Use `/goal resume` only after addressing a blocker; counters restart with the configured bounds.
 5. Use `/goal cancel` before replacing an unfinished goal.
 A blocked or exhausted goal remains stopped and visible; Mosaic does not automatically raise its
 limits or restart the process. Framework sync owns file deployment, while Pi's native session file
 owns branch replay. Process/host restart remains the responsibility of the existing runtime or fleet
 supervisor.
@@ -9,9 +9,8 @@
 5. [Adding New MCP Tools](#adding-new-mcp-tools)
 6. [Database Schema and Migrations](#database-schema-and-migrations)
 7. [Claude Code Skill Bridge](#claude-code-skill-bridge)
-8. [Pi Persistent Goal Extension](#pi-persistent-goal-extension)
+8. [API Endpoint Reference](#api-endpoint-reference)
-9. [API Endpoint Reference](#api-endpoint-reference)
+9. [Local Fleet Canary](./fleet-local-canary.md)
 10. [Local Fleet Canary](./fleet-local-canary.md)
 ---
@@ -386,85 +385,6 @@ M1 intentionally manages Claude Code only. Pi's Mosaic launcher can discover the
 canonical root directly. Codex still relies on the existing full skill-sync
 linker and needs separate parity analysis before this lifecycle API is extended.
 ## Pi Persistent Goal Extension
 The source of the Mosaic-owned Pi goal controller is:
 ```text
 packages/mosaic/framework/runtime/pi/goal-extension.ts
 ```
 The framework manifest classifies `runtime/**` as framework-owned. Both the bash installer and the
 TypeScript file adapter therefore deploy the same reviewed source to:
 ```text
 $MOSAIC_HOME/runtime/pi/goal-extension.ts
 # default: ~/.config/mosaic/runtime/pi/goal-extension.ts
 ```
 Do not copy or link this extension into `~/.pi/agent/extensions/`. The launcher function
 `discoverPiExtensionArgs()` emits the core `mosaic-extension.ts` first and the optional
 `goal-extension.ts` second, preserving compatibility with an older installed framework that does
 not have the goal file yet.
 ### Lifecycle design
 | Pi API                         | Goal-controller responsibility                                                    |
 | ------------------------------ | --------------------------------------------------------------------------------- |
 | `registerCommand('goal')`      | Set, inspect, pause, resume, or cancel one branch-specific goal                   |
 | `registerTool(...)`            | Record a terminating structured progress report with evidence                     |
 | `context`                      | Inject the active goal contract before every provider request                     |
 | `turn_end`                     | Record every turn, reject mixed final reports, and enforce the turn bound         |
 | `agent_settled`                | Start one deduplicated continuation only after Pi has no retry/compact/queue work |
 | `session_compact`              | Record the compact check, reset provisional verification, and defer idle work     |
 | `session_start`/`session_tree` | Rebuild state from custom entries on the active branch                            |
 | `session_shutdown`             | Invalidate deferred callbacks and clear UI state                                  |
 State is appended as `mosaic-goal-state` custom entries, which do not enter model context. The
 `context` hook creates a fresh hidden `mosaic-goal-context` message for each request instead of
 trusting compaction summaries. The `mosaic_goal_report` result uses `terminate: true`; when it is the
 sole final tool call, Pi avoids an unnecessary model response before the controller decides whether
 to verify, continue, or stop.
 Before state is appended or displayed, the controller applies bounded credential-pattern redaction
 to the goal statement, report summary/evidence/next step, and stop reason. Fingerprints are computed
 over redacted report content. Pi session entries are append-only, so a credential-bearing legacy
 entry cannot honestly be erased by the extension: restoration fails closed, emits a warning, and
 requires removal of the affected session before setting a new goal. This is defense-in-depth rather
 than a secret-storage contract, and it does not rewrite Pi's separate model-message/tool-call
 history. Goal prompts tell the agent not to submit credentials or raw sensitive output, and tests use
 canaries to prove known forms do not reach new custom entries, status text, context, or tool details
 while ordinary typed fields such as `token: string` remain intact.
 Completion remains evidence-gated but semantic: two consecutive `achieved` reports are required,
 and the second run is explicitly a verification pass. This avoids an extra judge-model request after
 every turn. Deterministic validator commands are intentionally not accepted as `/goal` input in this
 slice, so never describe this mechanism as proof of arbitrary natural-language completion.
 ### Tests and local smoke workflow
 ```bash
 pnpm --filter @mosaicstack/mosaic exec vitest run \
  src/runtime/pi-goal-extension.spec.ts \
  src/commands/launch.spec.ts \
  src/config/file-adapter.test.ts
 bash packages/mosaic/framework/tools/quality/scripts/test-install-migration.sh
 ```
 For an additive local smoke test without reseeding unrelated live framework files:
 ```bash
 install -D -m 0644 \
  packages/mosaic/framework/runtime/pi/goal-extension.ts \
  ~/.config/mosaic/runtime/pi/goal-extension.ts
 pi --extension ~/.config/mosaic/runtime/pi/goal-extension.ts
 ```
 Use `/goal help`, `/goal set ...`, and `/goal status` in that test session. A released framework
 sync installs the file, and a released Mosaic CLI loads it automatically through `mosaic pi`.
 ## API Endpoint Reference
 All endpoints are served by the gateway at `http://localhost:14242` by default.
@@ -0,0 +1,99 @@
 # Installer State Machine and Recovery
 The unified installer uses a transactional P0–P9 model. It may report success only after P9 reasserts every applicable committed postcondition. Internal phases invoke the CLI by P3's absolute path; shell discovery is checked only at P8.
 ## Canonical phases
 | Phase                           | Responsibility                                                                                                                    | Failure disposition                                                              |
 | ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
 | P0 Resolve context              | Bind uid/username to the authoritative passwd HOME/shell, state privilege mode, architecture, libc, Node, and npm                 | Fail before mutation                                                             |
 | P1 Preflight                    | Validate downstream tool closure (including `git` and `python3`), writable prefix, registry lane, disk/inodes, and exclusive lock | Fail before target mutation                                                      |
 | P2 Acquire artifacts            | Resolve exact registry versions and an immutable framework commit; record lane and SHA-256                                        | Discard temporary work                                                           |
 | P3 Install CLI                  | Install at the configured absolute prefix; require exact version plus target owner/group and non-writable executable mode         | Restore the prior prefix/npmrc snapshot                                          |
 | P4 Install framework + skills   | Sync framework and consume a checkout-free, lane/versioned shipped-skill declaration                                              | Restore prior framework/runtime trees                                            |
 | P5 Identity                     | Validate SOUL/USER content and private modes; require private credential storage and target owner/group                           | Restore generated identity/credential binding                                    |
 | P6 Runtime linking / activation | Evaluate activation honestly; never treat dead enforcement hooks as active readiness                                              | Restore runtime activation files                                                 |
 | P7 Services                     | Provision only requested services/resources after any required P5 credential commits                                              | Stop and restore requested services/resources                                    |
 | P8 Shell discoverability        | Require fresh login and non-login shells of the actual target shell to resolve P3's path                                          | Restore shell profiles                                                           |
 | P9 Verify + commit              | Re-run P0–P8, commit the manifest, and seal the journal                                                                           | Leave an honestly reported resumable failure or restore the pre-install snapshot |
 The phase numbers are a cross-workstream contract and must not be renumbered.
 ## Side-effect-free check
 ```bash
 bash tools/install.sh --check          # stable/latest lane
 bash tools/install.sh --check --next   # prerelease lane
 ```
 `--check`:
 - emits exactly one `[P0]` through `[P8]` PASS/FAIL row;
 - exits non-zero if any predicate fails;
 - does not create the npm prefix, lock, journal, manifest, shell profile, or runtime file;
 - uses temporary npm observation storage outside the target HOME and removes it before exit.
 P4 currently fails as `NOT-MEASURED / UNDECLARED` until the installer publishes `~/.config/mosaic/.install-shipped-skills.json`. C1 deliberately does not select among the conflicting candidate populations; C5 owns publishing and fulfilling that declaration. Once present, the P4 predicate requires the declaration's lane/version to match the resolved install and every named skill to remain contained under `skills/<name>/SKILL.md` with matching loadable frontmatter.
 ## Durable journal
 Each mutating run creates a private transaction directory:
 ```text
 ${XDG_STATE_HOME:-~/.local/state}/mosaic/install/
  active.json
  <UTC-run-id>/
    journal.ndjson
    journal.ndjson.sha256   # committed runs only
    commands.log
    snapshot/
 ```
 Before each mutation scope is touched, `journal.ndjson` records:
 - phase and path;
 - whether prior state existed and where its snapshot lives;
 - the reversal action;
 - the captured command-output location and command status.
 Journal, action-status, manifest, or command-log write/sync failure is fatal. An unrecorded mutation is not allowed. Command diagnostics are redacted before terminal output or durable logging; credential-shaped environment values, bearer values, auth tokens, and credentialed URLs are never deliberately persisted. Successful P9 runs append a seal event, write the SHA-256 sidecar, and make the journal and sidecar read-only. Required P4/P6 action failures are persisted in the manifest so a later `--check` cannot turn a failed action into a false pass.
 Rollback roots must be non-overlapping, non-symlinked, target-user-owned strict descendants of canonical `HOME`; unsafe custom `MOSAIC_HOME`/`MOSAIC_PREFIX` values fail at P0. The same validation runs again immediately before recursive rollback. The OS lock is concurrency authority: if a process dies while `active.json` still says `in-progress`, a retry that acquires the free lock preserves the stale projection as `prior-active.json` and proceeds from the honestly retained partial state.
 `active.json` is the current projection:
 - `in-progress`: incomplete/open transaction;
 - `rolled-back`: a fault restored the snapshot;
 - `rollback-failed`: restoration failed or refused a replaced/unsafe target and requires manual recovery;
 - `failed-resumable`: named postconditions failed and the recorded partial state remains for remediation;
 - `committed`: P9 passed and the journal is sealed.
 ## Failure recovery
 1. Read the named phase and remediation line from installer stderr.
 2. Inspect `active.json`, then the referenced `journal.ndjson` and `commands.log`. Command output needed to diagnose a failure is preserved and surfaced; it is not redirected away.
 3. For `rolled-back`, verify the target paths match their pre-install state before retrying.
 4. For `failed-resumable`, repair the named phase owner requirement, then run `install.sh --check` before retrying the installer.
 5. Do not activate the #869 enforcement hooks merely to turn P6 green. A broker-less host with those hooks is a failed P6 state.
 ## Greenfield CI gate
 `.woodpecker/greenfield-install.yml` runs `tools/e2e-install-test.sh` from zero in Debian/glibc as a non-root uid with `env -i`. No host HOME, npm cache, credentials, or bind mount enters the target process. Checkout mode packages the complete current checkout into an archive, pins its SHA-256 through an internal fixture seam, and copies the self-contained fixture into the container; framework-installer changes in the PR are therefore exercised rather than fetched from an older remote branch.
 The C1 fixture intentionally returns an attributable RED while C2–C5 remain open. CI itself remains green only when the fixture's final P0–P9 verdicts, required discriminator rows, seeded secret-canary scan, and non-zero exit match the versioned contract in `tools/fixtures/greenfield-expected-red.tsv`. The comparator validates the complete three-case schema before selecting a case: exactly one exit and P0–P9 disposition per case, pinned require/forbid populations, and no duplicate or unknown rows. Any later remediation that changes an observed verdict makes CI red until the owning lane deliberately updates that manifest:
 - `git` present: P1 and strict P3 pass; P4/P5/P6/P8 fail for their own reasons; P9 refuses success.
 - `git` absent: P1 fails before target mutation and the installer emits no `Done.`.
 The fixture is lane-parametric:
 ```bash
 bash tools/e2e-install-test.sh --lane next --git present
 bash tools/e2e-install-test.sh --lane main --git present
 ```
 CI exercises both lane parameters as expected-RED structural checks. A separate remote-contract arm fetches the installer at the immutable CI commit, rejects failed or empty HTTP-success bodies, compares it to the reviewed `tools/install.sh.sha256`, and executes that exact fetched artifact. The P2–P8 fault matrix runs the real phase actions (including the P3 npm path, P4 framework path, and wizard path) rather than synthetic representative writes, then compares the complete target tree to its pre-install fingerprint. Delivery targets `main` under the trunk-only merge rule; `next` remains a non-merging integration lane. The linked installer issue stays open after merge and closes only after Jarvis independently validates the greenfield behavior.
 ## Source trust boundary
 Remote installer mode requires a non-empty body and an expected SHA-256 before execution. Remote source-archive mode separately pins the resolved commit, records the archive SHA-256, limits compressed/expanded size and entry count, and rejects traversal, links, devices, and special files before extraction. These controls provide immutable run provenance and archive safety, not an independent signing root. Signed artifact metadata/provenance is explicitly deferred by the canonical greenfield PRD; C1 does not invent a signing system. The checkout and remote CI seams verify reviewed digests before executing their artifacts.
@@ -12,6 +12,20 @@ with no snapshot to fall back to.
 Protection is layered. Each layer is independent; a later layer catches what an
 earlier one misses.
 ## Layer 0 — Transaction journal (install-wide recovery)
 The unified installer opens a private journal under
 `${XDG_STATE_HOME:-~/.local/state}/mosaic/install/` before the first target
 mutation. Every mutation scope records its path, prior snapshot, and reversal
 instructions before it is touched. Journal write/sync failure is fatal, and P9
 seals successful journals with a SHA-256 sidecar. See
 [Installer state machine and recovery](./installer-state-machine.md).
 This transaction journal is distinct from the retained operator-only backup
 below. The transaction journal is required for correctness and rollback;
 Layer 2's durable backup remains a separately stated, fail-open recovery bonus
 for a manifest bug that the normal transaction did not detect.
 ## Layer 1 — Manifest-owned sync (prevention)
 The single source of truth for ownership is
@@ -8,10 +8,9 @@
 4. [Tasks](#tasks)
 5. [Settings](#settings)
 6. [CLI Usage](#cli-usage)
-7. [Pi Persistent Goals](#pi-persistent-goals)
+7. [Sub-package Commands](#sub-package-commands)
-8. [Sub-package Commands](#sub-package-commands)
+8. [Telemetry](#telemetry)
-9. [Telemetry](#telemetry)
+9. [Local Fleet Canary](./fleet-local-canary.md)
 10. [Local Fleet Canary](./fleet-local-canary.md)
 ---
@@ -308,57 +307,6 @@ mosaic prdy
 mosaic quality-rails
 ```
 ## Pi Persistent Goals
 `mosaic pi` loads a Mosaic-owned goal extension from
 `~/.config/mosaic/runtime/pi/goal-extension.ts`. It is deliberately not installed in
 `~/.pi/agent/extensions/`; framework installation and updates manage it with the rest of the Mosaic
 runtime assets.
 Start Pi, then set a goal:
 ```text
 /goal set Deliver the feature, tests, documentation, and verification evidence
 # Shorthand:
 /goal Deliver the feature, tests, documentation, and verification evidence
 ```
 Control and inspect the loop with:
 | Command                | Behavior                                                           |
 | ---------------------- | ------------------------------------------------------------------ |
 | `/goal status`         | Show phase, limits, compaction checks, latest report, and evidence |
 | `/goal pause [reason]` | Stop autonomous continuation while preserving the goal             |
 | `/goal resume`         | Resume with fresh turn and no-progress counters                    |
 | `/goal cancel`         | Cancel the goal and remove its active status                       |
 | `/goal help`           | Show command help                                                  |
 While a goal is active, Mosaic injects its contract before every Pi model request and checks every
 completed model/tool turn. The agent ends each work cycle with the structured
 `mosaic_goal_report` tool. `achieved` is provisional until a second consecutive report rechecks the
 whole goal with evidence. A continuation report or a successful compaction resets provisional
 verification.
 Goal statements and reports are stored in Pi session data. Mosaic redacts common credential shapes
 before appending its goal-state entries and before goal tool output or `/goal status`, but
 pattern-based redaction is not a secret store. Pi's own model-message and tool-call records are
 outside that redactor. Never put tokens, passwords, private keys, connection strings, or raw
 sensitive output in a goal or report; cite the command, artifact, and pass/fail result instead.
 The loop stops instead of running forever when it is paused, blocked, cancelled, verified, reaches
 its turn limit, or repeats the same no-progress report too many times. Defaults are 40 turns and 6
 repeated no-progress reports. Operators may lower or raise them within enforced bounds before
 launching Pi:
 ```bash
 MOSAIC_GOAL_MAX_TURNS=60 MOSAIC_GOAL_MAX_NO_PROGRESS=8 mosaic pi
 ```
 Goal state is branch-specific Pi session data. It survives compaction and session resume, but Pi's
 process still must be relaunched or supervised after a process/host failure. This initial verifier
 checks structured evidence twice; it cannot mathematically prove every arbitrary natural-language
 goal. Use explicit acceptance criteria and inspect `/goal status` for consequential work.
 ---
 ### Claude Code Skill Registration
@@ -1,72 +0,0 @@
 # #1099 pipefail + early-exit sweep
 Baseline: `df4c591ab42aa1ae62c12935fdc0e772684864a0`
 This is a site inventory, not a risk count. `FIXED` means the early-exiting consumer no longer has a piped upstream process whose SIGPIPE can become the result under `pipefail`. `NOT-LOAD-BEARING` means the pipeline status is explicitly discarded. `UNREACHABLE-AND-WHY` describes designed input, not a payload-size safety claim.
 ## Tranche 1 — runtime and general scripts
 | Baseline site | Verdict | Construction / reason |
 | --- | --- | --- |
 | `tools/matrix-presence-harness/run.sh:38` | FIXED | nullglob array selects the first path; no pipeline |
 | `tools/e2e-install-test.sh:139` | FIXED | capture help completely, then grep via redirection |
 | `tools/install.sh:312` | FIXED | NUL `mapfile` reads all roots; count != 1 reaches the named malformed-archive diagnostic |
 | `scripts/analysis/reflect-board-history.sh:76` | FIXED | capture Git history completely, then grep via redirection |
 | `scripts/analysis/reflect-git-history.sh:67` | FIXED | grep reads from a here-string |
 | `scripts/analysis/reflect-git-history.sh:69` | FIXED | grep reads from a here-string |
 | `packages/mosaic/framework/tools/authentik/user-create.sh:72` | FIXED | jq `first(...)` reads the response directly |
 | `packages/mosaic/framework/tools/git/mutate-push-guard.sh:87` | FIXED | grep `-m1` reads the file directly; downstream `cut` consumes its complete scalar output |
 | `packages/mosaic/framework/tools/orchestrator/session-resume.sh:94` | FIXED | `mapfile` plus bounded indexed loop replaces `head` pipeline |
 | `packages/mosaic/framework/tools/prdy/prdy-status.sh:69` | FIXED | grep reads from a here-string |
 | `packages/mosaic/framework/tools/qa/reflect-stop-hook.sh:172` | FIXED | grep reads from a here-string |
 | `packages/mosaic/framework/tools/qa/reflect-stop-hook.sh:173` | FIXED | grep reads from a here-string |
 | `packages/mosaic/framework/tools/qa/reflect-stop-hook.sh:174` | FIXED | grep reads from a here-string |
 | `packages/mosaic/framework/tools/qa/reflect-stop-hook.sh:175` | FIXED | grep reads from a here-string |
 | `packages/mosaic/framework/tools/qa/reflect-stop-hook.sh:176` | FIXED | grep reads from a here-string |
 | `packages/mosaic/framework/tools/qa/reflect-stop-hook.sh:177` | FIXED | grep reads from a here-string |
 | `packages/mosaic/framework/tools/qa/reflect-stop-hook.sh:178` | FIXED | grep reads from a here-string |
 | `packages/mosaic/framework/tools/qa/typecheck-hook.sh:16` | FIXED | Bash regex extracts the first field without a pipeline |
 | `packages/mosaic/framework/tools/qa/typecheck-hook.sh:56` | FIXED | grep and bounded sed each read from a here-string |
 | `packages/mosaic/framework/tools/tmux/send-message.sh:113` | FIXED | grep reads from a here-string |
 | `packages/mosaic/framework/tools/tmux/send-message.sh:124` | FIXED | grep reads from a here-string |
 | `packages/mosaic/framework/tools/wake/detector.sh:126` | FIXED | one awk reads the manifest directly and exits after the first exact key |
 | `packages/mosaic/framework/tools/wake/detector.sh:270` | FIXED | grep reads from a here-string |
 | `packages/mosaic/framework/tools/wake/detector.sh:278` | FIXED | grep reads from a here-string |
 | `packages/mosaic/framework/tools/wake/digest.sh:647` | FIXED | capture complete locator output, then select first line by parameter expansion |
 | `packages/mosaic/framework/tools/wake/reconcile.sh:149` | FIXED | one awk reads the manifest directly and exits after the first exact key |
 ## Explicit withdrawn / non-load-bearing sites
 | Baseline site | Verdict | Reason |
 | --- | --- | --- |
 | `tools/install.sh:182` | NOT-LOAD-BEARING | `|| true` explicitly discards lookup status |
 | `tools/install.sh:356` | UNREACHABLE-AND-WHY | `pnpm pack` writes one matching CLI tarball into a fresh directory immediately before lookup; citation withdrawn in #1099 |
 | `tools/install.sh:357` | UNREACHABLE-AND-WHY | same fresh-directory invariant for gateway tarball; citation withdrawn in #1099 |
 | `tools/install.sh:627` | NOT-LOAD-BEARING | `|| true` explicitly discards lookup status |
 | `scripts/agent/session-start.sh:70` | NOT-LOAD-BEARING | optional scratchpad lookup has `|| true` |
 | `packages/mosaic/framework/templates/repo/scripts/agent/session-start.sh:58` | NOT-LOAD-BEARING | optional scratchpad lookup has `|| true` |
 | `packages/mosaic/framework/tools/qa/qa-hook-stdin.sh:25` | UNREACHABLE-AND-WHY | withdrawn in #1099 after designed-input reachability measurement; preserved without re-litigation |
 | `packages/mosaic/framework/tools/qa/qa-hook-stdin.sh:27` | UNREACHABLE-AND-WHY | same withdrawn designed-input finding |
 | `packages/mosaic/framework/tools/qa/qa-hook-stdin.sh:30` | UNREACHABLE-AND-WHY | same withdrawn designed-input finding |
 | `packages/mosaic/framework/tools/qa/qa-hook-stdin.sh:32` | UNREACHABLE-AND-WHY | same withdrawn designed-input finding |
 | `packages/mosaic/framework/tools/qa/qa-hook-stdin.sh:34` | UNREACHABLE-AND-WHY | same withdrawn designed-input finding |
 ## Tranche 2 — non-wake test harnesses
 All 22 baseline sites below are `FIXED`; the checked-in tranche fixture is passed through the same scanner and asserts all 22 occurrences and 21 normalized identities (the same response-split line occurs twice).
 | Baseline site(s) | Verdict | Construction |
 | --- | --- | --- |
 | `systemd/user/test-fleet-units.sh:148` | FIXED | capture tmux output, then grep via redirection |
 | `git/test-issue-comment-readback.sh:283,302` | FIXED | parameter expansion splits status/body without `head` |
 | `git/test-pr-review-gitea-comment.sh:228` | FIXED | parameter expansion splits status/body |
 | `git/test-lane-brief-pr-linkage.sh:72` | FIXED | grep reads from a here-string |
 | `git/test-pr-review-repo-host-override.sh:225-226` | FIXED | grep reads from a here-string |
 | `orchestrator/smoke-test.sh:67,72` | FIXED | parameter expansion selects first line |
 | `orchestrator/test-board-roll.sh:99-100` | FIXED | grep reads from a here-string |
 | `quality/scripts/test-upgrade-durable-snapshot.sh:180` | FIXED | complete sorted output is read with `mapfile`, then indexed |
 | `quality/scripts/test-upgrade-rollback.sh:339,356` | FIXED | direct `grep -m1` file reads; cleanup captures before testing |
 | `tmux/test-send-message-socket.sh:37,38,44-46,68,72` | FIXED | capture commands complete before redirected grep assertions |
 | `tmux/test-send-message-verdict.sh:34` | FIXED | grep reads from a here-string |
 Remaining wake-validation sites are intentionally deferred to the final review-sized tranche and are not yet assigned a safety verdict here.
@@ -0,0 +1,14 @@
 subject_head=3edde464b3891ad439019fcc19aad7728e4c2fb8
 source=git show HEAD:tools/install-next-lane.test.sh
   477	  echo 'credentialed URL userinfo leaked to terminal output' >&2; exit 1
   478	fi
   479	[[ "$(grep -oF '[REDACTED]@' <<<"$OUTPUT" | wc -l | tr -d ' ')" -ge 5 ]] \
   480	  || { echo 'credentialed URL redaction controls were not all exercised' >&2; exit 1; }
   481	secret_active="$TMP/secret-state/active.json"
 --
   525	  echo 'framework nested capture leaked credential diagnostics' >&2; exit 1
   526	fi
   527	[[ "$(grep -oF '[REDACTED]@' "$framework_log" | wc -l | tr -d ' ')" -ge 5 ]] \
   528	  || { echo 'framework URL redaction controls were not exercised' >&2; exit 1; }
   529
@@ -0,0 +1,16 @@
 source=/tmp/c1-ci-next-x.log (exact failing canonical-image xtrace)
 credential material is already replaced by the redactor token [REDACTED]; no live secret is reproduced
  urls=https://[REDACTED]@example.com/a https://[REDACTED]@example.net/b https://[REDACTED]@example.org/c https://[REDACTED]@example.dev/d https://[REDACTED]@example.io/e
  urls=https://[REDACTED]@example.com/a https://[REDACTED]@example.net/b https://[REDACTED]@example.org/c https://[REDACTED]@example.dev/d https://[REDACTED]@example.io/e
 line_count=2
 occurrence_count=10
 observed_assertion_value=2 (from xtrace: [[ 2 -ge 5 ]])
 canonical-image discriminator (same locally cached digest as failing run):
 image_id=sha256:d40fb1a218b72d3dcbf8a427a5076facf2a6d958b6854e6bbd057f7264540841 repo_digests=["git.mosaicstack.dev/mosaicstack/stack/ci-base@sha256:0f1d996a6cfcc09e6dcf979ee66c872a1b0be4f1bfde852b4790f520ddd0d776"]
 busybox=BusyBox v1.37.0 (2026-01-10 15:38:28 UTC)
 regex_-o_single_line=5
 fixed_-oF_single_line=1
 fixed_-oF_two_lines=2
@@ -0,0 +1,14 @@
 positive_control_exit=1
 seeded_line=https://[MASKED-USERINFO]@example.io/e (actual synthetic userinfo intentionally omitted here)
 expected_failure=credentialed URL redaction control missing for example.io
 transcript_tail:
 [test] --next fast path pins resolved package versions
 [test] fast path failure falls back to source build
 [test] source-build failure is fatal and restores the pre-install prefix
 [test] corrupt source archive is fatal and restores the pre-install prefix
 [test] --dev source install does not require registry version resolution
 [test] explicit --ref keeps source lane and avoids @next lookup
 [test] --check --next rejects mismatched prerelease pipeline suffixes
 [test] full framework path receives P3 absolute CLI without relying on PATH
 [test] captured diagnostics redact seeded credential canary everywhere
 credentialed URL redaction control missing for example.io
@@ -0,0 +1,10 @@
 [test] --next fast path pins resolved package versions
 [test] fast path failure falls back to source build
 [test] source-build failure is fatal and restores the pre-install prefix
 [test] corrupt source archive is fatal and restores the pre-install prefix
 [test] --dev source install does not require registry version resolution
 [test] explicit --ref keeps source lane and avoids @next lookup
 [test] --check --next rejects mismatched prerelease pipeline suffixes
 [test] full framework path receives P3 absolute CLI without relying on PATH
 [test] captured diagnostics redact seeded credential canary everywhere
 credentialed URL redaction control missing for example.io
@@ -0,0 +1,579 @@
 #!/usr/bin/env bash
 set -euo pipefail
 ROOT="/work"
 # shellcheck source=tools/test-enumeration-assertions.sh
 source "$ROOT/tools/test-enumeration-assertions.sh"
 TMP="$(mktemp -d "${TMPDIR:-/tmp}/mosaic-next-install-test-XXXXXX")"
 trap 'rm -rf "$TMP"' EXIT
 export TMPDIR="$TMP/runtime-tmp"
 mkdir -p "$TMPDIR"
 FAKE_BIN="$TMP/bin"
 HOME_DIR="$TMP/home"
 PREFIX="$HOME_DIR/prefix"
 MOSAIC_HOME="$HOME_DIR/mosaic"
 STATE="$TMP/state"
 LOG="$TMP/npm.log"
 mkdir -p "$FAKE_BIN" "$HOME_DIR" "$STATE"
 # Model the supported non-root/glibc target explicitly even when this harness
 # itself runs as root in Alpine/BusyBox CI.
 cat > "$FAKE_BIN/id" <<'FAKE_ID'
 #!/usr/bin/env bash
 case "${1:-}" in
  -u) echo 1001 ;;
  -g) echo 1001 ;;
  -un) echo fixture-user ;;
  *) exec /bin/id "$@" ;;
 esac
 FAKE_ID
 cat > "$FAKE_BIN/getent" <<FAKE_GETENT
 #!/usr/bin/env bash
 printf 'fixture-user:x:1001:1001::%s:/bin/bash\n' '$HOME_DIR'
 FAKE_GETENT
 cat > "$FAKE_BIN/ldd" <<'FAKE_LDD'
 #!/usr/bin/env bash
 printf 'ldd (GNU libc) 2.36\n'
 FAKE_LDD
 cat > "$FAKE_BIN/stat" <<'FAKE_STAT'
 #!/usr/bin/env bash
 if [[ "${1:-} ${2:-}" == '-c %u' ]]; then
  [[ "${3:-}" == "${MOSAIC_TEST_WRONG_OWNER_PATH:-__none__}" ]] && echo 9999 || echo 1001
  exit 0
 fi
 if [[ "${1:-} ${2:-}" == '-c %g' ]]; then
  [[ "${3:-}" == "${MOSAIC_TEST_WRONG_GROUP_PATH:-__none__}" ]] && echo 9999 || echo 1001
  exit 0
 fi
 exec /bin/stat "$@"
 FAKE_STAT
 cat > "$FAKE_BIN/realpath" <<'FAKE_REALPATH'
 #!/usr/bin/env python3
 import os, sys
 args=sys.argv[1:]
 mode=args.pop(0) if args and args[0] in ('-e','-m') else '-m'
 if args and args[0]=='--': args.pop(0)
 if len(args)!=1 or (mode=='-e' and not os.path.exists(args[0])): raise SystemExit(1)
 print(os.path.realpath(args[0]))
 FAKE_REALPATH
 chmod 0755 "$FAKE_BIN/id" "$FAKE_BIN/getent" "$FAKE_BIN/ldd" "$FAKE_BIN/stat" "$FAKE_BIN/realpath"
 cat > "$FAKE_BIN/npm" <<'FAKE_NPM'
 #!/usr/bin/env bash
 set -euo pipefail
 LOG="${MOSAIC_TEST_NPM_LOG:?}"
 STATE="${MOSAIC_TEST_STATE:?}"
 echo "$*" >> "$LOG"
 if [[ "${1:-}" == "--version" ]]; then
  echo "10.6.2"
  exit 0
 fi
 install_cli() {
  local version="$1"
  echo "$version" > "$STATE/mosaic"
  mkdir -p "${MOSAIC_PREFIX:?}/bin"
  cat > "$MOSAIC_PREFIX/bin/mosaic" <<CLI
 #!/usr/bin/env bash
 set -euo pipefail
 if [[ "\${1:-}" == "wizard" ]]; then
  printf 'wizard\n' >> "\${MOSAIC_TEST_NPM_LOG:?}"
  mkdir -p "\${MOSAIC_HOME:?}" "\${HOME:?}/.config/mosaic-gateway"
  printf '# Soul\\n\\nConfigured.\\n' > "\$MOSAIC_HOME/SOUL.md"
  printf '# User\\n\\nConfigured.\\n' > "\$MOSAIC_HOME/USER.md"
  chmod 0600 "\$MOSAIC_HOME/SOUL.md" "\$MOSAIC_HOME/USER.md"
  exit 0
 fi
 printf '%s\\n' '$version'
 CLI
  chmod +x "$MOSAIC_PREFIX/bin/mosaic"
 }
 if [[ "$1" == "view" ]]; then
  if [[ "${MOSAIC_TEST_FAIL_NPM_VIEW:-0}" == "1" ]]; then
    echo "forced registry metadata failure" >&2
    exit 1
  fi
  case "$2 $3" in
    "@mosaicstack/mosaic@next version") echo "0.0.49-next.999" ;;
    "@mosaicstack/gateway@next version") echo "${MOSAIC_TEST_GATEWAY_NEXT_VERSION:-0.0.7-next.999}" ;;
    "@mosaicstack/mosaic version") echo "0.0.48" ;;
    *) echo "unexpected npm view: $*" >&2; exit 1 ;;
  esac
  exit 0
 fi
 if [[ "$1" == "install" ]]; then
  if [[ -n "${MOSAIC_INSTALL_SECRET_CANARY:-}" ]]; then
    printf 'registry diagnostic authToken=%s\n' "$MOSAIC_INSTALL_SECRET_CANARY"
    printf 'urls=https://alice:p@[email protected]/a https://bob:pa:[email protected]/b https://carol:p%%[email protected]/c https://[email protected]/d https://public.example/e\n'
    printf 'Authorization: Basic QWxhZGRpbjpvcGVu\n//registry/:_auth=Ym9iOnNlY3JldA==\nCookie: session=abc123\nSet-Cookie: sid=xyz789\n'
    printf '%s\n' "$MOSAIC_INSTALL_SECRET_CANARY" > "${MOSAIC_TEST_CANARY_OBSERVATION:?}"
  fi
  case "$*" in
    *"@mosaicstack/[email protected]"*)
      install_cli "0.0.49-next.999"
      ;;
    *"@mosaicstack/[email protected]"*)
      if [[ "${MOSAIC_TEST_FAIL_NEXT_GATEWAY_INSTALL:-0}" == "1" ]]; then
        echo "forced gateway install failure" >&2
        exit 1
      fi
      echo "0.0.7-next.999" > "$STATE/gateway"
      ;;
    *"mosaicstack-mosaic-0.0.0-source.tgz"*)
      install_cli "0.0.0-source"
      ;;
    *"mosaicstack-gateway-0.0.0-source.tgz"*)
      echo "0.0.0-source" > "$STATE/gateway"
      ;;
    *) echo "unexpected npm install: $*" >&2; exit 1 ;;
  esac
  exit 0
 fi
 if [[ "$1" == "ls" ]]; then
  cli="$(cat "$STATE/mosaic" 2>/dev/null || true)"
  gateway="$(cat "$STATE/gateway" 2>/dev/null || true)"
  node -e '
    const cli = process.argv[1];
    const gateway = process.argv[2];
    const dependencies = {};
    if (cli) dependencies["@mosaicstack/mosaic"] = { version: cli };
    if (gateway) dependencies["@mosaicstack/gateway"] = { version: gateway };
    process.stdout.write(JSON.stringify({ dependencies }));
  ' "$cli" "$gateway"
  exit 0
 fi
 echo "unexpected npm command: $*" >&2
 exit 1
 FAKE_NPM
 chmod +x "$FAKE_BIN/npm"
 cat > "$FAKE_BIN/curl" <<'FAKE_CURL'
 #!/usr/bin/env bash
 set -euo pipefail
 headers=""; output=""; url=""
 while [[ $# -gt 0 ]]; do
  case "$1" in
    -D) headers="$2"; shift 2 ;;
    -o) output="$2"; shift 2 ;;
    --max-filesize) shift 2 ;;
    -*) shift ;;
    *) url="$1"; shift ;;
  esac
 done
 case "$url" in
  */api/v1/repos/mosaicstack/stack/commits?sha=*)
    printf 'HTTP/1.1 200 OK\r\ncontent-type: application/json; charset=utf-8\r\n\r\n' > "$headers"
    printf '[{"sha":"1111111111111111111111111111111111111111"}]\n' > "$output"
    ;;
  */archive/*.tar.gz)
    if [[ "${MOSAIC_TEST_CORRUPT_ARCHIVE:-0}" == "1" ]]; then
      printf 'not-a-tarball\n' > "$output"
    else
      archive_root="$(mktemp -d)"
      mkdir -p "$archive_root/stack"
      printf 'fixture\n' > "$archive_root/stack/.fixture"
      /bin/tar czf "$output" -C "$archive_root" stack
      rm -rf "$archive_root"
    fi
    ;;
 esac
 FAKE_CURL
 chmod +x "$FAKE_BIN/curl"
 cat > "$FAKE_BIN/tar" <<'FAKE_TAR'
 #!/usr/bin/env bash
 set -euo pipefail
 dest=""; list=false
 while [[ $# -gt 0 ]]; do
  case "$1" in
    -C) dest="$2"; shift 2 ;;
    -*t*|t*) list=true; shift ;;
    *) shift ;;
  esac
 done
 [[ "$list" == true ]] && exit 0
 if [[ -z "$dest" ]]; then
  echo "fake tar missing -C destination" >&2
  exit 1
 fi
 mkdir -p "$dest/stack/packages/mosaic/framework" "$dest/stack/apps/gateway"
 cat > "$dest/stack/packages/mosaic/framework/install.sh" <<'FRAMEWORK'
 #!/usr/bin/env bash
 set -euo pipefail
 expected="${MOSAIC_PREFIX:?}/bin/mosaic"
 [[ "${MOSAIC_CLI_PATH:-}" == "$expected" && -x "$MOSAIC_CLI_PATH" ]] || {
  echo "framework did not receive P3 absolute CLI (got=${MOSAIC_CLI_PATH:-unset} expected=$expected)" >&2
  exit 61
 }
 printf 'framework-cli=%s version=%s\n' "$MOSAIC_CLI_PATH" "$($MOSAIC_CLI_PATH --version)" >> "${MOSAIC_TEST_NPM_LOG:?}"
 mkdir -p "${MOSAIC_HOME:?}/credentials"
 chmod 0700 "$MOSAIC_HOME/credentials"
 printf '# framework fixture\n' > "$MOSAIC_HOME/AGENTS.md"
 FRAMEWORK
 chmod 0755 "$dest/stack/packages/mosaic/framework/install.sh"
 FAKE_TAR
 chmod +x "$FAKE_BIN/tar"
 cat > "$FAKE_BIN/pnpm" <<'FAKE_PNPM'
 #!/usr/bin/env bash
 set -euo pipefail
 LOG="${MOSAIC_TEST_NPM_LOG:?}"
 echo "pnpm $*" >> "$LOG"
 if [[ "$1" == "pack" ]]; then
  out=""
  while [[ $# -gt 0 ]]; do
    case "$1" in
      --pack-destination) out="$2"; shift 2 ;;
      *) shift ;;
    esac
  done
  if [[ -z "$out" ]]; then
    echo "fake pnpm pack missing destination" >&2
    exit 1
  fi
  mkdir -p "$out"
  case "$PWD" in
    */apps/gateway) touch "$out/mosaicstack-gateway-0.0.0-source.tgz" ;;
    */packages/mosaic) touch "$out/mosaicstack-mosaic-0.0.0-source.tgz" ;;
    *) echo "unexpected pnpm pack cwd: $PWD" >&2; exit 1 ;;
  esac
  exit 0
 fi
 if [[ "${MOSAIC_TEST_FAIL_PNPM_INSTALL:-0}" == "1" && "$1" == "install" ]]; then
  echo "forced pnpm install failure" >&2
  exit 42
 fi
 # Other install/build commands are no-ops in this harness.
 exit 0
 FAKE_PNPM
 chmod +x "$FAKE_BIN/pnpm"
 reset_state() {
  : > "$LOG"
  rm -f "$STATE"/*
 }
 tree_fingerprint() {
  local root="$1"
  if [[ ! -d "$root" ]]; then printf 'ABSENT\n'; return; fi
  python3 - "$root" <<'PY'
 import hashlib, os, stat, sys
 root=os.path.abspath(sys.argv[1]); rows=[]
 for current, dirs, files in os.walk(root, topdown=True, followlinks=False):
    for name in dirs + files:
        path=os.path.join(current,name); meta=os.lstat(path)
        rel=os.path.relpath(path,root)
        target=os.readlink(path) if stat.S_ISLNK(meta.st_mode) else ''
        digest=''
        if stat.S_ISREG(meta.st_mode):
            with open(path,'rb') as handle: digest=hashlib.sha256(handle.read()).hexdigest()
        rows.append((rel,stat.S_IFMT(meta.st_mode),stat.S_IMODE(meta.st_mode),target,digest))
 payload='\n'.join('|'.join(map(str,row)) for row in sorted(rows)).encode()
 print(hashlib.sha256(payload).hexdigest())
 PY
 }
 prefix_fingerprint() { tree_fingerprint "$PREFIX"; }
 reset_state
 echo "[test] --next fast path pins resolved package versions"
 OUTPUT="$(
  HOME="$HOME_DIR" \
  MOSAIC_HOME="$MOSAIC_HOME" \
  MOSAIC_PREFIX="$PREFIX" \
  MOSAIC_NO_COLOR=1 \
  MOSAIC_TEST_NPM_LOG="$LOG" \
  MOSAIC_TEST_STATE="$STATE" \
  PATH="$FAKE_BIN:$PATH" \
  bash "$ROOT/tools/install.sh" --cli --next --yes --no-auto-launch
 )"
 grep -qF 'Installed @next packages: CLI 0.0.49-next.999, gateway 0.0.7-next.999' <<<"$OUTPUT"
 grep -qF 'install -g @mosaicstack/[email protected]' "$LOG"
 grep -qF 'install -g @mosaicstack/[email protected]' "$LOG"
 if grep -qE '^install -g .+@next( |$)' "$LOG"; then
  echo "expected exact-version installs, found mutable @next install" >&2
  exit 1
 fi
 if grep -qF 'Downloading source ref next at pinned commit' <<<"$OUTPUT"; then
  echo "fast path unexpectedly fell back to source" >&2
  exit 1
 fi
 ACTIVE="$HOME_DIR/.local/state/mosaic/install/active.json"
 [[ "$(node -p "require('$ACTIVE').status")" == "committed" ]]
 JOURNAL="$(node -p "require('$ACTIVE').journal")"
 [[ "$(stat -c '%a' "$JOURNAL")" == "444" ]]
 ( cd "$(dirname "$JOURNAL")" && sha256sum -c "$(basename "$JOURNAL").sha256" >/dev/null )
 grep -q '"event":"mutation".*"phase":"P3".*path=.*prior=.*reverse=' "$JOURNAL"
 reset_state
 echo "[test] fast path failure falls back to source build"
 OUTPUT="$(
  HOME="$HOME_DIR" \
  MOSAIC_HOME="$MOSAIC_HOME" \
  MOSAIC_PREFIX="$PREFIX" \
  MOSAIC_NO_COLOR=1 \
  MOSAIC_TEST_NPM_LOG="$LOG" \
  MOSAIC_TEST_STATE="$STATE" \
  MOSAIC_TEST_FAIL_NEXT_GATEWAY_INSTALL=1 \
  PATH="$FAKE_BIN:$PATH" \
  bash "$ROOT/tools/install.sh" --cli --next --yes --no-auto-launch
 )"
 grep -qF 'Fast gateway @next install failed.' <<<"$OUTPUT"
 grep -qF 'Falling back to source build at ref next; --next will not hard-fail on registry issues.' <<<"$OUTPUT"
 grep -qF 'Downloading source ref next at pinned commit 1111111111111111111111111111111111111111' <<<"$OUTPUT"
 grep -qF 'Installed from source: CLI 0.0.0-source' <<<"$OUTPUT"
 grep -qF 'install -g @mosaicstack/[email protected]' "$LOG"
 grep -qE 'install -g .*/mosaicstack-gateway-0\.0\.0-source\.tgz' "$LOG"
 grep -qE 'install -g .*/mosaicstack-mosaic-0\.0\.0-source\.tgz' "$LOG"
 [[ "$(cat "$STATE/mosaic")" == "0.0.0-source" ]]
 [[ "$(cat "$STATE/gateway")" == "0.0.0-source" ]]
 reset_state
 echo "[test] source-build failure is fatal and restores the pre-install prefix"
 before_prefix="$(prefix_fingerprint)"
 set +e
 OUTPUT="$(
  HOME="$HOME_DIR" \
  MOSAIC_HOME="$MOSAIC_HOME" \
  MOSAIC_PREFIX="$PREFIX" \
  MOSAIC_NO_COLOR=1 \
  MOSAIC_TEST_NPM_LOG="$LOG" \
  MOSAIC_TEST_STATE="$STATE" \
  MOSAIC_TEST_FAIL_NEXT_GATEWAY_INSTALL=1 \
  MOSAIC_TEST_FAIL_PNPM_INSTALL=1 \
  PATH="$FAKE_BIN:$PATH" \
  bash "$ROOT/tools/install.sh" --cli --next --yes --no-auto-launch 2>&1
 )"
 FAIL_STATUS=$?
 set -e
 [[ "$FAIL_STATUS" -ne 0 ]]
 [[ "$(prefix_fingerprint)" == "$before_prefix" ]]
 grep -qF 'forced pnpm install failure' <<<"$OUTPUT"
 [[ "$(node -p "require('$ACTIVE').status")" == "rolled-back" ]]
 reset_state
 echo "[test] corrupt source archive is fatal and restores the pre-install prefix"
 before_prefix="$(prefix_fingerprint)"
 set +e
 OUTPUT="$(
  HOME="$HOME_DIR" \
  MOSAIC_HOME="$MOSAIC_HOME" \
  MOSAIC_PREFIX="$PREFIX" \
  MOSAIC_NO_COLOR=1 \
  MOSAIC_TEST_NPM_LOG="$LOG" \
  MOSAIC_TEST_STATE="$STATE" \
  MOSAIC_TEST_FAIL_NEXT_GATEWAY_INSTALL=1 \
  MOSAIC_TEST_CORRUPT_ARCHIVE=1 \
  PATH="$FAKE_BIN:$PATH" \
  bash "$ROOT/tools/install.sh" --cli --next --yes --no-auto-launch 2>&1
 )"
 FAIL_STATUS=$?
 set -e
 [[ "$FAIL_STATUS" -ne 0 ]]
 [[ "$(prefix_fingerprint)" == "$before_prefix" ]]
 grep -qF 'archive safety/integrity check failed' <<<"$OUTPUT"
 [[ "$(node -p "require('$ACTIVE').status")" == "rolled-back" ]]
 reset_state
 echo "[test] --dev source install does not require registry version resolution"
 OUTPUT="$(
  HOME="$HOME_DIR" \
  MOSAIC_HOME="$MOSAIC_HOME" \
  MOSAIC_PREFIX="$PREFIX" \
  MOSAIC_NO_COLOR=1 \
  MOSAIC_TEST_NPM_LOG="$LOG" \
  MOSAIC_TEST_STATE="$STATE" \
  MOSAIC_TEST_FAIL_NPM_VIEW=1 \
  PATH="$FAKE_BIN:$PATH" \
  bash "$ROOT/tools/install.sh" --cli --dev --ref feature-x --yes --no-auto-launch
 )"
 grep -qF 'Downloading source ref feature-x at pinned commit 1111111111111111111111111111111111111111' <<<"$OUTPUT"
 grep -qF 'Installed from source: CLI 0.0.0-source' <<<"$OUTPUT"
 grep -q '^\[P2\] PASS: source_ref=feature-x pinned_commit=1111111111111111111111111111111111111111 sha256=' <<<"$OUTPUT"
 reset_state
 echo "[test] explicit --ref keeps source lane and avoids @next lookup"
 set +e
 OUTPUT="$(
  HOME="$HOME_DIR" \
  MOSAIC_HOME="$MOSAIC_HOME" \
  MOSAIC_PREFIX="$PREFIX" \
  MOSAIC_NO_COLOR=1 \
  MOSAIC_TEST_NPM_LOG="$LOG" \
  MOSAIC_TEST_STATE="$STATE" \
  PATH="$FAKE_BIN:$PATH" \
  bash "$ROOT/tools/install.sh" --check --cli --next --ref feature-x
 )"
 CHECK_STATUS=$?
 set -e
 [[ "$CHECK_STATUS" -ne 0 ]]
 grep -q '^\[P2\] PASS: source_ref=feature-x pinned_commit=1111111111111111111111111111111111111111 sha256=' <<<"$OUTPUT"
 if grep -qF '@next version' "$LOG"; then
  echo "explicit ref should not query @next dist-tags" >&2
  exit 1
 fi
 reset_state
 echo "[test] --check --next rejects mismatched prerelease pipeline suffixes"
 set +e
 OUTPUT="$(
  HOME="$HOME_DIR" \
  MOSAIC_HOME="$MOSAIC_HOME" \
  MOSAIC_PREFIX="$PREFIX" \
  MOSAIC_NO_COLOR=1 \
  MOSAIC_TEST_NPM_LOG="$LOG" \
  MOSAIC_TEST_STATE="$STATE" \
  MOSAIC_TEST_GATEWAY_NEXT_VERSION="0.0.7-next.1000" \
  PATH="$FAKE_BIN:$PATH" \
  bash "$ROOT/tools/install.sh" --check --cli --next
 )"
 CHECK_STATUS=$?
 set -e
 [[ "$CHECK_STATUS" -ne 0 ]]
 grep -q '^\[P2\] FAIL: resolved_version=unavailable' <<<"$OUTPUT"
 printf '[test] full framework path receives P3 absolute CLI without relying on PATH\n'
 rm -rf "$HOME_DIR" "$STATE"; mkdir -p "$HOME_DIR" "$STATE"; reset_state
 set +e
 OUTPUT="$(
  HOME="$HOME_DIR" MOSAIC_HOME="$MOSAIC_HOME" MOSAIC_PREFIX="$PREFIX" \
  MOSAIC_INSTALL_STATE_DIR="$TMP/full-state" MOSAIC_NO_COLOR=1 \
  MOSAIC_TEST_NPM_LOG="$LOG" MOSAIC_TEST_STATE="$STATE" \
  PATH="$FAKE_BIN:/usr/local/bin:/usr/bin:/bin" \
  bash "$ROOT/tools/install.sh" --next --yes --no-auto-launch 2>&1
 )"
 FULL_STATUS=$?
 set -e
 [[ "$FULL_STATUS" -ne 0 ]] # P4 remains intentionally undeclared until C5.
 grep -qF "framework-cli=$PREFIX/bin/mosaic version=0.0.49-next.999" "$LOG"
 if grep -q "CLI not found on PATH\|did not receive P3 absolute CLI" <<<"$OUTPUT"; then
  echo "internal framework phase depended on PATH instead of P3 absolute CLI" >&2
  exit 1
 fi
 printf '[test] captured diagnostics redact seeded credential canary everywhere\n'
 rm -rf "$HOME_DIR" "$STATE"; mkdir -p "$HOME_DIR" "$STATE"; reset_state
 canary='C1_SECRET_CANARY_7df4c2'
 OUTPUT="$(
  HOME="$HOME_DIR" MOSAIC_HOME="$MOSAIC_HOME" MOSAIC_PREFIX="$PREFIX" \
  MOSAIC_INSTALL_STATE_DIR="$TMP/secret-state" MOSAIC_NO_COLOR=1 \
  MOSAIC_INSTALL_SECRET_CANARY="$canary" MOSAIC_TEST_CANARY_OBSERVATION="$TMP/canary-observed" \
  MOSAIC_TEST_NPM_LOG="$LOG" MOSAIC_TEST_STATE="$STATE" \
  PATH="$FAKE_BIN:/usr/local/bin:/usr/bin:/bin" \
  bash "$ROOT/tools/install.sh" --cli --next --yes --no-auto-launch 2>&1
 )"
 # Positive control: replace the removed redacted example.io source with one deliberately unredacted userinfo URL.
 OUTPUT+=$'\nhttps://[email protected]/e'
 if grep -qF "$canary" <<<"$OUTPUT"; then echo 'credential canary leaked to terminal output' >&2; exit 1; fi
 if grep -Eq 'alice:p@ss|bob:pa:ss|carol:p%40ss|token@example|user%3Apass|QWxhZGRpbjpvcGVu|Ym9iOnNlY3JldA|session=abc123|sid=xyz789' <<<"$OUTPUT"; then
  echo 'credentialed URL userinfo leaked to terminal output' >&2; exit 1
 fi
 for host in example.com example.net example.org example.dev example.io; do
  grep -qF "https://[REDACTED]@$host" <<<"$OUTPUT" \
    || { echo "credentialed URL redaction control missing for $host" >&2; exit 1; }
 done
 secret_active="$TMP/secret-state/active.json"
 secret_journal="$(node -p "require('$secret_active').journal")"
 secret_command_log="$(dirname "$secret_journal")/commands.log"
 if grep -R -F "$canary" "$secret_command_log" "$HOME_DIR" 2>/dev/null; then
  echo 'credential canary leaked to persistent installer output' >&2; exit 1
 fi
 if grep -E 'alice:p@ss|bob:pa:ss|carol:p%40ss|token@example|user%3Apass|QWxhZGRpbjpvcGVu|Ym9iOnNlY3JldA|session=abc123|sid=xyz789' "$secret_command_log" >/dev/null; then
  echo 'credentialed URL userinfo leaked to persistent installer output' >&2; exit 1
 fi
 if [[ "$(cat "$TMP/canary-observed" 2>/dev/null || true)" != "$canary" ]]; then
  echo 'credential canary positive control was not exercised' >&2; exit 1
 fi
 test_assert_find_empty 'redacted diagnostic staging files' \
  "$TMPDIR" -maxdepth 1 -type f \
  \( -name 'mosaic-phase-redacted.*' -o -name 'mosaic-post-redacted.*' \) || exit 1
 printf '[test] framework nested capture redacts the same canary and URL variants\n'
 framework_test_home="$TMP/framework-redact-home"
 framework_target="$framework_test_home/.config/mosaic"
 framework_cli="$TMP/framework-redact-cli"
 framework_log="$TMP/framework-redact-commands.log"
 framework_status="$TMP/framework-redact-status.tsv"
 mkdir -p "$framework_test_home"; : > "$framework_log"; : > "$framework_status"
 cat > "$framework_cli" <<'FRAMEWORK_CLI'
 #!/usr/bin/env bash
 printf 'nested authToken=%s\n' "${MOSAIC_INSTALL_SECRET_CANARY:?}"
 printf 'nested=https://alice:p@[email protected]/a https://bob:pa:[email protected]/b https://carol:p%%[email protected]/c https://[email protected]/d https://user%%[email protected]/e\n'
 printf 'Authorization: Basic QWxhZGRpbjpvcGVu\n//registry/:_auth=Ym9iOnNlY3JldA==\nCookie: session=abc123\nSet-Cookie: sid=xyz789\n'
 exit 1
 FRAMEWORK_CLI
 chmod 0755 "$framework_cli"
 set +e
 FRAMEWORK_OUTPUT="$(
  HOME="$framework_test_home" MOSAIC_HOME="$framework_target" MOSAIC_INSTALL_MODE=overwrite \
  MOSAIC_CLI_PATH="$framework_cli" MOSAIC_INSTALL_SECRET_CANARY="$canary" \
  MOSAIC_INSTALL_COMMAND_LOG="$framework_log" MOSAIC_INSTALL_PHASE_STATUS_FILE="$framework_status" \
  MOSAIC_ALLOW_MISSING_SEQUENTIAL_THINKING=1 MOSAIC_SKIP_SKILLS_SYNC=1 \
  bash "$ROOT/packages/mosaic/framework/install.sh" 2>&1
 )"
 framework_install_status=$?
 set -e
 [[ "$framework_install_status" -eq 0 ]]
 if grep -Eq "$canary|alice:p@ss|bob:pa:ss|carol:p%40ss|token@example|user%3Apass|QWxhZGRpbjpvcGVu|Ym9iOnNlY3JldA|session=abc123|sid=xyz789" <<<"$FRAMEWORK_OUTPUT" \
  || grep -Eq "$canary|alice:p@ss|bob:pa:ss|carol:p%40ss|token@example|user%3Apass|QWxhZGRpbjpvcGVu|Ym9iOnNlY3JldA|session=abc123|sid=xyz789" "$framework_log"; then
  echo 'framework nested capture leaked credential diagnostics' >&2; exit 1
 fi
 for host in example.com example.net example.org example.dev example.io; do
  grep -qF "https://[REDACTED]@$host" "$framework_log" \
    || { echo "framework URL redaction control missing for $host" >&2; exit 1; }
 done
 printf '[test] real P2-P8 actions run under fault injection and restore actual surfaces\n'
 for phase in P2 P3 P4 P5 P6 P7 P8; do
  rm -rf "$HOME_DIR" "$STATE" "$TMP/fault-$phase"; mkdir -p "$HOME_DIR" "$STATE" "$TMP/fault-$phase"
  printf 'operator-sentinel\n' > "$HOME_DIR/operator.txt"
  reset_state
  before="$(tree_fingerprint "$HOME_DIR")"
  set +e
  HOME="$HOME_DIR" MOSAIC_HOME="$MOSAIC_HOME" MOSAIC_PREFIX="$PREFIX" \
    MOSAIC_INSTALL_STATE_DIR="$TMP/fault-$phase" MOSAIC_INSTALL_FAULT_AFTER="$phase" \
    MOSAIC_INSTALL_SELF_TEST_ALLOW=1 MOSAIC_NO_COLOR=1 \
    MOSAIC_TEST_NPM_LOG="$LOG" MOSAIC_TEST_STATE="$STATE" \
    PATH="$FAKE_BIN:/usr/local/bin:/usr/bin:/bin" \
    bash "$ROOT/tools/install.sh" --state-machine-self-test --next --yes \
    >"$TMP/fault-$phase.log" 2>&1
  status=$?
  set -e
  [[ "$status" -eq 97 ]] || { echo "$phase real fault expected 97, got $status" >&2; exit 1; }
  [[ -s "$LOG" ]] || { echo "$phase fault never entered the real action path" >&2; exit 1; }
  [[ "$(tree_fingerprint "$HOME_DIR")" == "$before" ]] || { echo "$phase real rollback mismatch" >&2; exit 1; }
  grep -q "phase=$phase" "$TMP/fault-$phase.log"
  test_assert_no_file_content_match "$phase fault-state" \
    '"status"[[:space:]]*:[[:space:]]*"in-progress"' "$TMP/fault-$phase" || exit 1
 done
 printf '[test] stale projection is preserved while the real fault path acquires a free OS lock\n'
 rm -rf "$HOME_DIR" "$STATE" "$TMP/stale-state"; mkdir -p "$HOME_DIR" "$STATE" "$TMP/stale-state"
 printf '{"status":"in-progress","journal":"%s"}\n' "$TMP/stale-state/dead-run/journal.ndjson" > "$TMP/stale-state/active.json"
 reset_state
 set +e
 HOME="$HOME_DIR" MOSAIC_HOME="$MOSAIC_HOME" MOSAIC_PREFIX="$PREFIX" \
  MOSAIC_INSTALL_STATE_DIR="$TMP/stale-state" MOSAIC_INSTALL_FAULT_AFTER=P2 \
  MOSAIC_INSTALL_SELF_TEST_ALLOW=1 MOSAIC_NO_COLOR=1 \
  MOSAIC_TEST_NPM_LOG="$LOG" MOSAIC_TEST_STATE="$STATE" \
  PATH="$FAKE_BIN:/usr/local/bin:/usr/bin:/bin" \
  bash "$ROOT/tools/install.sh" --state-machine-self-test --next --yes >"$TMP/stale.log" 2>&1
 stale_status=$?
 set -e
 [[ "$stale_status" -eq 97 ]]
 find "$TMP/stale-state" -name prior-active.json -type f -print -quit | grep -q .
 [[ "$(node -p "require('$TMP/stale-state/active.json').status")" == rolled-back ]]
 echo "[test] installer next lane tests passed"
@@ -0,0 +1,13 @@
 [test] --next fast path pins resolved package versions
 [test] fast path failure falls back to source build
 [test] source-build failure is fatal and restores the pre-install prefix
 [test] corrupt source archive is fatal and restores the pre-install prefix
 [test] source archive with multiple extracted roots fails instead of selecting by find order
 [test] --dev source install does not require registry version resolution
 [test] explicit --ref keeps source lane and avoids @next lookup
 [test] --check --next rejects mismatched prerelease pipeline suffixes
 [test] full framework path receives P3 absolute CLI without relying on PATH
 [test] captured diagnostics redact seeded credential canary everywhere
 [test] framework nested capture redacts the same canary and URL variants
 [test] real P2-P8 actions run under fault injection and restore actual surfaces
 P2 left an in-progress transaction
@@ -0,0 +1,14 @@
 [test] --next fast path pins resolved package versions
 [test] fast path failure falls back to source build
 [test] source-build failure is fatal and restores the pre-install prefix
 [test] corrupt source archive is fatal and restores the pre-install prefix
 [test] source archive with multiple extracted roots fails instead of selecting by find order
 [test] --dev source install does not require registry version resolution
 [test] explicit --ref keeps source lane and avoids @next lookup
 [test] --check --next rejects mismatched prerelease pipeline suffixes
 [test] full framework path receives P3 absolute CLI without relying on PATH
 [test] captured diagnostics redact seeded credential canary everywhere
 [test] framework nested capture redacts the same canary and URL variants
 [test] real P2-P8 actions run under fault injection and restore actual surfaces
 [test] stale projection is preserved while the real fault path acquires a free OS lock
 [test] installer next lane tests passed
@@ -0,0 +1,2 @@
 [test] enumeration failure cannot mask a planted in-progress transaction
 [test] FAIL: planted in-progress transaction plus failed enumeration passed the full suite
@@ -0,0 +1,14 @@
 [test] --next fast path pins resolved package versions
 [test] fast path failure falls back to source build
 [test] source-build failure is fatal and restores the pre-install prefix
 [test] corrupt source archive is fatal and restores the pre-install prefix
 [test] source archive with multiple extracted roots fails instead of selecting by find order
 [test] --dev source install does not require registry version resolution
 [test] explicit --ref keeps source lane and avoids @next lookup
 [test] --check --next rejects mismatched prerelease pipeline suffixes
 [test] full framework path receives P3 absolute CLI without relying on PATH
 [test] captured diagnostics redact seeded credential canary everywhere
 [test] framework nested capture redacts the same canary and URL variants
 [test] real P2-P8 actions run under fault injection and restore actual surfaces
 find: ‘/tmp/mosaic-next-install-test-hqL7U0/fault-P2/blocked’: Permission denied
 [test] ERROR: P2 fault-state enumeration failed
@@ -0,0 +1,121 @@
 #1050 C1 ROUND 3 — REMOTE-ARM DOWNSTREAM SOURCE BINDING
 IDENTITY / SCOPE
 - branch: feat/1050-install-state-machine-red-fixture
 - predecessor/provider lease pin: ff3f0d29f1763bed44a60610d073036112e66b77
 - status language: believed-fixed, pending jarvis validation
 - in scope: remote arm's mosaicstack/stack framework/source archive (#7)
 - unchanged/fenced: expected-RED manifest including P6=FAIL; #869; #1068 sequencing
 - corrected reference citation: the container-image acquisition path in fa-install.sh only
 ACQUISITION-PATH CENSUS (10/10 CODE-READ; COMPLETE RUNTIME PATH CENSUS NOT MEASURED)
 1. Woodpecker checkout at CI commit — fully constrained by intended CI identity.
 2. node:22-bookworm-slim image — unpinned sibling, out of scope.
 3. apt package set — unpinned sibling, out of scope.
 4. tools/install.sh at CI_COMMIT_SHA + verified SHA-256 — fully constrained.
 5. @mosaicstack/mosaic@next — P2 CLI value is authoritative; realised disagreement is detected at P3 — fully constrained at the top-level package version.
 6. @mosaicstack/gateway@next — later re-resolution wins and is verified against itself; drift from the first value can be silently accepted — partially constrained TOCTOU sibling, out of scope.
 7. stack framework/source archive — pre-fix internally pinned to WRONG identity 4df478cdd150fdf8d52ea109f02ade5d85017acd; post-fix bound to intended CI commit.
 8. unversioned sequential-thinking npx package — unpinned sibling, out of scope.
 9. Excalidraw dependency graph — shipped lockfile exact versions + registry integrity hashes — fully constrained by lock/integrity.
 10. agent-skills default-branch clone — unpinned sibling, out of scope.
 Post-fix mechanism breakdown: fully constrained 5/10 (#1,#4,#5,#7,#9); partially constrained 1/10 (#6); unpinned 4/10 (#2,#3,#8,#10). Same-CI stack payload hops moved from 1/2 to 2/2. The fix does not increase the number of constrained paths; it corrects #7 from wrong identity to intended identity. This census is a LOWER BOUND on defects and an UPPER BOUND on assurance: questioning revised the claimed assurance downward each time (blended 6/10 -> mechanism split -> 5 full + 1 partial + 4 unpinned), never upward.
 #5/#6 RESOLUTION-FAILURE / TOCTOU DISPOSITION (CODE-READ; DISAGREEMENT INJECTION NOT MEASURED)
 - P1 metadata failure blocks before mutation.
 - Failed package install falls back to the one immutable stack archive resolved in P2; source resolution/fetch failure is fatal.
 - #5 CLI: P2 RESOLVED_CLI_VERSION is authoritative; a later installed CLI mismatch is detected by P3 and rolls back.
 - #6 gateway: no authoritative P2 gateway value is persisted. The last resolution in install_next_cli_from_registry wins and is compared with itself, so successful same-suffix gateway drift can be silently accepted. Reported, not fixed.
 RED-FIRST — STALE NEXT REJECTED BEFORE ACQUISITION FIX
 Command shape: exact ff3f0d2 installer URL/digest + expected source commit/digest, remote next lane.
 - expected source commit: ff3f0d29f1763bed44a60610d073036112e66b77
 - expected source SHA-256: 944c6db1b01b23c83169e6dc83e0d31262b1d24a2825270441745eb65c269c25
 - fixture rc: 1
 - realised source commit: 4df478cdd150fdf8d52ea109f02ade5d85017acd
 - realised source SHA-256: 3e6d831efe13c3b2c0501507099d4a566af5abf877dacf85e5d7e4284d35e5c7
 - source control: FAIL (realised != expected)
 - P6 final fixture value: PASS (false pass from stale framework)
 - forbidden evidence: CLI not found on PATH present
 - comparator rc: 1; failures=8/checks=19
 IMPLEMENTED PATH #7
 - .woodpecker/greenfield-install.yml supplies MOSAIC_FIXTURE_SOURCE_COMMIT=${CI_COMMIT_SHA} while still invoking --lane next and --source remote.
 - tools/e2e-install-test.sh validates 40-hex commit input, derives the exact commit archive URL, rejects failed/empty fetch, computes SHA-256 over that exact body, and passes the body/commit/digest through MOSAIC_INSTALL_LOCAL_SOURCE_{ARCHIVE,COMMIT,SHA256}.
 - The existing installer local-source seam re-hashes the body and rejects mismatch.
 - The fixture verifies realised .install-manifest.json sourceCommit and sourceSha256 against the exact fetched body after installation. Mismatch exits before the phase comparator; there is no fallback to next.
 EXACT-SOURCE REPRODUCIBILITY RESULT — N=5 IDENTICAL FINAL-TREE EXECUTIONS
 Invariant inputs on every run:
 - fixture mode: --lane next --source remote --git present
 - installer/source commit: ff3f0d29f1763bed44a60610d073036112e66b77
 - installer SHA-256: e59cb441a2f37ae9150f8eae470238e9d858a1816df93343d9784a6796676096
 - realised source SHA-256: 944c6db1b01b23c83169e6dc83e0d31262b1d24a2825270441745eb65c269c25
 - resolved/realised CLI: @mosaicstack/mosaic@next = 0.0.50-next.2207
 - fixture rc=1, P3 PASS, SOURCE-CONTROL PASS, installer_exit=1, done_claims=0, P6 FAIL, P9 FAIL
 Per-run outcomes:
 run 1: comparator rc=0; checks=19/19; dead_hooks=0; P6 reason=runtime linking/activation action reported a required failure; elapsed/load NOT MEASURED
 run 2: comparator rc=0; checks=19/19; dead_hooks=0; P6 reason=runtime linking/activation action reported a required failure; elapsed/load NOT MEASURED
 run 3: comparator rc=1; checks=18/19; dead_hooks=2; P6 reason=broker absent but dead enforcement hooks are active (count=2); elapsed=912s; load before=7.79 7.51 8.93; load after=12.28 14.82 11.79
 run 4: comparator rc=0; checks=19/19; dead_hooks=0; P6 reason=runtime linking/activation action reported a required failure; elapsed=938s; load before=12.28 14.82 11.79; load after=9.84 15.18 13.83
 run 5: comparator rc=0; checks=19/19; dead_hooks=0; P6 reason=runtime linking/activation action reported a required failure; elapsed=954s; load before=9.84 15.18 13.83; load after=3.94 4.76 8.18
 Rate, not verdict:
 - comparator rc=0: 4/5
 - comparator rc=1: 1/5
 - action-failure P6 reason: 4/5
 - dead-hooks-active count=2 P6 reason: 1/5
 - source commit/digest property: PASS 5/5
 - P6 outcome property: FAIL 5/5
 No comparator verdict is claimed. Identical source, digest, and package version produced different comparator values; this gate is nondeterministic on the #869 probe path. Load does not explain the small sample monotonically: run 4 had the highest observed 5/15-minute load but produced rc=0. The 2000ms capability-probe timeout remains a code-read hypothesis, NOT MEASURED as causal.
 CHECKOUT CONTROL (EXECUTED, NOT PART OF REMOTE N=5)
 The checkout-source arm independently produced: fixture rc=1; @next CLI 0.0.50-next.2207; P3 PASS; P6 FAIL with dead hooks active count=2; comparator rc=1 with the same 1/19 required-reason miss. This showed that outcome can occur independently of the remote #7 binding; its reproducibility was not separately measured.
 PROPERTY / SIGNAL FINDING (MANIFEST UNCHANGED)
 P6=FAIL remains the correct property and is unchanged. The comparator additionally pins one reason signal: "runtime linking/activation action reported a required failure". Exact-source P6 failed on all 5/5 runs, while the reason signal varied. The reason assertion was not widened to fit either observation.
 #869 FINDING (BEHAVIOR EXECUTED; ROOT-CAUSE ATTRIBUTION CODE-READ)
 Current @next now carries the lease capability. defaultSupervisorProbe treats bundled launcher+daemon file presence plus a nonempty resolved socket PATH as supervisor presence; it does not require the socket itself to exist. One of five identical clean broker-absent runs wired two dead hooks and let the linker exit zero; four reported the action failure. The 2000ms defaultCapabilityProbe subprocess timeout is a code-read candidate for the variance, NOT MEASURED as causal. Fixing this is #869 scope and was not performed.
 TRUST BOUNDARY / INDEPENDENT PROVENANCE
 The exact-commit archive URL binds source identity under the configured repository provider's authenticated mapping of commit ID to response bytes. The computed SHA-256 proves that the bytes executed are the bytes that exact URL served and that they did not change between fetch, installer consumption, and manifest verify-after. That is the measured control against stale-next substitution: SOURCE-CONTROL passed 5/5 exact-source runs and failed when R7 deleted the binding. The digest does NOT prove that those bytes are what the repository's authors published if the repository service or TLS trust root is compromised. Provider + TLS are the trust root by design. Independent signed provenance/authenticity remains an inherited deferral explicitly sourced to canonical greenfield-install PRD v2 §3, matching the already documented install.sh sidecar boundary. No stronger supply-chain claim is made. Codex security review's initial HIGH/CWE-494 finding is retained as the named trust-root deferral rather than bypassed or silently reclassified.
 R7 DELETE-THE-SUBJECT MUTANT (EXECUTED)
 Deleted the three MOSAIC_INSTALL_LOCAL_SOURCE_{ARCHIVE,COMMIT,SHA256} binding exports from tools/e2e-install-test.sh temporarily while retaining the realised source assertion.
 - fixture rc: 1
 - realised source commit reverted to 4df478cdd150fdf8d52ea109f02ade5d85017acd
 - expected source commit remained ff3f0d29f1763bed44a60610d073036112e66b77
 - realised source SHA-256: 3e6d831efe13c3b2c0501507099d4a566af5abf877dacf85e5d7e4284d35e5c7
 - expected source SHA-256: 944c6db1b01b23c83169e6dc83e0d31262b1d24a2825270441745eb65c269c25
 - SOURCE-CONTROL: FAIL
 - comparator rc: 1; failures=8/checks=19
 - elapsed: 171s; load before=4.13 4.71 8.05; load after=4.94 4.58 7.42
 - subject file SHA-256 before mutant: a93113565aa69f2c6f3d792b78251021bb3bbe3f7813d5fed547ab0099fa3b98
 - subject file SHA-256 after restoration: a93113565aa69f2c6f3d792b78251021bb3bbe3f7813d5fed547ab0099fa3b98
 EVIDENCE LOGS (LOCAL, NOT COMMITTED RAW TRANSCRIPTS)
 - /tmp/c1-round3-red.log and /tmp/c1-round3-red-summary.txt
 - /tmp/c1-round3-green.log and /tmp/c1-round3-green-summary.txt
 - /tmp/c1-round3-green-comparator.log
 - /tmp/c1-round3-checkout-control.log and /tmp/c1-round3-checkout-summary.txt
 - /tmp/c1-round3-repro-n5.tsv and /tmp/c1-round3-repro-{3,4,5}.log
 - /tmp/c1-round3-final-r7.log and /tmp/c1-round3-final-r7-summary.txt
 BASELINES / INDEPENDENT REVIEW
 - bash -n tools/e2e-install-test.sh: PASS
 - shellcheck tools/e2e-install-test.sh: PASS
 - invalid remote source commit control: rc=2, named 40-hex requirement
 - pnpm test:installer: PASS
 - pnpm typecheck: PASS, 45/45 tasks
 - pnpm lint: PASS, 25/25 tasks
 - pnpm format:check: PASS
 - git diff --check: PASS
 - Codex code review: APPROVE, confidence 0.92, 6 files, zero findings
 - Initial Codex security review: HIGH/CWE-494 on independent provider-compromise provenance; retained and bounded explicitly in PRD/report as the canonical v2 §3 deferral
 - Codex security re-review after trust-boundary documentation: risk NONE, confidence 0.96, 6 files, zero findings
 PUSH / CI
 Not yet recorded in this artifact. No CI polling is authorised after the single push.
@@ -0,0 +1,83 @@
 #1050 C1 ROUND 4 — PIPELINE CASE-COVERAGE DENOMINATOR
 IDENTITY / SCOPE
 - predecessor head: 0e2eef1c1261444b83c089df6047a2a06592d5c6
 - branch: feat/1050-install-state-machine-red-fixture
 - only open requirement: pipeline-level expected-case/executed-case set equality
 - unchanged/fenced: tools/fixtures/greenfield-expected-red.tsv, tools/verify-greenfield-expected-red.sh, #869, P6 detector/producer, absolute-P3 CLI linking, and per-case fixture dispositions
 - status language: believed-fixed, pending jarvis validation
 STALE-RULING WITHDRAWAL HONOURED
 Requirements 1-3 were withdrawn after pipeline 2242 at 0e2eef1c reached terminal green and showed P6 failure propagation, absolute-P3 CLI use, and an executed git-absent arm. A temporary local P6-consumer edit made while the stale ruling was in flight was restored before this change set; tools/e2e-install-test.sh has no final-tree delta. Requirement 5 alone remains in this round.
 RED-FIRST
 Before the change, .woodpecker/greenfield-install.yml had no pipeline-level initialized marker store, no per-case success marker, and no final exact-set gate. A static assertion for a final run-on-failure case-coverage step failed. Pipeline 2242's green result proved that all three cases ran once, but no gate required that population on a later run.
 IMPLEMENTATION
 - tools/verify-greenfield-case-coverage.sh is a new pipeline-level instrument; the existing per-case verifier is unchanged.
 - Expected case names are derived from the first TSV field of tools/fixtures/greenfield-expected-red.tsv and sorted uniquely. There is no literal expected count.
 - Marker storage is scoped by ${CI_PIPELINE_NUMBER}-${CI_WORKFLOW_NUMBER}. The init action validates the manifest and empties only that run directory, so stale markers cannot satisfy a retry or later run.
 - Every case/contract step explicitly depends on initialization. Each unconditional case step calls mark only after its exact tools/verify-greenfield-expected-red.sh invocation succeeds.
 - The final greenfield-case-denominator step explicitly depends on all four case/contract steps, has status eligibility [success, failure], emits cases_defined=N cases_executed=M, and compares sorted expected and actual case-name sets. Missing or unexpected names fail even when the two counts are equal.
 - A newly defined manifest case changes the expected set automatically and fails until a corresponding successful case step marks it.
 MEASURED CONTROLS
 1. Skipped expected arm:
   rc=1
   [fixture-suite] cases_defined=3 cases_executed=2
   [fixture-suite] missing_case=next-git-absent
 2. Count-inflation control (one expected missing, one unexpected added):
   rc=1
   [fixture-suite] cases_defined=3 cases_executed=3
   [fixture-suite] missing_case=next-git-absent
   [fixture-suite] unexpected_case=unexpected-case
 3. Stale-marker initialization control (same run re-initialized after markers existed):
   rc=1
   [fixture-suite] cases_defined=3 cases_executed=0
   missing_case rows emitted for all three expected names
 4. Exact-set positive control:
   rc=0
   [fixture-suite] cases_defined=3 cases_executed=3
 5. Future manifest case control:
   rc=1
   [fixture-suite] cases_defined=4 cases_executed=3
   [fixture-suite] missing_case=future-case
 WORKFLOW / FOCUSED VALIDATION
 - bash -n new subject and test: PASS
 - shellcheck new subject and test: PASS
 - bash tools/verify-greenfield-case-coverage.test.sh: PASS
 - test statically proves each mark follows its exact per-case verifier, every producer depends on initialization, the final gate depends on the complete matrix, and final status eligibility includes success+failure
 - woodpecker-cli lint --strict .woodpecker/greenfield-install.yml: PASS
 - Prettier check for workflow/package/PRD: PASS
 - git diff --check: PASS
 CURRENT-HEAD FIXTURE MEASUREMENTS TAKEN BEFORE THE STALE RULING WAS WITHDRAWN
 These measurements were run from 0e2eef1c before requirement 5 changed only pipeline instrumentation. They are retained as measured outcomes, not as justification for modifying requirements 1-3.
 - next checkout/git-present: fixture rc=1; resolved @next=0.0.50-next.2207; P0/P1/P2/P3/P7 PASS; P4/P5/P6/P8/P9 FAIL; installer_exit=1; done_claims=0; P6 reason was dead enforcement hooks active count=2.
 - next checkout/git-absent: fixture rc=1; P0/P6/P7 PASS; P1/P2/P3/P4/P5/P8/P9 FAIL; installer_exit=1; done_claims=0.
 - /home free before the first run: 8.5G; after concurrent authorized fleet reclaim completed: 11G; no be-coder-05 generated payload was deleted because active fixture work made that churn.
 INDEPENDENT REVIEW CYCLE
 - Initial Codex code review: REQUEST_CHANGES, confidence 0.96; one blocker found that the first draft omitted depends_on ordering and could race initialization/final checking.
 - Disposition: accepted. Added explicit init -> all case/contract steps -> final dependency graph and a regression assertion for every dependency edge.
 - Initial Codex security review: risk NONE, confidence 0.94, zero findings. The sandbox could not create its own temp directory; local focused/full tests provide the dynamic evidence.
 - First post-dependency code re-review: REQUEST_CHANGES, confidence 0.99; the case extractor treated the production manifest's comment lines as case names, while the synthetic test omitted comments.
 - Disposition: accepted. Case derivation now excludes blank/comment lines; the focused test includes representative comments and executes init/mark/check against the repository's real manifest.
 - Post-dependency security re-review: risk NONE, confidence 0.96, zero findings.
 - Final Codex code re-review after the comment fix: APPROVE, confidence 0.94, 8 files, zero findings. It confirmed ordering, run scope, fail-closed set equality, PRD alignment, and negative controls.
 - Final Codex security re-review: risk NONE, confidence 0.96, 8 files, zero findings.
 FINAL LOCAL BASELINES
 - pnpm test:installer: PASS, including the new coverage suite
 - pnpm typecheck: PASS, 45/45
 - pnpm lint: PASS, 25/25
 - pnpm format:check: PASS
 - bash -n + ShellCheck for new shell surfaces: PASS
 - Woodpecker strict lint: PASS
 - git diff --check: PASS
 - /home free before/after local baselines: 11G
 PENDING BEFORE PUSH
 - commit, queue guard, one push, provider attribution read-back
 - announce the new full SHA to rev-security-02; do not merge or close
@@ -0,0 +1,81 @@
 #1050 C1 ROUND 5 — ARM COVERAGE + CHECKOUT PURITY
 IDENTITY / SCOPE
 - predecessor head: f33bd0da96bee3ce518744d6888d018bebb1c841
 - branch: feat/1050-install-state-machine-red-fixture
 - review inputs: be-coder-06 review 110; rev-security-02 review 111
 - in scope: exact required pipeline-arm set including greenfield-remote-installer-contract; success-only arm marks; skipped-remote RED control; coverage-state exclusion from checkout source archives
 - unchanged/fenced: tools/fixtures/greenfield-expected-red.tsv, tools/verify-greenfield-expected-red.sh, tools/e2e-install-test.sh, #869, and all per-case dispositions
 - status: believed-fixed, pending jarvis validation
 RED-FIRST — FOUR ARMS WERE REPRESENTED BY THREE CASES
 The f33bd0d gate represented only the three expected-RED case identities. With all three case names marked and no remote-arm identity available, the production checker returned:
  SKIPPED_REMOTE_ARM_CURRENT_GATE_RC=0
  [fixture-suite] cases_defined=3 cases_executed=3
 The fourth required arm, greenfield-remote-installer-contract, reused next-git-present and therefore could skip without changing case-set equality.
 RED-FIRST — COVERAGE STATE CONTAMINATED CHECKOUT ARCHIVES
 The f33bd0d workflow created .greenfield-case-state in the shared repository before the checkout-mode fixture arms. An independent reproduction using the exact e2e-install-test.sh tar exclusions created .greenfield-case-state/remote-arm.ran and measured:
  OLD_STATE_ARCHIVE_MATCHES=1
 The state instrument was therefore part of the checkout source payload it was intended only to observe.
 IMPLEMENTATION
 - Renamed the checker to tools/verify-greenfield-execution-coverage.sh and generalized it over two validated dimensions: cases and arms.
 - Added tools/fixtures/greenfield-expected-arms.txt as the explicit required arm set:
  greenfield-git-present
  greenfield-main-git-present
  greenfield-remote-installer-contract
  greenfield-git-absent
 - Expected cases remain derived from the unchanged expected-RED TSV. Expected arms are derived from the new one-name-per-line arm declaration. Both inputs allow comments/blanks and validate every resulting name.
 - Each of the four fixture arms writes its unique arm marker only after its exact per-case verifier succeeds. The three distinct expected-RED cases continue to write case markers after successful verification.
 - The final step checks both dimensions even when the first check fails, emits both denominators, and fails unless both exact name sets match.
 - Coverage state moved to .mosaic-test-work/greenfield-execution-coverage/${CI_PIPELINE_NUMBER}-${CI_WORKFLOW_NUMBER}/{cases,arms}. The checkout archive already excludes every */.mosaic-test-work subtree.
 - The expected-RED manifest, per-case verifier, and detector are untouched.
 MEASURED SKIPPED-REMOTE CONTROL
 With all three cases marked and only the three non-remote arms marked:
  case gate rc=0
  [fixture-suite] cases_defined=3 cases_executed=3
  arm gate rc=1
  [fixture-suite] arms_defined=4 arms_executed=3
  [fixture-suite] missing_arm=greenfield-remote-installer-contract
 This is the discriminating control: the case denominator remains green while the arm denominator catches the exact previously invisible skip.
 OTHER DYNAMIC CONTROLS
 - missing case: cases 3/2 => rc1
 - case count inflation (one missing + one unexpected): cases 3/3 => rc1
 - stale case markers after re-init: cases 3/0 => rc1
 - exact case set: cases 3/3 => rc0
 - future manifest case: cases 4/3 => rc1
 - arm count inflation (remote missing + unexpected): arms 4/4 => rc1
 - exact arm set: arms 4/4 => rc0
 - production expected-RED manifest comments/blanks: accepted; exact set 3/3 => rc0
 - archive selector firing control: a non-excluded root marker is present in the archive
 - archive purity control: no .mosaic-test-work path is present in the archive
 STATIC / STRUCTURAL CONTROLS
 - every case mark follows that arm's successful per-case verifier
 - every arm mark, including the remote contract, follows that arm's successful per-case verifier
 - all four arms depend on coverage initialization
 - final denominator depends on all four arms and is eligible after success or failure
 - final denominator runs both checks and aggregates their statuses
 - workflow contains the already-excluded .mosaic-test-work state root and no .greenfield-case-state reference
 LOCAL BASELINES
 - bash -n + ShellCheck on generalized checker/test: PASS
 - pnpm test:installer: PASS, including execution-coverage controls
 - pnpm typecheck: PASS, 45/45
 - pnpm lint: PASS, 25/25
 - pnpm format:check: PASS
 - woodpecker-cli lint --strict: PASS
 - git diff --check: PASS
 - /home free before/after: 11G
 INDEPENDENT REVIEW
 - Codex code review: APPROVE, confidence 0.93, zero findings. It confirmed exact arm coverage, success-only marking, dual-status aggregation, excluded state, checkout-purity controls, and PRD alignment.
 - Codex security review: risk NONE, confidence 0.96, zero findings. CI/path identifiers are constrained, expansions quoted, expected sets treated as data, and checks fail closed.
 - Review sandboxes could not execute their own dynamic suite/ShellCheck because their filesystem is read-only; the local measured baselines above provide that evidence.
 PENDING
 - commit, queue guard, one push, attribution read-back
 - announce the new full SHA; no merge or closure
@@ -0,0 +1,60 @@
 # #1050 C1 fix round — Round 6 caller coupling and production archive binding
 BASE HEAD
 - df705828a439c6795cd47c938ed7f838b956ebf3
 - Reviews 114 (rev-security-02) and 115 (be-coder-06) independently reproduced the same caller-level mutant: ignoring arms_status in the workflow left the focused helper suite green.
 - Both reviewers confirmed the production aggregation was correct and requested test reachability, not a logic rewrite.
 - rev-974 separately deleted only the production e2e-install-test.sh .mosaic-test-work tar exclusion; the copied-selector suite remained green.
 RED
 - After adding the four-cell caller truth-table expectations but before creating the workflow helper:
  bash tools/verify-greenfield-execution-coverage.test.sh => rc=1
  The expected helper did not exist, so the test could not reach a passing aggregation implementation.
 - Prior independent controls:
  ignore-arms workflow mutant => rc=0 before this round (reviews 114/115)
  delete-production-archive-exclusion mutant => rc=0 before this round (rev-974 exact-head sandbox)
 IMPLEMENTATION
 - Extracted the existing set +e / two checks / status capture / final OR into tools/verify-greenfield-execution-coverage-gate.sh without changing its semantics.
 - .woodpecker/greenfield-install.yml now invokes that helper directly; its inline duplicate was removed.
 - The focused suite invokes the same helper used by the workflow across all four cells:
  cases PASS / arms FAIL => RED
  cases FAIL / arms PASS => RED
  both FAIL => both diagnostic outputs and RED
  both PASS => GREEN
 - The archive-purity test now first locates the production checkout-archive command in tools/e2e-install-test.sh and requires its .mosaic-test-work exclusion, then proves the exclusion's archive effect.
 - GREENFIELD_COVERAGE_GATE and GREENFIELD_E2E_INSTALLER are test-only subject injection seams used to prove the requested mutants; production paths remain the defaults.
 MUTATION CONTROLS
 - ignore-arms aggregation helper => focused suite rc=1
 - ignore-cases aggregation helper => focused suite rc=1
 - always-RED aggregation helper => focused suite rc=1
 - delete only production .mosaic-test-work archive exclusion => focused suite rc=1
 - restored production subjects => greenfield execution coverage tests passed
 - final mutant workspace: /tmp/c1-round6-final-mutants.u0ZaL6
 - logs: /tmp/c1-round6-final-gate-ignore-arms.log, /tmp/c1-round6-final-gate-ignore-cases.log, /tmp/c1-round6-final-gate-always-red.log, /tmp/c1-round6-final-archive-mutant.log
 FENCED FILES
 - tools/e2e-install-test.sh HEAD/worktree SHA-256: a93113565aa69f2c6f3d792b78251021bb3bbe3f7813d5fed547ab0099fa3b98 (byte-identical)
 - tools/fixtures/greenfield-expected-red.tsv HEAD/worktree SHA-256: baae06c664d0ab7ffe4c32ec106bfcb6f9dd74b46461d3c4440b73dc582af1a2 (byte-identical)
 - No per-case disposition or #869 wiring changed.
 LOCAL BASELINES
 - /home free before build: 11G
 - bash -n focused scripts: PASS
 - ShellCheck focused scripts: PASS
 - bash tools/verify-greenfield-execution-coverage.test.sh: PASS
 - pnpm test:installer: PASS
 - pnpm typecheck: PASS (45/45)
 - pnpm lint: PASS (25/25)
 - pnpm format:check: PASS
 - woodpecker-cli lint --strict .woodpecker/greenfield-install.yml: PASS
 - git diff --check: PASS
 INDEPENDENT REVIEW
 - Codex code review: APPROVE, confidence 0.94, seven files reviewed, zero findings. It confirmed the workflow invokes the exact four-cell-tested helper, both diagnostics remain observable, and archive purity binds to the production selector.
 - Codex security review: risk NONE, confidence 0.97, seven files reviewed, zero findings. It confirmed fail-closed behavior, quoted inputs, repository-controlled production arguments, and no new secret/injection/access-control exposure.
 - The code-review sandbox could not execute the dynamic suite because its filesystem is read-only; the local measured baselines and mutation controls above provide dynamic evidence.
 PENDING
 - commit, queue guard, one lease-pinned push, provider attribution read-back
@@ -0,0 +1,56 @@
 # #1050 C1 fix round — Round 7 canonical Alpine/BusyBox portability
 BASE HEAD
 - d66e91b1f22489b911eef982aec3faa62c5edeb3
 - Review 119 (rev-974) found tools/verify-greenfield-execution-coverage.sh used GNU-only find -printf.
 - Pipeline 2246's canonical Alpine ci-base test failed while the Debian greenfield workflow passed; the stale pipeline is diagnostic evidence only and is not inherited as a ruling for the replacement head.
 RED
 - Before remediation:
  docker run --rm -v "$PWD:/workspace" -w /workspace git.mosaicstack.dev/mosaicstack/stack/ci-base:latest bash tools/verify-greenfield-execution-coverage.test.sh
  => canonical_alpine_red_rc=1
 - Independent review 119 captured BusyBox 1.37 rejecting `find: unrecognized: -printf`.
 - Debian/GNU execution remained green, proving that one runtime's success did not establish portability.
 IMPLEMENTATION
 - Removed the GNU find -printf inventory.
 - Marker inventory now uses Bash nullglob/dotglob plus parameter expansion, all available in the script's declared Bash runtime.
 - The checker verifies the run directory is readable/searchable before inventory and fails closed otherwise.
 - Only direct regular, non-symlink `*.ran` files are included, preserving the prior find boundary; identities remain sorted and compared as exact sets.
 - No production fixture disposition, expected-RED manifest, e2e installer, #869 wiring, or acquisition behavior changed.
 GREEN
 - Local focused suite: greenfield execution coverage tests passed.
 - Canonical Alpine/BusyBox focused suite:
  docker run --rm -u "$(id -u):$(id -g)" -v "$PWD:/workspace" -w /workspace git.mosaicstack.dev/mosaicstack/stack/ci-base:latest bash tools/verify-greenfield-execution-coverage.test.sh
  => greenfield execution coverage tests passed.
 - Existing Round-6 controls retained:
  ignore-arms aggregation helper => rc=1
  ignore-cases aggregation helper => rc=1
  always-RED aggregation helper => rc=1
  delete production .mosaic-test-work archive exclusion => rc=1
 - Mutant workspace: /tmp/c1-round7-mutants.LocpBH
 FENCED FILES
 - tools/e2e-install-test.sh HEAD/worktree SHA-256: a93113565aa69f2c6f3d792b78251021bb3bbe3f7813d5fed547ab0099fa3b98 (byte-identical)
 - tools/fixtures/greenfield-expected-red.tsv HEAD/worktree SHA-256: baae06c664d0ab7ffe4c32ec106bfcb6f9dd74b46461d3c4440b73dc582af1a2 (byte-identical)
 LOCAL BASELINES
 - /home free before and after validation: 11G
 - Bash syntax focused scripts: PASS
 - ShellCheck focused scripts: PASS
 - pnpm test:installer: PASS
 - pnpm typecheck: PASS (45/45)
 - pnpm lint: PASS (25/25)
 - pnpm format:check: PASS
 - woodpecker-cli lint --strict .woodpecker/greenfield-install.yml: PASS
 - git diff --check: PASS
 INDEPENDENT REVIEW
 - Codex code review: APPROVE, confidence 0.96, zero findings. It confirmed hidden/empty/direct-regular/non-symlink semantics, exact sorting/comparison, dual-runtime execution, and PRD alignment.
 - Codex security review: risk NONE, confidence 0.97, zero findings. It confirmed quoted paths, fail-closed exact-set behavior, and no new injection, traversal, authorization, secret, cryptographic, dependency, or data-integrity risk.
 - The security-review sandbox could not execute the focused suite because its filesystem is read-only; the local and canonical-container measured runs above provide dynamic evidence.
 PENDING
 - commit, queue guard, one lease-pinned push, provider attribution read-back
 - replacement-head canonical CI; no manual pipeline trigger or polling
@@ -0,0 +1,56 @@
 # #1050 C1 fix round — Round 8 pipefail-safe expected-set membership
 BASE HEAD
 - 58ada98d2b430da28c46cf92eebdb6d45b8b1846
 - Review 122 (rev-security-02) found expected_names | grep -Fxq could falsely reject valid markers under pipefail when grep closed the pipe after an early match and the producer exited 141.
 - Independent canonical-Alpine live-manifest stress reproduced intermittent false failures at the current four-arm set size. No small-manifest safe threshold is claimed.
 DETERMINISTIC RED
 - The focused suite now generates a 20,001-name manifest with a valid target sorted first and invokes the real mark path.
 - Before remediation, in canonical Alpine ci-base:
  docker run --rm -u "$(id -u):$(id -g)" -v "$PWD:/workspace" -w /workspace git.mosaicstack.dev/mosaicstack/stack/ci-base:latest bash tools/verify-greenfield-execution-coverage.test.sh
  => canonical_sigpipe_tdd_red_rc=1
  => [fixture-suite] case is not in the expected set: a-target
 - This control exercises the production checker invocation rather than an approximated producer and makes the early-close race deterministic by exceeding pipe capacity.
 IMPLEMENTATION
 - The mark path now fully materializes expected_names into expected_snapshot and fails closed if production fails.
 - grep -Fxq reads the completed snapshot through a here-string; there is no producer/consumer pipeline to close early.
 - Missing names still fail with the same attributable message. No `|| true` or other failure suppression was introduced.
 - Exact-set checks, marker inventory, aggregation, archive binding, fixture dispositions, expected-RED manifest, e2e installer, #869 wiring, and acquisition behavior are unchanged.
 GREEN
 - Local focused suite: greenfield execution coverage tests passed.
 - Canonical Alpine focused suite: greenfield execution coverage tests passed.
 - Canonical Alpine live production-manifest stress: 1,000 valid greenfield-git-absent arm marks, failures=0.
 - Canonical grep-q pipeline mutant through the real checker path => rc=1 with the attributable false rejection; restored subject => GREEN.
 - Existing Round-6 controls retained:
  ignore-arms aggregation helper => rc=1
  ignore-cases aggregation helper => rc=1
  always-RED aggregation helper => rc=1
  delete production .mosaic-test-work archive exclusion => rc=1
 - Round-8 mutant workspace: /tmp/c1-round8-mutants.aS1xTI
 FENCED FILES
 - tools/e2e-install-test.sh HEAD/worktree SHA-256: a93113565aa69f2c6f3d792b78251021bb3bbe3f7813d5fed547ab0099fa3b98 (byte-identical)
 - tools/fixtures/greenfield-expected-red.tsv HEAD/worktree SHA-256: baae06c664d0ab7ffe4c32ec106bfcb6f9dd74b46461d3c4440b73dc582af1a2 (byte-identical)
 LOCAL BASELINES
 - /home free before and after validation: 11G
 - Bash syntax focused scripts: PASS
 - ShellCheck focused scripts: PASS
 - pnpm test:installer: PASS
 - pnpm typecheck: PASS (45/45)
 - pnpm lint: PASS (25/25)
 - pnpm format:check: PASS
 - woodpecker-cli lint --strict .woodpecker/greenfield-install.yml: PASS
 - git diff --check: PASS
 INDEPENDENT REVIEW
 - Codex code review: APPROVE, confidence 0.96, six files reviewed, zero findings. It confirmed full materialization removes the SIGPIPE race and the deterministic regression control exercises the real early-match mark path.
 - Codex security review: risk NONE, confidence 0.98, six files reviewed, zero findings. It confirmed fail-closed producer handling, constrained/quoted names, and no new injection, traversal, secret, access-control, cryptographic, dependency, or logging risk.
 - The code-review sandbox could not execute the suite or install ShellCheck because its filesystem is read-only; local and canonical-container dynamic evidence above supplies those gates.
 PENDING
 - commit, queue guard, one lease-pinned push, provider attribution read-back
 - replacement-head canonical CI; no manual trigger or polling
@@ -0,0 +1,33 @@
 # #1050 C1 fix-round verification
 Frozen reviewed head before remediation: `378bc1afe3bc485adb8614897d66c5edccd4a527`.
 Status: **believed-fixed, pending jarvis validation**. PR #1054 is not self-merged and issue #1050 remains open.
 ## Blocker B — fail-closed test enumeration
 The RED-first control used a real filesystem permission failure, not binary shadowing or PATH interception.
 1. A planted `{"status":"in-progress"}` file in a readable P2 fault tree made the complete real walk fail the frozen suite at `P2 left an in-progress transaction` (`01-pre-fix-positive-control.log`, exit 1).
 2. The same planted defect beneath a target-owned mode-0100 directory made real `find` report a permission failure. The frozen suite erased the producer failure and exited 0 with `installer next lane tests passed` (`02-pre-fix-permission-failure-attack.log`).
 3. The committed regression control initially failed because the child full-suite attack still exited 0 (`03-regression-test-red.log`).
 4. After remediation, the same child full-suite input exits 1 and names `[test] ERROR: P2 fault-state enumeration failed` (`04-post-fix-permission-failure-attack.log`). The ordinary full suite remains green.
 `tools/test-enumeration-assertions.sh` now captures each complete NUL-delimited population and checks the producer status before asserting absence. Content checks inspect the captured population and distinguish “no match” from a read error. The shared fail-closed implementation covers:
 - `tools/install-next-lane.test.sh`: redacted staging-file cleanup and fault-state transaction scan;
 - `tools/verified-installer-fetch.test.sh`: temporary-download cleanup;
 - `tools/install-state-machine.test.sh`: symlink-target non-mutation;
 - `docs/reports/verification/1050-b8-redaction-control/positive-control.test.sh`: both copied counterparts.
 No assertion was loosened. A1, A2, upgrade-guard, source-root, the species-2 sweep, #869, and expected-RED verdict rows remain outside this remediation.
 ## Blocker A — installer digest
 The stale sidecar value was replaced with the exact `sha256sum` record for `tools/install.sh`:
 ```text
 e59cb441a2f37ae9150f8eae470238e9d858a1816df93343d9784a6796676096  install.sh
 ```
 RED-first documentation control from the repository root: `sha256sum -c tools/install.sh.sha256` exits 1 with `install.sh: FAILED open or read` because the sidecar records a path relative to `tools/`. The command actually executed, `(cd tools && sha256sum -c install.sh.sha256)`, exits 0 with `install.sh: OK`; the workflow's separate exact expected/actual equality also passes. The immutable provider-fetch arm at the new `${CI_COMMIT_SHA}` is recorded in the freeze artifact after push; local equality alone is not treated as sufficient evidence.
@@ -0,0 +1,28 @@
 # Documentation completion checklist — #1050 C1 fix round
 ## Required artifacts
 - [x] `docs/PRD.md` exists; #1050 C1 requirement 13 binds the complete in-scope remote stack source chain, and requirement 15 binds exact case+arm execution coverage, executable aggregation, production-bound archive purity, dual-runtime portability, and pipefail-safe materialized membership.
 - [x] User guide: not applicable; no user-facing production installer behavior changed.
 - [x] Admin guide: not applicable; no operator procedure or deployment behavior changed.
 - [x] Developer guide: existing `docs/guides/installer-state-machine.md` defines the fail-closed installer model; the C1-specific remote-arm contract and evidence live in the PRD, scratchpad, and scoped verification report.
 - [x] OpenAPI and endpoint index: not applicable; no API changed.
 - [x] Sitemap: not applicable; no navigation changed.
 ## API and structural coverage
 - [x] API schema/auth/error coverage: not applicable; no endpoint changed.
 - [x] Guide book indexes: not applicable; no guide page was added or moved.
 - [x] Root hygiene preserved; all new artifacts are under `docs/reports/verification/1050-c1-fix-round/` and the active scratchpad remains under `docs/scratchpads/`.
 ## Review and publishing
 - [x] Verification documentation is in the same logical change set as the shell-test remediation.
 - [x] Trust boundary states both halves: the digest proves fetched bytes remain identical through execution/verify-after; it does not authenticate authorship against provider/TLS compromise. Independent provenance is the inherited PRD v2 §3 deferral.
 - [x] Round-3 Codex code review APPROVE (confidence 0.92, zero findings) and security re-review risk NONE (confidence 0.96, zero findings). The initial HIGH trust-root finding remains documented as the canonical signed-provenance deferral, not hidden.
 - [x] Round-4 review cycle closed: two blocking Codex findings (missing dependency ordering; production manifest comments misparsed) were accepted and fixed. Final code review APPROVE (confidence 0.94, zero findings) and security risk NONE (confidence 0.96, zero findings).
 - [x] Round-5 exact arm coverage and archive-purity controls reviewed: Codex code APPROVE (confidence 0.93, zero findings) and security risk NONE (confidence 0.96, zero findings).
 - [x] Round-6 executable aggregation and production archive-selector binding reviewed: Codex code APPROVE (confidence 0.94, zero findings) and security risk NONE (confidence 0.97, zero findings).
 - [x] Round-7 BusyBox-safe marker inventory and dual-runtime evidence reviewed: Codex code APPROVE (confidence 0.96, zero findings) and security risk NONE (confidence 0.97, zero findings).
 - [x] Round-8 materialized membership and deterministic canonical-Alpine control reviewed: Codex code APPROVE (confidence 0.96, zero findings) and security risk NONE (confidence 0.98, zero findings).
 - [x] Canonical evidence remains in-repo. No external publishing action was requested or performed.
@@ -0,0 +1,66 @@
 # #1050 successor remediation verification
 Head under test before remediation: `e5d5c8495a070af2dcd393cace287fe74a8a819e`.
 This change strengthens the expected-RED detector; it does not repair the intentionally failing greenfield rows. The #869 hooks remain unwired.
 ## A1 — P0 reason binding
 RED first:
 ```text
 $ bash tools/verify-greenfield-expected-red.test.sh
 [test] FAIL: vacuous P0 PASS satisfied the expected-RED contract without identity/context evidence
 exit=1
 ```
 The pinned manifest now has an explicit `phase-reason` binding against the final P0 row: target `mosaic`, uid `1001`, equal `HOME` and passwd HOME, `/bin/bash`, `privilege=user`, `x86_64`, glibc, and version-shaped Node/npm evidence. All three cases structurally require exactly one P0 reason binding. The greenfield fixture's final P0 row now emits and validates the same complete identity/context evidence, so an unrelated earlier P0 line cannot satisfy the binding for a vacuous final row.
 Pipeline 2224 and the successor's pre-change fixture run also exposed a stale next-lane P6 reason left behind by the already-closed B6 remediation: actual behavior is a fail-closed runtime-link action refusal with `#869` hooks left inactive and a persisted required P6 failure, while the manifest still expected dead hooks to be active. The pinned reason now matches the stronger measured refusal (`runtime linking/activation action reported a required failure`); no verdict changed and #869 remains unwired.
 GREEN:
 ```text
 [test] PASS: P0 PASS must bind target identity, HOME, shell, privilege, architecture, and runtime reason
 ```
 ## A2 — fail-closed P4 enumeration
 RED first: a `find` control emitted only the safe root, omitted an unsafe mode-`0666` child, and exited `73`. The process-substitution consumer discarded that status:
 ```text
 [test] FAIL: P4 accepted a partial created-path inventory after find failed
 [test] FAIL: P4 did not report failed created-path enumeration
 exit=1
 ```
 P4 now captures the NUL-delimited walk into a temporary file, checks `find` to completion, and only then evaluates the complete inventory. A failed walk reports that enumeration failed and returns a P4 finding.
 GREEN:
 ```text
 [test] PASS: P4 rejects an incomplete created-path inventory
 [test] PASS: P4 attributes the failed created-path enumeration
 ```
 ## B — deterministic TERM no-exit control
 Woodpecker pipeline 2224 at the original head reported `32 passed, 2 failed`: the no-exit fixture did not exit zero or report sync success. The premise was not stale: the same fixture passed `34/34` on another filesystem.
 A controlled reverse-sorted `find -print0` walk reproduced the pipeline result exactly (`32 passed, 2 failed`). Root cause: signal injection was tied to `guides/E2E-DELIVERY.md`; whether required `tools/` content remained after restore depended on filesystem enumeration order. The test was measuring path order as well as trap semantics.
 The generated fixtures now damage a real target path after the snapshot is armed, self-signal immediately before the complete normal sync, and differ only in the explicit handler exit. Therefore a no-exit handler always restores, returns, runs the full sync, mutates the restored target again, and reports completion independent of walk order.
 GREEN on both native and reverse-sorted enumeration:
 ```text
 RESULT: 36 passed, 0 failed
 ```
 Mutation sensitivity: restoring `exit 1` to the nominal no-exit fixture makes the control RED (`32 passed, 4 failed`), including failures of the zero-exit and resumed-success assertions. The control can still fail for its stated reason.
 ## Enumeration-class sweep
 The sweep covered production enumeration in `tools/install.sh` and `packages/mosaic/framework/install.sh`, plus process-substitution consumers in the C1 shell-test surfaces. Framework installer file, operator, durable-snapshot, and pruning walks already capture and check their producer status. P4's created-path walk was the reviewed unchecked instance.
 One additional order/completeness dependency was found in source acquisition: `find "$WORK_DIR" ... | head -1` hid `find` failure and selected arbitrarily when an archive produced multiple top-level directories. RED first, the extraction fake produced two roots and the lane test stopped at that new assertion with exit 1 because today's code selected one. Source acquisition now captures and checks the complete NUL-delimited walk and requires exactly one extracted root. The lane suite is green with the multiple-root rejection. No remaining production installer enumeration uses unchecked process substitution or first-row order as authority.
@@ -1,229 +0,0 @@
 # #1043 — Fleet pane git-identity propagation
 ## Objective
 Ensure a fleet seat's launched runtime process receives its roster-derived `MOSAIC_GIT_IDENTITY`, and lock the complete generated-environment propagation boundary with an enumerated set comparison.
 ## Tracking
 - External issue: `mosaicstack/stack#1043`
 - Branch: `fix/1043-pane-git-identity`
 - Coordinator: `tl-mosaic`
 - `docs/TASKS.md`: read-only by project worker contract; not modified.
 ## Constraints
 - RED-first bug reproducer is mandatory.
 - R7 delete-the-subject mutation must turn the behavioral test red.
 - Assert launched-process environment, not source text.
 - One push only; do not poll CI after push.
 - Run the CI queue guard immediately before push and report its `state=` line as state, not evidence.
 - Do not modify a live host launcher or obtain/copy another credential.
 - Self-post the PR, verify provider attribution, then stop.
 - Final status wording: `believed-fixed, pending jarvis validation`.
 ## Scope inventory
 Re-derived against `origin/main` at `85d2108e`:
 - Launch consumer: `packages/mosaic/framework/tools/fleet/start-agent-session.sh`
 - Behavioral launch test: `packages/mosaic/framework/tools/fleet/test-start-agent-session.sh`
 - Generated-environment contract/parser: `packages/mosaic/src/fleet/generated-env-boundary.ts`
 - Roster projection producers:
  - `packages/mosaic/src/commands/fleet.ts`
  - `packages/mosaic/src/fleet/fleet-reconciler.ts`
  - `packages/mosaic/src/fleet/fleet-agent-crud.ts`
  - `packages/mosaic/src/fleet/v1-v2-migration.ts`
 - Contract and producer tests discovered by repository search.
 - Generated-environment operator/developer docs and their executable documentation contract test.
 Discrepancy sent to `tl-mosaic`: current main no longer contains the charter's `PANE_SHELL_SNIPPET`; #772 replaced it with an `/usr/bin/env -i` argv launch boundary, and current generated projections do not declare git identity. Code-read inventory is **NOT MEASURED** behavior.
 ## Plan
 1. Add the process-environment set-comparison regression first and record RED.
 2. Add roster-derived `MOSAIC_GIT_IDENTITY=<agent name>` to the complete generated projection contract.
 3. Validate identity syntax and equality with `MOSAIC_AGENT_NAME`; pass it through the clean pane environment.
 4. Update affected projection tests and generated-environment docs.
 5. Run focused and baseline gates.
 6. Perform R7 by deleting the pane propagation entry, prove RED, restore, and prove GREEN.
 7. Run independent review, remediate, commit, queue guard, one push, self-post PR, verify provider attribution, and stop without CI polling.
 ## Budget
 No explicit token cap was provided. Working cap: one narrow logical unit, no dependency installation unless existing tooling requires it, no unrelated refactor.
 ## Evidence log
 ### TDD and mutation evidence
 - RED-first, repository launcher: `bash packages/mosaic/framework/tools/fleet/test-start-agent-session.sh` exited 64 on pre-fix source with `code=unknown-key key=MOSAIC_GIT_IDENTITY`. The generated seat could not launch with the required declared identity.
 - GREEN: the same repository launcher test emitted `ok - start-agent-session generated environment boundary`.
 - R7 delete-the-subject: removed only `"MOSAIC_GIT_IDENTITY=$MOSAIC_GIT_IDENTITY"` from the repository launch array; the same test exited 1 with `FAIL: runtime pane omitted or changed generated environment keys: MOSAIC_GIT_IDENTITY`.
 - R7 restoration: restored that launch entry; the same test returned green.
 - Launcher under test is explicitly `packages/mosaic/framework/tools/fleet/start-agent-session.sh` through the test's `$START`, **not** the stale installed host copy.
 ### Situational and focused tests
 - Repository launcher boundary: green, including set comparison of all nine generated projection entries and fail-before-tmux cases for missing, unsafe, mismatched, and local-shadow Git identity.
 - Fleet systemd launcher integration: `bash packages/mosaic/framework/systemd/user/test-fleet-units.sh` — green.
 - Focused Mosaic Vitest set: 6 files, 311 tests — green.
 - `bash -n` on changed shell files — green.
 - `git diff --check` — green.
 ### Baseline gates
 - `pnpm typecheck` — 45/45 tasks green.
 - `pnpm lint` — 25/25 tasks green.
 - `pnpm format:check` — green.
 - `pnpm test:checkout` — green.
 - Repository-wide Vitest under a hermetic current-version npm prefix: Mosaic 81/81 files and 1510/1510 tests green; other workspace test tasks shown green before the framework-shell phase.
 - Canonical `pnpm test` is not fully green on this host for unrelated environment-sensitive gates:
  1. the first two runs exposed the globally installed Mosaic 0.0.48 update banner in three CLI smoke tests expecting empty stderr;
  2. after isolating that global-version input, the framework wake assertion aborted at the known `#973` Bash `BASH_LINENO` convention check (exit 97; observed `[3 5]`, expected `[3 4]`).
  No tests were weakened or bypassed; focused changed-surface tests are green. CI remains the canonical clean-environment result and is intentionally not polled after push per charter.
 ### Independent review
 - Codex code review first pass: request changes for missing shell rejection-path coverage.
 - Remediation: added table-driven missing/unsafe/mismatch/local-shadow launcher cases, each asserting no tmux call.
 - Codex code re-review: **approve**, no findings, confidence 0.88.
 - Codex security review: risk `none`, no findings, confidence 0.97.
 ### Acceptance criteria mapping
 | Acceptance criterion | Evidence |
 | --- | --- |
 | AC-FGI-01: launched process receives every generated key/value | Repository launcher process-environment `comm -23` set comparison; GREEN and R7 RED evidence above |
 | AC-FGI-02: missing, unsafe, or split identity fails before tmux | Table-driven shell cases plus TypeScript generated-boundary tests |
 | AC-FGI-03: focused/baseline/review evidence recorded | Commands and review outcomes above; host-sensitive full-suite limitations stated explicitly |
 ### Documentation checklist
 - PRD updated with #1043 requirements and acceptance criteria.
 - Fleet launch runbook, generated-env concept, and generated-env reference updated.
 - No API/OpenAPI, sitemap, user publishing target, deployment, or external docs publication change applies.
 - `docs/TASKS.md` remains unmodified per its single-writer project contract.
 ## Round 2 — PR #1073 review 97 remediation
 ### Review blocker
 The launched-process suite was signed-excluded from CI enumeration. Manual GREEN/R7 evidence therefore did not prove a PR workflow could detect regression.
 ### RED-first and canonical wiring
 1. Removed the suite's signed exclusion before adding a CI execution path.
 2. `check-test-enumeration.sh` went RED with exact `UNENUMERATED` output for `test-start-agent-session.sh`: population 49, enumerated 30, excluded 18.
 3. Added both `framework/tools/fleet/test-start-agent-session.sh` and `framework/systemd/user/test-fleet-units.sh` to `@mosaicstack/mosaic`'s canonical `test:framework-shell` chain.
 4. The guard returned GREEN: population 49, enumerated 32, excluded 18, surfaces 45. The systemd suite is outside the guard's tools-only population but now has the same explicit canonical execution disposition.
 ### Workflow-level R7
 - Deleted only the pane launch entry `"MOSAIC_GIT_IDENTITY=$MOSAIC_GIT_IDENTITY"`.
 - Ran the exact `.woodpecker/ci.yml` test-step command, `pnpm test`, with only a temporary PATH-scoped npm shim reporting the checkout's current 0.0.49 version so the unrelated global 0.0.48 banner could not preempt the shell chain.
 - Result: exit 1 at `@mosaicstack/mosaic#test`, with the enumeration guard GREEN followed by `FAIL: runtime pane omitted or changed generated environment keys: MOSAIC_GIT_IDENTITY`.
 - Restored the launch entry. The canonical `test:framework-shell` chain then reached both newly wired suites and printed both GREEN markers before the known unrelated #973 host-only `BASH_LINENO` abort.
 - An actual provider PR workflow on the intentionally broken mutant is **NOT MEASURED**: the one-push constraint forbids pushing a red mutant and then a repaired head. Local execution proves the exact PR workflow command and dependency chain go RED on the subject deletion; CI on the repaired pushed head remains canonical.
 ### Workflow population
 - **DEFINED:** 3 workflows (`ci.yml`, `ci-image.yml`, `publish.yml`).
 - **ELIGIBLE for `pull_request`:** 1/3 (`ci.yml`), based on top-level `when:` clauses.
 - **REPORTED:** Round-1 exact-head provider read reported 1/1 eligible context (`ci/woodpecker/pr/ci`). Post-remediation-head reported count is **NOT MEASURED** by this seat because CI polling is prohibited; workflow definitions and eligibility did not change.
 ### Independent remediation review
 - First Round-2 review identified a CI-image blocker: the newly wired launcher suite used Perl, which the Alpine CI base does not install.
 - Replaced the suite's three Perl-only fixture mutations with POSIX/BusyBox-compatible `sed -i` substitutions; production behavior and assertions are unchanged.
 - Codex re-review: **APPROVE**, confidence 0.93, no findings.
 ### Vitest denominator reconciliation
 The PR's `311/311` is correct for its explicitly named six-file command at both the original and remediation worktrees:
 - generated environment boundary: 24
 - fleet documentation: 23
 - Tess service profile: 6
 - fleet regen command: 27
 - fleet agent CRUD command: 22
 - fleet command: 209
 - total: **311**
 Review 97 reported 312/312 without naming its six files. That is a different or miscounted population and cannot replace the command-scoped 311 denominator; the PR follow-up will name the exact files and arithmetic.
 ## Round 3 — Alpine stale-marker portability
 ### Objective and plan
 - Replace the GNU-only relative-date fixture with a deterministic POSIX/BusyBox timestamp while preserving the required stale-marker assertion.
 - Re-run the launcher suite in the canonical `ci-base:latest` Alpine image, then run applicable repository gates and independent review.
 - Update the PR body to name the repeated GNU-host/Alpine-CI portability pattern, run the mandatory queue guard, push once, verify provider attribution, and stop without CI polling.
 - Working budget: 8K tokens; scope is one fixture line plus delivery evidence. No production behavior changes.
 ### RED-first evidence
 Before the fix, the canonical CI image command
 `docker run --rm -v "$PWD:/work" -w /work git.mosaicstack.dev/mosaicstack/stack/ci-base:latest bash packages/mosaic/framework/tools/fleet/test-start-agent-session.sh`
 exited 1 at the stale-marker setup with exact BusyBox output
 `touch: invalid date '10 seconds ago'`. The prior fresh-marker assertions had already executed, matching pipeline 2233's failure location.
 ### Root cause and fix
 The test used GNU `touch -d` relative-date parsing although the PR workflow runs on Alpine/BusyBox. The fixture now uses POSIX `touch -t 200001010000.00`, a fixed timestamp that is unconditionally stale; the stale assertion remains mandatory and was not made tolerant of missing timestamp metadata.
 ### Structural pattern
 This is the third GNU-host/Alpine-CI portability defect in the lane: GNU `grep` multi-match counting, Perl-only fixture mutation, and GNU `touch -d` date parsing. The repeated cause is shell suites authored on a GNU host but executed in an Alpine CI image; durable prevention belongs in CI-image execution or portability lint, not assertion weakening.
 ### GREEN and quality evidence
 - Focused launcher suite in `ci-base:latest`: exit 0, `ok - start-agent-session generated environment boundary`.
 - Canonical test step in `ci-base:latest` with the pipeline's `pgvector/pgvector:pg17` service, readiness check, migration, and `pnpm test`: exit 0; 46/46 Turbo tasks; Mosaic 81/81 files and 1510/1510 tests; Gateway 57 passed/5 skipped files and 629 passed/11 skipped tests; enumeration 49 population / 32 enumerated / 18 signed exclusions / 45 named surfaces.
 - The first image-only `pnpm test` attempt lacked the pipeline PostgreSQL service and failed only on connection refusal after the launcher suite was GREEN. The rerun supplied the canonical service precondition and passed.
 - Canonical-image baseline: typecheck 45/45 tasks, lint 25/25 tasks, format check GREEN; `git diff --check` GREEN.
 - Independent Codex code review: APPROVE, confidence 0.96, 2/2 Round-3 files, no findings.
 - Independent Codex security review: risk none, confidence 0.99, 2/2 Round-3 files, no findings.
 ### Re-derived inventory and denominators
 - Round-3 git delta: **2/2 files** — launcher suite and task scratchpad; 25 insertions / 1 deletion before evidence finalization.
 - Full PR path inventory against `origin/main` at `85d2108e`: **19/19 changed paths**; Round 3 adds no new PR path.
 - Workflow definition population: **1/3 pull-request-eligible** (`ci.yml` of `ci.yml`, `ci-image.yml`, `publish.yml`).
 - Do not re-litigate the settled 311/312 populations; both are valid for their separately named Tess6 and CRUD-core7 sets.
 ## Round 4 — bound stale-marker observation
 ### Objective and plan
 - Make the heartbeat assertion discriminate an initially stale native marker from a fresh marker without changing the production staleness threshold or shortening the polling window.
 - Freeze only the sidecar's numeric observation clock during the stale-fixture arm so elapsed assertion time cannot turn a fresh mutant stale.
 - Prove two independent mutants RED: disable production stale-marker detection while retaining the stale fixture; replace the stale fixture with a fresh marker. Restore the tree and prove GREEN in the canonical Alpine image.
 - Re-derive the changed-path inventory, run applicable quality and independent review gates, commit with environment-only author/committer identity, queue-guard, push once, verify provider attribution using curl stdin config, and stop without CI polling.
 - Working budget: 8K tokens. Scope is the launcher test and its scratchpad evidence; production launcher behavior remains unchanged.
 ### Root cause and bounded observation
 The 30 × 0.1-second assertion window overlaps the production `now - marker > interval * 2 + 1` threshold at interval 1. Depending on second boundaries and load, a fresh marker can age past the threshold before the assertion ends. A focused pre-fix fresh-mutant attempt returned RED while Review 101's full-suite run returned GREEN; the differing result is itself timing dependence, not a discriminating assertion.
 The test now supplies a fixed numeric epoch only to the stale-fixture sidecar. Its real marker mtime is still read from the filesystem, but assertion runtime cannot advance `now`. Date formatting still delegates to the image's real `/bin/date`. Neither the production threshold nor the 30 × 0.1-second polling window changed.
 ### Two-mutant RED / restored GREEN
 All three runs used `git.mosaicstack.dev/mosaicstack/stack/ci-base:latest`:
 1. **Stale-detection mutant RED:** replaced only the production stale-age predicate with `false` while retaining the fixed stale marker; suite exit 1 with `FAIL: heartbeat sidecar did not resume after native marker became stale or absent`.
 2. **Fresh-marker mutant RED:** replaced only `touch -t 200001010000.00` with fresh `touch`; suite exit 1 with the same failed stale-resumption assertion. The fixed observation epoch kept the mutant fresh throughout all 30 polls.
 3. **Restored tree GREEN:** suite exit 0 with `ok - start-agent-session generated environment boundary`.
 ### Re-derived inventory
 - Round-4 delta: **2/2 files** — launcher test plus task scratchpad; production launcher delta is empty.
 - Full PR inventory against `origin/main`: **19/19 paths**; Round 4 adds no path.
 - Production stale threshold remains `now - marker > iv * 2 + 1`; assertion polling remains 30 × 0.1 seconds.
 - Review 101's confirmed enumeration/workflow/CI and attribution evidence is accepted without re-polling or re-derivation.
 ## Residual risk
 - Landing on `main` does not update the currently installed host launcher. Host framework installation/reseed and Jarvis live-seat validation are separate downstream events.
 - Canonical CI result is pending and will not be polled by this seat.
@@ -0,0 +1,186 @@
 # #1050 — Installer P0–P9 state machine and red-first fixture
 ## Objective
 Implement C1 from the canonical greenfield-install PRD v2: a transactional P0–P9 installer spine, a side-effect-free P0–P8 `--check`, and a lane-parametric Debian/glibc non-root from-zero fixture. The acceptance milestone is an attributable RED on the pre-C1 installer while preserving P3 PASS.
 ## Authority and scope
 - Canonical requirements: `jason.woltje/jarvis-brain` `docs/plans/2026-08-04-greenfield-install-blockers-PRD-v2.md`. Currency was re-derived after compaction: authenticated fetch resolved `origin/main` to `cb23e5fbc8a282fa967b93d7a134fa48d11b4bb1`; the PRD and charters are byte-identical to the previously read remote copies.
 - Tracking: `mosaicstack/stack#1050` on `git.mosaicstack.dev` (author read back as `be-coder-05`).
 - Historical implementation base: `origin/next` `4df478cdd150fdf8d52ea109f02ade5d85017acd`. Delivery PR #1054 targets `main` under L0's trunk-only rule; `next` remains a non-merging integration lane.
 - Out of scope: PATH, skills, headless wizard/identity, activation remediation, #869 wiring, RM-02, main promotion.
 - `docs/TASKS.md` is orchestrator-single-writer and is not modified by this worker.
 ## Plan
 1. Pre-register the canonical phase/output/side-effect-free/fault-injection checks and observe RED against the base installer.
 2. Commit the immutable red-first acceptance fixture before implementation.
 3. Add the state-machine/journal/postcondition spine without repairing P4/P5/P8 symptoms.
 4. Wire the expected-RED from-zero fixture into Woodpecker using Debian/glibc and a non-root target user.
 5. Run shell/static baselines, situational container validation, code review, security review, then deliver through a PR to `next` under the coordinator-owned merge path.
 ## Budget
 - Working estimate: 32K reasoning/output tokens.
 - Hard external cap: none stated.
 - Adaptation: keep implementation in shell surfaces already in scope; no package dependency install unless repository gates require it.
 ## Pre-registered acceptance checks
 | ID | Exact case | Expected pre-fix result |
 |---|---|---|
 | C1-R1 | `tools/e2e-install-test.sh --lane next` in a clean Debian 12 container as uid 1001 | non-zero; P3 PASS; P4 `NOT-MEASURED / UNDECLARED`; P5/P6/P8 FAIL with own reasons |
 | C1-R2 | `tools/install-state-machine.test.sh` phase table case | RED because base installer does not enumerate canonical P0–P9 contracts |
 | C1-R3 | side-effect-free `--check` case over a fingerprinted HOME | RED because base `--check` is version-only rather than P0–P8 predicates |
 | C1-R4 | fault injection after each P2…P8 | RED because base installer has no injectable durable journal/rollback state |
 | C1-R5 | Docker unavailable | base harness incorrectly exits 0; replacement must fail non-zero |
 | C1-R6 | lane resolution | bare checkout is forbidden; fixture must pass `--next` and assert the resolved prerelease version |
 | C1-R7 | same Debian fixture with `git` absent vs present | absent: P1 FAIL while legacy installer exits 0 and sync degrades; present: P1 PASS and observed store/runtime containment 101/101 |
 ## Progress
 - [x] Charter, doctrine, delivery/CI/QA/docs guides read and re-anchored after compaction.
 - [x] Canonical PRD v2/v3 addenda and charters read from fetched `origin/main`; numbering reconciles with the TL spec. No numbering conflict found. INV-B/C/D are binding and implemented without renumbering.
 - [x] Target base reachability verified with `merge-base --is-ancestor`.
 - [x] Issue #1050 created and provider author read back.
 - [x] Initial RED captured; TL rejected P4's repo-root count as a false RED. Four populations disagree (framework payload 1, repo root 13, sync store 101 in the fixture, W-jarvis observation 7), so C1 now requires a checkout-free declared shipped-set artifact and reports P4 `NOT-MEASURED / UNDECLARED` until C5 supplies it.
 - [x] P6 strengthens #869: the two dead enforcement hooks reproduce from zero on a clean broker-less container. C1 asserts the breach but neither wires nor unwires it.
 - [x] P1 false pass identified from the P4 evidence row: `git` is absent from the Debian base and was undeclared even though skill sync shells out to it. C1 adds `git` to P1; the fixture matrix preserves absent/present controls. The prior claim that web1's missing runtime skills reproduce this greenfield mechanism is withdrawn by the TL and is not carried here.
 - [x] Corrected RED transcript captured and reported, including the git-present/absent controls and strict P3 PASS.
 - [x] State-machine implementation complete: private pre-mutation journal/snapshot, P0–P8 `--check`, P2–P8 fault seam, rollback, durable manifest/journal seal, action-status persistence, safe rollback roots, and stale-projection recovery.
 - [x] Debian/glibc checkout fixture now packages the complete current checkout, verifies its digest in-container, and reaches the expected attributable RED without host inheritance. CI compares its exact final phase map/reasons to `tools/fixtures/greenfield-expected-red.tsv`; the fixture remains red while the detector job is green only on an exact match.
 - [ ] Reviews complete. Reviews 80 (`rev-security-02`) and 81 (`rev-974`) requested changes at `3934e03f`; their eight non-overlapping detector findings are being remediated red-first. Current remediation adds canonical-image portability, absolute P3 CLI propagation, exact expected-RED schema/cardinality, passwd-HOME binding, created-path owner/mode policy, real-action P2–P8 fault injection, verified non-empty remote installer execution, and seeded secret-canary/redacted diagnostics. Both old verdicts become void when the remediation head moves and require fresh independent review.
 - [x] Successor remediation for review 90 is RED-first and recorded in `docs/reports/verification/1050-successor-remediation/`: the manifest now binds the complete supported final P0 reason; P4 rejects an incomplete created-path walk instead of discarding `find` failure; and the TERM no-exit control is independent of filesystem enumeration order while retaining a proven RED mutation. Pipeline 2224's 32/2 result was a path-order-sensitive control, not evidence that the resume bug's premise became stale. The enumeration-class sweep additionally replaced order-dependent `find | head -1` source-root selection with a checked complete inventory requiring exactly one extracted root.
 - [x] C1 fix round for reviews 92/93: Blocker B was completed first. RED was reproduced before implementation: a planted `{"status":"in-progress"}` record makes the complete real walk fail the suite at P2, while the same planted defect beneath a target-owned mode-0100 directory makes real `find` fail and the frozen suite falsely exit 0 with `installer next lane tests passed`. One shared helper now captures and checks the complete NUL-delimited population before testing absence across the primary and copied harness sites; grep no-match is distinct from read failure. The same attack child drives the full suite RED with a named enumeration error, while ordinary native and root/container runs pass. Blocker A then regenerated the exact installer sidecar; provider-fetch validation remains the required post-push bar. Working estimate: 16K tokens; no external hard cap; 60% context is the stop/report gate.
 ## Risks / blockers
 - The deployed create wrappers do not expose `--dry-run`; identity preflight was performed through `pr-merge.sh --dry-run` on the same HOMELAB repo, which resolved `git.mosaicstack.dev` + `be-coder-05`. The issue create then fell back from tea to the API but provider read-back confirmed author `be-coder-05`.
 - `next` is a non-merging integration lane; PR #1054 targets `main`. The old “pending promotion to main” caution dissolved when the base moved. #1050 remains open after merge and closes only after Jarvis validates the greenfield behavior.
 - #869 must remain staged and inactive.
 - Late sequencing input MB-BRAIN-01 is accommodated without implementation or renumbering: P2 covers installer distribution only; P5 owns requested credential capability; P7 leaves an ordered seam for credential-dependent resource provisioning after P5.
 ## Remediation review controls
 - B1 RED: the next-lane harness failed immediately under `ci-base:latest` as root/musl; it now models uid 1001/glibc explicitly and uses Python tree fingerprints instead of GNU `find -printf`.
 - B2 RED: framework/runtime linking consumed bare `mosaic` from PATH after P3 had committed an absolute path. The unified installer now exports/passes `MOSAIC_CLI_PATH`; the linker invokes that absolute artifact, and wizard auto-launch has no stale-PATH fallback.
 - B3 RED: a one-row manifest (`exit=1`) certified any exit-1 log. Full-manifest validation now requires the exact three cases, one exit and P0–P9 row each, pinned require/forbid populations, and rejects malformed/duplicate/unknown rows; shrink is a negative control.
 - B4 RED: uid 1001 with a passwd HOME different from ambient HOME produced P0 PASS. P0 now binds uid, username, passwd HOME and shell and explicitly rejects root and sudo-with-inherited-HOME controls.
 - B5 RED: mode-0777 CLI, mode-0644 identity, and mode-0755 credential storage passed. P3/P4/P5 now apply target owner/group plus executable/shared/private policies; framework credential storage is created 0700.
 - B6 RED: fault injection only wrote `.selftest-*` files. The synthetic path was removed; the P2–P8 matrix enters the normal action flow, proves an action observation occurred, injects after each real phase, and fingerprints rollback.
 - B7 RED: an HTTP-200 empty body exits zero when piped to Bash. The fetched installer must now be non-empty, digest-equal to `tools/install.sh.sha256`, and that exact file is executed; failed/empty/mismatch controls are blocking and CI has a remote immutable-commit arm.
 - B8 RED: raw combined command output was duplicated to terminal and `commands.log`. Both capture layers now redact before output/persistence; a seeded canary is positively emitted by the fake credential-capable registry and must remain absent from terminal, command log, npmrc, generated files and observed argv. The real greenfield fixture also scans those populations.
 - Advisory code review findings are fixed: URL userinfo redaction now handles raw `@`, token-only and percent-encoded forms, repeated `:`, multiple URLs, Authorization/Basic, npm `_auth`, and Cookie headers in both capture layers; the real greenfield path positively emits its canary through `state_run_captured`; verified-fetch removes its temporary body after successful execution; and plaintext diagnostics exist only in process-substitution pipes rather than interruptible temporary files.
 - Advisory security review's independent trust-root finding is **DEFERRED by canonical PRD v2 §3**, which explicitly excludes signed provenance. README now states precisely that the same-origin sidecar detects empty/corrupt/inconsistent publication but cannot authenticate against repository/server compromise; no stronger claim remains.
 - The web1 no-manifest representativeness observation is recorded but intentionally not acted on: it is explicitly outside these eight blockers. This remediation does not weaken or otherwise change P9's manifest-presence assertion.
 ## Verification log
 - `bash -n` and ShellCheck pass for all changed shell surfaces; `git diff --check` passes.
 - `bash tools/install-state-machine.test.sh` passes, including exact P0–P8 rows, passwd-HOME/privilege discrimination, owner/group/mode attacks, persisted P4/P6 action failures, no synthetic fault implementation, unsafe/overlapping/symlink roots, and fatal journal initialization.
 - `bash tools/install-next-lane.test.sh` passes inside `ci-base:latest`, including exact `@next` versions, immutable source fallback, source-build/archive-failure rollback, offline `--dev`, explicit refs, prerelease suffix mismatch, absolute P3 CLI propagation, secret redaction, real-action P2–P8 rollback, and stale projection recovery.
 - Comparator controls pass for verdict drift, unexpected exit, manifest shrink, missing phases, duplicate rows, unknown cases, and unknown kinds. Verified-fetch controls pass for successful execution and failed/empty/digest-mismatch rejection.
 - `bash tools/e2e-install-test.sh --lane next --source checkout --git present` returns the required expected RED in clean Debian/glibc as uid 1001: installer P0/P1/P2/P3/P7 PASS; P4/P5/P6/P8 and P9 blocking; no `Done.` claim; checkout archive digest pinned and current framework installer exercised. `tools/verify-greenfield-expected-red.sh` converts that expected detector result into a green CI assertion and fails on any unreviewed verdict drift.
 - Earlier repository gates passed: `pnpm typecheck`, `pnpm lint`, `pnpm format:check`, upgrade manifest/rollback/durable-snapshot/migration suites, and focused `@mosaicstack/mosaic` tests with an isolated npm prefix. Full exact-remediation rerun is required before push.
 - Review-93 RED evidence at frozen `378bc1a`: isolated positive-control full-suite exit `1` with `P2 left an in-progress transaction`; isolated permission-failure attack full-suite exit `0` with final `installer next lane tests passed`. No binary shadowing or PATH interception was used; the failure came from a real target-owned mode-0100 directory.
 - Fix-round GREEN: `pnpm test:installer`, native next-lane, root/`ci-base:latest` next-lane, state-machine, verified-fetch, Bash syntax, ShellCheck, `pnpm typecheck`, `pnpm lint`, `pnpm format:check`, and `git diff --check` pass. The direct attack child exits 1 and names `P2 fault-state enumeration failed`. All 81 Mosaic Vitest files / 1508 tests pass under an isolated npm prefix; the wider framework-shell chain reaches the pre-existing #973 Bash-line-number gate and exits 97, matching the known host-specific condition rather than this delta. Codex code review approved at 0.93 confidence with zero findings; Codex security review reported no risk at 0.96 confidence with zero findings.
 - Sidecar RED-first documentation control from the repository root: `sha256sum -c tools/install.sh.sha256` exits 1 with `install.sh: FAILED open or read` because the sidecar path is relative to `tools/`. Sidecar GREEN with the command actually executed: `(cd tools && sha256sum -c install.sh.sha256)` exits 0 with `install.sh: OK`; the workflow's separate expected/actual comparison resolves `e59cb441a2f37ae9150f8eae470238e9d858a1816df93343d9784a6796676096`. This is not substituted for the required immutable provider-fetch arm at the pushed head.
 ## Round 3 — remote-arm downstream source binding
 ### Objective and constraints
 - Tracking remains `mosaicstack/stack#1050`, delivery PR #1054, branch `feat/1050-install-state-machine-red-fixture`; `docs/TASKS.md` remains orchestrator-single-writer.
 - Bind the remote arm's downstream stack framework/source archive to the same immutable `${CI_COMMIT_SHA}` as the digest-verified `install.sh`, while retaining `--next` and its exact resolved CLI/gateway lane-version assertion.
 - RED first: the realised source commit/digest assertion must reject the existing stale `origin/next` substitution; GREEN must restore the exact expected `P6 FAIL` and pass the comparator. R7 then deletes the binding and requires RED again.
 - Fenced out: the expected-RED manifest (including `P6=FAIL`), #869 activation, and #1068 digest-before-comparator sequencing.
 - Push budget: one force-with-lease push pinned to provider head `ff3f0d29f1763bed44a60610d073036112e66b77`; run the queue guard first; do not poll CI after push.
 - Working estimate: 14K reasoning/output tokens; no external hard token cap. Scope reduction order: reuse the existing local-source archive seam, add one realised-state assertion, avoid installer behavior changes.
 ### Corrected reference citation
 The transferable reference is only **the container-image acquisition path in `fa-install.sh`**: resolve mutable input once to `Docker-Content-Digest`, fail closed if unresolved, render `@sha256`, then verify running images against the resolved digest. It is not a claim about USC's installer as a whole; the sibling root bundle extraction in `Install-FieldAgentOnPanel.ps1:82` is unpinned. The applicable structure is `RESOLVE-ONCE -> PIN -> FAIL-CLOSED ON RESOLUTION -> VERIFY-AFTER`, applied per acquisition path.
 ### Remote-arm acquisition-path census before the fix
 Code-path enumeration only; execution of the complete list is **NOT MEASURED** in this round yet. Logical payload paths are counted once even when one command is invoked repeatedly or installs a dependency graph.
 | # | Acquisition path taken by the arm | Pre-fix binding state | Scope disposition |
 |---|---|---|---|
 | 1 | Woodpecker checkout containing the workflow, fixture, sidecar, and comparator | CI commit checkout (commit-bound by runner contract) | existing arm substrate |
 | 2 | `node:22-bookworm-slim` step image | mutable image tag | unpinned sibling; outside this fix fence |
 | 3 | Debian package set acquired by `apt-get update/install` | repository-current, no package versions/snapshot | unpinned sibling; outside this fix fence |
 | 4 | remote `tools/install.sh` | exact `${CI_COMMIT_SHA}` URL plus checked SHA-256 | in scope; already bound first hop |
 | 5 | `@mosaicstack/mosaic@next` CLI package graph | mutable lane resolved to an exact top-level version, exact version installed, realised top-level version verified | lane assertion; must remain |
 | 6 | `@mosaicstack/gateway@next` package graph | later re-resolution wins and is verified against itself; drift from the first value can be silently accepted | partially constrained TOCTOU sibling; outside this fix |
 | 7 | `mosaicstack/stack` framework/source archive consumed by `ensure_monorepo` | `next` resolves once to `4df478cdd150fdf8d52ea109f02ade5d85017acd`, not the arm's CI commit | **in-scope defect; bind to CI commit** |
 | 8 | sequential-thinking MCP package warmed via unversioned `npx -y @modelcontextprotocol/server-sequential-thinking` | mutable package resolution | unpinned sibling; outside this fix fence |
 | 9 | Excalidraw npm dependency graph | shipped `package-lock.json` exact versions + registry integrity hashes; `npm install` consumes the lock | already lock/integrity-bound, separate from CI-source identity |
 | 10 | canonical skills repo cloned by `mosaic-sync-skills` | mutable default branch of `mosaic/agent-skills.git` | unpinned sibling; outside this fix fence |
 Pre-fix mechanism breakdown (do not blend unlike strengths): **2 / 10 intended-CI-commit-bound** (#1 checkout, #4 installer); **1 / 10 resolve-then-pin with comparison to the authoritative value** (#5 CLI); **1 / 10 partially constrained because verify-after compares #6 gateway to its later re-resolution rather than an authoritative pin**; **1 / 10 lockfile+integrity-bound** (#9 Excalidraw); **1 / 10 internally pinned to an immutable commit+digest but bound to the wrong arm identity** (#7 framework at `4df478cd`); **4 / 10 unpinned siblings** (#2, #3, #8, #10). The in-scope same-CI stack payload ratio is **1 / 2** (`install.sh` yes; framework/source no).
 Resolution-failure behavior is separately stated rather than hidden in the counts. For #5/#6, a metadata-resolution failure during P1 blocks before mutation. Later package metadata/install failure enters the documented source fallback, but that fallback consumes the immutable stack archive already resolved in P2; failure to resolve or fetch that source is fatal. For #5, the P2 CLI value is authoritative and a later realised mismatch blocks P3 and rolls back. For #6, no authoritative P2 gateway value persists; a later same-suffix gateway drift can be silently accepted because the later value is compared with itself. Changing that TOCTOU path is outside this fix. The new #7 path accepts the 40-hex CI commit directly, fetches only its exact commit URL, rejects failed/empty acquisition, computes and passes the exact body's digest through the existing local-source seam, and rejects any realised manifest commit/digest mismatch without falling back to `next`.
 Denominator corrections were sent to and accepted by the lane lead before implementation. Four expressly unpinned siblings make `7/10` impossible. Post-fix, the primary mechanism breakdown is **fully constrained 5 / 10** (#1, #4, #5, #7, #9), **partially constrained 1 / 10** (#6), and **unpinned 4 / 10** (#2, #3, #8, #10). The meaningful repaired ratio is **2 / 2 same-CI stack payload hops**. The fix does not increase coverage; it moves #7 from wrong identity to intended identity. Every census revision moved assurance downward under additional questioning, never upward, so the census is a lower bound on defects and an upper bound on assurance.
 ### Implementation plan
 1. Add the realised source commit+archive-digest assertion and pass the expected immutable identity through the remote fixture; run the current stale-`next` mechanism and capture RED before changing acquisition.
 2. Fetch the stack archive from the exact commit URL once, fail closed on failed/empty acquisition, compute its digest, pass that exact body through the installer's existing local-source archive seam, and verify the manifest's realised `sourceCommit` and `sourceSha256` against those values.
 3. Run exact-source GREEN: require `P6 FAIL` values and a passing `next-git-present` comparator; run focused installer/baseline gates.
 4. R7: delete the binding in a temporary mutant, run the same assertion to RED, then restore and re-run GREEN.
 5. Independent code/security review, commit with command-scoped identity, queue guard, one force-with-lease push pinned to `ff3f0d29`; stop without CI polling and report `believed-fixed, pending jarvis validation`.
 ### Executed outcome
 - RED-first stale substitution: fixture `rc=1`; realised source `4df478cdd150fdf8d52ea109f02ade5d85017acd` / `3e6d831efe13c3b2c0501507099d4a566af5abf877dacf85e5d7e4284d35e5c7` rejected against expected `ff3f0d29f1763bed44a60610d073036112e66b77` / `944c6db1b01b23c83169e6dc83e0d31262b1d24a2825270441745eb65c269c25`; comparator `rc=1`, 8/19 mismatches.
 - Exact-source reproducibility, N=5 identical final-tree executions: every run had fixture `rc=1`, `@mosaicstack/mosaic@next=0.0.50-next.2207`, P3 PASS, realised source `ff3f0d29…` / `944c6db1…`, SOURCE-CONTROL PASS, `installer_exit=1`, `done_claims=0`, P6 FAIL, and P9 FAIL. Comparator `rc=0` occurred 4/5 (19/19 checks; action-failure reason); comparator `rc=1` occurred 1/5 (18/19; dead hooks active count `2`). The rate is the finding; no comparator verdict is claimed.
 - Timings/load: runs 1–2 NOT MEASURED; run 3 rc1 elapsed 912s, load 7.79/7.51/8.93 -> 12.28/14.82/11.79; run 4 rc0 elapsed 938s, load 12.28/14.82/11.79 -> 9.84/15.18/13.83; run 5 rc0 elapsed 954s, load 9.84/15.18/13.83 -> 3.94/4.76/8.18. Load does not explain this sample monotonically.
 - The `P6=FAIL` row remains untouched; P6 failed 5/5 while its reason signal varied. No comparator widening was performed. Checkout-source control independently exhibited the rc1/dead-hooks outcome, but its reproducibility was not separately measured.
 - #869 out-of-scope finding: current `defaultSupervisorProbe` checks bundled supervisor artifact presence and a resolvable socket path, not socket existence. The 2000ms capability-probe timeout is a code-read hypothesis for variance, NOT MEASURED as causal.
 - Final-tree R7 deleted the three local-source binding exports temporarily. The realised source reverted to `4df478cd…` / `3e6d831…`, SOURCE-CONTROL failed against `ff3f0d29…` / `944c6db…`, and comparator `rc=1` with 8/19 mismatches. The subject file SHA-256 was `a93113565aa69f2c6f3d792b78251021bb3bbe3f7813d5fed547ab0099fa3b98` before mutation and after restoration.
 - Trust boundary: the exact-commit URL trusts the configured repository provider's authenticated commit-to-archive mapping. The computed digest pins transfer/consumption but does not authenticate against repository/TLS compromise; signed provenance remains the canonical PRD v2 §3 deferral. Initial Codex security review retained this as HIGH/CWE-494; no stronger claim or out-of-scope signing change was made.
 - Final baselines: Bash syntax, ShellCheck, `pnpm test:installer`, `pnpm typecheck` (45/45), `pnpm lint` (25/25), `pnpm format:check`, and `git diff --check` pass. Codex code review APPROVE confidence 0.92 with zero findings; after explicit trust-boundary documentation, security re-review risk NONE confidence 0.96 with zero findings. The initial HIGH trust-root finding remains recorded as the signed-provenance deferral.
 - Full evidence and named paths: `docs/reports/verification/1050-c1-fix-round/09-round3-source-binding.txt`.
 ## Round 4 — pipeline case-coverage denominator
 - Pipeline 2242 at `0e2eef1c` superseded the lane lead's earlier pipeline-2229 ruling: requirements 1–3 were already satisfied. The temporary local P6-consumer edit started while that ruling was in flight was restored; `tools/e2e-install-test.sh`, the expected-RED manifest, the per-case verifier, and #869 remain unchanged in the final tree.
 - Requirement 5 adds a pipeline-level instrument above the three per-case invocations. Expected names are derived from the manifest, markers are scoped by pipeline+workflow run, and each marker is written only after that exact per-case verifier succeeds. Every producer depends on initialization; the final step depends on the complete case/contract matrix, runs after success or failure, and requires exact expected/actual set equality rather than count equality.
 - Measured firing controls: skipped arm `3/2` rc1; count inflation `3/3` rc1 with one missing and one unexpected name; stale re-initialized run `3/0` rc1; exact set `3/3` rc0; future manifest case `4/3` rc1. Codex review found and blocked two independent defects: first the missing `depends_on` graph, then comment lines being parsed as case names. Both were accepted; dependency edges are regression-asserted, blank/comments are excluded, and the focused test now consumes the production manifest directly. Final Codex code re-review APPROVE confidence 0.94 and security re-review risk NONE confidence 0.96, both with zero findings. Woodpecker strict lint, Bash syntax, ShellCheck, focused/full installer tests, typecheck, lint, Prettier, and diff check pass.
 - Full evidence: `docs/reports/verification/1050-c1-fix-round/10-round4-case-coverage.txt`.
 ## Round 5 — arm coverage and checkout purity
 - Reviews 110/111 identified two blockers at `f33bd0da`: the three-case set could not represent the fourth `greenfield-remote-installer-contract` arm, and the root `.greenfield-case-state` directory was included in checkout fixture archives. The expected-RED manifest, per-case verifier, detector, and #869 remain fenced.
 - RED controls: with all three cases complete and no remote-arm identity, the old gate returned rc0 at `cases_defined=3 cases_executed=3`; the exact fixture tar selector archived `.greenfield-case-state/remote-arm.ran` once.
 - The checker is generalized across exact `cases` and `arms` dimensions. A new explicit four-arm declaration includes the remote contract; all four arms mark only after successful per-case verification. With the remote omitted, cases remain 3/3 rc0 while arms report 4/3 rc1 and name `greenfield-remote-installer-contract` as missing.
 - State moved beneath `.mosaic-test-work/greenfield-execution-coverage`, which the existing checkout selector excludes. The regression control proves a non-excluded root marker is archived while no `.mosaic-test-work` path is archived.
 - Final review: Codex code APPROVE confidence 0.93 and security risk NONE confidence 0.96, both with zero findings. Full installer tests, typecheck 45/45, lint 25/25, format, Bash syntax, ShellCheck, Woodpecker strict lint, and diff check pass with 11G free before/after.
 - Full evidence: `docs/reports/verification/1050-c1-fix-round/11-round5-arm-coverage-and-purity.txt`.
 ## Round 6 — executable aggregation and production archive binding
 - Reviews 114/115 independently reproduced the same caller-level mutant at `df705828`: ignoring `arms_status` in the workflow still left the helper-bounded focused suite green. The production OR was correct and was not rewritten; its aggregation moved byte-for-byte into `verify-greenfield-execution-coverage-gate.sh`, which the workflow invokes directly.
 - The focused suite now exercises that exact helper across the complete truth table: cases PASS/arms FAIL RED; cases FAIL/arms PASS RED; both FAIL emits both outputs and is RED; both PASS GREEN. Local ignore-arms, ignore-cases, and always-RED mutants each make the suite RED.
 - Review `rev-974` separately proved that deleting only the production `e2e-install-test.sh` `.mosaic-test-work` tar exclusion left the copied-selector control green. The control now structurally binds its semantic archive test to the production checkout-archive command; the delete-production-binding mutant is RED. The fenced production installer remains byte-unchanged.
 - Final review: Codex code APPROVE confidence 0.94 and security risk NONE confidence 0.97, both with zero findings. Full installer tests, typecheck 45/45, lint 25/25, format, Bash syntax, ShellCheck, Woodpecker strict lint, focused truth-table and four mutant controls, and diff check pass with 11G free before validation.
 - Full evidence: `docs/reports/verification/1050-c1-fix-round/12-round6-caller-coupling-and-archive-binding.txt`.
 ## Round 7 — canonical Alpine/BusyBox portability
 - Review 119 found the exact-head focused suite RED in the canonical Alpine `ci-base`: GNU `find -printf` is unsupported by BusyBox 1.37. The same script remained green in the Debian greenfield workflow, so greenfield success alone did not prove canonical runtime compatibility.
 - Local canonical-image RED was reproduced at rc1 before remediation. Marker inventory now uses Bash nullglob/dotglob and parameter expansion, checks state-directory readability, preserves the prior regular-file/non-symlink boundary, and retains sorted exact-set comparison without GNU-only flags.
 - The focused suite is green both locally and inside `git.mosaicstack.dev/mosaicstack/stack/ci-base:latest`. Canonical pipeline evidence remains pending the replacement frozen-head push; no stale pipeline is inherited.
 - Final review: Codex code APPROVE confidence 0.96 and security risk NONE confidence 0.97, both with zero findings. Full installer tests, typecheck 45/45, lint 25/25, format, Bash syntax, ShellCheck, Woodpecker strict lint, dual-runtime focused tests, retained Round-6 mutants, and diff check pass with 11G free.
 - Full evidence: `docs/reports/verification/1050-c1-fix-round/13-round7-busybox-portability.txt`.
 ## Round 8 — pipefail-safe expected-set membership
 - Review 122 found `expected_names | grep -Fxq` could falsely reject a valid early-sorted marker: `grep -q` closes after its match, the upstream sorter can exit 141, and `pipefail` selects that producer failure. Independent canonical-Alpine stress measured failures at the live four-arm manifest size, so no safe small-set threshold is claimed.
 - A deterministic 20,001-entry real-script mark control makes the unfixed canonical-Alpine path RED with `case is not in the expected set: a-target`. The mark path now materializes and validates the complete expected-name snapshot before applying `grep -q` via a here-string, eliminating the producer/consumer pipe while retaining fail-closed producer errors.
 - The focused suite is green locally and in canonical Alpine after remediation. A separate 1,000-mark canonical-Alpine stress against the live four-arm production manifest recorded zero false failures.
 - Final review: Codex code APPROVE confidence 0.96 and security risk NONE confidence 0.98, both with zero findings. Full installer tests, typecheck 45/45, lint 25/25, format, Bash syntax, ShellCheck, Woodpecker strict lint, canonical deterministic/stress controls, retained Round-6 mutants, and diff check pass with 11G free.
 - Full evidence: `docs/reports/verification/1050-c1-fix-round/14-round8-pipefail-membership.txt`.
@@ -1,97 +0,0 @@
 # #1098 — Framework shell portability / red main
 ## Objective
 Restore terminal-green `main` by making the `test-start-agent-session.sh` clean-environment assertion semantic and portable without removing either newly enumerated framework-shell suite.
 ## Scope
 - Tracking issue: `mosaicstack/stack#1098`
 - Branch: `fix/framework-shell-portability`
 - Base: `origin/main` at `4fa2768962702d53e16e8b67ee6ad52ebcb0910e`
 - Primary file: `packages/mosaic/framework/tools/fleet/test-start-agent-session.sh`
 - Requirements source: `docs/PRD.md` § Framework shell assertion portability (#1098)
 - Out of scope: deployed files under `~/.config/mosaic`, pnpm-store cleanup, checkout deletion, and changes to the launcher’s `/usr/bin/env -i` behavior.
 ## Acceptance criteria
 1. The test inspects the captured NUL-delimited tmux argv semantically and accepts an adjacent `/usr/bin/env`, `-i` pair regardless of trailing payload size or pipe scheduling.
 2. Missing `/usr/bin/env`, missing `-i`, and non-adjacent `-i` remain failures.
 3. Failure output includes the observed argv records with stable indexes and shell escaping; it exposes no credentials because this fixture supplies only generated non-secret launch data.
 4. The focused suite passes on the dev host and in the repository CI image; the blocking PR/main pipeline returns terminal green.
 5. Independent review passes; PR is squash-merged and #1098 is closed only after merged-main CI is terminal green.
 ## Budget
 - ASSUMPTION: 30K-token working budget; rationale: one shell-test defect plus full PR/CI lifecycle.
 - Auto-reduction: focused shell and package gates first; rely on canonical Woodpecker for the full monorepo suite rather than duplicating a dependency install under constrained `/home`.
 - Disk baseline before clone/build: `/home` 7.1G free (99% used), `/tmp` 2.4G free (92% used).
 ## Investigation
 ### First-hand CI evidence
 - Public log: `GET https://ci.mosaicstack.dev/api/repos/47/logs/2269/53041`
 - Decoded 1,436 entries (11 null `data` entries treated as empty log rows), 190,756 bytes.
 - Failure: `FAIL: pane command did not clear its environment` immediately after the expected pane-PID warning.
 - BusyBox primitives, complete assertion pipeline, real CI image, stale/current image digests, Turbo cache masking, gateway failure, and heartbeat-sidecar concurrent writing were independently excluded.
 ### Root cause
 The assertion ends in:
 ```bash
 printf '%s\n' "$pane_args" | tail -n +"$after_pane_env" | grep -qxF -- '-i'
 ```
 The script has `set -o pipefail`. `grep -q` exits as soon as it finds the valid `-i` record. Upstream `tail`/`printf` can then receive SIGPIPE, making the aggregate pipeline nonzero even though grep returned 0 and the semantic property is true. This depends on payload size, pipe capacity, and scheduling, explaining a local/image pass with a CI failure.
 Discriminating stress control with `/usr/bin/env` followed immediately by `-i`:
 - 8,192-byte trailing payload: `printf=0 tail=0 grep=0`, aggregate 0.
 - 16,384-byte trailing payload: `printf=0 tail=141 grep=0`, aggregate 141.
 - 32,768+ bytes: `printf=141 tail=141 grep=0`, aggregate 141.
 - A full-reading `grep -xF` control remained 0 for every payload.
 This is a third branch omitted by the earlier present-vs-corrupted split: the pair can be present and intact while `pipefail` reports an upstream SIGPIPE.
 ## TDD plan
 1. RED: preserve the one-off stress reproducer above and add an automated large-argv semantic regression that fails under the current pipeline implementation.
 2. GREEN: parse the authoritative NUL-delimited capture into a Bash array and search for an adjacent `/usr/bin/env`, `-i` pair without a short-circuit pipeline.
 3. Add negative controls for missing, detached, and reversed tokens.
 4. On failure, print indexed `%q` argv records before returning nonzero.
 5. Run focused suite, mutation controls, shell syntax/format checks, then repository baseline gates feasible without dependency installation.
 6. Independent review, queue guard, push, PR, CI, coordinator merge authorization, squash merge, merged-main CI, issue close.
 ## Progress
 - [x] Checkout created and based on `origin/main` `4fa27689`.
 - [x] CI log decoded directly.
 - [x] Root-cause stress control reproduced semantic match + aggregate pipeline failure.
 - [x] RED evidence: intact `/usr/bin/env`, `-i` fixture produced component statuses `0/141/0` and aggregate 141 under the former `grep -q` pipeline; full-reading semantic control stayed 0.
 - [x] GREEN implementation: direct NUL-argv adjacency parser, indexed diagnostics, and full-reading scalar predicates replace all load-bearing early-exit pipelines in this test.
 - [x] Baseline/situational tests:
  - focused launcher suite: PASS on GNU host and cached Alpine CI image;
  - paired `test-fleet-units.sh`: PASS;
  - enumeration guard: PASS (`population=53`, `enumerated=36`, `excluded=18`), 14/14 mutation needles;
  - `bash -n`, ShellCheck, `git diff --check`: PASS;
  - static denominator after change: zero load-bearing `grep -q`/`head`/`-m1` pipeline candidates in `test-start-agent-session.sh`;
  - delete-the-subject mutation removing production `-i`: RED with 78 indexed argv records, byte count, and explicit boundary failure.
 - [x] Independent review:
  - first Codex review: request changes — negative fixtures did not each assert diagnostics;
  - remediation: centralized predicate + diagnostic wrapper and exercised all four negative fixtures;
  - second Codex review: APPROVE, 0 blockers/should-fix/suggestions;
  - Codex security review: risk none, 0 findings.
 - [ ] PR CI, formal fleet review, merge, merged-main CI, issue closure.
 ## Documentation disposition
 - Updated canonical `docs/PRD.md` with FSP requirements and acceptance criteria.
 - This is an internal test/reliability change with no API, user workflow, deployment, navigation, or publishing-surface change; no user/admin/API/sitemap update is required.
 - `docs/TASKS.md` remains unchanged because the project contract makes it orchestrator-only.
 ## Risks
 - The CI failure did not print its captured argv, so the exact CI payload is unavailable. The stress control proves the assertion is non-portable and can emit the exact false verdict; branch CI is the canonical confirmation that replacing it resolves pipeline 2269’s failure class.
 - Printing fixture argv is safe only while this test’s projection remains non-secret. The diagnostic must stay scoped to the test capture and shell-escaped.
@@ -1,37 +0,0 @@
 # #1099 — pipefail + early-exit sweep
 ## Scope and decisions
 - Baseline `df4c591ab42aa1ae62c12935fdc0e772684864a0`, after #1100 removed its 35 sites.
 - Split into review-sized non-closing tranches: runtime/general; tmux/git/quality tests; wake validation/tests.
 - Do not equate class membership with demonstrated risk. Do not use payload size or pipeline stage count as a safety proxy.
 - Preserve the issue's withdrawn findings for `qa-hook-stdin.sh` and the two fresh-directory `pnpm pack` lookups. Fix `install.sh:312` because malformed multi-root input must reach its named handler.
 ## Tranche 1 TDD
 RED-first control: `node --test scripts/pipefail-early-exit.test.mjs` reported exactly 26 non-accepted runtime/general sites, including `install.sh:312`, and exited 1. A checked-in fixture generated from immutable baseline `df4c591a` records all 26 normalized sites; the control passes every fixture entry through the same scanner, asserts exact identity/count/uniqueness, and separately requires zero findings in the current tree. It also inventories accepted sites rather than silently excluding whole files.
 Construction choices:
 - here-string/file redirection for scalar grep assertions;
 - full capture then parameter expansion for first-line selection;
 - arrays/`mapfile` for complete populations;
 - direct jq/awk/grep selection where one tool can express the property;
 - no `|| true` added to a load-bearing assertion.
 Site-by-site verdicts: `docs/reports/quality/1099-pipefail-sweep.md`.
 ## Tranche 2 TDD
 Expanded the unconditional scanner over 11 non-wake test harnesses. RED named exactly 22 source lines; a second immutable-baseline fixture now asserts those 22 entries through the same scanner. Rewrites preserve command status by capturing producers before redirected assertions, use parameter expansion for line selection, and use complete `mapfile` populations where ordering matters. Current-tree finding count is zero for tranches 1 and 2.
 ## Verification so far
 - `bash -n` on every changed shell script: pass.
 - structural Node control: pass.
 - `test-mutate-push-guard.sh`: 8/8 pass.
 - `test-send-message-verdict.sh`: 3/3 pass.
 - `test-send-message-socket.sh`: pass.
 - Independent review 143 found two semantic regressions: a help-probe `|| true` changed the failure truth table, and an unguarded Git capture changed non-Git data-dir behavior from rc 0 + JSON to silent rc 128. Both received RED-first regressions before correction; help status is now separate and required, and Git status remains condition-guarded.
 - Wake detector/reconcile/digest/preimage suites terminate at their existing fail-closed #973 `BASH_LINENO` environment probe (exit 97, observed `[3 5]`, expected `[3 4]`) before subject tests. No bypass or skip was used; canonical CI remains required.
 - ShellCheck reports only pre-existing source-following, unused-variable, and untouched `ls | head` findings; no new diagnostic was introduced.
@@ -1,156 +0,0 @@
 # #1150 — Pi persistent goal extension
 - **Task ID:** ISSUE-1150 (no `docs/TASKS.md` row; that file is orchestrator-only)
 - **Issue:** #1150 — `pi: add persistent /goal controller extension to Mosaic framework`
 - **Branch:** `feat/1150-pi-goal-extension`
 - **Mode:** Delivery
 - **Status:** in progress
 ## Objective
 Build and locally validate a Mosaic-owned Pi `/goal` extension. Source must ship from
 `packages/mosaic/framework/runtime/pi/`, framework sync must deploy it under
 `~/.config/mosaic/runtime/pi/`, and no extension/configuration asset may be written into `~/.pi`.
 Pi's native session manager remains the owner of session entries.
 ## Scope and acceptance source
 - Canonical requirements: `docs/PRD.md`, section **Pi Persistent Goal Loop (#1150)**.
 - User intent: continuous goal orientation and status checking after each Pi turn and compaction,
  tested locally before framework delivery.
 - Documentation target: canonical in-repo user/developer/runtime docs; no external publication.
 ## Assumptions
 - `ASSUMPTION:` Initial semantic verification uses two consecutive structured, evidence-bearing
  reports from the working agent rather than a second model request after every turn. This keeps the
  loop testable and avoids doubling model cost while making the limitation explicit.
 - `ASSUMPTION:` Default autonomous bounds are 40 turns and 6 repeated no-progress reports, with only
  bounded numeric environment overrides.
 - `ASSUMPTION:` A local smoke copy to `~/.config/mosaic/runtime/pi/goal-extension.ts` is authorized by
  the user's explicit request. Full framework reseed into the live home is not required for the smoke
  test and would touch unrelated framework-owned files.
 ## Budget
 - Working estimate: 30K implementation/review tokens.
 - Hard user cap: none stated.
 - Cost control: deterministic fake-Pi tests; no nested evaluator calls; only bounded arithmetic/load
  smoke workflows against the installed runtime.
 ## Plan
 1. Update PRD and create tracking/scratchpad artifacts.
 2. Read launcher, installer ownership, Pi extension, and documentation surfaces.
 3. TDD: add fake-Pi behavior tests for commands, state restoration, turn checks, compaction, limits,
   verification, and continuation deduplication.
 4. Implement `runtime/pi/goal-extension.ts` and deterministic launcher discovery.
 5. Add framework-sync/deployment acceptance coverage.
 6. Update user, developer, runtime, framework README, and sitemap documentation.
 7. Run focused tests, local Mosaic-path smoke test, then baseline repository gates.
 8. Run independent review, remediate, commit, push/PR/CI/merge/issue closure per delivery gates.
 ## TDD decision
 Applied. The continuation state machine and lifecycle scheduling are control-path logic where a race
 or false terminal state can cause unbounded work or premature completion.
 ## Progress checkpoints
 - [x] Issue #1150 created through Mosaic wrapper.
 - [x] Isolated worktree created from `origin/main`.
 - [x] PRD requirements and acceptance criteria added.
 - [x] Task scratchpad created.
 - [x] RED controller and security-regression tests written and observed failing before implementation.
 - [x] Goal controller, launcher discovery, framework deployment coverage, and bounded state machine
      implemented.
 - [x] User, admin, developer, runtime, adapter, README, and sitemap documentation updated.
 - [x] Final source copied additively to `~/.config/mosaic/runtime/pi/goal-extension.ts`; source and
      deployed SHA-256 are identical.
 - [x] Live Pi RPC smoke from the exact Mosaic path reached `achieved` with two verification passes and
      no extension errors.
 - [x] Baseline and situational checks completed, except the explicitly documented unavailable
      PostgreSQL-only root integration case.
 - [x] Independent code and OWASP/security reviews completed; all findings remediated and re-reviewed.
 - [ ] Commit, push, PR, terminal-green CI, squash merge, and issue closure complete.
 ## Tests and evidence
 ### Situational
 - `pnpm --filter @mosaicstack/mosaic exec vitest run src/runtime/pi-goal-extension.spec.ts`
  - final: 25 passed.
  - Covers commands, per-turn checks, context injection, two-pass verification, mixed-report
    rejection, bounded limits, compaction, branch restore, stale timers, credential redaction,
    typed-field false-positive protection, and append-only legacy-state fail-closed behavior.
 - Final focused launcher/controller/file-adapter run: 3 files / 67 tests passed.
 - Final V8 coverage for `framework/runtime/pi/goal-extension.ts`:
  - 99.17% statements/lines, 93.78% branches, 100% functions.
 - Installer migration fixture: 24 passed and byte-compared the deployed framework asset.
 - Standalone extension TypeScript check against installed Pi 0.84.1 types passed:
  `pnpm --filter @mosaicstack/mosaic exec tsc --noEmit --pretty false --module NodeNext
  --moduleResolution NodeNext --target ES2022 --skipLibCheck framework/runtime/pi/goal-extension.ts`.
 - Live deployment/load evidence:
  - source/deployed SHA-256:
    `1f0a3806e0948ad5f49684273a7e535e9880c148f7fd16d13ee487fcd601f637`.
  - `get_commands` identified `/goal` as an extension command sourced from
    `~/.config/mosaic/runtime/pi/goal-extension.ts`; `/goal help` succeeded; zero extension errors.
  - live arithmetic goal ended `achieved`, verification `2/2`, with 3 goal reports / 3 agent starts
    and zero extension errors.
  - no goal extension exists under `~/.pi` extension paths.
 ### Baseline
 - `pnpm build`: passed before the final framework-only redaction remediation; the extension is not a
  package build input and its final source passed the standalone Pi type check.
 - `pnpm typecheck`: 45/45 tasks passed.
 - `pnpm lint`: 25/25 tasks passed.
 - `pnpm format:check`: passed.
 - Final Mosaic package components:
  - Vitest: 82 files / 1,539 tests passed.
  - full `test:framework-shell` harness passed.
  - the discovered pre-existing tmux loader-marker race was reproduced with constructor PID
    evidence, fixed with a pane readiness/FIFO barrier, passed 3 consecutive focused runs, and passed
    in the full shell harness.
  - one combined rerun encountered the separate existing real-lease probe TOCTOU in
    `install-ordering-guard.spec.ts`; an earlier final Vitest run was fully green and the changed
    focused suites remained green.
 - Gateway safe baseline excluding the prohibited PostgreSQL-only fixture: 55 files / 600 tests passed
  (6 files / 12 tests skipped by their existing environment gates).
 - Root `pnpm test` reached 43 successful workspace tasks and all changed-package Vitest tests, but
  the unchanged `apps/gateway/src/__tests__/cross-user-isolation.test.ts` afterAll hook retried a
  PostgreSQL connection and failed authentication (`28P01`). This checkout explicitly forbids local
  PostgreSQL startup/access; the failure is unrelated to #1150 and cannot be remediated by starting
  the database. The gateway suite excluding that PostgreSQL-only file and required CI are used as
  the safe verification paths.
 ### Independent review
 - Codex code review: approved, 0 findings across 15 files.
 - Initial Codex security review: one medium CWE-532/A09 finding for raw report persistence.
 - Remediation added central credential-pattern redaction, prompt/docs guidance, canary tests, typed
  field false-positive guards, and sticky fail-closed restore for credential-bearing append-only
  history.
 - Codex security re-review: risk `none`, 0 findings, confidence 0.87.
 - Focused remediation review findings were fixed; final focused re-review verdict: `APPROVE`.
 - Focused independent review of the tmux readiness barrier: `APPROVE`, no actionable findings.
 ## Risks and blockers
 - Live `~/.config/mosaic` is shared by active Pi/fleet processes. Local deployment remained a single
  additive framework file and did not reload or restart unrelated sessions.
 - Completion verification is semantic, not mathematical: the active agent supplies structured
  evidence twice. Operators must still inspect consequential outcomes.
 - Credential redaction is pattern-based defense-in-depth, not a secret store. It covers
  controller-owned state/status/tool details, not Pi's separate model-message/tool-call history.
  Goals and reports must never contain real secrets or raw sensitive output. Because Pi session
  entries are append-only, a detected credential-bearing legacy branch fails closed and the affected
  session must be removed.
 - Current installed Pi is newer than the repository's historical gateway Pi dependency. The
  extension was checked and smoke-tested against installed Pi 0.84.1 using stable documented APIs.
 - Local root testing cannot safely execute the unchanged PostgreSQL-only integration fixture under
  the checkout's explicit database safety constraints. Terminal-green PR CI remains mandatory before
  merge.
 - The unchanged real-lease default-probe test can observe different broker availability across its two
  sequential probes; one combined package rerun hit that existing TOCTOU. The same final Vitest suite
  passed in a separate run, and CI remains the merge authority.
@@ -1,99 +0,0 @@
 # PR merge squash message field
 - **Charter:** `/home/hermes/agent-work/CHARTER-PRMERGE-MESSAGE-FIELD.md`
 - **Owner:** `be-coder-08`
 - **Branch:** `fix/pr-merge-message-field`
 - **Base:** remote `main` / local `origin/main` at `85d2108e4ed15c744ad3b87a5b629e7b2d39405a`
 - **Estate:** HOMELAB tooling shared by HOMELAB and USC
 ## Objective
 Add an optional, identity-checked Gitea squash message to `pr-merge.sh` so genuine multi-author PRs retain non-poster branch authors without weakening hardcoded squash behavior.
 ## Binding requirements
 1. `Do` remains hardcoded to `squash`; no provider/repository default may select merge style.
 2. A verified trailer uses a PR commit's linked `author.login` and that same commit's author email. No `/users/{login}` primary-email lookup occurs. Recorded rationale: this asks only what the provider can answer.
 3. A commit with `author.login` null blocks before merge, prints both the null provider fact and commit email fact, and names the escalation principal.
 4. The BLOCK arm must be observed firing; a normal canonical single-author API payload remains explicit squash plus its reviewed `head_commit_id`.
 5. Every provider mutation is read back from the provider; no real PR is merged during tests.
 ## Derived interface decisions
 - Add `--co-author-trailers` rather than accepting arbitrary message text. The wrapper enumerates PR commits and constructs trailers, making an unchecked `Co-authored-by` line unexpressible.
 - Require `--escalate-to PRINCIPAL` with `--co-author-trailers`, so the BLOCK diagnostic always names a principal rather than a generic role.
 - Do not expose `MergeTitleField` separately. When trailers exist, set it from the provider PR title and set `MergeMessageField` only to construction-generated trailers. This preserves one provider source for the title and avoids an unrelated caller-controlled degree of freedom.
 - Preserve first-commit order and emit one trailer per distinct non-poster `author.login`, using that first linked commit's own email.
 ## Canonical delivery plan
 1. Port the capability into the installed source of truth, `packages/mosaic/framework/tools/git/pr-merge.sh`; do not retain `infra/fleet/tools/git` as a second copy.
 2. Preserve canonical `--expect-head`, exact head branch/repository/SHA queue inspection, Gitea atomic head pinning, GitHub `--match-head-commit`, and delete-after-merge semantics.
 3. Do not port the deployed-only `--skip-queue-guard` bypass. Add the focused harness to the canonical framework-shell suite and re-establish RED/GREEN on the packaged baseline.
 4. Deliver through a reviewed package release followed by `mosaic update` with its default framework reseed. The installer snapshots, manifest-syncs framework-owned `tools/**`, and rolls back on failure.
 5. Before either estate relies on the change, require installed/package hash equality, `MergeMessageField` presence, and a green focused harness. Release/reseed ownership is currently unassigned and blocks activation after source merge.
 ## Evidence
 - RED against the byte-identical deployed baseline (`sha256 08a65e8584c5…`): rc 1 with eight named failures. The wrapper rejected `--co-author-trailers`; the null-login path emitted none of the required BLOCK facts/principal; and both verified/ordinary API paths failed the stdin-config credential assertion (ordinary path exposed the fixture token through curl argv). Log: `/home/hermes/agent-work/be-coder-08/evidence/prmerge-message-field-red.log`.
 - GREEN on the deployed-baseline candidate: verified linked multi-author payload, null-login BLOCK, required named principal, explicit squash, stdin-config token transport, and absence of `/users` lookup all passed. Log: `/home/hermes/agent-work/be-coder-08/evidence/prmerge-message-field-green.log`.
 - RED against canonical packaged baseline `c581ef48…`: rc 1 with 32 assertions. It rejects the new option, and the first harness version did not satisfy canonical head branch/repository/SHA metadata. Log: `/home/hermes/agent-work/be-coder-08/evidence/prmerge-packaged-baseline-red.log`. The port adapts the fixture rather than weakening canonical head controls.
 - Provider capability probe against `git.mosaicstack.dev`: authenticated `be-coder-08` POST to deliberately nonexistent PR `2147483647` with both message fields returned JSON HTTP 404; the unauthenticated same request returned JSON HTTP 401 (not the charter's predicted 403). The authenticated-vs-unauthenticated differential proves write authorization resolved while no mergeable subject existed. `tl-mosaic` ruled the literal non-load-bearing: preserve the observed 404/401 pair and do not manufacture a 403 case. No cause was inferred and no real PR was targeted.
 - Provider-generated trailer behavior is not treated as exclusive or absent. The wrapper's VERIFIED/BLOCK decision binds each requested non-poster trailer to commit `author.login` plus that commit's email; it does not assume `MergeMessageField` is the squash's only trailer source. The poster is omitted from the constructed list because the resulting squash author already records the poster; any additional provider-generated trailer is outside this change's unmeasured mechanism.
 - An early candidate SHA-256 `5de32876990e4f26920448cb3220cc7f1146d558b4dd2bc1ee1a2abee2f2cbe6` passed the initial harness, then author-side review found credential-fallback and argv-exposure defects. The live deployed wrapper was atomically restored to baseline SHA-256 `08a65e8584c52c6d41ea1c686f8b95585c21e4b37320a2447eba09359a0e02c1`; the remediated candidate remains only in the worktree.
 ## Remediation and current review state
 1. Token and Basic Auth now use stdin curl configuration, not argv. PR title, contributor email, and the JSON payload also remain out of child argv.
 2. Each credential attempt binds commit inspection and merge. A token failure during either inspection or mutation causes Basic fallback to repeat inspection before mutation; the payload pins the inspected `head_commit_id`.
 3. Focused tests cover token-resolution fail-closed behavior, both HTTP-401 fallback seams, metadata/credential argv absence, null-login BLOCK, explicit squash, canonical reviewed-head binding, unchanged ordinary payload, and retained log-safe provider diagnostics. Token-resolution RED: `/home/hermes/agent-work/be-coder-08/evidence/prmerge-token-resolution-red.log`.
 4. Codex review rounds 3–5 requested retained provider error text, log-safe provider diagnostics, fail-closed credential fallback, stable value-option parsing, and PR-title trailer-injection prevention. These are remediated with regression assertions. A post-remediation independent review is still required.
 5. **Accepted linkage limitation:** `author.login` resolution proves that the commit address maps to a registered provider account. It does not prove that the named principal authored the commit because Git author metadata is self-asserted. This gate checks attribution linkage, not authorship; commit signing is out of scope and currently unadopted. Coordinators explicitly ruled that this does not add a third state.
 6. Codex's sandbox could not execute the harness because its checkout was read-only; that environmental limitation is recorded separately from host-side test results.
 ## Disposable provider fixture acceptance
 - Use a retained scratch repository only, with two branch authors and `author != committer` on at least one commit.
 - Arm A supplies a message-field trailer for one non-poster; record whether that value lands without forcing the partial-pair result into under-specified `APPENDS`/`REPLACES` labels. Demonstrate an absence control.
 - Arm B includes a registered trailer for a different non-poster on a branch commit; record whether it survives or drops. Verify identity through an existing commit whose `author.login` resolves and demonstrate an absence control.
 - Parse landed trailers key-agnostically with `^[A-Za-z-]+-[Bb]y:` and record generated poster pair presence/absence plus resulting poster attribution.
 - Record `/users/<login>` status and raw email only as non-gating estate telemetry. Never read `active`, `visibility`, or any profile field as an identity gate.
 - Use distinct principals: poster `be-coder-08`, merger `Mos`, Arm A `be-coder-07`, and Arm B `be-coder-06`. Capture every trailer-shaped line verbatim and in order. Zero trailer lines means the generator did not fire and the run is `VOID`, not evidence that either arm dropped.
 - Report the same read-back evidence to `mos-claude` on socket `default` and `tl-mosaic` on socket `mosaic-fleet`. Report values rather than mechanism inferences and stop on any poster-attribution regression.
 ## Fixture preflight
 - Retained public repository: `mosaicstack/prmerge-trailer-fixture`; PR `#1`, posted by `be-coder-08` and reserved for merge by `Mos`.
 - Existing `mosaicstack/stack` commits resolve `be-coder-07` and `be-coder-06` through `author.login`; exact addresses are `[email protected]` and `[email protected]`.
 - Non-gating HOMELAB telemetry for authenticated reader `be-coder-08`: `/api/v1/users/be-coder-06` returned HTTP 200 with raw `email` value `[email protected]`.
 - Provider preflight showed PR commit enumeration is newest-first. A new RED test proved that deriving `head_commit_id` from the final array element selected the wrong commit. The candidate now reads `.head.sha` from the authenticated PR endpoint before enumeration, verifies it appears in the commit set, and atomically pins that SHA in the explicit squash payload. RED: `/home/hermes/agent-work/be-coder-08/evidence/prmerge-head-order-red.log`.
 - Fixture PR head `f6ba6e5105031fa21f5ff7bd8e4379d99c16e1de` has `author.login=be-coder-07`, `committer.login=be-coder-08`, and branch-message trailer `Co-authored-by: be-coder-06 <[email protected]>`.
 ## Fixture result
 - `Mos` merged retained fixture PR `#1` through staged candidate SHA-256 `60e779a85fd13b729d859ea7c986d1e9b1641b97991611329226c1b3113ffb6e`; resulting squash commit: `3f550715d9bc716426fd355a65fe997b3a90fa7d` with one parent.
 - Provider read-back: poster/commit author `be-coder-08`, committer/merger `Mos`. The run is non-void.
 - Trailer-shaped lines, verbatim and in order:
  1. `Co-authored-by: be-coder-07 <[email protected]>`
  2. `Co-authored-by: be-coder-08 <[email protected]>`
 - Arm A supplied field value (`be-coder-07`) landed. Arm B branch trailer (`be-coder-06`) dropped. Both fabricated absence controls remained absent. No `Co-committed-by:` line landed.
 - The candidate payload construction explicitly excludes the poster and supplied only the Arm A `be-coder-07` line. Therefore the landed poster line was provider-generated, not candidate-composed. The raw result supports `FIELD LANDS`, `BRANCH DROPS`, and `POSTER GENERATED`; it does not support a claim that candidate code supplied the poster. Evidence: `/home/hermes/agent-work/be-coder-08/evidence/prmerge-fixture-readback.log` and the retained provider object.
 - Retained fixture PR `#2` measured the N=2 shape needed by `#1030`: supplied `be-coder-07` then `be-coder-06`; both landed in that order, followed by the provider-generated poster line. No truncation or dedup occurred at N=2. Resulting squash: `39db9d13aed0…`.
 ## Current hold point
 PR `mosaicstack/stack#1066` is open. Its first frozen head `f4b162fa…` was terminal-green in Woodpecker `mosaic` pipeline `#2225`, but that evidence becomes stale when the canonical port moves the head. The deployed wrapper remains baseline `08a65e85…`; no manual copy will occur. Canonical port tests, commit amendment, rebase, one guarded force-with-lease, exact-head CI, and new independent review remain. Even after source merge, activation remains blocked on an assigned package-release/reseed owner and installed-byte read-back.
 ## Security review 96 remediation
 Exact reviewed predecessor head: `1ceb11058f64dd7f4a817ceb2124f980a1c4dd23`.
 RED-first focused harness produced 10 named failures: all curl calls lacked size/time/connect bounds; raw ESC email reached mutation; oversized and stalled curl failures were discarded and reached mutation; nonempty Basic output with resolver rc 91 authorized mutation.
 Security remediation:
 - Removed the cross-principal HTTP-401 Basic fallback. Both inspection-401 and merge-401 paths now refuse without Basic resolution or mutation; `get_gitea_basic_auth` references in the merge subject are 0.
 - Applied `--max-filesize`, `--max-time`, and `--connect-timeout` to all 3/3 provider curl sites and fail closed on curl transport rc at all 3/3 sites.
 - Required linked email bytes to be ASCII and printable before constructing `MergeMessageField`; guarded construction sites 1/1.
 GREEN: message-field, exact-head, empty-UID/API, queue branch/repository/SHA, bash syntax, ShellCheck, and diff check pass. R7 total-removal mutants went RED: email guard 3 rows; bound switches 1 row; transport-rc guards 4 rows; HTTP-401 refusal 3 rows. R7 bound: mutants prove total removal only; explicit denominators above prove site coverage.
@@ -10,7 +10,8 @@
    "clean:generated": "node scripts/clean-generated.mjs",
    "typecheck": "pnpm preflight && turbo run typecheck",
    "test:checkout": "node --test scripts/*.test.mjs",
-    "test": "pnpm test:checkout && turbo run test",
+    "test": "pnpm test:checkout && turbo run test && pnpm run test:installer",
    "test:installer": "bash tools/install-state-machine.test.sh && bash tools/install-next-lane.test.sh && bash tools/verify-greenfield-expected-red.test.sh && bash tools/verify-greenfield-execution-coverage.test.sh && bash tools/verified-installer-fetch.test.sh",
    "format": "prettier --write \"**/*.{ts,tsx,js,jsx,json,md}\"",
    "format:check": "prettier --check \"**/*.{ts,tsx,js,jsx,json,md}\"",
    "prepare": "node scripts/install-hooks.mjs"
@@ -13,8 +13,7 @@ Pi is the native Mosaic agent runtime. The `mosaic pi` launcher:
 1. Injects the full runtime contract via `--append-system-prompt`
 2. Loads Mosaic skills via `--skill` flags
-3. Loads framework-owned `mosaic-extension.ts` and `goal-extension.ts` from
+3. Loads the Mosaic extension via `--extension` for lifecycle hooks
   `~/.config/mosaic/runtime/pi/` via ordered `--extension` flags
 4. Detects active missions and injects initial prompts
 ## Capabilities vs Other Runtimes
@@ -23,7 +22,6 @@ Pi is the native Mosaic agent runtime. The `mosaic pi` launcher:
 - Native thinking levels replace sequential-thinking MCP
 - Native skill discovery compatible with Mosaic SKILL.md format
 - Native extension system for lifecycle hooks (TypeScript, not bash shims)
 - Bounded persistent `/goal` loop with per-turn, post-compaction, and two-pass evidence checks
 - Native session persistence and resume
 - Model-agnostic (Anthropic, OpenAI, Google, Ollama, custom providers)
@@ -94,14 +94,7 @@ The launcher:
 1. Verifies `~/.config/mosaic` exists
 2. Verifies `SOUL.md` exists (auto-runs `mosaic init` if missing)
 3. Injects `AGENTS.md` into the runtime
-4. For Pi, loads the framework-owned core and persistent-goal extensions from
+4. Forwards all arguments to the runtime CLI
   `~/.config/mosaic/runtime/pi/`
 5. Forwards all arguments to the runtime CLI
 Inside `mosaic pi`, `/goal set <statement>` starts a bounded persistent goal loop. Use `/goal status`,
 `/goal pause`, `/goal resume`, or `/goal cancel` to control it. The extension remains part of Mosaic
 under `~/.config/mosaic/runtime/pi/goal-extension.ts`; it is not installed in Pi's main extension
 directory.
 You can still launch runtimes directly (`claude`, `codex`, etc.) — thin runtime adapters will tell the agent to read `~/.config/mosaic/AGENTS.md`.
@@ -121,7 +114,7 @@ You can still launch runtimes directly (`claude`, `codex`, etc.) — thin runtim
 │   ├── claude/            ← CLAUDE.md, RUNTIME.md, settings.json, hooks
 │   ├── codex/             ← instructions.md, RUNTIME.md
 │   ├── opencode/          ← AGENTS.md, RUNTIME.md
-│   ├── pi/                ← RUNTIME.md, mosaic-extension.ts, goal-extension.ts
+│   ├── pi/                ← RUNTIME.md, mosaic-extension.ts
 │   └── mcp/               ← MCP server configs
 ├── skills/                ← Universal skills (synced from mosaic/agent-skills)
 ├── skills-local/          ← Local cross-runtime skills
@@ -133,7 +126,7 @@ You can still launch runtimes directly (`claude`, `codex`, etc.) — thin runtim
 | Launch method       | Injection mechanism                                                                       |
 | ------------------- | ----------------------------------------------------------------------------------------- |
-| `mosaic pi`         | `--append-system-prompt` with composed runtime contract + skills + Mosaic extensions      |
+| `mosaic pi`         | `--append-system-prompt` with composed runtime contract + skills + extension              |
 | `mosaic claude`     | `--append-system-prompt` with composed runtime contract (`AGENTS.md` + runtime reference) |
 | `mosaic codex`      | Writes composed runtime contract to `~/.codex/instructions.md` before launch              |
 | `mosaic opencode`   | Writes composed runtime contract to `~/.config/opencode/AGENTS.md` before launch          |
@@ -58,6 +58,7 @@ done
 # packages/mosaic/src/framework/manifest.ts — both consume framework-manifest.txt.
 # Sourcing does not run its CLI dispatch (guarded by BASH_SOURCE==$0).
 # shellcheck source=tools/_lib/manifest.sh
 # shellcheck disable=SC1091 # Dynamic SOURCE_DIR; the path is validated by set -e.
 source "$SOURCE_DIR/tools/_lib/manifest.sh"
 # Which paths a keep-mode upgrade may touch is no longer a hand-maintained
@@ -222,12 +223,14 @@ prune_durable_snapshots() {
  [[ "$keep" =~ ^[0-9]+$ ]] && (( keep >= 1 )) || keep=5
  list="$(mktemp)"
  if ! find "$root" -maxdepth 1 -type d -name 'pre-update-*' > "$list"; then
    warn "Backup pruning skipped; policy: retention cleanup is optional and a failed enumeration must preserve every existing recovery snapshot."
    rm -f "$list"; return 0
  fi
  # Newest-first ordering needs `sort` (`-o` writes back in place — no `mv`
  # dependency); if it is somehow unavailable, leave the backups untouched rather
  # than risk pruning in an undefined order.
  if ! LC_ALL=C sort -r -o "$list" "$list" 2>/dev/null; then
    warn "Backup pruning skipped; policy: ordering failure preserves all snapshots rather than risking deletion in an undefined order."
    rm -f "$list"; return 0
  fi
  while IFS= read -r d; do
@@ -266,7 +269,11 @@ make_durable_snapshot() {
    warn "Durable snapshot skipped: cannot create backup dir $root (upgrade continues; operator files remain manifest-protected)."
    return 0
  fi
-  chmod 700 "$root" 2>/dev/null || true
+  if ! chmod 700 "$root"; then
    umask "$old_umask"
    warn "Durable snapshot skipped: backup root permissions could not be made private; policy: never write operator data to an insufficiently protected location."
    return 0
  fi
  dir="$root/pre-update-$ts"
  if [[ -e "$dir" ]]; then           # same-second re-run: disambiguate
    local n=1; while [[ -e "$dir-$n" ]]; do n=$((n + 1)); done; dir="$dir-$n"
@@ -281,7 +288,10 @@ make_durable_snapshot() {
  if ! enumerate_operator_files "$list"; then
    umask "$old_umask"
    warn "Durable snapshot skipped: could not enumerate operator files (upgrade continues)."
-    rm -f "$list"; rmdir "$dir" 2>/dev/null || true
+    rm -f "$list"
    if ! rmdir "$dir"; then
      warn "Durable snapshot cleanup left $dir in place; policy: preserve unexpected content rather than deleting it recursively."
    fi
    return 0
  fi
  while IFS= read -r -d '' rel; do
@@ -292,12 +302,18 @@ make_durable_snapshot() {
      warn "Durable snapshot: could not copy operator file '$rel' (skipped)."
      continue
    fi
-    chmod 600 "$dst" 2>/dev/null || true
+    if ! chmod 600 "$dst"; then
      rm -f "$dst"
      warn "Durable snapshot: copied '$rel' could not be made private and was removed; policy: do not retain an insecure recovery copy."
      continue
    fi
    count=$((count + 1))
  done < "$list"
  rm -f "$list"
-  # Tighten every dir the copy created (mkdir -p honors umask, but be explicit).
+  # Tighten every dir the copy created (mkdir -p already honored umask 077).
-  find "$dir" -type d -exec chmod 700 {} + 2>/dev/null || true
+  if ! find "$dir" -type d -exec chmod 700 {} +; then
    warn "Durable snapshot directory permission recheck failed; policy: continue because every directory was created under umask 077, while retaining the diagnostic."
  fi
  umask "$old_umask"   # UMASK-RESTORE-NORMAL — restore before the upgrade proper resumes (see above)
  DURABLE_SNAPSHOT_DIR="$dir"
  ok "Durable pre-update snapshot: $count operator file(s) saved to $dir (recover with: mosaic restore --list)"
@@ -344,7 +360,9 @@ verify_operator_surface() {
        continue
      fi
      if cp "$snap" "$cur"; then
-        chmod 600 "$cur" 2>/dev/null || true
+        if ! chmod 600 "$cur"; then
          warn "Operator file '$rel' was restored but its mode could not be tightened to 0600; policy: preserve recovered content and require manual permission repair."
        fi
        warn "Operator file was modified by the upgrade and has been restored from the pre-update snapshot: $rel"
        healed=$((healed + 1))
      else
@@ -535,7 +553,7 @@ sync_framework_keep() {
    # (unreadable dir) is surfaced as a warning rather than silently swallowed;
    # the "directory not empty" races we tolerate are ignored via -delete's own
    # rc, not by hiding stderr — so a real error is still visible to the operator.
-    if ! find "$dst/$root" -type d -empty -delete 2>/dev/null; then
+    if ! find "$dst/$root" -type d -empty -delete; then
      warn "prune: could not fully sweep empty framework dirs under $root (left as-is)"
    fi
  done < <(manifest_subtree_roots)
@@ -581,7 +599,7 @@ run_migrations() {
    MIGRATION_REMOVED_PATHS+=("bin" "rails")
    if [[ -d "$TARGET_DIR/bin" ]]; then
      ok "Removing legacy bin/ directory (executables now in npm CLI)"
-      rm -rf "$TARGET_DIR/bin"
+      rm -rf "${TARGET_DIR:?}/bin"
    fi
    # Remove old mosaic PATH entry from shell profiles
@@ -692,9 +710,11 @@ trap 'restore_snapshot; exit 1' ERR INT TERM
 sync_framework
-# Ensure persistent directories exist
+# Ensure persistent directories exist. Credentials are private material and
 # must never inherit a permissive umask/default mode.
 mkdir -p "$TARGET_DIR/memory"
 mkdir -p "$TARGET_DIR/credentials"
 chmod 0700 "$TARGET_DIR/credentials"
 # Reconcile contract files from defaults/ into the framework root: framework-owned
 # files (CONSTITUTION/AGENTS/STANDARDS) are overwritten every upgrade (a divergent
@@ -706,13 +726,23 @@ mkdir -p "$TARGET_DIR/credentials"
 # by `mosaic init` from templates with user-supplied values.
 reconcile_framework_files
-# Ensure tool scripts are executable
+# Ensure tool scripts are executable. These are P4 postconditions, not
-find "$TARGET_DIR/tools" -name "*.sh" -exec chmod +x {} + 2>/dev/null || true
+# best-effort cleanup: a chmod failure leaves shipped tools unloadable.
-find "$TARGET_DIR/tools/_scripts" -type f -exec chmod +x {} + 2>/dev/null || true
+if ! find "$TARGET_DIR/tools" -name "*.sh" -exec chmod +x {} +; then
  fail "Could not mark shipped shell tools executable."
  exit 1
 fi
 if ! find "$TARGET_DIR/tools/_scripts" -type f -exec chmod +x {} +; then
  fail "Could not mark shipped runtime scripts executable."
  exit 1
 fi
 # git-credential-mosaic (per-agent Gitea identity helper) ships without a .sh
-# suffix — git resolves credential helpers by exact name/path, not extension —
+# suffix — git resolves credential helpers by exact name/path, not extension.
-# so the *.sh glob above does not cover it; chmod it explicitly.
+if [[ -f "$TARGET_DIR/tools/git/git-credential-mosaic" ]] \
-[[ -f "$TARGET_DIR/tools/git/git-credential-mosaic" ]] && chmod +x "$TARGET_DIR/tools/git/git-credential-mosaic" 2>/dev/null || true
+  && ! chmod +x "$TARGET_DIR/tools/git/git-credential-mosaic"; then
  fail "Could not mark git-credential-mosaic executable."
  exit 1
 fi
 ok "Framework synced to $TARGET_DIR"
@@ -739,49 +769,162 @@ step "Post-install tasks"
 SCRIPTS="$TARGET_DIR/tools/_scripts"
 # Capture every fallible post-install command. A failure's text is surfaced and
 # also appended to the parent transaction's private command log. Failure to
 # write that log is fatal: continuing would recreate the false-clean diagnosis
 # INV-C forbids.
 record_phase_outcome() {
  local phase="$1" status="$2" reason="$3"
  [[ -n "${MOSAIC_INSTALL_PHASE_STATUS_FILE:-}" ]] || return 0
  if ! printf '%s\t%s\t%s\n' "$phase" "$status" "$reason" >> "$MOSAIC_INSTALL_PHASE_STATUS_FILE" \
    || ! sync "$MOSAIC_INSTALL_PHASE_STATUS_FILE"; then
    fail "Could not durably record $phase action outcome for the parent transaction."
    exit 1
  fi
 }
 redact_install_stream() {
  # Keep this bootstrap copy behaviorally identical to tools/install.sh's
  # state_redact_stream; neither installer can assume the other is installed.
  python3 /dev/fd/3 3<<'PY'
 import os, re, sys
 text = sys.stdin.read()
 secret_name = re.compile(r"(?:TOKEN|PASSWORD|PASSWD|SECRET|API_KEY|AUTH|CREDENTIAL|CANARY)", re.I)
 secrets = {value for name, value in os.environ.items() if secret_name.search(name) and len(value) >= 4}
 for value in sorted(secrets, key=len, reverse=True):
    text = text.replace(value, "[REDACTED]")
 patterns = (
    (re.compile(r"(?im)^(\s*(?:proxy-)?authorization\s*:\s*)[^\r\n]+"), r"\1[REDACTED]"),
    (re.compile(r"(?im)^(\s*(?:set-)?cookie\s*:\s*)[^\r\n]+"), r"\1[REDACTED]"),
    (re.compile(r"(?i)(Bearer\s+)[^\s'\"]+"), r"\1[REDACTED]"),
    (re.compile(r"(?i)((?:[_-]?auth(?:Token)?|token|password|passwd|secret|api[_-]?key)\s*[=:]\s*)[^\s'\"]+"), r"\1[REDACTED]"),
 )
 for pattern, replacement in patterns:
    text = pattern.sub(replacement, text)
 url_pattern = re.compile(r"https?://[^\s'\"<>]+", re.I)
 def redact_url(match):
    url = match.group(0)
    scheme_end = url.find("://") + 3
    authority_end = len(url)
    for separator in "/?#":
        position = url.find(separator, scheme_end)
        if position != -1:
            authority_end = min(authority_end, position)
    authority = url[scheme_end:authority_end]
    at = authority.rfind("@")
    if at != -1:
        return url[:scheme_end] + "[REDACTED]@" + authority[at + 1:] + url[authority_end:]
    return url
 sys.stdout.write(url_pattern.sub(redact_url, text))
 PY
 }
 run_captured() {
  local label="$1" redacted redactor_pid capture_fd status=0 redact_status=0
  shift
  redacted="$(mktemp "${TMPDIR:-/tmp}/mosaic-post-redacted.XXXXXX")"
  chmod 0600 "$redacted" || { rm -f "$redacted"; exit 1; }
  # Preserve in-shell command behavior without ever staging plaintext output on
  # disk. Process substitution carries raw bytes only through a pipe.
  exec {capture_fd}> >(redact_install_stream > "$redacted")
  redactor_pid=$!
  set +e
  "$@" >&"$capture_fd" 2>&1
  status=$?
  exec {capture_fd}>&-
  wait "$redactor_pid"
  redact_status=$?
  set -e
  if [[ "$redact_status" -ne 0 ]]; then
    rm -f "$redacted"
    fail "Could not redact '$label' diagnostics; refusing to expose or persist raw output."
    exit 1
  fi
  if [[ -n "${MOSAIC_INSTALL_COMMAND_LOG:-}" ]]; then
    if ! { printf '\n=== %s (exit=%s) ===\n' "$label" "$status"; cat "$redacted"; } >> "$MOSAIC_INSTALL_COMMAND_LOG" \
      || ! sync "$MOSAIC_INSTALL_COMMAND_LOG"; then
      cat "$redacted" >&2
      rm -f "$redacted"
      fail "Could not durably append '$label' diagnostics to the install command log."
      exit 1
    fi
  fi
  if [[ "$status" -ne 0 ]]; then cat "$redacted" >&2; fi
  rm -f "$redacted"
  return "$status"
 }
 if [[ -x "$SCRIPTS/mosaic-link-runtime-assets" ]]; then
  link_args=()
  [[ "$ALLOW_INACTIVE_ENFORCEMENT" == "1" ]] && link_args+=(--allow-inactive-enforcement)
-  # stdout is suppressed as before, but stderr is left connected: the
+  if run_captured "runtime asset linking" "$SCRIPTS/mosaic-link-runtime-assets" "${link_args[@]}"; then
-  # install-ordering guard's FAIL LOUD message (#869 Point-1 C2) must reach
+    record_phase_outcome P6 committed "runtime asset linker exited zero"
  # the operator, not be swallowed silently.
  if "$SCRIPTS/mosaic-link-runtime-assets" "${link_args[@]}" >/dev/null; then
    ok "Runtime assets linked"
  else
-    warn "Runtime asset linking failed (non-fatal) — see message above for details."
+    record_phase_outcome P6 failed "runtime asset linker exited non-zero"
    warn "Runtime asset linking did not commit; policy: continue only to enumerate all phase diagnostics, while P6/P9 remain blocking."
  fi
 else
  record_phase_outcome P6 failed "required runtime asset linker is missing or not executable"
  warn "Runtime asset linking was not attempted; policy: a missing required linker remains a blocking P6/P9 failure."
 fi
 if [[ -x "$SCRIPTS/mosaic-ensure-sequential-thinking" ]]; then
-  if "$SCRIPTS/mosaic-ensure-sequential-thinking" >/dev/null 2>&1; then
+  if run_captured "sequential-thinking setup" "$SCRIPTS/mosaic-ensure-sequential-thinking"; then
    ok "sequential-thinking MCP configured"
  elif [[ "${MOSAIC_ALLOW_MISSING_SEQUENTIAL_THINKING:-0}" == "1" ]]; then
    record_phase_outcome P6 failed "sequential-thinking setup failed under diagnostic-continuation compatibility mode"
    warn "sequential-thinking setup did not commit; policy: the unified installer compatibility flag allows diagnostic continuation, while P6/P9 remain blocking."
  else
-    if [[ "${MOSAIC_ALLOW_MISSING_SEQUENTIAL_THINKING:-0}" == "1" ]]; then
+    fail "sequential-thinking MCP setup failed (hard requirement)."
-      warn "sequential-thinking MCP setup bypassed (MOSAIC_ALLOW_MISSING_SEQUENTIAL_THINKING=1)"
+    exit 1
    else
      fail "sequential-thinking MCP setup failed (hard requirement)."
      exit 1
    fi
  fi
 fi
 if [[ -x "$SCRIPTS/mosaic-ensure-excalidraw" ]]; then
-  "$SCRIPTS/mosaic-ensure-excalidraw" >/dev/null 2>&1 && ok "excalidraw MCP configured" || warn "excalidraw MCP setup failed (non-fatal)"
+  if run_captured "excalidraw setup" "$SCRIPTS/mosaic-ensure-excalidraw"; then
    ok "excalidraw MCP configured"
  else
    warn "excalidraw setup did not commit; policy: optional integration failure is retained in the journal and does not define core install readiness."
  fi
 fi
-if [[ "${MOSAIC_SKIP_SKILLS_SYNC:-0}" != "1" ]] && [[ -x "$SCRIPTS/mosaic-sync-skills" ]]; then
+if [[ "${MOSAIC_SKIP_SKILLS_SYNC:-0}" == "1" ]]; then
-  "$SCRIPTS/mosaic-sync-skills" >/dev/null 2>&1 && ok "Skills synced" || warn "Skills sync failed (non-fatal)"
+  record_phase_outcome P4 failed "required skills sync explicitly skipped"
  warn "Skills sync was skipped; policy: diagnostic continuation is allowed, but P4/P9 cannot certify an incomplete requested framework install."
 elif [[ -x "$SCRIPTS/mosaic-sync-skills" ]]; then
  if run_captured "skills sync" "$SCRIPTS/mosaic-sync-skills"; then
    record_phase_outcome P4 committed "skills sync exited zero"
    ok "Skills synced"
  else
    record_phase_outcome P4 failed "skills sync exited non-zero"
    warn "Skills sync did not commit; policy: continue to collect P4 diagnostics, but P4/P9 must not certify the install."
  fi
 else
  record_phase_outcome P4 failed "required skills sync command is missing or not executable"
  warn "Skills sync was not attempted; policy: a missing required sync command remains a blocking P4/P9 failure."
 fi
 if [[ -x "$SCRIPTS/mosaic-migrate-local-skills" ]]; then
-  "$SCRIPTS/mosaic-migrate-local-skills" --apply >/dev/null 2>&1 && ok "Local skills migrated" || warn "Local skill migration failed (non-fatal)"
+  if run_captured "local skills migration" "$SCRIPTS/mosaic-migrate-local-skills" --apply; then
    ok "Local skills migrated"
  else
    record_phase_outcome P4 failed "local skills migration exited non-zero"
    warn "Local skill migration did not commit; policy: preserve user content and continue diagnostics, while P4/P9 remain blocking."
  fi
 fi
 if [[ -x "$SCRIPTS/mosaic-doctor" ]]; then
-  "$SCRIPTS/mosaic-doctor" >/dev/null 2>&1 && ok "Health audit passed" || warn "Health audit reported issues — run 'mosaic doctor' for details"
+  if run_captured "health audit" "$SCRIPTS/mosaic-doctor"; then
    ok "Health audit passed"
  else
    warn "Health audit found unresolved state; policy: preserve its diagnostics and let P9 issue the authoritative failure."
  fi
 fi
-# Write version stamp AFTER everything succeeds
+# The version stamp records the successfully committed framework file sync.
 # Post-install failures are carried separately into P4/P6 and cannot be erased
 # by this stamp.
 write_framework_version
 # ── Summary ──────────────────────────────────────────────────
@@ -51,26 +51,12 @@ Skills are discovered from:
 ### Extensions
-`mosaic pi` loads framework-owned extensions directly from `~/.config/mosaic/runtime/pi/` in this
+The Mosaic Pi extension (`~/.config/mosaic/runtime/pi/mosaic-extension.ts`) handles:
 order:
-1. `mosaic-extension.ts` — session lifecycle, mission context, memory routing, lease/mutator gates,
+- Session start/end lifecycle hooks
-   and fleet heartbeat reporting.
+- Active mission detection and context injection
-2. `goal-extension.ts` — optional persistent `/goal` controller with per-turn and post-compaction
+- Memory routing to `~/.config/mosaic/memory/`
-   checks.
+- MACP queue status reporting
 The goal extension is deployed by Mosaic and MUST NOT be copied into `~/.pi/agent/extensions/`.
 Use `/goal set <statement>` (or `/goal <statement>`) to start, then `/goal status`, `/goal pause`,
 `/goal resume`, or `/goal cancel` to control it. An active goal is injected before every model
 request, restored from branch-specific session entries, and considered achieved only after two
 consecutive evidence-bearing reports. Common credential shapes are redacted before controller-owned
 goal-state entries are persisted or
 displayed; Pi's own model/tool-call history is separate. Goals and reports must contain references
 and pass/fail summaries rather than secrets or raw sensitive output.
 - `MOSAIC_GOAL_MAX_TURNS` — autonomous turn limit, default `40`, accepted range `1..500`.
 - `MOSAIC_GOAL_MAX_NO_PROGRESS` — identical no-progress report limit, default `6`, accepted range
  `1..100`.
 ### Sessions
@@ -66,10 +66,7 @@ if command -v tmux >/dev/null 2>&1 && command -v cc >/dev/null 2>&1; then
  trap 'tmux -L "$TEST_SOCKET" kill-server >/dev/null 2>&1 || true; rm -rf "$TEST_ROOT"' EXIT
  MARKER="$TEST_ROOT/loader-marker"
  LIBRARY="$TEST_ROOT/marker.so"
  FIXTURE_READY="$TEST_ROOT/loader-ready"
  FIXTURE_FIFO="$TEST_ROOT/loader-block"
  HOLDER_HOME="$TEST_ROOT/holder-home"
  mkfifo "$FIXTURE_FIFO"
  mkdir -p "$HOLDER_HOME/.config/mosaic/fleet/run"
  chmod 700 "$HOLDER_HOME/.config" "$HOLDER_HOME/.config/mosaic" \
    "$HOLDER_HOME/.config/mosaic/fleet" "$HOLDER_HOME/.config/mosaic/fleet/run"
@@ -90,17 +87,7 @@ __attribute__((constructor)) static void mark_loader(void) {
 EOF
  cc -shared -fPIC -o "$LIBRARY" "$TEST_ROOT/marker.c"
  MOSAIC_LOADER_MARKER="$MARKER" LD_PRELOAD="$LIBRARY" \
-    tmux -L "$TEST_SOCKET" new-session -d -s _holder \
+    tmux -L "$TEST_SOCKET" new-session -d -s _holder 'sleep 60'
      "touch '$FIXTURE_READY'; read _ < '$FIXTURE_FIFO'"
  # tmux starts the pane asynchronously. Wait until its contaminated shell has
  # loaded the constructor and reached a builtin-only FIFO barrier before
  # clearing the marker; otherwise that expected constructor can race with the
  # clean holder assertion below and create a false failure.
  for _attempt in {1..100}; do
    [ -e "$FIXTURE_READY" ] && break
    sleep 0.01
  done
  [ -e "$FIXTURE_READY" ] || fail "contaminated fixture pane did not become ready"
  [ -s "$MARKER" ] || fail "contaminated fixture did not execute loader constructor"
  server_pid=$(tmux -L "$TEST_SOCKET" display-message -p '#{pid}')
  : > "$MARKER"
@@ -125,7 +112,6 @@ EOF
  chmod 700 "$AGENT_HOME/fleet/agents"
  cat > "$AGENT_HOME/fleet/agents/$AGENT_NAME.env.generated" <<EOF
 MOSAIC_AGENT_NAME=$AGENT_NAME
 MOSAIC_GIT_IDENTITY=$AGENT_NAME
 MOSAIC_AGENT_CLASS=code
 MOSAIC_AGENT_RUNTIME=pi
 MOSAIC_AGENT_MODEL=
@@ -158,8 +144,7 @@ EOF
  /usr/bin/env -i HOME="$HOLDER_HOME" PATH=/usr/bin:/bin \
    MOSAIC_TMUX_SOCKET="$TEST_SOCKET" MOSAIC_TMUX_HOLDER=_holder "$HOLDER_START"
  tmux -L "$TEST_SOCKET" has-session -t '=_holder:0.0' || fail "fresh holder was not created"
-  ld_preload_env="$(tmux -L "$TEST_SOCKET" show-environment -g LD_PRELOAD 2>/dev/null)" || true
+  if tmux -L "$TEST_SOCKET" show-environment -g LD_PRELOAD 2>/dev/null | grep -q '^LD_PRELOAD='; then
  if grep -q '^LD_PRELOAD=' <<<"$ld_preload_env"; then
    fail "fresh holder retained LD_PRELOAD"
  fi
  /usr/bin/env -i HOME="$HOLDER_HOME" PATH=/usr/bin:/bin MOSAIC_HOME="$AGENT_HOME" \
@@ -68,8 +68,15 @@ copy_claude_settings_guarded() {
    guard_args+=(--allow-inactive-enforcement)
  fi
-  if command -v mosaic >/dev/null 2>&1; then
+  local mosaic_cli="${MOSAIC_CLI_PATH:-}"
-    if mosaic "${guard_args[@]}"; then
+  # Unified install passes P3's committed absolute artifact. Standalone
  # framework installs may resolve PATH once, but still invoke the resulting
  # absolute path rather than a bare command.
  if [[ -z "$mosaic_cli" ]]; then
    mosaic_cli="$(command -v mosaic 2>/dev/null || true)"
  fi
  if [[ "$mosaic_cli" == /* && -x "$mosaic_cli" ]]; then
    if "$mosaic_cli" "${guard_args[@]}"; then
      return 0
    fi
    echo "[mosaic-link] Enforcement hooks were NOT wired into $dst (see message above)." >&2
@@ -77,7 +84,7 @@ copy_claude_settings_guarded() {
    return 0
  fi
-  echo "[mosaic-link] ERROR: 'mosaic' CLI not found on PATH — cannot confirm lease-enforcement" >&2
+  echo "[mosaic-link] ERROR: P3 absolute mosaic CLI unavailable — cannot confirm lease-enforcement" >&2
  echo "[mosaic-link] activation capability. enforcement requested but activation half absent —" >&2
  echo "[mosaic-link] needs a published CLI carrying launch-runtime activation + a broker" >&2
  echo "[mosaic-link] supervisor; refusing to wire a dead gate (see #869)." >&2
@@ -69,7 +69,7 @@ if [[ -n "$GROUP" ]]; then
  group_response=$(curl -sk \
    -H "Authorization: Bearer $TOKEN" \
    "${AUTHENTIK_URL}/api/v3/core/groups/?search=${GROUP}")
-  group_pk=$(jq -r "first(.results[] | select(.name == \"$GROUP\") | .pk) // empty" <<<"$group_response")
+  group_pk=$(echo "$group_response" | jq -r ".results[] | select(.name == \"$GROUP\") | .pk" | head -1)
  if [[ -n "$group_pk" ]]; then
    payload=$(echo "$payload" | jq --arg gk "$group_pk" '. + {groups: [$gk]}')
  else
@@ -97,7 +97,7 @@ is_sensitive_key() {
 is_generated_key() {
  case "$1" in
-    MOSAIC_AGENT_NAME|MOSAIC_GIT_IDENTITY|MOSAIC_AGENT_CLASS|MOSAIC_AGENT_RUNTIME|MOSAIC_AGENT_MODEL|MOSAIC_AGENT_REASONING|MOSAIC_AGENT_TOOL_POLICY|MOSAIC_AGENT_WORKDIR|MOSAIC_TMUX_SOCKET) return 0 ;;
+    MOSAIC_AGENT_NAME|MOSAIC_AGENT_CLASS|MOSAIC_AGENT_RUNTIME|MOSAIC_AGENT_MODEL|MOSAIC_AGENT_REASONING|MOSAIC_AGENT_TOOL_POLICY|MOSAIC_AGENT_WORKDIR|MOSAIC_TMUX_SOCKET) return 0 ;;
    *) return 1 ;;
  esac
 }
@@ -114,7 +114,6 @@ validate_generated_value() {
  local value="$2"
  case "$key" in
    MOSAIC_AGENT_NAME) safe_agent_name "$value" || fail_env unsafe-agent-name "$key" "$value" ;;
    MOSAIC_GIT_IDENTITY) safe_agent_name "$value" || fail_env unsafe-git-identity "$key" "$value" ;;
    MOSAIC_AGENT_CLASS) safe_policy_name "$value" || fail_env unsafe-class "$key" "$value" ;;
    MOSAIC_AGENT_RUNTIME)
      case "$value" in claude|codex|opencode|pi) ;; *) fail_env unsupported-runtime "$key" "$value" ;; esac
@@ -176,7 +175,7 @@ load_environment_file() {
 load_environment_file "$GENERATED_ENV" generated
 for required_key in \
-  MOSAIC_AGENT_NAME MOSAIC_GIT_IDENTITY MOSAIC_AGENT_CLASS MOSAIC_AGENT_RUNTIME MOSAIC_AGENT_MODEL \
+  MOSAIC_AGENT_NAME MOSAIC_AGENT_CLASS MOSAIC_AGENT_RUNTIME MOSAIC_AGENT_MODEL \
  MOSAIC_AGENT_REASONING MOSAIC_AGENT_TOOL_POLICY MOSAIC_AGENT_WORKDIR MOSAIC_TMUX_SOCKET; do
  [ -n "${GENERATED_VALUES[$required_key]+set}" ] || fail_env missing-key "$required_key" ''
 done
@@ -184,15 +183,12 @@ load_environment_file "$LOCAL_ENV" local
 [ "${GENERATED_VALUES[MOSAIC_AGENT_NAME]}" = "$AGENT_NAME" ] || \
  fail_env agent-name-mismatch MOSAIC_AGENT_NAME "${GENERATED_VALUES[MOSAIC_AGENT_NAME]}"
 [ "${GENERATED_VALUES[MOSAIC_GIT_IDENTITY]}" = "$AGENT_NAME" ] || \
  fail_env git-identity-mismatch MOSAIC_GIT_IDENTITY "${GENERATED_VALUES[MOSAIC_GIT_IDENTITY]}"
 MOSAIC_TMUX_SOCKET=${GENERATED_VALUES[MOSAIC_TMUX_SOCKET]}
 MOSAIC_AGENT_RUNTIME=${GENERATED_VALUES[MOSAIC_AGENT_RUNTIME]}
 MOSAIC_AGENT_MODEL=${GENERATED_VALUES[MOSAIC_AGENT_MODEL]}
 MOSAIC_AGENT_REASONING=${GENERATED_VALUES[MOSAIC_AGENT_REASONING]}
 MOSAIC_AGENT_WORKDIR=${GENERATED_VALUES[MOSAIC_AGENT_WORKDIR]}
 MOSAIC_GIT_IDENTITY=${GENERATED_VALUES[MOSAIC_GIT_IDENTITY]}
 MOSAIC_AGENT_CLASS=${GENERATED_VALUES[MOSAIC_AGENT_CLASS]}
 MOSAIC_AGENT_TOOL_POLICY=${GENERATED_VALUES[MOSAIC_AGENT_TOOL_POLICY]}
 MOSAIC_RUNTIME_BIN=${LOCAL_VALUES[MOSAIC_RUNTIME_BIN]:-}
@@ -347,7 +343,6 @@ LAUNCH_ENV=(
  "PATH=$PANE_PATH"
  "MOSAIC_HOME=$MOSAIC_HOME"
  "MOSAIC_AGENT_NAME=$AGENT_NAME"
  "MOSAIC_GIT_IDENTITY=$MOSAIC_GIT_IDENTITY"
  "MOSAIC_AGENT_CLASS=$MOSAIC_AGENT_CLASS"
  "MOSAIC_AGENT_RUNTIME=$MOSAIC_AGENT_RUNTIME"
  "MOSAIC_AGENT_MODEL=$MOSAIC_AGENT_MODEL"
@@ -14,82 +14,6 @@ fail() {
  exit 1
 }
 pane_command_clears_environment() {
  local calls_file="$1"
  local -a argv=()
  local index
  mapfile -d '' -t argv < "$calls_file"
  for ((index = 0; index + 1 < ${#argv[@]}; index++)); do
    if [ "${argv[$index]}" = /usr/bin/env ] && [ "${argv[$((index + 1))]}" = -i ]; then
      return 0
    fi
  done
  return 1
 }
 print_pane_argv() {
  local calls_file="$1"
  local -a argv=()
  local bytes index
  mapfile -d '' -t argv < "$calls_file"
  bytes=$(wc -c < "$calls_file")
  printf 'observed pane argv: records=%s bytes=%s\n' "${#argv[@]}" "$bytes" >&2
  for ((index = 0; index < ${#argv[@]}; index++)); do
    printf '  [%03d] %q\n' "$index" "${argv[$index]}" >&2
  done
 }
 check_pane_environment_boundary() {
  local calls_file="$1"
  if pane_command_clears_environment "$calls_file"; then
    return 0
  fi
  print_pane_argv "$calls_file"
  return 1
 }
 contains_literal() {
  grep -F -- "$2" <<< "$1" >/dev/null
 }
 contains_line() {
  grep -xF -- "$2" <<< "$1" >/dev/null
 }
 # Portability regression: inspect the authoritative NUL-delimited argv instead
 # of piping a newline reconstruction through `grep -q` under pipefail. The old
 # pipeline could report failure after a successful match when an upstream
 # producer received SIGPIPE. A large trailing argument keeps that failure class
 # covered without making stream size part of the semantic contract.
 PORTABILITY_CALLS="$ROOT/portability-calls"
 printf -v PORTABILITY_PADDING '%*s' 32768 ''
 PORTABILITY_PADDING=${PORTABILITY_PADDING// /x}
 printf '%s\0' /usr/bin/env -i "$PORTABILITY_PADDING" > "$PORTABILITY_CALLS"
 pane_command_clears_environment "$PORTABILITY_CALLS" || \
  fail "valid large pane argv was rejected by the environment-boundary assertion"
 assert_pane_boundary_rejected() {
  local case_name="$1"
  local expected_records="$2"
  local diagnostic
  if diagnostic=$(check_pane_environment_boundary "$PORTABILITY_CALLS" 2>&1); then
    fail "pane boundary accepted invalid $case_name fixture"
  fi
  contains_literal "$diagnostic" "records=$expected_records bytes=" || \
    fail "pane argv diagnostic omitted counts for $case_name fixture"
  contains_literal "$diagnostic" '[000]' || \
    fail "pane argv diagnostic omitted indexed arguments for $case_name fixture"
 }
 printf '%s\0' tmux -i > "$PORTABILITY_CALLS"
 assert_pane_boundary_rejected missing-env 2
 printf '%s\0' /usr/bin/env HOME=/untrusted > "$PORTABILITY_CALLS"
 assert_pane_boundary_rejected missing-i 2
 printf '%s\0' /usr/bin/env HOME=/untrusted -i > "$PORTABILITY_CALLS"
 assert_pane_boundary_rejected non-adjacent-i 3
 printf '%s\0' -i /usr/bin/env > "$PORTABILITY_CALLS"
 assert_pane_boundary_rejected reversed-boundary 2
 cat > "$FAKE_BIN/tmux" <<'SHIM'
 #!/usr/bin/env bash
 set -euo pipefail
@@ -138,19 +62,6 @@ env -0 > "${MOSAIC_HOME:?}/fleet/pane-environment"
 SHIM
 chmod +x "$FAKE_BIN/mosaic"
 # Freeze numeric epoch reads only when a test arm supplies an observation bound.
 # Formatting reads still use the real BusyBox/POSIX date implementation.
 cat > "$FAKE_BIN/date" <<'SHIM'
 #!/usr/bin/env bash
 set -euo pipefail
 if [ -n "${MOSAIC_TEST_FIXED_EPOCH:-}" ] && [ "${1:-}" = '+%s' ]; then
  printf '%s\n' "$MOSAIC_TEST_FIXED_EPOCH"
  exit 0
 fi
 exec /bin/date "$@"
 SHIM
 chmod +x "$FAKE_BIN/date"
 write_generated() {
  local home="$1"
  local agent="$2"
@@ -160,7 +71,6 @@ write_generated() {
  chmod 600 "$home/fleet/run/holder-owner"
  cat > "$home/fleet/agents/$agent.env.generated" <<EOF
 MOSAIC_AGENT_NAME=$agent
 MOSAIC_GIT_IDENTITY=$agent
 MOSAIC_AGENT_CLASS=code
 MOSAIC_AGENT_RUNTIME=pi
 MOSAIC_AGENT_MODEL=openai-codex/gpt-5.6-sol
@@ -178,7 +88,6 @@ run_start() {
  local agent="$2"
  HOME="$home" PATH="$FAKE_BIN:$PATH" MOSAIC_TEST_TMUX_CALLS="$TMUX_CALLS" \
    MOSAIC_TEST_PANE_PID="${MOSAIC_TEST_PANE_PID:-}" \
    MOSAIC_TEST_FIXED_EPOCH="${MOSAIC_TEST_FIXED_EPOCH:-}" \
    MOSAIC_TEST_HOME="$home" \
    MOSAIC_TEST_FLEET_OWNER=123e4567-e89b-12d3-a456-426614174000 \
    MOSAIC_HOME="$home" "$START" "$agent"
@@ -191,55 +100,19 @@ AGENT_VALID="coder0"
 write_generated "$HOME_VALID" "$AGENT_VALID"
 run_start "$HOME_VALID" "$AGENT_VALID"
 valid_args=$(tr '\0' '\n' < "$TMUX_CALLS")
-contains_literal "$valid_args" new-session || fail "valid generated projection did not reach tmux"
+echo "$valid_args" | grep -qF new-session || fail "valid generated projection did not reach tmux"
-contains_literal "$valid_args" mosaic || fail "fixed mosaic launcher command missing"
+echo "$valid_args" | grep -qF 'mosaic' || fail "fixed mosaic launcher command missing"
-contains_literal "$valid_args" yolo || fail "fixed yolo launcher command missing"
+echo "$valid_args" | grep -qF 'yolo' || fail "fixed yolo launcher command missing"
-contains_literal "$valid_args" pi || fail "roster runtime missing"
+echo "$valid_args" | grep -qF 'pi' || fail "roster runtime missing"
-if contains_literal "$valid_args" 'bash -c'; then
+if echo "$valid_args" | grep -qF 'bash -c'; then
  fail "launcher constructed a shell command payload"
 fi
 # The pane must start through an absolute clean-environment boundary. Its
 # runtime command remains an argv vector, but no holder/session environment
 # control variable can pass through the pane command.
-check_pane_environment_boundary "$TMUX_CALLS" || \
+echo "$valid_args" | grep -qxF '/usr/bin/env' || fail "pane does not use absolute env"
-  fail "pane command did not use an adjacent /usr/bin/env -i boundary"
+echo "$valid_args" | grep -qxF -- '-i' || fail "pane environment is not cleared"
 # Git identity is generated authority, not an optional or independently mutable
 # local value. Each invalid form must fail before fake tmux receives a call.
 assert_git_identity_rejected() {
  local case_name="$1"
  local expected_code="$2"
  local home="$ROOT/git-identity-$case_name"
  local agent="coder-git-identity-$case_name"
  local generated="$home/fleet/agents/$agent.env.generated"
  write_generated "$home" "$agent"
  case "$case_name" in
    missing) grep -v '^MOSAIC_GIT_IDENTITY=' "$generated" > "$generated.next" && mv "$generated.next" "$generated" ;;
    unsafe) sed -i 's|^MOSAIC_GIT_IDENTITY=.*$|MOSAIC_GIT_IDENTITY=bad/identity|' "$generated" ;;
    mismatch) sed -i 's|^MOSAIC_GIT_IDENTITY=.*$|MOSAIC_GIT_IDENTITY=other-agent|' "$generated" ;;
    local-shadow)
      printf 'MOSAIC_GIT_IDENTITY=%s\n' "$agent" > "$home/fleet/agents/$agent.env.local"
      chmod 600 "$home/fleet/agents/$agent.env.local"
      ;;
    *) fail "unknown Git identity rejection case: $case_name" ;;
  esac
  chmod 600 "$generated"
  : > "$TMUX_CALLS"
  if output=$(run_start "$home" "$agent" 2>&1); then
    fail "Git identity case $case_name was accepted"
  fi
  [ ! -s "$TMUX_CALLS" ] || fail "tmux ran before Git identity $case_name rejection"
  contains_literal "$output" "code=$expected_code" || \
    fail "Git identity $case_name diagnostic omitted code $expected_code"
 }
 assert_git_identity_rejected missing missing-key
 assert_git_identity_rejected unsafe unsafe-git-identity
 assert_git_identity_rejected mismatch git-identity-mismatch
 assert_git_identity_rejected local-shadow generated-key-shadow
 # The generated-file parent is a security boundary too: even a private regular
 # file is untrusted if its parent can be replaced or written by another user.
@@ -252,7 +125,7 @@ if output=$(run_start "$HOME_UNSAFE_PARENT" coder-parent 2>&1); then
  fail "generated file under a world-writable parent was accepted"
 fi
 [ ! -s "$TMUX_CALLS" ] || fail "tmux ran before unsafe parent rejection"
-contains_literal "$output" 'code=unsafe-permissions' || fail "unsafe parent diagnostic missing"
+echo "$output" | grep -qF 'code=unsafe-permissions' || fail "unsafe parent diagnostic missing"
 : > "$TMUX_CALLS"
 HOME_SYMLINK_PARENT="$ROOT/symlink-parent"
@@ -263,7 +136,7 @@ if output=$(run_start "$HOME_SYMLINK_PARENT" coder-symlink-parent 2>&1); then
  fail "generated file under a symlinked parent was accepted"
 fi
 [ ! -s "$TMUX_CALLS" ] || fail "tmux ran before symlinked parent rejection"
-contains_literal "$output" 'code=unsafe-directory' || fail "symlinked parent diagnostic missing"
+echo "$output" | grep -qF 'code=unsafe-directory' || fail "symlinked parent diagnostic missing"
 # Every managed ancestor is a boundary: MOSAIC_HOME, fleet, and agents. A
 # symlink or group/world-writable ancestor must fail before environment parsing,
@@ -301,8 +174,8 @@ assert_managed_ancestor_rejected() {
  fi
  [ ! -s "$TMUX_CALLS" ] || fail "tmux ran before $hazard $ancestor rejection"
  [ ! -e "$home/work" ] || fail "workdir was created before $hazard $ancestor rejection"
-  contains_literal "$output" 'code=unsafe-' || fail "managed ancestor diagnostic missing"
+  echo "$output" | grep -qF "code=unsafe-" || fail "managed ancestor diagnostic missing"
-  if contains_literal "$output" 'key=MOSAIC_AGENT_COMMAND'; then
+  if echo "$output" | grep -qF 'key=MOSAIC_AGENT_COMMAND'; then
    fail "environment parsing ran before $hazard $ancestor rejection"
  fi
 }
@@ -323,9 +196,9 @@ if output=$(run_start "$HOME_SHADOW" coder1 2>&1); then
  fail "generated-key shadow was accepted"
 fi
 [ ! -s "$TMUX_CALLS" ] || fail "tmux ran before generated-key shadow rejection"
-contains_literal "$output" 'key=MOSAIC_AGENT_RUNTIME' || fail "shadow diagnostic omitted key"
+echo "$output" | grep -qF 'key=MOSAIC_AGENT_RUNTIME' || fail "shadow diagnostic omitted key"
-contains_literal "$output" 'sha256=' || fail "shadow diagnostic omitted hash"
+echo "$output" | grep -qF 'sha256=' || fail "shadow diagnostic omitted hash"
-if contains_literal "$output" codex; then
+if echo "$output" | grep -qF 'codex'; then
  fail "shadow diagnostic leaked value"
 fi
@@ -341,9 +214,9 @@ if output=$(run_start "$HOME_COMMAND" coder2 2>&1); then
  fail "arbitrary command override was accepted"
 fi
 [ ! -s "$TMUX_CALLS" ] || fail "tmux ran before command rejection"
-contains_literal "$output" 'key=MOSAIC_AGENT_COMMAND' || fail "command diagnostic omitted key"
+echo "$output" | grep -qF 'key=MOSAIC_AGENT_COMMAND' || fail "command diagnostic omitted key"
-contains_literal "$output" 'sha256=' || fail "command diagnostic omitted hash"
+echo "$output" | grep -qF 'sha256=' || fail "command diagnostic omitted hash"
-if contains_literal "$output" "$COMMAND_VALUE"; then
+if echo "$output" | grep -qF "$COMMAND_VALUE"; then
  fail "command diagnostic leaked command value"
 fi
@@ -357,7 +230,7 @@ if output=$(run_start "$HOME_PERMS" coder3 2>&1); then
  fail "world-readable local input was accepted"
 fi
 [ ! -s "$TMUX_CALLS" ] || fail "tmux ran before permissions rejection"
-contains_literal "$output" 'code=unsafe-permissions' || fail "permission diagnostic missing"
+echo "$output" | grep -qF 'code=unsafe-permissions' || fail "permission diagnostic missing"
 # A unit/holder-like clean bootstrap must yield a pane with trusted HOME and
 # computed PATH only. The pane command itself must not carry loader, shell
@@ -387,35 +260,25 @@ PATH="$PANE_STALE_PATH" \
    MOSAIC_TEST_EXECUTE_PANE=1 \
    "$START" coder-pane-boundary
 pane_args=$(tr '\0' '\n' < "$TMUX_CALLS")
-contains_line "$pane_args" "HOME=$PANE_TRUSTED_HOME" || \
+echo "$pane_args" | grep -qxF "HOME=$PANE_TRUSTED_HOME" || \
  fail "pane did not restore trusted HOME"
-contains_literal "$pane_args" "HOME=$PANE_STALE_HOME" && \
+echo "$pane_args" | grep -qF "HOME=$PANE_STALE_HOME" && \
  fail "pane inherited stale HOME"
-contains_literal "$pane_args" "$PANE_STALE_PATH" && fail "pane inherited stale PATH"
+echo "$pane_args" | grep -qF "$PANE_STALE_PATH" && fail "pane inherited stale PATH"
 for blocked in LD_PRELOAD= BASH_ENV= MOSAIC_UNTRUSTED_SENTINEL=; do
-  contains_literal "$pane_args" "$blocked" && fail "pane inherited $blocked"
+  echo "$pane_args" | grep -qF "$blocked" && fail "pane inherited $blocked"
 done
-check_pane_environment_boundary "$TMUX_CALLS" || \
+after_pane_env=$(printf '%s\n' "$pane_args" | grep -n -m1 -F '/usr/bin/env' | cut -d: -f1)
-  fail "pane command did not use an adjacent /usr/bin/env -i boundary"
+[ -n "$after_pane_env" ] || fail "pane command did not use absolute env"
 printf '%s\n' "$pane_args" | tail -n +"$after_pane_env" | grep -qxF -- '-i' || \
  fail "pane command did not clear its environment"
 pane_environment=$(tr '\0' '\n' < "$HOME_PANE_BOUNDARY/fleet/pane-environment")
-# Exercise the repository launcher at $START, not the independently installed
+echo "$pane_environment" | grep -qxF "HOME=$PANE_TRUSTED_HOME" || \
 # host copy. Set-compare every declared generated projection entry with the
 # launched process environment so a newly declared identity cannot be omitted
 # by a hand-maintained per-variable assertion.
 declared_generated_environment=$(sort "$HOME_PANE_BOUNDARY/fleet/agents/coder-pane-boundary.env.generated")
 missing_or_changed_generated_environment=$(comm -23 \
  <(printf '%s\n' "$declared_generated_environment") \
  <(printf '%s\n' "$pane_environment" | sort))
 if [ -n "$missing_or_changed_generated_environment" ]; then
  missing_or_changed_keys=$(printf '%s\n' "$missing_or_changed_generated_environment" | cut -d= -f1 | paste -sd, -)
  fail "runtime pane omitted or changed generated environment keys: $missing_or_changed_keys"
 fi
 contains_line "$pane_environment" "HOME=$PANE_TRUSTED_HOME" || \
  fail "runtime pane did not receive trusted HOME"
-contains_literal "$pane_environment" "$PANE_STALE_PATH" && fail "runtime pane received stale PATH"
+echo "$pane_environment" | grep -qF "$PANE_STALE_PATH" && fail "runtime pane received stale PATH"
 for blocked in LD_PRELOAD= BASH_ENV= MOSAIC_UNTRUSTED_SENTINEL=; do
-  contains_literal "$pane_environment" "$blocked" && fail "runtime pane received $blocked"
+  echo "$pane_environment" | grep -qF "$blocked" && fail "runtime pane received $blocked"
 done
 write_interaction_generated() {
@@ -427,7 +290,6 @@ write_interaction_generated() {
  chmod 600 "$home/fleet/run/holder-owner"
  cat > "$home/fleet/agents/$agent.env.generated" <<EOF
 MOSAIC_AGENT_NAME=$agent
 MOSAIC_GIT_IDENTITY=$agent
 MOSAIC_AGENT_CLASS=operator-interaction
 MOSAIC_AGENT_RUNTIME=pi
 MOSAIC_AGENT_MODEL=openai/gpt-5.6-sol
@@ -490,12 +352,8 @@ write_generated "$HOME_NATIVE_STALE" "coder-native-stale"
 write_heartbeat_local "$HOME_NATIVE_STALE" "coder-native-stale"
 STALE_HB="$HOME_NATIVE_STALE/run/coder-native-stale.hb"
 printf 'ts=native\npid=1\nstatus=busy\nmodel=stale-model\n' > "$STALE_HB"
-touch -t 200001010000.00 "$STALE_HB.native"
+touch -d '10 seconds ago' "$STALE_HB.native"
-# Hold the sidecar's observation epoch constant: assertion runtime must not age
+MOSAIC_TEST_PANE_PID=$$ run_start "$HOME_NATIVE_STALE" coder-native-stale
 # a fresh-marker mutant into the stale state that this fixture must distinguish.
 STALE_OBSERVATION_EPOCH=$(date +%s)
 MOSAIC_TEST_FIXED_EPOCH="$STALE_OBSERVATION_EPOCH" \
  MOSAIC_TEST_PANE_PID=$$ run_start "$HOME_NATIVE_STALE" coder-native-stale
 wait_for_sidecar_status "$STALE_HB"
 HOME_NATIVE_ABSENT="$ROOT/native-absent"
@@ -516,22 +374,22 @@ if output=$(run_interaction "$HOME_INTERACTION_MALFORMED" interaction-malformed
  fail "interaction wrapper accepted malformed generated data"
 fi
 [ ! -s "$TMUX_CALLS" ] || fail "tmux ran before interaction strict-parser rejection"
-contains_literal "$output" 'code=unknown-key' || fail "interaction did not use shared strict parser first"
+echo "$output" | grep -qF 'code=unknown-key' || fail "interaction did not use shared strict parser first"
 # A syntactically valid but policy-incompatible projection reaches the pinned
 # interaction policy check only after strict parsing and never starts tmux.
 : > "$TMUX_CALLS"
 HOME_INTERACTION_POLICY="$ROOT/interaction-policy"
 write_interaction_generated "$HOME_INTERACTION_POLICY" "interaction-policy"
-sed -i 's|^MOSAIC_AGENT_RUNTIME=pi$|MOSAIC_AGENT_RUNTIME=codex|' \
+perl -0pi -e 's/MOSAIC_AGENT_RUNTIME=pi/MOSAIC_AGENT_RUNTIME=codex/' \
  "$HOME_INTERACTION_POLICY/fleet/agents/interaction-policy.env.generated"
 if output=$(run_interaction "$HOME_INTERACTION_POLICY" interaction-policy 2>&1); then
  fail "interaction wrapper accepted a policy-incompatible projection"
 fi
 interaction_policy_args=$(tr '\0' '\n' < "$TMUX_CALLS")
-contains_literal "$interaction_policy_args" new-session && \
+echo "$interaction_policy_args" | grep -qF 'new-session' && \
  fail "interaction pinned-policy rejection created a tmux session"
-contains_literal "$output" 'operator interaction service requires runtime pi' || \
+echo "$output" | grep -qF 'operator interaction service requires runtime pi' || \
  fail "interaction pinned-policy check did not follow strict parsing"
 # Exact stop derives the socket exclusively from the validated generated
@@ -544,10 +402,10 @@ HOME="$HOME_STOP" PATH="$FAKE_BIN:$PATH" MOSAIC_TEST_TMUX_CALLS="$TMUX_CALLS" \
  MOSAIC_TEST_FLEET_OWNER=123e4567-e89b-12d3-a456-426614174000 \
  MOSAIC_HOME="$HOME_STOP" MOSAIC_TMUX_SOCKET=ambient-socket "$START" --stop coder-stop
 stop_args=$(tr '\0' '\n' < "$TMUX_CALLS")
-contains_line "$stop_args" mosaic-test || fail "exact stop did not use the validated generated socket"
+echo "$stop_args" | grep -qxF 'mosaic-test' || fail "exact stop did not use the validated generated socket"
-contains_line "$stop_args" kill-session || fail "exact stop did not request session termination"
+echo "$stop_args" | grep -qxF 'kill-session' || fail "exact stop did not request session termination"
-contains_line "$stop_args" '=coder-stop' || fail "exact stop did not exact-match the generated agent name"
+echo "$stop_args" | grep -qxF '=coder-stop' || fail "exact stop did not exact-match the generated agent name"
-if contains_literal "$stop_args" ambient-socket; then
+if echo "$stop_args" | grep -qF 'ambient-socket'; then
  fail "exact stop trusted an ambient socket"
 fi
@@ -5,10 +5,7 @@
 detect_platform() {
    local remote_url
-    # `|| true` is load-bearing under `set -e`: outside a git repo this returns 128 and
+    remote_url=$(git remote get-url origin 2>/dev/null)
    # kills the CALLER before the -z check below can run, so the error message that is
    # already written here was unreachable. Same idiom as get_gitea_repo_args() below.
    remote_url=$(git remote get-url origin 2>/dev/null) || true
    if [[ -z "$remote_url" ]]; then
        echo "error: not a git repository or no origin remote" >&2
@@ -42,10 +39,7 @@ detect_platform() {
 get_repo_info() {
    local remote_url
-    # `|| true` is load-bearing under `set -e`: outside a git repo this returns 128 and
+    remote_url=$(git remote get-url origin 2>/dev/null)
    # kills the CALLER before the -z check below can run, so the error message that is
    # already written here was unreachable. Same idiom as get_gitea_repo_args() below.
    remote_url=$(git remote get-url origin 2>/dev/null) || true
    if [[ -z "$remote_url" ]]; then
        echo "error: not a git repository or no origin remote" >&2
@@ -246,21 +240,6 @@ PY
    } >&2
 }
 # Explain tea's most misleading failure. `user does not exist [uid: 0, name: ]` reads
 # as a missing account; it almost always means a REVOKED OR STALE TOKEN. `tea login`
 # keeps its OWN COPY of the token, so rotating the credential store does not update it.
 # Diagnostic only -- stderr, no control flow, no exit.
 explain_tea_user_does_not_exist() {
    cat >&2 <<'MSG'
 NOTE: `user does not exist [uid: 0, name: ]` from tea usually means a REVOKED OR STALE TOKEN,
      not a missing account. A `tea login` stores its OWN COPY of the token; rotating the
      credential store does NOT update it.
      CHECK: the login's cached copy (`tea login list` -- read the FULL table, never `| head`),
             then re-register that login against the current token.
      DO NOT probe capability with a mutating request; a POST is the action, not a check.
 MSG
 }
 get_gitea_login_for_host() {
    local host="${1:-}"
    local login
@@ -91,32 +91,13 @@ elif [[ "$PLATFORM" == "gitea" ]]; then
    GITEA_LOGIN_NAME=$(get_gitea_login || true)
    if [[ -n "$GITEA_LOGIN_NAME" ]]; then
        if [[ -n "$COMMENT" ]]; then
-            # `tea issue comment` is NOT a subcommand -- tea 0.11.x lists only
+            tea issue comment "$ISSUE_NUMBER" "$COMMENT" --repo "$OWNER/$REPO" --login "$GITEA_LOGIN_NAME"
            # list/create/edit/reopen/close under `tea issue`. Comments are the
            # TOP-LEVEL `tea comment`, which takes the same --repo/--login flags.
            # The old call therefore always failed, was unchecked, and the script
            # closed the issue anyway, losing the record of WHY.
            #
            # Use `tea comment` rather than the API helper so the comment and the
            # close are made by the SAME principal ($GITEA_LOGIN_NAME). Routing the
            # comment through the token-authenticated helper here would attribute the
            # comment to the token holder and the close to the tea login -- two
            # principals for one operation.
            tea comment "$ISSUE_NUMBER" "$COMMENT" --repo "$OWNER/$REPO" --login "$GITEA_LOGIN_NAME" || {
                echo "Error: failed to post comment on #$ISSUE_NUMBER -- NOT closing (fail closed)." >&2
                exit 1
            }
        fi
        tea issue close "$ISSUE_NUMBER" --repo "$OWNER/$REPO" --login "$GITEA_LOGIN_NAME"
    else
        echo "No tea login configured for $(get_remote_host); using authenticated Gitea API fallback." >&2
        if [[ -n "$COMMENT" ]]; then
-            # Fail closed here too: an unchecked comment lets the issue close without its
+            gitea_issue_comment_api
            # audit trail, which is the same defect as the tea path above.
            gitea_issue_comment_api || {
                echo "Error: failed to post comment on #$ISSUE_NUMBER -- NOT closing (fail closed)." >&2
                exit 1
            }
        fi
        gitea_issue_close_api
    fi
@@ -156,7 +156,6 @@ case "$PLATFORM" in
                exit 0
            fi
            echo "Warning: tea issue create failed, trying Gitea API fallback..." >&2
            { declare -F explain_tea_user_does_not_exist >/dev/null && explain_tea_user_does_not_exist; } || true
        fi
        gitea_issue_create_api
        ;;
@@ -71,7 +71,6 @@ elif [[ "$PLATFORM" == "gitea" ]]; then
            exit 0
        fi
        echo "Warning: tea issue view failed, trying Gitea API fallback..." >&2
        { declare -F explain_tea_user_does_not_exist >/dev/null && explain_tea_user_does_not_exist; } || true
    fi
    gitea_issue_view_api
 else
@@ -84,7 +84,7 @@ cp "$TARGET" "$BAK"
 export MOSAIC_TEST_WORK_DIR="$WORK/.work"
 # --- where the prose lives: usage() { ... EOF ---------------------------------
-PROSE_LO="$(grep -n -m1 '^usage() {' "$BAK" | cut -d: -f1)"
+PROSE_LO="$(grep -n '^usage() {' "$BAK" | head -1 | cut -d: -f1)"
 PROSE_HI="$(awk -v lo="$PROSE_LO" 'NR > lo && /^EOF$/ { print NR; exit }' "$BAK")"
 if [[ -z "$PROSE_LO" || -z "$PROSE_HI" ]]; then
    echo "!! cannot locate the usage() heredoc -- the prose guard would be inert; refusing" >&2
@@ -219,7 +219,6 @@ case "$PLATFORM" in
            exit 0
        fi
        echo "Warning: tea pr create failed, trying Gitea API fallback..." >&2
        { declare -F explain_tea_user_does_not_exist >/dev/null && explain_tea_user_does_not_exist; } || true
        gitea_pr_create_api
        ;;
    *)
@@ -1,6 +1,6 @@
 #!/bin/bash
 # pr-merge.sh - Merge pull requests on Gitea or GitHub
-# Usage: pr-merge.sh -n PR_NUMBER [-m squash] [-d] [--expect-head SHA] [--co-author-trailers --escalate-to PRINCIPAL]
+# Usage: pr-merge.sh -n PR_NUMBER [-m squash] [-d]
 set -euo pipefail
@@ -14,8 +14,6 @@ MERGE_METHOD="squash"
 DELETE_BRANCH=false
 DRY_RUN=false
 EXPECT_HEAD=""
 CO_AUTHOR_TRAILERS=false
 ESCALATE_TO=""
 usage() {
    cat <<EOF
@@ -29,16 +27,12 @@ Options:
    -d, --delete-branch     Delete the head branch after merge
        --dry-run           Run metadata/login preflight without merging
        --expect-head SHA   Refuse unless the PR head matches this full commit SHA
        --co-author-trailers Build verified trailers from linked PR commit authors
        --escalate-to NAME  Named principal for an unresolved-author BLOCK
    -h, --help              Show this help message
 Examples:
    $(basename "$0") -n 42                    # Merge PR #42
    $(basename "$0") -n 42 -m squash          # Squash merge
    $(basename "$0") -n 42 -d                 # Squash merge and delete branch
    $(basename "$0") -n 42 --expect-head 0123456789abcdef0123456789abcdef01234567
    $(basename "$0") -n 42 --co-author-trailers --escalate-to tl-mosaic
 EOF
    exit "${1:-1}"
 }
@@ -63,25 +57,9 @@ while [[ $# -gt 0 ]]; do
            shift
            ;;
        --expect-head)
            if [[ $# -lt 2 ]]; then
                echo "Error: --expect-head requires one full commit SHA." >&2
                exit 1
            fi
            EXPECT_HEAD="$2"
            shift 2
            ;;
        --co-author-trailers)
            CO_AUTHOR_TRAILERS=true
            shift
            ;;
        --escalate-to)
            if [[ $# -lt 2 ]]; then
                echo "Error: --escalate-to requires one principal name." >&2
                exit 1
            fi
            ESCALATE_TO="$2"
            shift 2
            ;;
        -h|--help)
            usage 0
            ;;
@@ -110,30 +88,17 @@ if [[ -n "$EXPECT_HEAD" && ! "$EXPECT_HEAD" =~ ^[0-9a-fA-F]{40}$ ]]; then
    echo "Error: --expect-head must be a full 40-character hexadecimal commit SHA." >&2
    exit 1
 fi
 if [[ "$CO_AUTHOR_TRAILERS" == true && -z "$ESCALATE_TO" ]]; then
    echo "Error: --co-author-trailers requires --escalate-to with a named principal." >&2
    exit 1
 fi
 if [[ -n "$ESCALATE_TO" && ! "$ESCALATE_TO" =~ ^[A-Za-z0-9_.-]+$ ]]; then
    echo "Error: --escalate-to must be one exact principal name." >&2
    exit 1
 fi
 if [[ "$CO_AUTHOR_TRAILERS" != true && -n "$ESCALATE_TO" ]]; then
    echo "Error: --escalate-to is valid only with --co-author-trailers." >&2
    exit 1
 fi
 PR_METADATA="$("$SCRIPT_DIR/pr-metadata.sh" -n "$PR_NUMBER")"
 BASE_BRANCH="$(printf '%s' "$PR_METADATA" | python3 -c 'import json, sys; print((json.load(sys.stdin).get("baseRefName") or "").strip())')"
 HEAD_BRANCH="$(printf '%s' "$PR_METADATA" | python3 -c 'import json, sys; print((json.load(sys.stdin).get("headRefName") or "").strip())')"
 HEAD_SHA="$(printf '%s' "$PR_METADATA" | python3 -c 'import json, sys; print((json.load(sys.stdin).get("headRefOid") or "").strip())')"
 HEAD_REPO="$(printf '%s' "$PR_METADATA" | python3 -c 'import json, sys; value=json.load(sys.stdin).get("headRepository") or ""; print((value.get("nameWithOwner") or value.get("full_name") or "") if isinstance(value, dict) else str(value).strip())')"
 PR_TITLE="$(printf '%s' "$PR_METADATA" | python3 -c 'import json, sys; print((json.load(sys.stdin).get("title") or "").strip())')"
 PR_AUTHOR="$(printf '%s' "$PR_METADATA" | python3 -c 'import json, sys; value=json.load(sys.stdin).get("author") or ""; print((value.get("login") or "").strip() if isinstance(value, dict) else str(value).strip())')"
 if [[ "$BASE_BRANCH" != "main" ]]; then
    echo "Error: Mosaic policy allows merges only for PRs targeting 'main' (found '$BASE_BRANCH')." >&2
    exit 1
 fi
 if [[ -z "$HEAD_BRANCH" || -z "$HEAD_REPO" || ! "$HEAD_SHA" =~ ^[0-9a-fA-F]{40}$ ]]; then
    echo "Error: Could not resolve the PR head branch, repository, and full commit SHA for queue inspection." >&2
    exit 1
@@ -157,442 +122,70 @@ PLATFORM=$(detect_platform)
 OWNER=$(get_repo_owner)
 REPO=$(get_repo_name)
-write_curl_auth_config() {
+merge_gitea_with_api() {
-    local mode="$1" credential="$2"
+    local host="$1" api_url token basic_auth body_file raw_code payload
    printf '%s' "$credential" | python3 -c '
 import sys
 mode = sys.argv[1]
 credential = sys.stdin.read()
 if not credential or any(char in credential for char in "\r\n"):
    raise SystemExit(1)
 escaped = credential.replace("\\", "\\\\").replace("\"", "\\\"")
 if mode == "token":
    print(f"header = \"Authorization: token {escaped}\"")
 elif mode == "basic":
    print(f"user = \"{escaped}\"")
 else:
    raise SystemExit(1)
 ' "$mode"
 }
 LAST_GITEA_HTTP_CODE="000"
 LAST_GITEA_ERROR=""
 MERGE_TEMP_DIRS=()
 GITEA_CURL_MAX_BYTES="${MOSAIC_GITEA_CURL_MAX_BYTES:-1048576}"
 GITEA_CURL_MAX_TIME="${MOSAIC_GITEA_CURL_MAX_TIME_SEC:-30}"
 GITEA_CURL_CONNECT_TIMEOUT="${MOSAIC_GITEA_CURL_CONNECT_TIMEOUT_SEC:-10}"
 for bound in "$GITEA_CURL_MAX_BYTES" "$GITEA_CURL_MAX_TIME" "$GITEA_CURL_CONNECT_TIMEOUT"; do
    if [[ ! "$bound" =~ ^[1-9][0-9]*$ ]]; then
        echo "Error: Gitea curl bounds must be positive integers; refusing request." >&2
        exit 1
    fi
 done
 GITEA_CURL_BOUNDS=(
    --max-filesize "$GITEA_CURL_MAX_BYTES"
    --max-time "$GITEA_CURL_MAX_TIME"
    --connect-timeout "$GITEA_CURL_CONNECT_TIMEOUT"
 )
 format_gitea_error_response() {
    local response_file="$1"
    python3 - "$response_file" <<'PY'
 import json
 import sys
 with open(sys.argv[1], "rb") as handle:
    raw = handle.read(65536)
 try:
    response = json.loads(raw.decode("utf-8", errors="replace"))
 except (UnicodeDecodeError, json.JSONDecodeError):
    message = "non-JSON response omitted"
 else:
    if isinstance(response, dict):
        message = response.get("message") or response.get("error")
        if not message and response.get("errors") is not None:
            message = json.dumps(response["errors"], separators=(",", ":"))
    else:
        message = None
    if not message:
        message = "JSON response contained no error message"
 message = str(message)
 if len(message) > 500:
    message = message[:500] + "..."
 print(ascii(message))
 PY
 }
 cleanup_merge_temp_dirs() {
    local path
    for path in "${MERGE_TEMP_DIRS[@]}"; do
        [[ -n "$path" ]] && rm -rf -- "$path"
    done
 }
 trap cleanup_merge_temp_dirs EXIT
 trap 'exit 130' INT
 trap 'exit 143' TERM
 fetch_gitea_pr_head() {
    local host="$1" auth_mode="$2" credential="$3" work_root="$4"
    local response_file raw_code api_url auth_config curl_rc
    response_file=$(mktemp "$work_root/pr-merge-pr.XXXXXX")
    api_url="https://${host}/api/v1/repos/${OWNER}/${REPO}/pulls/${PR_NUMBER}"
    if ! auth_config=$(write_curl_auth_config "$auth_mode" "$credential"); then
        echo "Error: Could not construct Gitea authentication config; refusing request." >&2
        rm -f "$response_file"
        return 1
    fi
    raw_code=$(curl -sS -K - "${GITEA_CURL_BOUNDS[@]}" -w '%{http_code}' -o "$response_file" \
        -H "User-Agent: curl/8" "$api_url" <<<"$auth_config")
    curl_rc=$?
    LAST_GITEA_HTTP_CODE="${raw_code:-000}"
    if [[ "$curl_rc" -ne 0 ]]; then
        LAST_GITEA_ERROR="curl transport failed (rc=$curl_rc)"
        rm -f "$response_file"
        return 1
    fi
    if [[ ! "$raw_code" =~ ^2 ]]; then
        LAST_GITEA_ERROR=$(format_gitea_error_response "$response_file")
        rm -f "$response_file"
        return 1
    fi
    if ! python3 - "$response_file" <<'PY'
 import json
 import re
 import sys
 with open(sys.argv[1], encoding="utf-8") as handle:
    pull = json.load(handle)
 head = pull.get("head") if isinstance(pull, dict) else None
 sha = str(head.get("sha") or "") if isinstance(head, dict) else ""
 if not re.fullmatch(r"[0-9a-fA-F]{40}", sha):
    raise SystemExit(1)
 print(sha)
 PY
    then
        echo "Error: Gitea PR response has no valid head SHA; refusing merge." >&2
        rm -f "$response_file"
        return 1
    fi
    rm -f "$response_file"
 }
 fetch_gitea_pr_commits() {
    local host="$1" auth_mode="$2" credential="$3" work_root="$4"
    local page page_file combined_file merged_file raw_code page_count api_url auth_config curl_rc
    mkdir -p "$work_root"
    if ! auth_config=$(write_curl_auth_config "$auth_mode" "$credential"); then
        echo "Error: Could not construct Gitea authentication config; refusing request." >&2
        return 1
    fi
    combined_file=$(mktemp "$work_root/pr-merge-commits.XXXXXX")
    printf '[]' > "$combined_file"
    page=1
    while true; do
        page_file=$(mktemp "$work_root/pr-merge-commits-page.XXXXXX")
        api_url="https://${host}/api/v1/repos/${OWNER}/${REPO}/pulls/${PR_NUMBER}/commits?limit=50&page=${page}"
        raw_code=$(curl -sS -K - "${GITEA_CURL_BOUNDS[@]}" -w '%{http_code}' -o "$page_file" \
            -H "User-Agent: curl/8" "$api_url" <<<"$auth_config")
        curl_rc=$?
        LAST_GITEA_HTTP_CODE="${raw_code:-000}"
        if [[ "$curl_rc" -ne 0 ]]; then
            LAST_GITEA_ERROR="curl transport failed (rc=$curl_rc)"
            rm -f "$page_file" "$combined_file"
            return 1
        fi
        if [[ ! "$raw_code" =~ ^2 ]]; then
            LAST_GITEA_ERROR=$(format_gitea_error_response "$page_file")
            rm -f "$page_file" "$combined_file"
            return 1
        fi
        if ! page_count=$(python3 - "$page_file" <<'PY'
 import json
 import sys
 with open(sys.argv[1], encoding="utf-8") as handle:
    page = json.load(handle)
 if not isinstance(page, list):
    raise SystemExit(1)
 print(len(page))
 PY
        ); then
            echo "Error: Gitea PR commits response is not a JSON array; refusing merge." >&2
            rm -f "$page_file" "$combined_file"
            return 1
        fi
        merged_file=$(mktemp "$work_root/pr-merge-commits-merged.XXXXXX")
        if ! python3 - "$combined_file" "$page_file" > "$merged_file" <<'PY'
 import json
 import sys
 with open(sys.argv[1], encoding="utf-8") as handle:
    combined = json.load(handle)
 with open(sys.argv[2], encoding="utf-8") as handle:
    page = json.load(handle)
 json.dump(combined + page, sys.stdout, separators=(",", ":"))
 PY
        then
            echo "Error: Could not combine paginated PR commit metadata; refusing merge." >&2
            rm -f "$page_file" "$combined_file" "$merged_file"
            return 1
        fi
        mv "$merged_file" "$combined_file"
        rm -f "$page_file"
        if [[ "$page_count" -lt 50 ]]; then
            break
        fi
        page=$((page + 1))
        if [[ "$page" -gt 1000 ]]; then
            echo "Error: PR commit pagination exceeded 1000 pages; refusing merge." >&2
            rm -f "$combined_file"
            return 1
        fi
    done
    cat "$combined_file"
    rm -f "$combined_file"
 }
 # LIMITATION: author.login resolution proves the commit address maps to a registered account.
 # It does NOT prove the named principal authored the commit — git author metadata is self-asserted.
 # This gate checks ATTRIBUTION LINKAGE, not AUTHORSHIP. Commit signing is out of scope and unadopted.
 build_coauthor_message_fields() {
    local commits_file="$1" context_file="$2" head_file="$3"
    python3 - "$commits_file" "$context_file" "$head_file" <<'PY'
 import json
 import re
 import sys
 commits_path, context_path, head_path = sys.argv[1:]
 with open(commits_path, encoding="utf-8") as handle:
    commits = json.load(handle)
 head_sha = open(head_path, encoding="utf-8").read().strip()
 context_parts = open(context_path, "rb").read().split(b"\0")
 if len(context_parts) != 4 or context_parts[-1] != b"":
    raise SystemExit(1)
 poster, title, principal = (part.decode("utf-8") for part in context_parts[:3])
 if not isinstance(commits, list) or not commits:
    print(
        f"BLOCK: provider returned no PR commits; author identity is unmeasurable. "
        f"Refusing merge; escalate to named principal '{principal}'.",
        file=sys.stderr,
    )
    raise SystemExit(75)
 if not poster:
    print(
        f"BLOCK: PR poster login is empty; refusing merge; "
        f"escalate to named principal '{principal}'.",
        file=sys.stderr,
    )
    raise SystemExit(75)
 if not re.fullmatch(r"[0-9a-fA-F]{40}", head_sha):
    print(
        f"BLOCK: inspected PR head SHA is invalid; refusing merge; "
        f"escalate to named principal '{principal}'.",
        file=sys.stderr,
    )
    raise SystemExit(75)
 seen = set()
 trailers = []
 head_seen = False
 for item in commits:
    if not isinstance(item, dict):
        print(f"BLOCK: malformed PR commit metadata; escalate to named principal '{principal}'.", file=sys.stderr)
        raise SystemExit(75)
    sha = str(item.get("sha") or "<unknown>")
    if sha == head_sha:
        head_seen = True
    commit = item.get("commit") if isinstance(item.get("commit"), dict) else {}
    commit_author = commit.get("author") if isinstance(commit.get("author"), dict) else {}
    email = str(commit_author.get("email") or "").strip()
    provider_author = item.get("author") if isinstance(item.get("author"), dict) else {}
    login = str(provider_author.get("login") or "").strip()
    if not login:
        diagnostic_email = email or "<missing>"
        print(
            f"BLOCK: commit {sha!r} has author.login=NULL while "
            f"commit.author.email={diagnostic_email!r}; refusing merge; "
            f"escalate to named principal '{principal}'.",
            file=sys.stderr,
        )
        raise SystemExit(75)
    if (
        not email.isascii()
        or not email.isprintable()
        or not re.fullmatch(r"[A-Za-z0-9_.-]+", login)
        or not re.fullmatch(r"[^<>\s]+@[^<>\s]+", email)
    ):
        print(
            f"BLOCK: commit {sha!r} has unusable linked identity "
            f"author.login={login!r}, commit.author.email={email!r}; refusing merge; "
            f"escalate to named principal '{principal}'.",
            file=sys.stderr,
        )
        raise SystemExit(75)
    if login == poster or login in seen:
        continue
    seen.add(login)
    trailers.append(f"Co-authored-by: {login} <{email}>")
 if not head_seen:
    print(
        f"BLOCK: inspected PR head is absent from commit enumeration; refusing merge; "
        f"escalate to named principal '{principal}'.",
        file=sys.stderr,
    )
    raise SystemExit(75)
 if not trailers:
    print("{}")
    raise SystemExit(0)
 if not title:
    print(
        f"BLOCK: PR title is empty; refusing merge; escalate to named principal '{principal}'.",
        file=sys.stderr,
    )
    raise SystemExit(75)
 if not title.isprintable() or re.match(r"^[A-Za-z-]+-[Bb]y:", title):
    print(
        f"BLOCK: PR title is not one printable, non-trailer line; refusing merge; "
        f"escalate to named principal '{principal}'.",
        file=sys.stderr,
    )
    raise SystemExit(75)
 print(json.dumps({
    "MergeTitleField": title,
    "MergeMessageField": "\n".join(trailers),
 }, separators=(",", ":")))
 PY
 }
 merge_gitea_api_attempt() {
    local host="$1" auth_mode="$2" credential="$3"
    local api_url attempt_dir body_file raw_code commits_file fields_file context_file head_file payload_file work_root attempt_rc auth_config curl_rc
    LAST_GITEA_HTTP_CODE="000"
    LAST_GITEA_ERROR=""
    api_url="https://${host}/api/v1/repos/${OWNER}/${REPO}/pulls/${PR_NUMBER}/merge"
-    work_root="${AGENT_WORK_ROOT:-${HOME:-/tmp}/mosaic/agent-work}"
+    mkdir -p "${AGENT_WORK_ROOT:-${HOME:-/tmp}/mosaic/agent-work}"
-    mkdir -p "$work_root"
+    body_file=$(mktemp "${AGENT_WORK_ROOT:-${HOME:-/tmp}/mosaic/agent-work}/pr-merge-api-response.XXXXXX")
-    attempt_dir=$(mktemp -d "$work_root/pr-merge-attempt.XXXXXX")
+    payload=$(python3 - "$HEAD_SHA" "$DELETE_BRANCH" <<'PY'
    chmod 0700 "$attempt_dir"
    MERGE_TEMP_DIRS+=("$attempt_dir")
    body_file=$(mktemp "$attempt_dir/api-response.XXXXXX")
    fields_file=$(mktemp "$attempt_dir/message-fields.XXXXXX")
    payload_file=$(mktemp "$attempt_dir/payload.XXXXXX")
    printf '{}' > "$fields_file"
    if [[ "$CO_AUTHOR_TRAILERS" == true ]]; then
        commits_file=$(mktemp "$attempt_dir/pr-merge-commits-input.XXXXXX")
        context_file=$(mktemp "$attempt_dir/pr-merge-message-context.XXXXXX")
        head_file=$(mktemp "$attempt_dir/pr-merge-head-input.XXXXXX")
        printf '%s\0%s\0%s\0' "$PR_AUTHOR" "$PR_TITLE" "$ESCALATE_TO" > "$context_file"
        if fetch_gitea_pr_head "$host" "$auth_mode" "$credential" "$attempt_dir" > "$head_file"; then
            :
        else
            attempt_rc=$?
            rm -f "$body_file" "$fields_file" "$payload_file" "$commits_file" "$context_file" "$head_file"
            return "$attempt_rc"
        fi
        if [[ "$(<"$head_file")" != "$HEAD_SHA" ]]; then
            echo "BLOCK: authenticated PR head moved from reviewed $HEAD_SHA to $(<"$head_file"); refusing merge; escalate to named principal '$ESCALATE_TO'." >&2
            rm -f "$body_file" "$fields_file" "$payload_file" "$commits_file" "$context_file" "$head_file"
            return 75
        fi
        if fetch_gitea_pr_commits "$host" "$auth_mode" "$credential" "$attempt_dir" > "$commits_file"; then
            :
        else
            attempt_rc=$?
            rm -f "$body_file" "$fields_file" "$payload_file" "$commits_file" "$context_file" "$head_file"
            return "$attempt_rc"
        fi
        if build_coauthor_message_fields "$commits_file" "$context_file" "$head_file" > "$fields_file"; then
            :
        else
            attempt_rc=$?
            rm -f "$body_file" "$fields_file" "$payload_file" "$commits_file" "$context_file" "$head_file"
            return "$attempt_rc"
        fi
        rm -f "$commits_file" "$context_file" "$head_file"
    fi
    if ! python3 - "$fields_file" "$HEAD_SHA" "$DELETE_BRANCH" > "$payload_file" <<'PY'
 import json
 import sys
-with open(sys.argv[1], encoding="utf-8") as handle:
+head_sha, delete_branch = sys.argv[1:]
    fields = json.load(handle)
 head_sha, delete_branch = sys.argv[2:]
 payload = {"Do": "squash", "head_commit_id": head_sha}
 if delete_branch == "true":
    payload["delete_branch_after_merge"] = True
 payload.update(fields)
 allowed = {"Do", "head_commit_id", "delete_branch_after_merge", "MergeTitleField", "MergeMessageField"}
 if payload.get("Do") != "squash" or set(payload) - allowed:
    raise SystemExit(1)
 print(json.dumps(payload, separators=(",", ":")))
 PY
-    then
+)
        rm -f "$body_file" "$fields_file" "$payload_file"
        return 1
    fi
    rm -f "$fields_file"
-    if ! auth_config=$(write_curl_auth_config "$auth_mode" "$credential"); then
+    token=$(get_gitea_token "$host" || true)
-        echo "Error: Could not construct Gitea authentication config; refusing request." >&2
+    if [[ -n "$token" ]]; then
-        rm -f "$body_file" "$payload_file"
+        raw_code=$(curl -sS -w '%{http_code}' -o "$body_file" \
-        return 1
+            -X POST \
            -H "User-Agent: curl/8" \
            -H "Authorization: token $token" \
            -H 'Content-Type: application/json' \
            -d "$payload" \
            "$api_url" || true)
        if [[ "$raw_code" =~ ^2 ]]; then
            rm -f "$body_file"
            return 0
        fi
    fi
    raw_code=$(curl -sS -K - "${GITEA_CURL_BOUNDS[@]}" -w '%{http_code}' -o "$body_file" \
        -X POST -H "User-Agent: curl/8" \
        -H 'Content-Type: application/json' \
        --data-binary "@$payload_file" "$api_url" <<<"$auth_config")
    curl_rc=$?
    LAST_GITEA_HTTP_CODE="${raw_code:-000}"
    if [[ "$curl_rc" -ne 0 ]]; then
        LAST_GITEA_ERROR="curl transport failed (rc=$curl_rc)"
        rm -f "$body_file" "$payload_file"
        rm -rf -- "$attempt_dir"
        return 1
    fi
    if [[ ! "$raw_code" =~ ^2 ]]; then
        LAST_GITEA_ERROR=$(format_gitea_error_response "$body_file")
    fi
    rm -f "$body_file" "$payload_file"
    rm -rf -- "$attempt_dir"
    [[ "$raw_code" =~ ^2 ]]
 }
-merge_gitea_with_api() {
+    basic_auth=$(get_gitea_basic_auth "$host" || true)
-    local host="$1" token attempt_rc
+    if [[ -n "$basic_auth" ]]; then
        raw_code=$(curl -sS -w '%{http_code}' -o "$body_file" \
            -X POST \
            -u "$basic_auth" \
            -H "User-Agent: curl/8" \
            -H 'Content-Type: application/json' \
            -d "$payload" \
            "$api_url" || true)
        if [[ "$raw_code" =~ ^2 ]]; then
            rm -f "$body_file"
            return 0
        fi
    fi
-    if ! token=$(get_gitea_token "$host"); then
+    python3 - "${raw_code:-000}" "$body_file" <<'PY' >&2
-        echo "Error: Could not resolve the required Gitea token; refusing merge without changing principals." >&2
+import json
-        return 1
+import sys
-    fi
+code, path = sys.argv[1], sys.argv[2]
-    if [[ -z "$token" ]]; then
+try:
-        echo "Error: Required Gitea token resolved empty; refusing merge without changing principals." >&2
+    with open(path, encoding="utf-8", errors="replace") as handle:
-        return 1
+        raw = handle.read(500)
-    fi
+    data = json.loads(raw) if raw else {}
-    if merge_gitea_api_attempt "$host" token "$token"; then
+    message = data.get("message") or data.get("error") or raw or "empty response"
-        return 0
+except Exception:
-    else
+    try:
-        attempt_rc=$?
+        message = open(path, encoding="utf-8", errors="replace").read(500) or "empty response"
-    fi
+    except Exception:
-    if [[ "$attempt_rc" -eq 75 ]]; then
+        message = "unreadable response"
-        return 75
+print(f"Error: Gitea API merge failed with HTTP {code}: {message}")
-    fi
+PY
-    if [[ "$LAST_GITEA_HTTP_CODE" != "401" ]]; then
+    rm -f "$body_file"
        echo "Error: Gitea API merge failed with the identity-bound token (HTTP ${LAST_GITEA_HTTP_CODE:-000}).${LAST_GITEA_ERROR:+ Provider response: $LAST_GITEA_ERROR}" >&2
        return 1
    fi
    echo "Error: Gitea API rejected the identity-bound token with HTTP 401; refusing cross-principal credential fallback." >&2
    return 1
 }
@@ -602,10 +195,11 @@ if [[ "$DRY_RUN" == true ]]; then
            echo "Error: Cannot determine host from origin remote URL" >&2
            exit 1
        }
-        if [[ "$CO_AUTHOR_TRAILERS" == true ]]; then
+        TEA_LOGIN="$(get_gitea_login_for_host "$HOST" || true)"
-            echo "Dry run: would verify PR commit authors and merge PR #$PR_NUMBER on $HOST with authenticated Gitea API message fields (base=$BASE_BRANCH, method=squash)."
+        if [[ -n "$TEA_LOGIN" ]]; then
            echo "Dry run: would merge PR #$PR_NUMBER on $HOST with tea login '$TEA_LOGIN' (base=$BASE_BRANCH, method=squash)."
        else
-            echo "Dry run: would merge PR #$PR_NUMBER on $HOST with the authenticated exact-head Gitea API path (base=$BASE_BRANCH, method=squash)."
+            echo "Dry run: would merge PR #$PR_NUMBER on $HOST with authenticated Gitea API fallback (base=$BASE_BRANCH, method=squash)."
        fi
    else
        echo "Dry run: would merge PR #$PR_NUMBER on $PLATFORM (base=$BASE_BRANCH, method=squash)."
@@ -615,10 +209,6 @@ fi
 case "$PLATFORM" in
    github)
        if [[ "$CO_AUTHOR_TRAILERS" == true ]]; then
            echo "Error: --co-author-trailers currently requires the Gitea REST message-field contract." >&2
            exit 1
        fi
        cmd=(gh pr merge "$PR_NUMBER" --squash --match-head-commit "$HEAD_SHA")
        [[ "$DELETE_BRANCH" == true ]] && cmd+=(--delete-branch)
        "${cmd[@]}"
@@ -629,7 +219,7 @@ case "$PLATFORM" in
            exit 1
        }
        # Gitea's API head_commit_id is an atomic compare-and-merge precondition.
-        # tea cannot express it, so every Gitea merge uses the authenticated API path.
+        # tea cannot express it, so exact-head merges use the authenticated API path.
        merge_gitea_with_api "$HOST"
        ;;
    *)
@@ -1,58 +0,0 @@
 #!/bin/bash
 # Regression: detect_platform / get_repo_info must FAIL LOUDLY outside a git repo,
 # not kill the caller silently.
 #
 # Both functions already contained the right error path:
 #     if [[ -z "$remote_url" ]]; then echo "error: not a git repository..." >&2; return 1; fi
 # but under `set -e` -- which every wrapper in this directory uses -- the preceding
 # assignment `remote_url=$(git remote get-url origin 2>/dev/null)` returns git's 128
 # outside a repo and terminates the CALLER first. The message was unreachable.
 #
 # Observed cost: pr-review.sh invoked from a non-repo cwd exits 128 with NO stdout and
 # NO stderr, even when -r/--repo and -H/--host are supplied -- the flags documented as
 # "skips git-remote inference". Two reviewer seats hit this and correctly reported
 # `blocked` with no diagnostic to report.
 #
 # The control that matters is the LOUD one: asserting "rc != 0" passes on the broken
 # build too, because 128 is also non-zero. The test must assert the MESSAGE.
 set -uo pipefail
 fail=0
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
 run_outside() { # $1=function name -> "rc:sawmessage"
    local fn="$1" out rc
    out=$( cd "$TMP" && bash -c "set -e; source '$HERE/detect-platform.sh'; $fn" 2>&1 ); rc=$?
    printf '%s:%s' "$rc" "$(grep -qi 'not a git repository' <<<"$out" && echo yes || echo no)"
 }
 check() { if [ "$2" = "$3" ]; then echo "  PASS  $1 ($2)"; else echo "  FAIL  $1: got $2, want $3"; fail=1; fi; }
 # $TMP must not be inside a git repo. Do not SKIP on failure: be-coder-07 showed the
 # original SKIP exited 0, so pointing TMPDIR beneath a git worktree made this test PASS
 # against unchanged main. A skip that exits 0 is indistinguishable from a pass.
 # GIT_CEILING_DIRECTORIES stops git walking above $TMP, making the condition hold
 # regardless of where TMPDIR lives, rather than merely detecting when it does not.
 # GIT_CEILING_DIRECTORIES is matched against the PHYSICAL path -- a symlinked TMPDIR
 # (/tmp is commonly one) makes the logical path never match, and the ceiling silently
 # does nothing. Resolve it before exporting.
 TMP="$(cd "$TMP" && pwd -P)"
 export GIT_CEILING_DIRECTORIES="$TMP"
 if ( cd "$TMP" && git rev-parse --git-dir >/dev/null 2>&1 ); then
    echo "  FAIL  scratch dir is inside a git repo even with GIT_CEILING_DIRECTORIES set;"
    echo "        the outside-a-repo precondition cannot be established -- refusing to report a result"
    exit 1
 fi
 echo "== outside a git repo: rc=1 AND the diagnostic is emitted =="
 check "detect_platform" "$(run_outside detect_platform)" "1:yes"
 check "get_repo_info"   "$(run_outside get_repo_info)"   "1:yes"
 echo "== inside a git repo the functions still work =="
 git init -q "$TMP/repo" 2>/dev/null
 git -C "$TMP/repo" remote add origin https://git.mosaicstack.dev/mosaicstack/stack.git 2>/dev/null
 out=$( cd "$TMP/repo" && bash -c "set -e; source '$HERE/detect-platform.sh'; detect_platform" 2>&1 ); rc=$?
 if [ "$rc" -eq 0 ] && grep -qi 'gitea' <<<"$out"; then echo "  PASS  detect_platform in-repo (rc=0, $out)"
 else echo "  FAIL  detect_platform in-repo: rc=$rc out=$out"; fail=1; fi
 [ "$fail" -eq 0 ] && echo "OK  detect-platform fails loudly outside a repo" || echo "FAILED"
 exit "$fail"
@@ -1,64 +0,0 @@
 #!/bin/bash
 # Regression: the tea-failure diagnostic must be STATUS-NEUTRAL.
 #
 # Found by be-coder-08 reviewing PR #1086. At all three call sites the diagnostic is emitted
 # immediately BEFORE the Gitea API fallback. Written as the last command of an && list:
 #     declare -F explain_... >/dev/null && explain_...
 # under `set -e` a FAILING diagnostic exits and the fallback never runs -- a diagnostic that
 # suppresses the recovery path it exists to explain. It misbehaves ONLY when the helper is
 # PRESENT, so the helper-absent path (pre-#1086 behaviour) keeps working and reads as a
 # passing control.
 #
 # TWO DEFECTS IN THE FIRST VERSION OF THIS TEST, both found by be-coder-08:
 #   1. `out=$( ... ) 2>"$errto"` applies the redirection to the ASSIGNMENT, not to the
 #      command substitution, so the probe's stderr was never actually pointed at /dev/full
 #      and the /dev/full rows proved nothing. Verified: `out=$(echo x >&2) 2>/dev/full`
 #      leaks to the terminal and returns 0; the redirect must be INSIDE the substitution.
 #   2. `eval "$CONSTRUCT"` changes `set -e` semantics for a bare && list, so the probe did
 #      not exercise the construct as the shipped file executes it. It now writes the line
 #      into a real script and runs it -- same parse, same set -e rules, no eval.
 # The construct is still LIFTED FROM THE SHIPPED FILE: retyping the fixed form makes the
 # probe pass on a build whose real call sites still carry the bare && form.
 set -uo pipefail
 fail=0
 GIT_DIR_UNDER_TEST="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
 probe() { # $1=present|absent  $2=stderr target  $3=source file  -> "rc:fallback"
    local helper="$1" errto="$2" src="$3" construct script out rc
    construct=$(grep -m1 'explain_tea_user_does_not_exist' "$GIT_DIR_UNDER_TEST/$src" | sed 's/^[[:space:]]*//')
    [ -n "$construct" ] || { printf 'no-construct:no'; return; }
    script="$TMP/probe.sh"
    {
        echo '#!/bin/bash'
        echo 'set -e'
        echo 'explain_tea_user_does_not_exist() { echo "diagnostic" >&2; }'
        [ "$helper" = absent ] && echo 'unset -f explain_tea_user_does_not_exist'
        echo "$construct"                # the shipped line, parsed by a real shell
        echo 'echo FALLBACK_REACHED'
    } > "$script"
    # redirect INSIDE the substitution so the subshell's stderr really is $errto
    out=$( bash "$script" 2>"$errto" ); rc=$?
    printf '%s:%s' "$rc" "$(grep -q FALLBACK_REACHED <<<"$out" && echo yes || echo no)"
 }
 check() { if [ "$2" = "$3" ]; then echo "  PASS  $1 ($2)"; else echo "  FAIL  $1: got $2, want $3"; fail=1; fi; }
 echo "== diagnostic must not alter exit status or skip the fallback =="
 # /dev/full makes every stderr write fail -- the real-world shape is a closed or full fd.
 for src in pr-create.sh issue-view.sh issue-create.sh; do
    check "$src stderr OK      / helper present" "$(probe present /dev/null "$src")" "0:yes"
    check "$src stderr OK      / helper absent " "$(probe absent  /dev/null "$src")" "0:yes"
    check "$src stderr FAILING / helper present" "$(probe present /dev/full "$src")" "0:yes"
    check "$src stderr FAILING / helper absent " "$(probe absent  /dev/full "$src")" "0:yes"
 done
 echo "== all three call sites use the status-neutral form =="
 for f in pr-create.sh issue-view.sh issue-create.sh; do
    p="$GIT_DIR_UNDER_TEST/$f"
    grep -q '{ declare -F explain_tea_user_does_not_exist >/dev/null && explain_tea_user_does_not_exist; } || true' "$p" \
        && echo "  PASS  $f guarded" || { echo "  FAIL  $f: diagnostic is not status-neutral"; fail=1; }
 done
 [ "$fail" -eq 0 ] && echo "OK  diagnostic is status-neutral" || echo "FAILED"
 exit "$fail"
@@ -1,150 +0,0 @@
 #!/usr/bin/env bash
 # Regression: issue-close.sh must NOT close an issue when the closing comment could not
 # be posted, and comment+close must be made by ONE principal.
 #
 # Guards two defects fixed together (see #1081):
 #   1. `tea issue comment` is not a subcommand -- tea exposes comments as the TOP-LEVEL
 #      `tea comment`. The old call always failed, was unchecked, and the issue closed
 #      anyway, losing the record of WHY it was closed.
 #   2. Routing the comment through the token-authenticated API helper while the close
 #      used --login would attribute one operation to two principals.
 #
 # SAFETY (rev-974, #1085 review 130): this test previously ran under `set -uo pipefail`
 # with unchecked mkdir/redirect/cd, then prepended a possibly-nonexistent $MOCK_BIN to
 # PATH -- while `git remote add origin` names the REAL repository. Forcing setup failure
 # with an unwritable AGENT_WORK_ROOT made it `git init` in its CALLER's directory and
 # invoke the real, provider-mutating issue-close.sh. Setup now fails closed, and both
 # `tea` and `curl` are asserted to resolve INSIDE $MOCK_BIN before any target run.
 set -euo pipefail
 # NOTE: with `set -e`, `grep -q X && fail "..."` is a trap -- the ABSENT case (grep rc=1,
 # which is the PASSING case for a must-not-appear assertion) is the last command of an &&
 # list and silently terminates the script with no message. Every must-not-appear check
 # below is therefore an if-block. This is the same set -e + &&-list defect be-coder-08
 # found in #1086, reintroduced here by adding `set -e` for the sandbox-safety fix.
 WORK_ROOT="${AGENT_WORK_ROOT:-${TMPDIR:-/tmp}}"
 SANDBOX="$WORK_ROOT/issue-close-fail-closed-test-$$"
 MOCK_BIN="$SANDBOX/bin"; REPO_DIR="$SANDBOX/repo"; CALLS="$SANDBOX/calls.log"
 cleanup() { rm -rf "$SANDBOX"; }
 trap cleanup EXIT
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 TARGET="$SCRIPT_DIR/issue-close.sh"
 [ -f "$TARGET" ] || { echo "FAIL: issue-close.sh not found beside this test"; exit 1; }
 fail() { echo "FAIL: $*"; exit 1; }
 # Every setup step is checked. Under `set -e` these abort; the explicit || fail keeps the
 # reason legible instead of a bare non-zero exit.
 mkdir -p "$MOCK_BIN" "$REPO_DIR" || fail "setup: cannot create sandbox under $WORK_ROOT"
 : > "$CALLS"                     || fail "setup: cannot write calls log at $CALLS"
 cd "$REPO_DIR"                   || fail "setup: cannot cd into $REPO_DIR"
 git init -q                      || fail "setup: git init failed"
 git remote add origin https://git.mosaicstack.dev/mosaicstack/stack.git || fail "setup: git remote add failed"
 export PATH="$MOCK_BIN:$PATH" CALLS
 export GITEA_URL="https://git.mosaicstack.dev"
 export GITEA_TOKEN="redacted-test-token"
 cat > "$MOCK_BIN/curl" <<'EOF'
 #!/bin/bash
 method=GET; url=""
 while [ $# -gt 0 ]; do
    case "$1" in
        -X) method="$2"; shift 2 ;;
        http*|https*) url="$1"; shift ;;
        *) shift ;;
    esac
 done
 printf 'curl %s %s\n' "$method" "$url" >> "$CALLS"
 [ "${MOCK_CURL_FAIL:-}" = "1" ] && [ "$method" = "POST" ] && exit 22
 exit 0
 EOF
 chmod +x "$MOCK_BIN/curl"
 mk_tea() {  # $1 = exit code for a comment attempt; $2 = login list (empty => no login)
    local rc="$1" login="${2-}"
    cat > "$MOCK_BIN/tea" <<EOF
 #!/bin/bash
 printf 'tea %s\n' "\$*" >> "$CALLS"
 if [[ "\$*" == *"login list"* ]]; then
    printf '%s\n' '${login}'; exit 0
 fi
 # Fail ANY comment attempt -- both the correct top-level \`tea comment\` and the broken
 # \`tea issue comment\` -- so an unfixed script exercises the DEFECT rather than tripping
 # a setup assertion.
 if [[ "\$1" == "comment" || ( "\$1" == "issue" && "\$2" == "comment" ) ]]; then exit $rc; fi
 exit 0
 EOF
    chmod +x "$MOCK_BIN/tea"
 }
 LOGIN_JSON='[{"name":"git.mosaicstack.dev","url":"https://git.mosaicstack.dev"}]'
 # The mocks must be the ones that run. Without this, a failed setup silently falls through
 # to the real tea/curl and the "test" mutates the real provider.
 assert_mocked() {
    local w
    for w in tea curl; do
        p=$(command -v "$w" || true)
        [ -n "$p" ] || fail "SAFETY: $w does not resolve at all"
        case "$p" in
            "$MOCK_BIN"/*) : ;;
            *) fail "SAFETY: $w resolves to $p, OUTSIDE the sandbox -- refusing to invoke the target" ;;
        esac
    done
 }
 run_target() {  # never let a target failure abort the test; we assert on rc
    # Call sites MUST use `rc=0; run_target ... || rc=$?` -- a bare `run_target ...; rc=$?`
    # lets the non-zero RETURN trip set -e in the CALLER before rc is ever read.
    set +e; bash "$TARGET" "$@" >/dev/null 2>&1; local rc=$?; set -e; return $rc
 }
 # ── tea path ────────────────────────────────────────────────────────────────────────
 # 1. NEGATIVE (the regression): comment fails => must NOT close, must exit non-zero
 mk_tea 1 "$LOGIN_JSON"; : > "$CALLS"; assert_mocked
 rc=0; run_target -i 42 -c "closing note" || rc=$?
 grep -qE 'tea (issue )?comment' "$CALLS" || fail "no comment attempt -- setup did not reach the tea branch"
 if grep -q 'tea issue close' "$CALLS"; then fail "ISSUE CLOSED AFTER THE COMMENT FAILED -- the regression"; fi
 [ "$rc" -ne 0 ] || fail "comment failed but issue-close exited 0 -- FAIL-OPEN"
 # 2. POSITIVE: comment succeeds => close proceeds, exit 0
 mk_tea 0 "$LOGIN_JSON"; : > "$CALLS"; assert_mocked
 rc=0; run_target -i 42 -c "closing note" || rc=$?
 [ "$rc" -eq 0 ] || fail "comment succeeded but issue-close exited $rc"
 grep -q 'tea issue close' "$CALLS" || fail "issue not closed even though the comment succeeded"
 # 3. must use top-level `tea comment`, never `tea issue comment`
 if grep -q 'tea issue comment' "$CALLS"; then fail "used 'tea issue comment' -- not a valid subcommand"; fi
 # 4. ONE PRINCIPAL: comment and close must carry the SAME --login
 c=$(grep -m1 '^tea comment'     "$CALLS" | grep -o -- '--login [^ ]*' | awk '{print $2}')
 k=$(grep -m1 '^tea issue close' "$CALLS" | grep -o -- '--login [^ ]*' | awk '{print $2}')
 [ -n "$c" ] || fail "comment carried no --login"
 [ "$c" = "$k" ] || fail "MIXED PRINCIPALS: comment=$c close=$k"
 # ── no-login / API fallback path ────────────────────────────────────────────────────
 # rev-974: the delta also adds fail-closed behaviour to this branch, and the suite never
 # reached it -- replacing the whole fallback contract with an unconditional close still
 # passed. These assert the POSTCONDITION (which HTTP calls happened, in what order),
 # not merely that a command ran.
 # 5. no login + comment FAILS => POST attempted, NO PATCH, non-zero
 mk_tea 0 ""; : > "$CALLS"; assert_mocked
 rc=0; MOCK_CURL_FAIL=1 run_target -i 42 -c "closing note" || rc=$?
 grep -q 'curl POST' "$CALLS" || fail "API path: no comment POST attempted"
 if grep -q 'curl PATCH' "$CALLS"; then fail "API path: ISSUE CLOSED (PATCH) AFTER THE COMMENT POST FAILED"; fi
 [ "$rc" -ne 0 ] || fail "API path: comment failed but exited 0 -- FAIL-OPEN"
 # 6. no login + comment SUCCEEDS => POST strictly BEFORE PATCH, exit 0
 mk_tea 0 ""; : > "$CALLS"; assert_mocked
 rc=0; run_target -i 42 -c "closing note" || rc=$?
 [ "$rc" -eq 0 ] || fail "API path: comment succeeded but exited $rc"
 order=$(grep -oE 'curl (POST|PATCH)' "$CALLS" | awk '{print $2}' | paste -sd, -)
 [ "$order" = "POST,PATCH" ] || fail "API path: expected POST,PATCH -- got '${order:-<none>}'"
 # 7. no login + NO comment => PATCH only, never a POST
 mk_tea 0 ""; : > "$CALLS"; assert_mocked
 rc=0; run_target -i 42 || rc=$?
 [ "$rc" -eq 0 ] || fail "API path: no-comment close exited $rc"
 if grep -q 'curl POST' "$CALLS"; then fail "API path: posted a comment when none was requested"; fi
 grep -q 'curl PATCH' "$CALLS" || fail "API path: issue not closed when no comment was requested"
 echo "issue-close.sh fail-closed + single-principal regression passed"
@@ -280,10 +280,7 @@ print("201")
 print(json.dumps(record))
 PY
 )
-    response_status="${result%%$'\n'*}"
+    write_response "$(printf '%s' "$result" | head -n1)" "$(printf '%s' "$result" | tail -n +2)"
    response_body=""
    [[ "$result" == *$'\n'* ]] && response_body="${result#*$'\n'}"
    write_response "$response_status" "$response_body"
 elif [[ "$method" == "GET" && "$path" == "$ISSUE_COMMENT_API_BASE"/issues/comments/* ]]; then
    result=$(ISSUE_COMMENT_GET_ID="${path##*/}" python3 - <<'PY'
 import json
@@ -302,10 +299,7 @@ else:
    print(json.dumps(match))
 PY
 )
-    response_status="${result%%$'\n'*}"
+    write_response "$(printf '%s' "$result" | head -n1)" "$(printf '%s' "$result" | tail -n +2)"
    response_body=""
    [[ "$result" == *$'\n'* ]] && response_body="${result#*$'\n'}"
    write_response "$response_status" "$response_body"
 else
    echo "Unexpected curl request: $method $url" >&2
    exit 97
@@ -69,7 +69,7 @@ section_nums() { # $1 = output  $2 = header-prefix
 }
 fail() { echo "FAIL: $1" >&2; exit 1; }
-contains() { grep -qx "$2" <<<"$1"; }
+contains() { printf '%s\n' "$1" | grep -qx "$2"; }
 # ---------------------------------------------------------------------------
 # Fixed (current) script behavior
@@ -51,23 +51,22 @@ for arg in "$@"; do
        prev=""
        continue
    fi
-    if [[ "$prev" == "data" ]]; then
+    if [[ "$prev" == "-d" ]]; then
        post_data="$arg"
        [[ "$post_data" == @* ]] && post_data=$(<"${post_data#@}")
        prev=""
        continue
    fi
-    if [[ "$prev" == "config" ]]; then
+    if [[ "$arg" == "-o" ]]; then
-        [[ "$arg" == "-" ]] && cat >/dev/null
+        prev="-o"
        prev=""
        continue
    fi
-    case "$arg" in
+    if [[ "$arg" == "-d" ]]; then
-        -o) prev="-o" ;;
+        prev="-d"
-        -d|--data|--data-binary) prev="data" ;;
+        continue
-        -K|--config) prev="config" ;;
+    fi
-        -w) write_code=true ;;
+    if [[ "$arg" == "-w" ]]; then
-    esac
+        write_code=true
    fi
 done
 emit_response() {
    local body="$1"
@@ -36,30 +36,13 @@ cat > "$WORK_DIR/gitea/curl" <<'SH'
 #!/usr/bin/env bash
 set -euo pipefail
 payload=""
-out_file=""
+for ((i=1; i<=$#; i++)); do
-while [[ $# -gt 0 ]]; do
+    if [[ "${!i}" == "-d" ]]; then
-    case "$1" in
+        j=$((i + 1))
-        -d|--data|--data-binary)
+        payload="${!j}"
-            payload="$2"
+    fi
            [[ "$payload" == @* ]] && payload=$(<"${payload#@}")
            shift 2
            ;;
        -o)
            out_file="$2"
            shift 2
            ;;
        -K|--config)
            [[ "$2" == "-" ]] && cat >/dev/null
            shift 2
            ;;
        -w|-X|-H)
            shift 2
            ;;
        *) shift ;;
    esac
 done
 printf '%s' "$payload" > "${MOSAIC_MERGE_PAYLOAD_LOG:?}"
 [[ -n "$out_file" ]] && printf '{}' > "$out_file"
 printf '200'
 SH
 chmod +x "$WORK_DIR/gitea/curl"
@@ -1,541 +0,0 @@
 #!/usr/bin/env bash
 # Regression harness for the optional, identity-checked Gitea squash message.
 set -u
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 SUBJECT="${MOSAIC_TEST_SUBJECT:-$SCRIPT_DIR/pr-merge.sh}"
 WORK_DIR="${MOSAIC_TEST_WORK_DIR:-$PWD/.mosaic-test-work/pr-merge-message-field}"
 ORIG_PATH="$PATH"
 failures=0
 rm -rf "$WORK_DIR"
 mkdir -p "$WORK_DIR"
 fail() {
    echo "FAIL $1" >&2
    failures=$((failures + 1))
 }
 make_case() {
    local name="$1" case_dir
    case_dir="$WORK_DIR/$name"
    mkdir -p "$case_dir/bin" "$case_dir/agent"
    cp "$SUBJECT" "$case_dir/pr-merge.sh"
    chmod +x "$case_dir/pr-merge.sh"
    cat > "$case_dir/detect-platform.sh" <<'SH'
 #!/usr/bin/env bash
 detect_platform() { PLATFORM=gitea; printf 'gitea\n'; }
 get_repo_owner() { printf 'acme\n'; }
 get_repo_name() { printf 'widgets\n'; }
 get_remote_host() { printf 'git.example.test\n'; }
 get_gitea_token() {
    printf 'resolved\n' >> "${MOSAIC_TEST_TOKEN_RESOLUTION_LOG:?}"
    if [[ "${MOSAIC_TEST_TOKEN_AVAILABLE:-true}" != "true" ]]; then
        return 1
    fi
    printf 'fixture-token\n'
 }
 get_gitea_basic_auth() {
    printf 'resolved\n' >> "${MOSAIC_TEST_BASIC_RESOLUTION_LOG:?}"
    if [[ "${MOSAIC_TEST_BASIC_AVAILABLE:-false}" == "true" ]]; then
        printf 'fixture-user:fixture-password\n'
        return "${MOSAIC_TEST_BASIC_RC:-0}"
    fi
    return 1
 }
 get_gitea_login_for_host() { return 1; }
 SH
    cat > "$case_dir/pr-metadata.sh" <<'SH'
 #!/usr/bin/env bash
 if [[ "${MOSAIC_TEST_TITLE_MODE:-safe}" == "injection" ]]; then
    title='Preserve authors\n\nCo-authored-by: victim <[email protected]>'
 else
    title='Preserve both branch authors'
 fi
 case "${MOSAIC_TEST_COMMITS_MODE:?}" in
    verified) head_sha=2222222222222222222222222222222222222222 ;;
    null-login|unsafe-identity) head_sha=3333333333333333333333333333333333333333 ;;
    single) head_sha=1111111111111111111111111111111111111111 ;;
    *) echo "unknown commits mode" >&2; exit 2 ;;
 esac
 printf '{"number":42,"title":"%s","author":"poster","baseRefName":"main","headRefName":"feature/fixture","headRefOid":"%s","headRepository":"acme/widgets"}\n' "$title" "$head_sha"
 SH
    cat > "$case_dir/ci-queue-wait.sh" <<'SH'
 #!/usr/bin/env bash
 exit 0
 SH
    cat > "$case_dir/bin/python3" <<'SH'
 #!/usr/bin/env bash
 for arg in "$@"; do
    case "$arg" in
        *"Preserve both branch authors"*|*"[email protected]"*)
            : > "${MOSAIC_TEST_METADATA_ARGV_MARKER:?}"
            ;;
    esac
 done
 exec "${MOSAIC_TEST_REAL_PYTHON:?}" "$@"
 SH
    cat > "$case_dir/bin/curl" <<'SH'
 #!/usr/bin/env bash
 set -eu
 for arg in "$@"; do
    case "$arg" in
        *"Preserve both branch authors"*|*"[email protected]"*)
            : > "${MOSAIC_TEST_METADATA_ARGV_MARKER:?}"
            ;;
    esac
 done
 url=""
 method="GET"
 out_file=""
 data=""
 config=""
 auth_mode="none"
 has_max_filesize=0
 has_max_time=0
 has_connect_timeout=0
 while [[ $# -gt 0 ]]; do
    case "$1" in
        -o)
            out_file="$2"
            shift 2
            ;;
        -w)
            shift 2
            ;;
        -X)
            method="$2"
            shift 2
            ;;
        -d|--data|--data-binary)
            data="$2"
            if [[ "$data" == @* ]]; then
                data=$(<"${data#@}")
            fi
            shift 2
            ;;
        -K|--config)
            if [[ "$2" == "-" ]]; then
                config=$(cat)
            fi
            shift 2
            ;;
        --max-filesize)
            has_max_filesize=1
            shift 2
            ;;
        --max-time)
            has_max_time=1
            shift 2
            ;;
        --connect-timeout)
            has_connect_timeout=1
            shift 2
            ;;
        -H|--header|-u|--user)
            if [[ "$2" == *"fixture-token"* ]]; then
                : > "${MOSAIC_TEST_TOKEN_ARGV_MARKER:?}"
            fi
            if [[ "$2" == *"fixture-password"* ]]; then
                : > "${MOSAIC_TEST_BASIC_ARGV_MARKER:?}"
            fi
            shift 2
            ;;
        http://*|https://*)
            url="$1"
            shift
            ;;
        *)
            shift
            ;;
    esac
 done
 if [[ "$config" == *"Authorization: token fixture-token"* ]]; then
    auth_mode="token"
    : > "${MOSAIC_TEST_AUTH_CONFIG_MARKER:?}"
 elif [[ "$config" == *"user = \"fixture-user:fixture-password\""* ]]; then
    auth_mode="basic"
    : > "${MOSAIC_TEST_BASIC_CONFIG_MARKER:?}"
 fi
 printf '%s %s %s\n' "$method" "$auth_mode" "$url" >> "${MOSAIC_TEST_CURL_LOG:?}"
 printf '%s:%s:%s\n' "$has_max_filesize" "$has_max_time" "$has_connect_timeout" >> "${MOSAIC_TEST_CURL_BOUNDS_LOG:?}"
 case "$url" in
    */pulls/42)
        case "${MOSAIC_TEST_COMMITS_MODE:?}" in
            verified) head_sha=2222222222222222222222222222222222222222 ;;
            null-login|unsafe-identity) head_sha=3333333333333333333333333333333333333333 ;;
            single) head_sha=1111111111111111111111111111111111111111 ;;
            *) echo "unknown commits mode" >&2; exit 2 ;;
        esac
        if [[ "${MOSAIC_TEST_HEAD_MODE:-stable}" == "moved" ]]; then
            head_sha=4444444444444444444444444444444444444444
        fi
        body="{\"head\":{\"sha\":\"$head_sha\"}}"
        code=200
        if [[ "${MOSAIC_TEST_FALLBACK_MODE:-none}" == "inspection" && "$auth_mode" == "token" ]]; then
            body='{"message":"token rejected"}'
            code=401
        fi
        ;;
    */pulls/42/commits*)
        case "${MOSAIC_TEST_COMMITS_MODE:?}" in
            verified)
                if [[ "${MOSAIC_TEST_EMAIL_MODE:-safe}" == "escape" ]]; then
                    body='[{"sha":"2222222222222222222222222222222222222222","commit":{"author":{"name":"Alice","email":"alice+\u001b[[email protected]"}},"author":{"login":"alice"}},{"sha":"1111111111111111111111111111111111111111","commit":{"author":{"name":"Poster","email":"[email protected]"}},"author":{"login":"poster"}}]'
                else
                    body='[{"sha":"2222222222222222222222222222222222222222","commit":{"author":{"name":"Alice","email":"[email protected]"}},"author":{"login":"alice"}},{"sha":"1111111111111111111111111111111111111111","commit":{"author":{"name":"Poster","email":"[email protected]"}},"author":{"login":"poster"}}]'
                fi
                ;;
            null-login)
                body='[{"sha":"1111111111111111111111111111111111111111","commit":{"author":{"name":"Poster","email":"[email protected]"}},"author":{"login":"poster"}},{"sha":"3333333333333333333333333333333333333333","commit":{"author":{"name":"Unresolved Author","email":"[email protected]\n\u001b[31m"}},"author":null}]'
                ;;
            unsafe-identity)
                body='[{"sha":"unsafe\n\u001b[31m","commit":{"author":{"name":"Unsafe","email":"not-an-email"}},"author":{"login":"unsafe"}},{"sha":"3333333333333333333333333333333333333333","commit":{"author":{"name":"Poster","email":"[email protected]"}},"author":{"login":"poster"}}]'
                ;;
            single)
                body='[{"sha":"1111111111111111111111111111111111111111","commit":{"author":{"name":"Poster","email":"[email protected]"}},"author":{"login":"poster"}}]'
                ;;
            *)
                echo "unknown commits mode" >&2
                exit 2
                ;;
        esac
        code=200
        if [[ "${MOSAIC_TEST_FALLBACK_MODE:-none}" == "inspection" && "$auth_mode" == "token" ]]; then
            body='{"message":"token rejected"}'
            code=401
        fi
        ;;
    */pulls/42/merge)
        body='{}'
        code=200
        if [[ "${MOSAIC_TEST_FALLBACK_MODE:-none}" == "merge" && "$auth_mode" == "token" ]]; then
            body='{"message":"token rejected"}'
            code=401
        elif [[ "${MOSAIC_TEST_FALLBACK_MODE:-none}" == "provider-error" ]]; then
            body='{"message":"branch policy rejected\n\u001b[31m"}'
            code=409
        elif [[ "${MOSAIC_TEST_FALLBACK_MODE:-none}" == "forbidden" ]]; then
            body='{"message":"permission denied"}'
            code=403
        else
            printf '%s' "$data" > "${MOSAIC_TEST_MERGE_PAYLOAD:?}"
        fi
        ;;
    */users/*)
        body='{"message":"not found"}'
        code=404
        ;;
    *)
        body='{"message":"unexpected URL"}'
        code=500
        ;;
 esac
 if [[ -n "$out_file" ]]; then
    printf '%s' "$body" > "$out_file"
 else
    printf '%s' "$body"
 fi
 printf '%s' "$code"
 case "${MOSAIC_TEST_CURL_FAILURE:-none}" in
    oversize) exit 63 ;;
    stalled) exit 28 ;;
 esac
 SH
    chmod +x "$case_dir/detect-platform.sh" "$case_dir/pr-metadata.sh" \
        "$case_dir/ci-queue-wait.sh" "$case_dir/bin/curl" "$case_dir/bin/python3"
    printf '%s\n' "$case_dir"
 }
 run_case() {
    local case_dir="$1" mode="$2"
    shift 2
    MOSAIC_TEST_COMMITS_MODE="$mode" \
    MOSAIC_TEST_CURL_LOG="$case_dir/curl.log" \
    MOSAIC_TEST_CURL_BOUNDS_LOG="$case_dir/curl-bounds.log" \
    MOSAIC_TEST_MERGE_PAYLOAD="$case_dir/merge-payload.json" \
    MOSAIC_TEST_TOKEN_ARGV_MARKER="$case_dir/token-in-argv" \
    MOSAIC_TEST_BASIC_ARGV_MARKER="$case_dir/basic-in-argv" \
    MOSAIC_TEST_AUTH_CONFIG_MARKER="$case_dir/auth-via-config" \
    MOSAIC_TEST_BASIC_CONFIG_MARKER="$case_dir/basic-via-config" \
    MOSAIC_TEST_TOKEN_RESOLUTION_LOG="$case_dir/token-resolution.log" \
    MOSAIC_TEST_BASIC_RESOLUTION_LOG="$case_dir/basic-resolution.log" \
    MOSAIC_TEST_METADATA_ARGV_MARKER="$case_dir/metadata-in-argv" \
    MOSAIC_TEST_REAL_PYTHON="$(command -v python3)" \
    AGENT_WORK_ROOT="$case_dir/agent" \
    PATH="$case_dir/bin:$ORIG_PATH" \
        "$case_dir/pr-merge.sh" -n 42 "$@"
 }
 # Verified multi-author path: the non-poster trailer is built from one commit's
 # linked author.login and that same commit's author email. No /users lookup.
 verified_dir=$(make_case verified)
 set +e
 verified_output=$(run_case "$verified_dir" verified --co-author-trailers --escalate-to tl-mosaic 2>&1)
 verified_rc=$?
 set -e
 if [[ "$verified_rc" -ne 0 ]]; then
    fail "verified multi-author merge expected rc=0, got rc=$verified_rc: $verified_output"
 elif [[ ! -s "$verified_dir/merge-payload.json" ]]; then
    fail "verified multi-author merge did not reach the API payload"
 else
    python3 - "$verified_dir/merge-payload.json" <<'PY' || fail "verified payload did not preserve squash and exact message fields"
 import json
 import sys
 payload = json.load(open(sys.argv[1], encoding="utf-8"))
 assert payload == {
    "Do": "squash",
    "head_commit_id": "2222222222222222222222222222222222222222",
    "MergeTitleField": "Preserve both branch authors",
    "MergeMessageField": "Co-authored-by: alice <[email protected]>",
 }, payload
 PY
 fi
 [[ -e "$verified_dir/auth-via-config" ]] || fail "verified path did not authenticate curl through stdin config"
 [[ ! -e "$verified_dir/token-in-argv" ]] || fail "verified path placed the Gitea token in curl argv"
 [[ ! -e "$verified_dir/metadata-in-argv" ]] || fail "verified path placed PR title or contributor email in child argv"
 [[ "$(wc -l < "$verified_dir/token-resolution.log")" -eq 1 ]] || fail "verified path did not bind inspection and merge to one credential resolution"
 if grep -q '/users/' "$verified_dir/curl.log" 2>/dev/null; then
    fail "verified path performed a forbidden second /users lookup"
 fi
 if grep -qv '^1:1:1$' "$verified_dir/curl-bounds.log"; then
    fail "verified path did not apply size/max-time/connect-time bounds to every provider download"
 fi
 # A linked email containing a terminal escape must block before mutation.
 escape_email_dir=$(make_case escape-email)
 set +e
 escape_email_output=$(MOSAIC_TEST_EMAIL_MODE=escape run_case "$escape_email_dir" verified --co-author-trailers --escalate-to tl-mosaic 2>&1)
 escape_email_rc=$?
 set -e
 [[ "$escape_email_rc" -ne 0 ]] || fail "control-byte email unexpectedly passed"
 [[ "$escape_email_output" == *"unusable linked identity"* ]] || fail "control-byte email refusal lost its diagnostic"
 [[ ! -e "$escape_email_dir/merge-payload.json" ]] || fail "control-byte email reached the merge API"
 # Curl transfer and duration failures must remain failures even with HTTP 200.
 for failure_mode in oversize stalled; do
    failure_dir=$(make_case "curl-$failure_mode")
    set +e
    failure_output=$(MOSAIC_TEST_CURL_FAILURE="$failure_mode" run_case "$failure_dir" verified --co-author-trailers --escalate-to tl-mosaic 2>&1)
    failure_rc=$?
    set -e
    [[ "$failure_rc" -ne 0 ]] || fail "curl $failure_mode failure was discarded: $failure_output"
    [[ ! -e "$failure_dir/merge-payload.json" ]] || fail "curl $failure_mode failure reached the merge API"
 done
 # The authenticated head is re-read under the mutation credential but cannot
 # replace the canonical preflight/review head. A move blocks before enumeration
 # or mutation even though the provider returned a valid new SHA.
 moved_dir=$(make_case moved-head)
 set +e
 moved_output=$(MOSAIC_TEST_HEAD_MODE=moved \
    run_case "$moved_dir" verified --co-author-trailers --escalate-to tl-mosaic 2>&1)
 moved_rc=$?
 set -e
 [[ "$moved_rc" -ne 0 ]] || fail "moved authenticated head unexpectedly passed"
 [[ "$moved_output" == *"authenticated PR head moved from reviewed"* ]] || fail "moved head refusal lost its diagnostic"
 [[ "$moved_output" == *"tl-mosaic"* ]] || fail "moved head refusal omitted the named escalation principal"
 [[ ! -e "$moved_dir/merge-payload.json" ]] || fail "moved head refusal reached the merge API"
 moved_sequence=$(awk '{print $1 ":" $2}' "$moved_dir/curl.log" | paste -sd, -)
 [[ "$moved_sequence" == "GET:token" ]] || fail "moved head refusal performed post-move inspection/mutation (calls=$moved_sequence)"
 # Token resolution failure is not an authentication response. It must fail
 # closed instead of borrowing a Basic credential under a different principal.
 token_missing_dir=$(make_case token-missing)
 set +e
 token_missing_output=$(MOSAIC_TEST_TOKEN_AVAILABLE=false MOSAIC_TEST_BASIC_AVAILABLE=true \
    run_case "$token_missing_dir" single 2>&1)
 token_missing_rc=$?
 set -e
 [[ "$token_missing_rc" -ne 0 ]] || fail "missing token unexpectedly borrowed Basic Auth"
 [[ "$token_missing_output" == *"required Gitea token"* ]] || fail "missing token refusal lost its diagnostic"
 [[ ! -e "$token_missing_dir/basic-resolution.log" ]] || fail "missing token resolved Basic Auth after identity failure"
 [[ ! -e "$token_missing_dir/curl.log" ]] || fail "missing token reached a provider request"
 # A failed Basic resolver must never use its nonempty output or reach mutation.
 basic_rc_dir=$(make_case basic-resolver-rc)
 set +e
 basic_rc_output=$(MOSAIC_TEST_BASIC_AVAILABLE=true MOSAIC_TEST_BASIC_RC=91 MOSAIC_TEST_FALLBACK_MODE=inspection \
    run_case "$basic_rc_dir" verified --co-author-trailers --escalate-to tl-mosaic 2>&1)
 basic_rc_rc=$?
 set -e
 [[ "$basic_rc_rc" -ne 0 ]] || fail "failed Basic resolver output unexpectedly authorized a merge: $basic_rc_output"
 [[ ! -e "$basic_rc_dir/merge-payload.json" ]] || fail "failed Basic resolver reached the merge API"
 # HTTP 401 never changes principals: inspection rejection fails closed without
 # resolving or attempting Basic Auth.
 fallback_inspect_dir=$(make_case fallback-inspection)
 set +e
 fallback_inspect_output=$(MOSAIC_TEST_BASIC_AVAILABLE=true MOSAIC_TEST_FALLBACK_MODE=inspection \
    run_case "$fallback_inspect_dir" verified --co-author-trailers --escalate-to tl-mosaic 2>&1)
 fallback_inspect_rc=$?
 set -e
 [[ "$fallback_inspect_rc" -ne 0 ]] || fail "inspection token rejection unexpectedly changed principals"
 [[ "$fallback_inspect_output" == *"refusing cross-principal credential fallback"* ]] || fail "inspection token rejection lost its refusal diagnostic"
 [[ ! -e "$fallback_inspect_dir/basic-resolution.log" ]] || fail "inspection token rejection resolved Basic Auth"
 [[ ! -e "$fallback_inspect_dir/merge-payload.json" ]] || fail "inspection token rejection reached merge mutation"
 inspect_sequence=$(awk '{print $1 ":" $2}' "$fallback_inspect_dir/curl.log" | paste -sd, -)
 [[ "$inspect_sequence" == "GET:token" ]] || fail "inspection rejection made unexpected provider calls (calls=$inspect_sequence)"
 # Token rejection at merge likewise fails closed without cross-principal retry.
 fallback_merge_dir=$(make_case fallback-merge)
 set +e
 fallback_merge_output=$(MOSAIC_TEST_BASIC_AVAILABLE=true MOSAIC_TEST_FALLBACK_MODE=merge \
    run_case "$fallback_merge_dir" verified --co-author-trailers --escalate-to tl-mosaic 2>&1)
 fallback_merge_rc=$?
 set -e
 [[ "$fallback_merge_rc" -ne 0 ]] || fail "merge token rejection unexpectedly changed principals"
 [[ "$fallback_merge_output" == *"refusing cross-principal credential fallback"* ]] || fail "merge token rejection lost its refusal diagnostic"
 [[ ! -e "$fallback_merge_dir/basic-resolution.log" ]] || fail "merge token rejection resolved Basic Auth"
 [[ ! -e "$fallback_merge_dir/merge-payload.json" ]] || fail "merge token rejection recorded a successful payload"
 merge_sequence=$(awk '{print $1 ":" $2}' "$fallback_merge_dir/curl.log" | paste -sd, -)
 [[ "$merge_sequence" == "GET:token,GET:token,POST:token" ]] || fail "merge rejection made unexpected provider calls (calls=$merge_sequence)"
 # BLOCK path: a commit email exists but author.login is null. It must name both
 # facts, name the escalation principal, and never reach the merge endpoint.
 null_dir=$(make_case null-login)
 set +e
 null_output=$(run_case "$null_dir" null-login --co-author-trailers --escalate-to tl-mosaic 2>&1)
 null_rc=$?
 set -e
 [[ "$null_rc" -ne 0 ]] || fail "null-login author expected a non-zero BLOCK"
 [[ "$null_output" == *"BLOCK"* ]] || fail "null-login author omitted BLOCK diagnostic"
 [[ "$null_output" == *"author.login=NULL"* ]] || fail "null-login author omitted the null provider fact"
 [[ "$null_output" == *"[email protected]"* ]] || fail "null-login author omitted the commit email fact"
 [[ "$null_output" == *'\n\x1b[31m'* ]] || fail "null-login author diagnostic did not escape control characters"
 [[ "$null_output" != *$'\033'* ]] || fail "null-login author diagnostic emitted a raw terminal escape"
 [[ "$(printf '%s\n' "$null_output" | wc -l)" -eq 1 ]] || fail "null-login author diagnostic permitted newline injection"
 [[ "$null_output" == *"tl-mosaic"* ]] || fail "null-login author omitted the named escalation principal"
 [[ ! -e "$null_dir/merge-payload.json" ]] || fail "null-login BLOCK still reached the merge API"
 # Every provider-derived field in alternate BLOCK diagnostics is log-safe too,
 # including an invalid non-head SHA that contains control characters.
 unsafe_dir=$(make_case unsafe-identity)
 set +e
 unsafe_output=$(run_case "$unsafe_dir" unsafe-identity --co-author-trailers --escalate-to tl-mosaic 2>&1)
 unsafe_rc=$?
 set -e
 [[ "$unsafe_rc" -ne 0 ]] || fail "unsafe identity expected a non-zero BLOCK"
 [[ "$unsafe_output" == *"unusable linked identity"* ]] || fail "unsafe identity omitted its BLOCK reason"
 [[ "$unsafe_output" == *'\n\x1b[31m'* ]] || fail "unsafe identity SHA did not escape control characters"
 [[ "$unsafe_output" != *$'\033'* ]] || fail "unsafe identity diagnostic emitted a raw terminal escape"
 [[ "$(printf '%s\n' "$unsafe_output" | wc -l)" -eq 1 ]] || fail "unsafe identity diagnostic permitted newline injection"
 [[ ! -e "$unsafe_dir/merge-payload.json" ]] || fail "unsafe identity BLOCK still reached the merge API"
 # The provider PR title cannot add an unchecked trailer outside the constructed
 # message field: multi-line and trailer-shaped titles block before mutation.
 title_dir=$(make_case title-injection)
 set +e
 title_output=$(MOSAIC_TEST_TITLE_MODE=injection \
    run_case "$title_dir" verified --co-author-trailers --escalate-to tl-mosaic 2>&1)
 title_rc=$?
 set -e
 [[ "$title_rc" -ne 0 ]] || fail "title trailer injection unexpectedly passed"
 [[ "$title_output" == *"not one printable, non-trailer line"* ]] || fail "title injection refusal lost its diagnostic"
 [[ ! -e "$title_dir/merge-payload.json" ]] || fail "title injection reached the merge API"
 # Provider failures remain diagnosable after their temporary response file is
 # removed, but provider-controlled control characters stay log-safe.
 error_dir=$(make_case provider-error)
 set +e
 error_output=$(MOSAIC_TEST_BASIC_AVAILABLE=true MOSAIC_TEST_FALLBACK_MODE=provider-error \
    run_case "$error_dir" single 2>&1)
 error_rc=$?
 set -e
 [[ "$error_rc" -ne 0 ]] || fail "provider error unexpectedly passed"
 [[ "$error_output" == *"HTTP 409"* ]] || fail "provider error omitted the HTTP status"
 [[ "$error_output" == *"branch policy rejected"* ]] || fail "provider error response was discarded"
 [[ "$error_output" == *'\n\x1b[31m'* ]] || fail "provider error response did not escape control characters"
 [[ "$error_output" != *$'\033'* ]] || fail "provider error response emitted a raw terminal escape"
 [[ "$error_output" != *"Basic Auth fallback"* ]] || fail "provider error advertised removed Basic Auth fallback"
 [[ ! -e "$error_dir/basic-resolution.log" ]] || fail "HTTP 409 policy denial incorrectly triggered Basic Auth fallback"
 # Authorization denials likewise fail closed instead of changing principals.
 forbidden_dir=$(make_case forbidden)
 set +e
 forbidden_output=$(MOSAIC_TEST_BASIC_AVAILABLE=true MOSAIC_TEST_FALLBACK_MODE=forbidden \
    run_case "$forbidden_dir" single 2>&1)
 forbidden_rc=$?
 set -e
 [[ "$forbidden_rc" -ne 0 ]] || fail "HTTP 403 authorization denial unexpectedly passed"
 [[ "$forbidden_output" == *"HTTP 403"* ]] || fail "authorization denial omitted the HTTP status"
 [[ "$forbidden_output" != *"Basic Auth fallback"* ]] || fail "authorization denial advertised removed Basic Auth fallback"
 [[ ! -e "$forbidden_dir/basic-resolution.log" ]] || fail "HTTP 403 authorization denial incorrectly triggered Basic Auth fallback"
 # The BLOCK destination cannot be generic or inferred after failure: opting in
 # without a named principal is refused before any provider operation.
 principal_dir=$(make_case missing-principal)
 set +e
 principal_output=$(run_case "$principal_dir" verified --co-author-trailers 2>&1)
 principal_rc=$?
 set -e
 [[ "$principal_rc" -ne 0 ]] || fail "co-author mode without a named principal unexpectedly passed"
 [[ "$principal_output" == *"requires --escalate-to with a named principal"* ]] || fail "missing-principal refusal lost its diagnostic"
 [[ ! -e "$principal_dir/merge-payload.json" ]] || fail "missing-principal refusal reached the merge API"
 # A trailing value-taking option receives a stable CLI diagnostic instead of a
 # set -u unbound-variable crash.
 value_dir=$(make_case missing-principal-value)
 set +e
 value_output=$(run_case "$value_dir" verified --co-author-trailers --escalate-to 2>&1)
 value_rc=$?
 set -e
 [[ "$value_rc" -ne 0 ]] || fail "missing --escalate-to value unexpectedly passed"
 [[ "$value_output" == *"--escalate-to requires one principal name"* ]] || fail "missing --escalate-to value lost its diagnostic"
 [[ "$value_output" != *"unbound variable"* ]] || fail "missing --escalate-to value crashed under set -u"
 [[ ! -e "$value_dir/merge-payload.json" ]] || fail "missing --escalate-to value reached the merge API"
 # Negative control: ordinary single-author merge remains byte-for-byte payload
 # compatible and hardcoded to squash, with no optional message fields.
 single_dir=$(make_case single)
 set +e
 single_output=$(run_case "$single_dir" single 2>&1)
 single_rc=$?
 set -e
 if [[ "$single_rc" -ne 0 ]]; then
    fail "ordinary single-author merge expected rc=0, got rc=$single_rc: $single_output"
 elif [[ ! -s "$single_dir/merge-payload.json" ]]; then
    fail "ordinary single-author merge did not reach the API payload"
 else
    python3 - "$single_dir/merge-payload.json" <<'PY' || fail "ordinary single-author payload changed"
 import json
 import sys
 payload = json.load(open(sys.argv[1], encoding="utf-8"))
 assert payload == {
    "Do": "squash",
    "head_commit_id": "1111111111111111111111111111111111111111",
 }, payload
 PY
 fi
 [[ -e "$single_dir/auth-via-config" ]] || fail "ordinary path did not authenticate curl through stdin config"
 [[ ! -e "$single_dir/token-in-argv" ]] || fail "ordinary path placed the Gitea token in curl argv"
 [[ "$(wc -l < "$single_dir/token-resolution.log")" -eq 1 ]] || fail "ordinary path did not use exactly one credential resolution"
 # Squash is not defaultable: an explicit non-squash method must remain refused.
 method_dir=$(make_case method-refusal)
 set +e
 method_output=$(run_case "$method_dir" single -m merge 2>&1)
 method_rc=$?
 set -e
 [[ "$method_rc" -ne 0 ]] || fail "non-squash method unexpectedly passed"
 [[ "$method_output" == *"enforces squash merge only"* ]] || fail "non-squash refusal lost its policy diagnostic"
 [[ ! -e "$method_dir/merge-payload.json" ]] || fail "non-squash refusal reached the merge API"
 if [[ "$failures" -ne 0 ]]; then
    echo "pr-merge message-field regression failed ($failures assertions)" >&2
    exit 1
 fi
 echo "pr-merge message-field regression passed (verified, BLOCK, and unchanged squash control)"
@@ -225,10 +225,7 @@ write_response() {
 emit() {
    # Split a two-line "status\n<json body>" python result into the response.
    local result="$1"
-    response_status="${result%%$'\n'*}"
+    write_response "$(printf '%s' "$result" | head -n1)" "$(printf '%s' "$result" | tail -n +2)"
    response_body=""
    [[ "$result" == *$'\n'* ]] && response_body="${result#*$'\n'}"
    write_response "$response_status" "$response_body"
 }
 mode="${PR_REVIEW_TEST_MODE:-}"
@@ -222,8 +222,8 @@ grep -q 'Unknown action: bogus-action' "$OUTPUT_FILE"
 # --- Case 2: -h/--help documents both overrides.
 HELP_TEXT="$("$SCRIPT_DIR/pr-review.sh" -h)"
-grep -q -- '-r, --repo' <<<"$HELP_TEXT"
+echo "$HELP_TEXT" | grep -q -- '-r, --repo'
-grep -q -- '-H, --host' <<<"$HELP_TEXT"
+echo "$HELP_TEXT" | grep -q -- '-H, --host'
 # --- Case 3 (comment): a TRUE no-git-origin dir + -r/-H must not silently die
 # and must not fail with "not a git repository or no origin remote" either.
@@ -91,12 +91,10 @@ fi
 if [[ -n "$dirty_files" ]]; then
  echo "  Modified files:"
-  mapfile -t dirty_lines <<<"$dirty_files"
+  echo "$dirty_files" | head -20 | while IFS= read -r line; do
-  file_count="${#dirty_lines[@]}"
+    echo "    $line"
  display_count=$((file_count < 20 ? file_count : 20))
  for ((i = 0; i < display_count; i++)); do
    echo "    ${dirty_lines[$i]}"
  done
  file_count="$(echo "$dirty_files" | wc -l)"
  if (( file_count > 20 )); then
    echo "    ... and $(( file_count - 20 )) more"
  fi
@@ -64,12 +64,12 @@ if jq -e '.next_task == "T-001"' "$capsule_file" >/dev/null 2>&1; then pass_case
 if grep -Fq 'Target runtime:** codex' <<< "$codex_continue_output"; then pass_case "continue prompt contains target runtime codex"; else fail_case "continue prompt contains target runtime codex"; fi
 codex_run_prompt="$(MOSAIC_COORD_RUNTIME=codex bash "$SCRIPT_DIR/session-run.sh" --project "$tmp_project" --print)"
-if [[ "${codex_run_prompt%%$'\n'*}" == "Now initiating Orchestrator mode..." ]]; then pass_case "codex run prompt first line is mode declaration"; else fail_case "codex run prompt first line is mode declaration"; fi
+if [[ "$(printf '%s\n' "$codex_run_prompt" | head -n1)" == "Now initiating Orchestrator mode..." ]]; then pass_case "codex run prompt first line is mode declaration"; else fail_case "codex run prompt first line is mode declaration"; fi
 if grep -Fq 'Do NOT ask clarifying questions before your first tool actions' <<< "$codex_run_prompt"; then pass_case "codex run prompt includes no-questions hard gate"; else fail_case "codex run prompt includes no-questions hard gate"; fi
 if grep -Fq '"next_task": "T-001"' <<< "$codex_run_prompt"; then pass_case "codex run prompt embeds capsule json"; else fail_case "codex run prompt embeds capsule json"; fi
 claude_run_prompt="$(MOSAIC_COORD_RUNTIME=claude bash "$SCRIPT_DIR/session-run.sh" --project "$tmp_project" --print)"
-if [[ "${claude_run_prompt%%$'\n'*}" == "## Continuation Mission" ]]; then pass_case "claude run prompt remains continuation prompt format"; else fail_case "claude run prompt remains continuation prompt format"; fi
+if [[ "$(printf '%s\n' "$claude_run_prompt" | head -n1)" == "## Continuation Mission" ]]; then pass_case "claude run prompt remains continuation prompt format"; else fail_case "claude run prompt remains continuation prompt format"; fi
 echo ""
 echo "Smoke test summary: pass=$PASS fail=$FAIL"
@@ -96,8 +96,8 @@ L="$WORK/live5.md"; G="$WORK/ledger5.md"; echo "# LEDGER" > "$G"
 make_board "$L" 6 1 400
 before_l=$(cat "$L"); before_g=$(cat "$G")
 out=$(bash "$SUT" --live "$L" --ledger "$G" --cap 2000 --dry-run 2>&1) || note "dry-run exited nonzero: $out"
-grep -qi "dry run" <<<"$out" || note "dry-run did not announce itself"
+echo "$out" | grep -qi "dry run" || note "dry-run did not announce itself"
-grep -q "would roll" <<<"$out" || note "dry-run did not report a plan"
+echo "$out" | grep -q "would roll" || note "dry-run did not report a plan"
 [[ "$(cat "$L")" == "$before_l" ]] || note "dry-run modified LIVE"
 [[ "$(cat "$G")" == "$before_g" ]] || note "dry-run modified LEDGER"
@@ -66,7 +66,7 @@ present=0
 for entry in "${PRDY_REQUIRED_SECTIONS[@]}"; do
  pattern="${entry#*|}"
-  if grep -qiE "$pattern" <<<"$PRD_CONTENT"; then
+  if echo "$PRD_CONTENT" | grep -qiE "$pattern"; then
    present=$((present + 1))
  fi
 done
@@ -169,13 +169,13 @@ main() {
 # classify_surface PATH → surface name (highest-risk match wins, mirrors TS)
 classify_surface() {
  local p="$1"
-  if grep -qiE 'auth|login|session|token|permission|rbac|credential|secret' <<<"$p"; then echo auth; return; fi
+  if printf '%s' "$p" | grep -qiE 'auth|login|session|token|permission|rbac|credential|secret'; then echo auth; return; fi
-  if grep -qiE 'migration|prisma|schema|\.sql|entity|repository|seed' <<<"$p"; then echo data; return; fi
+  if printf '%s' "$p" | grep -qiE 'migration|prisma|schema|\.sql|entity|repository|seed'; then echo data; return; fi
-  if grep -qiE 'docker|\.woodpecker|compose|traefik|deploy|helm|k8s|terraform' <<<"$p"; then echo infra; return; fi
+  if printf '%s' "$p" | grep -qiE 'docker|\.woodpecker|compose|traefik|deploy|helm|k8s|terraform'; then echo infra; return; fi
-  if grep -qiE 'package\.json|tsconfig|turbo\.json|pnpm-|\.config\.|eslint|vite' <<<"$p"; then echo build; return; fi
+  if printf '%s' "$p" | grep -qiE 'package\.json|tsconfig|turbo\.json|pnpm-|\.config\.|eslint|vite'; then echo build; return; fi
-  if grep -qE '\.tsx|\.css|components/|apps/web/' <<<"$p"; then echo ui; return; fi
+  if printf '%s' "$p" | grep -qE '\.tsx|\.css|components/|apps/web/'; then echo ui; return; fi
-  if grep -qE '\.spec\.|\.test\.|__tests__/' <<<"$p"; then echo test; return; fi
+  if printf '%s' "$p" | grep -qE '\.spec\.|\.test\.|__tests__/'; then echo test; return; fi
-  if grep -qE '\.md$|docs/' <<<"$p"; then echo docs; return; fi
+  if printf '%s' "$p" | grep -qE '\.md$|docs/'; then echo docs; return; fi
  echo none
 }
@@ -13,12 +13,7 @@ JSON_INPUT=$(cat)
 if command -v jq &>/dev/null; then
  FILE_PATH=$(echo "$JSON_INPUT" | jq -r '.tool_input.file_path // .tool_response.filePath // .file_path // empty' 2>/dev/null || echo "")
 else
-  file_path_pattern='"file_path"[[:space:]]*:[[:space:]]*"([^"]*)"'
+  FILE_PATH=$(echo "$JSON_INPUT" | grep -o '"file_path"[[:space:]]*:[[:space:]]*"[^"]*"' | sed 's/.*"\([^"]*\)"$/\1/' | head -1)
  if [[ "$JSON_INPUT" =~ $file_path_pattern ]]; then
    FILE_PATH="${BASH_REMATCH[1]}"
  else
    FILE_PATH=""
  fi
 fi
 # Only check TypeScript files
@@ -58,7 +53,7 @@ OUTPUT=$(npx tsc --noEmit --pretty --maxNodeModuleJsDepth 0 2>&1) || STATUS=$?
 if [ "${STATUS:-0}" -ne 0 ]; then
  # Filter output to only show errors related to the edited file (if possible)
  BASENAME=$(basename "$FILE_PATH")
-  RELEVANT=$(grep -A2 "$BASENAME" <<<"$OUTPUT" 2>/dev/null || sed -n '1,20p' <<<"$OUTPUT")
+  RELEVANT=$(echo "$OUTPUT" | grep -A2 "$BASENAME" 2>/dev/null || echo "$OUTPUT" | head -20)
  echo "TypeScript type errors detected after editing $FILE_PATH:"
  echo "$RELEVANT"
@@ -26,9 +26,6 @@ chk "F1 fresh: CONSTITUTION/AGENTS/STANDARDS/TOOLS seeded" \
  "[ -f '$T1/CONSTITUTION.md' ] && [ -f '$T1/AGENTS.md' ] && [ -f '$T1/STANDARDS.md' ] && [ -f '$T1/TOOLS.md' ]"
 chk "F1 fresh: AGENTS == shipped default" "cmp -s '$T1/AGENTS.md' '$DEFA/AGENTS.md'"
 chk "F1 fresh: framework-version stamped 3" "[ \"\$(cat '$T1/.framework-version' 2>/dev/null)\" = 3 ]"
 chk "F1 fresh: Pi goal extension deploys under Mosaic runtime" \
  "cmp -s '$T1/runtime/pi/goal-extension.ts' '$FW/runtime/pi/goal-extension.ts'"
 chk "F1 fresh: installer creates no nested main Pi config" "[ ! -e '$T1/.pi' ]"
 # F2 — legacy install with a user-edited AGENTS.md (the sanctioned pre-constitution customization)
 T2=$(mktemp -d); mkdir -p "$T2/credentials"
@@ -92,8 +89,6 @@ chk "F6 reseed: per-agent env bytes survive" "cmp -s '$T6/fleet/agents/coder0.en
 chk "F6 reseed: heartbeat bytes survive" "cmp -s '$T6/fleet/run/coder0.hb' '$E6/run.expected'"
 chk "F6 reseed: framework examples are refreshed" "grep -q orchestrator '$T6/fleet/examples/general.yaml'"
 chk "F6 reseed: framework roster schema is refreshed" "cmp -s '$T6/fleet/roster.schema.json' '$FW/fleet/roster.schema.json'"
 chk "F6 reseed: Pi goal extension is refreshed from framework source" \
  "cmp -s '$T6/runtime/pi/goal-extension.ts' '$FW/runtime/pi/goal-extension.ts'"
 rm -rf "$T1" "$T2" "$T3" "$T4" "$T5" "$T6" "$E6"
 echo
@@ -176,12 +176,8 @@ run_snap() {
 # Resolve the single pre-update-* snapshot dir under a state dir (newest if many).
 snap_dir() {
-  local -a snapshots=()
+  find "$1/mosaic/backups" -maxdepth 1 -type d -name 'pre-update-*' 2>/dev/null \
-  mapfile -t snapshots < <(
+    | LC_ALL=C sort -r | head -1
    find "$1/mosaic/backups" -maxdepth 1 -type d -name 'pre-update-*' 2>/dev/null \
      | LC_ALL=C sort -r
  )
  printf '%s\n' "${snapshots[0]:-}"
 }
 echo "── Part 1/2/3: durable snapshot scope, perms, no-leak ──────────────────"
@@ -180,15 +180,16 @@ chk "[control] without -E the mid-sync corruption survives (no rollback)" \
 # ── Part C: an INT/TERM interrupt must terminate, not resume (blocker-A) ──────
 # A bash signal trap that merely returns lets the script continue past the
-# interrupt — restoring the snapshot, then resuming the sync and reporting
+# interrupt — restoring the snapshot, then resuming the install and reporting
-# success. The earlier test used a child cp shim to signal its parent, making
+# success. Generate two installer fixtures that first damage a real target path
-# child completion race Bash's interrupted wait. Concurrency is not part of the
+# after the snapshot is armed, then signal their own Bash process immediately
-# guarded property: sync_framework_keep() runs in the installer's own Bash
+# before the normal sync. This fixed injection point is independent of `find`
-# process, and `kill` is a builtin. Generate two installer fixtures that signal
+# enumeration order: after a no-exit handler restores and returns, the complete
-# themselves at the same known mid-sync point. Their TERM handlers emit the same
+# sync still remains to run, so the historical resume bug is deterministic on
-# observable before diverging, so missing signal delivery fails BOTH arms rather
+# every filesystem. Their TERM handlers emit the same observable before
-# than manufacturing a pass. The only semantic difference between fixtures is
+# diverging, so missing signal delivery fails BOTH arms rather than manufacturing
-# the explicit `exit 1` whose load-bearing behavior this control proves.
+# a pass. The only semantic difference between fixtures is the explicit `exit 1`
 # whose load-bearing behavior this control proves.
 TERM_MARKER='[test-control] TERM handler entered'
 HANDLER_WITH_EXIT="trap 'echo \"$TERM_MARKER\" >&2; restore_snapshot; exit 1' TERM  # TEST-TERM-HANDLER"
 HANDLER_WITHOUT_EXIT="trap 'echo \"$TERM_MARKER\" >&2; restore_snapshot' TERM  # TEST-TERM-HANDLER"
@@ -196,19 +197,17 @@ HANDLER_WITHOUT_EXIT="trap 'echo \"$TERM_MARKER\" >&2; restore_snapshot' TERM  #
 make_signal_installer() {
  local output="$1" handler="$2"
  local target_trap="trap 'restore_snapshot; exit 1' ERR INT TERM"
-  local target_cp='    cp "$abs" "$dst/$rel"'
+  local target_sync='sync_framework'
-  local inject_open="    if [[ \"\$rel\" == \"$POISON_REL\" ]]; then"
+  local inject_damage="printf '%s' '$GARBAGE' > \"\$TARGET_DIR/$POISON_REL\"  # TEST-TERM-DAMAGE"
-  local inject_kill='      kill -TERM "$$"  # TEST-TERM-INJECTION'
+  local inject_kill='kill -TERM "$$"  # TEST-TERM-INJECTION'
  local inject_close='    fi'
  if ! awk \
-    -v target_trap="$target_trap" -v target_cp="$target_cp" \
+    -v target_trap="$target_trap" -v target_sync="$target_sync" \
-    -v handler="$handler" -v inject_open="$inject_open" \
+    -v handler="$handler" -v inject_damage="$inject_damage" \
-    -v inject_kill="$inject_kill" -v inject_close="$inject_close" '
+    -v inject_kill="$inject_kill" '
-      $0 == target_cp {
+      $0 == target_sync {
-        print inject_open
+        print inject_damage
        print inject_kill
        print inject_close
        injection_sites++
      }
      { print }
@@ -231,7 +230,8 @@ make_signal_installer "$SIGNALED" "$HANDLER_WITH_EXIT"
 make_signal_installer "$NOEXIT" "$HANDLER_WITHOUT_EXIT"
 signal_fixture_ready() {
  local fixture="$1" expected_handler="$2"
-  [[ "$(grep -cF '# TEST-TERM-INJECTION' "$fixture")" -eq 1 ]] \
+  [[ "$(grep -cF '# TEST-TERM-DAMAGE' "$fixture")" -eq 1 ]] \
    && [[ "$(grep -cF '# TEST-TERM-INJECTION' "$fixture")" -eq 1 ]] \
    && [[ "$(grep -cF '# TEST-TERM-HANDLER' "$fixture")" -eq 1 ]] \
    && grep -Fqx "$expected_handler" "$fixture"
 }
@@ -261,10 +261,12 @@ run_signal_upgrade() {
 IFS=$'\t' read -r rcC OUTC HC < <(run_signal_upgrade "$SIGNALED")
 chk "[signal] TERM handler observable fires exactly once" \
  "[ \"\$(grep -cF '$TERM_MARKER' '$OUTC')\" -eq 1 ]"
-chk "[signal] SIGTERM mid-sync aborts non-zero (trap exits, does not resume)" \
+chk "[signal] SIGTERM after target mutation aborts non-zero (trap exits, does not resume)" \
  "[ '$rcC' -ne 0 ]"
 chk "[signal] restore_snapshot fires on the interrupt" \
  "grep -q 'restoring previous state from snapshot' '$OUTC'"
 chk "[signal] the deliberately damaged target is restored before termination" \
  "[ \"\$(cat '$HC/$POISON_REL')\" = '$GOOD' ]"
 chk "[signal] does NOT resume to report sync success after the interrupt" \
  "! grep -q 'file phase complete' '$OUTC'"
@@ -277,6 +279,8 @@ chk "[control] without 'exit 1' the installer exits zero after resuming" \
  "[ '$rcD' -eq 0 ]"
 chk "[control] without 'exit 1' the trap resumes and reports sync success (the bug)" \
  "grep -q 'file phase complete' '$OUTD'"
 chk "[control] the resumed full sync mutates the restored target again" \
  "! grep -qxF '$GOOD' '$HD/$POISON_REL' && cmp -s '$FW/$POISON_REL' '$HD/$POISON_REL'"
 # ── Part D: a failed source/prune `find` scan must abort + roll back (D1) ─────
 # A `< <(find …)` process substitution discards find's exit status, so an
@@ -336,7 +340,7 @@ chk "[reset-fail] the manual-recovery pointer is emitted (not a silent set -e ex
  "grep -q 'Snapshot restore could not reset' '$OUTG'"
 chk "[reset-fail] the recovery message points at a preserved snapshot dir" \
  "grep -q 'preserved at: .*mosaic-snapshot' '$OUTG'"
-SNAP_E="$(grep -m1 -o '/[^ ]*mosaic-snapshot[^ ]*' "$OUTG")"
+SNAP_E="$(grep -o '/[^ ]*mosaic-snapshot[^ ]*' "$OUTG" | head -1)"
 chk "[reset-fail] the named snapshot directory actually survives for recovery" \
  "[ -n '$SNAP_E' ] && [ -d '$SNAP_E' ]"
 chk "[reset-fail] operator secret value never appears in installer output" \
@@ -353,8 +357,7 @@ chk "[control] without the D2 recovery line the operator gets no snapshot pointe
  "! grep -q 'Snapshot restore could not reset' '$OUTH'"
 [ -n "${SNAP_E:-}" ] && rm -rf "$SNAP_E"
 # Reap any snapshot the reset-fail runs left in /tmp (reset failed → never cleaned).
-orphan_snapshot="$(grep -m1 -o '/[^ ]*mosaic-snapshot[^ ]*' "$OUTH" 2>/dev/null || true)"
+grep -o '/[^ ]*mosaic-snapshot[^ ]*' "$OUTH" 2>/dev/null | head -1 | while read -r s; do rm -rf "$s"; done
 [ -n "$orphan_snapshot" ] && rm -rf "$orphan_snapshot"
 # Cleanup (generated installer controls are also removed by the EXIT trap).
 for d in "$HA" "$REFA" "$HB" "$REFB" "$HC" "$HD" "$HE" "$REFE" "$HF" "$REFF" "$HG" "$HH"; do rm -rf "$d"; done
@@ -32,6 +32,7 @@ packages/mosaic/framework/tools/tmux/test-send-message-socket.sh | requires a re
 packages/mosaic/framework/tools/tmux/test-send-message-verdict.sh | requires real tmux-pane fixtures on a throwaway socket; CI image ships no tmux; #1017 burndown (same condition as its sibling)
 # --- single-suite directories: unmeasured in CI ---
 packages/mosaic/framework/tools/fleet/test-start-agent-session.sh | unmeasured in CI image; stubs tmux via a fake bin dir, likely CI-fit; #1017 burndown
 packages/mosaic/framework/tools/glpi/test-list-http-status.sh | unmeasured in CI image; stub-based (#807 regression harness), likely CI-fit; #1017 burndown
 packages/mosaic/framework/tools/orchestrator/test-board-roll.sh | unmeasured in CI image; file-fixture based, likely CI-fit; #1017 burndown
 packages/mosaic/framework/tools/woodpecker/test-ci-wait-exit-matrix.sh | unmeasured in CI image; drives ci-wait.sh against a stub pipeline-status.sh, likely CI-fit; #1017 burndown
@@ -110,7 +110,7 @@ for attempt in $(seq 1 $((RETRIES + 1))); do
  sleep 1.2
  pane=$("${tmux_cmd[@]}" capture-pane -t "$EFFECTIVE_TARGET" -p 2>/dev/null)
-  if grep -qF "$QUEUED_RE" <<<"$pane"; then
+  if printf '%s' "$pane" | grep -qF "$QUEUED_RE"; then
    status="queued"; break
  fi
  # Locate the REPL input box (prompt glyph). If we cannot see it, we have NO
@@ -121,7 +121,7 @@ for attempt in $(seq 1 $((RETRIES + 1))); do
  fi
  # Input box located AND still carrying our tail => unsubmitted draft. Flush + retry.
  # (Submitted messages scroll up into history; a draft stays on the ❯ line.)
-  if [ -n "$snippet" ] && grep -qF "$snippet" <<<"$promptline"; then
+  if [ -n "$snippet" ] && printf '%s' "$promptline" | grep -qF "$snippet"; then
    status="draft"; continue
  fi
  # Input box located AND clear of our tail => positively submitted. This is the
@@ -34,20 +34,16 @@ tmux new-session -d -s "$DEFAULT_TARGET" -c "$TMPDIR" 'PS1="❯ " exec bash --no
 "$SEND_MESSAGE" -L "$SOCKET" -t "=$TARGET" -m "named socket hello" >/tmp/send-message-named.out
 sleep 0.2
-named_pane="$(capture_named)" || fail "could not capture named socket pane"
+capture_named | grep -qF "named socket hello" || fail "send-message.sh did not deliver to named socket"
-grep -qF "named socket hello" <<<"$named_pane" || fail "send-message.sh did not deliver to named socket"
+if capture_default | grep -qF "named socket hello"; then
 default_pane="$(capture_default)" || fail "could not capture default socket pane"
 if grep -qF "named socket hello" <<<"$default_pane"; then
  fail "send-message.sh leaked named-socket message to default tmux server"
 fi
 "$AGENT_SEND" -L "$SOCKET" -S "tester:source" -s "=$TARGET" -m "agent socket hello" >/tmp/agent-send-named.out
 sleep 0.2
-named_pane="$(capture_named)" || fail "could not capture named socket pane"
+capture_named | grep -qF "[tester:source ->" || fail "agent-send.sh did not include preamble"
-grep -qF "[tester:source ->" <<<"$named_pane" || fail "agent-send.sh did not include preamble"
+capture_named | grep -qF "agent socket hello" || fail "agent-send.sh did not deliver to named socket"
-grep -qF "agent socket hello" <<<"$named_pane" || fail "agent-send.sh did not deliver to named socket"
+if capture_default | grep -qF "agent socket hello"; then
 default_pane="$(capture_default)" || fail "could not capture default socket pane"
 if grep -qF "agent socket hello" <<<"$default_pane"; then
  fail "agent-send.sh leaked named-socket message to default tmux server"
 fi
@@ -69,11 +65,11 @@ done
 sleep 0.2
 for i in $(seq 1 "$CONC_N"); do
  pane=$(tmux -L "$SOCKET" capture-pane -t "=conc-$i:0.0" -p)
-  grep -qF "CONCPAYLOAD-${i}-END" <<<"$pane" \
+  printf '%s' "$pane" | grep -qF "CONCPAYLOAD-${i}-END" \
    || fail "concurrent send dropped payload for pane conc-$i"
  for j in $(seq 1 "$CONC_N"); do
    [ "$j" = "$i" ] && continue
-    if grep -qF "CONCPAYLOAD-${j}-END" <<<"$pane"; then
+    if printf '%s' "$pane" | grep -qF "CONCPAYLOAD-${j}-END"; then
      fail "concurrent send cross-delivered payload $j to pane conc-$i"
    fi
  done
@@ -31,7 +31,7 @@ tmux -L "$SOCKET" new-session -d -s repl -c "$TMP" \
  'PS1="❯ " exec bash --noprofile --norc -i'
 sleep 0.3
 out=$("$SEND" -L "$SOCKET" -t "=repl" -m "verdict fixture one delivered ok" 2>"$TMP/e1"); rc=$?
-if [ "$rc" -eq 0 ] && grep -qF "✓ delivered" <<<"$out"; then
+if [ "$rc" -eq 0 ] && printf '%s' "$out" | grep -qF "✓ delivered"; then
  ok "delivered: ❯-prompt REPL that submits => exit 0 ✓ delivered"
 else
  no "delivered: ❯-prompt REPL that submits => exit 0 ✓ delivered" "rc=$rc out=[$out] err=[$(cat "$TMP/e1")]"
@@ -123,7 +123,7 @@ _manifest_val() {
  # _manifest_val KEY — echo VALUE for KEY=VALUE in the manifest (blank if none).
  local key="$1"
  [ -f "$MANIFEST" ] || return 0
-  awk -v key="$key" 'index($0, key "=") == 1 { sub(/^[^=]*=/, ""); gsub(/[[:space:]]/, ""); print; exit }' "$MANIFEST"
+  sed -n "s/^${key}=//p" "$MANIFEST" | head -n1 | tr -d '[:space:]'
 }
 # _load_watchlist — validate the watch-list path + JSON + schema_version range.
@@ -267,7 +267,7 @@ _poll_source() {
    if snap_json="$(jq -ce '.' <<<"$rawmeta" 2>/dev/null)"; then
      snap_sha="$(jq -r 'if (.snapshot_sha|type) == "string" then .snapshot_sha else "" end' <<<"$snap_json")"
      snap_ts="$(jq -r 'if (.snapshot_ts|type) == "number" then (.snapshot_ts|floor|tostring) else "" end' <<<"$snap_json")"
-      if [ -n "$snap_sha" ] && ! grep -Eq '^[0-9a-f]{7,64}$' <<<"$snap_sha"; then
+      if [ -n "$snap_sha" ] && ! printf '%s' "$snap_sha" | grep -Eq '^[0-9a-f]{7,64}$'; then
        echo "detector.sh: source '$kind/$id' snapshot_sha rejected (not a 7-64 char lowercase-hex git sha) — snapshot metadata DROPPED, poll continues (#940)." >&2
        snap_sha=""
        snap_ts=""
@@ -275,7 +275,7 @@ _poll_source() {
      # A ts must be a sane positive epoch BEFORE any arithmetic touches it: a
      # negative or absurdly large value would make the shell integer comparison
      # below error out and silently KEEP the bad ts — validate first, compare after.
-      if [ -n "$snap_ts" ] && ! grep -Eq '^[0-9]{1,12}$' <<<"$snap_ts"; then
+      if [ -n "$snap_ts" ] && ! printf '%s' "$snap_ts" | grep -Eq '^[0-9]{1,12}$'; then
        echo "detector.sh: source '$kind/$id' snapshot_ts rejected (not a sane positive epoch) — snapshot_ts DROPPED, poll continues (#940)." >&2
        snap_ts=""
      fi
@@ -644,8 +644,7 @@ cmd_render() {
        oseq="$(jq -r '.observed_seq // "?"' <<<"$line")"
        oclass="$(jq -r '.class // "actionable"' <<<"$line")"
        oloc="$(jq -c '.locators // {}' <<<"$line")"
-        olabel="$(_locator_line "$oloc")"
+        olabel="$(_locator_line "$oloc" | head -n1)"
        olabel="${olabel%%$'\n'*}"
        printf '  * seq %s [%s] %s\n' "$oseq" "$(_scrub_inline "$oclass")" "$olabel"
      done <<<"$pending"
    fi
@@ -146,7 +146,7 @@ EOF
 _manifest_val() {
  local key="$1"
  [ -f "$MANIFEST" ] || return 0
-  awk -v key="$key" 'index($0, key "=") == 1 { sub(/^[^=]*=/, ""); gsub(/[[:space:]]/, ""); print; exit }' "$MANIFEST"
+  sed -n "s/^${key}=//p" "$MANIFEST" | head -n1 | tr -d '[:space:]'
 }
 # _load_watchlist — validate path + JSON + shape + Gate B schema range (mirrors
@@ -25,7 +25,7 @@
    "lint": "eslint src",
    "typecheck": "tsc --noEmit",
    "test": "vitest run --passWithNoTests && pnpm run test:framework-shell",
-    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && bash framework/tools/fleet/test-start-agent-session.sh && bash framework/systemd/user/test-fleet-units.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/git/test-explain-diagnostic-status-neutral.sh && bash framework/tools/git/test-detect-platform-outside-repo.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh"
+    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh"
  },
  "dependencies": {
    "@mosaicstack/brain": "workspace:*",
@@ -131,14 +131,13 @@ async function exists(path: string): Promise<boolean> {
 }
 describe('projectRosterV2AgentGeneratedEnv', (): void => {
-  it('maps a roster-v2 agent to exactly the nine generated projection keys', (): void => {
+  it('maps a roster-v2 agent to exactly the eight generated projection keys', (): void => {
    const roster = parseRosterV2(rosterYaml, 'yaml');
    const agent = roster.agents.find((candidate) => candidate.name === 'coder0');
    expect(agent).toBeDefined();
    const values = projectRosterV2AgentGeneratedEnv(roster, agent!);
    expect(values).toEqual({
      MOSAIC_AGENT_NAME: 'coder0',
      MOSAIC_GIT_IDENTITY: 'coder0',
      MOSAIC_AGENT_CLASS: 'code',
      MOSAIC_AGENT_RUNTIME: 'pi',
      MOSAIC_AGENT_MODEL: 'gpt-5.6-sol',
@@ -422,7 +422,6 @@ describe('fleet roster parsing', () => {
    expect(generateAgentEnv(roster, getRosterAgent(roster, 'coder0'))).toBe(
      [
        'MOSAIC_AGENT_NAME=coder0',
        'MOSAIC_GIT_IDENTITY=coder0',
        // Reflects the roster's canonicalized compatibility class (A3a).
        'MOSAIC_AGENT_CLASS=code',
        'MOSAIC_AGENT_RUNTIME=codex',
@@ -3800,7 +3799,6 @@ describe('fleet add command', () => {
      'utf8',
    );
    expect(envContent).toContain('MOSAIC_AGENT_NAME=coder0');
    expect(envContent).toContain('MOSAIC_GIT_IDENTITY=coder0');
    expect(envContent).toContain('MOSAIC_AGENT_RUNTIME=codex');
  });
@@ -484,7 +484,6 @@ function generateAgentEnvValues(
  const workingDirectory = agent.workingDirectory ?? roster.defaults.workingDirectory;
  return {
    MOSAIC_AGENT_NAME: agent.name,
    MOSAIC_GIT_IDENTITY: agent.name,
    MOSAIC_AGENT_CLASS: agent.className,
    MOSAIC_AGENT_RUNTIME: agent.runtime,
    MOSAIC_AGENT_MODEL: agent.modelHint ?? '',
@@ -5,7 +5,6 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import {
  buildPiSkillArgs,
  discoverPiExtensionArgs,
  enumerateSkillDirs,
  piForceSkillNames,
  registerRuntimeLaunchers,
@@ -179,52 +178,6 @@ describe('buildPiSkillArgs', () => {
  });
 });
 describe('discoverPiExtensionArgs', () => {
  it('loads the core and goal extensions in deterministic order from Mosaic home', () => {
    const root = mkdtempSync(join(tmpdir(), 'mosaic-pi-extensions-'));
    const runtimeDir = join(root, 'runtime', 'pi');
    mkdirSync(runtimeDir, { recursive: true });
    writeFileSync(join(runtimeDir, 'goal-extension.ts'), '// goal\n');
    writeFileSync(join(runtimeDir, 'mosaic-extension.ts'), '// core\n');
    try {
      expect(discoverPiExtensionArgs(root)).toEqual([
        '--extension',
        join(runtimeDir, 'mosaic-extension.ts'),
        '--extension',
        join(runtimeDir, 'goal-extension.ts'),
      ]);
    } finally {
      rmSync(root, { recursive: true, force: true });
    }
  });
  it('remains backward-compatible when the optional goal extension is absent', () => {
    const root = mkdtempSync(join(tmpdir(), 'mosaic-pi-extensions-'));
    const runtimeDir = join(root, 'runtime', 'pi');
    mkdirSync(runtimeDir, { recursive: true });
    writeFileSync(join(runtimeDir, 'mosaic-extension.ts'), '// core\n');
    try {
      expect(discoverPiExtensionArgs(root)).toEqual([
        '--extension',
        join(runtimeDir, 'mosaic-extension.ts'),
      ]);
    } finally {
      rmSync(root, { recursive: true, force: true });
    }
  });
  it('emits no extension arguments when Mosaic runtime assets are absent', () => {
    const root = mkdtempSync(join(tmpdir(), 'mosaic-pi-extensions-'));
    try {
      expect(discoverPiExtensionArgs(root)).toEqual([]);
    } finally {
      rmSync(root, { recursive: true, force: true });
    }
  });
 });
 describe('enumerateSkillDirs (real FS)', () => {
  let root: string;
@@ -715,15 +715,9 @@ export function buildPiSkillArgs(
  return ['--no-skills', ...forcedSkillArgs];
 }
-const PI_EXTENSION_FILES = ['mosaic-extension.ts', 'goal-extension.ts'] as const;
+function discoverPiExtension(): string[] {
-
+  const ext = join(MOSAIC_HOME, 'runtime', 'pi', 'mosaic-extension.ts');
-export function discoverPiExtensionArgs(mosaicHome: string = MOSAIC_HOME): string[] {
+  return existsSync(ext) ? ['--extension', ext] : [];
  const args: string[] = [];
  for (const fileName of PI_EXTENSION_FILES) {
    const extensionPath = join(mosaicHome, 'runtime', 'pi', fileName);
    if (existsSync(extensionPath)) args.push('--extension', extensionPath);
  }
  return args;
 }
 // ─── Launch functions ────────────────────────────────────────────────────────
@@ -798,7 +792,7 @@ function launchRuntime(runtime: RuntimeName, args: string[], yolo: boolean): nev
      const prompt = buildRuntimePrompt('pi');
      const cliArgs = ['--append-system-prompt', prompt];
      cliArgs.push(...buildPiSkillArgs(args));
-      cliArgs.push(...discoverPiExtensionArgs());
+      cliArgs.push(...discoverPiExtension());
      if (hasMissionNoArgs) {
        cliArgs.push(missionPrompt);
      } else {
@@ -209,20 +209,6 @@ describe('FileConfigAdapter.syncFramework — defaults seeding', () => {
    );
  });
  it('deploys the Mosaic-owned Pi goal extension only inside the Mosaic runtime tree', async () => {
    const sourceRuntime = join(fixture.sourceDir, 'runtime', 'pi');
    mkdirSync(sourceRuntime, { recursive: true });
    writeFileSync(join(sourceRuntime, 'goal-extension.ts'), '// persistent goal extension\n');
    const adapter = new FileConfigAdapter(fixture.mosaicHome, fixture.sourceDir);
    await adapter.syncFramework('fresh');
    expect(
      readFileSync(join(fixture.mosaicHome, 'runtime', 'pi', 'goal-extension.ts'), 'utf-8'),
    ).toBe('// persistent goal extension\n');
    expect(existsSync(join(fixture.mosaicHome, '.pi'))).toBe(false);
  });
  it('is a no-op for seeding when defaults/ dir does not exist', async () => {
    rmSync(fixture.defaultsDir, { recursive: true });
@@ -358,7 +358,6 @@ function generatedValues(
 ): Readonly<Record<string, string>> {
  return {
    MOSAIC_AGENT_NAME: agent.name,
    MOSAIC_GIT_IDENTITY: agent.name,
    MOSAIC_AGENT_CLASS: agent.className,
    MOSAIC_AGENT_RUNTIME: agent.runtime,
    MOSAIC_AGENT_MODEL: agent.model,
@@ -380,7 +380,7 @@ const COMMAND_RECORDS: Readonly<Record<string, RegExp>> = {
 const DATA_PROFILE_BODIES: Readonly<Record<string, string>> = {
  'DATA.DOTENV.FLEET_LAUNCH':
-    'MOSAIC_AGENT_NAME=<roster name>\nMOSAIC_GIT_IDENTITY=<roster name>\nMOSAIC_AGENT_CLASS=<roster class>\nMOSAIC_AGENT_RUNTIME=<roster runtime>\nMOSAIC_AGENT_MODEL=<roster model hint>\nMOSAIC_AGENT_REASONING=<roster reasoning>\nMOSAIC_AGENT_TOOL_POLICY=<roster tool policy>\nMOSAIC_AGENT_WORKDIR=<absolute roster work directory>\nMOSAIC_TMUX_SOCKET=<roster socket or empty>',
+    'MOSAIC_AGENT_NAME=<roster name>\nMOSAIC_AGENT_CLASS=<roster class>\nMOSAIC_AGENT_RUNTIME=<roster runtime>\nMOSAIC_AGENT_MODEL=<roster model hint>\nMOSAIC_AGENT_REASONING=<roster reasoning>\nMOSAIC_AGENT_TOOL_POLICY=<roster tool policy>\nMOSAIC_AGENT_WORKDIR=<absolute roster work directory>\nMOSAIC_TMUX_SOCKET=<roster socket or empty>',
  'DATA.TEXT_TABLE.FLEET_TASKS':
    '| W-FLEET | in-progress | Fleet (agent-session execution layer) | Phase 2/5 | docs/fleet/TASKS.md | observability dogfooded on live stub fleet; control plane rides federation (W1) |',
  'DATA.TEXT_DIAGRAM.BACKLOG_FLOW':
@@ -406,7 +406,7 @@ const DATA_PROFILE_BODIES: Readonly<Record<string, string>> = {
  'DATA.JSON.MUTATION_RESULT':
    '{\n  "applied": false,\n  "authoritativeRoster": "committed",\n  "projections": "incomplete",\n  "recovery": {\n    "code": "projection-apply-failed",\n    "action": "regenerate-projections-from-roster"\n  }\n}',
  'DATA.DOTENV.GENERATED_ENV':
-    'MOSAIC_AGENT_NAME=<roster name>\nMOSAIC_GIT_IDENTITY=<roster name>\nMOSAIC_AGENT_CLASS=<roster class>\nMOSAIC_AGENT_RUNTIME=<roster runtime>\nMOSAIC_AGENT_MODEL=<roster model hint>\nMOSAIC_AGENT_REASONING=<roster reasoning>\nMOSAIC_AGENT_TOOL_POLICY=<roster tool policy>\nMOSAIC_AGENT_WORKDIR=<absolute roster work directory>\nMOSAIC_TMUX_SOCKET=<roster socket or empty>',
+    'MOSAIC_AGENT_NAME=<roster name>\nMOSAIC_AGENT_CLASS=<roster class>\nMOSAIC_AGENT_RUNTIME=<roster runtime>\nMOSAIC_AGENT_MODEL=<roster model hint>\nMOSAIC_AGENT_REASONING=<roster reasoning>\nMOSAIC_AGENT_TOOL_POLICY=<roster tool policy>\nMOSAIC_AGENT_WORKDIR=<absolute roster work directory>\nMOSAIC_TMUX_SOCKET=<roster socket or empty>',
  'DATA.YAML.ROSTER_FIELDS':
    'version: 2\ngeneration: 1\ntransport: tmux\ntmux:\n  socket_name: mosaic-fleet\n  holder_session: _holder\ndefaults:\n  working_directory: ~/src\n  runtime: pi\nruntimes:\n  pi:\n    reset_command: /new\nagents:\n  - name: coder0\n    alias: Coder 0\n    class: code\n    runtime: pi\n    provider: openai\n    model: gpt-5.6-sol\n    reasoning: high\n    tool_policy: code\n    working_directory: ~/src\n    persistent_persona: false\n    reset_between_tasks: true\n    lifecycle:\n      enabled: true\n      desired_state: stopped\n    launch:\n      yolo: true',
 };
@@ -922,8 +922,8 @@ describe('fleet operator documentation', (): void => {
    );
    expect(
      surfaces.filter((surface): boolean => surface.category === 'InlineLiteral'),
-    ).toHaveLength(863);
+    ).toHaveLength(858);
-    expect(surfaces).toHaveLength(887);
+    expect(surfaces).toHaveLength(882);
    const rosterSource = await readFile(join(fleetDocs, 'examples', 'roster-v2.yaml'), 'utf8');
    const auxiliary: CodeSurface = {
@@ -597,7 +597,6 @@ export function projectRosterV2AgentGeneratedEnv(
 ): Readonly<Record<string, string>> {
  return {
    MOSAIC_AGENT_NAME: agent.name,
    MOSAIC_GIT_IDENTITY: agent.name,
    MOSAIC_AGENT_CLASS: agent.className,
    MOSAIC_AGENT_RUNTIME: agent.runtime,
    MOSAIC_AGENT_MODEL: agent.model,
@@ -22,7 +22,6 @@ import {
 const generatedValues = {
  MOSAIC_AGENT_NAME: 'coder0',
  MOSAIC_GIT_IDENTITY: 'coder0',
  MOSAIC_AGENT_CLASS: 'code',
  MOSAIC_AGENT_RUNTIME: 'pi',
  MOSAIC_AGENT_MODEL: 'openai-codex/gpt-5.6-sol',
@@ -46,7 +45,6 @@ describe('generated fleet agent environment boundary', (): void => {
    expect(renderGeneratedAgentEnvironment(generatedValues)).toBe(
      [
        'MOSAIC_AGENT_NAME=coder0',
        'MOSAIC_GIT_IDENTITY=coder0',
        'MOSAIC_AGENT_CLASS=code',
        'MOSAIC_AGENT_RUNTIME=pi',
        'MOSAIC_AGENT_MODEL=openai-codex/gpt-5.6-sol',
@@ -80,22 +78,6 @@ describe('generated fleet agent environment boundary', (): void => {
    expect(String(error)).toMatch(/key=.*sha256=/);
  });
  it.each([
    ['unsafe-git-identity', 'other/identity'],
    ['git-identity-mismatch', 'reviewer0'],
  ])('rejects %s before any launch consumer can use it', (code: string, identity: string): void => {
    expect((): void => {
      renderGeneratedAgentEnvironment({
        ...generatedValues,
        MOSAIC_GIT_IDENTITY: identity,
      });
    }).toThrow(
      expect.objectContaining({
        diagnostic: expect.objectContaining({ code, key: 'MOSAIC_GIT_IDENTITY' }),
      }),
    );
  });
  it('rejects unsafe generated paths before any launch consumer can use them', (): void => {
    expect((): void => {
      renderGeneratedAgentEnvironment({
@@ -73,7 +73,6 @@ export class AgentEnvBoundaryError extends Error {
 export const GENERATED_AGENT_ENV_KEYS = [
  'MOSAIC_AGENT_NAME',
  'MOSAIC_GIT_IDENTITY',
  'MOSAIC_AGENT_CLASS',
  'MOSAIC_AGENT_RUNTIME',
  'MOSAIC_AGENT_MODEL',
@@ -403,7 +402,6 @@ function assertGeneratedValues(values: Readonly<Record<string, string>>): void {
    if (value === undefined) throw new AgentEnvBoundaryError('missing-key', key, '');
  }
  const name = requiredGeneratedValue(values, 'MOSAIC_AGENT_NAME');
  const gitIdentity = requiredGeneratedValue(values, 'MOSAIC_GIT_IDENTITY');
  const className = requiredGeneratedValue(values, 'MOSAIC_AGENT_CLASS');
  const runtime = requiredGeneratedValue(values, 'MOSAIC_AGENT_RUNTIME');
  const model = requiredGeneratedValue(values, 'MOSAIC_AGENT_MODEL');
@@ -414,12 +412,6 @@ function assertGeneratedValues(values: Readonly<Record<string, string>>): void {
  if (!AGENT_NAME.test(name))
    throw new AgentEnvBoundaryError('unsafe-agent-name', 'MOSAIC_AGENT_NAME', name);
  if (!AGENT_NAME.test(gitIdentity)) {
    throw new AgentEnvBoundaryError('unsafe-git-identity', 'MOSAIC_GIT_IDENTITY', gitIdentity);
  }
  if (gitIdentity !== name) {
    throw new AgentEnvBoundaryError('git-identity-mismatch', 'MOSAIC_GIT_IDENTITY', gitIdentity);
  }
  if (!POLICY_NAME.test(className)) {
    throw new AgentEnvBoundaryError('unsafe-class', 'MOSAIC_AGENT_CLASS', className);
  }
@@ -1405,7 +1405,6 @@ function generatedValues(
 ): Readonly<Record<string, string>> {
  return {
    MOSAIC_AGENT_NAME: agent.name,
    MOSAIC_GIT_IDENTITY: agent.name,
    MOSAIC_AGENT_CLASS: agent.className,
    MOSAIC_AGENT_RUNTIME: agent.runtime,
    MOSAIC_AGENT_MODEL: agent.model,
@@ -1,796 +0,0 @@
 import { afterEach, describe, expect, it, vi } from 'vitest';
 interface FakeEntry {
  type: string;
  customType?: string;
  data?: unknown;
 }
 interface SentMessage {
  message: {
    customType: string;
    content: string;
    display: boolean;
  };
  options?: {
    triggerTurn?: boolean;
    deliverAs?: 'steer' | 'followUp' | 'nextTurn';
  };
 }
 interface FakeContext {
  cwd: string;
  ui: {
    notifications: Array<{ message: string; level?: string }>;
    statuses: Map<string, string | undefined>;
    notify(message: string, level?: string): void;
    setStatus(key: string, value: string | undefined): void;
  };
  sessionManager: {
    getBranch(): FakeEntry[];
  };
  isIdle(): boolean;
  hasPendingMessages(): boolean;
  abort(): void;
 }
 type EventHandler = (
  event: Record<string, unknown>,
  context: FakeContext,
 ) => unknown | Promise<unknown>;
 type CommandHandler = (args: string, context: FakeContext) => unknown | Promise<unknown>;
 interface FakeToolResult {
  content: Array<{ type: string; text: string }>;
  details?: unknown;
  terminate?: boolean;
 }
 interface FakeTool {
  name: string;
  execute(
    toolCallId: string,
    params: Record<string, unknown>,
    signal: AbortSignal | undefined,
    onUpdate: undefined,
    context: FakeContext,
  ): Promise<FakeToolResult>;
 }
 interface GoalExtensionFactory {
  (api: FakePiApi): void;
 }
 interface GoalExtensionModule {
  default: GoalExtensionFactory;
 }
 interface FakePiApi {
  on(event: string, handler: EventHandler): void;
  registerCommand(name: string, options: { description: string; handler: CommandHandler }): void;
  registerTool(tool: FakeTool): void;
  appendEntry(customType: string, data?: unknown): void;
  sendMessage(message: SentMessage['message'], options?: SentMessage['options']): void;
 }
 function isGoalExtensionModule(value: unknown): value is GoalExtensionModule {
  if (typeof value !== 'object' || value === null) return false;
  return typeof Reflect.get(value, 'default') === 'function';
 }
 const goalExtensionUrl = new URL('../../framework/runtime/pi/goal-extension.ts', import.meta.url)
  .href;
 const importedGoalExtension: unknown = await import(goalExtensionUrl);
 if (!isGoalExtensionModule(importedGoalExtension)) {
  throw new Error('Pi goal extension must export a default registration function');
 }
 const registerGoalExtension = importedGoalExtension.default;
 function isRecord(value: unknown): value is Record<string, unknown> {
  return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
 class FakePi {
  readonly handlers = new Map<string, EventHandler[]>();
  readonly commands = new Map<string, CommandHandler>();
  readonly tools = new Map<string, FakeTool>();
  readonly entries: FakeEntry[] = [];
  readonly sentMessages: SentMessage[] = [];
  readonly notifications: Array<{ message: string; level?: string }> = [];
  readonly statuses = new Map<string, string | undefined>();
  branch: FakeEntry[] = [];
  idle = true;
  pending = false;
  abortCount = 0;
  readonly context: FakeContext = {
    cwd: '/tmp/project',
    ui: {
      notifications: this.notifications,
      statuses: this.statuses,
      notify: (message: string, level?: string): void => {
        this.notifications.push({ message, level });
      },
      setStatus: (key: string, value: string | undefined): void => {
        this.statuses.set(key, value);
      },
    },
    sessionManager: {
      getBranch: (): FakeEntry[] => [...this.branch],
    },
    isIdle: (): boolean => this.idle,
    hasPendingMessages: (): boolean => this.pending,
    abort: (): void => {
      this.abortCount += 1;
    },
  };
  readonly api: FakePiApi = {
    on: (event: string, handler: EventHandler): void => {
      this.handlers.set(event, [...(this.handlers.get(event) ?? []), handler]);
    },
    registerCommand: (
      name: string,
      options: { description: string; handler: CommandHandler },
    ): void => {
      this.commands.set(name, options.handler);
    },
    registerTool: (tool: FakeTool): void => {
      this.tools.set(tool.name, tool);
    },
    appendEntry: (customType: string, data?: unknown): void => {
      const entry: FakeEntry = { type: 'custom', customType, data };
      this.entries.push(entry);
      this.branch.push(entry);
    },
    sendMessage: (message: SentMessage['message'], options?: SentMessage['options']): void => {
      this.sentMessages.push({ message, options });
    },
  };
  constructor(initialBranch: FakeEntry[] = []) {
    this.branch = [...initialBranch];
    registerGoalExtension(this.api);
  }
  async emit(event: string, value: Record<string, unknown> = {}): Promise<unknown[]> {
    const results: unknown[] = [];
    for (const handler of this.handlers.get(event) ?? []) {
      results.push(await handler(value, this.context));
    }
    return results;
  }
  async goal(args: string): Promise<void> {
    const handler = this.commands.get('goal');
    if (handler === undefined) throw new Error('/goal was not registered');
    await handler(args, this.context);
  }
  async report(params: Record<string, unknown>): Promise<FakeToolResult> {
    const tool = this.tools.get('mosaic_goal_report');
    if (tool === undefined) throw new Error('mosaic_goal_report was not registered');
    return await tool.execute('goal-report-1', params, undefined, undefined, this.context);
  }
 }
 function latestGoalStateData(pi: FakePi): Record<string, unknown> {
  for (let index = pi.entries.length - 1; index >= 0; index -= 1) {
    const entry = pi.entries[index];
    if (entry?.customType === 'mosaic-goal-state' && isRecord(entry.data)) return entry.data;
  }
  throw new Error('No persisted Mosaic goal state found');
 }
 function stateField(pi: FakePi, field: string): unknown {
  return latestGoalStateData(pi)[field];
 }
 function activeGoalStatementFromContext(result: unknown): string {
  if (!isRecord(result)) throw new Error('Context handler did not return an object');
  const messages = result['messages'];
  if (!Array.isArray(messages)) throw new Error('Context result did not include messages');
  const goalMessage = messages.find(
    (message: unknown): boolean =>
      isRecord(message) && message['customType'] === 'mosaic-goal-context',
  );
  if (!isRecord(goalMessage) || typeof goalMessage['content'] !== 'string') {
    throw new Error('Goal context message was not injected');
  }
  return goalMessage['content'];
 }
 afterEach(() => {
  vi.useRealTimers();
  vi.unstubAllEnvs();
 });
 describe('Mosaic Pi goal extension commands', () => {
  it('shows help and handles controls safely when no goal exists', async () => {
    const pi = new FakePi();
    await pi.goal('');
    expect(pi.notifications.at(-1)?.message).toContain('/goal set');
    await pi.goal('status');
    expect(pi.notifications.at(-1)?.message).toContain('No Mosaic goal is set');
    for (const command of ['pause', 'resume', 'cancel']) {
      await pi.goal(command);
      expect(pi.notifications.at(-1)?.level).toBe('warning');
    }
    expect(pi.entries).toHaveLength(0);
    expect(pi.sentMessages).toHaveLength(0);
  });
  it('sets, reports, pauses, resumes, and cancels a bounded goal', async () => {
    const pi = new FakePi();
    await pi.goal('set Deliver the local goal extension with tests');
    expect(stateField(pi, 'phase')).toBe('active');
    expect(stateField(pi, 'statement')).toBe('Deliver the local goal extension with tests');
    expect(pi.sentMessages).toHaveLength(1);
    expect(pi.sentMessages[0]?.options?.triggerTurn).toBe(true);
    await pi.goal('status');
    expect(pi.notifications.at(-1)?.message).toContain('Deliver the local goal extension');
    expect(pi.notifications.at(-1)?.message).toContain('active');
    await pi.goal('pause');
    expect(stateField(pi, 'phase')).toBe('paused');
    pi.sentMessages.length = 0;
    await pi.emit('agent_settled');
    expect(pi.sentMessages).toHaveLength(0);
    await pi.goal('resume');
    expect(stateField(pi, 'phase')).toBe('active');
    expect(pi.sentMessages).toHaveLength(1);
    await pi.goal('cancel');
    expect(stateField(pi, 'phase')).toBe('cancelled');
    pi.sentMessages.length = 0;
    await pi.emit('agent_settled');
    expect(pi.sentMessages).toHaveLength(0);
  });
  it('accepts /goal <statement> shorthand but refuses to replace an active goal', async () => {
    const pi = new FakePi();
    await pi.goal('First goal');
    const firstGoalId = stateField(pi, 'goalId');
    await pi.goal('set Second goal');
    expect(stateField(pi, 'goalId')).toBe(firstGoalId);
    expect(stateField(pi, 'statement')).toBe('First goal');
    expect(pi.notifications.at(-1)?.level).toBe('warning');
    expect(pi.notifications.at(-1)?.message).toContain('/goal cancel');
  });
  it('rejects invalid phase transitions, aborts busy work, and supports clear as cancel', async () => {
    const pi = new FakePi();
    await pi.goal('set Preserve transition safety');
    await pi.goal('resume');
    expect(pi.notifications.at(-1)?.message).toContain('cannot be resumed');
    pi.idle = false;
    await pi.goal('pause maintenance window');
    expect(stateField(pi, 'stopReason')).toBe('maintenance window');
    expect(pi.abortCount).toBe(1);
    await pi.goal('pause');
    expect(pi.notifications.at(-1)?.message).toContain('cannot be paused');
    await pi.goal('clear');
    expect(stateField(pi, 'phase')).toBe('cancelled');
    expect(pi.abortCount).toBe(2);
  });
  it('rejects empty and oversized goal statements without starting a run', async () => {
    const pi = new FakePi();
    await pi.goal('set');
    await pi.goal(`set ${'x'.repeat(8_001)}`);
    expect(pi.entries).toHaveLength(0);
    expect(pi.sentMessages).toHaveLength(0);
    expect(pi.notifications.at(-1)?.level).toBe('warning');
  });
 });
 describe('Mosaic Pi goal lifecycle', () => {
  it('injects one fresh active contract before every model context', async () => {
    const pi = new FakePi();
    await pi.goal('set Keep the agent oriented');
    const existingGoalContext = {
      role: 'custom',
      customType: 'mosaic-goal-context',
      content: 'stale',
    };
    const existingContinuation = {
      role: 'custom',
      customType: 'mosaic-goal-continuation',
      content: 'stale continuation',
    };
    const first = await pi.emit('context', {
      messages: [existingGoalContext, existingContinuation],
    });
    const second = await pi.emit('context', { messages: [] });
    expect(activeGoalStatementFromContext(first[0])).toContain('Keep the agent oriented');
    expect(activeGoalStatementFromContext(first[0])).toContain('mosaic_goal_report');
    expect(activeGoalStatementFromContext(first[0])).not.toContain('stale');
    if (!isRecord(first[0]) || !Array.isArray(first[0]['messages'])) {
      throw new Error('Expected filtered context messages');
    }
    expect(first[0]['messages']).toHaveLength(1);
    expect(activeGoalStatementFromContext(second[0])).toContain('Keep the agent oriented');
    await pi.goal('cancel');
    expect(
      await pi.emit('context', {
        messages: [existingGoalContext, existingContinuation],
      }),
    ).toEqual([{ messages: [] }]);
  });
  it('lets an existing busy run adopt the goal and waits behind a pending message', async () => {
    const busy = new FakePi();
    busy.idle = false;
    await busy.goal('set Join the current run safely');
    expect(busy.sentMessages).toHaveLength(0);
    busy.pending = true;
    await busy.emit('agent_settled');
    expect(busy.sentMessages).toHaveLength(0);
    busy.pending = false;
    busy.idle = true;
    await busy.emit('agent_settled');
    expect(busy.sentMessages).toHaveLength(1);
  });
  it('records every turn and continues once when an active run settles', async () => {
    const pi = new FakePi();
    await pi.goal('set Finish all acceptance criteria');
    pi.sentMessages.length = 0;
    await pi.emit('turn_end', { turnIndex: 0, message: {}, toolResults: [] });
    expect(stateField(pi, 'turnCount')).toBe(1);
    expect(stateField(pi, 'lastCheckSource')).toBe('turn');
    await pi.emit('agent_settled');
    await pi.emit('agent_settled');
    expect(pi.sentMessages).toHaveLength(1);
    expect(pi.sentMessages[0]?.message.content).toContain('Goal remains active');
    await pi.emit('agent_start');
    await pi.emit('agent_settled');
    expect(pi.sentMessages).toHaveLength(2);
  });
  it('requires two consecutive evidence-bearing achievement reports', async () => {
    const pi = new FakePi();
    await pi.goal('set Prove the feature works');
    pi.sentMessages.length = 0;
    const first = await pi.report({
      status: 'achieved',
      summary: 'Focused tests pass',
      evidence: ['pnpm test: 12 passed'],
    });
    expect(first.terminate).toBe(true);
    expect(stateField(pi, 'phase')).toBe('verifying');
    expect(stateField(pi, 'verificationPasses')).toBe(1);
    await pi.emit('agent_settled');
    expect(pi.sentMessages).toHaveLength(1);
    expect(pi.sentMessages[0]?.message.content).toContain('verification pass');
    await pi.emit('agent_start');
    const second = await pi.report({
      status: 'achieved',
      summary: 'Independent recheck confirms completion',
      evidence: ['rerun: 12 passed', 'framework path verified'],
    });
    expect(second.terminate).toBe(true);
    expect(stateField(pi, 'phase')).toBe('achieved');
    expect(stateField(pi, 'verificationPasses')).toBe(2);
    pi.sentMessages.length = 0;
    await pi.emit('agent_settled');
    expect(pi.sentMessages).toHaveLength(0);
  });
  it('rejects malformed progress reports and reports submitted without an active goal', async () => {
    const noGoal = new FakePi();
    await expect(
      noGoal.report({ status: 'continue', summary: 'work', evidence: [] }),
    ).rejects.toThrow(/No active Mosaic goal/);
    const pi = new FakePi();
    await pi.goal('set Validate report boundaries');
    const invalidReports: Record<string, unknown>[] = [
      {},
      { status: 'invalid', summary: 'work', evidence: [] },
      { status: 'continue', evidence: [] },
      { status: 'continue', summary: '   ', evidence: [] },
      { status: 'continue', summary: 'x'.repeat(2_001), evidence: [] },
      { status: 'continue', summary: 'work', evidence: 'not-an-array' },
      { status: 'continue', summary: 'work', evidence: Array.from({ length: 21 }, () => 'x') },
      { status: 'continue', summary: 'work', evidence: [4] },
      { status: 'continue', summary: 'work', evidence: [''] },
      { status: 'continue', summary: 'work', evidence: ['x'.repeat(1_001)] },
      { status: 'continue', summary: 'work', evidence: [], nextStep: 4 },
      { status: 'continue', summary: 'work', evidence: [], nextStep: '   ' },
      { status: 'continue', summary: 'work', evidence: [], nextStep: 'x'.repeat(2_001) },
    ];
    for (const report of invalidReports) {
      await expect(pi.report(report)).rejects.toThrow();
    }
    expect(stateField(pi, 'phase')).toBe('active');
  });
  it('rejects an achievement claim without evidence', async () => {
    const pi = new FakePi();
    await pi.goal('set Require evidence');
    await expect(
      pi.report({ status: 'achieved', summary: 'Trust me', evidence: [] }),
    ).rejects.toThrow(/evidence/i);
    expect(stateField(pi, 'phase')).toBe('active');
  });
  it('redacts credential-shaped goal and report text before persistence or display', async () => {
    const githubToken = `ghp_${'a'.repeat(32)}`;
    const anthropicKey = `sk-ant-api03-${'b'.repeat(40)}`;
    const bearerToken = 'header.payload.signature-canary';
    const databaseUrl = 'postgresql://mosaic:[email protected]/mosaic';
    const password = 'password-canary';
    const pi = new FakePi();
    await pi.goal(`set Rotate ${githubToken} without retaining it`);
    const context = await pi.emit('context', { messages: [] });
    expect(activeGoalStatementFromContext(context[0])).not.toContain(githubToken);
    const result = await pi.report({
      status: 'achieved',
      summary: `Validated ${anthropicKey}`,
      evidence: [`Authorization: Bearer ${bearerToken}`, `DATABASE_URL=${databaseUrl}`],
      nextStep: `password=${password}`,
    });
    await pi.goal('status');
    const persisted = JSON.stringify(latestGoalStateData(pi));
    const displayed = pi.notifications.at(-1)?.message ?? '';
    const toolOutput = JSON.stringify(result);
    for (const secret of [githubToken, anthropicKey, bearerToken, databaseUrl, password]) {
      expect(persisted).not.toContain(secret);
      expect(displayed).not.toContain(secret);
      expect(toolOutput).not.toContain(secret);
    }
    expect(persisted).toContain('[REDACTED-SECRET]');
  });
  it('preserves ordinary typed fields that resemble sensitive assignment names', async () => {
    const typedFields = 'token: string, password: boolean, secret: false';
    const pi = new FakePi();
    await pi.goal(`set Preserve TypeScript fields: ${typedFields}`);
    await pi.report({
      status: 'continue',
      summary: `Schema still contains ${typedFields}`,
      evidence: [`interface Config { ${typedFields} }`],
      nextStep: `Keep ${typedFields} unchanged`,
    });
    expect(stateField(pi, 'statement')).toContain(typedFields);
    expect(JSON.stringify(stateField(pi, 'lastReport'))).toContain(typedFields);
    expect(JSON.stringify(latestGoalStateData(pi))).not.toContain('[REDACTED-SECRET]');
  });
  it('stops autonomous continuation when the max-turn limit is reached', async () => {
    vi.stubEnv('MOSAIC_GOAL_MAX_TURNS', '2');
    const pi = new FakePi();
    await pi.goal('set Bound this run');
    pi.sentMessages.length = 0;
    await pi.emit('turn_end', { turnIndex: 0, message: {}, toolResults: [] });
    await pi.emit('turn_end', { turnIndex: 1, message: {}, toolResults: [] });
    expect(stateField(pi, 'phase')).toBe('exhausted');
    expect(pi.abortCount).toBe(1);
    await pi.emit('agent_settled');
    expect(pi.sentMessages).toHaveLength(0);
  });
  it('resets the no-progress sequence when a continuation report changes', async () => {
    const pi = new FakePi();
    await pi.goal('set Track changing progress');
    await pi.report({
      status: 'continue',
      summary: 'First checkpoint',
      evidence: ['file A changed'],
      nextStep: 'Run focused tests',
    });
    await pi.report({
      status: 'continue',
      summary: 'Second checkpoint',
      evidence: ['focused tests passed'],
      nextStep: 'Review the diff',
    });
    expect(stateField(pi, 'phase')).toBe('active');
    expect(stateField(pi, 'noProgressReports')).toBe(1);
    await pi.goal('status');
    expect(pi.notifications.at(-1)?.message).toContain('Next step: Review the diff');
    expect(pi.notifications.at(-1)?.message).toContain('focused tests passed');
  });
  it('stops after a bounded number of identical no-progress reports', async () => {
    vi.stubEnv('MOSAIC_GOAL_MAX_NO_PROGRESS', '2');
    const pi = new FakePi();
    await pi.goal('set Detect stalled work');
    const report = {
      status: 'continue',
      summary: 'No change yet',
      evidence: ['same observation'],
      nextStep: 'Try again',
    };
    await pi.report(report);
    await pi.report(report);
    expect(stateField(pi, 'phase')).toBe('exhausted');
    expect(stateField(pi, 'noProgressReports')).toBe(2);
    pi.sentMessages.length = 0;
    await pi.emit('agent_settled');
    expect(pi.sentMessages).toHaveLength(0);
  });
  it('rejects a goal report mixed with another tool result in the same turn', async () => {
    const pi = new FakePi();
    await pi.goal('set Require a sole final report');
    await pi.report({
      status: 'achieved',
      summary: 'Premature mixed claim',
      evidence: ['one observation'],
    });
    await pi.emit('turn_end', {
      turnIndex: 0,
      message: {},
      toolResults: [{ toolName: 'mosaic_goal_report' }, { toolName: 'read' }],
    });
    expect(stateField(pi, 'phase')).toBe('active');
    expect(stateField(pi, 'verificationPasses')).toBe(0);
    expect(stateField(pi, 'lastCheckOutcome')).toBe('mixed-goal-report-rejected');
    expect(pi.notifications.at(-1)?.level).toBe('warning');
  });
  it('marks blocked reports terminal until the operator resumes', async () => {
    const pi = new FakePi();
    await pi.goal('set Stop on a real blocker');
    await pi.report({
      status: 'blocked',
      summary: 'Missing required access',
      evidence: ['provider returned 403'],
    });
    expect(stateField(pi, 'phase')).toBe('blocked');
    pi.sentMessages.length = 0;
    await pi.emit('agent_settled');
    expect(pi.sentMessages).toHaveLength(0);
    await pi.goal('resume');
    expect(stateField(pi, 'phase')).toBe('active');
    expect(stateField(pi, 'turnCount')).toBe(0);
    expect(pi.sentMessages).toHaveLength(1);
  });
 });
 describe('Mosaic Pi goal compaction and restoration', () => {
  it('resets provisional verification and defers manual-compaction continuation until idle', async () => {
    vi.useFakeTimers();
    const pi = new FakePi();
    await pi.goal('set Survive compaction');
    await pi.report({
      status: 'achieved',
      summary: 'Initial claim',
      evidence: ['focused test passed'],
    });
    expect(stateField(pi, 'phase')).toBe('verifying');
    pi.sentMessages.length = 0;
    await pi.emit('session_compact', { reason: 'manual', willRetry: false });
    expect(stateField(pi, 'phase')).toBe('active');
    expect(stateField(pi, 'verificationPasses')).toBe(0);
    expect(stateField(pi, 'compactionCount')).toBe(1);
    expect(stateField(pi, 'lastCheckSource')).toBe('compact');
    expect(pi.sentMessages).toHaveLength(0);
    await vi.runAllTimersAsync();
    expect(pi.sentMessages).toHaveLength(1);
    expect(pi.sentMessages[0]?.message.content).toContain('compaction');
  });
  it('does not re-enter an active automatic compaction and relies on the settled backstop', async () => {
    vi.useFakeTimers();
    const pi = new FakePi();
    await pi.goal('set Avoid compaction races');
    pi.sentMessages.length = 0;
    pi.idle = false;
    await pi.emit('session_compact', { reason: 'threshold', willRetry: false });
    await vi.runAllTimersAsync();
    expect(pi.sentMessages).toHaveLength(0);
    pi.idle = true;
    await pi.emit('agent_settled');
    expect(pi.sentMessages).toHaveLength(1);
  });
  it('restores branch-specific state on session start and tree navigation', async () => {
    vi.useFakeTimers();
    const source = new FakePi();
    await source.goal('set Restore this exact branch goal');
    const activeState = latestGoalStateData(source);
    const restored = new FakePi([
      { type: 'custom', customType: 'mosaic-goal-state', data: activeState },
    ]);
    await restored.emit('session_start', { reason: 'resume' });
    expect(restored.statuses.get('mosaic-goal')).toContain('active');
    const context = await restored.emit('context', { messages: [] });
    expect(activeGoalStatementFromContext(context[0])).toContain('Restore this exact branch goal');
    await restored.goal('pause');
    const pausedState = latestGoalStateData(restored);
    restored.branch = [{ type: 'custom', customType: 'mosaic-goal-state', data: pausedState }];
    await restored.emit('session_tree', {});
    await vi.runAllTimersAsync();
    expect(stateField(restored, 'phase')).toBe('paused');
    expect(restored.sentMessages).toHaveLength(0);
  });
  it('restores only fully valid persisted states and ignores malformed entries', async () => {
    vi.useFakeTimers();
    const source = new FakePi();
    await source.goal('set Validate persisted branch state');
    await source.report({
      status: 'continue',
      summary: 'Valid report',
      evidence: ['valid evidence'],
      nextStep: 'Continue validation',
    });
    const valid = latestGoalStateData(source);
    const validRestore = new FakePi([
      { type: 'custom', customType: 'mosaic-goal-state', data: valid },
    ]);
    await validRestore.emit('session_start', { reason: 'resume' });
    expect(stateField(validRestore, 'statement')).toBe('Validate persisted branch state');
    await validRestore.emit('session_shutdown', { reason: 'reload' });
    const validReport = latestGoalStateData(source)['lastReport'];
    if (!isRecord(validReport)) throw new Error('Expected a valid persisted report fixture');
    const integerFields = [
      'turnCount',
      'reportCount',
      'verificationPasses',
      'requiredVerificationPasses',
      'noProgressReports',
      'maxTurns',
      'maxNoProgressReports',
      'compactionCount',
    ];
    const corruptions: Array<(state: Record<string, unknown>) => unknown> = [
      (): unknown => null,
      (state): unknown => ({ ...state, version: 99 }),
      (state): unknown => ({ ...state, goalId: '' }),
      (state): unknown => ({ ...state, statement: '' }),
      (state): unknown => ({ ...state, statement: 'x'.repeat(8_001) }),
      (state): unknown => ({ ...state, phase: 'unknown' }),
      (state): unknown => ({ ...state, lastCheckSource: 'unknown' }),
      (state): unknown => ({ ...state, startedAt: 4 }),
      (state): unknown => ({ ...state, lastCheckAt: 4 }),
      (state): unknown => ({ ...state, lastReport: null }),
      (state): unknown => ({ ...state, lastProgressFingerprint: 4 }),
      (state): unknown => ({ ...state, stopReason: 4 }),
      ...integerFields.map((field: string) => (state: Record<string, unknown>): unknown => ({
        ...state,
        [field]: -1,
      })),
    ];
    corruptions.push(
      (state: Record<string, unknown>): unknown => ({ ...state, maxTurns: 501 }),
      (state: Record<string, unknown>): unknown => ({ ...state, maxNoProgressReports: 101 }),
      (state: Record<string, unknown>): unknown => ({ ...state, requiredVerificationPasses: 3 }),
    );
    const reportCorruptions: Array<Record<string, unknown>> = [
      { ...validReport, status: 'bad' },
      { ...validReport, summary: '' },
      { ...validReport, evidence: 'bad' },
      { ...validReport, evidence: [4] },
      { ...validReport, fingerprint: '' },
      { ...validReport, reportedAt: '' },
      { ...validReport, nextStep: 4 },
    ];
    for (const corruptReport of reportCorruptions) {
      corruptions.push((state: Record<string, unknown>): unknown => ({
        ...state,
        lastReport: corruptReport,
      }));
    }
    for (const corrupt of corruptions) {
      const candidate = corrupt(structuredClone(valid));
      const restored = new FakePi([
        { type: 'custom', customType: 'mosaic-goal-state', data: candidate },
      ]);
      await restored.emit('session_start', { reason: 'resume' });
      expect(restored.statuses.get('mosaic-goal')).toBeUndefined();
      expect(await restored.emit('context', { messages: [] })).toEqual([undefined]);
    }
    const failClosed = new FakePi([
      { type: 'custom', customType: 'mosaic-goal-state', data: valid },
      { type: 'custom', customType: 'mosaic-goal-state', data: { ...valid, version: 99 } },
    ]);
    await failClosed.emit('session_start', { reason: 'resume' });
    expect(failClosed.statuses.get('mosaic-goal')).toBeUndefined();
  });
  it('fails closed instead of reusing credential-bearing legacy branch state', async () => {
    const source = new FakePi();
    await source.goal('set Build a valid restore fixture');
    const cleanState = latestGoalStateData(source);
    const legacyState = structuredClone(cleanState);
    legacyState['statement'] = `Legacy secret ghp_${'z'.repeat(32)}`;
    const restored = new FakePi([
      { type: 'custom', customType: 'mosaic-goal-state', data: legacyState },
      { type: 'custom', customType: 'mosaic-goal-state', data: cleanState },
    ]);
    await restored.emit('session_start', { reason: 'resume' });
    expect(restored.statuses.get('mosaic-goal')).toBeUndefined();
    expect(await restored.emit('context', { messages: [] })).toEqual([undefined]);
    expect(restored.notifications.at(-1)?.level).toBe('warning');
    expect(restored.notifications.at(-1)?.message).toContain('was not restored');
    expect(restored.entries).toHaveLength(0);
  });
  it('schedules an active tree-restored goal and preserves terminal state through compaction', async () => {
    vi.useFakeTimers();
    const source = new FakePi();
    await source.goal('set Restore active tree work');
    const active = latestGoalStateData(source);
    const restored = new FakePi();
    restored.branch = [{ type: 'custom', customType: 'mosaic-goal-state', data: active }];
    await restored.emit('session_tree', {});
    await vi.runAllTimersAsync();
    expect(restored.sentMessages).toHaveLength(1);
    expect(restored.sentMessages[0]?.message.content).toContain('tree navigation');
    await restored.goal('cancel');
    await restored.emit('session_compact', { reason: 'manual', willRetry: false });
    expect(stateField(restored, 'phase')).toBe('cancelled');
    expect(stateField(restored, 'compactionCount')).toBe(1);
  });
  it('cancels deferred continuation when the session shuts down', async () => {
    vi.useFakeTimers();
    const pi = new FakePi();
    await pi.goal('set Do not leak a stale timer');
    pi.sentMessages.length = 0;
    await pi.emit('session_compact', { reason: 'manual', willRetry: false });
    await pi.emit('session_shutdown', { reason: 'reload' });
    await vi.runAllTimersAsync();
    expect(pi.sentMessages).toHaveLength(0);
  });
 });
@@ -72,9 +72,8 @@ elif [[ -n "$DATA_DIR" ]]; then
  while IFS= read -r file; do
    [[ -z "$file" ]] && continue
    done_total=$((done_total + 1))
-    history_rc=0
+    if git -C "$DATA_DIR" log --since="${WINDOW_DAYS} days ago" --pretty='%s' -- "$file" 2>/dev/null \
-    history="$(git -C "$DATA_DIR" log --since="${WINDOW_DAYS} days ago" --pretty='%s' -- "$file" 2>/dev/null)" || history_rc=$?
+         | grep -qiE 'reopen|revert|fix|regression|wrong|incorrect|redo'; then
    if [[ "$history_rc" -eq 0 ]] && grep -qiE 'reopen|revert|fix|regression|wrong|incorrect|redo' <<<"$history"; then
      detectable=$((detectable + 1))
    fi
  done < <(find "$DATA_DIR" -type f -name '*.json' 2>/dev/null)
@@ -64,9 +64,9 @@ for line in "${LINES[@]}"; do
  #   - build/test/lint/type/ci signals → CI would have caught it
  #   - security/auth/permission/data/migration → human review would flag it
  #   - everything else (logic/UX/assumption/edge) → only-self-reflection bucket
-  if grep -qiE 'test|lint|type|build|ci|compile|typo' <<<"$subj"; then
+  if printf '%s' "$subj" | grep -qiE 'test|lint|type|build|ci|compile|typo'; then
    ci=$((ci + 1))
-  elif grep -qiE 'security|auth|permission|rbac|secret|migration|data|sql|injection' <<<"$subj"; then
+  elif printf '%s' "$subj" | grep -qiE 'security|auth|permission|rbac|secret|migration|data|sql|injection'; then
    human=$((human + 1))
  else
    selfonly=$((selfonly + 1))
@@ -1,28 +0,0 @@
 [
  "tools/matrix-presence-harness/run.sh:TSX_CLI=\"$(ls -d \"${REPO}\"/node_modules/.pnpm/tsx@*/node_modules/tsx/dist/cli.mjs 2>/dev/null | head -1)\"",
  "tools/e2e-install-test.sh:if ! mosaic gateway --help 2>&1 | grep -q 'verify'; then",
  "tools/install.sh:EXTRACTED_DIR=\"$(find \"$WORK_DIR\" -maxdepth 1 -mindepth 1 -type d | head -1)\"",
  "scripts/analysis/reflect-board-history.sh:if git -C \"$DATA_DIR\" log --since=\"${WINDOW_DAYS} days ago\" --pretty='%s' -- \"$file\" 2>/dev/null  | grep -qiE 'reopen|revert|fix|regression|wrong|incorrect|redo'; then",
  "scripts/analysis/reflect-git-history.sh:if printf '%s' \"$subj\" | grep -qiE 'test|lint|type|build|ci|compile|typo'; then",
  "scripts/analysis/reflect-git-history.sh:elif printf '%s' \"$subj\" | grep -qiE 'security|auth|permission|rbac|secret|migration|data|sql|injection'; then",
  "packages/mosaic/framework/tools/authentik/user-create.sh:group_pk=$(echo \"$group_response\" | jq -r \".results[] | select(.name == \\\"$GROUP\\\") | .pk\" | head -1)",
  "packages/mosaic/framework/tools/git/mutate-push-guard.sh:PROSE_LO=\"$(grep -n '^usage() {' \"$BAK\" | head -1 | cut -d: -f1)\"",
  "packages/mosaic/framework/tools/orchestrator/session-resume.sh:echo \"$dirty_files\" | head -20 | while IFS= read -r line; do",
  "packages/mosaic/framework/tools/prdy/prdy-status.sh:if echo \"$PRD_CONTENT\" | grep -qiE \"$pattern\"; then",
  "packages/mosaic/framework/tools/qa/reflect-stop-hook.sh:if printf '%s' \"$p\" | grep -qiE 'auth|login|session|token|permission|rbac|credential|secret'; then echo auth; return; fi",
  "packages/mosaic/framework/tools/qa/reflect-stop-hook.sh:if printf '%s' \"$p\" | grep -qiE 'migration|prisma|schema|\\.sql|entity|repository|seed'; then echo data; return; fi",
  "packages/mosaic/framework/tools/qa/reflect-stop-hook.sh:if printf '%s' \"$p\" | grep -qiE 'docker|\\.woodpecker|compose|traefik|deploy|helm|k8s|terraform'; then echo infra; return; fi",
  "packages/mosaic/framework/tools/qa/reflect-stop-hook.sh:if printf '%s' \"$p\" | grep -qiE 'package\\.json|tsconfig|turbo\\.json|pnpm-|\\.config\\.|eslint|vite'; then echo build; return; fi",
  "packages/mosaic/framework/tools/qa/reflect-stop-hook.sh:if printf '%s' \"$p\" | grep -qE '\\.tsx|\\.css|components/|apps/web/'; then echo ui; return; fi",
  "packages/mosaic/framework/tools/qa/reflect-stop-hook.sh:if printf '%s' \"$p\" | grep -qE '\\.spec\\.|\\.test\\.|__tests__/'; then echo test; return; fi",
  "packages/mosaic/framework/tools/qa/reflect-stop-hook.sh:if printf '%s' \"$p\" | grep -qE '\\.md$|docs/'; then echo docs; return; fi",
  "packages/mosaic/framework/tools/qa/typecheck-hook.sh:FILE_PATH=$(echo \"$JSON_INPUT\" | grep -o '\"file_path\"[[:space:]]*:[[:space:]]*\"[^\"]*\"' | sed 's/.*\"\\([^\"]*\\)\"$/\\1/' | head -1)",
  "packages/mosaic/framework/tools/qa/typecheck-hook.sh:RELEVANT=$(echo \"$OUTPUT\" | grep -A2 \"$BASENAME\" 2>/dev/null || echo \"$OUTPUT\" | head -20)",
  "packages/mosaic/framework/tools/tmux/send-message.sh:if printf '%s' \"$pane\" | grep -qF \"$QUEUED_RE\"; then",
  "packages/mosaic/framework/tools/tmux/send-message.sh:if [ -n \"$snippet\" ] && printf '%s' \"$promptline\" | grep -qF \"$snippet\"; then",
  "packages/mosaic/framework/tools/wake/detector.sh:sed -n \"s/^${key}=//p\" \"$MANIFEST\" | head -n1 | tr -d '[:space:]'",
  "packages/mosaic/framework/tools/wake/detector.sh:if [ -n \"$snap_sha\" ] && ! printf '%s' \"$snap_sha\" | grep -Eq '^[0-9a-f]{7,64}$'; then",
  "packages/mosaic/framework/tools/wake/detector.sh:if [ -n \"$snap_ts\" ] && ! printf '%s' \"$snap_ts\" | grep -Eq '^[0-9]{1,12}$'; then",
  "packages/mosaic/framework/tools/wake/digest.sh:olabel=\"$(_locator_line \"$oloc\" | head -n1)\"",
  "packages/mosaic/framework/tools/wake/reconcile.sh:sed -n \"s/^${key}=//p\" \"$MANIFEST\" | head -n1 | tr -d '[:space:]'"
 ]
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
be-coder-05	913f00770f	fix(installer): avoid pipefail marker race ci/woodpecker/pr/ci Pipeline was successful Details ci/woodpecker/pr/greenfield-install Pipeline was successful Details	2026-08-06 12:13:42 -05:00
be-coder-05	58ada98d2b	fix(installer): support BusyBox coverage inventory ci/woodpecker/pr/greenfield-install Pipeline was canceled Details ci/woodpecker/pr/ci Pipeline was canceled Details	2026-08-06 11:53:56 -05:00
be-coder-05	d66e91b1f2	test(installer): bind execution coverage callers ci/woodpecker/pr/ci Pipeline failed Details ci/woodpecker/pr/greenfield-install Pipeline was successful Details	2026-08-06 03:48:03 -05:00
be-coder-05	df705828a4	ci(installer): cover all greenfield execution arms ci/woodpecker/pr/ci Pipeline failed Details ci/woodpecker/pr/greenfield-install Pipeline was successful Details	2026-08-06 03:14:19 -05:00
be-coder-05	f33bd0da96	ci(installer): enforce greenfield case coverage ci/woodpecker/pr/ci Pipeline was canceled Details ci/woodpecker/pr/greenfield-install Pipeline was canceled Details	2026-08-06 02:52:14 -05:00
be-coder-05	0e2eef1c12	docs(installer): correct sidecar verification command ci/woodpecker/pr/ci Pipeline was successful Details ci/woodpecker/pr/greenfield-install Pipeline was successful Details	2026-08-06 01:38:23 -05:00
be-coder-05	4c4d16131a	fix(ci): bind remote fixture downstream source ci/woodpecker/pr/ci Pipeline was successful Details ci/woodpecker/pr/greenfield-install Pipeline was canceled Details	2026-08-06 00:49:41 -05:00
be-coder-05	ff3f0d29f1	fix(installer): fail closed on test enumeration errors ci/woodpecker/pr/ci Pipeline was successful Details ci/woodpecker/pr/greenfield-install Pipeline failed Details	2026-08-05 21:11:05 -05:00
be-coder-07	378bc1afe3	fix(installer): close detector false-pass gaps ci/woodpecker/pr/ci Pipeline was successful Details ci/woodpecker/pr/greenfield-install Pipeline failed Details	2026-08-05 19:00:22 -05:00
be-coder-05	e5d5c8495a	test(installer): pin B8 redaction evidence ci/woodpecker/pr/ci Pipeline failed Details ci/woodpecker/pr/greenfield-install Pipeline failed Details	2026-08-05 18:09:19 -05:00
be-coder-05	3edde464b3	fix(installer): harden greenfield detector contracts	2026-08-05 17:46:58 -05:00
be-coder-05	99e28d4100	test(installer): make state fixture CI-portable	2026-08-05 17:46:58 -05:00
be-coder-05	7c4a4a4a3a	fix(ci): assert pinned greenfield expected red	2026-08-05 17:46:58 -05:00
be-coder-05	049982d30e	feat(installer): add transactional P0-P9 state machine	2026-08-05 17:46:58 -05:00
be-coder-05	4904d4553c	test(installer): preregister P0-P9 greenfield RED	2026-08-05 17:46:58 -05:00
		`@@ -0,0 +1,2 @@`
							`[test] enumeration failure cannot mask a planted in-progress transaction`
							`[test] FAIL: planted in-progress transaction plus failed enumeration passed the full suite`