chore(orchestrator): fix pre-existing README prettier drift

Unrelated to #869/C3. This file was left unformatted by #868
(board-roll.sh) and fails the repo-wide format:check pre-push gate
for every branch cut from main. Whitespace/table-alignment only, no
content change (verified via `prettier <file> | diff - <file>`
before applying).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/mosaic/framework/systemd/user/mosaic-lease-broker.service

@@ -0,0 +1,22 @@
+[Unit]
+Description=Mosaic lease broker daemon (framework tools/lease-broker/daemon.py)
+Documentation=https://git.mosaicstack.dev/mosaicstack/stack
+After=default.target
+
+[Service]
+Type=simple
+# The broker socket lives under the runtime directory so it disappears with
+# the user session instead of surviving as stale state across logins.
+# daemon.py's secure_parent() fails closed unless this directory is exactly
+# 0700, so RuntimeDirectoryMode is not cosmetic.
+RuntimeDirectory=mosaic-lease
+RuntimeDirectoryMode=0700
+# Remove loader and noninteractive-shell controls before ExecStart loads env,
+# matching the tmux fleet units in this same directory.
+UnsetEnvironment=LD_PRELOAD BASH_ENV ENV
+ExecStart=/usr/bin/env -i HOME=%h PATH=/usr/bin:/bin XDG_RUNTIME_DIR=%t /bin/bash --noprofile --norc %h/.config/mosaic/tools/lease-broker/start-lease-broker.sh
+Restart=on-failure
+RestartSec=1
+
+[Install]
+WantedBy=default.target

packages/mosaic/framework/tools/lease-broker/start-lease-broker.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Supervisor entry point for the Mosaic lease broker daemon (issue #869, C3).
+#
+# Resolves the broker socket path with the SAME precedence as
+# `defaultLeaseBrokerSocket` in `packages/mosaic/src/commands/launch.ts`, so a
+# gated runtime launched through that client always finds the socket this
+# supervisor creates:
+#   1. an explicit MOSAIC_LEASE_BROKER_SOCKET
+#   2. "$XDG_RUNTIME_DIR/mosaic-lease/broker.sock"
+#   3. "/run/user/<uid>/mosaic-lease/broker.sock"
+#
+# The state file is colocated next to the socket (same directory,
+# "state.json"), mirroring how the broker already colocates its per-session
+# generation files beside the socket.
+#
+# This script never installs, enables, or starts the systemd unit that calls
+# it; it is only ever invoked BY that unit (or by a human/test harness that
+# passes its own HOME/XDG_RUNTIME_DIR).
+set -euo pipefail
+
+SCRIPT_DIR=$(cd -- "$(dirname -- "$0")" && pwd)
+
+if [ -n "${MOSAIC_LEASE_BROKER_SOCKET:-}" ]; then
+  SOCKET="$MOSAIC_LEASE_BROKER_SOCKET"
+else
+  RUNTIME_DIR="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
+  SOCKET="$RUNTIME_DIR/mosaic-lease/broker.sock"
+fi
+STATE="$(dirname -- "$SOCKET")/state.json"
+
+exec python3 "$SCRIPT_DIR/daemon.py" --socket "$SOCKET" --state "$STATE"

packages/mosaic/framework/tools/orchestrator/README.md

@@ -0,0 +1,92 @@
+# orchestrator/ tools
+
+Helper scripts for r0 coordinator / orchestrator sessions — mission lifecycle,
+session health, continuation, and board maintenance. See
+`framework/guides/ORCHESTRATOR-PROTOCOL.md` for the surrounding process.
+
+| Script               | Purpose                                                                                         |
+| -------------------- | ----------------------------------------------------------------------------------------------- |
+| `mission-init.sh`    | Initialize a new orchestration mission (manifest, scratchpad, TASKS.md).                        |
+| `mission-status.sh`  | Show the mission progress dashboard.                                                            |
+| `session-run.sh`     | Generate continuation context and launch the target runtime.                                    |
+| `session-resume.sh`  | Crash recovery for dead orchestrator sessions.                                                  |
+| `session-status.sh`  | Check agent session health.                                                                     |
+| `continue-prompt.sh` | Generate the continuation prompt for the next session.                                          |
+| `board-roll.sh`      | Keep a LIVE orchestration board under its byte cap by rolling the oldest entries to its LEDGER. |
+| `smoke-test.sh`      | Behavior smoke checks for the coord continue/run workflows.                                     |
+| `test-board-roll.sh` | Regression harness for `board-roll.sh`.                                                         |
+| `_lib.sh`            | Shared functions sourced by the above (state files, TASKS.md parsing, locks).                   |
+
+## board-roll.sh
+
+Coordinator boards (`MOS-ORCHESTRATION-BOARD-LIVE.md`, `MS-LEAD-BOARD-LIVE.md`)
+follow a **"< 8 KB LIVE"** discipline: the LIVE board is the only file loaded on
+resume, so it must stay small, and history lives in an append-only LEDGER. When a
+board write would push LIVE over its cap, coordinators otherwise hand-trim and
+retry every time — an observed 38 ABORT-OVER-CAP cycles in one 24 h window.
+`board-roll.sh` automates that trim mechanically and reversibly: the audit trail
+is moved to the LEDGER instead of being hand-deleted.
+
+### Contract (conservative — it never guesses what is safe to move)
+
+The LIVE board opts in by wrapping its aging archival ticks in an explicit roll
+zone. Everything **outside** the markers (title, protocol blockquote, curated
+always-current `##` sections) is pinned and never touched:
+
+```markdown
+# MOS ORCHESTRATION BOARD — LIVE state
+
+> protocol blockquote … (pinned)
+
+## 🟦 Curated always-current section (pinned)
+
+…
+
+<!-- BOARD-ROLL:START -->
+
+### 2026-07-22 (mid²²) — newest tick, stays longest
+
+…
+
+### 2026-07-20 (dawn) — oldest tick, rolled first
+
+…
+
+<!-- BOARD-ROLL:END -->
+```
+
+Inside the zone, entries are delimited by a heading marker (default `### `) and
+are assumed **newest-first (top) → oldest-last (bottom)**. `board-roll.sh` moves
+whole oldest (bottom-most) entry blocks out of the zone and appends them verbatim
+to the LEDGER, one at a time, until LIVE is back under the cap or the zone is
+empty. If the board has no markers, it exits `3` and changes nothing — adding the
+markers is a deliberate opt-in by the board owner.
+
+### Usage
+
+```bash
+board-roll.sh --live <LIVE.md> --ledger <LEDGER.md> [options]
+
+  --live   <path>    LIVE board file (required)
+  --ledger <path>    append-only LEDGER file (required; created if absent)
+  --cap    <bytes>   size ceiling for LIVE (default 8192)
+  --marker <prefix>  entry-heading prefix inside the roll zone (default "### ")
+  --dry-run          report what would move; change nothing
+  -h, --help         show help and exit 0
+```
+
+Only **one** roll zone is supported. If a board carries more than one
+`BOARD-ROLL:START`/`END` pair, `board-roll.sh` refuses (exit `3`, zero changes)
+rather than span first-START..last-END and relocate the curated content between
+the zones — consolidate the ticks into a single zone instead.
+
+Exit codes: `0` LIVE under cap (already, or after rolling) — on `--dry-run`, a
+plan exists or nothing to do · `2` usage / argument / IO error · `3` cannot meet
+the cap (no markers, **more than one marker pair**, or the pinned sections alone
+exceed the cap and need a manual trim).
+
+Writes are atomic (temp file + `mv`, LEDGER first) so a failure never leaves a
+board half-written; line endings are normalized to LF on rewrite. `--dry-run`
+first is recommended when wiring it into a board update protocol.
+
+Run the regression suite with `bash test-board-roll.sh`.

packages/mosaic/framework/tools/orchestrator/board-roll.sh

@@ -0,0 +1,277 @@
+#!/usr/bin/env bash
+#
+# board-roll.sh — keep a LIVE orchestration board under its byte cap by rolling
+#                 the oldest archival entries out to its append-only LEDGER.
+#
+# WHY: coordinator boards (MOS-ORCHESTRATION-BOARD-LIVE.md, MS-LEAD-BOARD-LIVE.md)
+# enforce a "< 8 KB LIVE" discipline via a self-guard that ABORTs the board write
+# when the file exceeds the cap. In practice the LIVE board keeps bumping the cap,
+# so coordinators hand-trim + retry every time (observed: 38 ABORT-OVER-CAP cycles
+# in a 24h window on one coordinator). This automates that trim, mechanically and
+# reversibly, so the audit trail is preserved in the LEDGER instead of hand-deleted.
+#
+# CONTRACT (conservative by design — it NEVER guesses what is safe to move):
+#   The LIVE board must declare an explicit ROLL ZONE with HTML-comment markers:
+#
+#       <!-- BOARD-ROLL:START -->
+#       ### 2026-07-22 (newest tick — stays longest)
+#       ...
+#       ### 2026-07-19 (oldest tick — rolled first)
+#       ...
+#       <!-- BOARD-ROLL:END -->
+#
+#   Everything OUTSIDE the markers (title, protocol blockquote, curated always-current
+#   `##` sections) is PINNED and never touched. Inside the zone, entries are delimited
+#   by a heading marker (default `### `) and are assumed newest-first (top) → oldest-last
+#   (bottom), matching board convention. board-roll moves whole oldest (bottom-most)
+#   entry blocks out of the zone and APPENDS them verbatim to the LEDGER, one block at a
+#   time, until the LIVE file is back under the cap or the zone is empty.
+#
+#   If no markers are present, it exits 3 without changing anything (safe default —
+#   adding the markers is a deliberate opt-in by the board owner).
+#
+# USAGE:
+#   board-roll.sh --live <LIVE.md> --ledger <LEDGER.md> [options]
+#
+# OPTIONS:
+#   --live   <path>   LIVE board file (required)
+#   --ledger <path>   append-only LEDGER file (required; created if absent)
+#   --cap    <bytes>  size ceiling for LIVE (default 8192)
+#   --marker <prefix> entry-heading prefix inside the roll zone (default "### ")
+#   --dry-run         report what would move + resulting size; change nothing
+#   -h, --help        print usage and exit 0
+#
+# EXIT CODES:
+#   0  LIVE is under cap (already, or after rolling); on --dry-run, 0 = a plan exists
+#      (or nothing to do)
+#   2  usage / argument / IO error (bad flag, missing file, unwritable target)
+#   3  cannot satisfy the cap: no roll markers present, MORE THAN ONE marker pair
+#      (multiple zones are refused, not guessed), OR the zone was emptied and LIVE
+#      is still over cap (curated pinned sections need a manual trim)
+#
+# NOTE: line endings are normalized to LF on rewrite (boards are LF markdown); a
+# trailing newline is always ensured. Writes are atomic (temp file + mv) so a
+# failure never leaves LIVE or LEDGER half-written.
+
+set -euo pipefail
+
+START_MARK='<!-- BOARD-ROLL:START -->'
+END_MARK='<!-- BOARD-ROLL:END -->'
+
+usage() {
+    cat <<'EOF'
+Usage: board-roll.sh --live <LIVE.md> --ledger <LEDGER.md> [options]
+
+Roll the oldest entries out of a LIVE orchestration board into its LEDGER
+until the LIVE file is under a byte cap. Conservative: only content inside
+explicit <!-- BOARD-ROLL:START -->/<!-- BOARD-ROLL:END --> markers is moved.
+
+Options:
+  --live   <path>    LIVE board file (required)
+  --ledger <path>    append-only LEDGER file (required; created if absent)
+  --cap    <bytes>   size ceiling for LIVE (default 8192)
+  --marker <prefix>  entry-heading prefix inside the roll zone (default "### ")
+  --dry-run          report what would move; change nothing
+  -h, --help         show this help and exit 0
+
+Exit: 0 under cap (or dry-run plan) · 2 usage/IO error · 3 cannot meet cap
+      (no markers, or pinned sections alone exceed the cap).
+EOF
+}
+
+die() { echo "board-roll: $*" >&2; exit 2; }
+
+LIVE=""; LEDGER=""; CAP=8192; MARKER='### '; DRYRUN=0
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --live)    LIVE="${2:-}"; shift 2 || die "--live needs a value" ;;
+        --ledger)  LEDGER="${2:-}"; shift 2 || die "--ledger needs a value" ;;
+        --cap)     CAP="${2:-}"; shift 2 || die "--cap needs a value" ;;
+        --marker)  MARKER="${2:-}"; shift 2 || die "--marker needs a value" ;;
+        --dry-run) DRYRUN=1; shift ;;
+        -h|--help) usage; exit 0 ;;
+        *) usage >&2; die "unknown option: $1" ;;
+    esac
+done
+
+[[ -n "$LIVE"   ]] || { usage >&2; die "--live is required"; }
+[[ -n "$LEDGER" ]] || { usage >&2; die "--ledger is required"; }
+[[ -f "$LIVE"   ]] || die "LIVE file not found: $LIVE"
+[[ "$CAP" =~ ^[0-9]+$ ]] || die "--cap must be a non-negative integer, got: $CAP"
+
+# --- read LIVE into a line array (newlines stripped; re-added on write) ---------
+mapfile -t LINES < "$LIVE"
+
+# byte size of an array rendered as LF-terminated text
+render_size() {
+    if [[ $# -eq 0 ]]; then printf 0; return; fi
+    printf '%s\n' "$@" | wc -c
+}
+
+orig_size=$(render_size "${LINES[@]}")
+
+# --- already under cap → nothing to do -----------------------------------------
+if (( orig_size < CAP )); then
+    echo "board-roll: LIVE is ${orig_size}B (< cap ${CAP}B) — nothing to roll."
+    exit 0
+fi
+
+# --- locate the roll-zone markers ----------------------------------------------
+# Exactly ONE marker pair is supported. If a board carries more than one START or
+# END marker we REFUSE (exit 3, zero changes) rather than guess: a naive
+# first-START..last-END span would swallow the curated content and the intermediate
+# markers sitting between two intended zones and silently relocate that pinned text
+# to the LEDGER — the exact data-loss this tool exists to prevent. Refusing matches
+# the "no markers = exit 3" conservative posture.
+start_idx=-1; end_idx=-1; start_count=0; end_count=0
+for i in "${!LINES[@]}"; do
+    if [[ "${LINES[$i]}" == "$START_MARK" ]]; then
+        if (( start_count == 0 )); then start_idx=$i; fi
+        start_count=$(( start_count + 1 ))
+    fi
+    if [[ "${LINES[$i]}" == "$END_MARK" ]]; then
+        end_idx=$i
+        end_count=$(( end_count + 1 ))
+    fi
+done
+if (( start_count > 1 || end_count > 1 )); then
+    echo "board-roll: LIVE is ${orig_size}B (>= cap ${CAP}B) but has ${start_count} START / ${end_count} END" >&2
+    echo "  markers — only a SINGLE '$START_MARK' … '$END_MARK' roll zone is supported." >&2
+    echo "  Multiple zones are refused (not guessed) so content between zones is never relocated." >&2
+    echo "  Consolidate the archival ticks into one zone, or trim manually." >&2
+    exit 3
+fi
+if (( start_idx < 0 || end_idx < 0 || end_idx <= start_idx )); then
+    echo "board-roll: LIVE is ${orig_size}B (>= cap ${CAP}B) but no usable roll zone" >&2
+    echo "  (need '$START_MARK' then '$END_MARK'). Add the markers around the" >&2
+    echo "  archival tick section to opt this board into automatic rolling." >&2
+    exit 3
+fi
+
+# preamble = lines [0 .. start_idx]   (inclusive of START marker)
+# zone     = lines (start_idx .. end_idx)  (exclusive of both markers)
+# footer   = lines [end_idx .. end]   (inclusive of END marker)
+preamble=(); zone=(); footer=()
+for i in "${!LINES[@]}"; do
+    if   (( i <= start_idx )); then preamble+=("${LINES[$i]}")
+    elif (( i <  end_idx  )); then zone+=("${LINES[$i]}")
+    else footer+=("${LINES[$i]}")
+    fi
+done
+
+# --- split the zone into a fixed head + entry blocks ----------------------------
+# zone_head = any zone lines before the first entry marker (kept, never rolled).
+# blocks[k] = newline-joined text of entry k (marker line .. line before next marker).
+zone_head=(); declare -a block_start=()
+first_block=-1
+for i in "${!zone[@]}"; do
+    if [[ "${zone[$i]}" == "$MARKER"* ]]; then
+        [[ $first_block -eq -1 ]] && first_block=$i
+        block_start+=("$i")
+    fi
+done
+if (( first_block == -1 )); then
+    echo "board-roll: LIVE is ${orig_size}B (>= cap ${CAP}B) but the roll zone has no" >&2
+    echo "  '${MARKER}' entries to move. Trim the pinned sections manually." >&2
+    exit 3
+fi
+for (( i=0; i<first_block; i++ )); do zone_head+=("${zone[$i]}"); done
+
+nblocks=${#block_start[@]}
+# block k spans zone[ block_start[k] .. (block_start[k+1]-1 or end-of-zone) ]
+block_text() {  # $1 = block index → prints the block's lines, LF-joined (no trailing)
+    local k=$1 s e
+    s=${block_start[$k]}
+    if (( k+1 < nblocks )); then e=$(( block_start[$((k+1))] - 1 )); else e=$(( ${#zone[@]} - 1 )); fi
+    local out=()
+    for (( j=s; j<=e; j++ )); do out+=("${zone[$j]}"); done
+    printf '%s\n' "${out[@]}"
+}
+
+# --- greedily roll oldest (bottom-most) blocks until under cap ------------------
+# keep = number of newest blocks retained; start with all, drop from the bottom.
+keep=$nblocks       # blocks [keep .. nblocks-1] are the oldest set that gets moved
+current_size=$orig_size
+build_live_size() {  # size of LIVE if we keep blocks [0 .. keep-1]
+    local acc=("${preamble[@]}" "${zone_head[@]}")
+    local k s e j
+    for (( k=0; k<keep; k++ )); do
+        s=${block_start[$k]}
+        if (( k+1 < nblocks )); then e=$(( block_start[$((k+1))] - 1 )); else e=$(( ${#zone[@]} - 1 )); fi
+        for (( j=s; j<=e; j++ )); do acc+=("${zone[$j]}"); done
+    done
+    acc+=("${footer[@]}")
+    render_size "${acc[@]}"
+}
+while (( current_size >= CAP && keep > 0 )); do
+    keep=$(( keep - 1 ))
+    current_size=$(build_live_size)
+done
+
+moved_count=$(( nblocks - keep ))
+if (( moved_count == 0 )); then
+    # zone had entries but none movable brought us under (shouldn't happen: keep hits 0)
+    echo "board-roll: could not reduce LIVE below cap (${current_size}B >= ${CAP}B)." >&2
+    exit 3
+fi
+
+# --- dry-run report -------------------------------------------------------------
+plan_headers() {
+    local k
+    for (( k=keep; k<nblocks; k++ )); do
+        # first line of each moved block
+        printf '    %s\n' "${zone[${block_start[$k]}]}"
+    done
+}
+if (( DRYRUN )); then
+    echo "board-roll: DRY RUN"
+    echo "  LIVE now:   ${orig_size}B (cap ${CAP}B) — over by $(( orig_size - CAP ))B"
+    echo "  would roll: ${moved_count} of ${nblocks} entr$([[ $moved_count -eq 1 ]] && echo y || echo ies) (oldest first):"
+    plan_headers
+    echo "  LIVE after: ${current_size}B"
+    if (( current_size >= CAP )); then
+        echo "  WARNING: still >= cap after emptying the zone; pinned sections need a manual trim." >&2
+        exit 3
+    fi
+    exit 0
+fi
+
+# --- commit the roll atomically -------------------------------------------------
+live_tmp="$(mktemp "${LIVE}.roll.XXXXXX")" || die "cannot create temp next to LIVE"
+ledger_tmp=""
+# shellcheck disable=SC2329  # invoked indirectly via `trap cleanup EXIT`
+cleanup() { rm -f "$live_tmp" "$ledger_tmp" 2>/dev/null || true; }
+trap cleanup EXIT
+
+# new LIVE = preamble + zone_head + kept blocks + footer
+{
+    printf '%s\n' "${preamble[@]}" "${zone_head[@]}"
+    for (( k=0; k<keep; k++ )); do block_text "$k"; done
+    printf '%s\n' "${footer[@]}"
+} > "$live_tmp"
+
+# LEDGER gets the moved blocks appended verbatim, in original top→bottom order,
+# under a provenance separator. LEDGER is append-only, so we only ever add at EOF.
+ledger_tmp="$(mktemp "${LEDGER}.roll.XXXXXX")" || die "cannot create temp next to LEDGER"
+if [[ -f "$LEDGER" ]]; then cat "$LEDGER" > "$ledger_tmp"; fi
+# ensure a trailing newline on existing content before appending
+if [[ -s "$ledger_tmp" && -n "$(tail -c1 "$ledger_tmp")" ]]; then printf '\n' >> "$ledger_tmp"; fi
+{
+    printf '\n<!-- board-roll: %d entr%s rolled from %s -->\n' \
+        "$moved_count" "$([[ $moved_count -eq 1 ]] && echo y || echo ies)" "$(basename "$LIVE")"
+    for (( k=keep; k<nblocks; k++ )); do block_text "$k"; done
+} >> "$ledger_tmp"
+
+# atomic swap (both, LEDGER first so a crash never drops content that left LIVE)
+mv "$ledger_tmp" "$LEDGER"; ledger_tmp=""
+mv "$live_tmp" "$LIVE"; live_tmp=""
+trap - EXIT
+
+# read the real on-disk size back (truthful, not the predicted value)
+final_size=$(wc -c < "$LIVE")
+echo "board-roll: rolled ${moved_count} entr$([[ $moved_count -eq 1 ]] && echo y || echo ies) to $(basename "$LEDGER"); LIVE ${orig_size}B → ${final_size}B (cap ${CAP}B)."
+if (( final_size >= CAP )); then
+    echo "board-roll: still >= cap after rolling all zone entries; pinned sections need a manual trim." >&2
+    exit 3
+fi
+exit 0

packages/mosaic/framework/tools/orchestrator/test-board-roll.sh

@@ -0,0 +1,156 @@
+#!/usr/bin/env bash
+# Regression harness for board-roll.sh — rolling oldest LIVE-board entries to LEDGER.
+#
+# Asserts:
+#   1. Under cap → no-op, exit 0, files unchanged.
+#   2. Over cap, no roll markers → exit 3, LIVE unchanged (never guesses).
+#   3. Over cap, markers present → rolls the fewest oldest entries to get under cap,
+#      LIVE ends under cap, pinned preamble/footer + newest entries preserved.
+#   4. Rolled blocks land in the LEDGER verbatim, oldest set in original order.
+#   5. --dry-run changes nothing and reports a plan.
+#   6. Zone emptied but pinned sections alone exceed cap → exit 3.
+#   7. --help exits 0 and prints usage; an unknown flag exits nonzero (#701 discipline).
+#   8. More than one marker pair → exit 3, unchanged; curated content between the two
+#      zones is never relocated to the LEDGER (rev0 #868 regression).
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SUT="$SCRIPT_DIR/board-roll.sh"
+
+fail=0
+note() { echo "FAIL: $*" >&2; fail=1; }
+
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+# builds a LIVE board: pinned preamble + roll zone with N dated entries (newest first),
+# each entry padded to be individually large so the cap math is predictable.
+make_board() {  # $1 file  $2 n_entries  $3 with_markers(1/0)  $4 pad_bytes
+    local f=$1 n=$2 markers=$3 pad=$4 i padtxt
+    padtxt=$(head -c "$pad" < /dev/zero | tr '\0' 'x')
+    {
+        echo "# BOARD — LIVE"
+        echo "> pinned protocol blockquote, never rolled."
+        echo
+        echo "## Curated always-current section (pinned)"
+        echo "- this stays no matter what"
+        echo
+        [[ "$markers" == 1 ]] && echo '<!-- BOARD-ROLL:START -->'
+        # newest first (i=n .. 1); oldest (i=1) ends at the bottom
+        for (( i=n; i>=1; i-- )); do
+            echo "### 2026-07-$(printf '%02d' $i) tick number $i"
+            echo "- detail $i $padtxt"
+            echo
+        done
+        [[ "$markers" == 1 ]] && echo '<!-- BOARD-ROLL:END -->'
+    } > "$f"
+    return 0
+}
+
+# ── 1. under cap → no-op ───────────────────────────────────────────────────────
+L="$WORK/live1.md"; G="$WORK/ledger1.md"; : > "$G"
+make_board "$L" 2 1 10
+before=$(cat "$L")
+if ! out=$(bash "$SUT" --live "$L" --ledger "$G" --cap 100000 2>&1); then
+    note "under-cap should exit 0 (got nonzero): $out"
+fi
+[[ "$(cat "$L")" == "$before" ]] || note "under-cap modified LIVE"
+[[ -s "$G" ]] && note "under-cap wrote to LEDGER"
+
+# ── 2. over cap, no markers → exit 3, unchanged ────────────────────────────────
+L="$WORK/live2.md"; G="$WORK/ledger2.md"; : > "$G"
+make_board "$L" 6 0 400
+before=$(cat "$L")
+set +e; bash "$SUT" --live "$L" --ledger "$G" --cap 800 >/dev/null 2>&1; rc=$?; set -e
+[[ "$rc" -eq 3 ]] || note "no-markers over-cap should exit 3 (got $rc)"
+[[ "$(cat "$L")" == "$before" ]] || note "no-markers run modified LIVE (must never guess)"
+
+# ── 3+4. over cap with markers → rolls oldest, LIVE under cap, LEDGER gets them ─
+L="$WORK/live3.md"; G="$WORK/ledger3.md"; echo "# LEDGER" > "$G"
+make_board "$L" 6 1 400          # 6 entries, each ~>400B
+big=$(wc -c < "$L")
+[[ "$big" -ge 2000 ]] || note "fixture too small to test rolling ($big B)"
+if ! out=$(bash "$SUT" --live "$L" --ledger "$G" --cap 2000 2>&1); then
+    note "marker roll should exit 0 when it can get under cap: $out"
+fi
+after=$(wc -c < "$L")
+[[ "$after" -lt 2000 ]] || note "LIVE still >= cap after roll ($after B)"
+# pinned content survives
+grep -q "Curated always-current section" "$L" || note "roll dropped pinned section"
+grep -q 'BOARD-ROLL:START' "$L" || note "roll dropped START marker"
+grep -q 'BOARD-ROLL:END' "$L"   || note "roll dropped END marker"
+# newest entry (07-06) stays; oldest (07-01) is the first to leave
+grep -q "### 2026-07-06 tick number 6" "$L" || note "roll dropped the newest entry"
+grep -q "### 2026-07-01 tick number 1" "$L" && note "oldest entry not rolled out of LIVE"
+# oldest went to LEDGER
+grep -q "### 2026-07-01 tick number 1" "$G" || note "oldest entry not appended to LEDGER"
+grep -q "board-roll:.*rolled from live3.md" "$G" || note "LEDGER missing provenance separator"
+# a rolled entry must not be duplicated (present in exactly one of LIVE/LEDGER)
+if grep -q "### 2026-07-01 tick number 1" "$L"; then note "rolled entry duplicated in LIVE"; fi
+# LEDGER original content preserved
+grep -q "^# LEDGER" "$G" || note "roll clobbered existing LEDGER content"
+
+# ── 5. --dry-run changes nothing ───────────────────────────────────────────────
+L="$WORK/live5.md"; G="$WORK/ledger5.md"; echo "# LEDGER" > "$G"
+make_board "$L" 6 1 400
+before_l=$(cat "$L"); before_g=$(cat "$G")
+out=$(bash "$SUT" --live "$L" --ledger "$G" --cap 2000 --dry-run 2>&1) || note "dry-run exited nonzero: $out"
+echo "$out" | grep -qi "dry run" || note "dry-run did not announce itself"
+echo "$out" | grep -q "would roll" || note "dry-run did not report a plan"
+[[ "$(cat "$L")" == "$before_l" ]] || note "dry-run modified LIVE"
+[[ "$(cat "$G")" == "$before_g" ]] || note "dry-run modified LEDGER"
+
+# ── 6. zone emptied, pinned alone over cap → exit 3 ────────────────────────────
+# cap 120 is below the pinned preamble+footer size (~180B), so even after rolling
+# every zone entry the LIVE file stays over cap → must report the unsatisfiable case.
+L="$WORK/live6.md"; G="$WORK/ledger6.md"; echo "# LEDGER" > "$G"
+make_board "$L" 3 1 50
+set +e; bash "$SUT" --live "$L" --ledger "$G" --cap 120 >/dev/null 2>&1; rc=$?; set -e
+[[ "$rc" -eq 3 ]] || note "unsatisfiable cap should exit 3 (got $rc)"
+
+# ── 7. help exits 0, unknown flag exits nonzero (#701) ─────────────────────────
+if ! out=$(bash "$SUT" --help 2>&1); then note "--help exited nonzero"; fi
+[[ "$out" == Usage:* ]] || note "--help did not print usage"
+bash "$SUT" -h >/dev/null 2>&1 || note "-h exited nonzero"
+if bash "$SUT" --not-a-real-flag >/dev/null 2>&1; then note "unknown flag was accepted"; fi
+if bash "$SUT" --live "$WORK/live3.md" >/dev/null 2>&1; then note "missing --ledger was accepted"; fi
+
+# ── 8. multiple marker pairs → exit 3, unchanged (no cross-zone relocation) ─────
+# Two separately-marked zones with a curated pinned section BETWEEN them. A naive
+# first-START..last-END span would sweep that curated section (and the intermediate
+# markers) into the LEDGER. board-roll must refuse (exit 3) and touch nothing.
+L="$WORK/live8.md"; G="$WORK/ledger8.md"; echo "# LEDGER" > "$G"
+pad8=$(head -c 300 < /dev/zero | tr '\0' 'x')
+{
+    echo "# BOARD — LIVE"
+    echo "> pinned protocol blockquote"
+    echo
+    echo '<!-- BOARD-ROLL:START -->'
+    echo "### 2026-07-10 zone-A newest"
+    echo "- detail A2 $pad8"
+    echo "### 2026-07-09 zone-A oldest"
+    echo "- detail A1 $pad8"
+    echo '<!-- BOARD-ROLL:END -->'
+    echo
+    echo "## Curated-between-zones (pinned — must never move)"
+    echo "- CANARY-BETWEEN keep me"
+    echo
+    echo '<!-- BOARD-ROLL:START -->'
+    echo "### 2026-07-08 zone-B newest"
+    echo "- detail B2 $pad8"
+    echo "### 2026-07-07 zone-B oldest"
+    echo "- detail B1 $pad8"
+    echo '<!-- BOARD-ROLL:END -->'
+} > "$L"
+before8=$(cat "$L")
+set +e; bash "$SUT" --live "$L" --ledger "$G" --cap 80 >/dev/null 2>&1; rc=$?; set -e
+[[ "$rc" -eq 3 ]] || note "multi-pair board should exit 3 (got $rc)"
+[[ "$(cat "$L")" == "$before8" ]] || note "multi-pair run modified LIVE (must never guess across zones)"
+grep -q "CANARY-BETWEEN keep me" "$L" || note "multi-pair run relocated curated between-zones content"
+grep -q "CANARY-BETWEEN" "$G" && note "curated between-zones content leaked into LEDGER"
+
+if [[ "$fail" -eq 0 ]]; then
+    echo "board-roll regression passed (8 groups)"
+fi
+exit "$fail"

packages/mosaic/src/lease-broker/broker-supervisor.spec.ts

@@ -0,0 +1,237 @@
+import { createServer, type Server } from 'node:net';
+import { mkdir, mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { afterEach, describe, expect, it } from 'vitest';
+
+import {
+  applyBrokerSupervisor,
+  checkBrokerSupervisorHealth,
+  isBrokerSupervisorHealthy,
+  resolveBrokerSupervisorPaths,
+  resolveLeaseBrokerSocketPath,
+  type BrokerSupervisorPaths,
+} from './broker-supervisor.js';
+
+const REAL_FRAMEWORK_ROOT = new URL('../../framework/', import.meta.url).pathname;
+
+const cleanupDirs: string[] = [];
+const cleanupServers: Server[] = [];
+
+async function tempDir(prefix: string): Promise<string> {
+  const dir = await mkdtemp(join(tmpdir(), prefix));
+  cleanupDirs.push(dir);
+  return dir;
+}
+
+afterEach(async () => {
+  for (const server of cleanupServers.splice(0)) {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+  for (const dir of cleanupDirs.splice(0)) {
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+describe('resolveLeaseBrokerSocketPath', () => {
+  it('honors an explicit MOSAIC_LEASE_BROKER_SOCKET override', () => {
+    expect(resolveLeaseBrokerSocketPath({ MOSAIC_LEASE_BROKER_SOCKET: '/tmp/explicit.sock' })).toBe(
+      '/tmp/explicit.sock',
+    );
+  });
+
+  it('falls back to $XDG_RUNTIME_DIR/mosaic-lease/broker.sock', () => {
+    expect(resolveLeaseBrokerSocketPath({ XDG_RUNTIME_DIR: '/run/user/1000' })).toBe(
+      join('/run/user/1000', 'mosaic-lease', 'broker.sock'),
+    );
+  });
+
+  it('falls back to /run/user/<uid>/mosaic-lease/broker.sock as a last resort', () => {
+    expect(resolveLeaseBrokerSocketPath({}, 4242)).toBe(
+      join('/run/user', '4242', 'mosaic-lease', 'broker.sock'),
+    );
+  });
+
+  it('prefers the explicit override over XDG_RUNTIME_DIR', () => {
+    expect(
+      resolveLeaseBrokerSocketPath({
+        MOSAIC_LEASE_BROKER_SOCKET: '/explicit.sock',
+        XDG_RUNTIME_DIR: '/run/user/1000',
+      }),
+    ).toBe('/explicit.sock');
+  });
+});
+
+describe('resolveBrokerSupervisorPaths', () => {
+  it('colocates the state file next to the resolved socket', () => {
+    const paths = resolveBrokerSupervisorPaths({
+      mosaicHome: '/home/x/.config/mosaic',
+      frameworkRoot: '/repo/framework',
+      env: { XDG_RUNTIME_DIR: '/run/user/1000' },
+    });
+    expect(paths.socketPath).toBe(join('/run/user/1000', 'mosaic-lease', 'broker.sock'));
+    expect(paths.statePath).toBe(join('/run/user/1000', 'mosaic-lease', 'state.json'));
+  });
+
+  it('targets the systemd --user dir under the given home, not mosaicHome', () => {
+    const paths = resolveBrokerSupervisorPaths({
+      mosaicHome: '/somewhere-else/.config/mosaic',
+      frameworkRoot: '/repo/framework',
+      homeDir: '/home/canary',
+      env: {},
+      uid: 0,
+    });
+    expect(paths.systemdUserDir).toBe(join('/home/canary', '.config', 'systemd', 'user'));
+    expect(paths.unitTargetPath).toBe(
+      join('/home/canary', '.config', 'systemd', 'user', 'mosaic-lease-broker.service'),
+    );
+  });
+
+  it('is a pure function: identical options resolve to identical paths', () => {
+    const options = {
+      mosaicHome: '/h/.config/mosaic',
+      frameworkRoot: '/repo/framework',
+      env: { XDG_RUNTIME_DIR: '/run/user/1000' },
+    };
+    expect(resolveBrokerSupervisorPaths(options)).toEqual(resolveBrokerSupervisorPaths(options));
+  });
+});
+
+describe('applyBrokerSupervisor', () => {
+  async function fakePaths(): Promise<BrokerSupervisorPaths> {
+    const home = await tempDir('mosaic-broker-supervisor-home-');
+    const mosaicHome = join(home, '.config', 'mosaic');
+    const runtimeDir = await tempDir('mosaic-broker-supervisor-runtime-');
+    return resolveBrokerSupervisorPaths({
+      mosaicHome,
+      frameworkRoot: REAL_FRAMEWORK_ROOT,
+      homeDir: home,
+      env: { XDG_RUNTIME_DIR: runtimeDir },
+    });
+  }
+
+  it('renders a unit that references the installed wrapper script and hardens the runtime dir', async () => {
+    const paths = await fakePaths();
+    const unitSource = await readFile(paths.unitSourcePath, 'utf8');
+    expect(unitSource).toContain('ExecStart=');
+    expect(unitSource).toContain('%h/.config/mosaic/tools/lease-broker/start-lease-broker.sh');
+    expect(unitSource).toContain('RuntimeDirectory=mosaic-lease');
+    expect(unitSource).toContain('RuntimeDirectoryMode=0700');
+    expect(unitSource).toContain('Restart=on-failure');
+    expect(unitSource).toContain('WantedBy=default.target');
+    // No ambient environment file preload, matching the other fleet units'
+    // strict-parsing convention.
+    expect(unitSource).not.toMatch(/^Environment(File)?=/m);
+  });
+
+  it('materializes the unit, wrapper script, and daemon sources on first apply', async () => {
+    const paths = await fakePaths();
+
+    const result = await applyBrokerSupervisor(paths);
+
+    expect(result.installedFiles).toContain(paths.unitTargetPath);
+    expect(result.installedFiles).toContain(paths.wrapperTargetPath);
+    for (const target of paths.daemonTargetPaths) {
+      expect(result.installedFiles).toContain(target);
+    }
+
+    const unitTargetContent = await readFile(paths.unitTargetPath, 'utf8');
+    const unitSourceContent = await readFile(paths.unitSourcePath, 'utf8');
+    expect(unitTargetContent).toBe(unitSourceContent);
+
+    const wrapperMode = (await stat(paths.wrapperTargetPath)).mode & 0o777;
+    expect(wrapperMode).toBe(0o755);
+
+    for (const target of paths.daemonTargetPaths) {
+      await expect(stat(target)).resolves.toBeDefined();
+    }
+  });
+
+  it('is idempotent: applying twice reproduces identical files with no error', async () => {
+    const paths = await fakePaths();
+
+    await applyBrokerSupervisor(paths);
+    const firstUnit = await readFile(paths.unitTargetPath, 'utf8');
+    const firstWrapper = await readFile(paths.wrapperTargetPath, 'utf8');
+    const firstWrapperMode = (await stat(paths.wrapperTargetPath)).mode & 0o777;
+
+    await expect(applyBrokerSupervisor(paths)).resolves.toBeDefined();
+
+    const secondUnit = await readFile(paths.unitTargetPath, 'utf8');
+    const secondWrapper = await readFile(paths.wrapperTargetPath, 'utf8');
+    const secondWrapperMode = (await stat(paths.wrapperTargetPath)).mode & 0o777;
+
+    expect(secondUnit).toBe(firstUnit);
+    expect(secondWrapper).toBe(firstWrapper);
+    expect(secondWrapperMode).toBe(firstWrapperMode);
+  });
+
+  it('never touches the real host: only writes under the supplied temp dirs', async () => {
+    const paths = await fakePaths();
+    await applyBrokerSupervisor(paths);
+    expect(paths.systemdUserDir.startsWith(tmpdir())).toBe(true);
+    expect(paths.mosaicHome.startsWith(tmpdir())).toBe(true);
+  });
+});
+
+describe('checkBrokerSupervisorHealth / isBrokerSupervisorHealthy', () => {
+  async function fakeHealthPaths(): Promise<
+    Pick<BrokerSupervisorPaths, 'unitTargetPath' | 'socketPath'>
+  > {
+    const runtimeDir = await tempDir('mosaic-broker-supervisor-health-');
+    await mkdir(join(runtimeDir, 'systemd-user'), { recursive: true });
+    return {
+      unitTargetPath: join(runtimeDir, 'systemd-user', 'mosaic-lease-broker.service'),
+      socketPath: join(runtimeDir, 'broker.sock'),
+    };
+  }
+
+  it('reports unhealthy when neither the unit nor the socket exist', async () => {
+    const paths = await fakeHealthPaths();
+
+    const health = await checkBrokerSupervisorHealth(paths);
+
+    expect(health).toEqual({ unitInstalled: false, socketPresent: false, healthy: false });
+    expect(await isBrokerSupervisorHealthy(paths)).toBe(false);
+  });
+
+  it('reports unhealthy when the unit is installed but no socket is listening', async () => {
+    const paths = await fakeHealthPaths();
+    await writeFile(paths.unitTargetPath, '[Unit]\n');
+
+    const health = await checkBrokerSupervisorHealth(paths);
+
+    expect(health.unitInstalled).toBe(true);
+    expect(health.socketPresent).toBe(false);
+    expect(health.healthy).toBe(false);
+  });
+
+  it('reports healthy=true once a real Unix socket exists at the resolved path, and false again once removed', async () => {
+    const paths = await fakeHealthPaths();
+
+    const server = createServer();
+    cleanupServers.push(server);
+    await new Promise<void>((resolve, reject) => {
+      server.once('error', reject);
+      server.listen(paths.socketPath, resolve);
+    });
+
+    expect(await isBrokerSupervisorHealthy(paths)).toBe(true);
+    const health = await checkBrokerSupervisorHealth(paths);
+    expect(health.socketPresent).toBe(true);
+    expect(health.healthy).toBe(true);
+
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+    await rm(paths.socketPath, { force: true });
+
+    expect(await isBrokerSupervisorHealthy(paths)).toBe(false);
+  });
+
+  it('does not confuse a stale regular file at the socket path with a live socket', async () => {
+    const paths = await fakeHealthPaths();
+    await writeFile(paths.socketPath, 'not actually a socket');
+
+    expect(await isBrokerSupervisorHealthy(paths)).toBe(false);
+  });
+});

packages/mosaic/src/lease-broker/broker-supervisor.ts

@@ -0,0 +1,223 @@
+/**
+ * Activation-side supervisor for the Mosaic lease broker (issue #869, Point-1
+ * C3). #828 shipped fail-closed enforcement hooks (`mutator-gate.py`,
+ * `receipt-observer-client.py`) with nothing that guaranteed `daemon.py` was
+ * running or that its socket existed before a gated runtime started. This
+ * module:
+ *
+ *  - resolves the broker socket/state paths and the on-disk locations of the
+ *    supervisor artifacts, deterministically and consistently with
+ *    `defaultLeaseBrokerSocket` in `../commands/launch.ts`;
+ *  - idempotently applies (materializes) a systemd `--user` unit plus the
+ *    wrapper script and daemon sources it execs, mirroring the tmux fleet
+ *    unit convention in `framework/systemd/user/`;
+ *  - exposes a health predicate other cards (e.g. the C1 activation probe)
+ *    can call to learn whether a broker supervisor is present and healthy.
+ *
+ * `applyBrokerSupervisor` only writes files under the paths it is given. It
+ * never runs `systemctl`, never starts `daemon.py`, and never touches a real
+ * host's `~/.config` unless the caller explicitly resolves paths there.
+ * Enabling/starting the unit is a separate, later, out-of-scope step.
+ */
+import { chmod, copyFile, mkdir, stat } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+
+const UNIT_NAME = 'mosaic-lease-broker.service';
+const WRAPPER_SCRIPT_NAME = 'start-lease-broker.sh';
+
+/** Co-located modules `daemon.py` imports at runtime; kept alongside it. */
+const DAEMON_SOURCE_FILE_NAMES = [
+  'daemon.py',
+  'lease_generation.py',
+  'normative_fragments.py',
+  'receipt_challenge.py',
+  'receipt_observer.py',
+] as const;
+
+export interface ResolveBrokerSupervisorPathsOptions {
+  /** `~/.config/mosaic` (or an override) — where installed tool copies live. */
+  mosaicHome: string;
+  /** Root of the checked-out `framework/` directory (canonical file source). */
+  frameworkRoot: string;
+  /** Defaults to `process.env`; pass a fake for tests. */
+  env?: NodeJS.ProcessEnv;
+  /** Defaults to `os.homedir()`; pass a temp dir in tests. */
+  homeDir?: string;
+  /** Defaults to `process.getuid()` (or 0); pass a fake for tests. */
+  uid?: number;
+}
+
+export interface BrokerSupervisorPaths {
+  readonly mosaicHome: string;
+  readonly frameworkRoot: string;
+  readonly systemdUserDir: string;
+  readonly leaseBrokerToolsDir: string;
+  readonly unitSourcePath: string;
+  readonly unitTargetPath: string;
+  readonly wrapperSourcePath: string;
+  readonly wrapperTargetPath: string;
+  readonly daemonSourcePaths: readonly string[];
+  readonly daemonTargetPaths: readonly string[];
+  /**
+   * Resolved with the same precedence as `defaultLeaseBrokerSocket` in
+   * `../commands/launch.ts`: an explicit `MOSAIC_LEASE_BROKER_SOCKET`, else
+   * `$XDG_RUNTIME_DIR/mosaic-lease/broker.sock`, else
+   * `/run/user/<uid>/mosaic-lease/broker.sock`.
+   */
+  readonly socketPath: string;
+  /** Colocated next to the socket, matching the broker's own generation-file convention. */
+  readonly statePath: string;
+}
+
+/**
+ * Resolve the lease broker socket path alone, with the same precedence as
+ * `defaultLeaseBrokerSocket` in `../commands/launch.ts`. Exported so callers
+ * (and tests) can assert the two stay in agreement without importing the CLI
+ * command module.
+ */
+export function resolveLeaseBrokerSocketPath(
+  env: NodeJS.ProcessEnv = process.env,
+  uid: number = typeof process.getuid === 'function' ? process.getuid() : 0,
+): string {
+  const explicit = env['MOSAIC_LEASE_BROKER_SOCKET'];
+  if (explicit) return explicit;
+  const runtimeDir = env['XDG_RUNTIME_DIR'];
+  if (runtimeDir) return join(runtimeDir, 'mosaic-lease', 'broker.sock');
+  return join('/run/user', String(uid), 'mosaic-lease', 'broker.sock');
+}
+
+/** Resolve every path the supervisor apply/health functions need, deterministically. */
+export function resolveBrokerSupervisorPaths(
+  options: ResolveBrokerSupervisorPathsOptions,
+): BrokerSupervisorPaths {
+  const { mosaicHome, frameworkRoot } = options;
+  const env = options.env ?? process.env;
+  const homeDir = options.homeDir ?? homedir();
+  const systemdUserDir = join(homeDir, '.config', 'systemd', 'user');
+  const leaseBrokerToolsDir = join(mosaicHome, 'tools', 'lease-broker');
+  const frameworkLeaseBrokerDir = join(frameworkRoot, 'tools', 'lease-broker');
+  const socketPath = resolveLeaseBrokerSocketPath(env, options.uid);
+  const statePath = join(dirname(socketPath), 'state.json');
+
+  return {
+    mosaicHome,
+    frameworkRoot,
+    systemdUserDir,
+    leaseBrokerToolsDir,
+    unitSourcePath: join(frameworkRoot, 'systemd', 'user', UNIT_NAME),
+    unitTargetPath: join(systemdUserDir, UNIT_NAME),
+    wrapperSourcePath: join(frameworkLeaseBrokerDir, WRAPPER_SCRIPT_NAME),
+    wrapperTargetPath: join(leaseBrokerToolsDir, WRAPPER_SCRIPT_NAME),
+    daemonSourcePaths: DAEMON_SOURCE_FILE_NAMES.map((name) => join(frameworkLeaseBrokerDir, name)),
+    daemonTargetPaths: DAEMON_SOURCE_FILE_NAMES.map((name) => join(leaseBrokerToolsDir, name)),
+    socketPath,
+    statePath,
+  };
+}
+
+export interface ApplyBrokerSupervisorResult {
+  readonly installedFiles: readonly string[];
+}
+
+/**
+ * Idempotently materialize the supervisor unit, its wrapper script, and the
+ * daemon sources it execs. Safe to call on every reseed: every write is a
+ * deterministic overwrite of the same target path from the same source, so a
+ * second call reproduces identical bytes/modes and never errors.
+ *
+ * Never runs `systemctl`; the caller decides separately whether/when to
+ * `daemon-reload`/`enable`/`start` the installed unit.
+ */
+export async function applyBrokerSupervisor(
+  paths: BrokerSupervisorPaths,
+): Promise<ApplyBrokerSupervisorResult> {
+  await mkdir(paths.leaseBrokerToolsDir, { recursive: true });
+  await mkdir(paths.systemdUserDir, { recursive: true });
+
+  const installedFiles: string[] = [];
+
+  for (let index = 0; index < paths.daemonSourcePaths.length; index += 1) {
+    const source = paths.daemonSourcePaths[index];
+    const target = paths.daemonTargetPaths[index];
+    if (source === undefined || target === undefined) continue;
+    await copyFile(source, target);
+    await chmod(target, 0o644);
+    installedFiles.push(target);
+  }
+
+  await copyFile(paths.wrapperSourcePath, paths.wrapperTargetPath);
+  await chmod(paths.wrapperTargetPath, 0o755);
+  installedFiles.push(paths.wrapperTargetPath);
+
+  await copyFile(paths.unitSourcePath, paths.unitTargetPath);
+  await chmod(paths.unitTargetPath, 0o644);
+  installedFiles.push(paths.unitTargetPath);
+
+  return { installedFiles };
+}
+
+export interface BrokerSupervisorHealth {
+  /** Whether the systemd unit file has been materialized at its target path. */
+  readonly unitInstalled: boolean;
+  /** Whether a Unix domain socket currently exists at the resolved socket path. */
+  readonly socketPresent: boolean;
+  /**
+   * The signal other cards (e.g. C1's activation probe) should treat as
+   * "a broker supervisor is present and healthy". Presence of a live socket
+   * is the authoritative signal: a gated runtime can only ever succeed by
+   * connecting to it, so this is what fail-closed callers must check.
+   */
+  readonly healthy: boolean;
+}
+
+/**
+ * Report the supervisor's on-disk/health signals. Never throws for an
+ * absent unit or socket — both simply report `false`; unexpected filesystem
+ * errors (permission issues, etc.) still propagate.
+ */
+export async function checkBrokerSupervisorHealth(
+  paths: Pick<BrokerSupervisorPaths, 'unitTargetPath' | 'socketPath'>,
+): Promise<BrokerSupervisorHealth> {
+  const [unitInstalled, socketPresent] = await Promise.all([
+    pathExists(paths.unitTargetPath),
+    isUnixSocket(paths.socketPath),
+  ]);
+  return { unitInstalled, socketPresent, healthy: socketPresent };
+}
+
+/** Convenience boolean form of {@link checkBrokerSupervisorHealth} for simple call sites. */
+export async function isBrokerSupervisorHealthy(
+  paths: Pick<BrokerSupervisorPaths, 'unitTargetPath' | 'socketPath'>,
+): Promise<boolean> {
+  return (await checkBrokerSupervisorHealth(paths)).healthy;
+}
+
+async function pathExists(path: string): Promise<boolean> {
+  try {
+    await stat(path);
+    return true;
+  } catch (error) {
+    if (isEnoent(error)) return false;
+    throw error;
+  }
+}
+
+async function isUnixSocket(path: string): Promise<boolean> {
+  try {
+    const info = await stat(path);
+    return info.isSocket();
+  } catch (error) {
+    if (isEnoent(error)) return false;
+    throw error;
+  }
+}
+
+function isEnoent(error: unknown): boolean {
+  return (
+    typeof error === 'object' &&
+    error !== null &&
+    'code' in error &&
+    (error as NodeJS.ErrnoException).code === 'ENOENT'
+  );
+}