docs: finalize ri-4-001 scratchpad with verification evidence (#1275)

- import paths: created/draft, typed refusal creates nothing, conflict
  refusal leaves bytes untouched, --accept-successor persists v+1
- export writes the labeled generated view; authority unchanged
- mission --plan persists linkage readable by a fresh service instance;
  mission path and prdy path share the docs/prdy store with stable
  ids/versions

packages/mosaic/__tests__/platform/detect.test.ts

@@ -0,0 +1,74 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+// homedir/platform are read at call time, so they can be stubbed per case.
+vi.mock('node:os', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('node:os')>();
+  return {
+    ...actual,
+    homedir: () => '/home/tester',
+    platform: () => mockPlatform,
+  };
+});
+
+let mockPlatform: NodeJS.Platform = 'linux';
+
+const { getShellProfilePath, detectShell } = await import('../../src/platform/detect.js');
+
+describe('getShellProfilePath', () => {
+  const originalShell = process.env['SHELL'];
+  const originalZdotdir = process.env['ZDOTDIR'];
+
+  beforeEach(() => {
+    mockPlatform = 'linux';
+    delete process.env['ZDOTDIR'];
+  });
+
+  afterEach(() => {
+    if (originalShell === undefined) delete process.env['SHELL'];
+    else process.env['SHELL'] = originalShell;
+    if (originalZdotdir === undefined) delete process.env['ZDOTDIR'];
+    else process.env['ZDOTDIR'] = originalZdotdir;
+  });
+
+  // The regression this guards: setupPath() in stages/finalize.ts appends the
+  // PATH export to whatever this returns. A line written to ~/.bashrc is
+  // unreachable to `bash -lc`, systemd units and agent seats, because Debian's
+  // default .bashrc returns early for non-interactive shells — so an install
+  // reported success and left `mosaic: command not found`. Same for .zshrc,
+  // which zsh only reads for interactive shells.
+  it('never targets an interactive-only rc file', () => {
+    for (const shell of ['/bin/bash', '/usr/bin/zsh']) {
+      process.env['SHELL'] = shell;
+      const profile = getShellProfilePath();
+      expect(profile).not.toMatch(/\.bashrc$/);
+      expect(profile).not.toMatch(/\.zshrc$/);
+    }
+  });
+
+  it('uses ~/.profile for bash', () => {
+    process.env['SHELL'] = '/bin/bash';
+    expect(getShellProfilePath()).toBe('/home/tester/.profile');
+  });
+
+  it('uses ~/.zshenv for zsh', () => {
+    process.env['SHELL'] = '/usr/bin/zsh';
+    expect(getShellProfilePath()).toBe('/home/tester/.zshenv');
+  });
+
+  it('honours ZDOTDIR for zsh', () => {
+    process.env['SHELL'] = '/usr/bin/zsh';
+    process.env['ZDOTDIR'] = '/custom/zdot';
+    expect(getShellProfilePath()).toBe('/custom/zdot/.zshenv');
+  });
+
+  it('falls back to ~/.profile for an unknown shell', () => {
+    process.env['SHELL'] = '/bin/somethingelse';
+    expect(detectShell()).toBe('unknown');
+    expect(getShellProfilePath()).toBe('/home/tester/.profile');
+  });
+
+  it('still routes fish to its own config', () => {
+    process.env['SHELL'] = '/usr/bin/fish';
+    expect(getShellProfilePath()).toBe('/home/tester/.config/fish/config.fish');
+  });
+});

packages/mosaic/framework/systemd/user/mosaic-agent@.service

@@ -4,6 +4,14 @@ Documentation=https://git.mosaicstack.dev/mosaicstack/stack
 Requires=mosaic-tmux-holder.service
 After=mosaic-tmux-holder.service
 PartOf=mosaic-tmux-holder.service
+# Do not attempt a seat before its generated env exists. `install` enables this
+# unit (WantedBy=default.target) but on a roster-v2 fleet the reconciler owns the
+# generated env, so between `install` and the first `apply`/`regen --write` there
+# is a boot window where ExecStart would run against an absent env file and the
+# launcher would fail the unit. A skipped unit is the honest state for "enabled
+# but not yet configured"; systemd re-evaluates the condition on every start, so
+# the seat comes up on the next start once the reconciler has written env.
+ConditionPathExists=%h/.config/mosaic/fleet/agents/%i.env.generated
 
 [Service]
 Type=oneshot

packages/mosaic/framework/systemd/user/test-fleet-units.sh

@@ -128,6 +128,14 @@ EOF
 sleep 30
 EOF
   chmod 700 "$AGENT_BIN/mosaic"
+  # The launcher resolves the roster's runtime against PANE_PATH before it
+  # spawns anything (#1241), so the runtime this projection names has to be
+  # present here even though the fake `mosaic` above never execs it.
+  cat > "$AGENT_BIN/pi" <<'EOF'
+#!/bin/sh
+sleep 30
+EOF
+  chmod 700 "$AGENT_BIN/pi"
   server_environment_before=$(tmux -L "$TEST_SOCKET" show-environment -g | sort)
   server_sessions_before=$(tmux -L "$TEST_SOCKET" list-sessions | sort)
   if /usr/bin/env -i HOME="$HOLDER_HOME" PATH=/usr/bin:/bin MOSAIC_HOME="$AGENT_HOME" \

packages/mosaic/framework/tools/_scripts/mosaic-doctor

@@ -225,6 +225,54 @@ else
   warn "mosaic-ensure-sequential-thinking helper missing"
 fi
 
+# Fleet transport binary (#1240).
+#
+# `mosaic fleet --help` reads "Manage the local Mosaic tmux fleet" and every
+# roster the CLI scaffolds sets `transport: tmux`, but nothing in the install
+# path provides tmux and, until now, nothing here noticed it was absent. On a
+# greenfield host that produced a fleet which installed clean, started clean,
+# and had no live seat; `mosaic fleet ps` was the operator's first and only
+# signal that anything was wrong.
+#
+# The roster's own `transport:` is read rather than assumed, so a host that
+# declares something other than tmux is told about the binary it actually
+# needs. Absent a roster the check still runs — `mosaic fleet init` will
+# scaffold a tmux fleet on this host, and finding out beforehand is the point.
+#
+# `tools/install.sh` carries a deliberately parallel check at the end of its
+# summary. The two are separate because the installer must be able to say this
+# before the framework's own scripts are guaranteed to be on disk; keep their
+# wording in step.
+fleet_declared_transport() {
+  local roster="$MOSAIC_HOME/fleet/roster.yaml"
+  local declared=""
+
+  if [[ -f "$roster" ]]; then
+    declared="$(sed -n 's/^[[:space:]]*transport:[[:space:]]*//p' "$roster" | head -1 |
+      tr -d '"'\''' | tr -d '\r' | awk '{print $1}')"
+  fi
+
+  printf '%s\n' "${declared:-tmux}"
+}
+
+check_fleet_transport() {
+  local transport
+  transport="$(fleet_declared_transport)"
+
+  if command -v "$transport" >/dev/null 2>&1; then
+    pass "Fleet transport available: $transport"
+    return
+  fi
+
+  if [[ -f "$MOSAIC_HOME/fleet/roster.yaml" ]]; then
+    warn "Fleet transport '$transport' is not installed — this host has a roster and no seat can launch. Install it (e.g. sudo apt-get install -y $transport), then 'mosaic fleet start'."
+  else
+    warn "Fleet transport '$transport' is not installed — 'mosaic fleet' cannot run seats here. Install it (e.g. sudo apt-get install -y $transport) before 'mosaic fleet init'."
+  fi
+}
+
+check_fleet_transport
+
 # Legacy migration surfaces should no longer contain symlink trees.
 legacy_paths=(
   "$HOME/.claude/agent-guides"

packages/mosaic/framework/tools/_scripts/test-fleet-transport-check.sh

@@ -0,0 +1,215 @@
+#!/usr/bin/env bash
+# Covers the #1240 fleet-transport checks in `mosaic-doctor` and in
+# `tools/install.sh`.
+#
+# Both checks answer the same question — "can a seat actually launch on this
+# host?" — from two different places, because the installer has to be able to
+# answer it before the framework's own scripts are guaranteed to be on disk.
+# Two implementations of one rule is exactly the shape that drifts, so this
+# harness drives BOTH, in one file, from the same table of cases.
+#
+# The functions are extracted from the shipped scripts rather than copied here.
+# A test that carries its own copy of the logic is a test that keeps passing
+# after the shipped copy changes — the failure mode this whole change is about.
+# Extraction is by exact function header and a closing brace in column one; if
+# either script is reshaped so that stops matching, the extraction yields
+# nothing and this fails loudly instead of silently measuring an empty string.
+set -euo pipefail
+
+SCRIPT_DIR=$(cd -- "$(dirname -- "$0")" && pwd)
+DOCTOR="$SCRIPT_DIR/mosaic-doctor"
+# framework/tools/_scripts -> framework/tools -> framework -> mosaic -> packages -> repo
+INSTALLER=$(cd -- "$SCRIPT_DIR/../../../../.." && pwd)/tools/install.sh
+
+fail() {
+  echo "FAIL: $*" >&2
+  exit 1
+}
+
+[ -f "$DOCTOR" ] || fail "missing mosaic-doctor at $DOCTOR"
+[ -f "$INSTALLER" ] || fail "missing install.sh at $INSTALLER"
+
+ROOT=$(mktemp -d)
+trap 'rm -rf "$ROOT"' EXIT
+
+# The cases below run with PATH set to a directory that deliberately does not
+# contain a shell, and a PATH assignment on a command also governs how that
+# command is looked up — so bash has to be named absolutely or it becomes the
+# thing that is missing.
+BASH_BIN=$(command -v bash) || fail "host is missing 'bash'"
+
+# A PATH containing exactly the utilities these functions use and nothing else.
+# The absent-transport cases are only meaningful on a PATH where the transport
+# is genuinely unresolvable, and this host (like most) has tmux in /usr/bin —
+# so the system path cannot be part of the path under test.
+FAKE_BIN="$ROOT/bin"
+mkdir -p "$FAKE_BIN"
+for utility in sed head tr awk; do
+  utility_path=$(command -v "$utility") || fail "host is missing '$utility'"
+  ln -s "$utility_path" "$FAKE_BIN/$utility"
+done
+
+if PATH="$FAKE_BIN" command -v tmux >/dev/null 2>&1; then
+  fail "'tmux' is resolvable on the minimal test path; absent-transport cases are not measurable"
+fi
+
+# Extract a function by its exact header, up to a closing brace in column one.
+extract_function() {
+  local source_file="$1"
+  local function_name="$2"
+  local destination="$3"
+
+  awk -v name="$function_name" '
+    $0 == name "() {" { collecting = 1 }
+    collecting { print }
+    collecting && $0 == "}" { exit }
+  ' "$source_file" > "$destination"
+
+  grep -qF "$function_name() {" "$destination" ||
+    fail "could not extract '$function_name' from $source_file — has it been renamed or reshaped?"
+  # An unterminated extraction would be a syntax error the moment it is sourced,
+  # but saying so here names the cause instead of leaving a bash parse error.
+  bash -n "$destination" ||
+    fail "extracted '$function_name' does not parse; the closing brace was probably not found"
+}
+
+extract_function "$DOCTOR" fleet_declared_transport "$ROOT/doctor-declared.sh"
+extract_function "$DOCTOR" check_fleet_transport "$ROOT/doctor-check.sh"
+extract_function "$INSTALLER" check_fleet_transport "$ROOT/installer-check.sh"
+
+# Build a MOSAIC_HOME, optionally with a roster declaring a transport.
+make_home() {
+  local home="$ROOT/$1"
+  local declared="${2-}"
+
+  rm -rf "$home"
+  mkdir -p "$home"
+  if [ -n "$declared" ]; then
+    mkdir -p "$home/fleet"
+    cat > "$home/fleet/roster.yaml" <<EOF
+version: 2
+generation: 1
+transport: $declared
+agents: []
+EOF
+  fi
+  printf '%s\n' "$home"
+}
+
+# Run the doctor's check against a given home and path, capturing which
+# reporter the check chose. The real `pass` prints only under `--verbose` and
+# the real `warn` always prints; these stubs make both unconditional on
+# purpose, because what is under test is the severity the check selects, not
+# whether the default verbosity happens to show it. A check that warned where
+# it should pass would otherwise be invisible here.
+run_doctor_check() {
+  local home="$1"
+  local path="$2"
+
+  MOSAIC_HOME="$home" PATH="$path" "$BASH_BIN" --noprofile --norc -c '
+    set -euo pipefail
+    warn() { echo "[WARN] $*"; }
+    pass() { echo "[OK] $*"; }
+    MOSAIC_HOME="$1"
+    source "$2"
+    source "$3"
+    check_fleet_transport
+  ' _ "$home" "$ROOT/doctor-declared.sh" "$ROOT/doctor-check.sh" 2>&1
+}
+
+run_installer_check() {
+  local home="$1"
+  local path="$2"
+
+  MOSAIC_HOME="$home" PATH="$path" "$BASH_BIN" --noprofile --norc -c '
+    set -euo pipefail
+    warn() { echo "[WARN] $*"; }
+    C="" RESET=""
+    MOSAIC_HOME="$1"
+    source "$2"
+    check_fleet_transport
+  ' _ "$home" "$ROOT/installer-check.sh" 2>&1
+}
+
+# A transport that exists. Named tmux because that is what the default roster
+# declares; the binary never runs, it only has to resolve.
+PRESENT_BIN="$ROOT/present-bin"
+mkdir -p "$PRESENT_BIN"
+printf '#!/usr/bin/env bash\nexit 0\n' > "$PRESENT_BIN/tmux"
+chmod +x "$PRESENT_BIN/tmux"
+PATH_WITH_TMUX="$PRESENT_BIN:$FAKE_BIN"
+
+# ── absent, no roster ────────────────────────────────────────────────────────
+# Nothing has been configured yet, so the honest thing to point at is `init`.
+home=$(make_home no-roster)
+
+output=$(run_doctor_check "$home" "$FAKE_BIN")
+echo "$output" | grep -qF '[WARN]' || fail "doctor did not warn when tmux was absent"
+echo "$output" | grep -qF 'tmux' || fail "doctor warning did not name the transport"
+echo "$output" | grep -qF 'mosaic fleet init' || fail "doctor did not point a rosterless host at init"
+
+output=$(run_installer_check "$home" "$FAKE_BIN")
+echo "$output" | grep -qF '[WARN]' || fail "installer did not warn when tmux was absent"
+echo "$output" | grep -qF 'reports success and no seat comes up' ||
+  fail "installer warning did not say what the missing transport actually breaks"
+
+# ── absent, roster present ───────────────────────────────────────────────────
+# A configured fleet that cannot launch is a stronger statement than a
+# hypothetical one, and the message says so.
+home=$(make_home with-roster tmux)
+
+output=$(run_doctor_check "$home" "$FAKE_BIN")
+echo "$output" | grep -qF '[WARN]' || fail "doctor did not warn with a roster present and tmux absent"
+echo "$output" | grep -qF 'roster' || fail "doctor did not mention the roster it found"
+echo "$output" | grep -qF 'mosaic fleet start' || fail "doctor did not point a configured host at start"
+
+# ── present ──────────────────────────────────────────────────────────────────
+# Silence from the installer, and a pass (not a warning) from the audit.
+for home_name in no-roster with-roster; do
+  home="$ROOT/$home_name"
+
+  output=$(run_doctor_check "$home" "$PATH_WITH_TMUX")
+  if echo "$output" | grep -qF '[WARN]'; then
+    fail "doctor warned about the transport while tmux was present ($home_name)"
+  fi
+  echo "$output" | grep -qF '[OK]' || fail "doctor did not record a pass with tmux present ($home_name)"
+
+  output=$(run_installer_check "$home" "$PATH_WITH_TMUX")
+  if [ -n "$output" ]; then
+    fail "installer was not silent with tmux present ($home_name): $output"
+  fi
+done
+
+# ── the roster declares something other than tmux ────────────────────────────
+# The roster is read, not assumed. A host that declares a different transport
+# is told about the binary it actually needs, and never about tmux — being sent
+# to install the wrong package is worse than no advice at all.
+home=$(make_home other-transport zellij)
+
+output=$(run_doctor_check "$home" "$PATH_WITH_TMUX")
+echo "$output" | grep -qF 'zellij' || fail "doctor ignored the roster's declared transport"
+if echo "$output" | grep -qF 'tmux'; then
+  fail "doctor named tmux for a host whose roster declares zellij"
+fi
+
+output=$(run_installer_check "$home" "$PATH_WITH_TMUX")
+echo "$output" | grep -qF 'zellij' || fail "installer ignored the roster's declared transport"
+if echo "$output" | grep -qF 'tmux'; then
+  fail "installer named tmux for a host whose roster declares zellij"
+fi
+
+# ── a quoted or trailing-comment transport value ─────────────────────────────
+# YAML permits both and neither is exotic; a check that installs `tmux"` or
+# reads `tmux # default` as a binary name would send the operator nowhere.
+home=$(make_home quoted-transport '"tmux"   # the only transport today')
+
+output=$(run_doctor_check "$home" "$PATH_WITH_TMUX")
+echo "$output" | grep -qF '[OK] Fleet transport available: tmux' ||
+  fail "doctor did not parse a quoted/commented transport value: $output"
+
+output=$(run_installer_check "$home" "$PATH_WITH_TMUX")
+if [ -n "$output" ]; then
+  fail "installer did not parse a quoted/commented transport value: $output"
+fi
+
+echo "ok - fleet transport checks (mosaic-doctor + install.sh)"

packages/mosaic/framework/tools/fleet/start-agent-session.sh

@@ -286,6 +286,36 @@ _build_runtime_bin_prefix() {
 MOSAIC_RUNTIME_BIN_PREFIX=$(_build_runtime_bin_prefix)
 PANE_PATH=${MOSAIC_RUNTIME_BIN_PREFIX:+${MOSAIC_RUNTIME_BIN_PREFIX}:}/usr/local/bin:/usr/bin:/bin
 
+# #1241. The pane runs `mosaic yolo <runtime>` under PANE_PATH with a cleared
+# environment. A binary missing from *that* path is a pane that dies in under a
+# second, inside a session nobody is attached to, with its diagnostic scrolled
+# into a pane tmux then destroys. Resolve both here, before any effect, where
+# the failure is still attributable to the thing that caused it.
+#
+# `mosaic yolo <runtime>` runs checkRuntime(runtime) and the binary it looks for
+# is named exactly like the runtime, so resolving the runtime name is the same
+# question the pane will ask a moment later — asked while an operator can still
+# see the answer.
+_resolve_in_pane_path() {
+  PATH="$PANE_PATH" command -v -- "$1" 2>/dev/null
+}
+
+# Exit 69 (EX_UNAVAILABLE): the seat cannot be provided. Distinguished from the
+# 64 (EX_USAGE) rejections above, which mean the projection itself was bad —
+# here the data is fine and the host is not ready. Callers tell the individual
+# cases apart by `code=`, the same way fail_env's many codes share exit 64.
+fail_launch() {
+  local code="$1"
+  shift
+  echo "ERROR: agent launch aborted: code=${code} agent=${AGENT_NAME} $*" >&2
+  exit 69
+}
+
+for required_binary in mosaic "$MOSAIC_AGENT_RUNTIME"; do
+  _resolve_in_pane_path "$required_binary" >/dev/null ||
+    fail_launch missing-binary "'${required_binary}' is not on the pane PATH (${PANE_PATH})"
+done
+
 _ensure_claude_workdir_trusted() {
   local workdir="$1"
   local resolved
@@ -384,6 +414,19 @@ if [ -n "$PANE_PID" ]; then
   _start_heartbeat_sidecar "$AGENT_NAME" "$PANE_PID" \
     "$MOSAIC_HEARTBEAT_RUN_DIR" "$MOSAIC_HEARTBEAT_INTERVAL" || \
     echo "WARNING: heartbeat sidecar could not be started for $AGENT_NAME" >&2
+elif _tmux has-session -t "=${AGENT_NAME}:0.0" 2>/dev/null; then
+  # #1241. Session present, no pane PID after a second of retries. Whatever this
+  # is, it is not a seat an operator can use, so it is not a success either.
+  fail_launch pane-pid-unresolved \
+    "tmux reports the session but no pane PID after 5 attempts"
 else
-  echo "WARNING: could not resolve pane PID for $AGENT_NAME — heartbeat sidecar not started" >&2
+  # #1241. This branch used to print a WARNING about the heartbeat sidecar and
+  # exit 0. It is not a heartbeat problem: tmux destroys a session when its pane
+  # command exits, so an absent session one second after new-session means the
+  # runtime died on startup. Reporting it as success is what let `fleet start`
+  # return 0 over three dead panes — the launcher knew, and said the wrong thing
+  # at the wrong severity to the wrong layer.
+  fail_launch pane-did-not-survive \
+    "the pane exited immediately and tmux destroyed the session;" \
+    "run 'mosaic yolo ${MOSAIC_AGENT_RUNTIME}' in ${MOSAIC_AGENT_WORKDIR} to see why"
 fi

packages/mosaic/framework/tools/fleet/test-start-agent-session.sh

@@ -23,8 +23,26 @@ index=0
 if [ "${args[0]:-}" = -L ]; then index=2; fi
 case "${args[$index]:-}" in
   has-session)
+    # The holder always answers. MOSAIC_TEST_HELD_SESSIONS lets a case add
+    # other targets that should answer too — without it there is no way to
+    # model "tmux still reports the session" for a non-holder agent, and the
+    # launcher's pane-pid-unresolved branch is unreachable from this harness.
+    #
+    # A listed target answers only AFTER new-session, because the launcher asks
+    # this question twice about the same name: once before launching, where a
+    # yes means "already running, nothing to do, exit 0", and once after, where
+    # a yes means "the session survived". A shim that answered yes to both
+    # would short-circuit at the first and never reach the branch under test —
+    # it would look like coverage and measure the idempotency path instead.
     for argument in "${args[@]}"; do
       [ "$argument" = '=_holder:0.0' ] && exit 0
+      case " ${MOSAIC_TEST_HELD_SESSIONS:-} " in
+        *" $argument "*)
+          if tr '\0' '\n' < "${MOSAIC_TEST_TMUX_CALLS:?}" | grep -qxF new-session; then
+            exit 0
+          fi
+          ;;
+      esac
     done
     exit 1
     ;;
@@ -62,6 +80,30 @@ env -0 > "${MOSAIC_HOME:?}/fleet/pane-environment"
 SHIM
 chmod +x "$FAKE_BIN/mosaic"
 
+# The runtime the rosters below name. The launcher resolves it against PANE_PATH
+# before spawning (#1241), so it has to exist somewhere the pane would find it —
+# not merely on the launcher's own PATH.
+printf '#!/usr/bin/env bash\nexit 0\n' > "$FAKE_BIN/pi"
+chmod +x "$FAKE_BIN/pi"
+
+# PANE_PATH is derived partly from `npm config get prefix`. Left to the real npm
+# it would splice whatever the host has installed into the path under test, and
+# the missing-binary cases below would pass or fail by accident of the machine.
+cat > "$FAKE_BIN/npm" <<'SHIM'
+#!/usr/bin/env bash
+printf '%s\n' "${MOSAIC_TEST_NPM_PREFIX:-/nonexistent}"
+SHIM
+chmod +x "$FAKE_BIN/npm"
+
+# PANE_PATH always ends in the system path. A host that installs these there can
+# not measure the missing-binary cases at all, and a green run would mean
+# nothing — so say so instead of passing.
+for host_binary in mosaic pi; do
+  if PATH=/usr/local/bin:/usr/bin:/bin command -v "$host_binary" >/dev/null 2>&1; then
+    fail "host provides '$host_binary' in the system path; missing-binary cases are not measurable here"
+  fi
+done
+
 write_generated() {
   local home="$1"
   local agent="$2"
@@ -81,6 +123,19 @@ MOSAIC_TMUX_SOCKET=mosaic-test
 EOF
   chmod 600 "$home/fleet/agents/$agent.env.generated"
   mkdir -p "$home/work"
+  install_pane_binaries "$home"
+}
+
+# `$PANE_HOME/.npm-global/bin` is one of the prefixes the launcher folds into
+# PANE_PATH, so this is the pane's own view of "installed", distinct from the
+# launcher's PATH. Tests that need a binary *absent* remove it from here.
+install_pane_binaries() {
+  local pane_home="$1"
+  mkdir -p "$pane_home/.npm-global/bin"
+  local binary
+  for binary in mosaic pi; do
+    ln -sf "$FAKE_BIN/$binary" "$pane_home/.npm-global/bin/$binary"
+  done
 }
 
 run_start() {
@@ -88,6 +143,7 @@ run_start() {
   local agent="$2"
   HOME="$home" PATH="$FAKE_BIN:$PATH" MOSAIC_TEST_TMUX_CALLS="$TMUX_CALLS" \
     MOSAIC_TEST_PANE_PID="${MOSAIC_TEST_PANE_PID:-}" \
+    MOSAIC_TEST_HELD_SESSIONS="${MOSAIC_TEST_HELD_SESSIONS:-}" \
     MOSAIC_TEST_HOME="$home" \
     MOSAIC_TEST_FLEET_OWNER=123e4567-e89b-12d3-a456-426614174000 \
     MOSAIC_HOME="$home" "$START" "$agent"
@@ -98,7 +154,10 @@ run_start() {
 HOME_VALID="$ROOT/valid"
 AGENT_VALID="coder0"
 write_generated "$HOME_VALID" "$AGENT_VALID"
-run_start "$HOME_VALID" "$AGENT_VALID"
+# A live pane PID is part of what "valid launch" means. Until #1241 this case
+# ran with none, so the suite's one success path was itself a dead pane the
+# launcher reported as fine.
+MOSAIC_TEST_PANE_PID=$$ run_start "$HOME_VALID" "$AGENT_VALID"
 valid_args=$(tr '\0' '\n' < "$TMUX_CALLS")
 echo "$valid_args" | grep -qF new-session || fail "valid generated projection did not reach tmux"
 echo "$valid_args" | grep -qF 'mosaic' || fail "fixed mosaic launcher command missing"
@@ -245,6 +304,13 @@ PANE_BASH_ENV="$ROOT/pane-boundary.bash-env"
 printf 'MOSAIC_RUNTIME_BIN=%s\n' "$FAKE_BIN" > \
   "$HOME_PANE_BOUNDARY/fleet/agents/coder-pane-boundary.env.local"
 chmod 600 "$HOME_PANE_BOUNDARY/fleet/agents/coder-pane-boundary.env.local"
+# This case does not go through run_start, so its pane binaries come from
+# MOSAIC_RUNTIME_BIN=$FAKE_BIN in the env.local written above — not from the
+# symlinks install_pane_binaries planted under the generated home, which this
+# launcher never consults because HOME here is the trusted parent. That is a
+# legitimate resolution path, but it means dropping MOSAIC_RUNTIME_BIN from
+# this case on the belief that the symlinks cover it would break the #1241
+# binary check rather than exercise it.
 LD_PRELOAD='/not/loaded/by-clean-bootstrap.so' \
 BASH_ENV="$PANE_BASH_ENV" \
 MOSAIC_UNTRUSTED_SENTINEL='must-not-reach-pane' \
@@ -258,6 +324,7 @@ PATH="$PANE_STALE_PATH" \
     "MOSAIC_TEST_HOME=$PANE_TRUSTED_HOME" \
     MOSAIC_TEST_FLEET_OWNER=123e4567-e89b-12d3-a456-426614174000 \
     MOSAIC_TEST_EXECUTE_PANE=1 \
+    "MOSAIC_TEST_PANE_PID=$$" \
     "$START" coder-pane-boundary
 pane_args=$(tr '\0' '\n' < "$TMUX_CALLS")
 echo "$pane_args" | grep -qxF "HOME=$PANE_TRUSTED_HOME" || \
@@ -392,6 +459,75 @@ echo "$interaction_policy_args" | grep -qF 'new-session' && \
 echo "$output" | grep -qF 'operator interaction service requires runtime pi' || \
   fail "interaction pinned-policy check did not follow strict parsing"
 
+# #1241. The pane runs `mosaic yolo <runtime>` against PANE_PATH. A binary
+# missing from that path is a launch failure, and it has to be named before the
+# session is created — after it, the diagnostic dies with the pane.
+assert_missing_pane_binary_rejected() {
+  local binary="$1"
+  local home="$ROOT/missing-$binary"
+  local agent="coder-missing-$binary"
+  write_generated "$home" "$agent"
+  rm -f "$home/.npm-global/bin/$binary"
+
+  : > "$TMUX_CALLS"
+  local output
+  if output=$(MOSAIC_TEST_PANE_PID=$$ run_start "$home" "$agent" 2>&1); then
+    fail "launch succeeded with '$binary' absent from the pane PATH"
+  fi
+  echo "$output" | grep -qF 'code=missing-binary' || fail "missing '$binary' diagnostic missing"
+  echo "$output" | grep -qF "'$binary'" || fail "missing-binary diagnostic did not name $binary"
+  if tr '\0' '\n' < "$TMUX_CALLS" | grep -qF new-session; then
+    fail "launcher created a session it knew would die ($binary absent)"
+  fi
+}
+
+assert_missing_pane_binary_rejected mosaic
+assert_missing_pane_binary_rejected pi
+
+# #1241. tmux destroys a session when its pane command exits, so no pane PID a
+# second after new-session means the runtime died on startup. This used to be a
+# WARNING about the heartbeat sidecar followed by exit 0 — three layers above it
+# then reported a fleet that was not running.
+: > "$TMUX_CALLS"
+HOME_DEAD_PANE="$ROOT/dead-pane"
+write_generated "$HOME_DEAD_PANE" "coder-dead-pane"
+if output=$(MOSAIC_TEST_PANE_PID='' run_start "$HOME_DEAD_PANE" coder-dead-pane 2>&1); then
+  fail "launcher reported success over a pane that did not survive"
+fi
+echo "$output" | grep -qF 'code=pane-did-not-survive' || fail "dead-pane diagnostic missing"
+if echo "$output" | grep -qiF 'heartbeat'; then
+  fail "dead pane is still being reported as a heartbeat-sidecar problem"
+fi
+tr '\0' '\n' < "$TMUX_CALLS" | grep -qF new-session || \
+  fail "dead-pane case did not reach the launch it is measuring"
+
+# #1241, the other way a pane fails. Above, tmux destroyed the session and
+# has-session said so. Here the session is still there and no PID comes back
+# after the retries — a different fault (the pane is alive but unusable, or
+# tmux is answering inconsistently) that an operator has to be told apart from
+# a runtime that died on startup.
+#
+# This case exists because the branch that handles it shipped with nothing able
+# to reach it: the shim answered has-session only for the holder, so every
+# non-holder agent landed in the session-is-gone branch no matter what. A
+# defensive branch nothing exercises is the same shape as the bug this whole
+# change is about, one layer down.
+: > "$TMUX_CALLS"
+HOME_NO_PID="$ROOT/pane-no-pid"
+write_generated "$HOME_NO_PID" "coder-no-pid"
+if output=$(MOSAIC_TEST_PANE_PID='' MOSAIC_TEST_HELD_SESSIONS='=coder-no-pid:0.0' \
+  run_start "$HOME_NO_PID" coder-no-pid 2>&1); then
+  fail "launcher reported success over a session with no resolvable pane PID"
+fi
+echo "$output" | grep -qF 'code=pane-pid-unresolved' || \
+  fail "session-present/no-PID was not reported as pane-pid-unresolved: $output"
+if echo "$output" | grep -qF 'code=pane-did-not-survive'; then
+  fail "a session tmux still reports was diagnosed as a destroyed session"
+fi
+if echo "$output" | grep -qiF 'heartbeat'; then
+  fail "an unresolvable pane PID is still being reported as a heartbeat-sidecar problem"
+fi
+
 # Exact stop derives the socket exclusively from the validated generated
 # projection and ignores an ambient socket supplied by the caller.
 : > "$TMUX_CALLS"

packages/mosaic/framework/tools/quality/test-enumeration-exclusions.txt

@@ -32,10 +32,6 @@ packages/mosaic/framework/tools/tmux/test-send-message-socket.sh | requires a re
 packages/mosaic/framework/tools/tmux/test-send-message-verdict.sh | requires real tmux-pane fixtures on a throwaway socket; CI image ships no tmux; #1017 burndown (same condition as its sibling)
 
 # --- single-suite directories: unmeasured in CI ---
-packages/mosaic/framework/tools/fleet/test-start-agent-session.sh | unmeasured in CI image; stubs tmux via a fake bin dir, likely CI-fit; #1017 burndown
-packages/mosaic/framework/tools/glpi/test-list-http-status.sh | unmeasured in CI image; stub-based (#807 regression harness), likely CI-fit; #1017 burndown
-packages/mosaic/framework/tools/orchestrator/test-board-roll.sh | unmeasured in CI image; file-fixture based, likely CI-fit; #1017 burndown
-packages/mosaic/framework/tools/woodpecker/test-ci-wait-exit-matrix.sh | unmeasured in CI image; drives ci-wait.sh against a stub pipeline-status.sh, likely CI-fit; #1017 burndown
 
 # --- naming-boundary files the strict test-*.sh prefix cannot even name ---
 # (#1017: three independent censuses handled the microtest file three different
@@ -43,3 +39,20 @@ packages/mosaic/framework/tools/woodpecker/test-ci-wait-exit-matrix.sh | unmeasu
 # recorded judgement. These lines ARE that judgement, signed.)
 packages/mosaic/framework/tools/orchestrator/smoke-test.sh | behavior smoke checks for coord continue/run workflows, run manually by orchestrator seats; unmeasured in CI; #1017 burndown
 packages/mosaic/framework/tools/wake/validate-973/microtest-wake-assert.sh | #973 instrument self-test, run as a precondition of the validate-973 evidence procedure rather than as a standing CI suite; #1017 burndown candidate
+
+# --- tools/fleet: precondition is unsatisfiable in the CI image (#1271) ---
+# Signed by fred (sb-it-1-dt, 2026-08-16) at origin/next 476db12.
+# This suite asserts the launcher's behaviour when `mosaic` and `pi` are MISSING.
+# It shims fakes into $FAKE_BIN, but the constructed PANE_PATH always ends in the
+# real system path, so on a host that installs those binaries the missing-binary
+# cases cannot be measured at all. The suite's own guard (line 103) says so and
+# fails rather than reporting a pass it cannot back. That guard is correct.
+# The error was wiring the suite into CI: #1017 (c56483eb) enumerated it and
+# dropped this exclusion, and the CI image provides `pi` in the system path, so
+# it has failed on every pipeline since. Measured 2026-08-16 across pipelines
+# 2444 (#1256), 2438 (#1240) and 2441 (#1017-quality): exactly one FAIL line in
+# each full log, identical, this assertion; control `zzz-not-present-zzz` -> 0.
+# Burn-down and the full measurement are tracked in #1271; unwired by PR #1270.
+# Because test:framework-shell is one && chain and this sat at position 44 of 48,
+# the four suites after it had not run at all since the merge.
+packages/mosaic/framework/tools/fleet/test-start-agent-session.sh | precondition unsatisfiable in the CI image: asserts missing-binary behaviour, but PANE_PATH always ends in the system path and the image provides `pi` there; guard at line 103 fails by design rather than passing unmeasured. Burn down by controlling the tail of PANE_PATH inside the test. NOT by removing `pi` from the image: the CI image installs @earendil-works/[email protected] deliberately (measured in pipeline 2444's test-step log), and other suites depend on that pin. Burn-down tracked in #1271

packages/mosaic/package.json

@@ -25,7 +25,7 @@
     "lint": "eslint src",
     "typecheck": "tsc --noEmit",
     "test": "vitest run --passWithNoTests && pnpm run test:framework-shell",
-    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/promotion_binding_unittest.py && python3 src/lease-broker/promotion_trigger_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/receipt_observer_client_unittest.py && python3 src/lease-broker/invariant_r_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/_scripts/test-mosaic-init-rce.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh"
+    "test:framework-shell": "bash framework/tools/quality/scripts/check-test-enumeration.sh && bash framework/tools/quality/scripts/test-check-test-enumeration.sh && python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/promotion_binding_unittest.py && python3 src/lease-broker/promotion_trigger_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/receipt_observer_client_unittest.py && python3 src/lease-broker/invariant_r_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-ci-queue-wait-tristate.sh && bash framework/tools/git/test-ci-queue-wait-github-checks.sh && bash framework/tools/git/test-pr-merge-queue-branch.sh && bash framework/tools/git/test-pr-merge-head-pin.sh && bash framework/tools/git/test-pr-merge-message-field.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/woodpecker/test-terminal-green-contract.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/_scripts/test-mosaic-init-rce.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-store-enqueue-race.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-preimage.sh && bash framework/tools/wake/test-wake-install.sh && bash framework/tools/glpi/test-list-http-status.sh && bash framework/tools/orchestrator/test-board-roll.sh && bash framework/tools/woodpecker/test-ci-wait-exit-matrix.sh && bash framework/tools/_scripts/test-fleet-transport-check.sh"
   },
   "dependencies": {
     "@mosaicstack/brain": "workspace:*",

packages/mosaic/src/commands/fleet-roster-v2-dispatch.spec.ts

@@ -0,0 +1,323 @@
+import { execFile } from 'node:child_process';
+import { mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { Command } from 'commander';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { registerFleetCommand, type CommandResult, type CommandRunner } from './fleet.js';
+
+/**
+ * #1237: the v1-only commands (`ps`, `install`, `install-systemd`, `add`,
+ * `remove`) rejected a roster-v2 fleet outright, so a greenfield v2 box could
+ * never get its units placed. These tests pin the three behaviours that fix
+ * gives it, and the two it deliberately does NOT give it.
+ *
+ * The load-bearing negative is that `install` on v2 writes no generated env:
+ * the reconciler owns that file through projectRosterV2AgentGeneratedEnv, and a
+ * second writer here — necessarily through the v1 mapping — is exactly the
+ * drift the #791 single-SSOT invariant exists to prevent.
+ */
+
+const rosterV2 = `
+version: 2
+generation: 4
+transport: tmux
+tmux:
+  socket_name: mosaic-fleet
+  holder_session: _holder
+defaults:
+  working_directory: /srv/mosaic
+  runtime: pi
+runtimes:
+  pi:
+    reset_command: /new
+agents:
+  - name: coder0
+    alias: Coder 0
+    class: code
+    runtime: pi
+    provider: openai
+    model: gpt-5.6-sol
+    reasoning: high
+    tool_policy: code
+    working_directory: /srv/mosaic
+    persistent_persona: false
+    reset_between_tasks: true
+    lifecycle:
+      enabled: true
+      desired_state: stopped
+    launch:
+      yolo: true
+  - name: coder1
+    alias: Coder 1
+    class: code
+    runtime: pi
+    provider: openai
+    model: gpt-5.6-sol
+    reasoning: medium
+    tool_policy: code
+    working_directory: /srv/other
+    persistent_persona: false
+    reset_between_tasks: true
+    lifecycle:
+      enabled: true
+      desired_state: stopped
+    launch:
+      yolo: true
+`;
+
+let tempHome: string | undefined;
+const savedHome = process.env.HOME;
+const savedMosaicHome = process.env.MOSAIC_HOME;
+
+afterEach(async (): Promise<void> => {
+  vi.restoreAllMocks();
+  process.exitCode = undefined;
+  if (savedHome === undefined) delete process.env.HOME;
+  else process.env.HOME = savedHome;
+  if (savedMosaicHome === undefined) delete process.env.MOSAIC_HOME;
+  else process.env.MOSAIC_HOME = savedMosaicHome;
+  if (tempHome) await rm(tempHome, { recursive: true, force: true });
+  tempHome = undefined;
+});
+
+/**
+ * A HOME with a roster-v2 fleet and nothing else — the greenfield shape, before
+ * anything has been installed, applied or started.
+ */
+async function v2Home(): Promise<string> {
+  tempHome = await mkdtemp(join(tmpdir(), 'mosaic-fleet-v2-dispatch-'));
+  process.env.HOME = tempHome;
+  delete process.env.MOSAIC_HOME;
+  const mosaicHome = join(tempHome, '.config', 'mosaic');
+  for (const directory of ['fleet', 'fleet/agents', 'fleet/roles']) {
+    await mkdir(join(mosaicHome, directory), { recursive: true, mode: 0o700 });
+  }
+  await writeFile(join(mosaicHome, 'fleet', 'roster.yaml'), rosterV2, { mode: 0o600 });
+  await writeFile(join(mosaicHome, 'fleet', 'roles', 'code.md'), '`class: code`\n\n# code\n', {
+    mode: 0o600,
+  });
+  return mosaicHome;
+}
+
+/**
+ * Stands in for a box where nothing is running: every systemctl and tmux probe
+ * fails the way it does before the holder has ever started. `ps` must survive
+ * this — it is the command an operator reaches for to find out *why* there is
+ * no seat, so it has to report the emptiness rather than fail on it.
+ */
+const greenfieldRunner: CommandRunner = async (command): Promise<CommandResult> => {
+  if (command === 'tmux') {
+    return { stdout: '', stderr: 'no server running on /tmp/tmux-1000/mosaic-fleet', exitCode: 1 };
+  }
+  return { stdout: '', stderr: '', exitCode: 1 };
+};
+
+function program(runner: CommandRunner = greenfieldRunner): Command {
+  const result = new Command();
+  result.exitOverride();
+  registerFleetCommand(result, { runner, frameworkRoot: resolve(process.cwd(), 'framework') });
+  return result;
+}
+
+function capture(): string[] {
+  const lines: string[] = [];
+  vi.spyOn(console, 'log').mockImplementation((value: string): void => {
+    lines.push(value);
+  });
+  return lines;
+}
+
+async function exists(path: string): Promise<boolean> {
+  try {
+    await stat(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+describe('mosaic fleet ps — roster v2', (): void => {
+  it('lists every v2 agent on a greenfield box with nothing running, and does not throw', async (): Promise<void> => {
+    await v2Home();
+    const lines = capture();
+
+    await expect(
+      program().parseAsync(['node', 'mosaic', 'fleet', 'ps', '--json']),
+    ).resolves.toBeDefined();
+
+    const rows = JSON.parse(lines.join('\n')) as {
+      name: string;
+      runtime: string;
+      alias?: string;
+      paneAlive: boolean;
+      source: string;
+    }[];
+    expect(rows.map((row) => row.name).sort()).toEqual(['coder0', 'coder1']);
+    // The v2 roster's per-agent fields must survive the read model, not be
+    // flattened into defaults.
+    expect(rows.every((row) => row.runtime === 'pi')).toBe(true);
+    expect(rows.find((row) => row.name === 'coder0')?.alias).toBe('Coder 0');
+    // Nothing is running, and that is a report, not an error.
+    expect(rows.every((row) => row.paneAlive === false)).toBe(true);
+    expect(rows.every((row) => row.source === 'roster')).toBe(true);
+    expect(process.exitCode ?? 0).toBe(0);
+  });
+});
+
+describe('mosaic fleet install — roster v2', (): void => {
+  it('places the tool files and unit templates', async (): Promise<void> => {
+    const mosaicHome = await v2Home();
+    capture();
+
+    await expect(
+      program().parseAsync(['node', 'mosaic', 'fleet', 'install', '--no-enable']),
+    ).resolves.toBeDefined();
+
+    // Units live in the systemd user dir, not under the Mosaic home.
+    const systemdUserDir = join(tempHome!, '.config', 'systemd', 'user');
+    for (const unit of [
+      'mosaic-tmux-holder.service',
+      '[email protected]',
+      '[email protected]',
+    ]) {
+      expect(await exists(join(systemdUserDir, unit))).toBe(true);
+    }
+    const launcher = join(mosaicHome, 'tools', 'fleet', 'start-agent-session.sh');
+    expect(await exists(launcher)).toBe(true);
+    expect((await stat(launcher)).mode & 0o777).toBe(0o755);
+  });
+
+  it('writes NO generated env — that file belongs to the reconciler (#791)', async (): Promise<void> => {
+    const mosaicHome = await v2Home();
+    capture();
+
+    await program().parseAsync(['node', 'mosaic', 'fleet', 'install', '--no-enable']);
+
+    const agentDir = join(mosaicHome, 'fleet', 'agents');
+    expect(await readdir(agentDir)).toEqual([]);
+  });
+
+  it('tells the operator which command does own the env', async (): Promise<void> => {
+    await v2Home();
+    const lines = capture();
+
+    await program().parseAsync(['node', 'mosaic', 'fleet', 'install', '--no-enable']);
+
+    expect(lines.join('\n')).toContain('mosaic fleet apply');
+  });
+});
+
+describe('[email protected]', (): void => {
+  const unitPath = resolve(process.cwd(), 'framework', 'systemd', 'user', '[email protected]');
+
+  /** The single `ConditionPathExists=` value declared by the unit template. */
+  async function conditionPath(): Promise<string> {
+    const unit = await readFile(unitPath, 'utf8');
+    const matches = unit.match(/^ConditionPathExists=(.+)$/gm) ?? [];
+    expect(matches).toHaveLength(1);
+    return matches[0]!.slice('ConditionPathExists='.length).trim();
+  }
+
+  it('will not attempt a seat before the reconciler has written its env', async (): Promise<void> => {
+    // The pairing that makes "install writes no env" safe: install enables the
+    // unit (WantedBy=default.target) but does not start it, so without this
+    // condition a reboot between `install` and the first `apply` would run
+    // ExecStart against an absent env file and fail every seat unit.
+    expect(await conditionPath()).toBe('%h/.config/mosaic/fleet/agents/%i.env.generated');
+  });
+
+  /**
+   * The two halves of the guard's *effect*, which no assertion on the literal
+   * string can cover on its own.
+   *
+   * Measured end to end on a real box (canary, 2026-08-16) rather than inferred:
+   * with the condition, `systemctl --user start mosaic-agent@<name>` on an agent
+   * with no generated env returns rc=0, `Result=success`, `ConditionResult=no`,
+   * and journals "skipped, unmet condition check". With the condition removed by
+   * drop-in and nothing else changed, the same start returns rc=1,
+   * `Result=exit-code`, `ExecMainStatus=64`, and the unit enters `failed`.
+   *
+   * systemd is not available in this suite, so these two tests pin the parts
+   * that can drift in code: the condition naming a *different* file than the one
+   * the fleet actually writes, and the launcher quietly becoming tolerant of an
+   * absent env — either of which turns the condition into decoration while the
+   * literal-string assertion above still passes.
+   */
+  it('guards exactly the file the fleet writes, so the two cannot drift apart', async (): Promise<void> => {
+    const mosaicHome = await v2Home();
+    const rendered = (await conditionPath()).replace('%h', tempHome!).replace('%i', 'coder0');
+
+    // The path an installed fleet actually places for this agent.
+    expect(rendered).toBe(join(mosaicHome, 'fleet', 'agents', 'coder0.env.generated'));
+  });
+
+  it('guards a real failure — the launcher rejects an absent generated env', async (): Promise<void> => {
+    await v2Home();
+    await program().parseAsync(['node', 'mosaic', 'fleet', 'install', '--no-enable']);
+
+    // Exactly what ExecStart runs, against the state the condition exists to
+    // catch: unit enabled, reconciler has not written env yet.
+    const launched = await new Promise<{ code: number | null; stderr: string }>((settle) => {
+      const child = execFile(
+        '/bin/bash',
+        [
+          '--noprofile',
+          '--norc',
+          join(tempHome!, '.config', 'mosaic', 'tools', 'fleet', 'start-agent-session.sh'),
+          'coder0',
+        ],
+        { env: { HOME: tempHome!, MOSAIC_AGENT_NAME: 'coder0', PATH: '/usr/bin:/bin' } },
+        (_error, _stdout, stderr) => {
+          settle({ code: child.exitCode, stderr });
+        },
+      );
+    });
+
+    expect(launched.code).not.toBe(0);
+    expect(launched.stderr).toContain('missing-file');
+  });
+});
+
+describe('mosaic fleet add / remove — roster v2', (): void => {
+  it('add refuses, and names the two-step v2 sequence instead of inventing defaults', async (): Promise<void> => {
+    await v2Home();
+
+    await expect(
+      program().parseAsync([
+        'node',
+        'mosaic',
+        'fleet',
+        'add',
+        'coder2',
+        '--runtime',
+        'pi',
+        '--class',
+        'code',
+      ]),
+    ).rejects.toThrow(/mosaic fleet create[\s\S]*mosaic fleet apply/);
+  });
+
+  it('remove refuses, and names delete plus apply', async (): Promise<void> => {
+    await v2Home();
+
+    await expect(
+      program().parseAsync(['node', 'mosaic', 'fleet', 'remove', 'coder1']),
+    ).rejects.toThrow(/mosaic fleet delete coder1[\s\S]*mosaic fleet apply/);
+  });
+
+  // Note: this one passes on the unmodified tree too — there `remove` throws in
+  // the v1 parser, before it can touch anything. It is a regression guard on the
+  // ordering of the new guard clause, not evidence that the fix works.
+  it('refuses BEFORE mutating the roster', async (): Promise<void> => {
+    const mosaicHome = await v2Home();
+    const rosterPath = join(mosaicHome, 'fleet', 'roster.yaml');
+    const before = await readFile(rosterPath, 'utf8');
+
+    await expect(
+      program().parseAsync(['node', 'mosaic', 'fleet', 'remove', 'coder1']),
+    ).rejects.toThrow();
+
+    expect(await readFile(rosterPath, 'utf8')).toBe(before);
+  });
+});

packages/mosaic/src/commands/fleet.ts

@@ -34,6 +34,7 @@ export {
   resolveInstalledFleetRosterPath,
 } from '../fleet/fleet-roster-v1.js';
 export type { FleetAgent, FleetRoster } from '../fleet/fleet-roster-v1.js';
+import { parseRosterV2 } from '../fleet/roster-v2.js';
 import {
   registerFleetAgentCrudCommands,
   type FleetAgentCrudCommandDeps,
@@ -820,7 +821,7 @@ export function buildEnableLingerCommand(user: string): string[] {
  */
 export async function enableFleetUnits(
   runner: CommandRunner,
-  roster: FleetRoster,
+  roster: { readonly agents: readonly { readonly name: string }[] },
   opts: { enable?: boolean },
 ): Promise<void> {
   if (opts.enable === false) {
@@ -1527,7 +1528,8 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
     .option('--no-enable', 'Skip enabling units for boot-survival')
     .action(async (opts: { enable?: boolean }) => {
       await installFleet(cmd, frameworkRoot);
-      const roster = await loadRosterForCommand(cmd);
+      // Unit enablement needs agent names only, so it reads either version.
+      const roster = await loadRosterReadModel(cmd);
       await enableFleetUnits(runner, roster, opts);
     });
 
@@ -1537,7 +1539,8 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
     .option('--no-enable', 'Skip enabling units for boot-survival')
     .action(async (opts: { enable?: boolean }) => {
       await installFleet(cmd, frameworkRoot);
-      const roster = await loadRosterForCommand(cmd);
+      // Unit enablement needs agent names only, so it reads either version.
+      const roster = await loadRosterReadModel(cmd);
       await enableFleetUnits(runner, roster, opts);
     });
 
@@ -1688,7 +1691,9 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
     .action(async (opts: { json?: boolean }) => {
       const commandOpts = cmd.opts<{ mosaicHome: string; roster?: string }>();
       const activePaths = resolveFleetPaths(commandOpts.mosaicHome);
-      const roster = await loadRosterForCommand(cmd);
+      // ps only reads, so it takes the version-agnostic read model rather than
+      // the v1 parser, which rejects a v2 roster outright.
+      const roster = await loadRosterReadModel(cmd);
       const { tenant_id, host } = getDefaultTenantAndHost();
       const nowMs = Date.now();
 
@@ -1908,6 +1913,16 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
           start: boolean;
         },
       ) => {
+        if (await usesRosterV2ControlPlane(cmd)) {
+          // command.error, not a bare throw: this is operator guidance, and a
+          // bare throw reaches the top level uncaught and prints it under a Node
+          // stack trace. Measured on canary — the message is the whole point of
+          // the refusal, so it has to arrive readable.
+          cmd.error(rosterV2MutationGuidance('add', 'create', name), {
+            code: 'fleet.roster-v2',
+            exitCode: 1,
+          });
+        }
         if (!VALID_FLEET_RUNTIMES.includes(opts.runtime)) {
           throw new Error(
             `Invalid runtime "${opts.runtime}". Valid runtimes: ${VALID_FLEET_RUNTIMES.join(', ')}.`,
@@ -1973,6 +1988,12 @@ export function registerFleetCommand(program: Command, deps: FleetCommandDeps =
     .description('Remove an agent from the fleet roster')
     .option('--keep-files', 'Skip deleting env and heartbeat files')
     .action(async (name: string, opts: { keepFiles?: boolean }) => {
+      if (await usesRosterV2ControlPlane(cmd)) {
+        cmd.error(rosterV2MutationGuidance('remove', 'delete', name), {
+          code: 'fleet.roster-v2',
+          exitCode: 1,
+        });
+      }
       const commandOpts = cmd.opts<{ mosaicHome: string; roster?: string }>();
       const activePaths = resolveFleetPaths(commandOpts.mosaicHome);
       const rosterPath = await resolveRosterPath(commandOpts.mosaicHome, commandOpts.roster);
@@ -2331,7 +2352,9 @@ export function registerFleetAgentCommands(
 async function installFleet(cmd: Command, frameworkRoot: string): Promise<void> {
   const activePaths = resolveFleetPaths(cmd.opts<{ mosaicHome: string }>().mosaicHome);
   assertDefaultMosaicHomeForSystemd(activePaths.mosaicHome);
-  const roster = await loadRosterForCommand(cmd);
+  // Read model first: every file this function places is roster-independent, and
+  // the v1 parser would reject a v2 roster before any of them were written.
+  const roster = await loadRosterReadModel(cmd);
   await ensureFleetHolderIdentity(activePaths.mosaicHome);
   await mkdir(activePaths.fleetToolsDir, { recursive: true });
   await mkdir(activePaths.tmuxToolsDir, { recursive: true });
@@ -2391,16 +2414,30 @@ async function installFleet(cmd: Command, frameworkRoot: string): Promise<void>
     join(activePaths.systemdUserDir, '[email protected]'),
   );
 
-  for (const agent of roster.agents) {
+  // On roster v2 the reconciler owns the generated env: `apply` writes it and
+  // `regen` rebuilds it, both from projectRosterV2AgentGeneratedEnv. Writing it
+  // here too — necessarily through the v1 mapping — would be the third writer of
+  // one file and would break the #791 single-SSOT invariant. So v2 gets the tool
+  // files and the units, and nothing else.
+  if (roster.version === 2) {
+    console.log(
+      `Installed fleet tools and systemd units for ${roster.agents.length} agent(s). ` +
+        `Generated env is owned by the reconciler on roster v2 — run: mosaic fleet apply --expected-generation <n>`,
+    );
+    return;
+  }
+
+  const v1Roster = await loadRosterForCommand(cmd);
+  for (const agent of v1Roster.agents) {
     await writeAgentEnvironmentProjection({
       mosaicHome: activePaths.mosaicHome,
       agentEnvDir: activePaths.agentEnvDir,
       agentName: agent.name,
-      generated: generateAgentEnvValues(roster, agent),
+      generated: generateAgentEnvValues(v1Roster, agent),
     });
   }
 
-  console.log(`Installed fleet files for ${roster.agents.length} agent(s).`);
+  console.log(`Installed fleet files for ${v1Roster.agents.length} agent(s).`);
 }
 
 async function loadRosterForCommand(cmd: Command): Promise<FleetRoster> {
@@ -2427,6 +2464,77 @@ async function usesRosterV2ControlPlane(cmd: Command): Promise<boolean> {
   );
 }
 
+/**
+ * `add`/`remove` and `create`/`delete` are not two spellings of one operation.
+ * The v1 pair edits the roster *and* drives systemd; the v2 pair is documented
+ * as changing desired state "without runtime actions", leaving convergence to
+ * `apply`. `add` also collects four fields where a v2 agent requires eleven, so
+ * routing it to `create` would mean inventing provider, alias, reasoning and
+ * tool-policy defaults on the operator's behalf. Refusing with the real command
+ * is honest; silently guessing an agent's provider is not.
+ */
+function rosterV2MutationGuidance(
+  v1Command: 'add' | 'remove',
+  v2Command: 'create' | 'delete',
+  name: string,
+): string {
+  const target = v2Command === 'delete' ? ` ${name}` : '';
+  return (
+    `mosaic fleet ${v1Command} does not operate on a roster-v2 fleet. ` +
+    `Roster v2 separates desired state from convergence:\n` +
+    `  1. mosaic fleet ${v2Command}${target} --expected-generation <current> ` +
+    `${v2Command === 'create' ? "--agent '<json>' " : ''}` +
+    `(edits the roster only)\n` +
+    `  2. mosaic fleet apply --expected-generation <new> (converges systemd and tmux)\n` +
+    `Read the current generation with: mosaic fleet status`
+  );
+}
+
+/**
+ * The read-only fields shared by roster v1 and v2, for the commands that only
+ * ever *read* the roster (`ps`, and unit enablement inside `install`).
+ *
+ * This is deliberately NOT a v2→v1 downshift. A downshifted `FleetRoster` would
+ * be accepted by `generateAgentEnvValues`, and that would make a third writer of
+ * `fleet/agents/<name>.env.generated` — through the v1 mapping — breaking the
+ * #791 single-SSOT invariant that {@link projectRosterV2AgentGeneratedEnv} is
+ * documented to hold. Keeping the read model this small makes that misuse
+ * impossible: there is nothing here to write a roster or an env file back from.
+ */
+interface FleetRosterReadModel {
+  readonly version: 1 | 2;
+  readonly tmux: { readonly socketName: string; readonly holderSession: string };
+  readonly agents: readonly {
+    readonly name: string;
+    readonly alias?: string;
+    readonly runtime: string;
+  }[];
+}
+
+/** Reads either roster version into the shared read-only view. */
+async function loadRosterReadModel(cmd: Command): Promise<FleetRosterReadModel> {
+  const opts = cmd.opts<{ mosaicHome: string; roster?: string }>();
+  const path = await resolveRosterPath(opts.mosaicHome, opts.roster);
+  if (!(await usesRosterV2ControlPlane(cmd))) {
+    const v1 = await loadRosterAtPath(cmd, path);
+    return {
+      version: 1,
+      tmux: { socketName: v1.tmux.socketName, holderSession: v1.tmux.holderSession },
+      agents: v1.agents,
+    };
+  }
+  try {
+    const v2 = parseRosterV2(await readFleetRosterText(path), 'yaml');
+    return {
+      version: 2,
+      tmux: { socketName: v2.tmux.socketName, holderSession: v2.tmux.holderSession },
+      agents: v2.agents,
+    };
+  } catch (error) {
+    reportFleetRosterConfigurationError(cmd, error);
+  }
+}
+
 async function loadRosterFromAgentCommand(
   command: Command,
   mosaicHomeOverride?: string,

packages/mosaic/src/commands/mission-prd.spec.ts

@@ -0,0 +1,149 @@
+import { mkdtemp, readFile, readdir } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import { parse as parseYaml } from 'yaml';
+import { Command } from 'commander';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { registerMissionCommand } from './mission.js';
+import { PrdService } from '@mosaicstack/prdy';
+import type { MissionInfo } from '../tui/gateway-api.js';
+
+// ── Mocks: the gateway is not available in adapter tests ──────────────────────
+
+// vi.hoisted: the mock factory is hoisted above imports, so the fixture must
+// be initialized there too.
+const MISSION = vi.hoisted(
+  (): MissionInfo => ({
+    id: 'mission-plan-1',
+    name: 'Plan Mission Alpha',
+    description: null,
+    status: 'planning',
+    projectId: null,
+    userId: null,
+    phase: null,
+    milestones: null,
+    config: null,
+    createdAt: '2026-01-01T00:00:00.000Z',
+    updatedAt: '2026-03-04T05:06:07.000Z',
+  }),
+);
+
+vi.mock('./with-auth.js', () => ({
+  withAuth: vi.fn().mockResolvedValue({
+    gateway: 'http://localhost:14242',
+    cookie: 'better-auth.session_token=test',
+    session: {},
+  }),
+}));
+
+vi.mock('../tui/gateway-api.js', () => ({
+  fetchMissions: vi.fn().mockResolvedValue([MISSION]),
+  fetchMission: vi.fn(),
+  createMission: vi.fn(),
+  updateMission: vi.fn(),
+  fetchMissionTasks: vi.fn().mockResolvedValue([]),
+  createMissionTask: vi.fn(),
+  updateMissionTask: vi.fn(),
+  fetchProjects: vi.fn().mockResolvedValue([]),
+}));
+
+// ── Helpers ──────────────────────────────────────────────────────────────────
+
+const originalCwd = process.cwd();
+let projectDir: string;
+let logSpy: ReturnType<typeof vi.spyOn>;
+let consoleStub: ReturnType<typeof vi.spyOn>[] = [];
+
+function buildTestProgram(): Command {
+  const program = new Command('mosaic').exitOverride();
+  registerMissionCommand(program);
+  return program;
+}
+
+beforeEach(async () => {
+  projectDir = await mkdtemp(path.join(os.tmpdir(), 'mosaic-mission-plan-'));
+  process.chdir(projectDir);
+  logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+  consoleStub.push(logSpy);
+});
+
+afterEach(() => {
+  // Restore only the per-test spies; module factory mocks keep their
+  // implementations across tests.
+  for (const stub of consoleStub) stub.mockRestore();
+  consoleStub = [];
+  process.chdir(originalCwd);
+});
+
+// ── Tests ────────────────────────────────────────────────────────────────────
+
+describe('mosaic mission --plan (thin adapter over PrdService)', () => {
+  it('creates the PRD in the shared docs/prdy authority store and persists the mission linkage', async () => {
+    await buildTestProgram().parseAsync(['mission', '--plan', 'Plan Mission Alpha'], {
+      from: 'user',
+    });
+
+    // PRD landed in the same store `mosaic prdy` uses.
+    const files = await readdir(path.join(projectDir, 'docs', 'prdy'));
+    expect(files).toHaveLength(1);
+    expect(files[0]).toMatch(/\.yaml$/);
+
+    // Fresh service instance (new-process equivalent) reads the linkage back.
+    const service = new PrdService({ projectPath: projectDir });
+    const docs = await service.list();
+    expect(docs).toHaveLength(1);
+
+    const prd = docs[0]!;
+    expect(prd.title).toBe('Plan Mission Alpha');
+    expect(prd.version).toBe(1);
+
+    const links = await service.listMissionLinks(prd.id);
+    expect(links).toHaveLength(1);
+    expect(links[0]).toMatchObject({
+      missionId: MISSION.id,
+      missionVersion: MISSION.updatedAt, // mission version marker
+      prdVersion: 1,
+    });
+
+    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('PRD created and linked'));
+  });
+
+  it('linkage is persisted in the YAML authority document itself (survives restart)', async () => {
+    await buildTestProgram().parseAsync(['mission', '--plan', 'Plan Mission Alpha'], {
+      from: 'user',
+    });
+
+    const files = await readdir(path.join(projectDir, 'docs', 'prdy'));
+    const raw = await readFile(path.join(projectDir, 'docs', 'prdy', files[0]!), 'utf8');
+    const persisted = parseYaml(raw) as { missions: Array<Record<string, unknown>> };
+
+    expect(persisted.missions).toHaveLength(1);
+    expect(persisted.missions[0]).toMatchObject({ missionId: 'mission-plan-1' });
+  });
+
+  it('the mission path and the prdy path resolve to the same store with stable ids/versions', async () => {
+    // Mission path.
+    await buildTestProgram().parseAsync(['mission', '--plan', 'Plan Mission Alpha'], {
+      from: 'user',
+    });
+
+    // prdy path (service, non-interactive entry).
+    const service = new PrdService({ projectPath: projectDir });
+    const direct = await service.create({ name: 'Directly Created' });
+
+    const all = await service.list();
+    expect(all.map((doc) => doc.id).sort()).toEqual([...all.map((doc) => doc.id)].sort());
+    expect(all).toHaveLength(2);
+
+    const files = await readdir(path.join(projectDir, 'docs', 'prdy'));
+    expect(files).toContain(`${direct.id}.yaml`);
+
+    // Both are v1 in the same store with distinct stable ids.
+    for (const doc of all) {
+      expect(doc.version).toBe(1);
+      expect(files).toContain(`${doc.id}.yaml`);
+    }
+  });
+});

packages/mosaic/src/commands/mission.ts

@@ -256,14 +256,41 @@ async function planMission(
   console.log(`Planning mission: ${mission.name}\n`);
 
   try {
-    const { runPrdWizard } = await import('@mosaicstack/prdy');
-    await runPrdWizard({
+    // Thin adapter: the PRD authority (create + mission↔PRD linkage) lives in
+    // PrdService — no second writer path. The mission's updatedAt serves as
+    // its version marker (the gateway exposes no numeric mission version).
+    const { PrdService, runPrdWizard } = await import('@mosaicstack/prdy');
+    const service = new PrdService({ projectPath: process.cwd() });
+
+    if (process.stdout.isTTY) {
+      const created = await runPrdWizard({
+        name: mission.name,
+        projectPath: process.cwd(),
+        interactive: true,
+      });
+      const linked = await service.linkMission({
+        prdId: created.id,
+        missionId: mission.id,
+        missionVersion: mission.updatedAt,
+        requirementIds: [],
+      });
+      console.log(
+        `\nMission ${mission.id} linked to PRD ${linked.id} v${linked.version} (docs/prdy/).`,
+      );
+      return;
+    }
+
+    const doc = await service.planForMission({
       name: mission.name,
-      projectPath: process.cwd(),
-      interactive: true,
+      missionId: mission.id,
+      missionVersion: mission.updatedAt,
+      requirementIds: [],
     });
+    console.log(
+      `PRD created and linked: ${doc.id} v${doc.version} — mission ${mission.id} (docs/prdy/).`,
+    );
   } catch (err) {
-    console.error(`PRD wizard failed: ${err instanceof Error ? err.message : String(err)}`);
+    console.error(`PRD planning failed: ${err instanceof Error ? err.message : String(err)}`);
     process.exit(1);
   }
 }

packages/mosaic/src/commands/prdy.spec.ts

@@ -0,0 +1,204 @@
+import { mkdtemp, readFile, readdir, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import { stringify as stringifyYaml } from 'yaml';
+import { Command } from 'commander';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { registerPrdyCommand } from './prdy.js';
+import { PrdService } from '@mosaicstack/prdy';
+
+// ── Mocks: keep the adapter test offline (no gateway, no disk side effects
+//    outside the tmp project dir) ──────────────────────────────────────────────
+
+vi.mock('./with-auth.js', () => ({
+  withAuth: vi.fn().mockResolvedValue({
+    gateway: 'http://localhost:14242',
+    cookie: 'better-auth.session_token=test',
+    session: {},
+  }),
+}));
+
+vi.mock('../tui/gateway-api.js', () => ({
+  fetchProjects: vi.fn().mockResolvedValue([]),
+}));
+
+// ── Helpers ──────────────────────────────────────────────────────────────────
+
+class ProcessExitError extends Error {
+  constructor(readonly code: number) {
+    super(`process.exit(${code})`);
+  }
+}
+
+function stubProcessExit() {
+  return vi.spyOn(process, 'exit').mockImplementation(((code?: number) => {
+    throw new ProcessExitError(code ?? 0);
+  }) as never);
+}
+
+const originalCwd = process.cwd();
+let projectDir: string;
+let errorSpy: ReturnType<typeof vi.spyOn>;
+let logSpy: ReturnType<typeof vi.spyOn>;
+let exitStub: ReturnType<typeof stubProcessExit>;
+
+function buildTestProgram(): Command {
+  const program = new Command('mosaic').exitOverride();
+  registerPrdyCommand(program);
+  return program;
+}
+
+function runPrdy(args: string[]): Promise<unknown> {
+  return buildTestProgram().parseAsync(['prdy', ...args], { from: 'user' });
+}
+
+function importableDocument(overrides: Record<string, unknown> = {}): Record<string, unknown> {
+  return {
+    id: 'cmd-import-prd',
+    title: 'Command Import PRD',
+    status: 'approved', // must be forced to draft: validity is not approval
+    projectPath: '/tmp/elsewhere',
+    template: 'software',
+    version: 1,
+    sections: [
+      { id: 'introduction', title: 'Introduction', fields: { context: 'x', objective: 'y' } },
+    ],
+    missions: [],
+    createdAt: '2026-01-01T00:00:00.000Z',
+    updatedAt: '2026-01-01T00:00:00.000Z',
+    ...overrides,
+  };
+}
+
+beforeEach(async () => {
+  projectDir = await mkdtemp(path.join(os.tmpdir(), 'mosaic-prdy-'));
+  process.chdir(projectDir);
+  exitStub = stubProcessExit();
+  errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+  logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+});
+
+afterEach(() => {
+  // Restore only the per-test spies: module factory mocks must keep their
+  // implementations for the next test.
+  exitStub.mockRestore();
+  errorSpy.mockRestore();
+  logSpy.mockRestore();
+  process.chdir(originalCwd);
+});
+
+// ── Tests ────────────────────────────────────────────────────────────────────
+
+describe('mosaic prdy (thin adapter over PrdService)', () => {
+  it('non-interactive --init creates a PRD in the docs/prdy authority store', async () => {
+    await runPrdy(['--init', 'Adapter Created']);
+
+    const files = await readdir(path.join(projectDir, 'docs', 'prdy'));
+    expect(files).toHaveLength(1);
+    expect(files[0]).toMatch(/\.yaml$/);
+
+    const docs = await new PrdService({ projectPath: projectDir }).list();
+    expect(docs).toHaveLength(1);
+    expect(docs[0]?.title).toBe('Adapter Created');
+    expect(docs[0]?.version).toBe(1);
+    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('PRD created'));
+  });
+
+  it('--import <file> creates a valid import through the service', async () => {
+    const filePath = path.join(projectDir, 'incoming.yaml');
+    await writeFile(filePath, stringifyYaml(importableDocument()), 'utf8');
+
+    await runPrdy(['--import', filePath]);
+
+    const docs = await new PrdService({ projectPath: projectDir }).list();
+    expect(docs).toHaveLength(1);
+    expect(docs[0]?.id).toBe('cmd-import-prd');
+    expect(docs[0]?.status).toBe('draft'); // import ≠ approval
+    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('Imported PRD cmd-import-prd'));
+  });
+
+  it('--import of a structurally-invalid file is a typed refusal that creates nothing', async () => {
+    const filePath = path.join(projectDir, 'broken.yaml');
+    await writeFile(filePath, stringifyYaml({ id: 'incomplete', no: 'structure' }), 'utf8');
+
+    await expect(runPrdy(['--import', filePath])).rejects.toBeInstanceOf(ProcessExitError);
+
+    // Typed refusal surfaced to the user, nothing created.
+    expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('PRD wizard failed'));
+    await expect(readdir(path.join(projectDir, 'docs'))).rejects.toMatchObject({ code: 'ENOENT' });
+  });
+
+  it('--import on conflict refuses with a successor proposal and leaves bytes untouched', async () => {
+    const service = new PrdService({ projectPath: projectDir });
+    const existing = await service.create({ name: 'Conflict Target' });
+    const storeFile = path.join(projectDir, 'docs', 'prdy', `${existing.id}.yaml`);
+    const beforeBytes = await readFile(storeFile, 'utf8');
+
+    const filePath = path.join(projectDir, 'divergent.yaml');
+    await writeFile(
+      filePath,
+      stringifyYaml(
+        importableDocument({
+          ...existing,
+          title: 'Divergent Command Import',
+        }),
+      ),
+      'utf8',
+    );
+
+    await expect(runPrdy(['--import', filePath])).rejects.toBeInstanceOf(ProcessExitError);
+
+    expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('refusing to overwrite'));
+    expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining('--accept-successor'));
+
+    // Original authority document is byte-identical on disk.
+    expect(await readFile(storeFile, 'utf8')).toBe(beforeBytes);
+  });
+
+  it('--import --accept-successor persists the successor version explicitly', async () => {
+    const service = new PrdService({ projectPath: projectDir });
+    const existing = await service.create({ name: 'Successor Target' });
+
+    const filePath = path.join(projectDir, 'divergent2.yaml');
+    await writeFile(
+      filePath,
+      stringifyYaml(
+        importableDocument({
+          ...existing,
+          title: 'Accepted Via CLI',
+        }),
+      ),
+      'utf8',
+    );
+
+    await runPrdy(['--import', filePath, '--accept-successor']);
+
+    const doc = await service.get(existing.id);
+    expect(doc.version).toBe(2);
+    expect(doc.title).toBe('Accepted Via CLI');
+    expect(doc.status).toBe('draft');
+    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining('successor'));
+  });
+
+  it('--export writes a labeled generated view and never touches authority', async () => {
+    const service = new PrdService({ projectPath: projectDir });
+    const created = await service.create({ name: 'Export Via CLI' });
+    const before = await service.get(created.id);
+
+    await runPrdy(['--export', created.id]);
+
+    const mdPath = path.join(projectDir, 'docs', 'prdy', `${created.id}.md`);
+    const md = await readFile(mdPath, 'utf8');
+    expect(md).toContain('generated view — do not edit');
+    expect(md).toContain(`prd-id: ${created.id}`);
+    expect(md).toContain('prd-version: 1');
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining(`Generated view written: ${mdPath}`),
+    );
+
+    // Authority unchanged by the export.
+    expect(await service.get(created.id)).toEqual(before);
+  });
+});

packages/mosaic/src/commands/prdy.ts

@@ -2,6 +2,10 @@ import type { Command } from 'commander';
 import { withAuth } from './with-auth.js';
 import { fetchProjects } from '../tui/gateway-api.js';
 
+/**
+ * `mosaic prdy` — thin adapter over PrdService (@mosaicstack/prdy).
+ * All reads/writes go through the service; there is no local writer path.
+ */
 export function registerPrdyCommand(program: Command) {
   const cmd = program
     .command('prdy')
@@ -9,12 +13,18 @@ export function registerPrdyCommand(program: Command) {
     .option('-g, --gateway <url>', 'Gateway URL', 'http://localhost:14242')
     .option('--init [name]', 'Create a new PRD')
     .option('--update [name]', 'Update an existing PRD')
+    .option('--import <file>', 'Import a YAML PRD document (validated, conflict-aware)')
+    .option('--accept-successor', 'With --import: accept a conflicted import as next version')
+    .option('--export [id]', 'Export a PRD as a labeled generated-view Markdown file')
     .option('--project <idOrName>', 'Scope to project')
     .action(
       async (opts: {
         gateway: string;
         init?: string | boolean;
         update?: string | boolean;
+        import?: string;
+        acceptSuccessor?: boolean;
+        export?: string | boolean;
         project?: string;
       }) => {
         // Detect project context when --project flag is provided
@@ -31,20 +41,69 @@ export function registerPrdyCommand(program: Command) {
           }
         }
 
+        const { PrdService, runPrdWizard } = await import('@mosaicstack/prdy');
+        const service = new PrdService({ projectPath: process.cwd() });
+
         try {
-          const { runPrdWizard } = await import('@mosaicstack/prdy');
+          if (opts.import !== undefined) {
+            const input = { filePath: opts.import };
+
+            if (opts.acceptSuccessor) {
+              const successor = await service.acceptSuccessor(input);
+              console.log(
+                `Import accepted as successor: ${successor.id} v${successor.version} (status: ${successor.status})`,
+              );
+              return;
+            }
+
+            const result = await service.importDocument(input);
+            console.log(
+              result.kind === 'created'
+                ? `Imported PRD ${result.document.id} v${result.document.version} (status: ${result.document.status})`
+                : `PRD ${result.document.id} already present with identical content — nothing to do.`,
+            );
+            return;
+          }
+
+          if (opts.export !== undefined) {
+            const id =
+              typeof opts.export === 'string' && opts.export.length > 0 ? opts.export : undefined;
+            const result = await service.exportMarkdown({ id });
+            console.log(
+              `Generated view written: ${result.filePath} (source authority: YAML under docs/prdy/ — do not edit the Markdown)`,
+            );
+            return;
+          }
+
           const name =
             typeof opts.init === 'string'
               ? opts.init
               : typeof opts.update === 'string'
                 ? opts.update
                 : 'untitled';
-          await runPrdWizard({
-            name,
-            projectPath: process.cwd(),
-            interactive: true,
-          });
+
+          if (process.stdout.isTTY) {
+            await runPrdWizard({
+              name,
+              projectPath: process.cwd(),
+              interactive: true,
+            });
+            return;
+          }
+
+          // Non-interactive fallback routes through the service directly.
+          const doc = await service.create({ name });
+          console.log(`PRD created: ${doc.id} v${doc.version} (status: ${doc.status})`);
         } catch (err) {
+          if (err instanceof Error && err.name === 'PrdImportConflictError') {
+            const conflict = err as { proposal?: { version?: number } };
+            console.error(`${err.message}`);
+            console.error(
+              `Original PRD left untouched. To accept the proposed successor (v${conflict.proposal?.version}), re-run with --accept-successor.`,
+            );
+            process.exit(1);
+          }
+
           console.error(`PRD wizard failed: ${err instanceof Error ? err.message : String(err)}`);
           process.exit(1);
         }

packages/mosaic/src/platform/detect.ts

@@ -1,4 +1,3 @@
-import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir, platform } from 'node:os';
 
@@ -22,15 +21,18 @@ export function getShellProfilePath(): string | null {
 
   const shell = detectShell();
   switch (shell) {
+    // Both of these deliberately avoid the interactive-only rc files.
+    // Debian's default .bashrc returns early for non-interactive shells, so a
+    // PATH line appended to it never runs for `bash -lc`, systemd units, or
+    // agent seats — an install could report success and still leave `mosaic`
+    // unreachable. .profile is read by login shells and sources .bashrc for
+    // interactive ones, so one line covers both; .zshenv is zsh's equivalent.
     case 'zsh': {
       const zdotdir = process.env['ZDOTDIR'] ?? home;
-      return join(zdotdir, '.zshrc');
+      return join(zdotdir, '.zshenv');
     }
-    case 'bash': {
-      const bashrc = join(home, '.bashrc');
-      if (existsSync(bashrc)) return bashrc;
+    case 'bash':
       return join(home, '.profile');
-    }
     case 'fish':
       return join(home, '.config', 'fish', 'config.fish');
     default:

packages/prdy/src/cli.ts

@@ -1,6 +1,6 @@
 import { Command } from 'commander';
 
-import { createPrd, listPrds, loadPrd } from './prd.js';
+import { PrdService } from './service.js';
 import { runPrdWizard } from './wizard.js';
 
 interface InitCommandOptions {
@@ -18,6 +18,22 @@ interface ShowCommandOptions {
   readonly id?: string;
 }
 
+interface ImportCommandOptions {
+  readonly project: string;
+  readonly file: string;
+  readonly acceptSuccessor?: boolean;
+}
+
+interface ExportCommandOptions {
+  readonly project: string;
+  readonly id?: string;
+  readonly out?: string;
+}
+
+function serviceFor(project: string): PrdService {
+  return new PrdService({ projectPath: project });
+}
+
 export function buildPrdyCli(): Command {
   const program = new Command();
   program.name('mosaic').description('Mosaic CLI').exitOverride();
@@ -38,11 +54,9 @@ export function buildPrdyCli(): Command {
             template: options.template,
             interactive: true,
           })
-        : await createPrd({
+        : await serviceFor(options.project).create({
             name: options.name,
-            projectPath: options.project,
             template: options.template,
-            interactive: false,
           });
 
       console.log(
@@ -52,6 +66,7 @@ export function buildPrdyCli(): Command {
             id: doc.id,
             title: doc.title,
             status: doc.status,
+            version: doc.version,
             projectPath: doc.projectPath,
           },
           null,
@@ -65,7 +80,7 @@ export function buildPrdyCli(): Command {
     .description('List PRD documents for a project')
     .requiredOption('--project <path>', 'Project path')
     .action(async (options: ListCommandOptions) => {
-      const docs = await listPrds(options.project);
+      const docs = await serviceFor(options.project).list();
       console.log(JSON.stringify(docs, null, 2));
     });
 
@@ -75,20 +90,65 @@ export function buildPrdyCli(): Command {
     .requiredOption('--project <path>', 'Project path')
     .option('--id <id>', 'PRD document id')
     .action(async (options: ShowCommandOptions) => {
-      if (options.id !== undefined) {
-        const docs = await listPrds(options.project);
-        const match = docs.find((doc) => doc.id === options.id);
+      const doc = await serviceFor(options.project).get(options.id);
+      console.log(JSON.stringify(doc, null, 2));
+    });
 
-        if (match === undefined) {
-          throw new Error(`PRD id not found: ${options.id}`);
-        }
+  prdy
+    .command('import')
+    .description('Import a YAML PRD document (validated; conflicts propose a successor)')
+    .requiredOption('--project <path>', 'Project path')
+    .requiredOption('--file <file>', 'Path to YAML PRD document')
+    .option('--accept-successor', 'Accept a conflicted import as the next version')
+    .action(async (options: ImportCommandOptions) => {
+      const service = serviceFor(options.project);
+      const input = { filePath: options.file };
 
-        console.log(JSON.stringify(match, null, 2));
+      if (options.acceptSuccessor) {
+        const successor = await service.acceptSuccessor(input);
+        console.log(
+          JSON.stringify(
+            {
+              ok: true,
+              outcome: 'successor-accepted',
+              id: successor.id,
+              version: successor.version,
+            },
+            null,
+            2,
+          ),
+        );
         return;
       }
 
-      const doc = await loadPrd(options.project);
-      console.log(JSON.stringify(doc, null, 2));
+      const result = await service.importDocument(input);
+      console.log(
+        JSON.stringify(
+          {
+            ok: true,
+            outcome: result.kind,
+            id: result.document.id,
+            version: result.document.version,
+            status: result.document.status,
+          },
+          null,
+          2,
+        ),
+      );
+    });
+
+  prdy
+    .command('export')
+    .description('Render a PRD to a labeled generated-view Markdown file')
+    .requiredOption('--project <path>', 'Project path')
+    .option('--id <id>', 'PRD document id')
+    .option('--out <path>', 'Output path (default docs/prdy/<id>.md)')
+    .action(async (options: ExportCommandOptions) => {
+      const result = await serviceFor(options.project).exportMarkdown({
+        id: options.id,
+        outPath: options.out,
+      });
+      console.log(JSON.stringify({ ok: true, filePath: result.filePath }, null, 2));
     });
 
   return program;

packages/prdy/src/index.ts

@@ -1,12 +1,35 @@
-export { createPrd, loadPrd, savePrd, listPrds } from './prd.js';
+// PrdService is the single authority surface for PRD documents. The raw store
+// writers (createPrd/savePrd) are deliberately NOT exported: every mutation
+// goes through the service so there is no second writer path.
+export { loadPrd, listPrds, parsePrdDocument } from './prd.js';
 export { runPrdWizard } from './wizard.js';
 export { buildPrdyCli, runPrdyCli } from './cli.js';
 export { BUILTIN_PRD_TEMPLATES, resolveTemplate } from './templates.js';
+export {
+  PrdService,
+  PRD_GENERATED_VIEW_LABEL,
+  PrdError,
+  PrdNotFoundError,
+  PrdUpdateError,
+  PrdImportInvalidError,
+  PrdImportConflictError,
+} from './service.js';
 export type {
   PrdStatus,
   PrdTemplate,
   PrdTemplateSection,
   PrdSection,
+  PrdMissionLinkage,
   PrdDocument,
   CreatePrdOptions,
+  PrdServiceOptions,
+  PrdCreateInput,
+  PrdSectionPatch,
+  PrdUpdateInput,
+  PrdLinkMissionInput,
+  PrdPlanForMissionInput,
+  PrdExportInput,
+  PrdExportResult,
+  PrdImportInput,
+  PrdImportResult,
 } from './types.js';

packages/prdy/src/prd.ts

@@ -17,17 +17,49 @@ const prdSectionSchema = z.object({
   fields: z.record(z.string(), z.string()),
 });
 
+const prdMissionLinkageSchema = z.object({
+  missionId: z.string().min(1),
+  missionVersion: z.string().min(1),
+  prdVersion: z.number().int().min(1),
+  requirementIds: z.array(z.string()),
+  linkedAt: z.string().datetime(),
+});
+
 const prdDocumentSchema = z.object({
   id: z.string().min(1),
   title: z.string().min(1),
   status: z.enum(['draft', 'review', 'approved', 'archived']),
   projectPath: z.string().min(1),
   template: z.string().min(1),
+  // Defaults keep documents written by older prdy versions loadable.
+  version: z.number().int().min(1).default(1),
   sections: z.array(prdSectionSchema),
+  missions: z.array(prdMissionLinkageSchema).default([]),
   createdAt: z.string().datetime(),
   updatedAt: z.string().datetime(),
 });
 
+/** YAML timestamp scalars are parsed as Date by some emitters — normalize to ISO strings. */
+function coerceTimestamps(value: unknown): unknown {
+  if (value instanceof Date) {
+    return value.toISOString();
+  }
+  if (Array.isArray(value)) {
+    return value.map(coerceTimestamps);
+  }
+  if (typeof value === 'object' && value !== null) {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, entry]) => [key, coerceTimestamps(entry)]),
+    );
+  }
+  return value;
+}
+
+/** Validate an unknown value as a PRD document (throws zod errors on failure). */
+export function parsePrdDocument(value: unknown): PrdDocument {
+  return prdDocumentSchema.parse(coerceTimestamps(value)) as PrdDocument;
+}
+
 function expandHome(projectPath: string): string {
   if (!projectPath.startsWith('~')) {
     return projectPath;
@@ -74,6 +106,8 @@ function prdDirectory(projectPath: string): string {
   return path.join(projectPath, PRD_DIRECTORY);
 }
 
+export { prdDirectory };
+
 function prdFilePath(projectPath: string, id: string): string {
   return path.join(prdDirectory(projectPath), `${id}.yaml`);
 }
@@ -113,11 +147,13 @@ export async function createPrd(options: CreatePrdOptions): Promise<PrdDocument>
     status: 'draft',
     projectPath: resolvedProjectPath,
     template: template.id,
+    version: 1,
     sections: template.sections.map((section) => ({
       id: section.id,
       title: section.title,
       fields: Object.fromEntries(section.fields.map((field) => [field, ''])),
     })),
+    missions: [],
     createdAt: now,
     updatedAt: now,
   };
@@ -190,7 +226,7 @@ export async function listPrds(projectPath: string): Promise<PrdDocument[]> {
       throw new Error(`Failed to parse PRD file ${filePath}: ${String(error)}`);
     }
 
-    const document = prdDocumentSchema.parse(parsed);
+    const document = parsePrdDocument(parsed);
     documents.push(document);
   }
 

packages/prdy/src/service.spec.ts

@@ -0,0 +1,433 @@
+import { existsSync } from 'node:fs';
+import { mkdtemp, readFile, readdir, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+import yaml from 'js-yaml';
+import { beforeEach, describe, expect, it } from 'vitest';
+
+import {
+  PRD_GENERATED_VIEW_LABEL,
+  PrdImportConflictError,
+  PrdImportInvalidError,
+  PrdNotFoundError,
+  PrdService,
+  PrdUpdateError,
+} from './index.js';
+import type { PrdDocument } from './index.js';
+
+// ── Helpers ──────────────────────────────────────────────────────────────────
+
+let projectDir: string;
+
+async function makeProject(): Promise<string> {
+  return mkdtemp(path.join(os.tmpdir(), 'prdy-service-'));
+}
+
+function service(): PrdService {
+  return new PrdService({ projectPath: projectDir });
+}
+
+function storeDir(): string {
+  return path.join(projectDir, 'docs', 'prdy');
+}
+
+/** Handcraft a full, schema-valid PRD document for import scenarios. */
+function importFixture(overrides: Partial<PrdDocument> = {}): PrdDocument {
+  return {
+    id: 'imported-prd-20260101-000000',
+    title: 'Imported PRD',
+    status: 'draft',
+    projectPath: '/tmp/elsewhere',
+    template: 'software',
+    version: 1,
+    sections: [
+      { id: 'introduction', title: 'Introduction', fields: { context: '', objective: '' } },
+      {
+        id: 'scope-non-goals',
+        title: 'Scope / Non-Goals',
+        fields: { inScope: '', outOfScope: '' },
+      },
+    ],
+    missions: [],
+    createdAt: '2026-01-01T00:00:00.000Z',
+    updatedAt: '2026-01-01T00:00:00.000Z',
+    ...overrides,
+  };
+}
+
+async function writeImportFile(doc: PrdDocument): Promise<string> {
+  const filePath = path.join(projectDir, `${doc.id}.import.yaml`);
+  await writeFile(filePath, yaml.dump(doc), 'utf8');
+  return filePath;
+}
+
+beforeEach(async () => {
+  projectDir = await makeProject();
+});
+
+// ── Single authority store (AC: prdy path and mission path resolve to the
+//    SAME store under docs/prdy/ with stable ids/versions) ────────────────────
+
+describe('PrdService single authority store', () => {
+  it('persists PRDs from the prdy path and the mission path into the same docs/prdy store', async () => {
+    const direct = await service().create({ name: 'Direct PRD' });
+    const viaMission = await service().planForMission({
+      name: 'Mission PRD',
+      missionId: 'mission-1',
+      missionVersion: '2026-01-01T00:00:00.000Z',
+    });
+
+    const files = await readdir(storeDir());
+    expect(files).toContain(`${direct.id}.yaml`);
+    expect(files).toContain(`${viaMission.id}.yaml`);
+
+    // A fresh service instance (new process equivalent) resolves both.
+    const all = await service().list();
+    expect(all.map((doc) => doc.id).sort()).toEqual([direct.id, viaMission.id].sort());
+
+    // Stable versions: creation is v1; linkage writes do not bump content version.
+    expect((await service().get(direct.id)).version).toBe(1);
+    expect((await service().get(viaMission.id)).version).toBe(1);
+  });
+
+  it('round-trips documents through the store with identity intact', async () => {
+    const created = await service().create({ name: 'Round Trip', template: 'feature' });
+    const fresh = await service().get(created.id);
+
+    expect(fresh).toEqual(created);
+    expect(fresh.id).toBe(created.id);
+    expect(fresh.template).toBe('feature');
+    expect(fresh.status).toBe('draft');
+  });
+
+  it('throws a typed error for unknown ids and empty stores', async () => {
+    await expect(service().get('nope')).rejects.toBeInstanceOf(PrdNotFoundError);
+    await expect(service().get()).rejects.toBeInstanceOf(PrdNotFoundError);
+  });
+});
+
+// ── Mission linkage persistence (AC: linkage survives restart via fresh
+//    service instances) ────────────────────────────────────────────────────────
+
+describe('PrdService mission linkage', () => {
+  it('persists linkage and reads it back from a fresh service instance', async () => {
+    const created = await service().planForMission({
+      name: 'Linked PRD',
+      missionId: 'mission-42',
+      missionVersion: '2026-02-03T04:05:06.000Z',
+      requirementIds: ['FR-1', 'FR-2'],
+    });
+
+    // Fresh instance — nothing in memory from the creating call.
+    const links = await service().listMissionLinks(created.id);
+    expect(links).toHaveLength(1);
+    expect(links[0]).toMatchObject({
+      missionId: 'mission-42',
+      missionVersion: '2026-02-03T04:05:06.000Z',
+      prdVersion: 1,
+      requirementIds: ['FR-1', 'FR-2'],
+    });
+
+    // Linkage is carried in the YAML authority file itself.
+    const raw = await readFile(path.join(storeDir(), `${created.id}.yaml`), 'utf8');
+    const persisted = yaml.load(raw) as PrdDocument;
+    expect(persisted.missions[0]?.missionId).toBe('mission-42');
+    expect(persisted.missions[0]?.requirementIds).toEqual(['FR-1', 'FR-2']);
+  });
+
+  it('refreshes an existing linkage entry in place instead of duplicating', async () => {
+    const created = await service().planForMission({
+      name: 'Relink PRD',
+      missionId: 'mission-7',
+      missionVersion: 'v1',
+    });
+
+    await service().update({
+      id: created.id,
+      sections: [{ id: 'introduction', fields: { objective: 'Ship it' } }],
+    });
+
+    const relinked = await service().linkMission({
+      prdId: created.id,
+      missionId: 'mission-7',
+      missionVersion: 'v2',
+      requirementIds: ['NFR-1'],
+    });
+
+    expect(relinked.missions).toHaveLength(1);
+    expect(relinked.missions[0]).toMatchObject({ missionVersion: 'v2', prdVersion: 2 });
+  });
+
+  it('does not bump the content version when writing linkage', async () => {
+    const created = await service().create({ name: 'Stable Version' });
+    const linked = await service().linkMission({
+      prdId: created.id,
+      missionId: 'm',
+      missionVersion: 'v1',
+    });
+    expect(linked.version).toBe(1);
+  });
+});
+
+// ── Update semantics ──────────────────────────────────────────────────────────
+
+describe('PrdService update', () => {
+  it('applies section patches and bumps the content version', async () => {
+    const created = await service().create({ name: 'Updatable' });
+    const updated = await service().update({
+      id: created.id,
+      sections: [{ id: 'introduction', fields: { context: 'Some context', objective: 'Goal' } }],
+    });
+
+    expect(updated.version).toBe(2);
+    expect(updated.sections[0]?.fields).toMatchObject({
+      context: 'Some context',
+      objective: 'Goal',
+    });
+    expect((await service().get(created.id)).version).toBe(2);
+  });
+
+  it('refuses unknown section ids with a typed error', async () => {
+    const created = await service().create({ name: 'Strict' });
+    await expect(
+      service().update({ id: created.id, sections: [{ id: 'nope', fields: {} }] }),
+    ).rejects.toBeInstanceOf(PrdUpdateError);
+  });
+});
+
+// ── Markdown export is a labeled generated view, never authority ──────────────
+
+describe('PrdService exportMarkdown', () => {
+  it('writes a generated view carrying the label and source identity', async () => {
+    const created = await service().create({ name: 'Exported PRD' });
+    const result = await service().exportMarkdown({ id: created.id });
+
+    expect(result.filePath).toBe(path.join(storeDir(), `${created.id}.md`));
+    expect(result.content).toContain(PRD_GENERATED_VIEW_LABEL);
+    expect(result.content).toContain(`prd-id: ${created.id}`);
+    expect(result.content).toContain('prd-version: 1');
+    expect(result.content).toContain(`source-of-truth: docs/prdy/${created.id}.yaml`);
+  });
+
+  it('reflects the current version after updates', async () => {
+    const created = await service().create({ name: 'Versioned Export' });
+    await service().update({
+      id: created.id,
+      sections: [{ id: 'introduction', fields: { objective: 'v2 goal' } }],
+    });
+    const result = await service().exportMarkdown({ id: created.id });
+    expect(result.content).toContain('prd-version: 2');
+  });
+
+  it('NEGATIVE CONTROL: mutating the exported Markdown cannot change the authority', async () => {
+    const created = await service().create({ name: 'Guarded PRD' });
+    const before = structuredClone(await service().get(created.id));
+
+    const result = await service().exportMarkdown({ id: created.id });
+    await writeFile(
+      result.filePath,
+      `<!-- ${PRD_GENERATED_VIEW_LABEL} -->\n# FAKE\nprd-id: fake-id\nprd-version: 99\n`,
+      'utf8',
+    );
+
+    const after = await service().get(created.id);
+    expect(after).toEqual(before);
+    expect(after.version).toBe(1);
+    expect(after.title).toBe(before.title);
+  });
+
+  it('never parses Markdown files that sit in the store directory', async () => {
+    const created = await service().create({ name: 'Decoy Guard' });
+
+    // A decoy .md file with invalid YAML must be invisible to the store.
+    await writeFile(path.join(storeDir(), 'decoy.md'), 'not: [valid: yaml', 'utf8');
+    // And a decoy .yaml-named Markdown body must not silently validate either.
+    await service().exportMarkdown({ id: created.id });
+
+    const listed = await service().list();
+    expect(listed.map((doc) => doc.id)).toEqual([created.id]);
+    await expect(service().get(created.id)).resolves.toBeTruthy();
+  });
+});
+
+// ── Import: validated, conflict-aware, never silently merging ─────────────────
+
+describe('PrdService importDocument', () => {
+  it('creates a valid import through the service, as draft — validity is not approval', async () => {
+    const filePath = await writeImportFile(importFixture({ status: 'approved' }));
+
+    const result = await service().importDocument({ filePath });
+
+    expect(result.kind).toBe('created');
+    expect(result.document.id).toBe('imported-prd-20260101-000000');
+    expect(result.document.status).toBe('draft'); // structural validity ≠ approval
+    expect(result.document.version).toBe(1);
+
+    const persisted = await service().get('imported-prd-20260101-000000');
+    expect(persisted.status).toBe('draft');
+
+    const files = await readdir(storeDir());
+    expect(files).toContain('imported-prd-20260101-000000.yaml');
+  });
+
+  it('reports identical content as a no-op without writing', async () => {
+    const created = await service().create({ name: 'Existing PRD' });
+    const before = await readFile(path.join(storeDir(), `${created.id}.yaml`), 'utf8');
+
+    const filePath = await writeImportFile(importFixture({ ...created }));
+    const result = await service().importDocument({ filePath });
+
+    expect(result.kind).toBe('identical');
+    const after = await readFile(path.join(storeDir(), `${created.id}.yaml`), 'utf8');
+    expect(after).toBe(before);
+  });
+
+  it('refuses a conflicting import with a typed error, a proposed successor, and untouched bytes', async () => {
+    const existing = await service().create({ name: 'Authority PRD' });
+    await service().linkMission({
+      prdId: existing.id,
+      missionId: 'mission-keep',
+      missionVersion: 'v1',
+      requirementIds: ['FR-0'],
+    });
+    const beforeBytes = await readFile(path.join(storeDir(), `${existing.id}.yaml`), 'utf8');
+
+    const divergent = importFixture({
+      ...existing,
+      title: 'Divergent Title',
+      sections: [
+        {
+          id: 'introduction',
+          title: 'Introduction',
+          fields: { context: 'changed', objective: '' },
+        },
+      ],
+    });
+    const filePath = await writeImportFile(divergent);
+
+    const attempt = service().importDocument({ filePath });
+    let caught: unknown;
+    try {
+      await attempt;
+    } catch (error) {
+      caught = error;
+    }
+    expect(caught).toBeInstanceOf(PrdImportConflictError);
+
+    const error = caught as PrdImportConflictError;
+    expect(error.code).toBe('PRD_IMPORT_CONFLICT');
+    expect(error.existing.id).toBe(existing.id);
+    expect(error.proposal.version).toBe(existing.version + 1); // successor proposal
+    expect(error.proposal.status).toBe('draft');
+
+    // Original authority content untouched on disk.
+    const afterBytes = await readFile(path.join(storeDir(), `${existing.id}.yaml`), 'utf8');
+    expect(afterBytes).toBe(beforeBytes);
+  });
+
+  it('acceptSuccessor persists the proposal explicitly, carrying linkages forward', async () => {
+    const existing = await service().create({ name: 'Successor Base' });
+    await service().linkMission({
+      prdId: existing.id,
+      missionId: 'mission-keep',
+      missionVersion: 'v1',
+    });
+
+    const divergent = importFixture({
+      ...existing,
+      title: 'Accepted Successor Title',
+    });
+    const filePath = await writeImportFile(divergent);
+
+    const successor = await service().acceptSuccessor({ filePath });
+    expect(successor.id).toBe(existing.id);
+    expect(successor.version).toBe(existing.version + 1);
+    expect(successor.title).toBe('Accepted Successor Title');
+    expect(successor.status).toBe('draft');
+    expect(successor.missions.map((m) => m.missionId)).toEqual(['mission-keep']);
+
+    // Persisted for a fresh reader.
+    const fresh = await service().get(existing.id);
+    expect(fresh.version).toBe(2);
+    expect(fresh.title).toBe('Accepted Successor Title');
+  });
+
+  it('refuses structurally-invalid imports with a typed error and creates nothing', async () => {
+    const cases: Array<{ name: string; body: string }> = [
+      { name: 'missing-title.yaml', body: yaml.dump({ id: 'x', status: 'draft' }) },
+      {
+        name: 'bad-status.yaml',
+        body: yaml.dump(importFixture({ status: 'not-a-status' as PrdDocument['status'] })),
+      },
+      {
+        name: 'bad-version.yaml',
+        body: yaml.dump(importFixture({ version: 0 })),
+      },
+      { name: 'not-yaml.yaml', body: '::: not yaml [\n  - {' },
+    ];
+
+    for (const fixture of cases) {
+      const filePath = path.join(projectDir, fixture.name);
+      await writeFile(filePath, fixture.body, 'utf8');
+
+      await expect(service().importDocument({ filePath })).rejects.toBeInstanceOf(
+        PrdImportInvalidError,
+      );
+    }
+
+    // Nothing was created: the authority store does not even exist yet.
+    await expect(readdir(storeDir())).rejects.toMatchObject({ code: 'ENOENT' });
+  });
+
+  it('acceptSuccessor refuses when there is no existing document to succeed', async () => {
+    const filePath = await writeImportFile(importFixture());
+    await expect(service().acceptSuccessor({ filePath })).rejects.toBeInstanceOf(PrdNotFoundError);
+  });
+});
+
+// ── No second writer: no code path reads exported Markdown back into authority ─
+
+describe('no-second-writer invariant (source-level)', () => {
+  // Resolve the package source dir whether vitest runs from the package root
+  // (turbo/pnpm test) or from the worktree root.
+  function resolveSrcDir(): string {
+    const candidates = [path.resolve('src'), path.resolve('packages/prdy/src')];
+    return candidates.find((dir) => existsSync(path.join(dir, 'service.ts'))) ?? candidates[0]!;
+  }
+
+  const srcDir = resolveSrcDir();
+  const sourceFiles = [
+    'cli.ts',
+    'index.ts',
+    'prd.ts',
+    'service.ts',
+    'templates.ts',
+    'types.ts',
+    'wizard.ts',
+  ];
+
+  it('no source file in @mosaicstack/prdy reads a .md file', async () => {
+    for (const file of sourceFiles) {
+      const text = await readFile(path.join(srcDir, file), 'utf8');
+      const readLines = text
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => /readFile|readFileSync|createReadStream/.test(line));
+
+      for (const line of readLines) {
+        expect(line.includes('.md'), `${file} reads a Markdown file: ${line}`).toBe(false);
+      }
+    }
+  });
+
+  it('the mosaic prdy/mission adapters never read a .md file', async () => {
+    const adapterDir = path.resolve(srcDir, '..', '..', 'mosaic', 'src', 'commands');
+    for (const file of ['prdy.ts', 'mission.ts']) {
+      const text = await readFile(path.join(adapterDir, file), 'utf8');
+      expect(text.includes("'.md'") || text.includes('.md`'), `${file} references a .md path`).toBe(
+        false,
+      );
+    }
+  });
+});

packages/prdy/src/service.ts

@@ -0,0 +1,379 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+
+import yaml from 'js-yaml';
+
+import { createPrd, listPrds, parsePrdDocument, prdDirectory, savePrd } from './prd.js';
+import type {
+  PrdCreateInput,
+  PrdDocument,
+  PrdExportInput,
+  PrdExportResult,
+  PrdImportInput,
+  PrdImportResult,
+  PrdLinkMissionInput,
+  PrdMissionLinkage,
+  PrdPlanForMissionInput,
+  PrdServiceOptions,
+  PrdUpdateInput,
+} from './types.js';
+
+/**
+ * PrdService is the SINGLE authority surface for PRD documents.
+ *
+ * Every mutation path (CLI wizard, `mosaic mission --plan`, import) routes
+ * through this service; the YAML store under `docs/prdy/` is the authority and
+ * exported Markdown is a generated view that no code path reads back.
+ */
+
+// ── Typed errors ───────────────────────────────────────────────────────────────
+
+export class PrdError extends Error {
+  constructor(
+    message: string,
+    readonly code: string,
+  ) {
+    super(message);
+    this.name = 'PrdError';
+  }
+}
+
+export class PrdNotFoundError extends PrdError {
+  constructor(message: string) {
+    super(message, 'PRD_NOT_FOUND');
+    this.name = 'PrdNotFoundError';
+  }
+}
+
+export class PrdUpdateError extends PrdError {
+  constructor(message: string) {
+    super(message, 'PRD_UPDATE_INVALID');
+    this.name = 'PrdUpdateError';
+  }
+}
+
+/** Structural refusal: the import payload failed schema validation. Nothing is written. */
+export class PrdImportInvalidError extends PrdError {
+  constructor(
+    message: string,
+    readonly issues?: string,
+  ) {
+    super(message, 'PRD_IMPORT_INVALID');
+    this.name = 'PrdImportInvalidError';
+  }
+}
+
+/**
+ * Conflict refusal: an existing PRD shares the imported id but the content
+ * diverges. Carries a PROPOSED successor (existing version + 1) that is only
+ * persisted via an explicit {@link PrdService.acceptSuccessor} call — import
+ * never overwrites and never merges.
+ */
+export class PrdImportConflictError extends PrdError {
+  constructor(
+    message: string,
+    readonly existing: PrdDocument,
+    readonly proposal: PrdDocument,
+  ) {
+    super(message, 'PRD_IMPORT_CONFLICT');
+    this.name = 'PrdImportConflictError';
+  }
+}
+
+// ── Service ────────────────────────────────────────────────────────────────────
+
+/** The generated-view label carried by every Markdown export. */
+export const PRD_GENERATED_VIEW_LABEL = 'generated view — do not edit';
+
+export class PrdService {
+  private readonly projectPath: string;
+
+  constructor(options: PrdServiceOptions) {
+    this.projectPath = options.projectPath;
+  }
+
+  /** Create a new PRD (version 1, draft) in the authority store. */
+  async create(input: PrdCreateInput): Promise<PrdDocument> {
+    return createPrd({
+      name: input.name,
+      projectPath: this.projectPath,
+      template: input.template,
+      interactive: false,
+    });
+  }
+
+  /** Read a PRD by id, or the most recently updated one. */
+  async get(id?: string): Promise<PrdDocument> {
+    const documents = await listPrds(this.projectPath);
+
+    if (id === undefined) {
+      const latest = documents[0];
+      if (latest === undefined) {
+        throw new PrdNotFoundError(`No PRD documents found under docs/prdy/ for this project`);
+      }
+      return latest;
+    }
+
+    const match = documents.find((doc) => doc.id === id);
+    if (match === undefined) {
+      throw new PrdNotFoundError(`PRD id not found: ${id}`);
+    }
+    return match;
+  }
+
+  /** List all PRDs in the authority store (most recently updated first). */
+  async list(): Promise<PrdDocument[]> {
+    return listPrds(this.projectPath);
+  }
+
+  /**
+   * Apply section field patches and bump the content version.
+   * Linkage entries are preserved; linkage writes do NOT bump the version.
+   */
+  async update(input: PrdUpdateInput): Promise<PrdDocument> {
+    const doc = await this.get(input.id);
+
+    for (const patch of input.sections) {
+      const section = doc.sections.find((candidate) => candidate.id === patch.id);
+      if (section === undefined) {
+        throw new PrdUpdateError(`Unknown section id: ${patch.id}`);
+      }
+      for (const [field, value] of Object.entries(patch.fields)) {
+        if (!(field in section.fields)) {
+          throw new PrdUpdateError(`Unknown field "${field}" on section "${patch.id}"`);
+        }
+        section.fields[field] = value;
+      }
+    }
+
+    doc.version += 1;
+    doc.updatedAt = new Date().toISOString();
+    await savePrd(doc);
+    return doc;
+  }
+
+  /**
+   * Record (or refresh) a mission ↔ PRD linkage on the PRD document.
+   * Persisted in the YAML authority, so it survives restarts.
+   */
+  async linkMission(input: PrdLinkMissionInput): Promise<PrdDocument> {
+    const doc = await this.get(input.prdId);
+    return this.applyLinkage(doc, input);
+  }
+
+  /** Read back the mission linkages recorded on a PRD. */
+  async listMissionLinks(prdId?: string): Promise<PrdMissionLinkage[]> {
+    const doc = await this.get(prdId);
+    return doc.missions;
+  }
+
+  /**
+   * Mission planning path: create a PRD for a mission AND persist the
+   * mission↔PRD linkage in a single authority write.
+   */
+  async planForMission(input: PrdPlanForMissionInput): Promise<PrdDocument> {
+    const doc = await this.create({ name: input.name, template: input.template });
+    return this.applyLinkage(doc, {
+      prdId: doc.id,
+      missionId: input.missionId,
+      missionVersion: input.missionVersion,
+      requirementIds: input.requirementIds,
+    });
+  }
+
+  /**
+   * Render the PRD to a Markdown GENERATED VIEW.
+   *
+   * The output carries source identity (PRD id + version + generated-view
+   * label). It is written under `docs/prdy/<id>.md` and is NEVER read back:
+   * the authority store only loads `.yaml`/`.yml` files, and no code path in
+   * this package parses the exported Markdown.
+   */
+  async exportMarkdown(input?: PrdExportInput): Promise<PrdExportResult> {
+    const doc = await this.get(input?.id);
+    const content = renderMarkdown(doc);
+    const filePath = input?.outPath ?? path.join(prdDirectory(doc.projectPath), `${doc.id}.md`);
+
+    await fs.mkdir(path.dirname(filePath), { recursive: true });
+    await fs.writeFile(filePath, content, 'utf8');
+    return { filePath, content };
+  }
+
+  /**
+   * Import a YAML PRD document.
+   *
+   * Structural validation (zod) happens BEFORE anything is proposed or
+   * written. A structurally-valid import is persisted as `draft` — validity is
+   * NOT approval. If an existing PRD shares the id with divergent content, a
+   * typed {@link PrdImportConflictError} is thrown carrying a proposed
+   * successor; the original authority document is left byte-identical on disk.
+   */
+  async importDocument(input: PrdImportInput): Promise<PrdImportResult> {
+    const incoming = await this.readImportFile(input.filePath);
+
+    const existing = (await listPrds(this.projectPath)).find((doc) => doc.id === incoming.id);
+    if (existing === undefined) {
+      const document = this.buildImportedDocument(incoming);
+      await savePrd(document);
+      return { kind: 'created', document };
+    }
+
+    if (canonicalCore(existing) === canonicalCore(incoming)) {
+      return { kind: 'identical', document: existing };
+    }
+
+    throw new PrdImportConflictError(
+      `PRD id "${incoming.id}" already exists with divergent content — refusing to overwrite. ` +
+        `Proposed successor: version ${existing.version + 1} (draft). ` +
+        `Accept explicitly with acceptSuccessor().`,
+      existing,
+      this.buildSuccessor(existing, incoming),
+    );
+  }
+
+  /**
+   * Explicitly accept a conflicted import as a successor version of the
+   * existing PRD. Re-validates the source file before writing; the successor
+   * is persisted with status `draft` (acceptance of the import is not approval
+   * of the PRD) and the existing mission linkages are carried forward.
+   */
+  async acceptSuccessor(input: PrdImportInput): Promise<PrdDocument> {
+    const incoming = await this.readImportFile(input.filePath);
+
+    const existing = (await listPrds(this.projectPath)).find((doc) => doc.id === incoming.id);
+    if (existing === undefined) {
+      throw new PrdNotFoundError(
+        `No existing PRD with id "${incoming.id}" — use importDocument to create it`,
+      );
+    }
+
+    const successor = this.buildSuccessor(existing, incoming);
+    await savePrd(successor);
+    return successor;
+  }
+
+  // ── internals ──────────────────────────────────────────────────────────────
+
+  private async applyLinkage(doc: PrdDocument, input: PrdLinkMissionInput): Promise<PrdDocument> {
+    const entry: PrdMissionLinkage = {
+      missionId: input.missionId,
+      missionVersion: input.missionVersion,
+      prdVersion: doc.version,
+      requirementIds: input.requirementIds ?? [],
+      linkedAt: new Date().toISOString(),
+    };
+
+    // One entry per mission: refresh in place if the mission is already linked.
+    const index = doc.missions.findIndex((m) => m.missionId === entry.missionId);
+    if (index === -1) {
+      doc.missions.push(entry);
+    } else {
+      doc.missions[index] = entry;
+    }
+
+    // Linkage is mission-side metadata, not a content revision: bump the
+    // timestamp only so ids/versions stay stable for consumers.
+    doc.updatedAt = new Date().toISOString();
+    await savePrd(doc);
+    return doc;
+  }
+
+  private async readImportFile(filePath: string): Promise<PrdDocument> {
+    let raw: string;
+    try {
+      raw = await fs.readFile(filePath, 'utf8');
+    } catch (error) {
+      throw new PrdImportInvalidError(`Cannot read import file ${filePath}: ${String(error)}`);
+    }
+
+    let parsed: unknown;
+    try {
+      parsed = yaml.load(raw);
+    } catch (error) {
+      throw new PrdImportInvalidError(`Import file is not valid YAML: ${String(error)}`);
+    }
+
+    try {
+      return parsePrdDocument(parsed);
+    } catch (error) {
+      throw new PrdImportInvalidError(
+        `Import file failed PRD schema validation: ${filePath}`,
+        error instanceof Error ? error.message : String(error),
+      );
+    }
+  }
+
+  private buildImportedDocument(incoming: PrdDocument): PrdDocument {
+    const now = new Date().toISOString();
+    return {
+      ...incoming,
+      // The import lands in THIS project's authority store.
+      projectPath: this.projectPath,
+      // A structurally-valid import is not thereby approved.
+      status: 'draft',
+      version: 1,
+      missions: [],
+      createdAt: now,
+      updatedAt: now,
+    };
+  }
+
+  private buildSuccessor(existing: PrdDocument, incoming: PrdDocument): PrdDocument {
+    return {
+      ...incoming,
+      id: existing.id,
+      projectPath: existing.projectPath,
+      status: 'draft',
+      version: existing.version + 1,
+      missions: existing.missions,
+      createdAt: existing.createdAt,
+      updatedAt: new Date().toISOString(),
+    };
+  }
+}
+
+// ── Markdown rendering (generated view) ───────────────────────────────────────
+
+function canonicalCore(doc: PrdDocument): string {
+  return JSON.stringify([doc.title, doc.template, doc.sections]);
+}
+
+function renderMarkdown(doc: PrdDocument): string {
+  const lines: string[] = [
+    '<!--',
+    `${PRD_GENERATED_VIEW_LABEL}`,
+    `source-of-truth: docs/prdy/${doc.id}.yaml (YAML authority)`,
+    `prd-id: ${doc.id}`,
+    `prd-version: ${doc.version}`,
+    `generated-at: ${new Date().toISOString()}`,
+    '-->',
+    '',
+    `# ${doc.title}`,
+    '',
+    `**Status:** ${doc.status} · **Version:** ${doc.version} · **Template:** ${doc.template}`,
+    '',
+  ];
+
+  if (doc.missions.length > 0) {
+    lines.push('## Mission Linkage', '');
+    for (const mission of doc.missions) {
+      const requirements =
+        mission.requirementIds.length > 0 ? mission.requirementIds.join(', ') : 'none selected';
+      lines.push(
+        `- mission \`${mission.missionId}\` @ version \`${mission.missionVersion}\`` +
+          ` (linked at PRD v${mission.prdVersion}) — requirements: ${requirements}`,
+      );
+    }
+    lines.push('');
+  }
+
+  for (const section of doc.sections) {
+    lines.push(`## ${section.title}`, '');
+    for (const [field, value] of Object.entries(section.fields)) {
+      lines.push(`### ${field}`, '', value.trim().length > 0 ? value : '_Not set_.', '');
+    }
+  }
+
+  lines.push('---', '', `_End of generated view for ${doc.id} v${doc.version}._`, '');
+  return lines.join('\n');
+}

packages/prdy/src/types.ts

@@ -19,13 +19,31 @@ export interface PrdSection {
   fields: Record<string, string>;
 }
 
+/**
+ * Mission ↔ PRD linkage recorded on the PRD document (the YAML authority).
+ *
+ * `missionVersion` is the mission-side revision marker available to the CLI
+ * (the gateway exposes `updatedAt` for missions — there is no numeric mission
+ * version yet). `prdVersion` snapshots the PRD content version at link time.
+ */
+export interface PrdMissionLinkage {
+  missionId: string;
+  missionVersion: string;
+  prdVersion: number;
+  requirementIds: string[];
+  linkedAt: string;
+}
+
 export interface PrdDocument {
   id: string;
   title: string;
   status: PrdStatus;
   projectPath: string;
   template: string;
+  /** Content revision counter. Bumped by updates and accepted imports. */
+  version: number;
   sections: PrdSection[];
+  missions: PrdMissionLinkage[];
   createdAt: string;
   updatedAt: string;
 }
@@ -36,3 +54,60 @@ export interface CreatePrdOptions {
   template?: string;
   interactive?: boolean;
 }
+
+// ── PrdService surface (single authority entry point) ─────────────────────────
+
+export interface PrdServiceOptions {
+  projectPath: string;
+}
+
+export interface PrdCreateInput {
+  name: string;
+  template?: string;
+}
+
+export interface PrdSectionPatch {
+  id: string;
+  fields: Record<string, string>;
+}
+
+export interface PrdUpdateInput {
+  /** Defaults to the most recently updated PRD. */
+  id?: string;
+  sections: PrdSectionPatch[];
+}
+
+export interface PrdLinkMissionInput {
+  /** Defaults to the most recently updated PRD. */
+  prdId?: string;
+  missionId: string;
+  missionVersion: string;
+  requirementIds?: string[];
+}
+
+export interface PrdPlanForMissionInput extends PrdLinkMissionInput {
+  name: string;
+  template?: string;
+}
+
+export interface PrdExportInput {
+  /** Defaults to the most recently updated PRD. */
+  id?: string;
+  /** Override the generated-view output path. */
+  outPath?: string;
+}
+
+export interface PrdExportResult {
+  filePath: string;
+  content: string;
+}
+
+/** Discriminated result of a non-conflicting import. */
+export type PrdImportResult =
+  | { kind: 'created'; document: PrdDocument }
+  | { kind: 'identical'; document: PrdDocument };
+
+export interface PrdImportInput {
+  /** Path to a YAML-serialized PRD document (NOT the generated Markdown view). */
+  filePath: string;
+}

packages/prdy/src/wizard.ts

@@ -2,8 +2,8 @@ import path from 'node:path';
 
 import { cancel, intro, isCancel, outro, select, text } from '@clack/prompts';
 
-import { createPrd, savePrd } from './prd.js';
-import type { CreatePrdOptions, PrdDocument } from './types.js';
+import { PrdService } from './service.js';
+import type { CreatePrdOptions, PrdDocument, PrdSectionPatch } from './types.js';
 
 interface WizardAnswers {
   goals: string;
@@ -11,20 +11,41 @@ interface WizardAnswers {
   milestones: string;
 }
 
-function updateSectionField(doc: PrdDocument, sectionKeyword: string, value: string): void {
-  const section = doc.sections.find((candidate) => candidate.id.includes(sectionKeyword));
+/**
+ * Translate wizard answers into section patches using the same keyword
+ * matching the wizard always used (first section whose id contains the
+ * keyword, then first field whose name contains it, else first field).
+ */
+function buildWizardPatches(doc: PrdDocument, answers: WizardAnswers): PrdSectionPatch[] {
+  const bySection = new Map<string, PrdSectionPatch>();
 
-  if (section === undefined) {
-    return;
-  }
+  const add = (keyword: string, value: string): void => {
+    const section = doc.sections.find((candidate) => candidate.id.includes(keyword));
+    if (section === undefined) {
+      return;
+    }
 
-  const fieldName =
-    Object.keys(section.fields).find((field) => field.toLowerCase().includes(sectionKeyword)) ??
-    Object.keys(section.fields)[0];
+    const fieldName =
+      Object.keys(section.fields).find((field) => field.toLowerCase().includes(keyword)) ??
+      Object.keys(section.fields)[0];
 
-  if (fieldName !== undefined) {
-    section.fields[fieldName] = value;
-  }
+    if (fieldName === undefined || section.fields[fieldName] === value) {
+      return;
+    }
+
+    const existing = bySection.get(section.id);
+    if (existing === undefined) {
+      bySection.set(section.id, { id: section.id, fields: { [fieldName]: value } });
+    } else {
+      existing.fields[fieldName] = value;
+    }
+  };
+
+  add('goal', answers.goals);
+  add('constraint', answers.constraints);
+  add('milestone', answers.milestones);
+
+  return [...bySection.values()];
 }
 
 async function promptText(message: string, initialValue = ''): Promise<string> {
@@ -63,15 +84,10 @@ async function promptTemplate(template?: string): Promise<string> {
   return choice;
 }
 
-function applyWizardAnswers(doc: PrdDocument, answers: WizardAnswers): PrdDocument {
-  updateSectionField(doc, 'goal', answers.goals);
-  updateSectionField(doc, 'constraint', answers.constraints);
-  updateSectionField(doc, 'milestone', answers.milestones);
-
-  doc.updatedAt = new Date().toISOString();
-  return doc;
-}
-
+/**
+ * Interactive PRD wizard. All writes go through PrdService — the wizard is a
+ * prompt layer, never a second writer path.
+ */
 export async function runPrdWizard(options: CreatePrdOptions): Promise<PrdDocument> {
   intro('Mosaic PRD wizard');
 
@@ -82,20 +98,15 @@ export async function runPrdWizard(options: CreatePrdOptions): Promise<PrdDocume
   const constraints = await promptText('Key constraints');
   const milestones = await promptText('Planned milestones');
 
-  const doc = await createPrd({
-    ...options,
+  const service = new PrdService({ projectPath: options.projectPath });
+  const doc = await service.create({
     name,
     template,
-    interactive: true,
   });
 
-  const updated = applyWizardAnswers(doc, {
-    goals,
-    constraints,
-    milestones,
-  });
-
-  await savePrd(updated);
+  const patches = buildWizardPatches(doc, { goals, constraints, milestones });
+  const updated =
+    patches.length > 0 ? await service.update({ id: doc.id, sections: patches }) : doc;
 
   outro(`PRD created: ${path.join(updated.projectPath, 'docs', 'prdy', `${updated.id}.yaml`)}`);
 

scratchpads/ri-4-001-prd-authority.md

@@ -0,0 +1,37 @@
+# Scratchpad — RI-4-001 One transitional PRD authority (RI-N3, #1275)
+
+- Objective: single PrdService authority in `@mosaicstack/prdy`; `mosaic prdy` and
+  `mission --plan` become thin adapters; mission↔PRD linkage persisted on disk;
+  Markdown export is a labeled generated view (never read back); import is
+  validated/conflict-aware with typed refusals.
+- Budget: ~35K tokens (card cap). Baselines: prdy build/lint rc=0, 0 tests;
+  mosaic build rc=0 (after root turbo build), lint rc=0, 1548 tests pass;
+  root build rc=0.
+- Plan: (1) extend store schema (version, missions linkage) (2) PrdService +
+  typed errors (3) wizard/cli route through service (4) mosaic adapters
+  (5) contract specs both packages (6) gates (7) sabotage control (8) report
+  to /var/tmp/ri-050/ri-4-001-report.md.
+- Decisions:
+  - Linkage lives ON the PRD document (`missions` array) — one authority file,
+    survives restart, no sidecar sync problems.
+  - `version` = content revision of sections/status (bumped by update/import
+    accept). Linkage writes bump `updatedAt` only, so ids/versions stay stable
+    for the card's "stable ids/versions" contract.
+  - Mission version marker = `mission.updatedAt` (gateway MissionInfo has no
+    numeric version field).
+  - Import reads YAML documents only — never the exported Markdown (keeps the
+    "no code path reads exported Markdown" invariant).
+  - Import of an existing id with identical core content → `identical` no-op;
+    divergent → typed `PrdImportConflictError` carrying proposed successor
+    (existing.version + 1, status draft, linkages preserved). Original bytes
+    untouched until explicit `acceptSuccessor`.
+  - `requirementIds` default `[]` at the mission command (no requirement
+    selection UI yet) — service accepts ids when a caller has them.
+- Progress log:
+  - [16:35] baselines captured (prdy 0 tests; mosaic 1548 after root build; root build rc=0)
+  - [16:38] store schema v2 + PrdService + wizard/cli rerouted; prdy build/lint green
+  - [16:40] mosaic adapters done; prdy spec 20/20 (found+fixed: import project-path leak, empty-store typed error, YAML timestamp coercion)
+  - [16:44] mosaic specs 9/9 (fixed commander from:'user' argv, vi.mock hoisting, restoreAllMocks wiping factory mocks)
+  - [16:45] all gates green; 4 commits (e291bfb, 2c5d208, a23826c, 540d6f1)
+  - [16:46] sabotage: linkage write removed → prdy 3 fail / mosaic 2 fail, 1548/1548 pre-existing pass; restored byte-identically; re-green 20/20 + 1557/1557
+  - [16:47] report written to /var/tmp/ri-050/ri-4-001-report.md — card complete

tools/install.sh

@@ -309,6 +309,124 @@ require_cmd() {
   fi
 }
 
+# True if any shell rc file already puts $1 on PATH.
+#
+# Each file is tested for existence first and grepped one at a time, rather than
+# handed to a single `grep -qs ... "${rc_files[@]}"`. Handing grep a missing file
+# makes the exit status implementation-defined: GNU grep 3.11 returns 0 when -q
+# matched an earlier file, ugrep 7.5 returns 2 for the missing one regardless.
+# On the 2 path the caller reads "not present yet" and appends a duplicate PATH
+# line on every single install.
+path_entry_exists() {
+  local dir="$1" rc_file
+  for rc_file in "$HOME/.profile" "$HOME/.zshenv" "$HOME/.zshrc" "$HOME/.bashrc"; do
+    if [[ -f "$rc_file" ]] && grep -qF "$dir" "$rc_file"; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+# Append `export PATH="$1:$PATH"` to the shell profile so $1 survives this
+# process. An `export` here reaches only the installer; every directory the
+# install leaves behind has to be written down somewhere a later shell reads.
+#
+# Deliberately NOT ~/.bashrc: Debian's default .bashrc returns early for
+# non-interactive shells, so a PATH line appended to the bottom of it is
+# unreachable to `bash -lc`, to systemd units, and to every agent seat — the
+# exact consumers that need these binaries. ~/.profile is read by login shells
+# and Debian's .profile sources .bashrc for interactive ones, so a single line
+# there reaches both. For zsh the always-sourced file is .zshenv, not .zshrc.
+#
+# $1 = directory to add, $2 = label for the comment line.
+# Returns 1 (having warned) if the profile could not be written.
+persist_on_path() {
+  local dir="$1" label="$2" profile
+
+  if path_entry_exists "$dir"; then
+    return 0
+  fi
+
+  if [[ -n "${ZSH_VERSION:-}" ]] || [[ "$(basename "${SHELL:-}")" == "zsh" ]]; then
+    profile="$HOME/.zshenv"
+  else
+    profile="$HOME/.profile"
+  fi
+
+  # Probe writability in a subshell. A redirection failure on a special built-in
+  # aborts the shell it runs in, so it has to be a child; and the redirection on
+  # the subshell is what silences the "Permission denied" the shell would
+  # otherwise print ahead of our own message.
+  if ! ( : >>"$profile" ) 2>/dev/null; then
+    warn "$dir is not on your PATH and $profile could not be written"
+    dim "  Add to your shell rc:  export PATH=\"$dir:\$PATH\""
+    return 1
+  fi
+
+  {
+    echo ""
+    echo "# $label"
+    echo "export PATH=\"$dir:\$PATH\""
+  } >>"$profile"
+  ok "Added $dir to PATH in $profile"
+  return 0
+}
+
+# Persist $PREFIX/bin on PATH instead of only warning about it.
+#
+# The warning it replaces was the last step of an otherwise successful install,
+# so the installer reported success and left `mosaic: command not found` — an
+# unattended install had no operator to read the advice and act on it.
+ensure_prefix_on_path() {
+  if [[ ":$PATH:" == *":$PREFIX/bin:"* ]]; then
+    return
+  fi
+
+  if path_entry_exists "$PREFIX/bin"; then
+    warn "$PREFIX/bin is in your shell profile but not in this shell"
+  elif ! persist_on_path "$PREFIX/bin" "Mosaic CLI"; then
+    return
+  fi
+  dim "  Run:  export PATH=\"$PREFIX/bin:\$PATH\"   (or start a new login shell)"
+}
+
+# Fleet transport binary (#1240).
+#
+# `mosaic fleet --help` reads "Manage the local Mosaic tmux fleet" and every
+# roster the CLI scaffolds sets `transport: tmux`, but nothing in this script
+# provides tmux and, until now, nothing in it mentioned tmux at all. A
+# greenfield host came out of this installer able to install a fleet, start a
+# fleet, and run no seat — the operator's first signal was `mosaic fleet ps`.
+#
+# Not a `require_cmd`: tmux is required by the fleet, not by mosaic. Plenty of
+# hosts install this to run `mosaic claude` and will never scaffold a roster,
+# and failing their install over a binary they do not need would be wrong. It
+# is a warning that names precisely what it blocks.
+#
+# `tools/_scripts/mosaic-doctor` carries a deliberately parallel check, so the
+# same host state gets the same answer from an audit as from an install. They
+# are separate implementations because this one has to work before the
+# framework's scripts are guaranteed to be on disk; keep their wording in step.
+check_fleet_transport() {
+  local transport=tmux
+  local roster="$MOSAIC_HOME/fleet/roster.yaml"
+  local declared=""
+
+  if [[ -f "$roster" ]]; then
+    declared="$(sed -n 's/^[[:space:]]*transport:[[:space:]]*//p' "$roster" | head -1 |
+      tr -d '"'\''' | tr -d '\r' | awk '{print $1}')"
+    [[ -n "$declared" ]] && transport="$declared"
+  fi
+
+  command -v "$transport" &>/dev/null && return 0
+
+  warn "Fleet transport '$transport' is not installed."
+  echo "  The Mosaic fleet runs its agent seats inside $transport. Without it,"
+  echo "  ${C}mosaic fleet start${RESET} reports success and no seat comes up."
+  echo "  Install it before using the fleet, e.g. ${C}sudo apt-get install -y $transport${RESET}"
+  echo "  (this does not affect ${C}mosaic claude${RESET} or the other single-runtime commands)."
+}
+
 installed_cli_version() {
   local json
   json="$(npm ls -g --depth=0 --json --prefix="$PREFIX" 2>/dev/null)" || true
@@ -516,8 +634,175 @@ install_next_cli_from_registry() {
   ok "Installed @next packages: CLI ${installed_cli}, gateway ${installed_gateway}"
 }
 
+# ─── node bootstrap ───────────────────────────────────────────────────────────
+#
+# Nothing on a greenfield host installs Node.js, yet this installer and the CLI
+# it installs both hard-require it. Measured on a clean Debian 13 image: the
+# installer stopped at `require_cmd node` with "Required command not found" and
+# nothing was installed, with no hint of how to proceed.
+#
+# Inlined rather than factored into a sibling file on purpose: this script is
+# fetched standalone by curl and has nothing to source.
+#
+# No-op when a suitable node is already on PATH, so it never fights an
+# operator's nvm/fnm/distro node.
+
+NODE_ROOT="${MOSAIC_NODE_ROOT:-$HOME/.mosaic/node}"
+NODE_BOOTSTRAP_VERSION="${MOSAIC_NODE_VERSION:-v22.23.2}"
+NODE_MIN_MAJOR="${MOSAIC_NODE_MIN_MAJOR:-20}"
+NODE_DIST_BASE="${MOSAIC_NODE_DIST_BASE:-https://nodejs.org/dist}"
+
+# Major version of the node at $1, or empty if it will not run.
+node_major_of() {
+  local candidate="$1" version
+  version="$("$candidate" -e 'process.stdout.write(process.versions.node)' 2>/dev/null)" || return 0
+  printf '%s' "${version%%.*}"
+}
+
+node_is_suitable() {
+  local major
+  major="$(node_major_of "$1")"
+  [[ -n "$major" ]] && [[ "$major" -ge "$NODE_MIN_MAJOR" ]]
+}
+
+install_node() {
+  local node_os node_arch tarball release_url work_dir extracted target node_bin
+
+  case "$(uname -s)" in
+    Linux)  node_os="linux" ;;
+    Darwin) node_os="darwin" ;;
+    *) fail "Unsupported OS '$(uname -s)'. Install Node.js >= $NODE_MIN_MAJOR manually."; return 1 ;;
+  esac
+
+  # Linux here means glibc. Node's official linux-x64 build is dynamically
+  # linked against glibc, so on musl (Alpine) the binary will not exec — but it
+  # fails visibly: node_is_suitable rejects it and ensure_node exits with
+  # "install Node.js manually". No silent breakage, just a wasted download.
+  # A musl host needs the unofficial build, which is out of scope here.
+  case "$(uname -m)" in
+    x86_64|amd64)  node_arch="x64" ;;
+    aarch64|arm64) node_arch="arm64" ;;
+    armv7l)        node_arch="armv7l" ;;
+    *) fail "Unsupported architecture '$(uname -m)'. Install Node.js >= $NODE_MIN_MAJOR manually."; return 1 ;;
+  esac
+
+  # .tar.gz rather than the smaller .tar.xz: gzip is universally present, xz is
+  # not, and a minimal image is exactly the case this exists to handle.
+  tarball="node-${NODE_BOOTSTRAP_VERSION}-${node_os}-${node_arch}.tar.gz"
+  release_url="${NODE_DIST_BASE}/${NODE_BOOTSTRAP_VERSION}"
+
+  work_dir="$(mktemp -d "${TMPDIR:-/tmp}/mosaic-node-XXXXXX")"
+
+  info "Installing Node.js $NODE_BOOTSTRAP_VERSION ($node_os-$node_arch) to $NODE_ROOT…"
+
+  if ! curl -fsSL "${release_url}/${tarball}" -o "$work_dir/$tarball"; then
+    fail "Download failed: ${release_url}/${tarball}"
+    rm -rf "$work_dir"; return 1
+  fi
+
+  # Trust assumption, stated so nobody has to infer it: this verifies INTEGRITY
+  # (the tarball matches the manifest), not AUTHENTICITY (the manifest is
+  # genuinely Node's). The only thing establishing that is TLS to
+  # $NODE_DIST_BASE. Node publishes SHASUMS256.txt.sig signed by its release
+  # keys and we do not check it, which is on par with nvm but means pointing
+  # MOSAIC_NODE_DIST_BASE at an untrusted mirror has no signature backstop.
+  # Tracked as a hardening follow-up (raised by scooby in the #1229 review).
+  if ! curl -fsSL "${release_url}/SHASUMS256.txt" -o "$work_dir/SHASUMS256.txt"; then
+    fail "Could not fetch SHASUMS256.txt; refusing to install an unverified runtime."
+    rm -rf "$work_dir"; return 1
+  fi
+
+  # Keep only our artifact's line, so a missing entry is an error not a pass.
+  if ! grep " ${tarball}\$" "$work_dir/SHASUMS256.txt" >"$work_dir/expected.sha256"; then
+    fail "$tarball has no entry in SHASUMS256.txt; refusing to install."
+    rm -rf "$work_dir"; return 1
+  fi
+
+  if ! (cd "$work_dir" && verify_sha256 expected.sha256); then
+    fail "Checksum mismatch for $tarball; refusing to install."
+    rm -rf "$work_dir"; return 1
+  fi
+  ok "Checksum verified"
+
+  tar xzf "$work_dir/$tarball" -C "$work_dir"
+  extracted="$work_dir/node-${NODE_BOOTSTRAP_VERSION}-${node_os}-${node_arch}"
+  if [[ ! -x "$extracted/bin/node" ]]; then
+    fail "Extracted archive has no bin/node"
+    rm -rf "$work_dir"; return 1
+  fi
+
+  mkdir -p "$NODE_ROOT"
+  target="$NODE_ROOT/$NODE_BOOTSTRAP_VERSION"
+  rm -rf "$target.incoming"
+  mv "$extracted" "$target.incoming"
+  rm -rf "$target"
+  mv "$target.incoming" "$target"
+  ln -sfn "$NODE_BOOTSTRAP_VERSION" "$NODE_ROOT/current"
+  rm -rf "$work_dir"
+
+  node_bin="$NODE_ROOT/current/bin"
+  if ! node_is_suitable "$node_bin/node"; then
+    fail "Installed node at $node_bin/node did not run"
+    return 1
+  fi
+
+  export PATH="$node_bin:$PATH"
+  ok "Node.js $(node -v) installed with npm $(npm -v 2>/dev/null || echo '?')"
+  return 0
+}
+
+# Make the Mosaic-managed Node reachable from the next shell as well as this
+# one. Measured on a greenfield canary run: without this the install finished
+# rc=0, wrote $PREFIX/bin to ~/.profile, and the next login shell found `mosaic`
+# and then died on `env: 'node': No such file or directory` — the CLI is a Node
+# script, so a CLI on PATH without its runtime is a successful install that
+# produces a broken command.
+persist_node_on_path() {
+  persist_on_path "$NODE_ROOT/current/bin" "Mosaic-managed Node.js" || true
+}
+
+ensure_node() {
+  if command -v node &>/dev/null && node_is_suitable node; then
+    return 0
+  fi
+
+  # A previous run may have installed one that is not on this shell's PATH.
+  if node_is_suitable "$NODE_ROOT/current/bin/node"; then
+    export PATH="$NODE_ROOT/current/bin:$PATH"
+    persist_node_on_path
+    return 0
+  fi
+
+  if [[ "${MOSAIC_SKIP_NODE_BOOTSTRAP:-0}" == "1" ]]; then
+    fail "No suitable Node.js and MOSAIC_SKIP_NODE_BOOTSTRAP=1; refusing to download."
+    echo "  Install Node.js >= $NODE_MIN_MAJOR yourself, then re-run this script."
+    exit 1
+  fi
+
+  require_cmd curl
+  require_cmd tar
+
+  # sha256sum on Linux, shasum on macOS. Verification is not optional: without a
+  # checksum this would install an unauthenticated runtime.
+  if command -v sha256sum &>/dev/null; then
+    verify_sha256() { sha256sum -c --status "$1"; }
+  elif command -v shasum &>/dev/null; then
+    verify_sha256() { shasum -a 256 -c --status "$1"; }
+  else
+    fail "sha256sum or shasum required to verify the Node.js download"
+    exit 1
+  fi
+
+  if ! install_node; then
+    fail "Could not bootstrap Node.js. Install Node.js >= $NODE_MIN_MAJOR and re-run."
+    exit 1
+  fi
+  persist_node_on_path
+}
+
 # ─── preflight ────────────────────────────────────────────────────────────────
 
+ensure_node
 require_cmd node
 require_cmd npm
 
@@ -682,11 +967,7 @@ if [[ "$FLAG_CLI" == "true" ]]; then
     ensure_monorepo
     install_cli_from_source
 
-    # PATH check for npm prefix
-    if [[ ":$PATH:" != *":$PREFIX/bin:"* ]]; then
-      warn "$PREFIX/bin is not on your PATH"
-      dim "  Add to your shell rc:  export PATH=\"$PREFIX/bin:\$PATH\""
-    fi
+    ensure_prefix_on_path
   elif is_next_registry_lane; then
     info "Next mode — trying fast npm @next install from ${REGISTRY}…"
     if install_next_cli_from_registry; then
@@ -699,11 +980,7 @@ if [[ "$FLAG_CLI" == "true" ]]; then
       export MOSAIC_GATEWAY_SKIP_NPM_INSTALL=1
     fi
 
-    # PATH check for npm prefix
-    if [[ ":$PATH:" != *":$PREFIX/bin:"* ]]; then
-      warn "$PREFIX/bin is not on your PATH"
-      dim "  Add to your shell rc:  export PATH=\"$PREFIX/bin:\$PATH\""
-    fi
+    ensure_prefix_on_path
   else
     if [[ -z "$LATEST" ]]; then
       warn "Could not reach registry at $REGISTRY — skipping npm CLI."
@@ -721,11 +998,7 @@ if [[ "$FLAG_CLI" == "true" ]]; then
       ok "CLI is at or ahead of registry ($CURRENT ≥ $LATEST)."
     fi
 
-    # PATH check for npm prefix
-    if [[ ":$PATH:" != *":$PREFIX/bin:"* ]]; then
-      warn "$PREFIX/bin is not on your PATH"
-      dim "  Add to your shell rc:  export PATH=\"$PREFIX/bin:\$PATH\""
-    fi
+    ensure_prefix_on_path
   fi
 fi
 
@@ -870,6 +1143,11 @@ if [[ "$FLAG_CHECK" == "false" ]]; then
   ok "Done."
 fi
 
+# Fleet readiness (#1240). Runs in both normal and --check mode: "what is the
+# state of this host" is exactly the question --check is asked, and a host that
+# cannot run a seat should not have to discover it from `fleet ps`.
+check_fleet_transport
+
 } # end main
 
 main "$@"